Discourse as a Blog Comment Service on FreeBSD without Docker

1
2
3
4
5

# You may be surprised production is not here, it is sourced from application.rb using a monkey patch
# This is done for 2 reasons
#
# 1. we need to support blank settings correctly and rendering nothing in yaml/erb is a PITA
# 2. why go from object -> yaml -> object, pointless

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149

#
# DO NOT EDIT THIS FILE
# If you need to make changes create a file called discourse.conf in this directory with your changes
# On import this file will be imported using ERB
#

# Discourse supports multiple mechanisms for production config.
#
# 1. You can do nothing and get these defaults (not recommended, you should at least set hostname)
# 2. You can copy this file to config/discourse.conf and amend with your settings
# 3. You can pass in config from your environment, all the settings below are available.
#    Append DISCOURSE_ and upper case the setting in ENV. For example:
#    to pass in db_timeout of 200 you would use DISCOURSE_DB_TIMEOUT=200

# All settings apply to production only

# connection pool size, sidekiq is set to 5, allowing an extra 3 for bg threads
db_pool = 8

# database timeout in milliseconds
db_timeout = 5000

# socket file used to access db
db_socket =

# host address for db server
# This is set to blank so it tries to use sockets first
db_host =

# port running db server, no need to set it
db_port =

# database name running discourse
db_name = discourse

# username accessing database
db_username = discourse

# password used to access the db
db_password =

# Disallow prepared statements
# see: https://github.com/rails/rails/issues/21992
db_prepared_statements = false

# host address for db replica server
db_replica_host =

# port running replica db server, defaults to 5432 if not set
db_replica_port =

# hostname running the forum
hostname = "www.example.com"

# backup hostname mainly for cdn use
backup_hostname =

# address of smtp server used to send emails
smtp_address =

# port of smtp server used to send emails
smtp_port = 25

# domain passed to smtp server
smtp_domain =

# username for smtp server
smtp_user_name =

# password for smtp server
smtp_password =

# smtp authentication mechanism
smtp_authentication = plain

# enable TLS encryption for smtp connections
smtp_enable_start_tls = true

# mode for verifying smtp server certificates
# to disable, set to 'none'
smtp_openssl_verify_mode =

# load MiniProfiler in production, to be used by developers
load_mini_profiler = true

# recommended, cdn used to access assets
cdn_url =

# comma delimited list of emails that have developer level access
developer_emails =

# redis server address
redis_host = localhost

# redis server port
redis_port = 6379

# redis slave server address
redis_slave_host =

# redis slave server port
redis_slave_port = 6379

# redis database
redis_db = 0

# redis password
redis_password =

# redis sentinels eg
# redis_sentinels = 10.0.0.1:26381,10.0.0.2:26381
redis_sentinels =

# enable Cross-origin Resource Sharing (CORS) directly at the application level
enable_cors = false
cors_origin = ''

# enable if you really need to serve assets in prd
serve_static_assets = false

# number of sidekiq workers (launched via unicorn master)
sidekiq_workers = 5

# adjust stylesheets to rtl (requires "rtlit" gem)
rtl_css = false

# notify admin when a new version of discourse is released
# this is global so it is easier to set in multisites
# TODO allow for global overrides
new_version_emails = true

# connection reaping helps keep connection counts down, postgres
# will not work properly with huge numbers of open connections
# reap connections from pool that are older than 30 seconds
connection_reaper_age = 30
# run reap check every 30 seconds
connection_reaper_interval = 30
# also reap any connections older than this
connection_reaper_max_age = 600

# set to relative URL (for subdirectory hosting)
# IMPORTANT: path must not include a trailing /
# EG: /forum
relative_url_root =

# increasing this number will increase redis memory use
# this ensures backlog (ability of channels to catch up are capped)
# message bus default cap is 1000, we are winding it down to 100
message_bus_max_backlog_size = 100

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# Database
db_pool = 12
db_name = discourse_production
db_username = discourse
#db_password =   # Only if the PostgreSQL user 'discourse' is password-protected

# Hostname
hostname = "babaei.net"

# SMTP
smtp_address = "127.0.0.1"
smtp_port = 587
smtp_user_name = "mailer@babaei.net"
smtp_password = "${MAILER_SECRET_PASSWORD}"
smtp_authentication = plain
smtp_enable_start_tls = true

# Admin Email
developer_emails = admin@babaei.net

# Sidekiq
sidekiq_workers = 8

# Update Notification
new_version_emails = true

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

mlp:
  adapter: postgresql
  database: discourse_mlp
  username: discourse_mlp
  password: applejack
  host: dbhost
  pool: 5
  timeout: 5000
  db_id: 1      # ensure db_id is unique for each site
  ### If you change this setting you will need to
  ###   - restart sidekiq if you change this setting
  ###   - rebake all to posts using: `RAILS_ENV=production bundle exec rake posts:rebake`
  host_names:
    - discourse.equestria.com
    - discourse.equestria.internal

drwho:
  adapter: postgresql
  database: discourse_who
  username: discourse_who
  password: "Up the time stream without a TARDIS"
  host: dbhost
  pool: 5
  timeout: 5000
  db_id:        # ensure db_id is unique for each site
  ### If you change this setting you will need to
  ###   - restart sidekiq if you change this setting
  ###   - rebake all to posts using: `RAILS_ENV=production bundle exec rake posts:rebake`
  host_names:
    - discuss.tardis.gallifrey

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

babaei_net_production:
  adapter: postgresql
  database: discourse_babaei_net_production
  username: discourse               # if using username/password auth
  # password: ${SECRET_PASSWORD}    # if using username/password auth
  # host: dbhost                    # if not localhost
  pool: 12
  timeout: 5000
  db_id: 1	# ensure db_id is unique for each site
  ### If you change this setting you will need to
  ###   - restart sidekiq if you change this setting
  ###   - rebake all to posts using: `sudo -u discourse -H RAILS_ENV=production bundle exec rake posts:rebake`
  host_names:
    - discuss.babaei.net

fa_babaei_net_production:
  adapter: postgresql
  database: discourse_fa_babaei_net_production
  username: discourse               # if using username/password auth
  # password: ${SECRET_PASSWORD}    # if using username/password auth
  # host: dbhost                    # if not localhost
  pool: 12
  timeout: 5000
  db_id: 2	# ensure db_id is unique for each site
  ### If you change this setting you will need to
  ###   - restart sidekiq if you change this setting
  ###   - rebake all to posts using: `sudo -u discourse -H RAILS_ENV=production bundle exec rake posts:rebake`
  host_names:
    - discuss.fa.babaei.net

1
2
3
4
5

#!/bin/sh

cd /home/discourse/discourse/
sudo -u discourse -H nohup bundle exec sidekiq -e production > /home/discourse/discourse/log/sidekiq.log 2>&1&
sudo -u discourse -H RAILS_ENV=production RUBY_GC_MALLOC_LIMIT=90000000 nohup bundle exec thin start -s8 --socket /home/discourse/discourse/tmp/sockets/thin.sock > /home/discourse/discourse/log/thin.log 2>&1&

1
2
3

# Discourse
# At Boot
@reboot     /home/discourse/cron/server.sh

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269

# Discourse
proxy_cache_path /usr/local/www/nginx/cache keys_zone=one:10m max_size=200m;

# Discourse
# Additional MIME types that you'd like nginx to handle go in here
types {
    text/csv csv;
}

# Discourse
log_format log_discourse '[$time_local] $remote_addr "$request" "$http_user_agent" "$sent_http_x_discourse_route" $status $bytes_sent "$http_referer" $upstream_response_time $request_time "$sent_http_x_discourse_username"';

upstream discourse {
    server unix:/home/discourse/discourse/tmp/sockets/thin.0.sock;
    server unix:/home/discourse/discourse/tmp/sockets/thin.1.sock;
    server unix:/home/discourse/discourse/tmp/sockets/thin.2.sock;
    server unix:/home/discourse/discourse/tmp/sockets/thin.3.sock;
    server unix:/home/discourse/discourse/tmp/sockets/thin.4.sock;
    server unix:/home/discourse/discourse/tmp/sockets/thin.5.sock;
    server unix:/home/discourse/discourse/tmp/sockets/thin.6.sock;
    server unix:/home/discourse/discourse/tmp/sockets/thin.7.sock;
    #server 11011   # TCP/IP instead of Unix domain socket
}

server {
    error_log       /home/discourse/log/error.log;
    access_log      /home/discourse/log/access.log log_discourse;

    listen 80;
    gzip on;
    gzip_vary on;
    gzip_min_length 1000;
    gzip_comp_level 5;
    gzip_types application/json text/css application/x-javascript application/javascript;

    # Uncomment and configure this section for HTTPS support
    # NOTE: Put your ssl cert in your main nginx config directory (/etc/nginx)
    #
    # rewrite ^/(.*) https://enter.your.web.hostname.here/$1 permanent;
    #
    # listen 443 ssl;
    # ssl_certificate your-hostname-cert.pem;
    # ssl_certificate_key your-hostname-cert.key;
    # ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    # ssl_ciphers HIGH:!aNULL:!MD5;
    #

    server_name discuss.babaei.net discuss.fa.babaei.net;
    server_tokens off;

    sendfile on;

    keepalive_timeout 65;

    # maximum file upload size (keep up to date when changing the corresponding site setting)
    client_max_body_size 1m;

    # path to discourse's public directory
    set $public /home/discourse/discourse/public;

    # Prevent Internet Explorer 10 "compatibility mode", which breaks Discourse.
    # If other subdomains under your domain are supposed to use Internet Explorer Compatibility mode,
    # it may be used for this one too, unless you explicitly tell IE not to use it.  Alternatively,
    # some people have reported having compatibility mode "stuck" on for some reason.
    # (This will also prevent compatibility mode in IE 8 and 9, but those browsers aren't supported anyway.
    add_header X-UA-Compatible "IE=edge";

    # without weak etags we get zero benefit from etags on dynamically compressed content
    # further more etags are based on the file in nginx not sha of data
    # use dates, it solves the problem fine even cross server
    etag off;

    # prevent direct download of backups
    location ^~ /backups/ {
        internal;
    }

    # bypass rails stack with a cheap 204 for favicon.ico requests
    location /favicon.ico {
        return 204;
        access_log off;
        log_not_found off;
    }

    location / {
        root $public;
        add_header ETag "";

        # auth_basic on;
        # auth_basic_user_file /etc/nginx/htpasswd;

        location ~* assets/.*\.(eot|ttf|woff|woff2|ico)$ {
            expires 1y;
            add_header Cache-Control public;
            add_header Access-Control-Allow-Origin *;
        }

        location = /srv/status {
            access_log off;
            log_not_found off;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $thescheme;
            proxy_pass http://discourse;
            break;
        }

        location ~ ^/assets/ {
            expires 1y;
            # asset pipeline enables this
            gzip_static on;
            add_header Cache-Control public;
            # TODO I don't think this break is needed, it just breaks out of rewrite
            break;
        }

        location ~ ^/plugins/ {
            expires 1y;
            add_header Cache-Control public;
        }

        # cache emojis
        location ~ /_?emoji.*\.(png|gif|jpg|jpeg)$/ {
            expires 1y;
            add_header Cache-Control public;
        }

        location ~ ^/uploads/ {
            # NOTE: it is really annoying that we can't just define headers
            # at the top level and inherit.
            #
            # proxy_set_header DOES NOT inherit, by design, we must repeat it,
            # otherwise headers are not set correctly
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $thescheme;
            proxy_set_header X-Sendfile-Type X-Accel-Redirect;
            proxy_set_header X-Accel-Mapping $public/=/downloads/;
            expires 1y;
            add_header Cache-Control public;

            ## optional upload anti-hotlinking rules
            #valid_referers none blocked mysite.com *.mysite.com;
            #if ($invalid_referer) { return 403; }

            # custom CSS
            location ~ /stylesheet-cache/ {
                try_files $uri =404;
            }
            # this allows us to bypass rails
            location ~* \.(gif|png|jpg|jpeg|bmp|tif|tiff)$ {
                try_files $uri =404;
            }
            # thumbnails & optimized images
            location ~ /_?optimized/ {
                try_files $uri =404;
            }

            proxy_pass http://discourse;
                break;
            }

            location ~ ^/admin/backups/ {
                proxy_set_header Host $http_host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $thescheme;
                proxy_set_header X-Sendfile-Type X-Accel-Redirect;
                proxy_set_header X-Accel-Mapping $public/=/downloads/;
                proxy_pass http://discourse;
                break;
            }

            # This big block is needed so we can selectively enable
            # acceleration for backups and avatars
            # see note about repetition above
            location ~ ^/(letter_avatar/|user_avatar|highlight-js|stylesheets|favicon/proxied) {
                proxy_set_header Host $http_host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $thescheme;

                # if Set-Cookie is in the response nothing gets cached
                # this is double bad cause we are not passing last modified in
                proxy_ignore_headers "Set-Cookie";
                proxy_hide_header "Set-Cookie";

                # note x-accel-redirect can not be used with proxy_cache
                proxy_cache one;
                proxy_cache_valid 200 301 302 7d;
                proxy_cache_valid any 1m;
                proxy_pass http://discourse;
                break;
            }

        location /letter_avatar_proxy/ {
            # Don't send any client headers to the avatars service
            proxy_method GET;
            proxy_pass_request_headers off;
            proxy_pass_request_body off;

            # Don't let cookies interrupt caching, and don't pass them to the
            # client
            proxy_ignore_headers "Set-Cookie";
            proxy_hide_header "Set-Cookie";

            proxy_cache one;
            proxy_cache_key $uri;
            proxy_cache_valid 200 7d;
            proxy_cache_valid 404 1m;
            proxy_set_header Connection "";

            proxy_pass http://discourse;
            break;
        }

        # we need buffering off for message bus
        location /message-bus/ {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $thescheme;
            proxy_http_version 1.1;
            proxy_buffering off;
            proxy_pass http://discourse;
            break;
        }

        # this means every file in public is tried first
        try_files $uri @discourse;
    }

    location /downloads/ {
        internal;
        alias $public/;
    }

    location @discourse {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $thescheme;
        proxy_pass http://discourse;
    }

    # Error Pages
    error_page  400              /400.html;
    location = /400.html {
        root   /usr/local/www/nginx/error;
    }
    error_page  401              /401.html;
    location = /401.html {
        root   /usr/local/www/nginx/error;
    }
    error_page  403              /403.html;
    location = /403.html {
        root   /usr/local/www/nginx/error;
    }
    error_page  404              /404.html;
    location = /404.html {
        root   /usr/local/www/nginx/error;
    }
    error_page  500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/local/www/nginx/error;
    }
}

1
2
3
4
5

# chruby
source /usr/local/share/chruby/chruby.sh

# Default Ruby Version
chruby ruby-2.3.1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

#!/usr/bin/env bash

source /usr/local/share/chruby/chruby.sh
chruby ruby-2.3.1

cd ~/discourse/
nohup bundle exec sidekiq -e production > ~/sidekiq.log 2>&1&
RAILS_ENV=production RUBY_GC_MALLOC_LIMIT=90000000 nohup \
    bundle exec thin start -s8 --socket \
    ~/discourse/tmp/sockets/thin.sock > ~/discourse/log/thin.log 2>&1&

1
2
3
4
5
6
7

SHELL=/bin/sh
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
MAILTO=""

# Discourse
# At Boot
@reboot     /home/discourse/cron/server.sh