什么是 Mastodon？

systemctl restart ssh.service

apt update && apt upgrade -y

apt install fail2ban

[DEFAULT]

destemail = [email protected]

sendername = Fail2Ban

[sshd]

enabled = true

port = 22

mode = aggressive

systemctl restart fail2ban

apt install -y iptables-persistent

*filter



#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0

-A INPUT -i lo -j ACCEPT

-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT



#  Accept all established inbound connections

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT



#  Allow all outbound traffic - you can modify this to only allow certain traffic

-A OUTPUT -j ACCEPT



#  Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).

-A INPUT -p tcp --dport 80 -j ACCEPT

-A INPUT -p tcp --dport 443 -j ACCEPT

#  (optional) Allow HTTP/3 connections from anywhere.

-A INPUT -p udp --dport 443 -j ACCEPT



#  Allow SSH connections

#  The -dport number should be the same port number you set in sshd_config

-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT



#  Allow ping

-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT



# Allow destination unreachable messages, especially code 4 (fragmentation required) is required or PMTUD breaks

-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT



#  Log iptables denied calls

-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7



#  Reject all other inbound - default deny unless explicitly allowed policy

-A INPUT -j REJECT

-A FORWARD -j REJECT



COMMIT

iptables-restore < /etc/iptables/rules.v4

*filter



#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0

-A INPUT -i lo -j ACCEPT

-A INPUT ! -i lo -d ::1/128 -j REJECT



#  Accept all established inbound connections

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT



#  Allow all outbound traffic - you can modify this to only allow certain traffic

-A OUTPUT -j ACCEPT



#  Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).

-A INPUT -p tcp --dport 80 -j ACCEPT

-A INPUT -p tcp --dport 443 -j ACCEPT

#  (optional) Allow HTTP/3 connections from anywhere.

-A INPUT -p udp --dport 443 -j ACCEPT



#  Allow SSH connections

#  The -dport number should be the same port number you set in sshd_config

-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT



#  Allow ping

-A INPUT -p icmpv6 -j ACCEPT



#  Log iptables denied calls

-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7



#  Reject all other inbound - default deny unless explicitly allowed policy

-A INPUT -j REJECT

-A FORWARD -j REJECT



COMMIT

iptables-restore < /etc/iptables/rules.v4

curl -sL https://deb.nodesource.com/setup_12.x | bash -

curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -
echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list

apt update

apt install -y \

  imagemagick ffmpeg libpq-dev libxml2-dev libxslt1-dev file git-core \

  g++ libprotobuf-dev protobuf-compiler pkg-config nodejs gcc autoconf \

  bison build-essential libssl-dev libyaml-dev libreadline6-dev \

  zlib1g-dev libncurses5-dev libffi-dev libgdbm5 libgdbm-dev \

  nginx redis-server redis-tools postgresql postgresql-contrib \

  certbot python-certbot-nginx yarn libidn11-dev libicu-dev libjemalloc-dev

adduser --disabled-login mastodon

su - mastodon

git clone https://github.com/rbenv/rbenv.git ~/.rbenv

cd ~/.rbenv && src/configure && make -C src

echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >> ~/.bashrc

echo 'eval "$(rbenv init -)"' >> ~/.bashrc

exec bash

git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build

RUBY_CONFIGURE_OPTS=--with-jemalloc rbenv install 2.6.6
rbenv global 2.6.6

gem install bundler --no-document

exit

sudo -u postgres psql

CREATE USER mastodon CREATEDB;
\q

git clone https://github.com/mastodon/mastodon.git live && cd live
git checkout $(git tag -l | grep -v 'rc[0-9]*$' | sort -V | tail -n 1)

bundle config deployment 'true'

bundle config without 'development test'

bundle install -j$(getconf _NPROCESSORS_ONLN)

yarn install --pure-lockfile

cp /home/mastodon/live/dist/nginx.conf /etc/nginx/sites-available/mastodon
ln -s /etc/nginx/sites-available/mastodon /etc/nginx/sites-enabled/mastodon

ssl_certificate     /etc/ssl/certs/ssl-cert-snakeoil.pem;
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;

systemctl daemon-reload
systemctl start mastodon-web mastodon-sidekiq mastodon-streaming
systemctl enable mastodon-*

wget -O /usr/share/keyrings/elasticsearch.asc https://artifacts.elastic.co/GPG-KEY-elasticsearch
echo "deb [signed-by=/usr/share/keyrings/elasticsearch.asc] https://artifacts.elastic.co/packages/7.x/apt stable main" > /etc/apt/sources.list.d/elastic-7.x.list

apt update
apt install elasticsearch

systemctl daemon-reload
systemctl enable --now elasticsearch

ES_ENABLED=true
ES_HOST=localhost
ES_PORT=9200
ES_PRESET= # single_node_cluster, small_cluster or large_cluster
# ES_USER=
# ES_PASS=

curl -X POST -u elastic:admin_password "localhost:9200/_security/role/mastodon_full_access?pretty" -H 'Content-Type: application/json' -d'
{
  "cluster": ["monitor"],
  "indices": [{
    "names": ["*"],
    "privileges": ["read", "monitor", "write", "manage"]
  }]
}
'

curl -X POST -u elastic:admin_password "localhost:9200/_security/user/mastodon?pretty" -H 'Content-Type: application/json' -d'
{
  "password" : "l0ng-r4nd0m-p@ssw0rd",
  "roles" : ["mastodon_full_access"]
}
'

ES_USER=mastodon
ES_PASS=l0ng-r4nd0m-p@ssw0rd

su - mastodon
cd live
RAILS_ENV=production bin/tootctl search deploy

diff --git a/app/chewy/accounts_index.rb b/app/chewy/accounts_index.rb
--- a/app/chewy/accounts_index.rb
+++ b/app/chewy/accounts_index.rb
@@ -4,7 +4,7 @@ class AccountsIndex < Chewy::Index
   settings index: { refresh_interval: '5m' }, analysis: {
     analyzer: {
       content: {
-        tokenizer: 'whitespace',
+        tokenizer: 'ik_max_word',
         filter: %w(lowercase asciifolding cjk_width),
       },

diff --git a/app/chewy/statuses_index.rb b/app/chewy/statuses_index.rb
--- a/app/chewy/statuses_index.rb
+++ b/app/chewy/statuses_index.rb
@@ -16,9 +16,17 @@ class StatusesIndex < Chewy::Index
         language: 'possessive_english',
       },
     },
+    char_filter: {
+      tsconvert: {
+        type: 'stconvert',
+        keep_both: false,
+        delimiter: '#',
+        convert_type: 't2s',
+      },
+    },
     analyzer: {
       content: {
-        tokenizer: 'uax_url_email',
+        tokenizer: 'ik_max_word',
         filter: %w(
           english_possessive_stemmer
           lowercase
@@ -27,6 +35,7 @@ class StatusesIndex < Chewy::Index
           english_stop
           english_stemmer
         ),
+        char_filter: %w(tsconvert),
       },
     },
   }
diff --git a/app/chewy/tags_index.rb b/app/chewy/tags_index.rb
--- a/app/chewy/tags_index.rb
+++ b/app/chewy/tags_index.rb
@@ -2,10 +2,19 @@

 class TagsIndex < Chewy::Index
   settings index: { refresh_interval: '15m' }, analysis: {
+    char_filter: {
+      tsconvert: {
+        type: 'stconvert',
+        keep_both: false,
+        delimiter: '#',
+        convert_type: 't2s',
+      },
+    },
     analyzer: {
       content: {
-        tokenizer: 'keyword',
+        tokenizer: 'ik_max_word',
         filter: %w(lowercase asciifolding cjk_width),
+        char_filter: %w(tsconvert),
       },

       edge_ngram: {