diff --git a/seed/peertube/UPGRADE.md b/seed/peertube/UPGRADE.md new file mode 100644 index 0000000..40e94d0 --- /dev/null +++ b/seed/peertube/UPGRADE.md @@ -0,0 +1,7 @@ +peertube-plugin-auth-openid-connect +=================================== + +Modify version in: +- peertube/manual/image/postinstall/peertube.sh +- peertube/templates/peertube.service +- peertube/dictionaries/30_peertube.xml diff --git a/seed/peertube/dictionaries/30_peertube.xml b/seed/peertube/dictionaries/30_peertube.xml index 6e627f1..490afba 100644 --- a/seed/peertube/dictionaries/30_peertube.xml +++ b/seed/peertube/dictionaries/30_peertube.xml @@ -63,7 +63,7 @@ revprox_client_external_domainnames revprox_client_location - plugins/auth-openid-connect/0.0.7/auth/openid-connect + plugins/auth-openid-connect/0.1.0/auth/openid-connect oauth2_client_external diff --git a/seed/peertube/manual/image/postinstall/peertube.patch b/seed/peertube/manual/image/postinstall/peertube.patch deleted file mode 100644 index 2a8f363..0000000 --- a/seed/peertube/manual/image/postinstall/peertube.patch +++ /dev/null @@ -1,60 +0,0 @@ ---- peertube_plugins/node_modules/peertube-plugin-auth-openid-connect/main.js -+++ peertube_plugins/node_modules/peertube-plugin-auth-openid-connect/main.js -@@ -110,6 +110,14 @@ async function register ({ - descriptionHTML: 'Will only allow login for users whose group array contains this group' - }) - -+ registerSetting({ -+ name: 'signature-algorithm', -+ label: 'Token signature algorithm', -+ type: 'input', -+ private: true, -+ default: 'RS256' -+ }) -+ - const router = getRouter() - router.use('/code-cb', (req, res) => handleCb(peertubeHelpers, settingsManager, req, res)) - -@@ -159,7 +167,8 @@ async function loadSettingsAndCreateClient (registerExternalAuth, unregisterExte - 'scope', - 'discover-url', - 'client-id', -- 'client-secret' -+ 'client-secret', -+ 'signature-algorithm' - ]) - - if (!settings['discover-url']) { -@@ -188,6 +197,8 @@ async function loadSettingsAndCreateClient (registerExternalAuth, unregisterExte - } else { - clientOptions.token_endpoint_auth_method = 'none' - } -+ clientOptions.id_token_signed_response_alg = settings['signature-algorithm'] -+ clientOptions.authorization_signed_response_alg = settings['signature-algorithm'] - - store.client = new issuer.Client(clientOptions) - ---- peertube/dist/server/helpers/custom-validators/activitypub/actor.js.ori 2022-04-06 13:58:17.752681849 +0000 -+++ peertube/dist/server/helpers/custom-validators/activitypub/actor.js 2022-04-06 13:58:22.268682531 +0000 -@@ -43,8 +43,8 @@ - function isActorPrivateKeyValid(privateKey) { - return (0, misc_1.exists)(privateKey) && - typeof privateKey === 'string' && -- privateKey.startsWith('-----BEGIN RSA PRIVATE KEY-----') && -- privateKey.includes('-----END RSA PRIVATE KEY-----') && -+ privateKey.startsWith('-----BEGIN PRIVATE KEY-----') && -+ privateKey.includes('-----END PRIVATE KEY-----') && - validator_1.default.isLength(privateKey, constants_1.CONSTRAINTS_FIELDS.ACTORS.PRIVATE_KEY); - } - exports.isActorPrivateKeyValid = isActorPrivateKeyValid; ---- peertube/node_modules/pem/lib/pem.js.ori 2022-04-06 13:59:36.232693763 +0000 -+++ peertube/node_modules/pem/lib/pem.js 2022-04-06 13:59:48.916695687 +0000 -@@ -74,7 +74,7 @@ - - params.push(keyBitsize) - -- openssl.exec(params, 'RSA PRIVATE KEY', function (sslErr, key) { -+ openssl.exec(params, 'PRIVATE KEY', function (sslErr, key) { - function done (err) { - if (err) { - return callback(err) diff --git a/seed/peertube/manual/image/postinstall/peertube.sh b/seed/peertube/manual/image/postinstall/peertube.sh index 08f7146..b8e6d45 100644 --- a/seed/peertube/manual/image/postinstall/peertube.sh +++ b/seed/peertube/manual/image/postinstall/peertube.sh @@ -8,7 +8,7 @@ echo "nameserver 9.9.9.9" > /etc/resolv.conf PLUGINS_DIR=$PLUGINS_DIR mkdir -p "\$PLUGINS_DIR" cd "\$PLUGINS_DIR" -yarn add peertube-plugin-auth-openid-connect@0.0.7 --production +yarn add peertube-plugin-auth-openid-connect@0.1.0 --production mkdir -p "\$PLUGINS_DIR/data/peertube-plugin-auth-openid-connect" chown peertube: "\$PLUGINS_DIR/data" chown peertube: "\$PLUGINS_DIR/data/peertube-plugin-auth-openid-connect" @@ -23,5 +23,5 @@ rmdir "$IMAGE_NAME_RISOTTO_IMAGE_DIR/proc/self/" rm -f "$IMAGE_NAME_RISOTTO_IMAGE_DIR/install.sh" cd "$IMAGE_NAME_RISOTTO_IMAGE_DIR$PLUGINS_DIR/.." -patch -p0 < "$IMAGE_DIR_RECIPIENT_IMAGE/postinstall/peertube.patch" +#patch -p0 < "$IMAGE_DIR_RECIPIENT_IMAGE/postinstall/peertube.patch" cd - diff --git a/seed/peertube/manual/image/preinstall/peertube.sh b/seed/peertube/manual/image/preinstall/peertube.sh index 453ac07..fb672db 100644 --- a/seed/peertube/manual/image/preinstall/peertube.sh +++ b/seed/peertube/manual/image/preinstall/peertube.sh @@ -1,3 +1,4 @@ -PKG="$PKG peertube yarnpkg" +PKG="$PKG peertube peertube-tools yarnpkg" +#PKG="$PKG peertube yarnpkg" COPR="https://copr.fedorainfracloud.org/coprs/daftaupe/peertube/repo/fedora-36/daftaupe-peertube-fedora-36.repo" FUSION=true diff --git a/seed/peertube/templates/peertube.service b/seed/peertube/templates/peertube.service index 4120601..510d9fa 100644 --- a/seed/peertube/templates/peertube.service +++ b/seed/peertube/templates/peertube.service @@ -2,4 +2,4 @@ Environment=PGPASSFILE=/usr/local/lib/secrets/postgresql.pass ExecStartPost=+/usr/bin/timeout 90 sh -c 'while ! /usr/bin/psql --set=sslmode=verify-full -h %%pg_client_server_domainname -U %%pg_client_username %%pg_client_database -c "SELECT * FROM plugin;"; do sleep 1; done' ExecStartPost=+/usr/bin/psql --set=sslmode=verify-full -h %%pg_client_server_domainname -U %%pg_client_username %%pg_client_database -c "DELETE FROM plugin;" -ExecStartPost=+/usr/bin/psql --set=sslmode=verify-full -h %%pg_client_server_domainname -U %%pg_client_username %%pg_client_database -c "INSERT INTO plugin (name, type, version, enabled, uninstalled, \"peertubeEngine\", description, homepage, settings, \"createdAt\", \"updatedAt\") VALUES ('auth-openid-connect', '1', '0.0.7', true, false, '>=2.2.0', 'Add OpenID connect support to login form in PeerTube.', 'https://framagit.org/framasoft/peertube/official-plugins/tree/master/peertube-plugin-auth-openid-connect', '{\"scope\": \"openid email profile\", \"client-id\": \"%%oauth2_client_id\", \"discover-url\": \"https://%%oauth2_client_server_domainname/.well-known/openid-configuration\", \"client-secret\": \"%%oauth2_client_secret\", \"mail-property\": \"email\", \"auth-display-name\": \"OpenID Connect\", \"username-property\": \"nickname\", \"signature-algorithm\": \"%%oauth2_client_token_signature_algo\", \"display-name-property\": \"email\"}', '2022-04-05 18:12:34.832+02', '2022-04-05 18:12:34.832+02')" +ExecStartPost=+/usr/bin/psql --set=sslmode=verify-full -h %%pg_client_server_domainname -U %%pg_client_username %%pg_client_database -c "INSERT INTO plugin (name, type, version, enabled, uninstalled, \"peertubeEngine\", description, homepage, settings, \"createdAt\", \"updatedAt\") VALUES ('auth-openid-connect', '1', '0.1.0', true, false, '>=2.2.0', 'Add OpenID connect support to login form in PeerTube.', 'https://framagit.org/framasoft/peertube/official-plugins/tree/master/peertube-plugin-auth-openid-connect', '{\"scope\": \"openid email profile\", \"client-id\": \"%%oauth2_client_id\", \"discover-url\": \"https://%%oauth2_client_server_domainname/.well-known/openid-configuration\", \"client-secret\": \"%%oauth2_client_secret\", \"mail-property\": \"email\", \"auth-display-name\": \"OpenID Connect\", \"username-property\": \"nickname\", \"signature-algorithm\": \"%%oauth2_client_token_signature_algo\", \"display-name-property\": \"email\"}', '2022-04-05 18:12:34.832+02', '2022-04-05 18:12:34.832+02')" diff --git a/seed/peertube/templates/production.yaml b/seed/peertube/templates/production.yaml index 95ca2bc..96f7361 100644 --- a/seed/peertube/templates/production.yaml +++ b/seed/peertube/templates/production.yaml @@ -28,6 +28,10 @@ rates_limit: # 3 attempts in 5 min window: 5 minutes max: 3 + receive_client_log: + # 10 attempts in 10 min + window: 10 minutes + max: 10 # Proxies to trust to get real client IP # If you run PeerTube just behind a local proxy (nginx), keep 'loopback' @@ -49,7 +53,7 @@ database: # Redis server for short time storage # You can also specify a 'socket' path to a unix socket but first need to -# comment out hostname and port +# set 'hostname' and 'port' to null redis: hostname: '%%redis_client_server_domainname' port: 6379 @@ -95,11 +99,13 @@ defaults: licence: null p2p: - # Enable P2P by default + # Enable P2P by default in PeerTube client # Can be enabled/disabled by anonymous users and logged in users webapp: enabled: true + # Enable P2P by default in PeerTube embed + # Can be enabled/disabled by URL option embed: enabled: true @@ -138,6 +144,9 @@ object_storage: region: 'us-east-1' + # Set this ACL on each uploaded object + upload_acl: 'public-read' + credentials: # You can also use AWS_ACCESS_KEY_ID env variable access_key_id: '' @@ -145,7 +154,10 @@ object_storage: secret_access_key: '' # Maximum amount to upload in one request to object storage +# GNUNUX max_upload_part: 100MB +#>GNUNUX max_upload_part: 2GB +#GNUNUX enabled : false # Enabled by default, if disabled make sure that 'storage.logs' is pointing to a folder handled by logrotate +#GNUNUX enabled: false +#GNUNUX enabled: false +#GNUNUX allowed: false +#GNUNUX enabled: true +#GNUNUX - fr +#