ActivityPubの仕組み

1. ユーザーがコンテンツを投稿
2. ActivityPubプロトコルでメッセージを配信
3. フォロワーのサーバーがメッセージを受信
4. 各サーバーでコンテンツが表示される

必要なソフトウェア

# Docker & Docker Composeのインストール
curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh
sudo usermod -aG docker $USER

# Docker Composeのインストール
sudo curl -L "https://github.com/docker/compose/releases/download/v2.20.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose

# プロジェクトディレクトリの作成
mkdir -p /opt/pixelfed
cd /opt/pixelfed

# 必要なディレクトリの作成
mkdir -p {config,storage,database,redis_data,uploads}

docker-compose.yml

version: '3.8'

services:
  db:
    image: mysql:8.0
    environment:
      MYSQL_DATABASE: pixelfed
      MYSQL_USER: pixelfed
      MYSQL_PASSWORD: ${DB_PASSWORD}
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
    volumes:
      - ./database:/var/lib/mysql
    restart: unless-stopped
    networks:
      - pixelfed

  redis:
    image: redis:7-alpine
    volumes:
      - ./redis_data:/data
    restart: unless-stopped
    networks:
      - pixelfed

  app:
    image: pixelfed/pixelfed:latest
    depends_on:
      - db
      - redis
    environment:
      APP_NAME: "My Pixelfed"
      APP_ENV: production
      APP_KEY: ${APP_KEY}
      APP_URL: https://${DOMAIN}
      DB_CONNECTION: mysql
      DB_HOST: db
      DB_DATABASE: pixelfed
      DB_USERNAME: pixelfed
      DB_PASSWORD: ${DB_PASSWORD}
      REDIS_HOST: redis
      MAIL_DRIVER: smtp
      MAIL_HOST: ${MAIL_HOST}
      MAIL_PORT: ${MAIL_PORT}
      MAIL_USERNAME: ${MAIL_USERNAME}
      MAIL_PASSWORD: ${MAIL_PASSWORD}
      MAIL_ENCRYPTION: tls
    volumes:
      - ./storage:/var/www/storage
      - ./uploads:/var/www/public/storage
    restart: unless-stopped
    networks:
      - pixelfed
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pixelfed.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.pixelfed.tls.certresolver=letsencrypt"

  traefik:
    image: traefik:v2.10
    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
    restart: unless-stopped
    networks:
      - pixelfed

networks:
  pixelfed:
    driver: bridge

# ドメイン設定
DOMAIN=your-pixelfed-domain.com
ACME_EMAIL=your-email@example.com

# データベース設定
DB_PASSWORD=secure_password_here
DB_ROOT_PASSWORD=secure_root_password_here

# アプリ設定
APP_KEY=base64:$(openssl rand -base64 32)

# メール設定
MAIL_HOST=smtp.gmail.com
MAIL_PORT=587
MAIL_USERNAME=your-email@gmail.com
MAIL_PASSWORD=your-app-password

# Certbotインストール
sudo apt install certbot python3-certbot-nginx

# SSL証明書取得
sudo certbot --nginx -d your-pixelfed-domain.com

# 自動更新設定
sudo crontab -e
# 以下を追加
0 12 * * * /usr/bin/certbot renew --quiet

# セキュリティヘッダー設定（Nginx）
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'" always;

# レート制限
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
limit_req zone=login burst=3 nodelay;