dotfiles/nixos/modules/services/mastodon/default.nix

{
  flake,
  config,
  pkgs,
  lib,
  ...
}: let
  inherit (flake.config.people) user0;
  inherit (flake.config.people.user.${user0}) domain email;
  inherit (flake.config.system.device) server wildcard;
  inherit (flake.config.service.instance.mastodon) paths name sops ssl;
  host = domain.url1;
  localhost = wildcard.ip.address0;
in {
  # If you need to start fresh for some reason, run these to create the new Admin account:
  # sudo -u mastodon mastodon-tootctl accounts create nick --email=nick@localhost --confirmed --role=Owner
  # sudo -u mastodon mastodon-tootctl accounts approve nick

  # If you fuck up and lose the password, use this:
  # sudo mastodon-tootctl accounts modify --reset-password nick

  # If you really fuck up and name yourself wrong, use this shit
  # sudo mastodon-tootctl accounts modify username --remove-role

  nixpkgs.overlays = [
    (
      final: prev: {
        mastodon = prev.mastodon.overrideAttrs (oldAttrs: {
          postPatch =
            (oldAttrs.postPatch or "")
            + ''
              patch -p1 < ${./chars.patch}
            '';
        });
      }
    )
  ];

  services = {
    mastodon = {
      enable = true;
      localDomain = host;
      secretKeyBaseFile = "/var/lib/mastodon/secrets/secret-key-base";
      streamingProcesses = 7;
      trustedProxy = localhost;
      automaticMigrations = true;
      database = {
        createLocally = true;
        name = name;
        host = "/run/postgresql";
        user = name;
        passwordFile = config.sops.secrets.mastodon-database.path;
      };
      extraConfig = {
        SINGLE_USER_MODE = "true";
        SMTP_AUTH_METHOD = "plain";
        SMTP_DELIVERY_METHOD = "smtp";
        SMTP_ENABLE_STARTTLS_AUTO = "true";
        SMTP_SSL = "false";
      };
      mediaAutoRemove = {
        enable = true;
        olderThanDays = 14;
      };
      redis = {
        createLocally = true;
        enableUnixSocket = true;
      };
      sidekiqThreads = 25;
      sidekiqProcesses = {
        all = {
          jobClasses = [];
          threads = null;
        };
        default = {
          jobClasses = ["default"];
          threads = 5;
        };
        ingress = {
          jobClasses = ["ingress"];
          threads = 5;
        };
        push-pull = {
          jobClasses = ["push" "pull"];
          threads = 5;
        };
        mailers = {
          jobClasses = ["mailers"];
          threads = 5;
        };
      };
      smtp = {
        authenticate = true;
        createLocally = false;
        fromAddress = "The Nutrivore <${email.address2}>";
        host = "smtp.protonmail.ch";
        passwordFile = config.sops.secrets.mastodon-smtp.path;
        port = 587;
        user = email.address2;
      };
    };
    caddy = {
      virtualHosts = {
        "${host}" = {
          extraConfig = ''
            handle_path /system/* {
              file_server * {
                root /var/lib/mastodon/public-system
              }
            }

            handle /api/v1/streaming/* {
              reverse_proxy unix//run/mastodon-streaming/streaming.socket
            }

            route * {
              file_server * {
                root ${pkgs.mastodon}/public
                pass_thru
              }
              reverse_proxy * unix//run/mastodon-web/web.socket
            }

            tls ${ssl.cert} ${ssl.key}

            handle_errors {
              root * ${pkgs.mastodon}/public
              rewrite 500.html
              file_server
            }

            encode gzip

            header /* {
              Strict-Transport-Security "max-age=31536000;"
            }
            header /emoji/* Cache-Control "public, max-age=31536000, immutable"
            header /packs/* Cache-Control "public, max-age=31536000, immutable"
            header /system/accounts/avatars/* Cache-Control "public, max-age=31536000, immutable"
            header /system/media_attachments/files/* Cache-Control "public, max-age=31536000, immutable"
          '';
        };
      };
    };
  };

  systemd.services.caddy.serviceConfig.ReadWriteDirectories = lib.mkForce ["/var/lib/caddy" "/run/mastodon-web"];

  sops = let
    sopsSecrets = ["smtp" "database" "redis"];
    sopsPath = secret: {
      path = "${sops.path0}/${name}-${secret}";
      owner = name;
      mode = "600";
    };
  in {
    secrets = builtins.listToAttrs (
      map
      (secret: {
        name = "${name}-${secret}";
        value = sopsPath secret;
      })
      sopsSecrets
    );
  };

  fileSystems."/var/lib/${name}" = {
    device = paths.path0;
    fsType = "none";
    options = ["bind"];
    depends = [server.storage0.mount];
  };

  systemd.tmpfiles.rules = [
    "Z ${paths.path0} 0755 ${name} ${name} -"
    "Z ${sops.path0} 0755 ${name} ${name} -"
  ];

  users.users.${name}.extraGroups = ["postgres"];

  networking = {
    firewall = {
      allowedTCPPorts = [];
    };
  };
}