this post was submitted on 28 Dec 2024
12 points (100.0% liked)

PieFed help

412 readers
1 users here now

It's seems right that we should have a local community to help us all with PieFed

founded 1 year ago
MODERATORS
007@piefed.social
12
Questions about setting up a new instance (piefed.social)
submitted 4 months ago by taters@piefed.social to c/piefed_help@piefed.social
20 comments fedilink hide all child comments
 

Hi, I'm just starting out with self hosting and I am currently working on a project meant to serve a small town that I live in. What I would like to do is host a small social media site from a Rapsberry Pi 5. I'm not expecting to have a lot of people using it so I'm not pressured about the hardware requirements at this point in time.

I have a few questions before I go any further.

  1. Is it possible to set up a PieFed instance as text only? I'm not interested in moderating images or videos. Also, I'm also running this from a residential connection so I don't want to affect my home traffic. All aspects of this project are meant to be as minimal as possible to access more people.

  2. My ISP blocks ports. I intend to call them soon and talk to them about unblocking ports. If I am unable to do that, my backup plan to simply run an instance that is unfederated. It will act as a message board for my town. Can I set PieFed to a custom port for traffic? For example using piefed.domainname.com:8080 as the address for people to reach my server.

  3. Does the registration for new users require any SSL? I'm not entirely sure if that would be affected the same as federation without SSL.

  4. Would mail related services be affected by blocked ports? Would I be able to use another email address not associated with my domain name and PieFed instance?

Thanks for any help or information.

top 20 comments
sorted by: hot top controversial new old
[–] rimu@piefed.social 3 points 4 months ago* (last edited 4 months ago) (1 children)

Yes there is a setting to disable the creation of image posts. Don't worry too much about space usage - after 1 year of operation piefed.social is only using 20 GB for media storage.

For the blocked ports - look into using Cloudflare tunnels aka their Zero Trust product. It's free and very easy to set up. You just need a daemon running on your server which keeps the tunnel open and you configure it all from within the CF dashboard. Just remember to exclude the url "/inbox" from the WAF.

SSL is required but if you use Cloudflare they will take care of SSL for you.

You only need to send email, not receive it so your ISP won't block that. You'll need a SMTP server or AWS SES account. The free tier of https://www.smtp2go.com/ gives you 200 emails per day which should be plenty.

For more info please see https://codeberg.org/rimu/pyfedi/src/branch/main/INSTALL.md. Using docker makes it easier but it's still a moderately challenging beast to set up so perhaps not ideal if you have never self-hosted anything before. Good luck!

[–] taters@piefed.social 2 points 4 months ago (2 children)

Thanks for the information.

I have a more questions about account registration/logins. If I understand correctly, they will require SSL.

Before I ask anything, I just want to explain what it is I want to do so it's easier to understand where I'm coming from.

I want to start a seed library for my local community in my town. Unless Monsanto is targeting libraries for heritage seeds, I feel my risk is quite low.

I would like a simple place for people to talk, share information and organize events. I'm also trying to create everything as independent from outside services as possible. The reason being that if any of these outside services experience an extended outage, I can physically move my Raspberry Pi box to central location with local internet/wifi (a library for example) and people will still be able to access all the information. Think of the pi box as becoming a digital community board. In this situation, federation is completely unimportant.

If Cloudflare tunneling experiences issues or outages, can people still create and login to accounts locally? I'm going to assume any disruptions to any email services would also have an effect since that is used for registration as well.

I prefer the Reddit/Lemmy/Piefed style and the markdown language works well with the other parts of my project. It's not necessary and I may keep searching around for something that suites my use case better.

I'll most likely go ahead and try installing PieFed anyways with Cloudflare tunneling(or Let's Encrypt if I don't have to worry about blocked ports) and smtp2go. At the very least it'll be an experience and a good place to start for my needs. I can move on from there if I feel the need to.

Thanks again.

[–] rimu@piefed.social 1 points 4 months ago* (last edited 4 months ago) (1 children)

You can convert an instance to run locally over http without SSL, yes. All you need to do is change your SERVER_NAME environment variable to 127.0.0.1:5000 or whatever your IP address is. Federation won't work but that's ok for this scenario.

I ran piefed.social without cloudflare for a few weeks, until the network activity caused by federation required better caching. I used Nginx to listen on port 443 (and to integrate with Lets Encrypt for SSL) and forward requests through to port 5000. This is the setup I documented in the "the hard way" installation instructions. Hopefully your ISP does not use CGNAT and you'll simply be able to open a port on your router and send it through to your Pi.

You don't really really need email to work because you can create accounts manually through the admin area. Other than during registration the other other function email is used for is notifications about replies, new posts, etc which isn't crucial.

[–] taters@piefed.social 1 points 4 months ago (1 children)

So after a few attempts, I was able to get PieFed working by accessing it through pi.MyDomainName.ca:5000

I changed the SERVER_NAME in .env.docker to match the address above, but with my actual domain name. I also changed the port numbers from 8030:5000 to 5000:5000 in the compose.yaml

I am running into an issue when I attempt to use the login information after the database initialization steps. I get the error "The CSRF tokens do not match." above the username field on the login screen. I'm not sure what that means exactly.

Other than that, using the docker was fairly straight forward except for some information I forgot to put in correctly the first couple times.

[–] rimu@piefed.social 1 points 4 months ago (2 children)

Congrats :)

Does your SERVER_NAME include :5000 on the end? It probably should.

CSRF is a type of hack where the attacker sends fake requests to a web app, from another domain. If PieFed thinks a normal form submission is coming from another domain then that makes me think your reverse proxy (Nginx? Caddy?) needs to add a header that tells PieFed what the domain of the original request was, before it was forwarded on to PieFed. Or are you not using a reverse proxy at all?

[–] taters@piefed.social 1 points 3 months ago (1 children)

I decided to start over today with a fresh OS install on my Pi. I did everything according to a checklist I started so nothing new has changed from my knowledge. I am getting errors trying to get past the

export DOCKER_BUILDKIT=1  
docker-compose up --build

part of the INSTALL.md for the docker instructions.

I've saved a copy of my terminal but I'm not sure where a good spot to paste it is since it's long. There were a lot of permission error 13's so I tried

sudo docker-compose up --build

and things started to download and proceed up until a point before another error showed up.

Step 1/14 : FROM --platform=$BUILDPLATFORM python:3-alpine AS builder  
failed to parse platform : "" is an invalid component of "": platform specifier component must match "^[A-Za-z0-9_-]+$": invalid argument  
ERROR: Service 'celery' failed to build : Build failed

I'm quite confident I did nothing different this time so I don't know what would be causing issues today. I can provide you with the outputs from my terminal if that will help you.

[–] rimu@piefed.social 1 points 3 months ago (1 children)

I have only tried building the docker image on my laptop, which has a different CPU architecture than a Pi. On your system the buildplatform variable is empty for some reason. You could try editing the file Dockerfile to have --platform=linux/arm64/v8 or maybe try removing it entirely so the line is just FROM python:3-alpine AS builder.

Do you have a quite old version of docker? Try running docker version to check.

[–] taters@piefed.social 1 points 3 months ago (1 children)

You're right, it was outdated. It seems I got mixed up after a fresh OS install on my Pi. I used APT to download and install docker which is extremely outdated. I now have proper repositories set up for both docker and nginx and everything is up to date. I didn't need to make any changes to the dockerfile with the proper version.

I'm having issues getting nginx, pyfedi.service and celery.service to work.

Below are some snippets from my notes which should lay out all the steps I've taken, hopefully that will explain where I am currently at.

## Apt software  
sudo apt install ddclient gufw -y  

# ddclient -> Account/Password/Domain Address  
# gufw  

## Repository Software  
# Docker -> Install-> https://docs.docker.com/engine/install/debian/  
# nginx -> Install -> https://nginx.org/en/linux_packages.html#Debian  
        -> sudo nano /etc/nginx/nginx.conf  
           -> Add line -> include /etc/nginx/sites-enabled/DOMAINNAME;  
        -> sudo nano /etc/nginx/sites-enabled/DOMAIN -> Copy DOMAINNAME reverse proxy settings from USB  
        -> sudo nginx -t  
        -> sudo service nginx restart  

## Docker Images  
# PieFed -> Install: Easy/Docker -> https://codeberg.org/rimu/pyfedi/src/branch/main/INSTALL.md  
  ->Edit file entries  
    -env.docker  
     -> SECRET_KEY='k3avh6fp'  
     -> SERVER_NAME='pi.DOMAINNAME.ca:5000'  
    -compose.yaml  
     -> ports: - '8030:5000' -> - '5000:5000'  

## Running In Production  
# Virtual Environment -> Gunicorn & Celery  
  -> python -m venv ~/home/USERNAME/pyfedi/venv  
  -> source ~/home/USERNAME/pyfedi/venv/bin/activate  
  -> pip3 install gunicorn celery  
  -> deactivate  
# Copy file celery_worker.default.py -> celery_worker.py  
  -> Change -> DATABASE_URL -> postgresql+psycopg2://piefed:piefed@db/piefed  
  -> Change -> SERVER_NAME -> pi.DOMAINNAME.ca:5000  
# Create Background Service Files -> Copy EACH from USB  
  -> sudo nano /etc/systemd/system/pyfedi.service  
  -> sudo nano /etc/systemd/system/celery.service  
  -> sudo nano /etc/default/celeryd  
# Enable/Start Background Services  
  -> sudo systemctl enable pyfedi.service  
  -> sudo systemctl enable celery.service  
  -> sudo systemctl start pyfedi.service  
  -> sudo systemctl start celery.service  

upstream app_server {  
    # fail_timeout=0 means we always retry an upstream even if it failed  
    # to return a good HTTP response  

    # for UNIX domain socket setups  
    # server unix:/tmp/gunicorn.sock fail_timeout=0;  

    # for a TCP configuration  
    server 192.168.40.140:5000 fail_timeout=0;  
    keepalive 4;  
}  

server {  
    listen 5000;  
    listen [::]:5000;  
    server_name pi.DOMAINNAME.ca;  
    root /home/USERNAME/pyfedi/app;  

    keepalive_timeout 30;  
    ssi off;  

    location / {  
        # Proxy all requests to Gunicorn  
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
        proxy_set_header X-Forwarded-Proto $scheme;  
        proxy_set_header Host $http_host;  
        proxy_redirect off;  
        proxy_http_version 1.1;  
        proxy_set_header Connection "";  
        proxy_pass http://app_server;  
        ssi off;  
    }  

    # Serve static files directly with nginx  
    location ~* /static/ {  
        alias /home/USERNAME/pyfedi/app/static/;  
        expires max;  
        access_log off;  
    }  

}
[–] taters@piefed.social 1 points 3 months ago (1 children)

To start, if I load PieFed first, then nginx I get an error like below:

nginx error:

× nginx.service - nginx - high performance web server  
     Loaded: loaded (/lib/systemd/system/nginx.service; enabled; preset: enabled)  
     Active: failed (Result: exit-code) since Thu 2025-01-02 17:26:07 EST; 22s ago  
   Duration: 5min 39.898s  
       Docs: https://nginx.org/en/docs/  
    Process: 9406 ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf (code=exited, status=1/FAILURE)  
        CPU: 6ms  

Jan 02 17:26:06 pi nginx[9406]: nginx: [emerg] bind() to 0.0.0.0:5000 failed (98: Address already in use)  
Jan 02 17:26:06 pi nginx[9406]: nginx: [emerg] bind() to [::]:5000 failed (98: Address already in use)  
Jan 02 17:26:06 pi nginx[9406]: nginx: [emerg] bind() to 0.0.0.0:5000 failed (98: Address already in use)  
Jan 02 17:26:06 pi nginx[9406]: nginx: [emerg] bind() to [::]:5000 failed (98: Address already in use)  
Jan 02 17:26:07 pi nginx[9406]: nginx: [emerg] bind() to 0.0.0.0:5000 failed (98: Address already in use)  
Jan 02 17:26:07 pi nginx[9406]: nginx: [emerg] bind() to [::]:5000 failed (98: Address already in use)  
Jan 02 17:26:07 pi nginx[9406]: nginx: [emerg] still could not bind()  
Jan 02 17:26:07 pi systemd[1]: nginx.service: Control process exited, code=exited, status=1/FAILURE  
Jan 02 17:26:07 pi systemd[1]: nginx.service: Failed with result 'exit-code'.  
Jan 02 17:26:07 pi systemd[1]: Failed to start nginx.service - nginx - high performance web server.

If I do the opposite and load nginx before PieFed, PieFed will make a similar complaint about sharing the same port.

The pyfedi.service, celery.service and celeryd files all look similar to the examples from the INSTALL.md except I changed the directory names to match my name in the appropriate places.

Here are the error messages I am getting from systemctl:

pyfedi.service error/celery.service error:

sudo systemctl status celery.service  
× pyfedi.service - Gunicorn instance to serve PieFed application  
     Loaded: loaded (/etc/systemd/system/pyfedi.service; enabled; preset: enabled)  
     Active: failed (Result: exit-code) since Thu 2025-01-02 14:28:27 EST; 4h 42min ago  
   Duration: 126ms  
    Process: 6699 ExecStart=/home/USERNAME/pyfedi/venv/bin/gunicorn --config gunicorn.conf.py --preload pyfedi:app (code>  
   Main PID: 6699 (code=exited, status=1/FAILURE)  
        CPU: 126ms  

Jan 02 14:28:27 pi systemd[1]: pyfedi.service: Scheduled restart job, restart counter is at 5.  
Jan 02 14:28:27 pi systemd[1]: Stopped pyfedi.service - Gunicorn instance to serve PieFed application.  
Jan 02 14:28:27 pi systemd[1]: pyfedi.service: Start request repeated too quickly.  
Jan 02 14:28:27 pi systemd[1]: pyfedi.service: Failed with result 'exit-code'.  
Jan 02 14:28:27 pi systemd[1]: Failed to start pyfedi.service - Gunicorn instance to serve PieFed application.  
lines 1-13/13 (END)  

----------  

× celery.service - Celery Service  
     Loaded: loaded (/etc/systemd/system/celery.service; enabled; preset: enabled)  
     Active: failed (Result: exit-code) since Thu 2025-01-02 14:28:26 EST; 4h 42min ago  
    Process: 6694 ExecStart=/bin/sh -c ${CELERY_BIN} multi start -A ${CELERY_APP} ${CELERYD_NODES} --pidfile=${CELERY>  
        CPU: 341ms  

Jan 02 14:28:26 pi sh[6695]:   File "<frozen importlib._bootstrap_external>", line 940, in exec_module  
Jan 02 14:28:26 pi sh[6695]:   File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed  
Jan 02 14:28:26 pi sh[6695]:   File "/home/USERNAME/pyfedi/celery_worker.py", line 3, in <module>  
Jan 02 14:28:26 pi sh[6695]:     from app import celery, create_app  
Jan 02 14:28:26 pi sh[6695]:   File "/home/USERNAME/pyfedi/app/__init__.py", line 7, in <module>  
Jan 02 14:28:26 pi sh[6695]:     from flask import Flask, request, current_app, session  
Jan 02 14:28:26 pi sh[6695]: ModuleNotFoundError: No module named 'flask'  
Jan 02 14:28:26 pi systemd[1]: celery.service: Control process exited, code=exited, status=2/INVALIDARGUMENT  
Jan 02 14:28:26 pi systemd[1]: celery.service: Failed with result 'exit-code'.  
Jan 02 14:28:26 pi systemd[1]: Failed to start celery.service - Celery Service.

At this point I am stuck and not sure where to go from here.

[–] rimu@piefed.social 2 points 3 months ago (1 children)

You seem to have followed the instructions for BOTH the easy way (docker) AND the hard way - you have PieFed running in docker AND you have it installed on the host. Is that it?

[–] taters@piefed.social 1 points 3 months ago (1 children)

There is just one PieFed running in docker on the Pi. My labeling might be a little confusing there.

I followed the easy instructions up until getting PieFed running in the background then skipped down to the Running PieFed in production section. I didn't see any of the files mentioned in that section and thought to continue from there.

[–] rimu@piefed.social 3 points 3 months ago (2 children)

Ahh there we go. The first half of 'running piefed in production' is for the hard non-docker way. The second half will need heavily modification to be appropriate for docker.

Sorry to waste your time. I'll split the installation instructions into two files because mashing them up together like this is very confusing.

[–] taters@piefed.social 1 points 3 months ago

No worries, I'm at least learning a lot about network communication and using the terminal in linux more comfortably. In this case I learned how virtual environments work.

Also since it's a Pi, I've been copying and swapping SD cards at certain points as a backup. It's easy to clean up learning mistakes along the way. It's also good practice before I do it all over again on a proper storage device.

[–] taters@piefed.social 1 points 3 months ago

I've tried just building PieFed in docker with as few things changed as possible and I am still running getting the same message when I try to log in. The CSRF tokens do not match.

The only change I made was in the .env.docker file which was SERVER_NAME='pi.DOMAINNAME.ca:8030'

This is what the reverse proxy in nginx looks like now:

upstream app_server {  
    # fail_timeout=0 means we always retry an upstream even if it failed  
    # to return a good HTTP response  

    # for UNIX domain socket setups  
    # server unix:/tmp/gunicorn.sock fail_timeout=0;  

    # for a TCP configuration  
    server 192.168.40.140:5000 fail_timeout=0;  
    keepalive 4;  
}  

server {  
    server_name pi.DOMAINNAME.ca;  
    root /home/USERNAME/pyfedi/app;  

    keepalive_timeout 30;  
    ssi off;  

    location / {  
        # Proxy all requests to Gunicorn  
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
        proxy_set_header X-Forwarded-Proto $scheme;  
        proxy_set_header Host $http_host;  
        proxy_redirect off;  
        proxy_http_version 1.1;  
        proxy_set_header Connection "";  
        proxy_pass http://app_server;  
        ssi off;  
    }  

   # Serve static files directly with nginx  
    location ~* /static/ {  
        alias /home/USERNAME/pyfedi/app/static/;  
        expires max;  
        access_log off;  
    }  

}

I've tried changing ports, commenting out different parts and it's still the same. I've even checked the port forwarding settings and I still getting the same message. I did notice when I ran netstat -tunpl I didn't see any ports from docker for port 5000. If I understand how the reverse proxy works, I should have a connection coming in from the outside on port 8030 and be redirected by nginx to port 5000 on the local machine where PieFed is hosted? If that's right, then nginx isn't sending anything through 5000 locally and just through 8030 I think.

[–] taters@piefed.social 1 points 4 months ago

Yeah, I had :5000 at the end, otherwise I would have gotten an error with the initial website connection from a browser saying the domain did not match. That's how I figured out to change the port in the compose.yaml from an earlier attempt.

I did not create a reverse proxy. I got excited at getting the site to load that I missed that. I'll try that in a couple days when I'm free again.

Docker decided to randomly disappear my PieFed image an hour after I finished working on it. The PyFedi folder and all it's contents have vanished. A very quick search showed that it has happened to other people with other images. So it's a thing maybe? Strange but fortunately it was all fresh and nothing was lost.

[–] Evotech@lemmy.world 1 points 4 months ago

I wouldn't worry about cloudflare reliability. Compared to your rasberrypi especially :p

[–] jeena@piefed.jeena.net 3 points 4 months ago

For 1, you can disallow uploading pictures, videos are not possible to upload anyway. But people can link to videos and pictured hosted somewhere else.

For 2, yes that is not a problem. And even with the other port it can federate, but

For 3, you would need to run SSL for federation as far as I remember, but that should work on other ports that 443 too.

For 4, you can use your gmail server to send emails, you can set PieFed up with that.

[–] hendrik@palaver.p3x.de 2 points 4 months ago* (last edited 4 months ago) (1 children)

A bit unrelated: But I've seen people also use Flarum and Mobilizon for local neighbourhood stuff. We've had a (more traditional NodeBB) web forum when I used to live in a student dormitory. Back then people used it for all kinds of stuff, recommendations, asking for help, a lot of classified ads and things to give away for free... Plus we had a large file-drop for photos of our events, summer party etc. Sadly everything fell into disuse when it got replaced by Facebook, WhatsApp, etc at some point. I think projects like this have quite some potential. The old forum had quite some more reach and nice activity, in contrast to today's online groups.

If you get anywhere with your plans, I'd be interested to read some blog post or something like that. About how it turned out and if (and how) people make use of it. And if someone knows a federated classified ads platform... Please tell me. But I guess a web-forum or PieFed would work, too. Though, that one kind of requires pictures in the posts.

[–] taters@piefed.social 2 points 4 months ago (1 children)

Thanks for the suggestions, I'll have a look into them and see how they fit my needs. I am looking for something that uses markdown language. I'm using that in other parts of this project as a way to keep things unified and simple for others to participate or contribute.

I don't do blogs or anything but I do intend to make a community on slrpnk.net in addition to my local instance on my pi. The Solarpunk community will focus more on creating a guide for others to create their own local communities and knowledge base.

The ultimate goal is making sure it's simple and accessible to as many people as possible.

Once I set up an instance or some sort of community page, I plan to write up an outline of decision choices and future goals in order to help people understand what's going on and where to begin contributing. I'll be able to use my seed library as a working example.

I am hoping to be ready within the next couple weeks. I can let you know when the Solarpunk community goes up so you can check it out.

[–] hendrik@palaver.p3x.de 1 points 4 months ago* (last edited 4 months ago)

Thx, I'll keep an eye out, so you don't need to keep me posted. I'm always interested in the broad topic of making the world a slightly better place with technology, and random nice side-projects...

I agree, such things need to be simple, or they won't take off. Simple to use and simple to sign up. Even coming up with a username and password is a major barrier for the target audience "regular people". I hope your approach turns out well, because from my experience, onboarding a decent chunk of people is key to making a small and more general platform useful. And it's hard.