mirror of
				https://codeberg.org/yeentown/barkey.git
				synced 2025-11-03 23:14:13 +00:00 
			
		
		
		
	* fix(backend): Fix an issue where the origin of ActivityPub lookup response was not validated correctly. [GHSA-6w2c-vf6f-xf26](https://github.com/misskey-dev/misskey/security/advisories/GHSA-6w2c-vf6f-xf26) Signed-off-by: eternal-flame-AD <yume@yumechi.jp> * Enhance: Add configuration option to disable all external redirects when responding to an ActivityPub lookup (config.disallowExternalApRedirect) Signed-off-by: eternal-flame-AD <yume@yumechi.jp> * fixup! fix(backend): Fix an issue where the origin of ActivityPub lookup response was not validated correctly. * docs & one edge case Signed-off-by: eternal-flame-AD <yume@yumechi.jp> * apply suggestions Signed-off-by: eternal-flame-AD <yume@yumechi.jp> * remove stale frontend reference to _responseInvalidIdHostNotMatch Signed-off-by: eternal-flame-AD <yume@yumechi.jp> * apply suggestions Signed-off-by: eternal-flame-AD <yume@yumechi.jp> --------- Signed-off-by: eternal-flame-AD <yume@yumechi.jp>
		
			
				
	
	
		
			229 lines
		
	
	
	
		
			7 KiB
		
	
	
	
		
			YAML
		
	
	
	
	
	
			
		
		
	
	
			229 lines
		
	
	
	
		
			7 KiB
		
	
	
	
		
			YAML
		
	
	
	
	
	
#━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 | 
						|
# Misskey configuration
 | 
						|
#━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 | 
						|
 | 
						|
#   ┌────────────────────────┐
 | 
						|
#───┘ Initial Setup Password └─────────────────────────────────────────────────────
 | 
						|
 | 
						|
# Password to initiate setting up admin account.
 | 
						|
# It will not be used after the initial setup is complete.
 | 
						|
#
 | 
						|
# Be sure to change this when you set up Misskey via the Internet.
 | 
						|
#
 | 
						|
# The provider of the service who sets up Misskey on behalf of the customer should
 | 
						|
# set this value to something unique when generating the Misskey config file,
 | 
						|
# and provide it to the customer.
 | 
						|
setupPassword: example_password_please_change_this_or_you_will_get_hacked
 | 
						|
 | 
						|
#   ┌─────┐
 | 
						|
#───┘ URL └─────────────────────────────────────────────────────
 | 
						|
 | 
						|
# Final accessible URL seen by a user.
 | 
						|
url: 'http://misskey.local'
 | 
						|
 | 
						|
# ONCE YOU HAVE STARTED THE INSTANCE, DO NOT CHANGE THE
 | 
						|
# URL SETTINGS AFTER THAT!
 | 
						|
 | 
						|
#   ┌───────────────────────┐
 | 
						|
#───┘ Port and TLS settings └───────────────────────────────────
 | 
						|
 | 
						|
#
 | 
						|
# Misskey requires a reverse proxy to support HTTPS connections.
 | 
						|
#
 | 
						|
#                 +----- https://example.tld/ ------------+
 | 
						|
#   +------+      |+-------------+      +----------------+|
 | 
						|
#   | User | ---> || Proxy (443) | ---> | Misskey (3000) ||
 | 
						|
#   +------+      |+-------------+      +----------------+|
 | 
						|
#                 +---------------------------------------+
 | 
						|
#
 | 
						|
#   You need to set up a reverse proxy. (e.g. nginx)
 | 
						|
#   An encrypted connection with HTTPS is highly recommended
 | 
						|
#   because tokens may be transferred in GET requests.
 | 
						|
 | 
						|
# The port that your Misskey server should listen on.
 | 
						|
port: 61812
 | 
						|
 | 
						|
#   ┌──────────────────────────┐
 | 
						|
#───┘ PostgreSQL configuration └────────────────────────────────
 | 
						|
 | 
						|
db:
 | 
						|
  host: db
 | 
						|
  port: 5432
 | 
						|
 | 
						|
  # Database name
 | 
						|
  db: misskey
 | 
						|
 | 
						|
  # Auth
 | 
						|
  user: postgres
 | 
						|
  pass: postgres
 | 
						|
 | 
						|
  # Whether disable Caching queries
 | 
						|
  #disableCache: true
 | 
						|
 | 
						|
  # Extra Connection options
 | 
						|
  #extra:
 | 
						|
  #  ssl: true
 | 
						|
 | 
						|
dbReplications: false
 | 
						|
 | 
						|
# You can configure any number of replicas here
 | 
						|
#dbSlaves:
 | 
						|
#  -
 | 
						|
#    host:
 | 
						|
#    port:
 | 
						|
#    db:
 | 
						|
#    user:
 | 
						|
#    pass:
 | 
						|
#  -
 | 
						|
#    host:
 | 
						|
#    port:
 | 
						|
#    db:
 | 
						|
#    user:
 | 
						|
#    pass:
 | 
						|
 | 
						|
#   ┌─────────────────────┐
 | 
						|
#───┘ Redis configuration └─────────────────────────────────────
 | 
						|
 | 
						|
redis:
 | 
						|
  host: redis
 | 
						|
  port: 6379
 | 
						|
  #family: 0  # 0=Both, 4=IPv4, 6=IPv6
 | 
						|
  #pass: example-pass
 | 
						|
  #prefix: example-prefix
 | 
						|
  #db: 1
 | 
						|
 | 
						|
#redisForPubsub:
 | 
						|
#  host: redis
 | 
						|
#  port: 6379
 | 
						|
#  #family: 0  # 0=Both, 4=IPv4, 6=IPv6
 | 
						|
#  #pass: example-pass
 | 
						|
#  #prefix: example-prefix
 | 
						|
#  #db: 1
 | 
						|
 | 
						|
#redisForJobQueue:
 | 
						|
#  host: redis
 | 
						|
#  port: 6379
 | 
						|
#  #family: 0  # 0=Both, 4=IPv4, 6=IPv6
 | 
						|
#  #pass: example-pass
 | 
						|
#  #prefix: example-prefix
 | 
						|
#  #db: 1
 | 
						|
 | 
						|
#redisForTimelines:
 | 
						|
#  host: redis
 | 
						|
#  port: 6379
 | 
						|
#  #family: 0  # 0=Both, 4=IPv4, 6=IPv6
 | 
						|
#  #pass: example-pass
 | 
						|
#  #prefix: example-prefix
 | 
						|
#  #db: 1
 | 
						|
 | 
						|
#redisForReactions:
 | 
						|
#  host: redis
 | 
						|
#  port: 6379
 | 
						|
#  #family: 0  # 0=Both, 4=IPv4, 6=IPv6
 | 
						|
#  #pass: example-pass
 | 
						|
#  #prefix: example-prefix
 | 
						|
#  #db: 1
 | 
						|
 | 
						|
#   ┌───────────────────────────┐
 | 
						|
#───┘ MeiliSearch configuration └─────────────────────────────
 | 
						|
 | 
						|
#meilisearch:
 | 
						|
#  host: meilisearch
 | 
						|
#  port: 7700
 | 
						|
#  apiKey: ''
 | 
						|
#  ssl: true
 | 
						|
#  index: ''
 | 
						|
 | 
						|
#   ┌───────────────┐
 | 
						|
#───┘ ID generation └───────────────────────────────────────────
 | 
						|
 | 
						|
# You can select the ID generation method.
 | 
						|
# You don't usually need to change this setting, but you can
 | 
						|
# change it according to your preferences.
 | 
						|
 | 
						|
# Available methods:
 | 
						|
# aid ... Short, Millisecond accuracy
 | 
						|
# aidx ... Millisecond accuracy
 | 
						|
# meid ... Similar to ObjectID, Millisecond accuracy
 | 
						|
# ulid ... Millisecond accuracy
 | 
						|
# objectid ... This is left for backward compatibility
 | 
						|
 | 
						|
# ONCE YOU HAVE STARTED THE INSTANCE, DO NOT CHANGE THE
 | 
						|
# ID SETTINGS AFTER THAT!
 | 
						|
 | 
						|
id: 'aidx'
 | 
						|
 | 
						|
#   ┌────────────────┐
 | 
						|
#───┘ Error tracking └──────────────────────────────────────────
 | 
						|
 | 
						|
# Sentry is available for error tracking.
 | 
						|
# See the Sentry documentation for more details on options.
 | 
						|
 | 
						|
#sentryForBackend:
 | 
						|
#  enableNodeProfiling: true
 | 
						|
#  options:
 | 
						|
#    dsn: 'https://examplePublicKey@o0.ingest.sentry.io/0'
 | 
						|
 | 
						|
#sentryForFrontend:
 | 
						|
#  options:
 | 
						|
#    dsn: 'https://examplePublicKey@o0.ingest.sentry.io/0'
 | 
						|
 | 
						|
#   ┌─────────────────────┐
 | 
						|
#───┘ Other configuration └─────────────────────────────────────
 | 
						|
 | 
						|
# Whether disable HSTS
 | 
						|
#disableHsts: true
 | 
						|
 | 
						|
# Number of worker processes
 | 
						|
#clusterLimit: 1
 | 
						|
 | 
						|
# Job concurrency per worker
 | 
						|
# deliverJobConcurrency: 128
 | 
						|
# inboxJobConcurrency: 16
 | 
						|
 | 
						|
# Job rate limiter
 | 
						|
# deliverJobPerSec: 128
 | 
						|
# inboxJobPerSec: 32
 | 
						|
 | 
						|
# Job attempts
 | 
						|
# deliverJobMaxAttempts: 12
 | 
						|
# inboxJobMaxAttempts: 8
 | 
						|
 | 
						|
# IP address family used for outgoing request (ipv4, ipv6 or dual)
 | 
						|
#outgoingAddressFamily: ipv4
 | 
						|
 | 
						|
# Proxy for HTTP/HTTPS
 | 
						|
#proxy: http://127.0.0.1:3128
 | 
						|
 | 
						|
proxyBypassHosts:
 | 
						|
  - api.deepl.com
 | 
						|
  - api-free.deepl.com
 | 
						|
  - www.recaptcha.net
 | 
						|
  - hcaptcha.com
 | 
						|
  - challenges.cloudflare.com
 | 
						|
 | 
						|
# Proxy for SMTP/SMTPS
 | 
						|
#proxySmtp: http://127.0.0.1:3128   # use HTTP/1.1 CONNECT
 | 
						|
#proxySmtp: socks4://127.0.0.1:1080 # use SOCKS4
 | 
						|
#proxySmtp: socks5://127.0.0.1:1080 # use SOCKS5
 | 
						|
 | 
						|
# Media Proxy
 | 
						|
#mediaProxy: https://example.com/proxy
 | 
						|
 | 
						|
# Proxy remote files (default: true)
 | 
						|
proxyRemoteFiles: true
 | 
						|
 | 
						|
# Sign to ActivityPub GET request (default: true)
 | 
						|
signToActivityPubGet: true
 | 
						|
 | 
						|
allowedPrivateNetworks: [
 | 
						|
  '127.0.0.1/32'
 | 
						|
]
 | 
						|
 | 
						|
# Disable automatic redirect for ActivityPub object lookup. (default: false)
 | 
						|
# This is a strong defense against potential impersonation attacks if the viewer instance has inadequate validation.
 | 
						|
# However it will make it impossible for other instances to lookup third-party user and notes through your URL.
 | 
						|
#disallowExternalApRedirect: true
 | 
						|
 | 
						|
# Upload or download file size limits (bytes)
 | 
						|
#maxFileSize: 262144000
 |