Raspberry Pi 3 Model B+を使ってmisskeyサーバー構築

adduser --gecos "" [ユーザー名]
adduser [ユーザー名] sudo

echo "0 * * * * curl http://[mydnsのユーザー名]:[mydnsのパスワード]@ipv4.mydns.jp/login.html"|sudo tee /etc/cron.hourly/mydns

curl -fsSL https://deb.nodesource.com/setup_current.x|sudo bash -
curl -fsSL https://packages.redis.io/gpg|sudo gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb $(lsb_release -cs) main"|sudo tee /etc/apt/sources.list.d/redis.list
sudo apt update
sudo apt install nodejs postgresql redis nginx git build-essential cmake
sudo corepack enable
sudo -u postgres psql <<EOF
CREATE ROLE misskey LOGIN CREATEDB PASSWORD 'misskey';
CREATE DATABASE misskey OWNER misskey;
EOF

sudo systemctl stop nginx
sudo certbot certonly --standalone --email [管理者のメールアドレス] -d [取得したドメイン(サブドメインでも可)]
sudo systemctl start nginx

cat <<EOF|sudo tee /etc/cron.d/certbot
# /etc/cron.d/certbot: crontab entries for the certbot package
#
# Upstream recommends attempting renewal twice a day
#
# Eventually, this will be an opportunity to validate certificates
# haven't been revoked, etc.  Renewal will only occur if expiration
# is within 30 days.
#
# Important Note!  This cronjob will NOT be executed if you are
# running systemd as your init system.  If you are running systemd,
# the cronjob.timer function takes precedence over this cronjob.  For
# more details, see the systemd.timer manpage, or use systemctl show
# certbot.timer.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

0 */12 * * * root systemctl stop nginx && test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew && systemctl start nginx
EOF

sudo adduser --gecos "" --disabled-password --disabled-login misskey

sudo su misskey
cd

git clone https://github.com/misskey-dev/misskey --recursive --depth 1 -b master

sudo systemctl poweroff

sudo mkdir /mnt/rpi
sudo umount [SDカードのデバイスファイル]2 >/dev/null 2>&1 || true
sudo mount [SDカードのデバイスファイル]2 /mnt/rpi -o exec,suid,dev,rw

sudo chroot /mnt/rpi

su misskey

cd misskey
NODE_ENV=production pnpm install --frozen-lockfile

NODE_ENV=production pnpm run build

exit # 1回目: misskeyユーザーからログアウト
exit # 2回目: chrootから抜ける
sudo rmdir /mnt/rpi

sudo su misskey

cd misskey
nano .config/default.yml

url: https://[取得したドメイン]/
port: 3000
db:
  host: localhost
  port: 5432
  db  : misskey
  user: misskey
  pass: misskey
redis:
  host: localhost
  port: 6379
id: 'aid'
syslog:
  host: localhost
  port: 514

pnpm run init

exit # misskeyユーザーから抜ける
sudo rm /etc/nginx/sites-enabled/default
sudo nano /etc/nginx/conf.d/misskey.conf

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache1:16m max_size=1g inactive=720m use_temp_path=off;

server {
    listen 80;
    listen [::]:80;
    server_name [取得したドメイン名];
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name [取得したドメイン名];

    ssl_session_timeout 1d;
    ssl_session_cache shared:ssl_session_cache:10m;
    ssl_session_tickets off;

    ssl_certificate     /etc/letsencrypt/live/[取得したドメイン名]/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/[取得したドメイン名]/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_stapling on;
    ssl_stapling_verify on;
    client_max_body_size 80m;
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_http_version 1.1;
        proxy_redirect off;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_cache cache1;
        proxy_cache_lock on;
        proxy_cache_use_stale updating;
        proxy_force_ranges on;
        add_header X-Cache $upstream_cache_status;
    }
}

sudo systemctl restart nginx

sudo systemctl enable nginx
sudo systemctl enable postgresql
sudo systemctl enable redis-server
cat <<EOF |sudo -u misskey tee /home/misskey/misskey/start.sh
#!/bin/bash
cd /home/misskey/misskey
NODE_ENV=production pnpm run start
EOF
sudo -u misskey chmod +x /home/misskey/misskey/start.sh
cat <<EOF >/tmp/cronfile
@reboot /home/misskey/misskey/start.sh
EOF
sudo crontab -u misskey /tmp/cronfile