From 666de2c8f4143cd67cb99e4a324a8f394cb326cd Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Tue, 15 Oct 2024 23:19:02 +0200
Subject: [PATCH] mastodon: switch files.pub.solar from storj to garage

s3 backend
---
 modules/mastodon/default.nix             |   6 +++---
 modules/nginx-mastodon-files/default.nix |  12 ++++++++----
 modules/nginx/default.nix                |   7 +++++++
 secrets/mastodon-extra-env-secrets.age   | Bin 2878 -> 2663 bytes
 4 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/modules/mastodon/default.nix b/modules/mastodon/default.nix
index 01acf7a6..2f16e330 100644
--- a/modules/mastodon/default.nix
+++ b/modules/mastodon/default.nix
@@ -96,9 +96,9 @@
       # S3 File storage (optional)
       # -----------------------
       S3_ENABLED = "true";
-      S3_BUCKET = "pub-solar-mastodon";
-      S3_REGION = "europe-west-1";
-      S3_ENDPOINT = "https://gateway.tardigradeshare.io";
+      S3_BUCKET = "mastodon";
+      S3_REGION = "eu-central";
+      S3_ENDPOINT = "https://buckets.pub.solar";
       S3_ALIAS_HOST = "files.${config.pub-solar-os.networking.domain}";
       # Translation (optional)
       # -----------------------
diff --git a/modules/nginx-mastodon-files/default.nix b/modules/nginx-mastodon-files/default.nix
index b5497468..a4ddca4e 100644
--- a/modules/nginx-mastodon-files/default.nix
+++ b/modules/nginx-mastodon-files/default.nix
@@ -1,8 +1,7 @@
 { config, ... }:
 
 let
-  objStorHost = "link.tardigradeshare.io";
-  objStorBucket = "s/jw24ad6l4a6zxsnd32cmf5hp5nsq/pub-solar-mastodon";
+  objStorHost = "mastodon.web.pub.solar";
 in
 {
   services.nginx.virtualHosts = {
@@ -10,6 +9,12 @@ in
       enableACME = true;
       forceSSL = true;
 
+      # Use variable to force nginx to perform a DNS resolution on its value,
+      # the IP of the object storage provider may not always remain the same.
+      extraConfig = ''
+        set $s3_backend 'https://${objStorHost}';
+      '';
+
       locations = {
         "= /" = {
           index = "index.html";
@@ -25,7 +30,6 @@ in
               deny all;
             }
 
-            resolver 8.8.8.8;
             proxy_set_header Host ${objStorHost};
             proxy_set_header Connection \'\';
             proxy_set_header Authorization \'\';
@@ -40,7 +44,7 @@ in
             proxy_hide_header x-amz-bucket-region;
             proxy_hide_header x-amzn-requestid;
             proxy_ignore_headers Set-Cookie;
-            proxy_pass https://${objStorHost}/${objStorBucket}$request_uri?download;
+            proxy_pass $s3_backend$uri;
             proxy_intercept_errors off;
             proxy_ssl_protocols TLSv1.2 TLSv1.3;
             proxy_ssl_server_name on;
diff --git a/modules/nginx/default.nix b/modules/nginx/default.nix
index 0122164d..46bec0ff 100644
--- a/modules/nginx/default.nix
+++ b/modules/nginx/default.nix
@@ -22,6 +22,13 @@ in
     recommendedOptimisation = true;
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
+    resolver.addresses = [
+      # quad9.net
+      "9.9.9.9"
+      "149.112.112.112"
+      "[2620:fe::fe]"
+      "[2620:fe::9]"
+    ];
     appendHttpConfig = ''
       # https://my.f5.com/manage/s/article/K51798430
       proxy_headers_hash_bucket_size 128;
diff --git a/secrets/mastodon-extra-env-secrets.age b/secrets/mastodon-extra-env-secrets.age
index 14ad42713dc4552370b4f661043838718a37b4cb..c78b5b57a4084f3047084aa98baa223137fd33a5 100644
GIT binary patch
literal 2663
zcmZXW>+9<V9maPi=*$aY=$xXCI*tm9XU(N)5=2=pP12-Io8}%7Op`SCHn%2Ca8qP+
z4pCGlUJyiNFvLwo+0;2a+Yoh}IgUfn7Y>;+kAk@Aiz!a@=ZlHDzu*H8pXd30-7vTi
z?7gZln)tB4`A~)976vZ7XH?hGg}_HJ3?@f0D<xexs>05TIwnTx4l|6>2uqGnI7YRk
zCP^0(&by>H#Y}az4}sO*TWcoTOm_M>=4fR>umZ`s?KnExE)=#wqa72_+D3l*|Fom+
zv2r)^a{lCqL7DS`EJo~#%b12eVO=Z<yQsGtLo_(0VA4bC0Su9%dzcb7r&#lm41=9j
zj<7=voenXiA$DfUhd^5Pu~EN7t7><&!!+R#0?h)%!!c~k(wSBv1urw>*&)y&R<Vaw
zt!$}kBQ<;Sw8`dfIe~;RJ8RL(8HhHd7pHj%unbrhA)=wQ&SOT5uWREt9g~nx8t`)O
zM{c1)7%9q85+r$Vwvcx`HWa;>Po3Im=QLoi5}Y6-H>wpHCX7whjintjqY5`QcBGOM
zJvafmJ<>|5xi<5KKv>C+b`QylX}uNK0&zWdyrOiBp;y8ax-J;s999_T$-#UnSoWbY
z6L2l`6;zj1TdE=2;k{##VpJ(g!A3x|!YTtBc2>M$X{4J*yU9U!C6)|}VP4^UwBB=a
zwb0x-y|OsL<krdz#TB$p0=lfN0#N50Lz$EE$tHuyR@zcQ5dn1-!aMYJ%@o@J1LsNT
z*l2BT30aw$exRBQt3DkU8*R1*;BAg#Q^B_qcU{<Po5A-L6Um?iPZc-S^WI~J9UPQx
zkmqMw&S)3aYy#aBML`U9<^#(-NnqF6kxXArpavI$b*oDo!8|(gk=QMyp*qw!B!b}~
zG`f&mvE;DSVU1&%Agpx($fkz5t``jvH~!H~SBylJFiMsP<v3iLa3|ji3IvAoF6a1|
z<NO6BL8lplV&Oh!77^e=8%*8z8bXud;Op72#m}TT`iW9*gERdV306wAB`FCZOr}Yq
ze9ASHW28D7K+}x?XtXXGXBmdPEY0d9G%YDC7L+Dn^;z!dWM)+3X}#VY$IJirIOSLs
zq5vi<?V_r3HEE_Rems}vW|I?hQr$JEDV(HU3}wDKqVrU$HI9T<k}FA^YDRYBr{OpS
zOf+dz6^S(3s@C#OWDbsJp?n6mZZ>3b2d!5;CC=wT$ni~&W!-kIs;<E5AkX-@0Rtcr
z!ZOrA8pEnX?G7dy1{T|+I49s$5vrbo=k=yd5eYLecb_|TC41tMZ|Wh@^ivD$WyB@c
zKCwvxuM)()$3aKE7i(MVqK$2?+g$Tn$yPyA=M*&-hZ(e&&N9O+N2VpI07PVMW_{e-
zeo5n&w5of0;~w31uuj!t81}ObT@kY55F63civuz*r3oDfiKG)#BQ6ABJnzO{xK%=R
z+M8ocbi<WAsBF8g*^Fig+|r3i;gH&xpl+*kARmE_-`U%3+IVr+5r86+btfP-Bzj0D
zLr}!{NFa{omDe7ldcmaY`bbPDTx?}?Qjl!3H)RkPwg{vfy{JQgmcucPGl<`+e!9wN
z8PZ7@?S$NfN=HvmR%&Y?2^tilE{7pTSS%5}R7O<Hhx%bj042?5TZ2hZZn7kZJ?b|$
zA!&HB_KT!pjVOe$fF^vBlTIdOAh9~>3fWD@yUJT-@<asUfi?t#C{!3H1a2E`lar@9
zvn+F)Mnug6(ym2qPB{^%9wt)gK(>k28=8{>e<sne4(KZnm9`F&90|?tgcc*|CETT2
zzMOTveKuKY94gs7Nt*e;Juc$*LV;k@QM(z|XVXt%so29HBri6ehY-bSK?}TK%|b@@
z3y|5{&@lAO+?rrr18k}gfm@;+rgk;kM)-b_R}Sh%Y3d{~+ciAbt|JhX<R<(d)=-w?
z_>7g?o)X17S41I+#^FP&gkyvES2-kzuq(3dQVM#q1AVRn^rKG>LW8#z6;aq8)3R}(
z#C$l2E)@)ip-Mf_uC}yj{imNV-B6oTS9Lg=AHi`slml&sWp#+~4Nv%yNsz?qPy~T+
zI?Y3$nDV|B*TBZ3<X))TFxMr$T(L!Na6-idR5GEMg*DI(thpq!SZ2^mYw!{+7K|xM
zjR>ww%ag>T?pZ010%B46*vhvHfhq$7cRWwrtvjYgTE+to>|uql4nM1Rr87jToh-vC
zlpic*Gs8km*}9WrW3~(iy^Ka1b+1t)I-Sh1Sp&-TR`qsy?qvS7cP+0lHAwYE2ga5(
zo=fvN-vL6)EQ0<h5-p^$rcIP;VMSmXHxQxGs0ijqqV4>_#mSc?38Ds)DI@!^ZHF1h
zfPz`9hd$6Lg>6%Mx!s{bj$<|C8B6!TTji+(5)opKOWk8r+}BIPn$NnN)v1|0<(qEd
zaO5uIi=Ammle2H+!iABR%DqzXRVPEvuHrCF1$QKQ@b=QAAyK$z1;W(avQHfXc;s_W
zUq1JnJ8ovqf9o5+yZpHG{&TlXZhhU&zx?K_Cjb2SVeu90>#u+A?&AwBas~S2;*Hmz
zzw6rjE<O7;o4fYKS6qDeJMPTVFZ`;y2Y6xd@4D^N|G0N_F8l5Sk5<L$nya4fgkKz*
z(bZ2r^6lsU`1cP<R~~ruuhZQJvM)dW<FD~g-2KdhcYeuwQ~lKR)sxSC@%bl@kG%6|
zpZW=9tB*@h{`S%*_~-41E*BTyGWnqWnebxj6c1Bd?uB39bo(3by>EKsUEhhi`i^tn
zJs+Nr9{c%Me|Y!(?|bE?{BM)rKlm5%-W$NTe)j6~x848Ihrx^L#iyPap7{uN{#~D^
zul?SYOSk{&4=w%TQ|GR_5qj>1XP^H5<+oQqy?*tWcJ8LDuA8i0^V*O7`A0#0+k3Bp
WZ+P~(E4RMczvZDHJjUE7UH2~|W0Z#g

literal 2878
zcmZ9OjqfA{dB-KnwYOL8wNVVT;IEtkbvS2tW@l!H9zEt|XJ&VHW@l#S-L|?r?=QQv
zJFh!~v_M}BVrh)^4bj9P7!_YmQ$$KjX;O%2P}EvuuP4{2gr13(M2{+o{j~{+<uCZ;
z`+UF8_j#6qchcK9dAlv6Z1d(U55RiRJNX9(MG>C#TnIr1_(4STaT6Rk6x#W|L9(K^
zFdDVpYTiyv0Ap<QeQ5@*bWsrcL`ZG5aZjg;+#O54ZbU0#!!7e+owgnc(1{$I;0ob7
zM1`w?%K815(kjcL#pYlrHTyk31!lptVg=gFsoAzB7aUN;X~slFN@8eCu($>jJrEyF
zLAY|KK-e!rgpL$vfb6$!5O+?Ydr7J*>>Q900~x(Y%ZufKkEmQ0^row+Eg&=|F!Q=C
zt$D%}nzIEpmp46DWP>uTs!|r$n!!s@7JE2G1n!Kr1Uz?|vBdNQUDjo4VobQTDLI(~
zTI$HH5Wpk$yupW|IYK;wm}}rt9M$#2bcJF$6q(tfKE#g4Nw4$;zb&T;1kQK7IyEQ2
zcIeZ>+N+#xhC54=8+YT;R2b~AO&<eFbSS3S#vZvFCZ+&1@8#<y;Ssr#>>YVzB(Q0%
zi*Cu$(y{^4$v}^DautR1RD=Lwhi8e<pUdKYn&~ClI>xB(p%MpZV3uH_qT;|3Ky{<u
z%6YVq%?Z-a$t3Q^=*0Fxiwcb(1+az{Rn-Z(3ER!p)x6h*&CZY{TSrGJfyPrJ(Kgf3
zMq7`^%!E(Pwgd;WGM8XzDOnRAM1&R12<@Ppbj_9)7rh-4WtKLK?7hSLNiI|!0i!mt
zu~clCQSLNbH8l`ok>oBidJ^G#sMXiPrjcrPP_AZrPeDY31$EouE054DjvsqAK(?Zw
z0Tuv4MYfp@qiKcj<=ja?nq;#bYa>t?jfM;yFYTVr2q3P}4Y2FfeZN2{(a&+uGzlh7
zDP%ZgnMH?)X;<|Fi`ejG)3~+Oj8-_q>=>@8dqrT6F%xl1UeC4=V|yAQ&xk6<NQL!k
z9uyc~B_(ABH=NB(@PvU=6Y27tcA`x%PpRH`i4Iav!uUDFVMU%YWmBvwLmCUUjWV_b
z2T3bLTer!JU(IpC(2G9N<M=dz32KPZcxNe1+V2Ndu`<iJ*-ppvP*eSo^}yWCC*)*f
z@5_E9^cU*^?d#qkn45NQ>LZ-0G5Ej>X*yP<!+okH5F%)9%bG%ir1=z{x2VXK$#^p>
zn@u^iO>K~r1!z@b;`Js`hT0<OX!ulcsX@K45^xCTfg#6;18>++2P85RVUm;;URQiK
z8*LHaT|k&XBnX)Fc0-J*C^>T0b&w}5(ohCp!z*vk4+v*s(Ds^PLJRXXb86d%0T**u
zH>;$-8IpRYP+rfAiP^H1)@s(NjH|X5g4dl84i(-h_FXcxi*Xy|88T#sxLF)l1fv34
z?oCa+WanEu=oR}hnAbkD7UH;Vi#iLZF{s2fvahtPYMFr}(eA>@Vaql2aHZC>wj6em
z<S$0jJRbqQDGY&;3I(f~$c->C4@-kxlNqi{&K%i5NHCh~8w?@lWgrd$8q1{Eq7s=5
zN{yPu>$WG$%p&YGMTWF8Wu>tbBl>L3l>5w&Y;!PT0&UMUhTgQTD#Mh#?xJOlb0G*Q
zJj-mo-X2ias*+VJQBgwFs}nrM`qhLURD5O`3xrY8kv9gqttv*fq2rNVrald2d^lYw
zc82t3I>)g&IX70R&Ph_dLLm!p25B&?)|^F?g6C4&Oxx{e`F1d-_mibnxvd)L=B_9#
z!|eGr+l3IiaKuHPPGc0@iA#!J5f<N%DV>E_hvtBZw<uS^|K@lb)hD+Qf*#aLCmmKl
z5u?(gAyiMOJF`F3+0Z1%y2Y!b#-D(yQZ7~iw<hKZ7ID2HDPgpbK@{L(SZdNUA2AhZ
zs<{(r1ZB&0$`>mo14(;9{6AK=+kw#`YYhu#JeYw5*B{_pD-%tBZkb)*Nrz5_W=nIL
zj+SUk_Z_X5@(#6_P;JESHz*0@xU9KDYan3DNQ=^R7AOlqc4=C!lNa~%#T#ldi+K?o
z1cb`jO*?@}vu1XrBd@S*2~#E?Z3bOdLv0bRV8q;IEYX`-{C3Q`QO(vfV#`xh4p@52
zC<6iZXD!z>IfAtEB#)BuOKB0OqcCxhi`_`TXj`!+;bz)Z<-W%2kr!#CD=Diz)5X4}
z`$Cb@!ycLJHhU>C%ZynHtZl?RHpS%~+yo;Fr%2f9&tPz;t?J_cJp0xEfYggtB@T9d
z3gTwV*a|pBU!}Pf)j`~6Hl)AC40&O7+l@A@%4Vtzd#u1<SW%R;oB6BS*U-+gwuioX
z>6V`@#?6e_C2TyAfKBsKZ2+u8seB-fbPA*=A*895+pRbKoqpKy9;MZ?i5Oid0|Fz%
z<_t*3JxGihx{oW>T-w768Q_*<%GErm8$~oUW~COyyQ#O<n*4B*Cr=)f3GL`(((vUC
z>PDG5)ApkwAXlldH|Rok^)XnXDc}M=(R<{f{pZd;9R1O^uRr+A{oklm3;o{0JHp-R
zKKSenpE>vW$>R83pZ)LSA3u1@S04G{&tBdC*PC9EyylMI`@-=sdf=6-Uq1fKHTfrA
zxb20DgQvRt2TyeG{mI$4-}KhkTz}%j&wus7@|!=dkKBCetBhYfclw&^&i~iXzVvhJ
z^r@?lJ$>}<?|d=jZn*v3PX$+8a_Z>s|KTmjIpaeQ|I6P(!Ob7M|E~Lg?frj~efrNY
zKK8~xyA?cfhj`6(&%XIDzOJ9U<t-=fqtX2p4}Rm?)Au}d)xZDX{r8=+Pb|ly*C9{7
z{4e)cKX%X0?>_Uk)0h0mr-&bZ>@xoKyH5n(bw6PIyNS!cduRIGn{E#NZo&NH_kQ=C
z=U$#a^PboJY4M*|=!SCTnMYrC;dfpO{D{{tJ#+cR$#4DfNc+%x|KW?t<-ZAC_V&BH
zBl+F8{_}TUuikUwsc(_rKl<8tU48D@$1b^W!*$m_|J^rSbzk=-7<%C15&usL{N0~_
z_$D0q#Yb)|uYWRl^wBqbz}$9^f3<qzN#NY2+TzzwJo(6{?l|>z`rxQ>;ge5X`|2b2
zp1=2N$3FVk4;=j^!d!Uh$EVsW?)~y#J$mGhv&aAb*y;D2`rzuy_kI7j&-lw%p1kei
z(SQ3~{i?yY-uM&h1FPGg{*m^+%Z@$s*)!ih{ZHV1&pofr-^M@w7<&7I$M3xH>?N07
zycGWE)y0+Xc-e29JO+F3yz9bMx1QHO{EGfr`kOD@c+G7GGV{~(KYjX^^UwYdxJ&g4