Hi everyone, I'm setting up a funkwhale instance on AWS EC plus storage of music data in an S3 bucket. I've been able to set it up with version 1.1.4 followign the mono container installation guide https://docs.funkwhale.audio/installation/docker.html. I'm running it with the NESTED_PROXY=1 option enabled. I've loaded an mp3 album and I can play it nicely from Firefox on my laptop. However on my phone with iOS, trying with Safari, it logins and shows tracks but then it fails to play any track. Same behavior with substreamer app.
In matrix chat was pointed out that FLAC files aren't supported by iOS which is interesting, but this shouldn't be the case.
Pasting here my nginx funkwhale.conf for reference:
upstream fw {
# depending on your setup, you may want to update this
server 127.0.0.1:5000;
}
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80;
listen [::]:80;
server_name <domain>;
location / { return 301 https://$host$request_uri; }
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name <domain>;
# TLS
ssl_protocols TLSv1.2;
ssl_ciphers HIGH:!MEDIUM:!LOW:!aNULL:!NULL:!SHA;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_certificate /etc/letsencrypt/live/<domain>/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/<domain>/privkey.pem;
# HSTS
add_header Strict-Transport-Security "max-age=31536000";
# Security related headers
#more_clear_headers Content-Security-Policy;
# If you are using S3 to host your files, remember to add your S3 URL to the
# media-src and img-src headers (e.g. img-src 'self' https://<your-S3-URL> data:)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' https://<s3-bucket-name>.s3.amazonaws.com/* data:; font-src 'self' data:; object-src 'none'; media-src 'self' https://<s3-bucket-name>.s3.amazonaws.com/* data:" always;
# compression settings
gzip on;
gzip_comp_level 5;
gzip_min_length 256;
gzip_proxied any;
gzip_vary on;
gzip_types
application/javascript
application/vnd.geo+json
application/vnd.ms-fontobject
application/x-font-ttf
application/x-web-app-manifest+json
font/opentype
image/bmp
image/svg+xml
image/x-icon
text/cache-manifest
text/css
text/plain
text/vcard
text/vnd.rim.location.xloc
text/vtt
text/x-component
text/x-cross-domain-policy;
location ~ /_protected/media/(.+) {
internal;
# Needed to ensure DSub auth isn't forwarded to S3/Minio, see #932
proxy_set_header Authorization "";
proxy_pass $1;
}
location / {
include /etc/nginx/funkwhale_proxy.conf;
client_max_body_size 500M;
proxy_pass http://fw/;
}
}
I needed to modify the funkwhale_proxy.conf adding this line:
proxy_hide_header Content-Security-Policy;
otherwise a second Content-Security-Policy header was added before the s3 enabling one and it didn't work from a laptop browser either.
On EC2 configuration I've opened ports 443 and 80 for TCP traffic.
