socket("/socket", Pleroma.Web.UserSocket)
- # Serve at "/" the static files from "priv/static" directory.
- #
- # You should set gzip to true if you are running phoenix.digest
- # when deploying your static files in production.
+ plug(Pleroma.Plugs.SetLocalePlug)
plug(CORSPlug)
plug(Pleroma.Plugs.HTTPSecurityPlug)
-
plug(Pleroma.Plugs.UploadedMedia)
+ @static_cache_control "public, no-cache"
+
# InstanceStatic needs to be before Plug.Static to be able to override shipped-static files
# If you're adding new paths to `only:` you'll need to configure them in InstanceStatic as well
- plug(Pleroma.Plugs.InstanceStatic, at: "/")
+ # Cache-control headers are duplicated in case we turn off etags in the future
+ plug(Pleroma.Plugs.InstanceStatic,
+ at: "/",
+ gzip: true,
+ cache_control_for_etags: @static_cache_control,
+ headers: %{
+ "cache-control" => @static_cache_control
+ }
+ )
+ # Serve at "/" the static files from "priv/static" directory.
+ #
+ # You should set gzip to true if you are running phoenix.digest
+ # when deploying your static files in production.
plug(
Plug.Static,
at: "/",
from: :pleroma,
only:
- ~w(index.html robots.txt static finmoji emoji packs sounds images instance sw.js sw-pleroma.js favicon.png schemas doc)
+ ~w(index.html robots.txt static finmoji emoji packs sounds images instance sw.js sw-pleroma.js favicon.png schemas doc),
# credo:disable-for-previous-line Credo.Check.Readability.MaxLineLength
+ gzip: true,
+ cache_control_for_etags: @static_cache_control,
+ headers: %{
+ "cache-control" => @static_cache_control
+ }
+ )
+
+ plug(Plug.Static.IndexHtml, at: "/pleroma/admin/")
+
+ plug(Plug.Static,
+ at: "/pleroma/admin/",
+ from: {:pleroma, "priv/static/adminfe/"}
)
# Code reloading can be explicitly enabled under the
parsers: [:urlencoded, :multipart, :json],
pass: ["*/*"],
json_decoder: Jason,
- length: Application.get_env(:pleroma, :instance) |> Keyword.get(:upload_limit),
+ length: Pleroma.Config.get([:instance, :upload_limit]),
body_reader: {Pleroma.Web.Plugs.DigestPlug, :read_body, []}
)
do: "__Host-pleroma_key",
else: "pleroma_key"
- same_site =
- if Pleroma.Config.oauth_consumer_enabled?() do
- # Note: "SameSite=Strict" prevents sign in with external OAuth provider
- # (there would be no cookies during callback request from OAuth provider)
- "SameSite=Lax"
- else
- "SameSite=Strict"
- end
+ extra =
+ Pleroma.Config.get([__MODULE__, :extra_cookie_attrs])
+ |> Enum.join(";")
# The session will be stored in the cookie and signed,
# this means its contents can be read but not tampered with.
Plug.Session,
store: :cookie,
key: cookie_name,
- signing_salt: {Pleroma.Config, :get, [[__MODULE__, :signing_salt], "CqaoopA2"]},
+ signing_salt: Pleroma.Config.get([__MODULE__, :signing_salt], "CqaoopA2"),
http_only: true,
secure: secure_cookies,
- extra: same_site
+ extra: extra
)
# Note: the plug and its configuration is compile-time this can't be upstreamed yet