Setting up a personal Mastodon instance

Prerequisites

Domain name

Object storage

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::files.botta.social/*"
    }
  ]
}

SMTP relay

Creating the server

For your instance you can use any kind of server from any provider, really, provided that it has enough resources. In my case I use a cloud server from Hetzner with 2 cores and 8GB of RAM, which costs me around 12 euros per month. I recommend more than 4GB of RAM, since I tried with that amount and it was not enough for me. I recommend Hetzner if you don't already have a provider of choice since it offers reliable and performant servers for a fraction of the price of other providers. Hetzner has locations in the US, Germany and Finland at the moment.

If you go with Hetzner, you can follow the instructions below, otherwise it depends on the provider you use. One advantage of using Hetzner Cloud over other providers is that it offers a firewall feature in front of your server, and that's recommended vs configuring a software firewall inside the server because that way malicious traffic is blocked before even reaching your server at all.

First things first, create an account with Hetzner Cloud if you don't have one already. Then create a project from the console with a name like "Mastodon" or whatever you like, and add your public SSH key under Security -> SSH Keys from the sidebar. You will then be able to configure your server so that it already has this key, letting you SSH into the server easily.

Next, head to Firewalls, and create a new firewall like in the picture:

So you basically want outbound rules that allow traffic from any IP address to ports 1908, 80, 443, 81 and ICMP pings. Ports 80 and 443 are for regular traffic, 81 is for the Nginx Proxy Manager admin panel which we'll set up later, and 1908 is the port I use for SSH. This is one port that you can change with whatever you like, as long as it's different from the default port 22 to block most scripted attacks against SSH.

Now go to Servers, and click on Add Server. Here you can choose the location that you prefer (my instance is in Nuremberg since I am based in Finland, Europe, and Nuremberg has good latency also for US users). For the image I recommend Ubuntu 22.04 if you want to follow my instructions to the letter. For the instance type I recommend an instance with more than 4GB of RAM; I chose the CX31 with 2 cores and 8GB of RAM; instances with shared cores are good enough. The ones with dedicated cores may offer improved performance but they are quite a bit more expensive.

Under Networking you can leave the default settings. Under SSH Keys select the key you added earlier, and under Firewalls selected the firewall you also created earlier. Also I recommend you enable backups. Give a name to the server and click on Create and buy now.

Hetzner is pretty quick at provisioning cloud servers, they are typically ready in 10-20 seconds. Once the server is ready, take note of its public ipv4 address, then go to Cloudflare's DNS settings for your domain, and configure an A record pointing to that IP. Make sure you configure the domain or subdomain you want to use for your Mastodon web app, like botta.social in my case. 

Preparing the server

adduser vito
usermod -aG sudo vito

vito ALL=(ALL) NOPASSWD:ALL

ssh-copy-id -i ~/.ssh/<private key> vito@<server IP>

ClientAliveInterval 300
ClientAliveCountMax 1
PermitRootLogin no
PasswordAuthentication no
Port 1908
MaxAuthTries 2
AllowTcpForwarding no                  
X11Forwarding no                       
AllowAgentForwarding no  
AllowUsers vito              

sudo sshd -t

sudo systemctl restart sshd

sudo apt install fail2ban 

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

sudo systemctl restart fail2ban

sudo fail2ban-client status sshd

curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
sudo usermod -aG docker $USER

docker ps

docker network create apps

Setting up Mastodon

|- mariadb
|    |- .env
|    |- docker-compose.yml
|- mastodon
|    |- .env
|    |- docker-compose.yml
|- nginx-proxy-manager
|    |- .env
|    |- docker-compose.yml
|- start.sh

MARIADB_ROOT_PASSWORD=...

version: "3.3"

networks:
  default:
    name: apps

services:
  mariadb:
    image: mariadb:10.5
    container_name: mariadb
    restart: unless-stopped
    ports:
      - "127.0.0.1:3306:3306"
    env_file:
      - /home/vito/compose/mariadb/.env
    volumes:
      - /home/vito/apps/mariadb:/var/lib/mysql   

version: "3.7"

networks:
  default:
    name: apps

services:
  db:
    container_name: mastodon-postgres
    restart: always
    image: postgres:14-alpine
    user: root
    shm_size: 256mb
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "postgres"]
    volumes:
      - /home/vito/apps/mastodon/postgres:/var/lib/postgresql/data
    ports:
      - 127.0.0.1:5432:5432
    environment:
      POSTGRES_HOST_AUTH_METHOD: trust

  redis:
    container_name: mastodon-redis
    restart: always
    image: redis:7-alpine
    user: root
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
    volumes:
      - /home/vito/apps/mastodon/redis:/data

  es:
    container_name: mastodon-elasticsearch
    restart: always
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.2
    user: root
    environment:
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - "cluster.name=es-mastodon"
      - "discovery.type=single-node"
      - "bootstrap.memory_lock=true"
    healthcheck:
      test: ["CMD-SHELL", "curl --silent --fail localhost:9200/_cluster/health || exit 1"]
    volumes:
      - /home/vito/apps/mastodon/elasticsearch:/usr/share/elasticsearch/data
    ulimits:
      memlock:
        soft: -1
        hard: -1

  web:
    container_name: mastodon-web
    image: tootsuite/mastodon:v3.5.3
    user: root
    restart: always
    command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider --proxy=off localhost:3000/health || exit 1"]
    ports:
      - "127.0.0.1:3000:3000"
    depends_on:
      - db
      - redis
      - es
    volumes:
      - /home/vito/apps/mastodon/public/system:/mastodon/public/system
    env_file:
      - /home/vito/compose/mastodon/.env

  streaming:
    container_name: mastodon-streaming
    image: tootsuite/mastodon:v3.5.3
    user: root
    restart: always
    command: node ./streaming
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider --proxy=off localhost:4000/api/v1/streaming/health || exit 1"]
    ports:
      - "127.0.0.1:4000:4000"
    depends_on:
      - db
      - redis
    environment:
      VIRTUAL_HOST: botta.social
      VIRTUAL_PATH: "/api/v1/streaming"
      VIRTUAL_PORT: 4000
    env_file:
      - /home/vito/compose/mastodon/.env

  sidekiq:
    container_name: mastodon-sidekiq
    image: tootsuite/mastodon:v3.5.3
    user: root
    restart: always
    command: bundle exec sidekiq
    depends_on:
      - db
      - redis
    volumes:
      - /home/vito/apps/mastodon/public/system:/mastodon/public/system
    env_file:
      - /home/vito/compose/mastodon/.env

DB_MYSQL_HOST="mariadb"
DB_MYSQL_PORT=3306
DB_MYSQL_USER="root"
DB_MYSQL_PASSWORD="...."
DB_MYSQL_NAME="nginx"

version: "3.3"

networks:
  default:
    name: apps

services:
  nginx:
    image: 'jc21/nginx-proxy-manager:latest'
    container_name: nginx
    restart: unless-stopped
    ports:
      - '80:80' # Public HTTP Port
      - '443:443' # Public HTTPS Port
      - '81:81' # Admin Web Port
    depends_on:
      - mariadb
    env_file:
      - /home/vito/compose/nginx-proxy-manager/.env
    volumes:
      - /home/vito/apps/nginx/data:/data
      - /home/vito/apps/nginx/letsencrypt:/etc/letsencrypt

#!/bin/bash


docker compose \
-f /home/vito/compose/mariadb/docker-compose.yml \
-f /home/vito/compose/nginx-proxy-manager/docker-compose.yml \
-f /home/vito/compose/mastodon/docker-compose.yml \
up -d --remove-orphans

Initial setup

compose/start.sh

sudo sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
sudo apt -y update
sudo apt -y install postgresql-14
sudo systemctl stop postgresql
sudo systemctl disable postgresql

psql -h 127.0.0.1 -P 5432 -U postgres

CREATE DATABASE mastodon;

docker compose -f compose/mastodon/docker-compose.yml \
run --rm -v /home/vito/compose/mastodon/.env:/opt/mastodon/.env.production \
-e RUBYOPT=-W0 web bundle exec rake mastodon:setup

ES_ENABLED=true
ES_HOST=mastodon-elasticsearch
ES_PORT=9200

docker compose \
-f /home/vito/compose/mariadb/docker-compose.yml \
-f /home/vito/compose/nginx-proxy-manager/docker-compose.yml \
-f /home/vito/compose/mastodon/docker-compose.yml \
restart

docker ps

docker logs -f mastodon-web # or name of other container

docker exec -it mastodon-web bash

RAILS_ENV=production bin/tootctl search deploy

Setting up Nginx

sudo apt install mariadb-client

mysql -uroot -p<your mariadb password> -h 127.0.0.1

CREATE DATABASE nginx;

docker restart nginx

Check the logs and once it's started, open the URL http://<server IP>:81. This will show you the Nginx Proxy Manager admin panel. Log in with username: [email protected] and password: changeme, then be sure to change username and password right away.

Now go to Proxy Hosts, and add a new host:

Of course, use your own domain instead of botta.social. Before you save, go to Custom locations and add the location for the streaming as in the picture:

Under SSL, configure as in the picture:

Specify your email address for Let's Encrypt notifications (Nginx Proxy Manager uses Let's Encrypt to provision free SSL certificates), then go to Advanced and enter the following in the textarea:

proxy_set_header X-Forwarded-forward_scheme $scheme;
proxy_set_header X-Forwarded-Proto  $forward_scheme;
real_ip_header CF-Connecting-IP;

Backups

curl -s https://kopia.io/signing-key | sudo gpg --dearmor -o /usr/share/keyrings/kopia-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/kopia-keyring.gpg] http://packages.kopia.io/apt/ stable main" | sudo tee /etc/apt/sources.list.d/kopia.list
sudo apt update
sudo apt install kopia

export KOPIA_BACKUP_PROVIDER=wasabi
export KOPIA_CONFIG_FILE=/home/vito/.config/kopia/repository-$KOPIA_BACKUP_PROVIDER.config

sudo -E kopia repository create s3 \
--bucket=... \
--access-key=... \
--secret-access-key=... \
--region=eu-central-2 \
--endpoint=s3.eu-central-2.wasabisys.com

/snap
/apps/nginx/data/logs
/.cache
/.docker
/apps/mastodon/postgres

sudo -E kopia repository connect s3 \
--bucket=... \
--access-key=... \
--secret-access-key=.... \
--region=eu-central-2 \
--endpoint=s3.eu-central-2.wasabisys.com \
--config-file=$KOPIA_CONFIG_FILE \
--password=...

sudo -E kopia snapshot create --config-file $KOPIA_CONFIG_FILE /home/vito

#!/bin/bash

set -e

BACKUP_DATE=`date +%Y/%m/%d`
BACKUP_TIME=`date +%H-%M-%S`
NUMBER_OF_DAYS=7

BACKUP_DIR="/home/vito/backups/mariadb"
BY_DATE_DIR="$BACKUP_DIR/by-date/"
LATEST_DIR="$BACKUP_DIR/latest/"
DUMP_DIR="$BY_DATE_DIR$BACKUP_DATE"

DATABASES=(nginx)

mkdir -p $LATEST_DIR
mkdir -p $DUMP_DIR

for DATABASE in ${DATABASES[@]}; do
  SQL="$DATABASE-$BACKUP_TIME.sql"
  DUMP_PATH="$DUMP_DIR/$SQL"

  echo Dumping $DATABASE to $DUMP_PATH...

  mysqldump -uroot -p<mariadb password> -h 127.0.0.1 --opt $DATABASE > $DUMP_PATH

  gzip $DUMP_PATH

  ln -fs $DUMP_PATH.gz $LATEST_DIR$DATABASE.sql.gz
done

find $BY_DATE_DIR/*/*/* -type d -mtime +7 -exec rm -rf {} \;
find $LATEST_DIR/ -type f -mtime +7 -exec rm -f {} \;

chmod +x scripts/backup-mariadb

#!/bin/bash

set -e

BACKUP_DATE=`date +%Y/%m/%d`
BACKUP_TIME=`date +%H-%M-%S`
NUMBER_OF_DAYS=7

BACKUP_DIR="/home/vito/backups/postgres"
BY_DATE_DIR="$BACKUP_DIR/by-date/"
LATEST_DIR="$BACKUP_DIR/latest/"
DUMP_DIR="$BY_DATE_DIR$BACKUP_DATE"

DATABASES=(mastodon)

mkdir -p $LATEST_DIR
mkdir -p $DUMP_DIR

for DATABASE in ${DATABASES[@]}; do
  SQL="$DATABASE-$BACKUP_TIME.sql"
  DUMP_PATH="$DUMP_DIR/$SQL"

  echo Dumping $DATABASE to $DUMP_PATH...

  pg_dump --clean -h 127.0.0.1 -p 5432 -U postgres $DATABASE > $DUMP_PATH

  gzip $DUMP_PATH

  ln -fs $DUMP_PATH.gz $LATEST_DIR$DATABASE.sql.gz
done

find $BY_DATE_DIR/*/*/* -type d -mtime +7 -exec rm -rf {} \;
find $LATEST_DIR/ -type f -mtime +7 -exec rm -f {} \;

chmod +x scripts/backup-postgres

#!/bin/bash

[ "${FLOCKER}" != "$0" ] && exec env FLOCKER="$0" flock -en "$0" "$0" "$@" || :

set -e

export KOPIA_CHECK_FOR_UPDATES=false

sudo -E kopia repository connect s3 \
--bucket=<wasabi bucket for backups> \
--access-key=... \
--secret-access-key=.... \
--region=<wasabi backup bucket region> \
--endpoint=<wasabi backup bucket endpoint> \
--config-file=/home/vito/.config/kopia/repository-wasabi.config \
--password=<backup password>

sudo -E kopia snapshot create --config-file /home/vito/.config/kopia/repository-wasabi.config /home/vito

sudo -E kopia repository disconnect --config-file /home/vito/.config/kopia/repository-wasabi.config

chmod +x scripts/backup-wasabi

#!/bin/bash

[ "${FLOCKER}" != "$0" ] && exec env FLOCKER="$0" flock -en "$0" "$0" "$@" || :

date

set -e

echo "Backing up mariadb databases..."
/home/vito/scripts/backup-mariadb
echo
echo

echo "Backing up postgres databases..."
/home/vito/scripts/backup-postgres
echo
echo

echo "Backing up apps to Wasabi..."
/home/vito/scripts/backup-wasabi
echo
echo

echo "...Backup complete."

chmod +x scripts/backup

scripts/backup

0 * * * * /home/vito/scripts/backup

Wrapping up