Merge remote-tracking branch 'origin/develop' into shigusegubu

* origin/develop: (194 commits)
  Mix.Tasks.Pleroma.Instance: Generate signing_salt
  Send delete event over Mastodon streaming api
  Add a test to ensure #39 is fixed.
  update frontend
  Set custom similarity limit.
  Make use of the indices.
  test: add regression test for to/cc clobbering
  [#477] User trigram index adjustment.
  [#477] User: FTS and trigram search results mixing (to handle misspelled requests).
  [#491] Made full nicknames be preserved in user links text only in Bio.
  activitypub: add a match clause for objects, not just activities
  activitypub: transmogrifier: do not clobber the addressing on relayed announcements
  activitypub: allow is_public?() to work on any type of map representing an AS2 object
  activitypub: relay: chase selective public announce changes
  activitypub: announce: add new public parameter
  Add comments and change default path of the Mix binary.
  Fix bad link in likes collection
  [#502] Fixed `user_count` in `/api/v1/instance` to include only active local users.
  formatting
  Default to disabled in the code in case the setting is absent from config.exs
  ...

installation/pleroma.service

@@ -3,16 +3,24 @@ Description=Pleroma social network
 After=network.target postgresql.service
 
 [Service]
-User=pleroma
-WorkingDirectory=/home/pleroma/pleroma
-Environment="HOME=/home/pleroma"
-Environment="MIX_ENV=prod"
-ExecStart=/usr/local/bin/mix phx.server
 ExecReload=/bin/kill $MAINPID
 KillMode=process
 Restart=on-failure
 StandardOutput=journal
 
+; Name of the user that runs the Pleroma service.
+User=pleroma
+; Declares that Pleroma runs in production mode.
+Environment="MIX_ENV=prod"
+
+; Make sure that all paths fit your installation.
+; Path to the home directory of the user running the Pleroma service.
+Environment="HOME=/home/pleroma"
+; Path to the folder containing the Pleroma installation.
+WorkingDirectory=/home/pleroma/pleroma
+; Path to the Mix binary.
+ExecStart=/usr/bin/mix phx.server
+
 ; Some security directives.
 ; Use private /tmp and /var/tmp folders inside a new file system namespace, which are discarded after the process stops.
 PrivateTmp=true
@@ -22,6 +30,8 @@ ProtectSystem=full
 PrivateDevices=false
 ; Ensures that the service process and all its children can never gain new privileges through execve().
 NoNewPrivileges=true
+; Drops the sysadmin capability from the daemon.
+CapabilityBoundingSet=~CAP_SYS_ADMIN
 
 [Install]
 WantedBy=multi-user.target