[Quadlet]
DefaultDependencies=false

[Unit]
Description=Mastodon Web

After=network-online.target redis_mastodon.service
Wants=network-online.target redis_mastodon.service

[Container]
Image=ghcr.io/mastodon/mastodon:{{ version['containers']['mastodon'] }}
ContainerName=mastodon-web
HostName=mastodon-web

PublishPort={{ services['mastodon']['ports']['http'] }}:3000/tcp

Volume=%h/data/containers/mastodon/system:/mastodon/public/system:rw
Volume=%h/containers/mastodon/ssl:/etc/ssl/mastodon:ro


# General
Environment="TZ={{ timezone }}"
Environment="LOCAL_DOMAIN={{ services['mastodon']['domain']['public'] }}.{{ domain['public'] }}"
Environment="LIMITED_FEDERATION_MODE=true"
Environment="DISALLOW_UNAUTHENTICATED_API_ACCESS=true"
Environment="ES_ENABLED=false"
Environment="RAILS_LOG_LEVEL=info"
Environment="TRUSTED_PROXY_IP={{ hostvars['fw']['network']['podman']['ipv4']['lla'] }},{{ hostvars['fw']['network']['auth']['ipv4']['server'] }},{{ hostvars['fw']['network']['auth']['ipv6']['server'] }}"

# PostgreSQL
Environment="DB_HOST={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}"
Environment="DB_PORT={{ services['postgresql']['ports']['tcp'] }}"
Environment="DB_NAME=mastodon_db"
Environment="DB_USER=mastodon"
Environment="DB_SSLMODE=verify-full"
Environment="PGSSLROOTCERT=/etc/ssl/mastodon/{{ root_cert_filename }}"
Secret=MASTODON_POSTGRES_PASSWORD,type=env,target=DB_PASS

# Redis
Environment="REDIS_URL=redis://host.containers.internal:{{ services['mastodon']['ports']['redis'] }}"

# Rails secrets
Secret=MASTODON_SECRET_KEY_BASE,type=env,target=SECRET_KEY_BASE
Secret=MASTODON_ENCRYPTION_PRIMARY_KEY,type=env,target=ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY
Secret=MASTODON_ENCRYPTION_DETERMINISTIC_KEY,type=env,target=ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY
Secret=MASTODON_ENCRYPTION_SALT,type=env,target=ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT
Secret=MASTODON_VAPID_PRIVATE_KEY,type=env,target=VAPID_PRIVATE_KEY
Secret=MASTODON_VAPID_PUBLIC_KEY,type=env,target=VAPID_PUBLIC_KEY

# OIDC - Authelia
Environment="OIDC_ENABLED=true"
Environment="OIDC_DISPLAY_NAME=Sign in with Authelia"
Environment="OIDC_ISSUER=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}"
Environment="OIDC_DISCOVERY=true"
Environment="OIDC_SCOPE=openid,groups,profile,email"
Environment="OIDC_UID_FIELD=preferred_username"
Environment="OIDC_CLIENT_ID=mastodon"
Environment="OIDC_REDIRECT_URI=https://{{ services['mastodon']['domain']['public'] }}.{{ domain['public'] }}/auth/auth/openid_connect/callback"
Environment="OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED=false"
Environment="OMNIAUTH_ONLY=true"
Environment="ONE_CLICK_SSO_LOGIN=true"
Environment="OIDC_USE_PKCE=true"
Secret=MASTODON_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET

# Process
Exec=bundle exec puma -C config/puma.rb

[Service]
MemoryKSM=yes
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
TimeoutStopSec=120

[Install]
WantedBy=default.target