kevinveenbirkenbach/computer-playbook
1
0 Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(web-app-mastodon): omit empty VAPID keys so boot succeeds

Browse Source 
VAPID keys render empty (plain algorithm, allow-empty-plain); recent Mastodon hard-fails boot on empty VAPID env, crashing during Zeitwerk eager-load. Only emit the VAPID vars when both keys are set.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
kevinveenbirkenbachandClaude Opus 4.8 committed 2026-07-01 14:28:41 +02:00
1 parent b1bc730cb4
commit 0fc5408dbb
1 file changed
+7 -28
Download Patch File Download Diff File Expand all files Collapse all files
roles/web-app-mastodon/templates/env.j2
+7 -28
View File
@@ -8,37 +8,24 @@ ALTERNATE_DOMAINS={{ lookup('domains', 'web-app-mastodon')[1:] | join(',') }}
SINGLE_USER_MODE={{ lookup('config', application_id, 'services.mastodon.single_user_mode') }}
ALLOWED_PRIVATE_ADDRESSES={{ MASTODON_ALLOWED_PRIVATE_ADDRESSES }}
# This container isn't build for non-production environments
RAILS_ENV=production
# Debug
{% if MODE_DEBUG | bool %}
RAILS_LOG_LEVEL=debug
DEBUG=*
{% endif %}
# Credentials
# Secrets
# -------
# Make sure to use `bundle exec rails secret` to generate secrets
# -------
SECRET_KEY_BASE={{ lookup('config', application_id, 'credentials.secret_key_base') }}
OTP_SECRET={{ lookup('config', application_id, 'credentials.otp_secret') }}
# Web Push
# --------
# Generate with `bundle exec rails mastodon:webpush:generate_vapid_key`
# --------
VAPID_PRIVATE_KEY={{ lookup('config', application_id, 'credentials.vapid_private_key') }}
VAPID_PUBLIC_KEY={{ lookup('config', application_id, 'credentials.vapid_public_key') }}
{% set _vapid_private = lookup('config', application_id, 'credentials.vapid_private_key') %}
{% set _vapid_public = lookup('config', application_id, 'credentials.vapid_public_key') %}
{% if _vapid_private | length > 0 and _vapid_public | length > 0 %}
VAPID_PRIVATE_KEY={{ _vapid_private }}
VAPID_PUBLIC_KEY={{ _vapid_public }}
{% endif %}
# Encryption secrets
# ------------------
# Must be available (and set to same values) for all server processes
# These are private/secret values, do not share outside hosting environment
# Use `bin/rails db:encryption:init` to generate fresh secrets
# Do NOT change these secrets once in use, as this would cause data loss and other issues
# Exception: do NOT change these secrets once in use, doing so causes data loss
ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY={{ lookup('config', application_id, 'credentials.active_record_encryption_deterministic_key') }}
ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT={{ lookup('config', application_id, 'credentials.active_record_encryption_key_derivation_salt') }}
ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY={{ lookup('config', application_id, 'credentials.active_record_encryption_primary_key') }}
@@ -80,24 +67,16 @@ SMTP_FROM_ADDRESS=Mastodon <{{ email['from'] }}>
{% endif %}
{% if MASTODON_OIDC_ENABLED | bool %}
###################################
# OpenID Connect settings
###################################
# @see https://github.com/mastodon/mastodon/pull/16221
# @see https://stackoverflow.com/questions/72081776/how-mastodon-configured-login-using-sso
OIDC_ENABLED={{ MASTODON_OIDC_ENABLED | string | lower }}
OIDC_DISPLAY_NAME={{ OIDC.BUTTON_TEXT }}
OIDC_ISSUER={{ OIDC.CLIENT.ISSUER_URL }}
OIDC_DISCOVERY=true
OIDC_SCOPE=openid,profile,email
# @see https://stackoverflow.com/questions/72108087/how-to-set-the-username-of-mastodon-by-log-in-via-keycloak
OIDC_UID_FIELD={{ OIDC.ATTRIBUTES.USERNAME }}
OIDC_CLIENT_ID={{ OIDC.CLIENT.ID }}
OIDC_REDIRECT_URI={{ lookup('tls', application_id, 'url.base') }}auth/auth/openid_connect/callback
OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED=true
OIDC_CLIENT_SECRET={{ OIDC.CLIENT.SECRET }}
# uncomment to only use OIDC for login / registration buttons
OMNIAUTH_ONLY=true
ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH=true
ONE_CLICK_SSO_LOGIN=true