Add French translation of Tor configuration, typo fix in English source file
This commit is contained in:
Leia
commit
9d15ef9bda
|
|
@ -63,7 +63,110 @@ Now new statuses will be written to the ElasticSearch index. The last step is im
|
|||
|
||||
## Hidden services
|
||||
|
||||
TODO
|
||||
Mastodon can be served through Tor as an onion service. This will give you a *.onion address that can only be used while connected to the Tor network.
|
||||
|
||||
### Installing Tor
|
||||
|
||||
First Tor's Debian archive needs to be added to apt.
|
||||
|
||||
```
|
||||
deb https://deb.torproject.org/torproject.org stretch main
|
||||
deb-src https://deb.torproject.org/torproject.org stretch main
|
||||
```
|
||||
|
||||
Next add the gpg key.
|
||||
|
||||
```bash
|
||||
curl https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --import
|
||||
```
|
||||
|
||||
Finally install the required packages.
|
||||
|
||||
```bash
|
||||
apt install tor deb.torproject.org-keyring
|
||||
```
|
||||
|
||||
### Configure Tor
|
||||
|
||||
Edit the file at `/etc/tor/torrc` and add the following configuration.
|
||||
|
||||
```bash
|
||||
HiddenServiceDir /var/lib/tor/mastodon/
|
||||
HiddenServiceVersion 3
|
||||
HiddenServicePort 80 127.0.0.1:80
|
||||
```
|
||||
|
||||
Restart tor.
|
||||
|
||||
```bash
|
||||
sudo service tor restart
|
||||
```
|
||||
|
||||
Your tor hostname can now be found at `/var/lib/tor/mastodon/hostname`. This will work _if_ you are serving Mastodon over port 80 and _if_ it is the only site you are serving on your web server.
|
||||
|
||||
### Configuring a multi-host server
|
||||
|
||||
If you have multiple domains on your web server you will need to tell your web server how to serve the tor hostname. In the configuration file for your Mastodon web configuration add an additional hostname entry. e.g. for Nginx
|
||||
|
||||
```bash
|
||||
server {
|
||||
…
|
||||
servername mastodon.myhosting.com qKnFwnNH2oH4QhQ7CoRf7HYj8wCwpDwsa8ohJmcPG9JodMZvVA6psKq7qKnFwnNH2oH4QhQ7CoRf7HYj8wCwpDwsa8ohJmcPG9JodMZvVA6psKq7.onion
|
||||
…
|
||||
}
|
||||
```
|
||||
|
||||
### Serve Tor over http
|
||||
|
||||
While it may be tempting to serve your Tor version of Mastodon over https it is not good idea. See [this](https://blog.torproject.org/facebook-hidden-services-and-https-certs) blog post from the Tor Project about why https certificates do not add value. Since you cannot get an SSL cert for an onion domain, you will also be plagued with certificate errors when trying to use your Mastodon instance.
|
||||
|
||||
The solution is to serve your Mastodon instance over http, but only for Tor.
|
||||
|
||||
Consider the following example Nginx configuration.
|
||||
|
||||
```
|
||||
server {
|
||||
listen 80;
|
||||
server_name mastodon.myhosting.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name mastodon.myhomsting.com;
|
||||
…
|
||||
}
|
||||
```
|
||||
|
||||
Add a new server entry that duplicates the ssl entry, but defines it to use port 80 with your onion hostname.
|
||||
|
||||
```
|
||||
server {
|
||||
listen 80;
|
||||
server_name mastodon.myhosting.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name qKnFwnNH2oH4QhQ7CoRf7HYj8wCwpDwsa8ohJmcPG9JodMZvVA6psKq7qKnFwnNH2oH4QhQ7CoRf7HYj8wCwpDwsa8ohJmcPG9JodMZvVA6psKq7.onion;
|
||||
…
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name mastodon.myhosting.com;
|
||||
…
|
||||
}
|
||||
```
|
||||
|
||||
Restart your web server.
|
||||
|
||||
```bash
|
||||
service nginx restart
|
||||
```
|
||||
|
||||
You can also see [this Server Fault](https://serverfault.com/a/373661) answer for a more [DRY](https://en.wikipedia.org/wiki/Don%27t_repeat_yourself) solution.
|
||||
|
||||
## Login via LDAP/PAM/CAS/SAML
|
||||
|
||||
|
|
|
|||
|
|
@ -61,7 +61,110 @@ Désormais, les nouveaux messages seront inscrits dans l'index ElasticSearch. La
|
|||
|
||||
## Services cachés (Tor)
|
||||
|
||||
Bientôt.
|
||||
Mastodon peut être accédé via Tor à l'aide d'un service caché. Cela vous donnera une addresse .onion qui ne peut être utilisée qu'en se connectant au réseau Tor.
|
||||
|
||||
### Installer Tor
|
||||
|
||||
Tout d'abord, le dépôt logiciel de Tor pour Debian doit être ajouté à apt.
|
||||
|
||||
```
|
||||
deb https://deb.torproject.org/torproject.org stretch main
|
||||
deb-src https://deb.torproject.org/torproject.org stretch main
|
||||
```
|
||||
|
||||
Puis, ajoutez la clé GPG.
|
||||
|
||||
```bash
|
||||
curl https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --import
|
||||
```
|
||||
|
||||
Enfin, installez les paquets nécessaires.
|
||||
|
||||
```bash
|
||||
apt install tor deb.torproject.org-keyring
|
||||
```
|
||||
|
||||
### Configurer Tor
|
||||
|
||||
Modifiez le fichier `/etc/tor/torrc` et ajoutez la configuration suivante.
|
||||
|
||||
```bash
|
||||
HiddenServiceDir /var/lib/tor/mastodon/
|
||||
HiddenServiceVersion 3
|
||||
HiddenServicePort 80 127.0.0.1:80
|
||||
```
|
||||
|
||||
Redémarrez tor.
|
||||
|
||||
```bash
|
||||
sudo service tor restart
|
||||
```
|
||||
|
||||
Vous pouvez désormais récupérer votre adresse .onion dans le fichier `/var/lib/tor/mastodon/hostname`. Cela ne fonctionne _que_ si vous servez Mastodon à travers le port 80 et _que_ s'il s'agit du seul site que vous avez sur votre serveur.
|
||||
|
||||
### Configurer un serveur web multi-sites
|
||||
|
||||
Si vous avez plusieurs sites sur votre serveur web, vous devrez indiquer à votre serveur web comment servir l'adresse .onion. Dans le fichier de configuration du serveur web pour Mastodon, ajoutez une entrée additionnelle. Par exemple pour Nginx :
|
||||
|
||||
```bash
|
||||
server {
|
||||
…
|
||||
server_name mastodon.myhosting.com qKnFwnNH2oH4QhQ7CoRf7HYj8wCwpDwsa8ohJmcPG9JodMZvVA6psKq7qKnFwnNH2oH4QhQ7CoRf7HYj8wCwpDwsa8ohJmcPG9JodMZvVA6psKq7.onion
|
||||
…
|
||||
}
|
||||
```
|
||||
|
||||
### Servir le service caché Tor via HTTP
|
||||
|
||||
Même s'il est tentant de servir votre Mastodon "caché" via HTTPS, ce n'est pas une bonne idée. Lisez [cet article de blog](https://blog.torproject.org/facebook-hidden-services-and-https-certs) du Tor Project pour savoir pourquoi les certificats SSL ne changent rien ici. Puisque vous ne pouvez pas obtenir de certificat SSL pour un .onion, vous seriez submergé d'erreurs de certificat quand vous utiliseriez votre instance Mastodon.
|
||||
|
||||
La solution est de servir votre instance Mastodon via HTTP, mais uniquement pour Tor.
|
||||
|
||||
Prenez pour exemple cette configuration Nginx.
|
||||
|
||||
```
|
||||
server {
|
||||
listen 80;
|
||||
server_name mastodon.myhosting.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name mastodon.myhomsting.com;
|
||||
…
|
||||
}
|
||||
```
|
||||
|
||||
Ajoutez une nouvelle entrée `server` qui recopie celle ayant SSL (sans pour autant recopier les lignes concernant SSL), mais qui définit l'utilisation du port 80 avec votre adresse .onion.
|
||||
|
||||
```
|
||||
server {
|
||||
listen 80;
|
||||
server_name mastodon.myhosting.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name qKnFwnNH2oH4QhQ7CoRf7HYj8wCwpDwsa8ohJmcPG9JodMZvVA6psKq7qKnFwnNH2oH4QhQ7CoRf7HYj8wCwpDwsa8ohJmcPG9JodMZvVA6psKq7.onion;
|
||||
…
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name mastodon.myhosting.com;
|
||||
…
|
||||
}
|
||||
```
|
||||
|
||||
Redémarrez le serveur web.
|
||||
|
||||
```bash
|
||||
service nginx restart
|
||||
```
|
||||
|
||||
Vous pouvez également lire cette [réponse sur Server Fault](https://serverfault.com/a/373661) (en anglais) pour une solution plus [DRY](https://fr.wikipedia.org/wiki/Ne_vous_r%C3%A9p%C3%A9tez_pas).
|
||||
|
||||
## Connexion via LDAP/PAM/CAS/SAML
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue