77 lines
3.0 KiB
Django/Jinja
77 lines
3.0 KiB
Django/Jinja
[Quadlet]
|
|
DefaultDependencies=false
|
|
|
|
[Unit]
|
|
Description=Mastodon Web
|
|
|
|
After=network-online.target redis_mastodon.service
|
|
Wants=network-online.target redis_mastodon.service
|
|
|
|
[Container]
|
|
Image=ghcr.io/mastodon/mastodon:{{ version['containers']['mastodon'] }}
|
|
ContainerName=mastodon-web
|
|
HostName=mastodon-web
|
|
|
|
PublishPort={{ services['mastodon']['ports']['http'] }}:3000/tcp
|
|
|
|
Volume=%h/data/containers/mastodon/system:/mastodon/public/system:rw
|
|
Volume=%h/containers/mastodon/ssl:/etc/ssl/mastodon:ro
|
|
|
|
|
|
# General
|
|
Environment="TZ={{ timezone }}"
|
|
Environment="LOCAL_DOMAIN={{ services['mastodon']['domain']['public'] }}.{{ domain['public'] }}"
|
|
Environment="LIMITED_FEDERATION_MODE=true"
|
|
Environment="DISALLOW_UNAUTHENTICATED_API_ACCESS=true"
|
|
Environment="ES_ENABLED=false"
|
|
Environment="RAILS_LOG_LEVEL=info"
|
|
Environment="TRUSTED_PROXY_IP={{ hostvars['fw']['network']['podman']['ipv4']['lla'] }},{{ hostvars['fw']['network']['auth']['ipv4']['server'] }},{{ hostvars['fw']['network']['auth']['ipv6']['server'] }}"
|
|
|
|
# PostgreSQL
|
|
Environment="DB_HOST={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}"
|
|
Environment="DB_PORT={{ services['postgresql']['ports']['tcp'] }}"
|
|
Environment="DB_NAME=mastodon_db"
|
|
Environment="DB_USER=mastodon"
|
|
Environment="DB_SSLMODE=verify-full"
|
|
Environment="PGSSLROOTCERT=/etc/ssl/mastodon/{{ root_cert_filename }}"
|
|
Secret=MASTODON_POSTGRES_PASSWORD,type=env,target=DB_PASS
|
|
|
|
# Redis
|
|
Environment="REDIS_URL=redis://host.containers.internal:{{ services['mastodon']['ports']['redis'] }}"
|
|
|
|
# Rails secrets
|
|
Secret=MASTODON_SECRET_KEY_BASE,type=env,target=SECRET_KEY_BASE
|
|
Secret=MASTODON_ENCRYPTION_PRIMARY_KEY,type=env,target=ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY
|
|
Secret=MASTODON_ENCRYPTION_DETERMINISTIC_KEY,type=env,target=ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY
|
|
Secret=MASTODON_ENCRYPTION_SALT,type=env,target=ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT
|
|
Secret=MASTODON_VAPID_PRIVATE_KEY,type=env,target=VAPID_PRIVATE_KEY
|
|
Secret=MASTODON_VAPID_PUBLIC_KEY,type=env,target=VAPID_PUBLIC_KEY
|
|
|
|
# OIDC - Authelia
|
|
Environment="OIDC_ENABLED=true"
|
|
Environment="OIDC_DISPLAY_NAME=Sign in with Authelia"
|
|
Environment="OIDC_ISSUER=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}"
|
|
Environment="OIDC_DISCOVERY=true"
|
|
Environment="OIDC_SCOPE=openid,groups,profile,email"
|
|
Environment="OIDC_UID_FIELD=preferred_username"
|
|
Environment="OIDC_CLIENT_ID=mastodon"
|
|
Environment="OIDC_REDIRECT_URI=https://{{ services['mastodon']['domain']['public'] }}.{{ domain['public'] }}/auth/auth/openid_connect/callback"
|
|
Environment="OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED=false"
|
|
Environment="OMNIAUTH_ONLY=true"
|
|
Environment="ONE_CLICK_SSO_LOGIN=true"
|
|
Environment="OIDC_USE_PKCE=true"
|
|
Secret=MASTODON_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
|
|
|
|
# Process
|
|
Exec=bundle exec puma -C config/puma.rb
|
|
|
|
[Service]
|
|
MemoryKSM=yes
|
|
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
|
|
Restart=always
|
|
RestartSec=10s
|
|
TimeoutStopSec=120
|
|
|
|
[Install]
|
|
WantedBy=default.target
|