feat(funkwhale): optional Anubis bot-protection in front of the front container#31
Open
0cwa wants to merge 3 commits into
Open
feat(funkwhale): optional Anubis bot-protection in front of the front container#310cwa wants to merge 3 commits into
0cwa wants to merge 3 commits into
Conversation
…ugin Adds roles/docker, a generic role that installs the upstream Docker apt repository and the v2 'docker compose' plugin. No playbook references it yet -- it is consumed by the upcoming funkwhale role and is intentionally generic so any future containerised service can reuse it. Highlights: - pulls Docker's official GPG key into /etc/apt/keyrings - installs docker-ce + cli + containerd.io + buildx + compose plugin - exposes docker_group_users so the funkwhale service user can run docker without sudo Verified with: yamllint -c .yamllint.yaml .
Adds a Funkwhale role and playbook for music.bonfire.link.
Architecture:
client → host nginx (TLS, big bodies)
→ front container (in compose stack)
→ api / celery / postgres / redis (in compose stack)
audio → S3-compatible object storage (Storj gateway by default),
streamed directly to clients via signed URLs
Highlights:
- public + federated by default; e-mail verification on
- 5G upload ceiling (4h FLAC/WAV sets); proxy_request_buffering off
- direct streaming from Storj (PROXY_MEDIA=false +
AWS_QUERYSTRING_AUTH=true); the bucket can stay private
- storage backend toggle (s3 | local) for Vagrant/dev
- assert.yml refuses placeholder secrets; warns when registration
is on without real SMTP
- depends on roles/docker (added in feat/docker-role); reuses
common, fail2ban, certbot and nginx roles untouched
- public-repo-safe: no real secrets committed; vault layout
documented in roles/funkwhale/README.md
Two add-ons land in follow-up PRs and are explicitly out of scope
here:
- feat/funkwhale-anubis — Anubis bot protection
- feat/funkwhale-backup — nightly pg_dump → S3
Verified with:
yamllint -c .yamllint.yaml .
ansible-playbook --syntax-check -i hosts/prod playbooks/funkwhale.yml
jinja render of every template (compose YAML re-parses cleanly)
… container Adds Anubis (https://anubis.techaro.lol) as an opt-in service in the docker-compose stack, gated behind funkwhale_with_anubis (default false). When enabled, Anubis takes the host port that the front container had, and proxies to http://front:8080 internally. Bypass policy is the upstream Funkwhale botPolicy.yaml verbatim (vendored under roles/funkwhale/files/), which exempts /api, /federation, /rest, /.well-known, /media and /staticfiles -- so Subsonic clients, federating pods and ActivityPub well-knowns are not challenged. Verified with: yamllint -c .yamllint.yaml . ansible-lint --profile safety roles/funkwhale (passes) ansible-playbook --syntax-check -i hosts/prod playbooks/funkwhale.yml jinja render of compose template with anubis on/off
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds opt-in Anubis bot protection in front of the Funkwhale
frontcontainer. Default: off.What
funkwhale_with_anubis(defaultfalse)botPolicy.yamlverbatim underroles/funkwhale/files//api,/federation,/rest,/.well-known,/media,/staticfiles— keeps Subsonic clients, federating pods, and ActivityPub well-knowns unchallenged127.0.0.1:5000) the front container had, and proxies tohttp://front:8080internally — no nginx vhost change requiredVerified flag-on / flag-off
Rendered the compose template both ways:
funkwhale_with_anubis: false→ noanubisservice,frontowns the host portfunkwhale_with_anubis: true→anubisservice emitted,frontloses itsports:bindingVerified with
yamllint -c .yamllint.yaml . ansible-lint --profile safety roles/funkwhale ansible-playbook --syntax-check -i hosts/prod playbooks/funkwhale.ymlStacking
Depends on
feat/funkwhale-core. After that merges, rebase this ontomaster.Parallel with
feat/funkwhale-backup— they touch disjoint code paths.