blooym.dev / porxie
[MIRROR ONLY] A correct and efficient ATProto blob proxy for secure content delivery. codeberg.org/Blooym/porxie
36
fork

Configure Feed

Select the types of activity you want to include in your feed.

chore: update flake and add option descriptions

Lyna 95ce9f07 e5b5669d

+122
+122
flake.nix
··· 89 89 address = mkOption { 90 90 type = types.str; 91 91 default = "ip:127.0.0.1:6314"; 92 + description = '' 93 + Address to bind the server to. 94 + 95 + Use the 'ip:' prefix for an IP address (e.g. 'ip:127.0.0.1:6314'), or on 96 + UNIX systems, the 'unix:' prefix for a UNIX socket path 97 + (e.g. 'unix:/run/porxie.sock'). 98 + ''; 92 99 }; 93 100 94 101 authToken = mkOption { 95 102 type = types.nullOr types.str; 96 103 default = null; 104 + description = '' 105 + Bearer token for authenticating admin requests. 106 + 107 + When unset, all authenticated endpoints will reject requests with HTTP 401. 108 + Should be set via {option}`environmentFiles` rather than directly. 109 + ''; 97 110 }; 98 111 }; 99 112 ··· 101 114 allowedMimetypes = mkOption { 102 115 type = types.listOf types.str; 103 116 default = [ "image/*" ]; 117 + description = '' 118 + Blob mimetypes that can be served. 119 + 120 + Validation is done loosely via content inference. Further validation can be 121 + done by a layer above this proxy, such as an image transformation service. 122 + When inference fails, the blob's type falls back to 123 + `application/octet-stream`. When that type is allowed, blobs failing 124 + inference can still be served. 125 + ''; 104 126 }; 105 127 106 128 maxSize = mkOption { 107 129 type = types.str; 108 130 default = "50mb"; 131 + description = '' 132 + Maximum blob size that can be fetched and served. 133 + 134 + Blobs that exceed this limit will return HTTP 413. Setting this too high can 135 + exhaust process or system memory. The minimum value is 512kb. 136 + ''; 109 137 }; 110 138 111 139 cacheHeader = mkOption { 112 140 type = types.str; 113 141 default = "public, max-age=604800, must-revalidate, immutable"; 142 + description = '' 143 + The Cache-Control header value to send alongside blob responses. 144 + 145 + This does not affect internal cache lifetimes, only how downstream clients 146 + such as CDNs and browsers are instructed to cache responses. Intermediary 147 + caches may need to be cleared manually for changes to take effect quickly. 148 + ''; 114 149 }; 115 150 116 151 processingTimeout = mkOption { 117 152 type = types.str; 118 153 default = "1m"; 154 + description = '' 155 + Maximum duration a blob can be processed by this server before aborting. 156 + ''; 119 157 }; 120 158 121 159 httpTimeout = mkOption { 122 160 type = types.str; 123 161 default = "30s"; 162 + description = '' 163 + Maximum duration before blob fetch requests are timed out. 164 + ''; 124 165 }; 125 166 126 167 httpConnectTimeout = mkOption { 127 168 type = types.str; 128 169 default = "10s"; 170 + description = '' 171 + Maximum duration before an attempted connection to a blob upstream is aborted. 172 + 173 + This value should be lower than {option}`settings.blob.httpTimeout`. 174 + ''; 129 175 }; 130 176 }; 131 177 ··· 133 179 plcUrl = mkOption { 134 180 type = types.str; 135 181 default = "https://plc.directory"; 182 + description = '' 183 + URL of the PLC instance used for `did:plc` lookups. 184 + 185 + Can typically be left as default unless using a custom or local development 186 + setup. 187 + ''; 136 188 }; 137 189 138 190 httpTimeout = mkOption { 139 191 type = types.str; 140 192 default = "10s"; 193 + description = '' 194 + Maximum duration before identity resolution requests are timed out. 195 + ''; 141 196 }; 142 197 143 198 httpConnectTimeout = mkOption { 144 199 type = types.str; 145 200 default = "8s"; 201 + description = '' 202 + Maximum duration before a connection attempt to an identity upstream is aborted. 203 + 204 + This value should be lower than {option}`settings.identity.httpTimeout`. 205 + ''; 146 206 }; 147 207 }; 148 208 ··· 150 210 allocation = mkOption { 151 211 type = types.str; 152 212 default = "512mb"; 213 + description = '' 214 + Total memory allocation for the internal cache. 215 + 216 + Blobs are cached using an LFU policy. The most frequently requested blobs 217 + are kept longest when the cache approaches its limit. 218 + 219 + For production deployments, a CDN or caching layer in front of this server 220 + is recommended for lower latency and better global availability. 221 + 222 + Setting this too high can exhaust process or system memory. The minimum 223 + value is 8mb. 224 + ''; 153 225 }; 154 226 155 227 blobTti = mkOption { 156 228 type = types.str; 157 229 default = "7days"; 230 + description = '' 231 + How long blobs can be idle in the cache before expiring. 232 + ''; 158 233 }; 159 234 160 235 ownershipTtl = mkOption { 161 236 type = types.str; 162 237 default = "1day"; 238 + description = '' 239 + How long blob ownership can be cached before expiring. 240 + ''; 163 241 }; 164 242 165 243 policyTtl = mkOption { 166 244 type = types.str; 167 245 default = "1h"; 246 + description = '' 247 + How long policy decisions can be cached before expiring. 248 + ''; 249 + }; 250 + 251 + identityTtl = mkOption { 252 + type = types.str; 253 + default = "1h"; 254 + description = '' 255 + How long identity lookups (DID resolution, etc) can be cached before expiring. 256 + ''; 168 257 }; 169 258 }; 170 259 ··· 172 261 url = mkOption { 173 262 type = types.nullOr types.str; 174 263 default = null; 264 + description = '' 265 + Policy service URL that DID+CID pairs will be checked against. 266 + 267 + Requests are sent as HTTP GET <url>/<did>/<cid>. 268 + 269 + The service is expected to return HTTP 200 (OK) if permitted or HTTP 410 270 + (GONE) if restricted. 271 + ''; 175 272 }; 176 273 177 274 requestHeaders = mkOption { 178 275 type = types.listOf types.str; 179 276 default = []; 277 + description = '' 278 + Headers sent alongside all requests to the policy service. 279 + 280 + Each header must be in the format "Name: value". When setting via 281 + environment variable, headers are pipe-separated (|). 282 + 283 + Should be set via {option}`environmentFiles` for sensitive values such as 284 + API keys. 285 + ''; 180 286 }; 181 287 182 288 failOpen = mkOption { 183 289 type = types.bool; 184 290 default = false; 291 + description = '' 292 + Allow requests to proceed if the policy service is unavailable or returns 293 + an unexpected status code. 294 + 295 + Warning: enabling this means restricted blobs may be served when the 296 + policy service is unreachable. 297 + ''; 185 298 }; 186 299 187 300 httpTimeout = mkOption { 188 301 type = types.str; 189 302 default = "30s"; 303 + description = '' 304 + Maximum duration before policy service requests are timed out. 305 + ''; 190 306 }; 191 307 192 308 httpConnectTimeout = mkOption { 193 309 type = types.str; 194 310 default = "10s"; 311 + description = '' 312 + Maximum duration before an attempted connection to the policy service is aborted. 313 + 314 + This value should be lower than {option}`settings.policy.httpTimeout`. 315 + ''; 195 316 }; 196 317 }; 197 318 }; ··· 236 357 PORXIE_CACHE_BLOB_TTI = cfg.settings.cache.blobTti; 237 358 PORXIE_CACHE_OWNERSHIP_TTL = cfg.settings.cache.ownershipTtl; 238 359 PORXIE_CACHE_POLICY_TTL = cfg.settings.cache.policyTtl; 360 + PORXIE_CACHE_IDENTITY_TTL = cfg.settings.cache.identityTtl; 239 361 PORXIE_POLICY_URL = cfg.settings.policy.url; 240 362 PORXIE_POLICY_REQUEST_HEADERS = if cfg.settings.policy.requestHeaders != [] then lib.concatStringsSep "|" cfg.settings.policy.requestHeaders else null; 241 363 PORXIE_POLICY_FAIL_OPEN = if cfg.settings.policy.failOpen then "true" else null;