+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
defmodule Pleroma.Web.Endpoint do
use Phoenix.Endpoint, otp_app: :pleroma
- if Application.get_env(:pleroma, :chat) |> Keyword.get(:enabled) do
- socket "/socket", Pleroma.Web.UserSocket
- end
- socket "/api/v1", Pleroma.Web.MastodonAPI.MastodonSocket
+ socket("/socket", Pleroma.Web.UserSocket)
# Serve at "/" the static files from "priv/static" directory.
#
# You should set gzip to true if you are running phoenix.digest
# when deploying your static files in production.
- plug Plug.Static,
- at: "/media", from: "uploads", gzip: false
- plug Plug.Static,
- at: "/", from: :pleroma,
- only: ~w(index.html static finmoji emoji packs sounds images instance sw.js)
+ plug(CORSPlug)
+ plug(Pleroma.Plugs.HTTPSecurityPlug)
+
+ plug(Pleroma.Plugs.UploadedMedia)
+
+ @static_cache_control "public, no-cache"
+
+ # InstanceStatic needs to be before Plug.Static to be able to override shipped-static files
+ # If you're adding new paths to `only:` you'll need to configure them in InstanceStatic as well
+ # Cache-control headers are duplicated in case we turn off etags in the future
+ plug(Pleroma.Plugs.InstanceStatic,
+ at: "/",
+ gzip: true,
+ cache_control_for_etags: @static_cache_control,
+ headers: %{
+ "cache-control" => @static_cache_control
+ }
+ )
+
+ plug(
+ Plug.Static,
+ at: "/",
+ from: :pleroma,
+ only:
+ ~w(index.html robots.txt static finmoji emoji packs sounds images instance sw.js sw-pleroma.js favicon.png schemas doc),
+ # credo:disable-for-previous-line Credo.Check.Readability.MaxLineLength
+ gzip: true,
+ cache_control_for_etags: @static_cache_control,
+ headers: %{
+ "cache-control" => @static_cache_control
+ }
+ )
+
+ plug(Plug.Static.IndexHtml, at: "/pleroma/admin/")
+
+ plug(Plug.Static,
+ at: "/pleroma/admin/",
+ from: {:pleroma, "priv/static/adminfe/"}
+ )
# Code reloading can be explicitly enabled under the
# :code_reloader configuration of your endpoint.
if code_reloading? do
- plug Phoenix.CodeReloader
+ plug(Phoenix.CodeReloader)
end
- plug TrailingFormatPlug
- plug Plug.RequestId
- plug Plug.Logger
+ plug(TrailingFormatPlug)
+ plug(Plug.RequestId)
+ plug(Plug.Logger)
- plug Plug.Parsers,
+ plug(
+ Plug.Parsers,
parsers: [:urlencoded, :multipart, :json],
pass: ["*/*"],
- json_decoder: Poison
+ json_decoder: Jason,
+ length: Pleroma.Config.get([:instance, :upload_limit]),
+ body_reader: {Pleroma.Web.Plugs.DigestPlug, :read_body, []}
+ )
+
+ plug(Plug.MethodOverride)
+ plug(Plug.Head)
+
+ secure_cookies = Pleroma.Config.get([__MODULE__, :secure_cookie_flag])
+
+ cookie_name =
+ if secure_cookies,
+ do: "__Host-pleroma_key",
+ else: "pleroma_key"
- plug Plug.MethodOverride
- plug Plug.Head
+ extra =
+ Pleroma.Config.get([__MODULE__, :extra_cookie_attrs])
+ |> Enum.join(";")
# The session will be stored in the cookie and signed,
# this means its contents can be read but not tampered with.
# Set :encryption_salt if you would also like to encrypt it.
- plug Plug.Session,
+ plug(
+ Plug.Session,
store: :cookie,
- key: "_pleroma_key",
- signing_salt: "CqaoopA2"
+ key: cookie_name,
+ signing_salt: Pleroma.Config.get([__MODULE__, :signing_salt], "CqaoopA2"),
+ http_only: true,
+ secure: secure_cookies,
+ extra: extra
+ )
- plug Pleroma.Web.Router
+ # Note: the plug and its configuration is compile-time this can't be upstreamed yet
+ if proxies = Pleroma.Config.get([__MODULE__, :reverse_proxies]) do
+ plug(RemoteIp, proxies: proxies)
+ end
+
+ defmodule Instrumenter do
+ use Prometheus.PhoenixInstrumenter
+ end
+
+ defmodule PipelineInstrumenter do
+ use Prometheus.PlugPipelineInstrumenter
+ end
+
+ defmodule MetricsExporter do
+ use Prometheus.PlugExporter
+ end
+
+ plug(PipelineInstrumenter)
+ plug(MetricsExporter)
+
+ plug(Pleroma.Web.Router)
@doc """
Dynamically loads configuration from the system environment
port = System.get_env("PORT") || raise "expected the PORT environment variable to be set"
{:ok, Keyword.put(config, :http, [:inet6, port: port])}
end
+
+ def websocket_url do
+ String.replace_leading(url(), "http", "ws")
+ end
end