{% include 'roles/sys-svc-container/templates/env.j2' %}

LOCAL_DOMAIN={{ lookup('domain',application_id) }}
ALTERNATE_DOMAINS={{ lookup('domains', 'web-app-mastodon')[1:] | join(',') }}
SINGLE_USER_MODE={{ lookup('config', application_id, 'services.mastodon.single_user_mode') }}
ALLOWED_PRIVATE_ADDRESSES={{ MASTODON_ALLOWED_PRIVATE_ADDRESSES }}

RAILS_ENV=production

{% if MODE_DEBUG | bool %}
RAILS_LOG_LEVEL=debug
DEBUG=*
{% endif %}

SECRET_KEY_BASE={{ lookup('config', application_id, 'secrets.credentials.secret_key_base') }}
OTP_SECRET={{ lookup('config', application_id, 'secrets.credentials.otp_secret') }}

VAPID_PRIVATE_KEY={{ lookup('config', application_id, 'secrets.credentials.vapid_private_key') }}
VAPID_PUBLIC_KEY={{ lookup('config', application_id, 'secrets.credentials.vapid_public_key') }}

ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY={{ lookup('config', application_id, 'secrets.credentials.active_record_encryption_deterministic_key') }}
ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT={{ lookup('config', application_id, 'secrets.credentials.active_record_encryption_key_derivation_salt') }}
ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY={{ lookup('config', application_id, 'secrets.credentials.active_record_encryption_primary_key') }}

DB_HOST={{ lookup('database', application_id, 'host') }}
DB_PORT={{ lookup('database', application_id, 'port') }}
DB_NAME={{ lookup('database', application_id, 'name') }}
DB_USER={{ lookup('database', application_id, 'username') }}
DB_PASS={{ lookup('database', application_id, 'password') }}
DB_POOL={{ POSTGRES_ALLOWED_AVG_CONNECTIONS }}
RAILS_MAX_THREADS={{ POSTGRES_ALLOWED_AVG_CONNECTIONS }}

REDIS_HOST={{ lookup('engine', 'redis', application_id, 'host') }}
REDIS_PORT={{ lookup('engine', 'redis', application_id, 'port') }}
REDIS_PASSWORD={{ lookup('engine', 'redis', application_id, 'password') | dotenv_quote }}

{% if lookup('objstore', application_id, 'enabled') | bool %}
S3_ENABLED=true
S3_BUCKET={{ lookup('objstore', application_id, 'bucket') }}
AWS_ACCESS_KEY_ID={{ lookup('objstore', application_id, 'access_key') }}
AWS_SECRET_ACCESS_KEY={{ lookup('objstore', application_id, 'secret_key') }}
S3_ENDPOINT={{ lookup('objstore', application_id, 'url') }}
S3_REGION={{ lookup('objstore', application_id, 'region') }}
S3_PROTOCOL={{ lookup('tls', lookup('objstore', application_id, 'id'), 'protocols.web') }}
S3_HOSTNAME={{ lookup('objstore', application_id, 'endpoint') }}
S3_ALIAS_HOST={{ lookup('objstore', application_id, 'public_bucket') }}
{% endif %}

{% set email = lookup('email', application_id) %}
{% if email.enabled | bool %}
SMTP_SERVER={{ email.host }}
SMTP_PORT={{ email.port }}
SMTP_LOGIN={{ email.username }}
SMTP_PASSWORD={{ email.password | dotenv_quote }}
SMTP_AUTH_METHOD=plain
SMTP_OPENSSL_VERIFY_MODE=none
SMTP_ENABLE_STARTTLS=auto
SMTP_FROM_ADDRESS=Mastodon <{{ email['from'] }}>
{% endif %}

{% if MASTODON_OIDC_ENABLED | bool %}
OIDC_ENABLED={{ MASTODON_OIDC_ENABLED | string | lower }}
OIDC_DISPLAY_NAME={{ OIDC.BUTTON_TEXT }}
OIDC_ISSUER={{ OIDC.CLIENT.ISSUER_URL }}
OIDC_DISCOVERY=true
OIDC_SCOPE=openid,profile,email
OIDC_UID_FIELD={{ OIDC.ATTRIBUTES.USERNAME }}
OIDC_CLIENT_ID={{ OIDC.CLIENT.ID }}
OIDC_REDIRECT_URI={{ lookup('tls', application_id, 'url.base') }}auth/auth/openid_connect/callback
OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED=true
OIDC_CLIENT_SECRET={{ OIDC.CLIENT.SECRET }}
OMNIAUTH_ONLY=true
ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH=true
ONE_CLICK_SSO_LOGIN=true
{% endif %}