platform

package
v0.1.0-beta.9 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 20, 2026 License: AGPL-3.0 Imports: 39 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ClientIP

func ClientIP(ctx context.Context) string

func Migrate

func Migrate(ctx context.Context, pool *pgxpool.Pool, authUnits, app fs.FS, log *slog.Logger) error

Migrate applies auth-all's units, then the app migrations, then River's. Each goose set keeps its own version table, so their version numbers never interleave.

func NewAPI

func NewAPI(mux *http.ServeMux, version string) huma.API

NewAPI creates the Huma API on mux. The OpenAPI document is at /api/openapi.json and the docs UI at /api/docs.

func OpenPool

func OpenPool(ctx context.Context, dsn string) (*pgxpool.Pool, error)

func WithClientIP

func WithClientIP(proxies []netip.Prefix) func(http.Handler) http.Handler

WithClientIP records the client address. Without trusted proxies it is the direct peer. Behind a trusted proxy it is the rightmost X-Forwarded-For hop that is not a trusted proxy, the same rule auth-all applies, because any client can put addresses at the left of that header.

Types

type Buckets

type Buckets struct {
	// contains filtered or unexported fields
}

Buckets is a token bucket per key: a peer domain, a client address or an actor.

func NewBuckets

func NewBuckets(perMinute, burst int) *Buckets

func (*Buckets) Allow

func (l *Buckets) Allow(key string, now time.Time) bool

Allow takes one token for key and reports whether one was left.

type Config

type Config struct {
	DatabaseURL string
	AppDomain   string
	// AppOrigin is the browser origin of the app domain, e.g. https://example.org.
	AppOrigin string
	SecretKey []byte
	SMTPURL   *url.URL
	EmailFrom string

	TLS       TLSMode
	ACMEEmail string
	CertDir   string
	// HTTPAddr is the public listener when TLS is off.
	HTTPAddr     string
	WebUpstream  *url.URL
	InternalAddr string

	MediaDir string
	S3       *S3Config

	FederationHTTP bool
	Signup         SignupMode
	// TrustedProxies are the networks of a TLS-terminating proxy in front of the listener.
	TrustedProxies []netip.Prefix
	// GitHubClientID and GitHubClientSecret enable GitHub sign-in. Both are set or neither.
	GitHubClientID     string
	GitHubClientSecret string
}

func LoadConfig

func LoadConfig(getenv func(string) string) (Config, error)

LoadConfig reads config from getenv and reports every missing or unsafe value at once.

type Guard

type Guard struct {
	// AllowHTTP permits plain http. Only the interop harness sets it.
	AllowHTTP bool
	Timeout   time.Duration
	MaxBytes  int64
	Resolver  Resolver
}

Guard refuses outbound requests to private, loopback, link-local and other non-public addresses, at request time and again at dial time. Every outbound request in notid goes through Client.

func NewGuard

func NewGuard(allowHTTP bool, t Tuning) *Guard

func (*Guard) CheckURL

func (g *Guard) CheckURL(ctx context.Context, raw string) (*url.URL, error)

CheckURL refuses a URL whose scheme or resolved addresses the guard forbids.

func (*Guard) Client

func (g *Guard) Client() *http.Client

Client returns an HTTP client that enforces the guard on every request and redirect, caps the response body and reaches only vetted addresses.

type Mailer

type Mailer struct {
	// contains filtered or unexported fields
}

Mailer sends plain-text email over SMTP. smtp:// upgrades with STARTTLS when the server offers it; smtps:// uses implicit TLS.

func NewMailer

func NewMailer(server *url.URL, from string) (*Mailer, error)

func (*Mailer) Send

func (m *Mailer) Send(ctx context.Context, to, subject, body string) error

type Markdown

type Markdown struct {

	// ImageURL, when set, rewrites every image source. The renderer for
	// readers sends remote images through the proxy; the one for peers keeps them.
	ImageURL func(src string) string
	// contains filtered or unexported fields
}

Markdown is the one renderer for all HTML notid serves or sends. Raw HTML in the source is dropped by goldmark, and bluemonday cleans the output again.

func NewMarkdown

func NewMarkdown() *Markdown

func (*Markdown) FromHTML

func (m *Markdown) FromHTML(html string) (string, error)

FromHTML converts remote HTML without a Markdown source to Markdown. The HTML is sanitized first, so nothing unsafe survives into storage.

func (*Markdown) HTML

func (m *Markdown) HTML(source string) string

HTML renders Markdown to sanitized HTML.

func (*Markdown) Text

func (m *Markdown) Text(source string, max int) string

Text renders Markdown to plain text of at most max bytes, cut at a word, for excerpts. It holds no markup; the web app escapes it like any other text.

type Resolver

type Resolver interface {
	LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
}

Resolver is the part of net.Resolver the guard uses. Tests replace it.

type S3Config

type S3Config struct {
	Endpoint  string
	Bucket    string
	AccessKey string
	SecretKey string
}

type Sealer

type Sealer struct {
	// contains filtered or unexported fields
}

Sealer encrypts secrets at rest with AES-256-GCM under SECRET_KEY.

func NewSealer

func NewSealer(key []byte) (*Sealer, error)

func (*Sealer) Open

func (s *Sealer) Open(sealed []byte, purpose string) ([]byte, error)

func (*Sealer) Seal

func (s *Sealer) Seal(plaintext []byte, purpose string) []byte

Seal returns nonce || ciphertext. purpose is bound as associated data, so a sealed value cannot be replayed for another purpose.

type SignupMode

type SignupMode string
const (
	SignupInvite SignupMode = "invite"
	SignupOpen   SignupMode = "open"
	SignupClosed SignupMode = "closed"
)

type TLSMode

type TLSMode string
const (
	TLSACME TLSMode = "acme"
	TLSOff  TLSMode = "off"
)

type Tuning

type Tuning struct {
	ReadHeaderTimeout time.Duration
	ReadTimeout       time.Duration
	WriteTimeout      time.Duration
	IdleTimeout       time.Duration
	ShutdownTimeout   time.Duration
	MaxHeaderBytes    int

	SessionIdle       time.Duration
	SessionAbsolute   time.Duration
	MagicLinkTTL      time.Duration
	APIKeyMaxTTL      time.Duration
	SignInPerEmail    int
	SignInPerIP       int
	MagicLinkPerEmail int
	MagicLinkPerIP    int
	SignUpPerIP       int

	FederationTimeout time.Duration
	MaxFetchBytes     int64
	MaxInboxBytes     int64
	SignatureMaxSkew  time.Duration
	ActorRefresh      time.Duration
	// DeliveryRetryWindow is how long a delivery retries, and how long a peer
	// may fail before deliveries to it are skipped until it answers again.
	DeliveryRetryWindow time.Duration
	DeliveryMaxBackoff  time.Duration
	// DeliveryBadRequestRetries is how many attempts a delivery answered with 400 gets.
	DeliveryBadRequestRetries int
	// A Follow of a remote group that is still pending after FollowResendAfter
	// is sent again with a new id, up to FollowResends times, each wait twice
	// the last. Lemmy drops the Accept of the first Follow from a peer it has
	// not seen before.
	FollowResendAfter time.Duration
	FollowResends     int
	// JoinBackfillPosts is how many of a remote community's newest posts a
	// join fetches from its outbox, so the feed does not start empty.
	JoinBackfillPosts int
	// JoinBackfillComments is how many of each backfilled post's newest
	// comments are fetched, from the post's thread collection.
	JoinBackfillComments int
	PeerInboxPerMinute   int
	PeerInboxBurst       int
	// KeyFetchesPerMinute caps, per client address, inbox requests signed by
	// keys notid must fetch first.
	KeyFetchesPerMinute int
	KeyFetchesBurst     int
	DeliveryWorkers     int
	InboxWorkers        int
	ProbeInterval       time.Duration

	PostsPerPage      int32
	TopDayWindow      time.Duration
	TopWeekWindow     time.Duration
	ThreadMaxComments int32
	SavedPerPage      int32

	ReportQueueSize int32
	// ReportsPerDay caps the reports one person files in a day.
	ReportsPerDay int
	// PeerListSize caps the peers an admin sees in one list.
	PeerListSize int32
	// DirectorySize caps the reviewed directory an admin sees in one list.
	DirectorySize     int32
	ModerationLogSize int32

	TrustMinAge        time.Duration
	TrustMinActivity   int
	TrustCheckInterval time.Duration
	// NewWritesPerDay caps posts and comments by a new user. A write into a
	// remote community counts against NewRemoteWritesPerDay as well.
	NewWritesPerDay int
	// ActorWritesPerMinute caps every state-changing API request per person.
	ActorWritesPerMinute  int
	ActorWritesBurst      int
	NewRemoteWritesPerDay int
	InvitesPerTrustedUser int
	UploadQuotaBytes      int64
	// TransparencyWindow is the recent window the public counts report.
	TransparencyWindow time.Duration

	// ProxyMaxBytes caps a remote image served through /proxy; ProxyMaxAge is
	// how long a reader's browser may cache it.
	ProxyMaxBytes int64
	ProxyMaxAge   time.Duration
	// PreviewReadBytes is how much of a linked page is read for its preview.
	PreviewReadBytes int64
	PreviewWorkers   int

	MaxUploadBytes int64
	MaxImagePixels int64
	// DecodeMaxBytes caps the memory one decode may take, from the image
	// header's size and pixel format; UploadDecoders decode at once.
	DecodeMaxBytes int64
	UploadDecoders int
	// MediaMaxAge is how long browsers keep an uploaded image.
	MediaMaxAge time.Duration
	// An upload no post or banner uses is deleted after MediaGrace, checked
	// every MediaSweepInterval.
	MediaGrace         time.Duration
	MediaSweepInterval time.Duration
	ImageMaxDimension  int
	JPEGQuality        int
}

Tuning holds every operational limit. Changing a value is a code change with a test.

func DefaultTuning

func DefaultTuning() Tuning

Directories

Path Synopsis
Package edge is the only public listener: host checks, TLS, content negotiation and the SSR proxy.
Package edge is the only public listener: host checks, TLS, content negotiation and the SSR proxy.
Package media stores uploaded images and serves them under /media/.
Package media stores uploaded images and serves them under /media/.
Package pgtest gives each test a transaction on a migrated database that rolls back at the end.
Package pgtest gives each test a transaction on a migrated database that rolls back at the end.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL