X-Git-Url: http://git.squeep.com/?a=blobdiff_plain;f=lib%2Fpleroma%2Fweb%2Fendpoint.ex;h=370d2d792333d9c61dba871f64196398deacecdf;hb=92b4a1aa1bc750bb077ae45c422967f9712e247d;hp=93b37dc74faf2654031cd281a66abc8cf111a88c;hpb=af854f7e01efa24d57b68283a9884d3fc80d6438;p=akkoma

diff --git a/lib/pleroma/web/endpoint.ex b/lib/pleroma/web/endpoint.ex
index 93b37dc74..bbea31682 100644
--- a/lib/pleroma/web/endpoint.ex
+++ b/lib/pleroma/web/endpoint.ex
@@ -1,48 +1,113 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
 defmodule Pleroma.Web.Endpoint do
   use Phoenix.Endpoint, otp_app: :pleroma
 
-  if Application.get_env(:pleroma, :chat) |> Keyword.get(:enabled) do
-    socket "/socket", Pleroma.Web.UserSocket
-  end
-  socket "/api/v1", Pleroma.Web.MastodonAPI.MastodonSocket
+  socket("/socket", Pleroma.Web.UserSocket)
+
+  plug(Pleroma.Plugs.SetLocalePlug)
+  plug(CORSPlug)
+  plug(Pleroma.Plugs.HTTPSecurityPlug)
+  plug(Pleroma.Plugs.UploadedMedia)
+
+  @static_cache_control "public max-age=86400 must-revalidate"
+
+  # InstanceStatic needs to be before Plug.Static to be able to override shipped-static files
+  # If you're adding new paths to `only:` you'll need to configure them in InstanceStatic as well
+  # Cache-control headers are duplicated in case we turn off etags in the future
+  plug(Pleroma.Plugs.InstanceStatic,
+    at: "/",
+    gzip: true,
+    cache_control_for_etags: @static_cache_control,
+    headers: %{
+      "cache-control" => @static_cache_control
+    }
+  )
 
   # Serve at "/" the static files from "priv/static" directory.
   #
   # You should set gzip to true if you are running phoenix.digest
   # when deploying your static files in production.
-  plug Plug.Static,
-    at: "/media", from: "uploads", gzip: false
-  plug Plug.Static,
-    at: "/", from: :pleroma,
-    only: ~w(index.html static finmoji emoji packs sounds images instance sw.js)
+  plug(
+    Plug.Static,
+    at: "/",
+    from: :pleroma,
+    only:
+      ~w(index.html robots.txt static finmoji emoji packs sounds images instance sw.js sw-pleroma.js favicon.png schemas doc),
+    # credo:disable-for-previous-line Credo.Check.Readability.MaxLineLength
+    gzip: true,
+    cache_control_for_etags: @static_cache_control,
+    headers: %{
+      "cache-control" => @static_cache_control
+    }
+  )
+
+  plug(Plug.Static.IndexHtml, at: "/pleroma/admin/")
+
+  plug(Plug.Static,
+    at: "/pleroma/admin/",
+    from: {:pleroma, "priv/static/adminfe/"}
+  )
 
   # Code reloading can be explicitly enabled under the
   # :code_reloader configuration of your endpoint.
   if code_reloading? do
-    plug Phoenix.CodeReloader
+    plug(Phoenix.CodeReloader)
   end
 
-  plug TrailingFormatPlug
-  plug Plug.RequestId
-  plug Plug.Logger
+  plug(Pleroma.Plugs.TrailingFormatPlug)
+  plug(Plug.RequestId)
+  plug(Plug.Logger)
+
+  plug(Pleroma.Plugs.Parsers)
+
+  plug(Plug.MethodOverride)
+  plug(Plug.Head)
+
+  secure_cookies = Pleroma.Config.get([__MODULE__, :secure_cookie_flag])
 
-  plug Plug.Parsers,
-    parsers: [:urlencoded, :multipart, :json],
-    pass: ["*/*"],
-    json_decoder: Poison
+  cookie_name =
+    if secure_cookies,
+      do: "__Host-pleroma_key",
+      else: "pleroma_key"
 
-  plug Plug.MethodOverride
-  plug Plug.Head
+  extra =
+    Pleroma.Config.get([__MODULE__, :extra_cookie_attrs])
+    |> Enum.join(";")
 
   # The session will be stored in the cookie and signed,
   # this means its contents can be read but not tampered with.
   # Set :encryption_salt if you would also like to encrypt it.
-  plug Plug.Session,
+  plug(
+    Plug.Session,
     store: :cookie,
-    key: "_pleroma_key",
-    signing_salt: "CqaoopA2"
+    key: cookie_name,
+    signing_salt: Pleroma.Config.get([__MODULE__, :signing_salt], "CqaoopA2"),
+    http_only: true,
+    secure: secure_cookies,
+    extra: extra
+  )
 
-  plug Pleroma.Web.Router
+  plug(Pleroma.Plugs.RemoteIp)
+
+  defmodule Instrumenter do
+    use Prometheus.PhoenixInstrumenter
+  end
+
+  defmodule PipelineInstrumenter do
+    use Prometheus.PlugPipelineInstrumenter
+  end
+
+  defmodule MetricsExporter do
+    use Prometheus.PlugExporter
+  end
+
+  plug(PipelineInstrumenter)
+  plug(MetricsExporter)
+
+  plug(Pleroma.Web.Router)
 
   @doc """
   Dynamically loads configuration from the system environment
@@ -55,4 +120,8 @@ defmodule Pleroma.Web.Endpoint do
     port = System.get_env("PORT") || raise "expected the PORT environment variable to be set"
     {:ok, Keyword.put(config, :http, [:inet6, port: port])}
   end
+
+  def websocket_url do
+    String.replace_leading(url(), "http", "ws")
+  end
 end