+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
defmodule Pleroma.Web.Endpoint do
use Phoenix.Endpoint, otp_app: :pleroma
- if Application.get_env(:pleroma, :chat) |> Keyword.get(:enabled) do
- socket("/socket", Pleroma.Web.UserSocket)
- end
-
- socket("/api/v1", Pleroma.Web.MastodonAPI.MastodonSocket)
+ socket("/socket", Pleroma.Web.UserSocket)
# Serve at "/" the static files from "priv/static" directory.
#
# You should set gzip to true if you are running phoenix.digest
# when deploying your static files in production.
plug(CORSPlug)
- plug(Pleroma.Plugs.CSPPlug)
+ plug(Pleroma.Plugs.HTTPSecurityPlug)
- plug(Plug.Static, at: "/media", from: Pleroma.Uploaders.Local.upload_path(), gzip: false)
+ plug(Pleroma.Plugs.UploadedMedia)
+
+ # InstanceStatic needs to be before Plug.Static to be able to override shipped-static files
+ # If you're adding new paths to `only:` you'll need to configure them in InstanceStatic as well
+ plug(Pleroma.Plugs.InstanceStatic, at: "/")
plug(
Plug.Static,
at: "/",
from: :pleroma,
only:
- ~w(index.html static finmoji emoji packs sounds images instance sw.js favicon.png schemas)
+ ~w(index.html static finmoji emoji packs sounds images instance sw.js favicon.png schemas doc)
)
# Code reloading can be explicitly enabled under the
plug(Plug.MethodOverride)
plug(Plug.Head)
+ cookie_name =
+ if Application.get_env(:pleroma, Pleroma.Web.Endpoint) |> Keyword.get(:secure_cookie_flag),
+ do: "__Host-pleroma_key",
+ else: "pleroma_key"
+
# The session will be stored in the cookie and signed,
# this means its contents can be read but not tampered with.
# Set :encryption_salt if you would also like to encrypt it.
plug(
Plug.Session,
store: :cookie,
- key: "_pleroma_key",
- signing_salt: "CqaoopA2",
+ key: cookie_name,
+ signing_salt: {Pleroma.Config, :get, [[__MODULE__, :signing_salt], "CqaoopA2"]},
http_only: true,
secure:
Application.get_env(:pleroma, Pleroma.Web.Endpoint) |> Keyword.get(:secure_cookie_flag),