40627a94d4
A recent group of vulnerabilities have been found in Pleroma (and inherited by Akkoma) that involve media files either uploaded by local users or proxied from remote instances (if media proxy is enabled). It is recommended that media files are served on a separate subdomain in order to mitigate this class of vulnerabilities. Based on https://meta.akkoma.dev/t/another-vector-for-the-injection-vulnerability-found/483/2
37 lines
1.1 KiB
Caddyfile
37 lines
1.1 KiB
Caddyfile
# default Caddyfile config for Akkoma
|
|
#
|
|
# Simple installation instructions:
|
|
# 1. Replace 'example.tld' with your instance's domain wherever it appears.
|
|
# 2. Copy this section into your Caddyfile and restart Caddy.
|
|
|
|
# If you are able to, it's highly recommended to have your media served via a separate subdomain for improved security.
|
|
# Uncomment the relevant sectons here and modify the base_url setting for Pleroma.Upload and :media_proxy accordingly.
|
|
|
|
example.tld {
|
|
log {
|
|
output file /var/log/caddy/akkoma.log
|
|
}
|
|
|
|
encode gzip
|
|
|
|
# this is explicitly IPv4 since Pleroma.Web.Endpoint binds on IPv4 only
|
|
# and `localhost.` resolves to [::0] on some systems: see issue #930
|
|
reverse_proxy 127.0.0.1:4000
|
|
|
|
# Uncomment if using a separate media subdomain
|
|
#@mediaproxy path /media/* /proxy/*
|
|
#handle @mediaproxy {
|
|
# redir https://media.example.tld{uri} permanent
|
|
#}
|
|
}
|
|
|
|
# Uncomment if using a separate media subdomain
|
|
#media.example.tld {
|
|
# @mediaproxy path /media/* /proxy/*
|
|
# reverse_proxy @mediaproxy 127.0.0.1:4000 {
|
|
# transport http {
|
|
# response_header_timeout 10s
|
|
# read_timeout 15s
|
|
# }
|
|
# }
|
|
#}
|