Libravatar-nginx

Libravatar-nginx is a project that aims to provide an easy and static way to provide your avatars following the libravatar using not more than nginx. This provides a massively reduced attack surface and maximum performance since all images are pre-generated and no further code has to run on the server-side.

To achieve this the image uses a shell script, imagemagick's magick command and an extended nginx config.

Supported features:

Feature	Support
size parameter	✔
default parameter	✔
forcedefault parameter	✖
SHA256 hash	✔
MD5 hash	✔
Gravatar fallback	✔ (implicit through libravatar)
Libravatar fallback	✔
Generated default icons	✔ (implicit through libravatar)
XMLRPC API	✖
WebFrontend	✖
OpenID	✖

How to use

Here is a minimal docker-compose.yml to run the container:

---
version: '2'
services:
  libravatar:
    image: quay.io/shivering-isles/libravatar-nginx:latest
    mem_limit: 50mb
    memswap_limit: 100mb
    volumes:
      - ./avatar:/var/libravatar.d/
    ports:
      - 80:80
    restart: always

Before starting the image using docker-compose up -d, drop your avatar into the ./avatars directory. The avatars should have your email address as image name followed by their file extension (currently only JPG is supported). Example: me@example.com.jpg

Finally you have to setup SRV records for your domain (example.com), so that libravatar libraries are able to find you. Those should have the following format:

_avatars._tcp.example.com.     IN SRV 0 0 80  avatars.example.com
_avatars-sec._tcp.example.com. IN SRV 0 0 443 avatars.example.com

avatars.example.com should be DNS name where the libravatar-nginx is available on. For _avatars-sec._tcp.example.com it's required to add a reverse-proxy in front of libravatar-nginx that does the HTTPS handling.

Further details can be found in the libravatar wiki.

What is libravatar?

"Libravatar is a service which delivers your avatar (profile picture) to other websites. If you create an account with us, your photo could start popping up next to forum posts or blog comments on any site where you [leave] your email address." -- libravatar.org, 20.02.2020

Technically it works through discovery of the avatar service for an email domain. If it exists, a web request of the hashed email address will be send there, along with the specification of size and a possible default image. If a profile picture was provided to the service, it'll be returned and can be displayed, otherwise it'll return a default image. If no avatar service was found for the domain, the libravatar client library can fall back to the central backend at https://libravatar.org, here users for arbitrary domains can be registered, given you can proof it's your email address.

On Libravatar.org there additionally the ability to proxy pictures from gravatar, so it can be used as drop-in replacement without losing anything.

For further details please check: https://libravatar.org

Configuration options

The libravatar-nginx container image provides some config options for the avatars available through it:

Option	Default	Description
DEBUG	unset	If set, the entrypoint script will run with set -x.
SCALE_START	10	Size of the minimal border length of an avatar. All avatars are square so the smallest avatar size available is 10x10 when using the default setting.
SCALE_STEP	2	Change in pixel for the generation of avatars. When using default values 10x10 would be the smallest available avatar followed by 12x12, 14x14, and so on.
SCALE_STOP	512	Maximum avatar size. All sizes from SCALE_START to SCALE_STOP will be generated using the SCALE_STEP as counter. With defaults this means 10x10, 12x12, 14x14, … until 512x512.
IMAGE_TYPE	jpg	File-type (more explicit file suffix) for images that are processed as avatars. Currently only one image type is supported for all icons, in future there should be more possible at the same time.