feat: added fedifetcher

modules/nixos/guests/mastodon/default.nix

@@ -14,18 +14,48 @@ let
   host = serviceCfg.domains.url0;
   dns0 = instances.web.dns.provider0;
   dns0Path = "dns/${dns0}";
+
+  fedifetcherConfig = pkgs.writeText "fedifetcher-config.json" (
+    builtins.toJSON {
+      server = host;
+      home-timeline-length = 200;
+      max-followings = 80;
+      from-notifications = 1;
+      max-bookmarks = 80;
+      max-favourites = 40;
+      backfill-with-context = 1;
+      backfill-mentioned-users = 1;
+      remember-users-for-hours = 168;
+      remember-hosts-for-days = 30;
+      http-timeout = 5;
+      lock-hours = 24;
+      log-level = "INFO";
+    }
+  );
+
+  fedifetcherPython = pkgs.python3.withPackages (
+    ps: with ps; [
+      requests
+      pytz
+      beautifulsoup4
+    ]
+  );
+
+  fedifetcherSrc = pkgs.fetchFromGitHub {
+    owner = "nanos";
+    repo = "FediFetcher";
+    rev = "main";
+    sha256 = "sha256-J7psV/mA7okuuO7/aXVVWS9p63eMncG2CEEGN38ip0=";
+  };
 in
 {
   # If you need to start fresh for some reason, run these to create the new Admin account:
   # sudo -u mastodon mastodon-tootctl accounts create nick --email=nick@localhost --confirmed --role=Owner
   # sudo -u mastodon mastodon-tootctl accounts approve nick
-
   # If you fuck up and lose the password, use this:
   # sudo mastodon-tootctl accounts modify --reset-password nick
-
   # If you really fuck up and name yourself wrong, use this shit
   # sudo mastodon-tootctl accounts modify username --remove-role
-
   # nixpkgs.overlays = [
   #   (
   #     final: prev: {
@@ -39,7 +69,6 @@ in
   #     }
   #   )
   # ];
-
   microvm.vms = {
     ${serviceCfg.name} = {
       autostart = true;
@@ -132,14 +161,12 @@ in
                       root /var/lib/mastodon/public-system
                     }
                   }
-
                   handle /api/v1/streaming/* {
                     reverse_proxy unix//run/mastodon-streaming/streaming.socket {
                       header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
                       header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
                     }
                   }
-
                   route * {
                     file_server * {
                       root ${pkgs.mastodon}/public
@@ -150,19 +177,15 @@ in
                       header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
                     }
                   }
-
                   handle_errors {
                     root * ${pkgs.mastodon}/public
                     rewrite 500.html
                     file_server
                   }
-
                   encode gzip
-
                   header /* {
                     Strict-Transport-Security "max-age=31536000;"
                   }
-
                   header /emoji/* Cache-Control "public, max-age=31536000, immutable"
                   header /packs/* Cache-Control "public, max-age=31536000, immutable"
                   header /system/accounts/avatars/* Cache-Control "public, max-age=31536000, immutable"
@@ -171,11 +194,9 @@ in
               };
             };
           };
-
           postgresql = {
             enable = true;
           };
-
           openssh = {
             enable = true;
             settings = {
@@ -184,14 +205,12 @@ in
             };
           };
         };
-
         users.users.${serviceCfg.name}.extraGroups = [
           "postgres"
         ];
         users.users.caddy.extraGroups = [
           serviceCfg.name
         ];
-
         networking.firewall.allowedTCPPorts = [
           22 # SSH
           80 # Caddy
@@ -201,7 +220,6 @@ in
           2525 # SMTP
           5432 # Postgres
         ];
-
         systemd = {
           services = {
             mastodon-init-dirs = {
@@ -234,23 +252,57 @@ in
               description = "Copy secrets from virtiofs to local filesystem";
               before = [ "mastodon-init-dirs.service" ];
               requiredBy = [ "mastodon-init-dirs.service" ];
-
               serviceConfig = {
                 Type = "oneshot";
                 RemainAfterExit = true;
               };
-
               script = ''
                 mkdir -p /etc/mastodon-secrets
                 cp /run/secrets/pass /etc/mastodon-secrets/pass
                 cp /run/secrets/database /etc/mastodon-secrets/database
                 cp /run/secrets/redis /etc/mastodon-secrets/redis
                 cp /run/secrets/smtp /etc/mastodon-secrets/smtp
+                cp /run/secrets/fedifetcher-token /etc/mastodon-secrets/fedifetcher-token
                 chmod 755 /etc/mastodon-secrets
                 chmod 644 /etc/mastodon-secrets/*
               '';
             };
+
+            fedifetcher = {
+              description = "FediFetcher Service";
+              after = [
+                "network.target"
+                "mastodon-web.service"
+              ];
+              serviceConfig = {
+                Type = "oneshot";
+                User = serviceCfg.name;
+                WorkingDirectory = "/var/lib/fedifetcher";
+                ExecStart =
+                  let
+                    script = pkgs.writeShellScript "fedifetcher-run" ''
+                      set -e
+                      export ACCESS_TOKEN=$(cat /etc/mastodon-secrets/fedifetcher-token)
+                      ${fedifetcherPython}/bin/python ${fedifetcherSrc}/find_posts.py \
+                        -c=${fedifetcherConfig} \
+                        --access-token="$ACCESS_TOKEN"
+                    '';
+                  in
+                  "${script}";
+              };
+            };
           };
+
+          timers.fedifetcher = {
+            description = "FediFetcher Timer";
+            wantedBy = [ "timers.target" ];
+            timerConfig = {
+              OnCalendar = "*:0/15"; # Run every 15 minutes
+              Persistent = true;
+              Unit = "fedifetcher.service";
+            };
+          };
+
           network = {
             enable = true;
             networks."20-lan" = {
@@ -268,6 +320,7 @@ in
               ];
             };
           };
+
           services = {
             mastodon-init-db = {
               serviceConfig = {
@@ -276,6 +329,7 @@ in
             };
             systemd-tmpfiles-setup.after = [ "var-lib-mastodon.mount" ];
           };
+
           tmpfiles.rules = [
             "d /var/lib/mastodon 0755 mastodon mastodon -"
             "Z /var/lib/mastodon 0755 mastodon mastodon -"
@@ -286,6 +340,7 @@ in
             "d /var/lib/mastodon/public-system/media_attachments 0755 mastodon mastodon -"
             "d /var/lib/mastodon/public-system/media_attachments/files 0755 mastodon mastodon -"
             "d /var/lib/mastodon/public-system/site_uploads 0755 mastodon mastodon -"
+            "d /var/lib/fedifetcher 0755 mastodon mastodon -"
           ];
         };
 
@@ -337,12 +392,17 @@ in
               source = "/run/secrets/${serviceCfg.name}";
               tag = "host_secrets";
             }
+            {
+              mountPoint = "/var/lib/fedifetcher";
+              proto = "virtiofs";
+              source = "${serviceCfg.mntPaths.path0}/fedifetcher";
+              tag = "fedifetcher_data";
+            }
           ];
         };
       };
     };
   };
-
   sops = {
     secrets = builtins.listToAttrs (
       map
@@ -359,6 +419,7 @@ in
           "database"
           "redis"
           "pass"
+          "fedifetcher-token"
         ]
     );
   };
@@ -367,6 +428,7 @@ in
     "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
     "d ${serviceCfg.mntPaths.path0}/data 0751 microvm wheel - -"
     "d ${serviceCfg.mntPaths.path0}/database 0751 microvm wheel - -"
+    "d ${serviceCfg.mntPaths.path0}/fedifetcher 0751 microvm wheel - -"
   ];
 
   services.caddy.virtualHosts."${host}" = {
@@ -376,9 +438,7 @@ in
         header_up X-Real-IP {remote_host}
         header_up X-Forwarded-For {remote_host}
       }
-
       tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
-
       encode zstd gzip
     '';
   };

secrets/secrets.yaml

@@ -11,6 +11,7 @@ mastodon:
     database: ENC[AES256_GCM,data:dYdLk9s4xZjHaIZCiKvLf/7HbcHVdMOk69JzYmXkX4lf,iv:IJKSR47LR08OuzPJZmfQnVUyOSjtUEmv0c/sGT9eIws=,tag:KUtW8ZKoZHBKvixVLYkNrQ==,type:str]
     redis: ENC[AES256_GCM,data:lrbTQAuay170fXNUGooG7bJg5lROItwUrnlKYBalo7Zp,iv:osaPJhqOpT5fm4ZYP7rbn0y/jzCfOu8+iPwO8KhRkuM=,tag:ByQjwCT7MtJjgpGWNAoffA==,type:str]
     pass: ENC[AES256_GCM,data:VlWIQQK89E4FaIUNXu1+sPuEbSQIVdYeGVWt8eztCMpikVsmeFd+G3XxS1Zm76m0tNFZjF7oHILpCudHU4M8k810ePwadcUOiglCP4P2Dkn1vrrB384T5Ed9gn8NHo3S1HlXczsNKmy6j8fP2CNKSb8Mar5VQBbajqryA73bB9pI,iv:EvlNrU4ImdYe5/HQytXCxqDui3Df3oIcC1vLkor7be4=,tag:lnkyjWHyEUTWPVqjwYx+cg==,type:str]
+    fedifetcher-token: ENC[AES256_GCM,data:1P4B5rs63eFFyTFdcwwQjedufURFPWy+EMFQ5TxFcXG/+FYODj9Gh6sZ2WI=,iv:Qd0abGcexrOqYGq4zOSiU9hMJAcoBWmiQEK5ujgls8s=,tag:8WfMSOqLLFO/RiXjyeaQYg==,type:str]
 peertube-smtp: ENC[AES256_GCM,data:rYwL0RNVvC9DUsSRJ5WpLX3VqT4zHYarxSe/tdRBHqs=,iv:cQKRbxdMOF+g84djLZcOk3hMYifucO+r0JxV8EnRjro=,tag:ZnN/LmQ/A3FR4bdJ9DYoEw==,type:str]
 peertube-database: ENC[AES256_GCM,data:nm0bHwTcT+ROZc2BC9jx+tXWjZ3689rdn4fdYW+7JTU=,iv:EeQVBAIXPut9gs+I9WpRf7L3f7ACTeTWycUFIKAneKk=,tag:QjGQmZ3zMAgB/WDbxTZVIQ==,type:str]
 peertube-redis: ENC[AES256_GCM,data:SQoPzPjgf4YN9dhvO0wo2DEra7cTgfZBx4vCBpNVSXI=,iv:mcCwYtE9E/Mb4V0j9NnU9WhaUMeBpX7BOcc8HGDiEvI=,tag:CsSiS4peZhnZ22uNtUC44w==,type:str]
@@ -65,7 +66,7 @@ sops:
             bXBOa1VSakoyaWxpODJEOU11QUZCaUEK8Ch9Ten3DdrPHF1DTH2qei85AlHUOaLD
             aNfzakake7ej+MxJYdKEU0bcWofNMKzIlZa2uM10KZSENDP8d8qlig==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-18T04:44:47Z"
+    lastmodified: "2025-11-21T10:02:04Z"
-    mac: ENC[AES256_GCM,data:B7g1vWlTq3SgmEr5ZMRXMJDmZa9G0OMaNqQLciNVTEwbR8h98K/5qdUl9XieA2Pr5114XwpV838iniCOeQfW3R7YTfhATw71flr1p6mXdHPIErVSFdeCT+xLhRk2uxCQLfQGiiZDcsuFt82byEYhgeXgrgp6ivo/sQOLaXAnbSY=,iv:eK9F3/tLxiEJnumuU6zVDh34fvXl3skCb0e4woZ59kI=,tag:hcaf72tZ4WuL3oAR/nuuEA==,type:str]
+    mac: ENC[AES256_GCM,data:5Q2J9yqR37J4S/PoOSK1btvUEmZZKEiSguWO2X/agiA4Xqqy1n6HMpyTJ1p2LYMiTDP1aFa1VaxKUObKjEPYOUpdzbteqCNvDR6mQAqh0BlOq+iUDZZW8d+vunmSeKgbEY9JJiEdUBNTyf4pu+vGhj37qWueksELsjQMojBDAt0=,iv:zlnZmYR/5hVqDlVA8azdoC0iO2pV/R27W6ZAXl96iPw=,tag:PX9VaSNl/Irahe65Ek2WQg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0