computing:pix3lfed
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| computing:pix3lfed [2026/03/01 21:46] – oemb1905 | computing:pix3lfed [2026/08/05 17:30] (current) – oemb1905 | ||
|---|---|---|---|
| Line 182: | Line 182: | ||
| < | < | ||
| Options Indexes FollowSymLinks | Options Indexes FollowSymLinks | ||
| - | AllowOverride | + | AllowOverride All ### NOTE " |
| Require all granted | Require all granted | ||
| </ | </ | ||
| Line 205: | Line 205: | ||
| First, let's create the unit file over in '' | First, let's create the unit file over in '' | ||
| - | | + | < |
| - | Description=Pixelfed Horizon Queue Worker | + | [Unit] |
| - | After=network.target apache2.service php8.4-fpm.service redis-server.service mariadb.service | + | Description=Pixelfed Horizon Queue Worker |
| - | Wants=apache2.service php8.4-fpm.service redis-server.service mariadb.service | + | Documentation=https:// |
| - | [Service] | + | After=network.target apache2.service php8.4-fpm.service redis-server.service mariadb.service |
| - | Type=simple | + | Wants=apache2.service php8.4-fpm.service redis-server.service mariadb.service |
| - | User=www-data | + | |
| - | Group=www-data | + | [Service] |
| - | WorkingDirectory=/ | + | Type=simple |
| - | ExecStart=/ | + | User=www-data |
| - | Restart=on-failure | + | Group=www-data |
| - | RestartSec=5s | + | WorkingDirectory=/ |
| - | StandardOutput=journal | + | ExecStart=/ |
| - | StandardError=journal | + | Restart=always |
| - | NoNewPrivileges=yes | + | RestartSec=3 |
| - | PrivateTmp=true | + | StartLimitIntervalSec=0 |
| - | ProtectSystem=strict | + | StandardOutput=journal |
| - | ProtectHome=yes | + | StandardError=journal |
| - | ReadWritePaths=/ | + | |
| - | ReadWritePaths=/ | + | # Security hardening (less restrictive than before) |
| - | [Install] | + | NoNewPrivileges=yes |
| - | WantedBy=multi-user.target | + | PrivateTmp=true |
| + | ProtectSystem=full | ||
| + | ProtectHome=yes | ||
| + | ProtectKernelTunables=yes | ||
| + | ProtectKernelModules=yes | ||
| + | ProtectControlGroups=yes | ||
| + | RestrictSUIDSGID=yes | ||
| + | LockPersonality=yes | ||
| + | RestrictRealtime=yes | ||
| + | |||
| + | # Paths Horizon actually needs to write to | ||
| + | ReadWritePaths=/ | ||
| + | ReadWritePaths=/ | ||
| + | ReadWritePaths=/ | ||
| + | |||
| + | [Install] | ||
| + | WantedBy=multi-user.target | ||
| + | </ | ||
| After you create the unit file, let's reload the daemon, restart the service and check for any errors. Restart all services and check a web browser to see if the instance resolves after restarting the services. | After you create the unit file, let's reload the daemon, restart the service and check for any errors. Restart all services and check a web browser to see if the instance resolves after restarting the services. | ||
| Line 238: | Line 255: | ||
| sudo systemctl reload apache2 | sudo systemctl reload apache2 | ||
| sudo systemctl restart apache2 php8.4-fpm pixelfed.service redis-server | sudo systemctl restart apache2 php8.4-fpm pixelfed.service redis-server | ||
| + | | ||
| + | Lastly, let's create our artisan workers so changes and updates happen automatically. Open up cron for www-data user with '' | ||
| + | |||
| + | < | ||
| + | * * * * * cd / | ||
| + | * * * * * cd / | ||
| + | * * * * * cd / | ||
| + | </ | ||
| At this point, most essential lifts are done. As long as your landing page resolves, which it should by this stage, you can now move on to creating an admin user and then managing the instance via the GUI web panel: | At this point, most essential lifts are done. As long as your landing page resolves, which it should by this stage, you can now move on to creating an admin user and then managing the instance via the GUI web panel: | ||
| Line 260: | Line 285: | ||
| curl -s https:// | curl -s https:// | ||
| curl -s https:// | curl -s https:// | ||
| + | curl -s " | ||
| sudo -u www-data php artisan route:list | grep -i nodeinfo | sudo -u www-data php artisan route:list | grep -i nodeinfo | ||
| + | | ||
| For updating, something like the following is minimally required: | For updating, something like the following is minimally required: | ||
| Line 307: | Line 334: | ||
| EXIT; | EXIT; | ||
| - | This solves the issue and allows users to upload images inside their DMS. | + | This solves the issue and allows users to upload images inside their DMS. Here are the issues that helped me fix this: |
| + | |||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | |||
| + | I'm having an issue where the sql of the instance wrongly uses 19 for the re-issuance of the new client registration. Since this conflicts with 19 being used by the default personal client, it fails. After repeatedly messing with auto-increment according to github iALTER TABLE oauth_clients DROP PRIMARY KEY;ssues and seeing it fail once the keys and passport were re-initialized, | ||
| + | |||
| + | ALTER TABLE oauth_clients MODIFY id INT NOT NULL; | ||
| + | ALTER TABLE oauth_clients DROP PRIMARY KEY; | ||
| + | ALTER TABLE oauth_clients MODIFY id VARCHAR(255) NOT NULL; | ||
| + | ALTER TABLE oauth_clients ADD PRIMARY KEY (id); | ||
| + | DESCRIBE oauth_clients; | ||
| + | EXIT; | ||
| + | cd / | ||
| + | sudo -u www-data php artisan passport: | ||
| + | sudo -u www-data php artisan passport: | ||
| + | sudo / | ||
| + | |||
| + | Once I did this, the '' | ||
| + | |||
| + | https:// | ||
| + | https:// | ||
| + | |||
| + | More coming ... | ||
| - | --- // | + | --- // |
computing/pix3lfed.1772401568.txt.gz · Last modified: by oemb1905
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: GNU Free Documentation License 1.3
