[Unit]
Description=Mastodon web
After=database.service redis.service elasticsearch.service
Requires=database.service redis.service elasticsearch.service

[Container]
ContainerName=mastodon
Image=ghcr.io/mastodon/mastodon:v4.5.5
Exec=bundle exec puma -C config/puma.rb
Network=mastodon_internal.network
Network=podman
Environment=LOCAL_DOMAIN=wtf.lt
Environment=REDIS_HOST=redis
Environment=REDIS_PORT=6379
Environment=DB_HOST=database
Environment=DB_NAME=mastodon
Environment=DB_USER={{ mastodon_database.username }}
Environment=DB_PASS={{ mastodon_database.password }}
Environment=DB_PORT=5432
Environment=ES_ENABLED=true
Environment=ES_HOST=elasticsearch
Environment=ES_PORT=9200
Environment=ES_PRESET=single_node_cluster
Environment=ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY={{ active_record_encryption.DETERMINISTIC_KEY }}
Environment=ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT={{ active_record_encryption.KEY_DERIVATION_SALT }}
Environment=ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY={{ active_record_encryption.PRIMARY_KEY }}
Environment=VAPID_PRIVATE_KEY={{ vapid.PRIVATE_KEY }}
Environment=VAPID_PUBLIC_KEY={{ vapid.PUBLIC_KEY }}
Environment=SECRET_KEY_BASE={{ secret_key_base }}
Environment=SMTP_SERVER={{ smtp.SERVER }}
Environment=SMTP_PORT={{ smtp.PORT }}
Environment=SMTP_LOGIN={{ smtp.LOGIN }}
Environment=SMTP_PASSWORD={{ smtp.PASSWORD }}
Environment=SMTP_FROM_ADDRESS={{ smtp.FROM_ADDRESS }}
Environment=TRUSTED_PROXY_IP=127.0.0.1/8,::1/128,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7
Label=traefik.enable=true
Label=traefik.http.routers.mastodon.entrypoints=http
Label=traefik.http.routers.mastodon.rule=Host(`wtf.lt`)
Label=traefik.http.middlewares.mastodon-https-redirect.redirectscheme.scheme=https
Label=traefik.http.routers.mastodon.middlewares=mastodon-https-redirect
Label=traefik.http.routers.mastodon-secure.entrypoints=https
Label=traefik.http.routers.mastodon-secure.rule=Host(`wtf.lt`)
Label=traefik.http.routers.mastodon-secure.tls=true
Label=traefik.http.routers.mastodon-secure.tls.certresolver=lets-encrypt
Label=traefik.http.services.mastodon.loadbalancer.server.port=3000
Volume=/home/apps/mastodon/system:/mastodon/public/system:z
HealthCmd=/bin/sh -c "curl -s --noproxy localhost localhost:3000/health | grep -q OK"

[Service]
Restart=always

[Install]
WantedBy=default.target