Documentation
¶
Index ¶
- func ClientIP(ctx context.Context) string
- func Migrate(ctx context.Context, pool *pgxpool.Pool, authUnits, app fs.FS, ...) error
- func NewAPI(mux *http.ServeMux, version string) huma.API
- func OpenPool(ctx context.Context, dsn string) (*pgxpool.Pool, error)
- func WithClientIP(proxies []netip.Prefix) func(http.Handler) http.Handler
- type Buckets
- type Config
- type Guard
- type Mailer
- type Markdown
- type Resolver
- type S3Config
- type Sealer
- type SignupMode
- type TLSMode
- type Tuning
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Migrate ¶
Migrate applies auth-all's units, then the app migrations, then River's. Each goose set keeps its own version table, so their version numbers never interleave.
func NewAPI ¶
NewAPI creates the Huma API on mux. The OpenAPI document is at /api/openapi.json and the docs UI at /api/docs.
func WithClientIP ¶
WithClientIP records the client address. Without trusted proxies it is the direct peer. Behind a trusted proxy it is the rightmost X-Forwarded-For hop that is not a trusted proxy, the same rule auth-all applies, because any client can put addresses at the left of that header.
Types ¶
type Buckets ¶
type Buckets struct {
// contains filtered or unexported fields
}
Buckets is a token bucket per key: a peer domain, a client address or an actor.
func NewBuckets ¶
type Config ¶
type Config struct {
DatabaseURL string
AppDomain string
// AppOrigin is the browser origin of the app domain, e.g. https://example.org.
AppOrigin string
SecretKey []byte
SMTPURL *url.URL
EmailFrom string
TLS TLSMode
ACMEEmail string
CertDir string
// HTTPAddr is the public listener when TLS is off.
HTTPAddr string
WebUpstream *url.URL
InternalAddr string
MediaDir string
S3 *S3Config
FederationHTTP bool
Signup SignupMode
// TrustedProxies are the networks of a TLS-terminating proxy in front of the listener.
TrustedProxies []netip.Prefix
// GitHubClientID and GitHubClientSecret enable GitHub sign-in. Both are set or neither.
GitHubClientID string
GitHubClientSecret string
}
type Guard ¶
type Guard struct {
// AllowHTTP permits plain http. Only the interop harness sets it.
AllowHTTP bool
Timeout time.Duration
MaxBytes int64
Resolver Resolver
}
Guard refuses outbound requests to private, loopback, link-local and other non-public addresses, at request time and again at dial time. Every outbound request in notid goes through Client.
type Mailer ¶
type Mailer struct {
// contains filtered or unexported fields
}
Mailer sends plain-text email over SMTP. smtp:// upgrades with STARTTLS when the server offers it; smtps:// uses implicit TLS.
type Markdown ¶
type Markdown struct {
// ImageURL, when set, rewrites every image source. The renderer for
// readers sends remote images through the proxy; the one for peers keeps them.
ImageURL func(src string) string
// contains filtered or unexported fields
}
Markdown is the one renderer for all HTML notid serves or sends. Raw HTML in the source is dropped by goldmark, and bluemonday cleans the output again.
func NewMarkdown ¶
func NewMarkdown() *Markdown
func (*Markdown) FromHTML ¶
FromHTML converts remote HTML without a Markdown source to Markdown. The HTML is sanitized first, so nothing unsafe survives into storage.
type Resolver ¶
type Resolver interface {
LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
}
Resolver is the part of net.Resolver the guard uses. Tests replace it.
type Sealer ¶
type Sealer struct {
// contains filtered or unexported fields
}
Sealer encrypts secrets at rest with AES-256-GCM under SECRET_KEY.
type SignupMode ¶
type SignupMode string
const ( SignupInvite SignupMode = "invite" SignupOpen SignupMode = "open" SignupClosed SignupMode = "closed" )
type Tuning ¶
type Tuning struct {
ReadHeaderTimeout time.Duration
ReadTimeout time.Duration
WriteTimeout time.Duration
IdleTimeout time.Duration
ShutdownTimeout time.Duration
MaxHeaderBytes int
SessionIdle time.Duration
SessionAbsolute time.Duration
MagicLinkTTL time.Duration
APIKeyMaxTTL time.Duration
SignInPerEmail int
SignInPerIP int
MagicLinkPerEmail int
MagicLinkPerIP int
SignUpPerIP int
FederationTimeout time.Duration
MaxFetchBytes int64
MaxInboxBytes int64
SignatureMaxSkew time.Duration
ActorRefresh time.Duration
// DeliveryRetryWindow is how long a delivery retries, and how long a peer
// may fail before deliveries to it are skipped until it answers again.
DeliveryRetryWindow time.Duration
DeliveryMaxBackoff time.Duration
// DeliveryBadRequestRetries is how many attempts a delivery answered with 400 gets.
DeliveryBadRequestRetries int
// A Follow of a remote group that is still pending after FollowResendAfter
// is sent again with a new id, up to FollowResends times, each wait twice
// the last. Lemmy drops the Accept of the first Follow from a peer it has
// not seen before.
FollowResendAfter time.Duration
FollowResends int
// JoinBackfillPosts is how many of a remote community's newest posts a
// join fetches from its outbox, so the feed does not start empty.
JoinBackfillPosts int
// JoinBackfillComments is how many of each backfilled post's newest
// comments are fetched, from the post's thread collection.
JoinBackfillComments int
PeerInboxPerMinute int
PeerInboxBurst int
// KeyFetchesPerMinute caps, per client address, inbox requests signed by
// keys notid must fetch first.
KeyFetchesPerMinute int
KeyFetchesBurst int
DeliveryWorkers int
InboxWorkers int
ProbeInterval time.Duration
PostsPerPage int32
TopDayWindow time.Duration
TopWeekWindow time.Duration
ThreadMaxComments int32
SavedPerPage int32
ReportQueueSize int32
// ReportsPerDay caps the reports one person files in a day.
ReportsPerDay int
// PeerListSize caps the peers an admin sees in one list.
PeerListSize int32
// DirectorySize caps the reviewed directory an admin sees in one list.
DirectorySize int32
ModerationLogSize int32
TrustMinAge time.Duration
TrustMinActivity int
TrustCheckInterval time.Duration
// NewWritesPerDay caps posts and comments by a new user. A write into a
// remote community counts against NewRemoteWritesPerDay as well.
NewWritesPerDay int
// ActorWritesPerMinute caps every state-changing API request per person.
ActorWritesPerMinute int
ActorWritesBurst int
NewRemoteWritesPerDay int
InvitesPerTrustedUser int
UploadQuotaBytes int64
// TransparencyWindow is the recent window the public counts report.
TransparencyWindow time.Duration
// ProxyMaxBytes caps a remote image served through /proxy; ProxyMaxAge is
// how long a reader's browser may cache it.
ProxyMaxBytes int64
ProxyMaxAge time.Duration
// PreviewReadBytes is how much of a linked page is read for its preview.
PreviewReadBytes int64
PreviewWorkers int
MaxUploadBytes int64
MaxImagePixels int64
// DecodeMaxBytes caps the memory one decode may take, from the image
// header's size and pixel format; UploadDecoders decode at once.
DecodeMaxBytes int64
UploadDecoders int
// MediaMaxAge is how long browsers keep an uploaded image.
MediaMaxAge time.Duration
// An upload no post or banner uses is deleted after MediaGrace, checked
// every MediaSweepInterval.
MediaGrace time.Duration
MediaSweepInterval time.Duration
ImageMaxDimension int
JPEGQuality int
}
Tuning holds every operational limit. Changing a value is a code change with a test.
func DefaultTuning ¶
func DefaultTuning() Tuning
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Package edge is the only public listener: host checks, TLS, content negotiation and the SSR proxy.
|
Package edge is the only public listener: host checks, TLS, content negotiation and the SSR proxy. |
|
Package media stores uploaded images and serves them under /media/.
|
Package media stores uploaded images and serves them under /media/. |
|
Package pgtest gives each test a transaction on a migrated database that rolls back at the end.
|
Package pgtest gives each test a transaction on a migrated database that rolls back at the end. |