-2

README.md

reviewed

··· 53 53 | Guide | Best For | 54 54 |-------|----------| 55 55 | [Debian](docs/install-debian.md) | Debian 13+ with systemd | 56 56 - | [Alpine](docs/install-alpine.md) | Alpine 3.23+ with OpenRC | 57 57 - | [OpenBSD](docs/install-openbsd.md) | OpenBSD 7.8+ with rc.d | 58 56 | [Containers](docs/install-containers.md) | Podman with quadlets or OpenRC | 59 57 | [Kubernetes](docs/install-kubernetes.md) | You know what you're doing | 60 58

-265

docs/install-alpine.md

reviewed

··· 1 1 - # Tranquil PDS Production Installation on Alpine Linux 2 2 - > **Warning**: These instructions are untested and theoretical, written from the top of Lewis' head. They may contain errors or omissions. This warning will be removed once the guide has been verified. 3 3 - 4 4 - This guide covers installing Tranquil PDS on Alpine Linux 3.23. 5 5 - 6 6 - ## Prerequisites 7 7 - - A VPS with at least 2GB RAM and 20GB disk 8 8 - - A domain name pointing to your server's IP 9 9 - - A **wildcard TLS certificate** for `*.pds.example.com` (user handles are served as subdomains) 10 10 - - Root access 11 11 - ## 1. System Setup 12 12 - ```sh 13 13 - apk update && apk upgrade 14 14 - apk add curl git build-base openssl-dev pkgconf 15 15 - ``` 16 16 - ## 2. Install Rust 17 17 - ```sh 18 18 - apk add rustup 19 19 - rustup-init -y 20 20 - source ~/.cargo/env 21 21 - rustup default stable 22 22 - ``` 23 23 - This installs the latest stable Rust. Alpine also ships Rust via `apk add rust cargo` if you prefer system packages. 24 24 - ## 3. Install postgres 25 25 - ```sh 26 26 - apk add postgresql postgresql-contrib 27 27 - rc-update add postgresql 28 28 - /etc/init.d/postgresql setup 29 29 - rc-service postgresql start 30 30 - psql -U postgres -c "CREATE USER tranquil_pds WITH PASSWORD 'your-secure-password';" 31 31 - psql -U postgres -c "CREATE DATABASE pds OWNER tranquil_pds;" 32 32 - psql -U postgres -c "GRANT ALL PRIVILEGES ON DATABASE pds TO tranquil_pds;" 33 33 - ``` 34 34 - ## 4. Install minio 35 35 - ```sh 36 36 - curl -O https://dl.min.io/server/minio/release/linux-amd64/minio 37 37 - chmod +x minio 38 38 - mv minio /usr/local/bin/ 39 39 - mkdir -p /var/lib/minio/data 40 40 - adduser -D -H -s /sbin/nologin minio-user 41 41 - chown -R minio-user:minio-user /var/lib/minio 42 42 - cat > /etc/conf.d/minio << 'EOF' 43 43 - MINIO_ROOT_USER="minioadmin" 44 44 - MINIO_ROOT_PASSWORD="your-minio-password" 45 45 - MINIO_VOLUMES="/var/lib/minio/data" 46 46 - MINIO_OPTS="--console-address :9001" 47 47 - EOF 48 48 - cat > /etc/init.d/minio << 'EOF' 49 49 - #!/sbin/openrc-run 50 50 - name="minio" 51 51 - description="MinIO Object Storage" 52 52 - command="/usr/local/bin/minio" 53 53 - command_args="server ${MINIO_VOLUMES} ${MINIO_OPTS}" 54 54 - command_user="minio-user" 55 55 - command_background=true 56 56 - pidfile="/run/${RC_SVCNAME}.pid" 57 57 - output_log="/var/log/minio.log" 58 58 - error_log="/var/log/minio.log" 59 59 - depend() { 60 60 - need net 61 61 - } 62 62 - start_pre() { 63 63 - . /etc/conf.d/minio 64 64 - export MINIO_ROOT_USER MINIO_ROOT_PASSWORD 65 65 - } 66 66 - EOF 67 67 - chmod +x /etc/init.d/minio 68 68 - rc-update add minio 69 69 - rc-service minio start 70 70 - ``` 71 71 - Create the buckets (wait a few seconds for minio to start): 72 72 - ```sh 73 73 - curl -O https://dl.min.io/client/mc/release/linux-amd64/mc 74 74 - chmod +x mc 75 75 - mv mc /usr/local/bin/ 76 76 - mc alias set local http://localhost:9000 minioadmin your-minio-password 77 77 - mc mb local/pds-blobs 78 78 - mc mb local/pds-backups 79 79 - ``` 80 80 - ## 5. Install valkey 81 81 - ```sh 82 82 - apk add valkey 83 83 - rc-update add valkey 84 84 - rc-service valkey start 85 85 - ``` 86 86 - ## 6. Install deno (for frontend build) 87 87 - ```sh 88 88 - curl -fsSL https://deno.land/install.sh | sh 89 89 - export PATH="$HOME/.deno/bin:$PATH" 90 90 - echo 'export PATH="$HOME/.deno/bin:$PATH"' >> ~/.profile 91 91 - ``` 92 92 - ## 7. Clone and Build Tranquil PDS 93 93 - ```sh 94 94 - mkdir -p /opt && cd /opt 95 95 - git clone https://tangled.org/lewis.moe/bspds-sandbox tranquil-pds 96 96 - cd tranquil-pds 97 97 - cd frontend 98 98 - deno task build 99 99 - cd .. 100 100 - cargo build --release 101 101 - ``` 102 102 - ## 8. Install sqlx-cli and Run Migrations 103 103 - ```sh 104 104 - cargo install sqlx-cli --no-default-features --features postgres 105 105 - export DATABASE_URL="postgres://tranquil_pds:your-secure-password@localhost:5432/pds" 106 106 - sqlx migrate run 107 107 - ``` 108 108 - ## 9. Configure Tranquil PDS 109 109 - ```sh 110 110 - mkdir -p /etc/tranquil-pds 111 111 - cp /opt/tranquil-pds/.env.example /etc/tranquil-pds/tranquil-pds.env 112 112 - chmod 600 /etc/tranquil-pds/tranquil-pds.env 113 113 - ``` 114 114 - Edit `/etc/tranquil-pds/tranquil-pds.env` and fill in your values. Generate secrets with: 115 115 - ```sh 116 116 - openssl rand -base64 48 117 117 - ``` 118 118 - ## 10. Create OpenRC Service 119 119 - ```sh 120 120 - adduser -D -H -s /sbin/nologin tranquil-pds 121 121 - cp /opt/tranquil-pds/target/release/tranquil-pds /usr/local/bin/ 122 122 - mkdir -p /var/lib/tranquil-pds 123 123 - cp -r /opt/tranquil-pds/frontend/dist /var/lib/tranquil-pds/frontend 124 124 - chown -R tranquil-pds:tranquil-pds /var/lib/tranquil-pds 125 125 - cat > /etc/init.d/tranquil-pds << 'EOF' 126 126 - #!/sbin/openrc-run 127 127 - name="tranquil-pds" 128 128 - description="Tranquil PDS - AT Protocol PDS" 129 129 - command="/usr/local/bin/tranquil-pds" 130 130 - command_user="tranquil-pds" 131 131 - command_background=true 132 132 - pidfile="/run/${RC_SVCNAME}.pid" 133 133 - output_log="/var/log/tranquil-pds.log" 134 134 - error_log="/var/log/tranquil-pds.log" 135 135 - depend() { 136 136 - need net postgresql minio 137 137 - } 138 138 - start_pre() { 139 139 - export FRONTEND_DIR=/var/lib/tranquil-pds/frontend 140 140 - . /etc/tranquil-pds/tranquil-pds.env 141 141 - export SERVER_HOST SERVER_PORT PDS_HOSTNAME DATABASE_URL 142 142 - export S3_ENDPOINT AWS_REGION S3_BUCKET AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY 143 143 - export VALKEY_URL JWT_SECRET DPOP_SECRET MASTER_KEY CRAWLERS 144 144 - } 145 145 - EOF 146 146 - chmod +x /etc/init.d/tranquil-pds 147 147 - rc-update add tranquil-pds 148 148 - rc-service tranquil-pds start 149 149 - ``` 150 150 - ## 11. Install and Configure nginx 151 151 - ```sh 152 152 - apk add nginx certbot certbot-nginx 153 153 - cat > /etc/nginx/http.d/tranquil-pds.conf << 'EOF' 154 154 - server { 155 155 - listen 80; 156 156 - listen [::]:80; 157 157 - server_name pds.example.com; 158 158 - location / { 159 159 - proxy_pass http://127.0.0.1:3000; 160 160 - proxy_http_version 1.1; 161 161 - proxy_set_header Upgrade $http_upgrade; 162 162 - proxy_set_header Connection "upgrade"; 163 163 - proxy_set_header Host $host; 164 164 - proxy_set_header X-Real-IP $remote_addr; 165 165 - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 166 166 - proxy_set_header X-Forwarded-Proto $scheme; 167 167 - proxy_read_timeout 86400; 168 168 - } 169 169 - } 170 170 - EOF 171 171 - rc-update add nginx 172 172 - rc-service nginx start 173 173 - ``` 174 174 - ## 12. Obtain Wildcard SSL Certificate 175 175 - User handles are served as subdomains (e.g., `alice.pds.example.com`), so you need a wildcard certificate. 176 176 - 177 177 - Wildcard certs require DNS-01 validation. For manual DNS validation (works with any provider): 178 178 - ```sh 179 179 - certbot certonly --manual --preferred-challenges dns \ 180 180 - -d pds.example.com -d '*.pds.example.com' 181 181 - ``` 182 182 - Follow the prompts to add TXT records to your DNS. 183 183 - 184 184 - If your DNS provider has a certbot plugin, you can use that for auto-renewal: 185 185 - ```sh 186 186 - apk add certbot-dns-cloudflare 187 187 - certbot certonly --dns-cloudflare \ 188 188 - --dns-cloudflare-credentials /etc/cloudflare.ini \ 189 189 - -d pds.example.com -d '*.pds.example.com' 190 190 - ``` 191 191 - 192 192 - After obtaining the cert, update nginx to use it, then set up auto-renewal: 193 193 - ```sh 194 194 - echo "0 0 * * * certbot renew --quiet && rc-service nginx reload" | crontab - 195 195 - ``` 196 196 - ## 13. Configure Firewall 197 197 - ```sh 198 198 - apk add iptables ip6tables 199 199 - iptables -A INPUT -p tcp --dport 22 -j ACCEPT 200 200 - iptables -A INPUT -p tcp --dport 80 -j ACCEPT 201 201 - iptables -A INPUT -p tcp --dport 443 -j ACCEPT 202 202 - iptables -A INPUT -i lo -j ACCEPT 203 203 - iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 204 204 - iptables -P INPUT DROP 205 205 - ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT 206 206 - ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT 207 207 - ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT 208 208 - ip6tables -A INPUT -i lo -j ACCEPT 209 209 - ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 210 210 - ip6tables -P INPUT DROP 211 211 - rc-update add iptables 212 212 - rc-update add ip6tables 213 213 - /etc/init.d/iptables save 214 214 - /etc/init.d/ip6tables save 215 215 - ``` 216 216 - ## 14. Verify Installation 217 217 - ```sh 218 218 - rc-service tranquil-pds status 219 219 - curl -s https://pds.example.com/xrpc/_health 220 220 - curl -s https://pds.example.com/.well-known/atproto-did 221 221 - ``` 222 222 - ## Maintenance 223 223 - View logs: 224 224 - ```sh 225 225 - tail -f /var/log/tranquil-pds.log 226 226 - ``` 227 227 - Update Tranquil PDS: 228 228 - ```sh 229 229 - cd /opt/tranquil-pds 230 230 - git pull 231 231 - cd frontend && deno task build && cd .. 232 232 - cargo build --release 233 233 - rc-service tranquil-pds stop 234 234 - cp target/release/tranquil-pds /usr/local/bin/ 235 235 - cp -r frontend/dist /var/lib/tranquil-pds/frontend 236 236 - DATABASE_URL="postgres://tranquil_pds:your-secure-password@localhost:5432/pds" sqlx migrate run 237 237 - rc-service tranquil-pds start 238 238 - ``` 239 239 - Backup database: 240 240 - ```sh 241 241 - pg_dump -U postgres pds > /var/backups/pds-$(date +%Y%m%d).sql 242 242 - ``` 243 243 - 244 244 - ## Custom Homepage 245 245 - 246 246 - Drop a `homepage.html` in `/var/lib/tranquil-pds/frontend/` and it becomes your landing page. Go nuts with it. Account dashboard is at `/app/` so you won't break anything. 247 247 - 248 248 - ```sh 249 249 - cat > /var/lib/tranquil-pds/frontend/homepage.html << 'EOF' 250 250 - <!DOCTYPE html> 251 251 - <html> 252 252 - <head> 253 253 - <title>Welcome to my PDS</title> 254 254 - <style> 255 255 - body { font-family: system-ui; max-width: 600px; margin: 100px auto; padding: 20px; } 256 256 - </style> 257 257 - </head> 258 258 - <body> 259 259 - <h1>Welcome to my amazing zoo pen</h1> 260 260 - <p>This is a <a href="https://atproto.com">AT Protocol</a> Personal Data Server.</p> 261 261 - <p><a href="/app/">Sign in</a> or learn more at <a href="https://bsky.social">Bluesky</a>.</p> 262 262 - </body> 263 263 - </html> 264 264 - EOF 265 265 - ```

-277

docs/install-openbsd.md

reviewed

··· 1 1 - # Tranquil PDS Production Installation on OpenBSD 2 2 - > **Warning**: These instructions are untested and theoretical, written from the top of Lewis' head. They may contain errors or omissions. This warning will be removed once the guide has been verified. 3 3 - This guide covers installing Tranquil PDS on OpenBSD 7.8. 4 4 - ## Prerequisites 5 5 - - A VPS with at least 2GB RAM and 20GB disk 6 6 - - A domain name pointing to your server's IP 7 7 - - A **wildcard TLS certificate** for `*.pds.example.com` (user handles are served as subdomains) 8 8 - - Root access (or doas configured) 9 9 - ## Why nginx over relayd? 10 10 - OpenBSD's native `relayd` supports WebSockets but does **not** support HTTP/2. For a modern PDS deployment, we recommend nginx which provides HTTP/2, WebSocket support, and automatic OCSP stapling. 11 11 - ## 1. System Setup 12 12 - ```sh 13 13 - pkg_add curl git 14 14 - ``` 15 15 - ## 2. Install Rust 16 16 - ```sh 17 17 - pkg_add rust 18 18 - ``` 19 19 - OpenBSD ships Rust in ports. For the latest stable, use rustup: 20 20 - ```sh 21 21 - pkg_add rustup 22 22 - rustup-init -y 23 23 - source ~/.cargo/env 24 24 - rustup default stable 25 25 - ``` 26 26 - ## 3. Install postgres 27 27 - ```sh 28 28 - pkg_add postgresql-server postgresql-client 29 29 - mkdir -p /var/postgresql/data 30 30 - chown _postgresql:_postgresql /var/postgresql/data 31 31 - su - _postgresql -c "initdb -D /var/postgresql/data -U postgres -A scram-sha-256" 32 32 - rcctl enable postgresql 33 33 - rcctl start postgresql 34 34 - psql -U postgres -c "CREATE USER tranquil_pds WITH PASSWORD 'your-secure-password';" 35 35 - psql -U postgres -c "CREATE DATABASE pds OWNER tranquil_pds;" 36 36 - psql -U postgres -c "GRANT ALL PRIVILEGES ON DATABASE pds TO tranquil_pds;" 37 37 - ``` 38 38 - ## 4. Install minio 39 39 - OpenBSD doesn't have a minio package. Options: 40 40 - **Option A: Use an external S3-compatible service (recommended for production)** 41 41 - aws s3, backblaze b2, or upcloud managed object storage. Skip to step 5 and configure the S3 credentials in step 9. 42 42 - **Option B: Build minio from source** 43 43 - ```sh 44 44 - pkg_add go 45 45 - mkdir -p /tmp/minio-build && cd /tmp/minio-build 46 46 - ftp -o minio.tar.gz https://github.com/minio/minio/archive/refs/tags/RELEASE.2025-10-15T17-29-55Z.tar.gz 47 47 - tar xzf minio.tar.gz 48 48 - cd minio-* 49 49 - go build -o minio . 50 50 - cp minio /usr/local/bin/ 51 51 - mkdir -p /var/minio/data 52 52 - useradd -d /var/minio -s /sbin/nologin _minio 53 53 - chown -R _minio:_minio /var/minio 54 54 - cat > /etc/minio.conf << 'EOF' 55 55 - MINIO_ROOT_USER=minioadmin 56 56 - MINIO_ROOT_PASSWORD=your-minio-password 57 57 - EOF 58 58 - chmod 600 /etc/minio.conf 59 59 - cat > /etc/rc.d/minio << 'EOF' 60 60 - #!/bin/ksh 61 61 - daemon="/usr/local/bin/minio" 62 62 - daemon_user="_minio" 63 63 - daemon_flags="server /var/minio/data --console-address :9001" 64 64 - . /etc/rc.d/rc.subr 65 65 - rc_pre() { 66 66 - . /etc/minio.conf 67 67 - export MINIO_ROOT_USER MINIO_ROOT_PASSWORD 68 68 - } 69 69 - rc_cmd $1 70 70 - EOF 71 71 - chmod +x /etc/rc.d/minio 72 72 - rcctl enable minio 73 73 - rcctl start minio 74 74 - ``` 75 75 - Create the buckets: 76 76 - ```sh 77 77 - ftp -o /usr/local/bin/mc https://dl.min.io/client/mc/release/openbsd-amd64/mc 78 78 - chmod +x /usr/local/bin/mc 79 79 - mc alias set local http://localhost:9000 minioadmin your-minio-password 80 80 - mc mb local/pds-blobs 81 81 - mc mb local/pds-backups 82 82 - ``` 83 83 - ## 5. Install redis 84 84 - OpenBSD has redis in ports (valkey not available yet): 85 85 - ```sh 86 86 - pkg_add redis 87 87 - rcctl enable redis 88 88 - rcctl start redis 89 89 - ``` 90 90 - ## 6. Install deno (for frontend build) 91 91 - ```sh 92 92 - curl -fsSL https://deno.land/install.sh | sh 93 93 - export PATH="$HOME/.deno/bin:$PATH" 94 94 - echo 'export PATH="$HOME/.deno/bin:$PATH"' >> ~/.profile 95 95 - ``` 96 96 - ## 7. Clone and Build Tranquil PDS 97 97 - ```sh 98 98 - mkdir -p /opt && cd /opt 99 99 - git clone https://tangled.org/lewis.moe/bspds-sandbox tranquil-pds 100 100 - cd tranquil-pds 101 101 - cd frontend 102 102 - deno task build 103 103 - cd .. 104 104 - cargo build --release 105 105 - ``` 106 106 - ## 8. Install sqlx-cli and Run Migrations 107 107 - ```sh 108 108 - cargo install sqlx-cli --no-default-features --features postgres 109 109 - export DATABASE_URL="postgres://tranquil_pds:your-secure-password@localhost:5432/pds" 110 110 - sqlx migrate run 111 111 - ``` 112 112 - ## 9. Configure Tranquil PDS 113 113 - ```sh 114 114 - mkdir -p /etc/tranquil-pds 115 115 - cp /opt/tranquil-pds/.env.example /etc/tranquil-pds/tranquil-pds.conf 116 116 - chmod 600 /etc/tranquil-pds/tranquil-pds.conf 117 117 - ``` 118 118 - Edit `/etc/tranquil-pds/tranquil-pds.conf` and fill in your values. Generate secrets with: 119 119 - ```sh 120 120 - openssl rand -base64 48 121 121 - ``` 122 122 - ## 10. Create rc.d Service 123 123 - ```sh 124 124 - useradd -d /var/empty -s /sbin/nologin _tranquil_pds 125 125 - cp /opt/tranquil-pds/target/release/tranquil-pds /usr/local/bin/ 126 126 - mkdir -p /var/tranquil-pds 127 127 - cp -r /opt/tranquil-pds/frontend/dist /var/tranquil-pds/frontend 128 128 - chown -R _tranquil_pds:_tranquil_pds /var/tranquil-pds 129 129 - cat > /etc/rc.d/tranquil_pds << 'EOF' 130 130 - #!/bin/ksh 131 131 - daemon="/usr/local/bin/tranquil-pds" 132 132 - daemon_user="_tranquil_pds" 133 133 - daemon_logger="daemon.info" 134 134 - . /etc/rc.d/rc.subr 135 135 - rc_pre() { 136 136 - export FRONTEND_DIR=/var/tranquil-pds/frontend 137 137 - while IFS='=' read -r key value; do 138 138 - case "$key" in 139 139 - \#*|"") continue ;; 140 140 - esac 141 141 - export "$key=$value" 142 142 - done < /etc/tranquil-pds/tranquil-pds.conf 143 143 - } 144 144 - rc_cmd $1 145 145 - EOF 146 146 - chmod +x /etc/rc.d/tranquil_pds 147 147 - rcctl enable tranquil_pds 148 148 - rcctl start tranquil_pds 149 149 - ``` 150 150 - ## 11. Install and Configure nginx 151 151 - ```sh 152 152 - pkg_add nginx 153 153 - cat > /etc/nginx/nginx.conf << 'EOF' 154 154 - worker_processes 1; 155 155 - events { 156 156 - worker_connections 1024; 157 157 - } 158 158 - http { 159 159 - include mime.types; 160 160 - server { 161 161 - listen 80; 162 162 - listen [::]:80; 163 163 - server_name pds.example.com; 164 164 - location /.well-known/acme-challenge/ { 165 165 - root /var/www/acme; 166 166 - } 167 167 - location / { 168 168 - return 301 https://$host$request_uri; 169 169 - } 170 170 - } 171 171 - server { 172 172 - listen 443 ssl http2; 173 173 - listen [::]:443 ssl http2; 174 174 - server_name pds.example.com; 175 175 - ssl_certificate /etc/ssl/pds.example.com.fullchain.pem; 176 176 - ssl_certificate_key /etc/ssl/private/pds.example.com.key; 177 177 - ssl_protocols TLSv1.2 TLSv1.3; 178 178 - ssl_ciphers HIGH:!aNULL:!MD5; 179 179 - ssl_prefer_server_ciphers on; 180 180 - ssl_session_cache shared:SSL:10m; 181 181 - location / { 182 182 - proxy_pass http://127.0.0.1:3000; 183 183 - proxy_http_version 1.1; 184 184 - proxy_set_header Upgrade $http_upgrade; 185 185 - proxy_set_header Connection "upgrade"; 186 186 - proxy_set_header Host $host; 187 187 - proxy_set_header X-Real-IP $remote_addr; 188 188 - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 189 189 - proxy_set_header X-Forwarded-Proto $scheme; 190 190 - proxy_read_timeout 86400; 191 191 - } 192 192 - } 193 193 - } 194 194 - EOF 195 195 - mkdir -p /var/www/acme 196 196 - rcctl enable nginx 197 197 - ``` 198 198 - ## 12. Obtain Wildcard SSL Certificate 199 199 - User handles are served as subdomains (e.g., `alice.pds.example.com`), so you need a wildcard certificate. 200 200 - 201 201 - OpenBSD's native `acme-client` only supports HTTP-01 validation, which can't issue wildcard certs. You have a few options: 202 202 - 203 203 - **Option A: Use certbot with DNS validation (recommended)** 204 204 - ```sh 205 205 - pkg_add certbot 206 206 - certbot certonly --manual --preferred-challenges dns \ 207 207 - -d pds.example.com -d '*.pds.example.com' 208 208 - ``` 209 209 - Follow the prompts to add TXT records to your DNS. Then update nginx.conf to point to the certbot certs. 210 210 - 211 211 - **Option B: Use a managed DNS provider with API** 212 212 - If your DNS provider has a certbot plugin, you can automate renewal. 213 213 - 214 214 - **Option C: Use acme.sh** 215 215 - [acme.sh](https://github.com/acmesh-official/acme.sh) supports many DNS providers for automated wildcard cert renewal. 216 216 - 217 217 - After obtaining the cert, update nginx to use it and restart: 218 218 - ```sh 219 219 - rcctl restart nginx 220 220 - ``` 221 221 - ## 13. Configure Packet Filter (pf) 222 222 - ```sh 223 223 - cat >> /etc/pf.conf << 'EOF' 224 224 - pass in on egress proto tcp from any to any port { 22, 80, 443 } 225 225 - EOF 226 226 - pfctl -f /etc/pf.conf 227 227 - ``` 228 228 - ## 14. Verify Installation 229 229 - ```sh 230 230 - rcctl check tranquil_pds 231 231 - ftp -o - https://pds.example.com/xrpc/_health 232 232 - ftp -o - https://pds.example.com/.well-known/atproto-did 233 233 - ``` 234 234 - ## Maintenance 235 235 - View logs: 236 236 - ```sh 237 237 - tail -f /var/log/daemon 238 238 - ``` 239 239 - Update Tranquil PDS: 240 240 - ```sh 241 241 - cd /opt/tranquil-pds 242 242 - git pull 243 243 - cd frontend && deno task build && cd .. 244 244 - cargo build --release 245 245 - rcctl stop tranquil_pds 246 246 - cp target/release/tranquil-pds /usr/local/bin/ 247 247 - cp -r frontend/dist /var/tranquil-pds/frontend 248 248 - DATABASE_URL="postgres://tranquil_pds:your-secure-password@localhost:5432/pds" sqlx migrate run 249 249 - rcctl start tranquil_pds 250 250 - ``` 251 251 - Backup database: 252 252 - ```sh 253 253 - pg_dump -U postgres pds > /var/backups/pds-$(date +%Y%m%d).sql 254 254 - ``` 255 255 - 256 256 - ## Custom Homepage 257 257 - 258 258 - Drop a `homepage.html` in `/var/tranquil-pds/frontend/` and it becomes your landing page. Go nuts with it. Account dashboard is at `/app/` so you won't break anything. 259 259 - 260 260 - ```sh 261 261 - cat > /var/tranquil-pds/frontend/homepage.html << 'EOF' 262 262 - <!DOCTYPE html> 263 263 - <html> 264 264 - <head> 265 265 - <title>Welcome to my PDS</title> 266 266 - <style> 267 267 - body { font-family: system-ui; max-width: 600px; margin: 100px auto; padding: 20px; } 268 268 - </style> 269 269 - </head> 270 270 - <body> 271 271 - <h1>Welcome to my uma musume shipping site!</h1> 272 272 - <p>This is a <a href="https://atproto.com">AT Protocol</a> Personal Data Server.</p> 273 273 - <p><a href="/app/">Sign in</a> or learn more at <a href="https://bsky.social">Bluesky</a>.</p> 274 274 - </body> 275 275 - </html> 276 276 - EOF 277 277 - ```