宅内Misskeyサーバーを立てよう

sudo apt update
sudo apt -y upgrade
sudo timedatectl set-timezone 'Asia/Tokyo'

sudo ufw allow 22
sudo ufw allow 'Nginx Full'
sudo ufw enable

network:
  version: 2
  ethernets:
    eno1:
      dhcp4: false
      dhcp6: false
      addresses: [192.168.10.56/24]
      routes:
        - to: default
          via: 192.168.10.1
      nameservers:
        addresses: [192.168.10.1, 8.8.8.8]

# 公開鍵と秘密鍵を生成
ssh-keygen -t ed25519
# ディレクトリ移動、公開鍵ファイルをauthorized_keysへ追記、権限の変更
cd /home/ユーザー名/.ssh/
sudo cat id_ed25519.pub >> authorized_keys
sudo chmod 600 authorized_keys

Host ubuntu
  HostName 192.168.10.56
  User ユーザー名
  Port 22
  IdentityFile ~/.ssh/id_ubuntu

# ssh接続の設定を編集
sudo vi /etc/ssh/sshd_config

ユーザー名 ALL=NOPASSWD: /usr/lib/openssh/sftp-server

sudo apt-get update
sudo apt-get install ca-certificates curl gnupg

# 公式GPCキーを取得
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

# リポジトリのセットアップ
echo \
  "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Docker EngineやDocker Composeをインストール
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# hello-worldを走らせてテスト
sudo docker run hello-world

git clone -b master https://github.com/misskey-dev/misskey.git
cd misskey
git checkout master

# 設定ファイルのサンプルをコピー
cp .config/docker_example.yml .config/default.yml
cp .config/docker_example.env .config/docker.env
cp ./docker-compose.yml.example ./docker-compose.yml

url: https://misskey.local/
port: 49514
  db: misskeydb
  # Auth
  user: データベースのユーザー名
  pass: データベースのパスワード

sudo docker compose build
sudo docker compose run --rm web pnpm run init

# Misskeyを起動
sudo docker compose up -d

# プライベートキー生成
openssl genrsa -out rootCA.key 2048
# ルート証明書生成
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.crt

# 証明書署名要求(CSR)の設定ファイルを作成
cat > misskey.local.csr.cnf <<EOF
[req]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn
[dn]
C=JP
ST=Tokyo
L=Shinjuku
O=myhome
OU=home
[email protected]
CN = misskey.local
EOF
# SANの設定ファイルを作成
cat > v3.ext <<EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = misskey.local
EOF
# CSRを生成
openssl req -new -sha256 -nodes -out misskey.local.csr -newkey rsa:2048 -keyout misskey.local.key -config <( cat misskey.local.csr.cnf )
# 証明書を生成
openssl x509 -req -in misskey.local.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out misskey.local.crt -days 500 -sha256 -extfile v3.ext

# For WebSocket
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}
proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache1:16m max_size=1g inactive=720m use_temp_path=off;
server {
    listen 80;
    listen [::]:80;
    server_name misskey.local;
    location / { return 301 https://$server_name$request_uri; }
}
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name misskey.local;
    ssl_session_timeout 1d;
    ssl_session_cache shared:ssl_session_cache:10m;
    ssl_session_tickets off;
    ssl_certificate     /etc/ssl/certs/misskey.local.crt;
    ssl_certificate_key /etc/ssl/private/misskey.local.key;
    # SSL protocol settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_stapling on;
    ssl_stapling_verify on;
    # Change to your upload limit
    client_max_body_size 80m;
    # Proxy to Node
    location / {
        proxy_pass http://127.0.0.1:49514;
        proxy_set_header Host $host;
        proxy_http_version 1.1;
        proxy_redirect off;
        # If it's behind another reverse proxy or CDN, remove the following.
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        # For WebSocket
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        # Cache settings
        proxy_cache cache1;
        proxy_cache_lock on;
        proxy_cache_use_stale updating;
        proxy_force_ranges on;
        add_header X-Cache $upstream_cache_status;
    }
}

# 設定を反映
sudo nginx -t
sudo systemctl reload nginx