Initial commit

roles/frontend/meta/main.yml

@@ -0,0 +1,4 @@
+---
+dependencies:
+  - role: geerlingguy.nginx
+  - role: mastodon # Required for the www root for nginx

roles/frontend/tasks/main.yml

@@ -0,0 +1,55 @@
+---
+# Install the requires nginx sites-available
+
+- name: Create nginx cache dir
+  file:
+    path: /data/nginx/cache
+    state: directory
+    owner: www-data
+    group: www-data
+
+- name: Install nginx site files
+  template:
+    src: files.j2
+    dest: /etc/nginx/sites-available/files
+  notify: restart nginx
+
+- name: Install nginx mastodon config
+  template:
+    src: mastodon.j2
+    dest: /etc/nginx/sites-available/mastodon
+  notify: restart nginx
+
+- name: Enable files
+  file:
+    src: /etc/nginx/sites-available/files
+    dest: /etc/nginx/sites-enabled/files
+    state: link
+
+- name: Enable mastodon
+  file:
+    src: /etc/nginx/sites-available/mastodon
+    dest: /etc/nginx/sites-enabled/mastodon
+    state: link
+
+- name: Disable default
+  file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+
+- name: Copy dmca
+  template:
+    src: dmca
+    dest: /etc/nginx/dmca
+  notify: restart nginx
+
+- name: Copy cloudflare
+  template:
+    src: cloudflare
+    dest: /etc/nginx/cloudflare
+  notify: restart nginx
+
+- name: install certbot
+  package:
+    name: python3-certbot-nginx
+    state: present

roles/frontend/templates/cloudflare

@@ -0,0 +1,29 @@
+#Cloudflare
+
+# - IPv4
+set_real_ip_from 173.245.48.0/20;
+set_real_ip_from 103.21.244.0/22;
+set_real_ip_from 103.22.200.0/22;
+set_real_ip_from 103.31.4.0/22;
+set_real_ip_from 141.101.64.0/18;
+set_real_ip_from 108.162.192.0/18;
+set_real_ip_from 190.93.240.0/20;
+set_real_ip_from 188.114.96.0/20;
+set_real_ip_from 197.234.240.0/22;
+set_real_ip_from 198.41.128.0/17;
+set_real_ip_from 162.158.0.0/15;
+set_real_ip_from 104.16.0.0/13;
+set_real_ip_from 104.24.0.0/14;
+set_real_ip_from 172.64.0.0/13;
+set_real_ip_from 131.0.72.0/22;
+
+# - IPv6
+set_real_ip_from 2400:cb00::/32;
+set_real_ip_from 2606:4700::/32;
+set_real_ip_from 2803:f800::/32;
+set_real_ip_from 2405:b500::/32;
+set_real_ip_from 2405:8100::/32;
+set_real_ip_from 2a06:98c0::/29;
+set_real_ip_from 2c0f:f248::/32;
+
+real_ip_header CF-Connecting-IP;

roles/frontend/templates/dmca

@@ -0,0 +1,4 @@
+# Example
+#location = /cache/media_attachments/files/109/437/372/880/064/218/original/3260dbbf5bbdce0e.jpg {
+#  deny all;
+#}

roles/frontend/templates/files.j2

@@ -0,0 +1,90 @@
+server {
+  listen 80;
+  listen [::]:80;
+  server_name {{ ENV_PRODUCTION['S3_ALIAS_HOST'] }};
+  root /var/www/html;
+  # Useful for Let's Encrypt
+  location /.well-known/acme-challenge/ { allow all; }
+  location / { return 301 https://$host$request_uri; }
+}
+
+log_format files_cache '$remote_addr - $upstream_cache_status [$time_local]  '
+                    '"$request" $status $body_bytes_sent '
+                    '"$http_referer" "$http_user_agent"';
+
+proxy_cache_path /data/nginx/cache keys_zone=mycache:50m inactive=3d;
+
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+  server_name {{ ENV_PRODUCTION['S3_ALIAS_HOST'] }};
+  root /var/www/html;
+
+  include /etc/nginx/cloudflare;
+
+  ssl_certificate     /etc/letsencrypt/live/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}/privkey.pem;
+
+  access_log /var/log/nginx/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}.access.log files_cache;
+  error_log /var/log/nginx/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}.error.log;
+
+  proxy_cache mycache;
+  keepalive_timeout 30;
+
+  # Don't allow directory listings
+  location ~ ^.*/$ {
+    deny all;
+  }
+
+  include /etc/nginx/dmca;
+
+  location ~ .+ {
+    try_files $uri @s3;
+  }
+
+  set $s3_backend '{{ ENV_PRODUCTION['S3_HOSTNAME'] }}';
+
+  location @s3 {
+    limit_except GET {
+      deny all;
+    }
+
+    resolver 8.8.8.8;
+    proxy_set_header Host yttrx.sfo3.digitaloceanspaces.com;
+    proxy_set_header Connection '';
+    proxy_set_header Authorization '';
+    proxy_hide_header Set-Cookie;
+    proxy_hide_header 'Access-Control-Allow-Origin';
+    proxy_hide_header 'Access-Control-Allow-Methods';
+    proxy_hide_header 'Access-Control-Allow-Headers';
+    #proxy_hide_header x-amz-id-2;
+    #proxy_hide_header x-amz-request-id;
+    #proxy_hide_header x-amz-meta-server-side-encryption;
+    #proxy_hide_header x-amz-server-side-encryption;
+    #proxy_hide_header x-amz-bucket-region;
+    #proxy_hide_header x-amzn-requestid;
+    proxy_ignore_headers Set-Cookie;
+    proxy_pass $s3_backend$uri;
+    #proxy_intercept_errors off;
+    # turn this on so that we can capture and redirect bad links to the main 404 page
+    proxy_intercept_errors on;
+
+    #proxy_cache_valid 200 48h;
+    proxy_cache_valid 48h;
+    proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
+    proxy_cache_lock on;
+    proxy_cache_key $uri;
+
+    # Download stale data only if it has been modified on origin 
+    proxy_cache_revalidate off;
+
+    expires 30d;
+    add_header Pragma public;
+    add_header Cache-Control "public";
+    add_header 'Access-Control-Allow-Origin' '*';
+    add_header X-Cache-Status $upstream_cache_status;
+
+    error_page 403 https://{{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}/404.html;
+    error_page 404 https://{{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}/404.html;
+  }
+}

roles/frontend/templates/mastodon.j2

@@ -0,0 +1,117 @@
+map $http_upgrade $connection_upgrade {
+  default upgrade;
+  ''      close;
+}
+
+server {
+  listen 80;
+  listen [::]:80;
+  server_name {{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}
+  root /home/mastodon/live/public;
+  # Useful for Let's Encrypt
+  location /.well-known/acme-challenge/ { allow all; }
+  location / { return 301 https://$host$request_uri; }
+}
+
+upstream webbackend {
+{% for server in webapp_hosts %}
+  server {{ server }}:3000;
+{% endfor %}
+}
+
+upstream streamingbackend {
+{% for server in webapp_hosts %}
+  server {{ server }}:4000;
+{% endfor %}
+}
+
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+  server_name {{ ENV_PRODUCTION['LOCAL_DOMAIN'] }};
+
+  include /etc/nginx/cloudflare;
+
+  ssl_protocols TLSv1.2;
+  ssl_ciphers HIGH:!MEDIUM:!LOW:!aNULL:!NULL:!SHA; ssl_prefer_server_ciphers on;
+  ssl_session_cache shared:SSL:10m;
+
+  ssl_certificate     /etc/letsencrypt/live/{{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/{{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}/privkey.pem;
+
+  keepalive_timeout    70;
+  sendfile             on;
+  client_max_body_size 80m;
+
+  root /home/mastodon/live/public;
+
+  gzip on;
+  gzip_disable "msie6";
+  gzip_vary on;
+  gzip_proxied any;
+  gzip_comp_level 6;
+  gzip_buffers 16 8k;
+  gzip_http_version 1.1;
+  gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+  add_header Strict-Transport-Security "max-age=31536000";
+
+  location / {
+    try_files $uri @proxy;
+  }
+
+  # WITH S3
+  location ~ ^/(emoji|packs) {
+    add_header Cache-Control "public, max-age=31536000, immutable";
+    try_files $uri @proxy;
+  }
+
+  location /system {
+  rewrite ^/system(.*) https://{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}$1 permanent;
+  }
+  # END OF S3 
+  location /sw.js {
+    #add_header Cache-Control "public, max-age=0";
+    add_header Cache-Control "public, max-age=604800, must-revalidate";
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
+    try_files $uri @proxy;
+  }
+
+  location @proxy {
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_set_header Proxy "";
+    proxy_pass_header Server;
+
+
+    proxy_pass http://webbackend;
+    proxy_buffering off;
+    proxy_redirect off;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+
+    tcp_nodelay on;
+  }
+
+  location /api/v1/streaming {
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_set_header Proxy "";
+
+    proxy_pass http://streamingbackend;
+    proxy_buffering off;
+    proxy_redirect off;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+
+    tcp_nodelay on;
+  }
+
+  error_page 500 501 502 503 504 /500.html;
+}

roles/frontend/templates/status

@@ -0,0 +1,19 @@
+server {
+	listen 81 default_server;
+	listen [::]:81 default_server;
+
+	root /var/www/html;
+	index index.html index.htm index.nginx-debian.html;
+
+	server_name _;
+
+	location / {
+		try_files $uri $uri/ =404;
+	}
+
+	location /nginx_status {
+        	stub_status;
+        	#allow 127.0.0.1;
+        	#deny all;
+        }
+}

roles/frontend/templates/tusky

@@ -0,0 +1,76 @@
+##
+# You should look at the following URL's in order to grasp a solid understanding
+# of Nginx configuration files in order to fully unleash the power of Nginx.
+# https://www.nginx.com/resources/wiki/start/
+# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
+# https://wiki.debian.org/Nginx/DirectoryStructure
+#
+# In most cases, administrators will remove this file from sites-enabled/ and
+# leave it as reference inside of sites-available where it will continue to be
+# updated by the nginx packaging team.
+#
+# This file will automatically load configuration files provided by other
+# applications, such as Drupal or Wordpress. These applications will be made
+# available underneath a path with that package name, such as /drupal8.
+#
+# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
+##
+
+# Default server configuration
+#
+
+server {
+  listen 80;
+  listen [::]:80;
+  server_name tusky.yttrx.com;
+  root /var/www/html/tusky;
+  # Useful for Let's Encrypt
+  location /.well-known/acme-challenge/ { allow all; }
+  location / { return 301 https://$host$request_uri; }
+}
+
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+  server_name tusky.yttrx.com;
+  root /var/www/html/tusky;
+
+  ssl_certificate     /etc/letsencrypt/live/tusky.yttrx.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/tusky.yttrx.com/privkey.pem;
+  access_log /var/log/nginx/tusky.access.log;
+  error_log /var/log/nginx/static.error.log;
+
+
+  location / {
+	# First attempt to serve request as file, then
+	# as directory, then fall back to displaying a 404.
+	try_files $uri $uri/ =404;
+  }
+
+  location /statsd {
+    try_files $uri @proxy;
+  }
+
+  location /metrics {
+    try_files $uri @proxy;
+  }
+
+  location @proxy {
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_set_header Proxy "";
+
+    proxy_pass http://127.0.0.1:9102;
+    proxy_buffering off;
+    proxy_redirect off;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+
+    tcp_nodelay on;
+  }
+
+}
+

roles/frontend/templates/waffles

@@ -0,0 +1,57 @@
+##
+# You should look at the following URL's in order to grasp a solid understanding
+# of Nginx configuration files in order to fully unleash the power of Nginx.
+# https://www.nginx.com/resources/wiki/start/
+# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
+# https://wiki.debian.org/Nginx/DirectoryStructure
+#
+# In most cases, administrators will remove this file from sites-enabled/ and
+# leave it as reference inside of sites-available where it will continue to be
+# updated by the nginx packaging team.
+#
+# This file will automatically load configuration files provided by other
+# applications, such as Drupal or Wordpress. These applications will be made
+# available underneath a path with that package name, such as /drupal8.
+#
+# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
+##
+
+# Default server configuration
+#
+
+server {
+  listen 80;
+  listen [::]:80;
+  server_name waffles.yttrx.com;
+  root /var/www/html/waffles;
+  # Useful for Let's Encrypt
+  location /.well-known/acme-challenge/ { allow all; }
+  location / { return 301 https://$host$request_uri; }
+}
+
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+  server_name waffles.yttrx.com;
+  root /var/www/html/waffles;
+
+  include /etc/nginx/cloudflare;
+    ssl_certificate /etc/letsencrypt/live/waffles.yttrx.com/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/waffles.yttrx.com/privkey.pem; # managed by Certbot
+  access_log /var/log/nginx/waffles.access.log;
+  error_log /var/log/nginx/waffles.error.log;
+
+  location = /.well-known/webfinger {
+    types {} default_type "application/jrd+json";
+    add_header Access-Control-Allow-Origin "*";
+  }
+
+  location / {
+	# First attempt to serve request as file, then
+	# as directory, then fall back to displaying a 404.
+	try_files $uri $uri/ =404;
+  }
+
+
+}
+

roles/frontend/vars/main.yml

@@ -0,0 +1 @@
+---

roles/mastodon/meta/main.yml

@@ -0,0 +1,4 @@
+---
+dependencies:
+  - role: geerlingguy.docker
+  - role: yttrx

roles/mastodon/tasks/main.yml

@@ -0,0 +1,32 @@
+---
+# Setup users etc
+- name: create the mastodon user account
+  user:
+    name: mastodon
+    shell: /bin/bash
+    group: docker
+
+- name: Check if mastodon repo checked out
+  stat: path=/home/mastodon/live
+  register: p
+
+- import_tasks: swap.yml
+
+- import_tasks: repo.yml
+  when: not p.stat.exists
+
+- name: Install statsd mapper
+  template:
+    src: statsd-mapping.yaml.j2
+    dest: /root/statsd-mapping.yml
+
+- name: Install .env.production file
+  template:
+    src: env.production.j2
+    dest: /home/mastodon/live/.env.production
+
+- name: Install docker-compose.yml file
+  template:
+    src: docker-compose.yml.j2
+    dest: /home/mastodon/live/docker-compose.yml
+  notify: "docker-compose up"

roles/mastodon/tasks/repo.yml

@@ -0,0 +1,7 @@
+---
+- name: clone mastodon repo
+  git:
+    repo: https://github.com/mastodon/mastodon.git
+    dest: /home/mastodon/live
+    version: v4.0.2
+

roles/mastodon/tasks/swap.yml

@@ -0,0 +1,36 @@
+- name: set swap_file variable
+  set_fact:
+    swap_file: /{{ swap_space }}.swap
+
+- name: check if swap file exists
+  stat:
+    path: "{{ swap_file }}"
+  register: swap_file_check
+
+- name: create swap file
+  command: fallocate -l {{ swap_space }} {{ swap_file }}
+  args:
+    creates: /{{ swap_file }}
+
+- name: set permissions on swap file
+  file:
+    path: "{{ swap_file }}"
+    mode: 0600
+
+- name: format swap file
+  command: mkswap {{ swap_file }}
+  when: not swap_file_check.stat.exists
+
+- name: add to fstab
+  lineinfile:
+    dest: /etc/fstab
+    regexp: "{{ swap_file }}"
+    line: "{{ swap_file }} none swap sw 0 0"
+
+- name: turn on swap
+  command: swapon -a
+
+- name: set swapiness
+  sysctl:
+    name: vm.swappiness
+    value: "1"

roles/mastodon/templates/docker-compose.sidekiq-default.yml.j2

@@ -0,0 +1,20 @@
+  
+  sidekiq-default:
+    image: tootsuite/mastodon:{{ MASTODON_VERSION }}
+    restart: always
+    env_file: .env.production
+    command: bundle exec sidekiq -q default -c 5
+    depends_on:
+      - pgbouncer
+    networks:
+      - external_network
+      - internal_network
+    volumes:
+      - ./public/system:/mastodon/public/system
+      - ./config:/opt/mastodon/config
+    environment:
+{% if DB_POOL is defined %}
+      - 'DB_POOL={{ DB_POOL }}'
+{% endif %}
+    healthcheck:
+      test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]

roles/mastodon/templates/docker-compose.sidekiq-ingress.yml.j2

@@ -0,0 +1,19 @@
+  # sidekiq-ingress
+  sidekiq-ingress:
+    image: tootsuite/mastodon:{{ MASTODON_VERSION }}
+    restart: always
+    env_file: .env.production
+    command: bundle exec sidekiq -q ingress
+    depends_on:
+      - pgbouncer
+    networks:
+      - external_network
+      - internal_network
+    volumes:
+      - ./public/system:/mastodon/public/system
+      - ./config:/opt/mastodon/config
+    environment:
+      - 'DB_POOL=25'
+    healthcheck:
+      test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]
+

roles/mastodon/templates/docker-compose.sidekiq-mailers.yml.j2

@@ -0,0 +1,20 @@
+
+  sidekiq-mailers:
+    image: tootsuite/mastodon:{{ MASTODON_VERSION }}
+    restart: always
+    env_file: .env.production
+    command: bundle exec sidekiq -q mailers -c 5
+    depends_on:
+      - pgbouncer
+    networks:
+      - external_network
+      - internal_network
+    volumes:
+      - ./public/system:/mastodon/public/system
+      - ./config:/opt/mastodon/config
+    environment:
+      - 'DB_POOL=25'
+    healthcheck:
+      test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]
+
+

roles/mastodon/templates/docker-compose.sidekiq-pushpull.yml.j2

@@ -0,0 +1,19 @@
+
+  sidekiq-pushpull:
+    image: tootsuite/mastodon:{{ MASTODON_VERSION }}
+    restart: always
+    env_file: .env.production
+    command: bundle exec sidekiq -q push -q pull -c 5
+    depends_on:
+      - pgbouncer
+    networks:
+      - external_network
+      - internal_network
+    volumes:
+      - ./public/system:/mastodon/public/system
+      - ./config:/opt/mastodon/config
+    environment:
+      - 'DB_POOL=25'
+    healthcheck:
+      test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]
+

roles/mastodon/templates/docker-compose.sidekiq-scheduler.yml.j2

@@ -0,0 +1,19 @@
+
+  sidekiq-scheduler:
+    image: tootsuite/mastodon:{{ MASTODON_VERSION }}
+    restart: always
+    env_file: .env.production
+    command: bundle exec sidekiq -q scheduler
+    depends_on:
+      - pgbouncer
+    networks:
+      - external_network
+      - internal_network
+    volumes:
+      - ./public/system:/mastodon/public/system
+      - ./config:/opt/mastodon/config
+    environment:
+      - 'DB_POOL=25'
+    healthcheck:
+      test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]
+

roles/mastodon/templates/docker-compose.sidekiq.yml.j2

@@ -0,0 +1,15 @@
+  sidekiq:
+    image: tootsuite/mastodon:{{ MASTODON_VERSION }}
+    restart: always
+    env_file: .env.production
+    command: bundle exec sidekiq
+    depends_on:
+      - pgbouncer
+    networks:
+      - external_network
+      - internal_network
+    volumes:
+      - ./public/system:/mastodon/public/system
+      - ./config:/opt/mastodon/config
+    healthcheck:
+      test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]

roles/mastodon/templates/docker-compose.yml.j2

@@ -0,0 +1,33 @@
+version: '3'
+services:
+{% if ENV_PRODUCTION['STATSD_ADDR'] is defined %}
+  statsd:
+    restart: always
+    image: prom/statsd-exporter
+    command: --statsd.mapping-config=/tmp/statsd_mapping.yml
+    volumes:
+      - /root/statsd-mapping.yml:/tmp/statsd_mapping.yml
+    networks:
+      - internal_network
+      - external_network
+    ports:
+      - 9102:9102
+      - "127.0.0.1:9125:9125"
+{% endif %}
+  pgbouncer:
+    restart: always
+    image: edoburu/pgbouncer
+    networks:
+      - internal_network
+      - external_network
+    environment:
+      - 'DB_HOST={{ REAL_DB_HOST }}'
+      - 'DB_NAME={{ ENV_PRODUCTION["DB_NAME"] }}'
+      - 'DB_USER={{ ENV_PRODUCTION["DB_USER"] }}'
+      - 'DB_PASSWORD={{ ENV_PRODUCTION["DB_PASS"] }}'
+      - 'SERVER_TLS_SSLMODE=prefer'
+
+networks:
+  external_network:
+  internal_network:
+    internal: true

roles/mastodon/templates/env.production.j2

@@ -0,0 +1,3 @@
+{% for key, val in ENV_PRODUCTION.items() %}
+{{ key }}={{ val }}
+{% endfor %}

roles/mastodon/templates/statsd-mapping.yaml.j2

@@ -0,0 +1,96 @@
+## Prometheus Statsd Exporter mapping for Mastodon 4.0+
+##
+## Version 1.0, November 2022
+##
+## Documentation: https://ipng.ch/s/articles/2022/11/27/mastodon-3.html
+
+mappings:
+  ## Web collector
+  - match: Mastodon\.production\.web\.(.+)\.(.+)\.(.+)\.status\.(.+)
+    match_type: regex
+    name: "mastodon_controller_status"
+    labels:
+      controller: $1
+      action: $2
+      format: $3
+      status: $4
+      mastodon: "web"
+  - match: Mastodon\.production\.web\.(.+)\.(.+)\.(.+)\.db_time
+    match_type: regex
+    name: "mastodon_controller_db_time"
+    labels:
+      controller: $1
+      action: $2
+      format: $3
+      mastodon: "web"
+  - match: Mastodon\.production\.web\.(.+)\.(.+)\.(.+)\.view_time
+    match_type: regex
+    name: "mastodon_controller_view_time"
+    labels:
+      controller: $1
+      action: $2
+      format: $3
+      mastodon: "web"
+  - match: Mastodon\.production\.web\.(.+)\.(.+)\.(.+)\.total_duration
+    match_type: regex
+    name: "mastodon_controller_duration"
+    labels:
+      controller: $1
+      action: $2
+      format: $3
+      mastodon: "web"
+
+  ## Database collector
+  - match: Mastodon\.production\.db\.tables\.(.+)\.queries\.(.+)\.duration
+    match_type: regex
+    name: "mastodon_db_operation"
+    labels:
+      table: "$1"
+      operation: "$2"
+      mastodon: "db"
+
+  ## Cache collector
+  - match: Mastodon\.production\.cache\.(.+)\.duration
+    match_type: regex
+    name: "mastodon_cache_duration"
+    labels:
+      operation: "$1"
+      mastodon: "cache"
+
+  ## Sidekiq collector
+  - match: Mastodon\.production\.sidekiq\.(.+)\.processing_time
+    match_type: regex
+    name: "mastodon_sidekiq_worker_processing_time"
+    labels:
+      worker: "$1"
+      mastodon: "sidekiq"
+  - match: Mastodon\.production\.sidekiq\.(.+)\.success
+    match_type: regex
+    name: "mastodon_sidekiq_worker_success_total"
+    labels:
+      worker: "$1"
+      mastodon: "sidekiq"
+  - match: Mastodon\.production\.sidekiq\.(.+)\.failure
+    match_type: regex
+    name: "mastodon_sidekiq_worker_failure_total"
+    labels:
+      worker: "$1"
+      mastodon: "sidekiq"
+  - match: Mastodon\.production\.sidekiq\.queues\.(.+)\.enqueued
+    match_type: regex
+    name: "mastodon_sidekiq_queue_enqueued"
+    labels:
+      queue: "$1"
+      mastodon: "sidekiq"
+  - match: Mastodon\.production\.sidekiq\.queues\.(.+)\.latency
+    match_type: regex
+    name: "mastodon_sidekiq_queue_latency"
+    labels:
+      queue: "$1"
+      mastodon: "sidekiq"
+  - match: Mastodon\.production\.sidekiq\.(.+)
+    match_type: regex
+    name: "mastodon_sidekiq_$1"
+    labels:
+      mastodon: "sidekiq"
+

roles/sidekiq/meta/main.yml

@@ -0,0 +1,3 @@
+---
+dependencies:
+  - role: mastodon

roles/sidekiq/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+  - name: Configure docker-compose.override.yml
+    template:
+      src: docker-compose.override.yml.j2
+      dest: /home/mastodon/live/docker-compose.override.yml
+    notify: "docker-compose up"

roles/sidekiq/templates/docker-compose.override.yml.j2

@@ -0,0 +1,23 @@
+services:
+{% for SK in sidekiq %}
+  sidekiq-{{ SK['name'] }}:
+    image: tootsuite/mastodon:{{ MASTODON_VERSION }}
+    restart: always
+    env_file: .env.production
+{% if 'q' in SK %}
+    command: bundle exec sidekiq {{ SK['q'] | join(' ') }} -c 10
+{% else %}
+    command: bundle exec sidekiq
+{% endif %}
+    depends_on:
+      - pgbouncer
+    networks:
+      - external_network
+      - internal_network
+    volumes:
+      - ./public/system:/mastodon/public/system
+      - ./config:/opt/mastodon/config
+    healthcheck:
+      test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]
+
+{% endfor %}

roles/webapp/meta/main.yml

@@ -0,0 +1,4 @@
+---
+dependencies:
+  - role: geerlingguy.nginx
+  - role: mastodon

roles/webapp/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+  - name: Configure docker-compose.yml
+    template:
+      src: docker-compose.override.yml.j2
+      dest: /home/mastodon/live/docker-compose.override.yml
+    notify: "docker-compose up"

roles/webapp/templates/docker-compose.override.yml.j2

@@ -0,0 +1,38 @@
+version: '3'
+services:
+  web:
+    image: tootsuite/mastodon:v4.0.2
+    restart: always
+    env_file: .env.production
+    command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"
+    networks:
+      - external_network
+      - internal_network
+    healthcheck:
+      test: ['CMD-SHELL', 'wget -q --spider --proxy=off localhost:3000/health || exit 1']
+    ports:
+      - 3000:3000
+    depends_on:
+      - pgbouncer
+    environment:
+      - 'MAX_THREADS=10'
+      - 'WEB_CONCURRENCY=3'
+    volumes:
+      - ./public/system:/mastodon/public/system
+
+  streaming:
+    image: tootsuite/mastodon:v4.0.2
+    restart: always
+    env_file: .env.production
+    command: node ./streaming
+    networks:
+      - external_network
+      - internal_network
+    healthcheck:
+      test: ['CMD-SHELL', 'wget -q --spider --proxy=off localhost:4000/api/v1/streaming/health || exit 1']
+    environment:
+      - 'DB_POOL=25'
+    ports:
+      - 4000:4000
+    depends_on:
+      - pgbouncer

roles/yttrx/meta/main.yml

@@ -0,0 +1,12 @@
+---
+dependencies:
+  - role: ansible-role-neovim
+  - role: geerlingguy.docker
+  - role: ansible-role-oh-my-zsh
+    vars:
+      users:
+        - username: root
+          oh_my_zsh:
+            theme: agnoster
+            plugins:
+              - git

roles/yttrx/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Install prometheus node exporter
+  package:
+    name: prometheus-node-exporter
+    state: present
+
+- name: Create nvim config dir
+  file:
+    path: /root/.config/nvim
+    state: directory
+
+- name: Install nvim config file
+  template:
+    src: templates/nvim/init.vim.j2
+    dest: /root/.config/nvim/init.vim
+
+- name: Install nvim plugins
+  command: nvim --headless +PluginInstall +qall
+  args:
+    creates: /root/.vim/bundle/
+
+- name: Clone fzf
+  git:
+    repo: https://github.com/junegunn/fzf
+    dest: /root/fzf
+    clone: yes
+    update: yes