Bot Updating Package Versions

Add categories to readme-vars.yml

.editorconfig

@@ -15,6 +15,6 @@ trim_trailing_whitespace = false
 indent_style = space
 indent_size = 2
 
-[{**.sh,root/etc/cont-init.d/**,root/etc/services.d/**}]
+[{**.sh,root/etc/s6-overlay/s6-rc.d/**,root/etc/cont-init.d/**,root/etc/services.d/**}]
 indent_style = space
 indent_size = 4

.github/CONTRIBUTING.md

@@ -6,7 +6,7 @@
 * Read, and fill the Pull Request template
   * If this is a fix for a typo (in code, documentation, or the README) please file an issue and let us sort it out. We do not need a PR
   * If the PR is addressing an existing issue include, closes #\<issue number>, in the body of the PR commit message
-* If you want to discuss changes, you can also bring it up in [#dev-talk](https://discordapp.com/channels/354974912613449730/757585807061155840) in our [Discord server](https://discord.gg/YWrKVTn)
+* If you want to discuss changes, you can also bring it up in [#dev-talk](https://discordapp.com/channels/354974912613449730/757585807061155840) in our [Discord server](https://linuxserver.io/discord)
 
 ## Common files
 
@@ -105,10 +105,10 @@ docker build \
   -t linuxserver/mastodon:latest .
 ```
 
-The ARM variants can be built on x86_64 hardware using `multiarch/qemu-user-static`
+The ARM variants can be built on x86_64 hardware and vice versa using `lscr.io/linuxserver/qemu-static`
 
 ```bash
-docker run --rm --privileged multiarch/qemu-user-static:register --reset
+docker run --rm --privileged lscr.io/linuxserver/qemu-static --reset
 ```
 
 Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64`.

.github/ISSUE_TEMPLATE/config.yml

@@ -1,7 +1,7 @@
 blank_issues_enabled: false
 contact_links:
   - name: Discord chat support
-    url: https://discord.gg/YWrKVTn
+    url: https://linuxserver.io/discord
     about: Realtime support / chat with the community and the team.
 
   - name: Discourse discussion forum

.github/ISSUE_TEMPLATE/issue.bug.md

@@ -1,40 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-
----
-[linuxserverurl]: https://linuxserver.io
-[![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]
-
-<!--- If you are new to Docker or this application our issue tracker is **ONLY** used for reporting bugs or requesting features. Please use [our discord server](https://discord.gg/YWrKVTn) for general support. --->
-
-<!--- Provide a general summary of the bug in the Title above -->
-
-------------------------------
-
-## Expected Behavior
-<!--- Tell us what should happen -->
-
-## Current Behavior
-<!--- Tell us what happens instead of the expected behavior -->
-
-## Steps to Reproduce
-<!--- Provide a link to a live example, or an unambiguous set of steps to -->
-<!--- reproduce this bug. Include code to reproduce, if relevant -->
-1.
-2.
-3.
-4.
-
-## Environment
-**OS:**
-**CPU architecture:** x86_64/arm32/arm64
-**How docker service was installed:**
-<!--- ie. from the official docker repo, from the distro repo, nas OS provided, etc. -->
-<!--- Providing context helps us come up with a solution that is most useful in the real world -->
-
-## Command used to create docker container (run/create/compose/screenshot)
-<!--- Provide your docker create/run command or compose yaml snippet, or a screenshot of settings if using a gui to create the container -->
-
-## Docker logs
-<!--- Provide a full docker log, output of "docker logs mastodon" -->

.github/ISSUE_TEMPLATE/issue.bug.yml

@@ -0,0 +1,76 @@
+# Based on the issue template
+name: Bug report
+description: Create a report to help us improve
+title: "[BUG] <title>"
+labels: [Bug]
+body:
+  - type: checkboxes
+    attributes:
+      label: Is there an existing issue for this?
+      description: Please search to see if an issue already exists for the bug you encountered.
+      options:
+        - label: I have searched the existing issues
+          required: true
+  - type: textarea
+    attributes:
+      label: Current Behavior
+      description: Tell us what happens instead of the expected behavior.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Expected Behavior
+      description: Tell us what should happen.
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Steps To Reproduce
+      description: Steps to reproduce the behavior.
+      placeholder: |
+        1. In this environment...
+        2. With this config...
+        3. Run '...'
+        4. See error...
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Environment
+      description: |
+        examples:
+          - **OS**: Ubuntu 20.04
+          - **How docker service was installed**: distro's packagemanager
+      value: |
+        - OS:
+        - How docker service was installed:
+      render: markdown
+    validations:
+      required: false
+  - type: dropdown
+    attributes:
+      label: CPU architecture
+      options:
+        - x86-64
+        - arm64
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Docker creation
+      description: |
+        Command used to create docker container
+        Provide your docker create/run command or compose yaml snippet, or a screenshot of settings if using a gui to create the container
+      render: bash
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      description: |
+        Provide a full docker log, output of "docker logs mastodon"
+      label: Container logs
+      placeholder: |
+        Output of `docker logs mastodon`
+      render: bash
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/issue.feature.md

@@ -1,25 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-
----
-[linuxserverurl]: https://linuxserver.io
-[![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]
-
-<!--- If you are new to Docker or this application our issue tracker is **ONLY** used for reporting bugs or requesting features. Please use [our discord server](https://discord.gg/YWrKVTn) for general support. --->
-
-<!--- If this acts as a feature request please ask yourself if this modification is something the whole userbase will benefit from --->
-<!--- If this is a specific change for corner case functionality or plugins please look at making a Docker Mod or local script  https://blog.linuxserver.io/2019/09/14/customizing-our-containers/ -->
-
-<!--- Provide a general summary of the request in the Title above -->
-
-------------------------------
-
-## Desired Behavior
-<!--- Tell us what should happen -->
-
-## Current Behavior
-<!--- Tell us what happens instead of the expected behavior -->
-
-## Alternatives Considered
-<!--- Tell us what other options you have tried or considered -->

.github/ISSUE_TEMPLATE/issue.feature.yml

@@ -0,0 +1,31 @@
+# Based on the issue template
+name: Feature request
+description: Suggest an idea for this project
+title: "[FEAT] <title>"
+labels: [enhancement]
+body:
+  - type: checkboxes
+    attributes:
+      label: Is this a new feature request?
+      description: Please search to see if a feature request already exists.
+      options:
+        - label: I have searched the existing issues
+          required: true
+  - type: textarea
+    attributes:
+      label: Wanted change
+      description: Tell us what you want to happen.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Reason for change
+      description: Justify your request, why do you want it, what is the benefit.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Proposed code change
+      description: Do you have a potential code change in mind?
+    validations:
+      required: false

.github/workflows/call_issue_pr_tracker.yml

@@ -0,0 +1,19 @@
+name: Issue & PR Tracker
+
+on:
+  issues:
+    types: [opened,reopened,labeled,unlabeled,closed]
+  pull_request_target:
+    types: [opened,reopened,review_requested,review_request_removed,labeled,unlabeled,closed]
+  pull_request_review:
+    types: [submitted,edited,dismissed]
+
+permissions:
+  contents: read
+
+jobs:
+  manage-project:
+    permissions:
+      issues: write
+    uses: linuxserver/github-workflows/.github/workflows/issue-pr-tracker.yml@v1
+    secrets: inherit

.github/workflows/call_issues_cron.yml

@@ -0,0 +1,16 @@
+name: Mark stale issues and pull requests
+on:
+  schedule:
+    - cron:  '21 5 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  stale:
+    permissions:
+      issues: write
+      pull-requests: write
+    uses: linuxserver/github-workflows/.github/workflows/issues-cron.yml@v1
+    secrets: inherit

.github/workflows/external_trigger.yml

@@ -3,24 +3,42 @@ name: External Trigger Main
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   external-trigger-main:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2.3.3
+      - uses: actions/checkout@v4.1.1
 
       - name: External Trigger
         if: github.ref == 'refs/heads/main'
+        env:
+          SKIP_EXTERNAL_TRIGGER: ${{ vars.SKIP_EXTERNAL_TRIGGER }}
         run: |
-          if [ -n "${{ secrets.PAUSE_EXTERNAL_TRIGGER_MASTODON_MAIN }}" ]; then
-            echo "**** Github secret PAUSE_EXTERNAL_TRIGGER_MASTODON_MAIN is set; skipping trigger. ****"
+          printf "# External trigger for docker-mastodon\n\n" >> $GITHUB_STEP_SUMMARY
+          if grep -q "^mastodon_main_" <<< "${SKIP_EXTERNAL_TRIGGER}"; then
+            echo "> [!NOTE]" >> $GITHUB_STEP_SUMMARY
+            echo "> Github organizational variable \`SKIP_EXTERNAL_TRIGGER\` contains \`mastodon_main_\`; will skip trigger if version matches." >> $GITHUB_STEP_SUMMARY
+          elif grep -q "^mastodon_main" <<< "${SKIP_EXTERNAL_TRIGGER}"; then
+            echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+            echo "> Github organizational variable \`SKIP_EXTERNAL_TRIGGER\` contains \`mastodon_main\`; skipping trigger." >> $GITHUB_STEP_SUMMARY
             exit 0
           fi
-          echo "**** External trigger running off of main branch. To disable this trigger, set a Github secret named \"PAUSE_EXTERNAL_TRIGGER_MASTODON_MAIN\". ****"
-          echo "**** Retrieving external version ****"
+          echo "> [!NOTE]" >> $GITHUB_STEP_SUMMARY
+          echo "> External trigger running off of main branch. To disable this trigger, add \`mastodon_main\` into the Github organizational variable \`SKIP_EXTERNAL_TRIGGER\`." >> $GITHUB_STEP_SUMMARY
+          printf "\n## Retrieving external version\n\n" >> $GITHUB_STEP_SUMMARY
           EXT_RELEASE=$(curl -u "${{ secrets.CR_USER }}:${{ secrets.CR_PAT }}" -sX GET "https://api.github.com/repos/mastodon/mastodon/releases/latest" | jq -r '. | .tag_name')
+          echo "Type is \`github_stable\`" >> $GITHUB_STEP_SUMMARY
+          if grep -q "^mastodon_main_${EXT_RELEASE}" <<< "${SKIP_EXTERNAL_TRIGGER}"; then
+            echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+            echo "> Github organizational variable \`SKIP_EXTERNAL_TRIGGER\` matches current external release; skipping trigger." >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
           if [ -z "${EXT_RELEASE}" ] || [ "${EXT_RELEASE}" == "null" ]; then
-            echo "**** Can't retrieve external version, exiting ****"
+            echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+            echo "> Can't retrieve external version, exiting" >> $GITHUB_STEP_SUMMARY
             FAILURE_REASON="Can't retrieve external version for mastodon branch main"
             GHA_TRIGGER_URL="https://github.com/linuxserver/docker-mastodon/actions/runs/${{ github.run_id }}"
             curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 16711680,
@@ -28,65 +46,102 @@ jobs:
               "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
             exit 1
           fi
-          EXT_RELEASE=$(echo ${EXT_RELEASE} | sed 's/[~,%@+;:/]//g')
-          echo "**** External version: ${EXT_RELEASE} ****"
-          echo "**** Retrieving last pushed version ****"
+          EXT_RELEASE_SANITIZED=$(echo ${EXT_RELEASE} | sed 's/[~,%@+;:/]//g')
+          echo "Sanitized external version: \`${EXT_RELEASE_SANITIZED}\`" >> $GITHUB_STEP_SUMMARY
+          echo "Retrieving last pushed version" >> $GITHUB_STEP_SUMMARY
           image="linuxserver/mastodon"
           tag="latest"
           token=$(curl -sX GET \
             "https://ghcr.io/token?scope=repository%3Alinuxserver%2Fmastodon%3Apull" \
             | jq -r '.token')
-            multidigest=$(curl -s \
+          multidigest=$(curl -s \
+            --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
+            --header "Accept: application/vnd.oci.image.index.v1+json" \
+            --header "Authorization: Bearer ${token}" \
+            "https://ghcr.io/v2/${image}/manifests/${tag}")
+          if jq -e '.layers // empty' <<< "${multidigest}" >/dev/null 2>&1; then
+            # If there's a layer element it's a single-arch manifest so just get that digest
+            digest=$(jq -r '.config.digest' <<< "${multidigest}")
+          else
+            # Otherwise it's multi-arch or has manifest annotations
+            if jq -e '.manifests[]?.annotations // empty' <<< "${multidigest}" >/dev/null 2>&1; then
+              # Check for manifest annotations and delete if found
+              multidigest=$(jq 'del(.manifests[] | select(.annotations))' <<< "${multidigest}")
+            fi
+            if [[ $(jq '.manifests | length' <<< "${multidigest}") -gt 1 ]]; then
+              # If there's still more than one digest, it's multi-arch
+              multidigest=$(jq -r ".manifests[] | select(.platform.architecture == \"amd64\").digest?" <<< "${multidigest}")
+            else
+              # Otherwise it's single arch
+              multidigest=$(jq -r ".manifests[].digest?" <<< "${multidigest}")
+            fi
+            if digest=$(curl -s \
               --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
+              --header "Accept: application/vnd.oci.image.manifest.v1+json" \
               --header "Authorization: Bearer ${token}" \
-              "https://ghcr.io/v2/${image}/manifests/${tag}" \
-              | jq -r 'first(.manifests[].digest)')
-            digest=$(curl -s \
-              --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
-              --header "Authorization: Bearer ${token}" \
-              "https://ghcr.io/v2/${image}/manifests/${multidigest}" \
-              | jq -r '.config.digest')
+              "https://ghcr.io/v2/${image}/manifests/${multidigest}"); then
+              digest=$(jq -r '.config.digest' <<< "${digest}");
+            fi
+          fi
           image_info=$(curl -sL \
             --header "Authorization: Bearer ${token}" \
-            "https://ghcr.io/v2/${image}/blobs/${digest}" \
-            | jq -r '.container_config')
+            "https://ghcr.io/v2/${image}/blobs/${digest}")
+          if [[ $(echo $image_info | jq -r '.container_config') == "null" ]]; then
+            image_info=$(echo $image_info | jq -r '.config')
+          else
+            image_info=$(echo $image_info | jq -r '.container_config')
+          fi
           IMAGE_RELEASE=$(echo ${image_info} | jq -r '.Labels.build_version' | awk '{print $3}')
           IMAGE_VERSION=$(echo ${IMAGE_RELEASE} | awk -F'-ls' '{print $1}')
           if [ -z "${IMAGE_VERSION}" ]; then
-            echo "**** Can't retrieve last pushed version, exiting ****"
+            echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+            echo "Can't retrieve last pushed version, exiting" >> $GITHUB_STEP_SUMMARY
             FAILURE_REASON="Can't retrieve last pushed version for mastodon tag latest"
             curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 16711680,
               "description": "**Trigger Failed** \n**Reason:** '"${FAILURE_REASON}"' \n"}],
               "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
             exit 1
           fi
-          echo "**** Last pushed version: ${IMAGE_VERSION} ****"
-          if [ "${EXT_RELEASE}" == "${IMAGE_VERSION}" ]; then
-            echo "**** Version ${EXT_RELEASE} already pushed, exiting ****"
+          echo "Last pushed version: \`${IMAGE_VERSION}\`" >> $GITHUB_STEP_SUMMARY
+          if [ "${EXT_RELEASE_SANITIZED}" == "${IMAGE_VERSION}" ]; then
+            echo "Sanitized version \`${EXT_RELEASE_SANITIZED}\` already pushed, exiting" >> $GITHUB_STEP_SUMMARY
             exit 0
           elif [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-mastodon/job/main/lastBuild/api/json | jq -r '.building') == "true" ]; then
-            echo "**** New version ${EXT_RELEASE} found; but there already seems to be an active build on Jenkins; exiting ****"
+            echo "New version \`${EXT_RELEASE}\` found; but there already seems to be an active build on Jenkins; exiting" >> $GITHUB_STEP_SUMMARY
             exit 0
           else
-            echo "**** New version ${EXT_RELEASE} found; old version was ${IMAGE_VERSION}. Triggering new build ****"
-            response=$(curl -iX POST \
-              https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-mastodon/job/main/buildWithParameters?PACKAGE_CHECK=false \
-              --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
-            echo "**** Jenkins job queue url: ${response%$'\r'} ****"
-            echo "**** Sleeping 10 seconds until job starts ****"
-            sleep 10
-            buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
-            buildurl="${buildurl%$'\r'}"
-            echo "**** Jenkins job build url: ${buildurl} ****"
-            echo "**** Attempting to change the Jenkins job description ****"
-            curl -iX POST \
-              "${buildurl}submitDescription" \
-              --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \
-              --data-urlencode "description=GHA external trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-              --data-urlencode "Submit=Submit"
-            echo "**** Notifying Discord ****"
-            TRIGGER_REASON="A version change was detected for mastodon tag latest. Old version:${IMAGE_VERSION} New version:${EXT_RELEASE}"
-            curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
-              "description": "**Build Triggered** \n**Reason:** '"${TRIGGER_REASON}"' \n**Build URL:** '"${buildurl}display/redirect"' \n"}],
-              "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+            if [[ "${artifacts_found}" == "false" ]]; then
+              echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+              echo "> New version detected, but not all artifacts are published yet; skipping trigger" >> $GITHUB_STEP_SUMMARY
+              FAILURE_REASON="New version ${EXT_RELEASE} for mastodon tag latest is detected, however not all artifacts are uploaded to upstream release yet. Will try again later."
+              curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
+                "description": "**Trigger Failed** \n**Reason:** '"${FAILURE_REASON}"' \n"}],
+                "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+            else
+              printf "\n## Trigger new build\n\n" >> $GITHUB_STEP_SUMMARY
+              echo "New sanitized version \`${EXT_RELEASE_SANITIZED}\` found; old version was \`${IMAGE_VERSION}\`. Triggering new build" >> $GITHUB_STEP_SUMMARY
+              if [[ "${artifacts_found}" == "true" ]]; then
+                echo "All artifacts seem to be uploaded." >> $GITHUB_STEP_SUMMARY
+              fi
+              response=$(curl -iX POST \
+                https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-mastodon/job/main/buildWithParameters?PACKAGE_CHECK=false \
+                --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
+              echo "Jenkins [job queue url](${response%$'\r'})" >> $GITHUB_STEP_SUMMARY
+              echo "Sleeping 10 seconds until job starts" >> $GITHUB_STEP_SUMMARY
+              sleep 10
+              buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
+              buildurl="${buildurl%$'\r'}"
+              echo "Jenkins job [build url](${buildurl})" >> $GITHUB_STEP_SUMMARY
+              echo "Attempting to change the Jenkins job description" >> $GITHUB_STEP_SUMMARY
+              curl -iX POST \
+                "${buildurl}submitDescription" \
+                --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \
+                --data-urlencode "description=GHA external trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+                --data-urlencode "Submit=Submit"
+              echo "**** Notifying Discord ****"
+              TRIGGER_REASON="A version change was detected for mastodon tag latest. Old version:${IMAGE_VERSION} New version:${EXT_RELEASE_SANITIZED}"
+              curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
+                "description": "**Build Triggered** \n**Reason:** '"${TRIGGER_REASON}"' \n**Build URL:** '"${buildurl}display/redirect"' \n"}],
+                "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+            fi
           fi

.github/workflows/external_trigger_scheduler.yml

@@ -2,42 +2,47 @@ name: External Trigger Scheduler
 
 on:
   schedule:
-    - cron:  '01 * * * *'
+    - cron:  '24 * * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   external-trigger-scheduler:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2.3.3
+      - uses: actions/checkout@v4.1.1
         with:
           fetch-depth: '0'
 
       - name: External Trigger Scheduler
         run: |
-          echo "**** Branches found: ****"
-          git for-each-ref --format='%(refname:short)' refs/remotes
-          echo "**** Pulling the yq docker image ****"
-          docker pull ghcr.io/linuxserver/yq
-          for br in $(git for-each-ref --format='%(refname:short)' refs/remotes)
+          printf "# External trigger scheduler for docker-mastodon\n\n" >> $GITHUB_STEP_SUMMARY
+          printf "Found the branches:\n\n%s\n" "$(git for-each-ref --format='- %(refname:lstrip=3)' refs/remotes)" >> $GITHUB_STEP_SUMMARY
+          for br in $(git for-each-ref --format='%(refname:lstrip=3)' refs/remotes)
           do
-            br=$(echo "$br" | sed 's|origin/||g')
-            echo "**** Evaluating branch ${br} ****"
-            ls_branch=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-mastodon/${br}/jenkins-vars.yml \
-              | docker run --rm -i --entrypoint yq ghcr.io/linuxserver/yq -r .ls_branch)
-            if [ "$br" == "$ls_branch" ]; then
-              echo "**** Branch ${br} appears to be live; checking workflow. ****"
+            if [[ "${br}" == "HEAD" ]]; then
+              printf "\nSkipping %s.\n" ${br} >> $GITHUB_STEP_SUMMARY
+              continue
+            fi
+            printf "\n## Evaluating \`%s\`\n\n" ${br} >> $GITHUB_STEP_SUMMARY
+            ls_jenkins_vars=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-mastodon/${br}/jenkins-vars.yml)
+            ls_branch=$(echo "${ls_jenkins_vars}" | yq -r '.ls_branch')
+            ls_trigger=$(echo "${ls_jenkins_vars}" | yq -r '.external_type')
+            if [[ "${br}" == "${ls_branch}" ]] && [[ "${ls_trigger}" != "os" ]]; then
+              echo "Branch appears to be live and trigger is not os; checking workflow." >> $GITHUB_STEP_SUMMARY
               if curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-mastodon/${br}/.github/workflows/external_trigger.yml > /dev/null 2>&1; then
-                echo "**** Workflow exists. Triggering external trigger workflow for branch ${br} ****."
+                echo "Triggering external trigger workflow for branch." >> $GITHUB_STEP_SUMMARY
                 curl -iX POST \
                   -H "Authorization: token ${{ secrets.CR_PAT }}" \
                   -H "Accept: application/vnd.github.v3+json" \
                   -d "{\"ref\":\"refs/heads/${br}\"}" \
                   https://api.github.com/repos/linuxserver/docker-mastodon/actions/workflows/external_trigger.yml/dispatches
               else
-                echo "**** Workflow doesn't exist; skipping trigger. ****"
+                echo "Skipping branch due to no external trigger workflow present." >> $GITHUB_STEP_SUMMARY
               fi
             else
-              echo "**** ${br} appears to be a dev branch; skipping trigger. ****"
+              echo "Skipping branch due to being detected as dev branch or having no external version." >> $GITHUB_STEP_SUMMARY
             fi
           done

.github/workflows/greetings.yml

@@ -2,12 +2,18 @@ name: Greetings
 
 on: [pull_request_target, issues]
 
+permissions:
+  contents: read
+
 jobs:
   greeting:
+    permissions:
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
     - uses: actions/first-interaction@v1
       with:
-        issue-message: 'Thanks for opening your first issue here! Be sure to follow the [bug](https://github.com/linuxserver/docker-mastodon/blob/main/.github/ISSUE_TEMPLATE/issue.bug.md) or [feature](https://github.com/linuxserver/docker-mastodon/blob/main/.github/ISSUE_TEMPLATE/issue.feature.md) issue templates!'
+        issue-message: 'Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.'
         pr-message: 'Thanks for opening this pull request! Be sure to follow the [pull request template](https://github.com/linuxserver/docker-mastodon/blob/main/.github/PULL_REQUEST_TEMPLATE.md)!'
         repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/package_trigger.yml

@@ -1,38 +0,0 @@
-name: Package Trigger Main
-
-on:
-  workflow_dispatch:
-
-jobs:
-  package-trigger-main:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2.3.3
-
-      - name: Package Trigger
-        if: github.ref == 'refs/heads/main'
-        run: |
-          if [ -n "${{ secrets.PAUSE_PACKAGE_TRIGGER_MASTODON_MAIN }}" ]; then
-            echo "**** Github secret PAUSE_PACKAGE_TRIGGER_MASTODON_MAIN is set; skipping trigger. ****"
-            exit 0
-          fi
-          if [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-mastodon/job/main/lastBuild/api/json | jq -r '.building') == "true" ]; then
-            echo "**** There already seems to be an active build on Jenkins; skipping package trigger ****"
-            exit 0
-          fi
-          echo "**** Package trigger running off of main branch. To disable, set a Github secret named \"PAUSE_PACKAGE_TRIGGER_MASTODON_MAIN\". ****"
-          response=$(curl -iX POST \
-            https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-mastodon/job/main/buildWithParameters?PACKAGE_CHECK=true \
-            --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
-          echo "**** Jenkins job queue url: ${response%$'\r'} ****"
-          echo "**** Sleeping 10 seconds until job starts ****"
-          sleep 10
-          buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
-          buildurl="${buildurl%$'\r'}"
-          echo "**** Jenkins job build url: ${buildurl} ****"
-          echo "**** Attempting to change the Jenkins job description ****"
-          curl -iX POST \
-            "${buildurl}submitDescription" \
-            --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \
-            --data-urlencode "description=GHA package trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-            --data-urlencode "Submit=Submit"

.github/workflows/package_trigger_scheduler.yml

@@ -2,49 +2,102 @@ name: Package Trigger Scheduler
 
 on:
   schedule:
-    - cron:  '31 4 * * 3'
+    - cron:  '35 10 * * 4'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   package-trigger-scheduler:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2.3.3
+      - uses: actions/checkout@v4.1.1
         with:
           fetch-depth: '0'
 
       - name: Package Trigger Scheduler
+        env:
+          SKIP_PACKAGE_TRIGGER: ${{ vars.SKIP_PACKAGE_TRIGGER }}
         run: |
-          echo "**** Branches found: ****"
-          git for-each-ref --format='%(refname:short)' refs/remotes
-          echo "**** Pulling the yq docker image ****"
-          docker pull ghcr.io/linuxserver/yq
-          for br in $(git for-each-ref --format='%(refname:short)' refs/remotes)
+          printf "# Package trigger scheduler for docker-mastodon\n\n" >> $GITHUB_STEP_SUMMARY
+          printf "Found the branches:\n\n%s\n" "$(git for-each-ref --format='- %(refname:lstrip=3)' refs/remotes)" >> $GITHUB_STEP_SUMMARY
+          for br in $(git for-each-ref --format='%(refname:lstrip=3)' refs/remotes)
           do
-            br=$(echo "$br" | sed 's|origin/||g')
-            echo "**** Evaluating branch ${br} ****"
-            ls_branch=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-mastodon/${br}/jenkins-vars.yml \
-              | docker run --rm -i --entrypoint yq ghcr.io/linuxserver/yq -r .ls_branch)
-            if [ "${br}" == "${ls_branch}" ]; then
-              echo "**** Branch ${br} appears to be live; checking workflow. ****"
-              if curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-mastodon/${br}/.github/workflows/package_trigger.yml > /dev/null 2>&1; then
-                echo "**** Workflow exists. Triggering package trigger workflow for branch ${br}. ****"
-                triggered_branches="${triggered_branches}${br} "
-                curl -iX POST \
-                  -H "Authorization: token ${{ secrets.CR_PAT }}" \
-                  -H "Accept: application/vnd.github.v3+json" \
-                  -d "{\"ref\":\"refs/heads/${br}\"}" \
-                  https://api.github.com/repos/linuxserver/docker-mastodon/actions/workflows/package_trigger.yml/dispatches
-                sleep 30
+            if [[ "${br}" == "HEAD" ]]; then
+              printf "\nSkipping %s.\n" ${br} >> $GITHUB_STEP_SUMMARY
+              continue
+            fi
+            printf "\n## Evaluating \`%s\`\n\n" ${br} >> $GITHUB_STEP_SUMMARY
+            JENKINS_VARS=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-mastodon/${br}/jenkins-vars.yml)
+            if ! curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-mastodon/${br}/Jenkinsfile >/dev/null 2>&1; then
+              echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+              echo "> No Jenkinsfile found. Branch is either deprecated or is an early dev branch." >> $GITHUB_STEP_SUMMARY
+              skipped_branches="${skipped_branches}${br} "
+            elif [[ "${br}" == $(yq -r '.ls_branch' <<< "${JENKINS_VARS}") ]]; then
+              echo "Branch appears to be live; checking workflow." >> $GITHUB_STEP_SUMMARY
+              README_VARS=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-mastodon/${br}/readme-vars.yml)
+              if [[ $(yq -r '.project_deprecation_status' <<< "${README_VARS}") == "true" ]]; then
+                echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                echo "> Branch appears to be deprecated; skipping trigger." >> $GITHUB_STEP_SUMMARY
+                skipped_branches="${skipped_branches}${br} "
+              elif [[ $(yq -r '.skip_package_check' <<< "${JENKINS_VARS}") == "true" ]]; then
+                echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                echo "> Skipping branch ${br} due to \`skip_package_check\` being set in \`jenkins-vars.yml\`." >> $GITHUB_STEP_SUMMARY
+                skipped_branches="${skipped_branches}${br} "
+              elif grep -q "^mastodon_${br}" <<< "${SKIP_PACKAGE_TRIGGER}"; then
+                echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                echo "> Github organizational variable \`SKIP_PACKAGE_TRIGGER\` contains \`mastodon_${br}\`; skipping trigger." >> $GITHUB_STEP_SUMMARY
+                skipped_branches="${skipped_branches}${br} "
+              elif [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-mastodon/job/${br}/lastBuild/api/json | jq -r '.building' 2>/dev/null) == "true" ]; then
+                echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                echo "> There already seems to be an active build on Jenkins; skipping package trigger for ${br}" >> $GITHUB_STEP_SUMMARY
+                skipped_branches="${skipped_branches}${br} "
               else
-                echo "**** Workflow doesn't exist; skipping trigger. ****"
+                echo "> [!NOTE]" >> $GITHUB_STEP_SUMMARY
+                echo "> Triggering package trigger for branch ${br}" >> $GITHUB_STEP_SUMMARY
+                printf "> To disable, add \`mastodon_%s\` into the Github organizational variable \`SKIP_PACKAGE_TRIGGER\`.\n\n" "${br}" >> $GITHUB_STEP_SUMMARY
+                triggered_branches="${triggered_branches}${br} "
+                response=$(curl -iX POST \
+                  https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-mastodon/job/${br}/buildWithParameters?PACKAGE_CHECK=true \
+                  --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
+                if [[ -z "${response}" ]]; then
+                  echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                  echo "> Jenkins build could not be triggered. Skipping branch."
+                  continue
+                fi
+                echo "Jenkins [job queue url](${response%$'\r'})" >> $GITHUB_STEP_SUMMARY
+                echo "Sleeping 10 seconds until job starts" >> $GITHUB_STEP_SUMMARY
+                sleep 10
+                buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
+                buildurl="${buildurl%$'\r'}"
+                echo "Jenkins job [build url](${buildurl})" >> $GITHUB_STEP_SUMMARY
+                echo "Attempting to change the Jenkins job description" >> $GITHUB_STEP_SUMMARY
+                if ! curl -ifX POST \
+                  "${buildurl}submitDescription" \
+                  --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \
+                  --data-urlencode "description=GHA package trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+                  --data-urlencode "Submit=Submit"; then
+                  echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                  echo "> Unable to change the Jenkins job description."
+                fi
+                sleep 20
               fi
             else
-              echo "**** ${br} appears to be a dev branch; skipping trigger. ****"
+              echo "Skipping branch ${br} due to being detected as dev branch." >> $GITHUB_STEP_SUMMARY
             fi
           done
-          echo "**** Package check build(s) triggered for branch(es): ${triggered_branches} ****"
-          echo "**** Notifying Discord ****"
-          curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
-            "description": "**Package Check Build(s) Triggered for mastodon** \n**Branch(es):** '"${triggered_branches}"' \n**Build URL:** '"https://ci.linuxserver.io/blue/organizations/jenkins/Docker-Pipeline-Builders%2Fdocker-mastodon/activity/"' \n"}],
-            "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+          if [[ -n "${triggered_branches}" ]] || [[ -n "${skipped_branches}" ]]; then
+            if [[ -n "${triggered_branches}" ]]; then
+              NOTIFY_BRANCHES="**Triggered:** ${triggered_branches} \n"
+              NOTIFY_BUILD_URL="**Build URL:** https://ci.linuxserver.io/blue/organizations/jenkins/Docker-Pipeline-Builders%2Fdocker-mastodon/activity/ \n"
+              echo "**** Package check build(s) triggered for branch(es): ${triggered_branches} ****"
+            fi
+            if [[ -n "${skipped_branches}" ]]; then
+              NOTIFY_BRANCHES="${NOTIFY_BRANCHES}**Skipped:** ${skipped_branches} \n"
+            fi
+            echo "**** Notifying Discord ****"
+            curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
+              "description": "**Package Check Build(s) for mastodon** \n'"${NOTIFY_BRANCHES}"''"${NOTIFY_BUILD_URL}"'"}],
+              "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+          fi

.github/workflows/permissions.yml

@@ -0,0 +1,12 @@
+name: Permission check
+on:
+  pull_request_target:
+    paths:
+      - '**/run'
+      - '**/finish'
+      - '**/check'
+      - 'root/migrations/*'
+
+jobs:
+  permission_check:
+    uses: linuxserver/github-workflows/.github/workflows/init-svc-executable-permissions.yml@v1

.github/workflows/stale.yml

@@ -1,23 +0,0 @@
-name: Mark stale issues and pull requests
-
-on:
-  schedule:
-  - cron: "30 1 * * *"
-
-jobs:
-  stale:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/stale@v3
-      with:
-        stale-issue-message: "This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions."
-        stale-pr-message: "This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions."
-        stale-issue-label: 'no-issue-activity'
-        stale-pr-label: 'no-pr-activity'
-        days-before-stale: 30
-        days-before-close: 365
-        exempt-issue-labels: 'awaiting-approval,work-in-progress'
-        exempt-pr-labels: 'awaiting-approval,work-in-progress'
-        repo-token: ${{ secrets.GITHUB_TOKEN }}

Dockerfile

@@ -1,39 +1,45 @@
-FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.15
+# syntax=docker/dockerfile:1
+
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.22
 
 ARG BUILD_DATE
 ARG VERSION
 ARG MASTODON_VERSION
 LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}"
-LABEL maintainer="TheSpad"
+LABEL maintainer="thespad"
 
 ENV RAILS_ENV="production" \
     NODE_ENV="production" \
-    PATH="${PATH}:/opt/ruby/bin:/opt/node/bin:/app/www/bin"
+    PATH="${PATH}:/app/www/bin" \
+    S6_STAGE2_HOOK="/init-hook" \
+    MASTODON_USE_LIBVIPS="true"
 
 RUN \
-  apk add -U --upgrade --no-cache \
+  apk add --no-cache \
     ffmpeg \
     file \
-    icu-libs \ 
-    imagemagick \
     libpq \
     libidn \
     nodejs \
     ruby \
     ruby-bundler \
-    yarn && \
+    ruby-rdoc \
+    vips \
+    vips-heif \
+    yaml && \
   apk add --no-cache --virtual=build-dependencies \
     build-base \
-    g++ \
-    gcc \
     icu-dev \
-    libidn-dev \    
+    libidn-dev \
     libpq-dev \
     libxml2-dev \
     libxslt-dev \
-    openssl-dev \
+    linux-headers \
     npm \
-    ruby-dev && \
+    openssl-dev \
+    ruby-dev \
+    vips-dev \
+    yaml-dev && \
   echo "**** install mastodon ****" && \
   mkdir -p /app/www && \
   if [ -z ${MASTODON_VERSION+x} ]; then \
@@ -42,23 +48,64 @@ RUN \
   fi && \
   curl -s -o \
     /tmp/mastodon.tar.gz -L \
-    "https://github.com/mastodon/mastodon/archive/refs/tags/${MASTODON_VERSION}.tar.gz" && \
+    "https://github.com/mastodon/mastodon/archive/${MASTODON_VERSION}.tar.gz" && \
   tar xf \
     /tmp/mastodon.tar.gz -C \
     /app/www/ --strip-components=1 && \
   cd /app/www && \
   bundle config set --local deployment 'true' && \
-  bundle config set --local without 'development test' && \
+  bundle config set --local without 'development test exclude' && \
   bundle config set silence_root_warning true && \
-  bundle install -j"$(nproc)" && \
-  yarn install --pure-lockfile && \
-  OTP_SECRET=precompile_placeholder SECRET_KEY_BASE=precompile_placeholder rails assets:precompile && \
+  bundle install -j"$(nproc)" --no-cache && \
+  npm install -g corepack && \
+  corepack enable && \
+  yarn workspaces focus --production @mastodon/mastodon && \
+  ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=precompile_placeholder \
+  ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=precompile_placeholder \
+  ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=precompile_placeholder \
+  OTP_SECRET=precompile_placeholder \
+  SECRET_KEY_BASE=precompile_placeholder \
+  bundle exec rails assets:precompile && \
+  bundle exec bootsnap precompile --gemfile app/ lib/ && \
+  rm -rf /app/www/node_modules && \
+  cd streaming && \
+  yarn workspaces focus --production @mastodon/streaming && \
+  printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version && \
   echo "**** cleanup ****" && \
+  yarn cache clean && \
   apk del --purge \
     build-dependencies && \
-  yarn cache clean && \
+  # Remove assets not needed in runtime because they were compiled & copied to public
+  rm -r \
+    /app/www/app/javascript/fonts \
+    /app/www/app/javascript/icons \
+    /app/www/app/javascript/styles && \
   rm -rf \
-    /tmp/*
+    # Remove vendored sources for building native extensions.
+    /app/www/vendor/bundle/ruby/*/gems/hiredis-*/vendor/hiredis \
+    /app/www/vendor/bundle/ruby/*/gems/nokogiri-*/gumbo-parser \
+    /app/www/vendor/bundle/ruby/*/gems/nokogiri-*/patches \
+    /app/www/vendor/bundle/ruby/*/gems/pghero-*/app/assets \
+    # Remove build logs, temp files, and cache.
+    /app/www/vendor/bundle/ruby/*/build_info/ \
+    /app/www/vendor/bundle/ruby/*/cache/ \
+    /app/www/tmp/cache \
+    $HOME/.bundle/cache \
+    $HOME/.composer \
+    /tmp/* && \
+	find /app/www/vendor/bundle/ruby/*/extensions/ \( -name gem_make.out -o -name mkmf.log \) -delete && \
+  # Remove tests, documentations and other useless files.
+	find /app/www/vendor/bundle/ruby/*/gems/ \( -name 'doc' \
+    -o -name 'spec' \
+    -o -name 'test' \) \
+		-type d -maxdepth 2 -exec rm -fr "{}" + && \
+	find /app/www/vendor/bundle/ruby/*/gems/ \( -name 'README*' \
+    -o -name 'CHANGELOG*' \
+    -o -name 'CONTRIBUT*' \
+    -o -name '*LICENSE*' \
+    -o -name 'Rakefile' \
+    -o -name '.*' \) \
+    -type f -delete
 
 COPY root/ /
 

Dockerfile.aarch64

@@ -1,41 +1,47 @@
-FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.15
+# syntax=docker/dockerfile:1
+
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.22
 
 ARG BUILD_DATE
 ARG VERSION
 ARG MASTODON_VERSION
 LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}"
-LABEL maintainer="TheSpad"
+LABEL maintainer="thespad"
 
 ENV RAILS_ENV="production" \
     NODE_ENV="production" \
-    PATH="${PATH}:/opt/ruby/bin:/opt/node/bin:/app/www/bin"
+    PATH="${PATH}:/app/www/bin" \
+    S6_STAGE2_HOOK="/init-hook" \
+    MASTODON_USE_LIBVIPS="true"
 
 RUN \
-  apk add -U --upgrade --no-cache \
+  apk add --no-cache \
     ffmpeg \
     file \
-    icu-libs \ 
-    imagemagick \
+    gcompat \
     libpq \
     libidn \
     nodejs \
     ruby \
     ruby-bundler \
-    yarn && \
+    ruby-rdoc \
+    vips \
+    vips-heif \
+    yaml && \
   apk add --no-cache --virtual=build-dependencies \
     build-base \
-    g++ \
-    gcc \
-    gcompat \
     icu-dev \
-    libidn-dev \    
+    libidn-dev \
     libpq-dev \
     libxml2-dev \
     libxslt-dev \
-    openssl-dev \
+    linux-headers \
     npm \
+    openssl-dev \
     python3-dev \
-    ruby-dev && \
+    ruby-dev \
+    vips-dev \
+    yaml-dev && \
   echo "**** install mastodon ****" && \
   mkdir -p /app/www && \
   if [ -z ${MASTODON_VERSION+x} ]; then \
@@ -44,24 +50,64 @@ RUN \
   fi && \
   curl -s -o \
     /tmp/mastodon.tar.gz -L \
-    "https://github.com/mastodon/mastodon/archive/refs/tags/${MASTODON_VERSION}.tar.gz" && \
+    "https://github.com/mastodon/mastodon/archive/${MASTODON_VERSION}.tar.gz" && \
   tar xf \
     /tmp/mastodon.tar.gz -C \
     /app/www/ --strip-components=1 && \
   cd /app/www && \
-  gem install nokogiri --platform=ruby -- --use-system-libraries && \
   bundle config set --local deployment 'true' && \
-  bundle config set --local without 'development test' && \
+  bundle config set --local without 'development test exclude' && \
   bundle config set silence_root_warning true && \
-  bundle install -j"$(nproc)" && \
-  yarn install --pure-lockfile && \
-  OTP_SECRET=precompile_placeholder SECRET_KEY_BASE=precompile_placeholder rails assets:precompile && \
+  bundle install -j"$(nproc)" --no-cache && \
+  npm install -g corepack && \
+  corepack enable && \
+  yarn workspaces focus --production @mastodon/mastodon && \
+  ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=precompile_placeholder \
+  ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=precompile_placeholder \
+  ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=precompile_placeholder \
+  OTP_SECRET=precompile_placeholder \
+  SECRET_KEY_BASE=precompile_placeholder \
+  bundle exec rails assets:precompile && \
+  bundle exec bootsnap precompile --gemfile app/ lib/ && \
+  rm -rf /app/www/node_modules && \
+  cd streaming && \
+  yarn workspaces focus --production @mastodon/streaming && \
+  printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version && \
   echo "**** cleanup ****" && \
+  yarn cache clean && \
   apk del --purge \
     build-dependencies && \
-  yarn cache clean && \
+  # Remove assets not needed in runtime because they were compiled & copied to public
+  rm -r \
+    /app/www/app/javascript/fonts \
+    /app/www/app/javascript/icons \
+    /app/www/app/javascript/styles && \
   rm -rf \
-    /tmp/*
+    # Remove vendored sources for building native extensions.
+    /app/www/vendor/bundle/ruby/*/gems/hiredis-*/vendor/hiredis \
+    /app/www/vendor/bundle/ruby/*/gems/nokogiri-*/gumbo-parser \
+    /app/www/vendor/bundle/ruby/*/gems/nokogiri-*/patches \
+    /app/www/vendor/bundle/ruby/*/gems/pghero-*/app/assets \
+    # Remove build logs, temp files, and cache.
+    /app/www/vendor/bundle/ruby/*/build_info/ \
+    /app/www/vendor/bundle/ruby/*/cache/ \
+    /app/www/tmp/cache \
+    $HOME/.bundle/cache \
+    $HOME/.composer \
+    /tmp/* && \
+	find /app/www/vendor/bundle/ruby/*/extensions/ \( -name gem_make.out -o -name mkmf.log \) -delete && \
+  # Remove tests, documentations and other useless files.
+	find /app/www/vendor/bundle/ruby/*/gems/ \( -name 'doc' \
+    -o -name 'spec' \
+    -o -name 'test' \) \
+		-type d -maxdepth 2 -exec rm -fr "{}" + && \
+	find /app/www/vendor/bundle/ruby/*/gems/ \( -name 'README*' \
+    -o -name 'CHANGELOG*' \
+    -o -name 'CONTRIBUT*' \
+    -o -name '*LICENSE*' \
+    -o -name 'Rakefile' \
+    -o -name '.*' \) \
+    -type f -delete
 
 COPY root/ /
 

Dockerfile.armhf

@@ -1,11 +0,0 @@
-FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm32v7-3.15
-
-ARG BUILD_DATE
-ARG VERSION
-ARG MASTODON_VERSION
-LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}"
-LABEL maintainer="TheSpad"
-
-# This image does not support armhf
-
-COPY root/ /

README.md

@@ -1,12 +1,10 @@
-<!-- DO NOT EDIT THIS FILE MANUALLY  -->
-<!-- Please read the https://github.com/linuxserver/docker-mastodon/blob/main/.github/CONTRIBUTING.md -->
-
+<!-- DO NOT EDIT THIS FILE MANUALLY -->
+<!-- Please read https://github.com/linuxserver/docker-mastodon/blob/main/.github/CONTRIBUTING.md -->
 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)](https://linuxserver.io)
 
 [![Blog](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=Blog)](https://blog.linuxserver.io "all the things you can do with our containers including How-To guides, opinions and much more!")
-[![Discord](https://img.shields.io/discord/354974912613449730.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=Discord&logo=discord)](https://discord.gg/YWrKVTn "realtime support / chat with the community and the team.")
+[![Discord](https://img.shields.io/discord/354974912613449730.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=Discord&logo=discord)](https://linuxserver.io/discord "realtime support / chat with the community and the team.")
 [![Discourse](https://img.shields.io/discourse/https/discourse.linuxserver.io/topics.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&logo=discourse)](https://discourse.linuxserver.io "post on our community forum.")
-[![Fleet](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=Fleet)](https://fleet.linuxserver.io "an online web interface which displays all of our maintained images.")
 [![GitHub](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitHub&logo=github)](https://github.com/linuxserver "view the source for all of our repositories.")
 [![Open Collective](https://img.shields.io/opencollective/all/linuxserver.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=Supporters&logo=open%20collective)](https://opencollective.com/linuxserver "please consider helping us by either donating or contributing to our budget")
 
@@ -21,15 +19,14 @@ The [LinuxServer.io](https://linuxserver.io) team brings you another container r
 Find us at:
 
 * [Blog](https://blog.linuxserver.io) - all the things you can do with our containers including How-To guides, opinions and much more!
-* [Discord](https://discord.gg/YWrKVTn) - realtime support / chat with the community and the team.
+* [Discord](https://linuxserver.io/discord) - realtime support / chat with the community and the team.
 * [Discourse](https://discourse.linuxserver.io) - post on our community forum.
-* [Fleet](https://fleet.linuxserver.io) - an online web interface which displays all of our maintained images.
 * [GitHub](https://github.com/linuxserver) - view the source for all of our repositories.
 * [Open Collective](https://opencollective.com/linuxserver) - please consider helping us by either donating or contributing to our budget
 
 # [linuxserver/mastodon](https://github.com/linuxserver/docker-mastodon)
 
-[![Scarf.io pulls](https://scarf.sh/installs-badge/linuxserver-ci/linuxserver%2Fmastodon?color=94398d&label-color=555555&logo-color=ffffff&style=for-the-badge&package-type=docker)](https://scarf.sh/gateway/linuxserver-ci/docker/linuxserver%2Fmastodon)
+[![Scarf.io pulls](https://scarf.sh/installs-badge/linuxserver-ci/linuxserver%2Fmastodon?color=94398d&label-color=555555&logo-color=ffffff&style=for-the-badge&package-type=docker)](https://scarf.sh)
 [![GitHub Stars](https://img.shields.io/github/stars/linuxserver/docker-mastodon.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&logo=github)](https://github.com/linuxserver/docker-mastodon)
 [![GitHub Release](https://img.shields.io/github/release/linuxserver/docker-mastodon.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&logo=github)](https://github.com/linuxserver/docker-mastodon/releases)
 [![GitHub Package Repository](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitHub%20Package&logo=github)](https://github.com/linuxserver/docker-mastodon/packages)
@@ -45,7 +42,7 @@ Find us at:
 
 ## Supported Architectures
 
-We utilise the docker manifest for multi-platform awareness. More information is available from docker [here](https://github.com/docker/distribution/blob/master/docs/spec/manifest-v2-2.md#manifest-list) and our announcement [here](https://blog.linuxserver.io/2019/02/21/the-lsio-pipeline-project/).
+We utilise the docker manifest for multi-platform awareness. More information is available from docker [here](https://distribution.github.io/distribution/spec/manifest-v2-2/#manifest-list) and our announcement [here](https://blog.linuxserver.io/2019/02/21/the-lsio-pipeline-project/).
 
 Simply pulling `lscr.io/linuxserver/mastodon:latest` should retrieve the correct image for your arch, but you can also pull specific arch images via tags.
 
@@ -55,13 +52,32 @@ The architectures supported by this image are:
 | :----: | :----: | ---- |
 | x86-64 | ✅ | amd64-\<version tag\> |
 | arm64 | ✅ | arm64v8-\<version tag\> |
-| armhf| ❌ | |
+
+## Version Tags
+
+This image provides various versions that are available via tags. Please read the descriptions carefully and exercise caution when using unstable or development tags.
+
+| Tag | Available | Description |
+| :----: | :----: |--- |
+| latest | ✅ | Stable releases. |
+| develop | ✅ | Pre-releases *only*. |
+| glitch | ✅ | [glitch-soc](https://github.com/glitch-soc/mastodon) fork releases. |
 
 ## Application Setup
 
-To generate keys for `SECRET_KEY_BASE` & `OTP_SECRET` run `docker run --rm -it -w /app/www --entrypoint rake lscr.io/linuxserver/mastodon secret` once for each.
+We provide aliases for the common commands that execute in the correct context so that environment variables from secrets are available to them:
 
-To generate keys for `VAPID_PRIVATE_KEY` & `VAPID_PUBLIC_KEY` run `docker run --rm -it -w /app/www --entrypoint rake lscr.io/linuxserver/mastodon mastodon:webpush:generate_vapid_key`
+* To generate keys for `SECRET_KEY_BASE` & `OTP_SECRET` run `docker run --rm -it --entrypoint /bin/bash lscr.io/linuxserver/mastodon:latest generate-secret` once for each.
+
+* To generate keys for `VAPID_PRIVATE_KEY` & `VAPID_PUBLIC_KEY` run `docker run --rm -it --entrypoint /bin/bash lscr.io/linuxserver/mastodon:latest generate-vapid`
+
+* To generate keys for `ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY`, `ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT`, & `ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY` run `docker run --rm -it --entrypoint /bin/bash lscr.io/linuxserver/mastodon:latest generate-active-record`
+
+Both of the secret generation aliases above can be run without any other setup having been carried out.
+
+* To use `tootctl` you can run something like `docker exec -it lscr.io/linuxserver/mastodon /tootctl <command>`
+
+Using `tootctl` requires you to complete the initial Mastodon configuration first.
 
 This container *requires* separate postgres and redis instances to run.
 
@@ -69,15 +85,33 @@ We support all of the official [environment variables](https://docs.joinmastodon
 
 For more information check out the [mastodon documentation](https://docs.joinmastodon.org/).
 
+### Running separate sidekiq instances
+
+It is currently only supported to run a single queue per container instance *or* all queues in a single container instance.
+
+All containers must share the same `/config` mount and be on a common docker network.
+
+### NO_CHOWN Option
+
+On larger Mastodon instances, our init process to verify that permissions are set correctly can noticeably slow down the container startup. If you are experiencing this, you can set `NO_CHOWN` to `true` to skip that step of the init.
+
+*Do NOT set this on first run of the container. If you enable this option you are taking full responsibility for ensuring that the permissions in your /config mount are correct. If you're even slightly unsure, don't set it.*
+
+### Strict reverse proxies
+
+This image automatically redirects to https with a self-signed certificate. If you are using a reverse proxy which validates certificates, you need to [disable this check for the container](https://docs.linuxserver.io/faq#strict-proxy).
+
 ## Usage
 
-Here are some example snippets to help you get started creating a container.
+To help you get started creating a container from this image you can either use docker-compose or the docker cli.
+
+>[!NOTE]
+>Unless a parameter is flaged as 'optional', it is *mandatory* and a value must be provided.
 
 ### docker-compose (recommended, [click here for more info](https://docs.linuxserver.io/general/docker-compose))
 
 ```yaml
 ---
-version: "2.1"
 services:
   mastodon:
     image: lscr.io/linuxserver/mastodon:latest
@@ -85,7 +119,7 @@ services:
     environment:
       - PUID=1000
       - PGID=1000
-      - TZ=America/New_York
+      - TZ=Etc/UTC
       - LOCAL_DOMAIN=example.com
       - REDIS_HOST=redis
       - REDIS_PORT=6379
@@ -95,6 +129,9 @@ services:
       - DB_PASS=mastodon
       - DB_PORT=5432
       - ES_ENABLED=false
+      - ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=
+      - ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=
+      - ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=
       - SECRET_KEY_BASE=
       - OTP_SECRET=
       - VAPID_PRIVATE_KEY=
@@ -114,11 +151,19 @@ services:
       - AWS_ACCESS_KEY_ID= #optional
       - AWS_SECRET_ACCESS_KEY= #optional
       - S3_ALIAS_HOST= #optional
+      - SIDEKIQ_ONLY=false #optional
+      - SIDEKIQ_QUEUE= #optional
+      - SIDEKIQ_DEFAULT=false #optional
+      - SIDEKIQ_THREADS=5 #optional
+      - DB_POOL=5 #optional
+      - NO_CHOWN= #optional
+      - MASTODON_PROMETHEUS_EXPORTER_ENABLED= #optional
     volumes:
-      - /path/to/appdata/config:/config
+      - /path/to/mastodon/config:/config
     ports:
       - 80:80
       - 443:443
+      - 9394:9394 #optional
     restart: unless-stopped
 ```
 
@@ -129,7 +174,7 @@ docker run -d \
   --name=mastodon \
   -e PUID=1000 \
   -e PGID=1000 \
-  -e TZ=America/New_York \
+  -e TZ=Etc/UTC \
   -e LOCAL_DOMAIN=example.com \
   -e REDIS_HOST=redis \
   -e REDIS_PORT=6379 \
@@ -139,6 +184,9 @@ docker run -d \
   -e DB_PASS=mastodon \
   -e DB_PORT=5432 \
   -e ES_ENABLED=false \
+  -e ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY= \
+  -e ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY= \
+  -e ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT= \
   -e SECRET_KEY_BASE= \
   -e OTP_SECRET= \
   -e VAPID_PRIVATE_KEY= \
@@ -158,24 +206,33 @@ docker run -d \
   -e AWS_ACCESS_KEY_ID= `#optional` \
   -e AWS_SECRET_ACCESS_KEY= `#optional` \
   -e S3_ALIAS_HOST= `#optional` \
+  -e SIDEKIQ_ONLY=false `#optional` \
+  -e SIDEKIQ_QUEUE= `#optional` \
+  -e SIDEKIQ_DEFAULT=false `#optional` \
+  -e SIDEKIQ_THREADS=5 `#optional` \
+  -e DB_POOL=5 `#optional` \
+  -e NO_CHOWN= `#optional` \
+  -e MASTODON_PROMETHEUS_EXPORTER_ENABLED= `#optional` \
   -p 80:80 \
   -p 443:443 \
-  -v /path/to/appdata/config:/config \
+  -p 9394:9394 `#optional` \
+  -v /path/to/mastodon/config:/config \
   --restart unless-stopped \
   lscr.io/linuxserver/mastodon:latest
 ```
 
 ## Parameters
 
-Container images are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate `<external>:<internal>` respectively. For example, `-p 8080:80` would expose port `80` from inside the container to be accessible from the host's IP on port `8080` outside the container.
+Containers are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate `<external>:<internal>` respectively. For example, `-p 8080:80` would expose port `80` from inside the container to be accessible from the host's IP on port `8080` outside the container.
 
 | Parameter | Function |
 | :----: | --- |
-| `-p 80` | Port for web frontend |
-| `-p 443` | Port for web frontend |
+| `-p 80:80` | Port for web frontend |
+| `-p 443:443` | Port for web frontend |
+| `-p 9394` | Port for Prometheus metrics |
 | `-e PUID=1000` | for UserID - see below for explanation |
 | `-e PGID=1000` | for GroupID - see below for explanation |
-| `-e TZ=America/New_York` | Specify a timezone to use EG America/New_York |
+| `-e TZ=Etc/UTC` | specify a timezone to use, see this [list](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List). |
 | `-e LOCAL_DOMAIN=example.com` | This is the unique identifier of your server in the network. It cannot be safely changed later. |
 | `-e REDIS_HOST=redis` | Redis server hostname |
 | `-e REDIS_PORT=6379` | Redis port |
@@ -183,19 +240,22 @@ Container images are configured using parameters passed at runtime (such as thos
 | `-e DB_USER=mastodon` | Postgres username |
 | `-e DB_NAME=mastodon` | Postgres db name |
 | `-e DB_PASS=mastodon` | Postgres password |
-| `-e DB_PORT=5432` | Portgres port |
+| `-e DB_PORT=5432` | Postgres port |
 | `-e ES_ENABLED=false` | Enable or disable Elasticsearch (requires a separate ES instance) |
+| `-e ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=` | Primary key for [Active Record Encryption](https://github.com/mastodon/mastodon/pull/29831/files). |
+| `-e ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=` | Deterministic key for [Active Record Encryption](https://github.com/mastodon/mastodon/pull/29831/files). |
+| `-e ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=` | Derivation salt for [Active Record Encryption](https://github.com/mastodon/mastodon/pull/29831/files). |
 | `-e SECRET_KEY_BASE=` | Browser session secret. Changing it will break all active browser sessions. |
-| `-e OTP_SECRET=` | MFA secret. Changing it will break two-factor authentication. |
-| `-e VAPID_PRIVATE_KEY=` | Push notification private key. Changing it will break push notifications. |
-| `-e VAPID_PUBLIC_KEY=` | Push notification public key. Changing it will break push notifications. |
+| `-e OTP_SECRET=` | MFA secret. Changing it after initial setup will break two-factor authentication. |
+| `-e VAPID_PRIVATE_KEY=` | Push notification private key. Changing it after initial setup will break push notifications. |
+| `-e VAPID_PUBLIC_KEY=` | Push notification public key. Changing it after initial setup will break push notifications. |
 | `-e SMTP_SERVER=mail.example.com` | SMTP server for email notifications |
 | `-e SMTP_PORT=25` | SMTP server port |
 | `-e SMTP_LOGIN=` | SMTP username |
 | `-e SMTP_PASSWORD=` | SMTP password |
 | `-e SMTP_FROM_ADDRESS=notifications@example.com` | From address for emails send from Mastodon |
 | `-e S3_ENABLED=false` | Enable or disable S3 storage of uploaded files |
-| `-e WEB_DOMAIN=mastodon.example.com` | This can be set if you want your server identifier to be different to the subdomain hosting Mastodon. See https://docs.joinmastodon.org/admin/config/#basic |
+| `-e WEB_DOMAIN=mastodon.example.com` | This can be set if you want your server identifier to be different to the subdomain hosting Mastodon. See [https://docs.joinmastodon.org/admin/config/#basic](https://docs.joinmastodon.org/admin/config/#basic) |
 | `-e ES_HOST=es` | Elasticsearch server hostname |
 | `-e ES_PORT=9200` | Elasticsearch port |
 | `-e ES_USER=elastic` | Elasticsearch username |
@@ -204,6 +264,13 @@ Container images are configured using parameters passed at runtime (such as thos
 | `-e AWS_ACCESS_KEY_ID=` | S3 bucket access key ID |
 | `-e AWS_SECRET_ACCESS_KEY=` | S3 bucket secret access key |
 | `-e S3_ALIAS_HOST=` | Alternate hostname for object fetching if you are front the S3 connections. |
+| `-e SIDEKIQ_ONLY=false` | Only run the sidekiq service in this container instance. For large scale instances that need better queue handling. |
+| `-e SIDEKIQ_QUEUE=` | The name of the sidekiq queue to run in this container. See [notes](https://docs.joinmastodon.org/admin/scaling/#sidekiq-queues). |
+| `-e SIDEKIQ_DEFAULT=false` | Set to `true` on the main container if you're running additional sidekiq instances. It will run the `default` queue. |
+| `-e SIDEKIQ_THREADS=5` | The number of threads for sidekiq to use. See [notes](https://docs.joinmastodon.org/admin/scaling/#sidekiq-threads). |
+| `-e DB_POOL=5` | The size of the DB connection pool, must be *at least* the same as `SIDEKIQ_THREADS`. See [notes](https://docs.joinmastodon.org/admin/scaling/#sidekiq-threads). |
+| `-e NO_CHOWN=` | Set to `true` to skip chown of /config on init. *READ THE APPLICATION NOTES BEFORE SETTING THIS*. |
+| `-e MASTODON_PROMETHEUS_EXPORTER_ENABLED=` | If set to `true`, Mastodon’s Ruby processes (web & Sidekiq) will enable the Prometheus instrumentation. |
 | `-v /config` | Contains all relevant configuration files. |
 
 ## Environment variables from files (Docker secrets)
@@ -213,10 +280,10 @@ You can set any environment variable from a file by using a special prepend `FIL
 As an example:
 
 ```bash
--e FILE__PASSWORD=/run/secrets/mysecretpassword
+-e FILE__MYVAR=/run/secrets/mysecretvariable
 ```
 
-Will set the environment variable `PASSWORD` based on the contents of the `/run/secrets/mysecretpassword` file.
+Will set the environment variable `MYVAR` based on the contents of the `/run/secrets/mysecretvariable` file.
 
 ## Umask for running applications
 
@@ -225,15 +292,20 @@ Keep in mind umask is not chmod it subtracts from permissions based on it's valu
 
 ## User / Group Identifiers
 
-When using volumes (`-v` flags) permissions issues can arise between the host OS and the container, we avoid this issue by allowing you to specify the user `PUID` and group `PGID`.
+When using volumes (`-v` flags), permissions issues can arise between the host OS and the container, we avoid this issue by allowing you to specify the user `PUID` and group `PGID`.
 
 Ensure any volume directories on the host are owned by the same user you specify and any permissions issues will vanish like magic.
 
-In this instance `PUID=1000` and `PGID=1000`, to find yours use `id user` as below:
+In this instance `PUID=1000` and `PGID=1000`, to find yours use `id your_user` as below:
 
 ```bash
-  $ id username
-    uid=1000(dockeruser) gid=1000(dockergroup) groups=1000(dockergroup)
+id your_user
+```
+
+Example output:
+
+```text
+uid=1000(your_user) gid=1000(your_user) groups=1000(your_user)
 ```
 
 ## Docker Mods
@@ -244,53 +316,101 @@ We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to
 
 ## Support Info
 
-* Shell access whilst the container is running: `docker exec -it mastodon /bin/bash`
-* To monitor the logs of the container in realtime: `docker logs -f mastodon`
-* container version number
-  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' mastodon`
-* image version number
-  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' lscr.io/linuxserver/mastodon:latest`
+* Shell access whilst the container is running:
+
+    ```bash
+    docker exec -it mastodon /bin/bash
+    ```
+
+* To monitor the logs of the container in realtime:
+
+    ```bash
+    docker logs -f mastodon
+    ```
+
+* Container version number:
+
+    ```bash
+    docker inspect -f '{{ index .Config.Labels "build_version" }}' mastodon
+    ```
+
+* Image version number:
+
+    ```bash
+    docker inspect -f '{{ index .Config.Labels "build_version" }}' lscr.io/linuxserver/mastodon:latest
+    ```
 
 ## Updating Info
 
-Most of our images are static, versioned, and require an image update and container recreation to update the app inside. With some exceptions (ie. nextcloud, plex), we do not recommend or support updating apps inside the container. Please consult the [Application Setup](#application-setup) section above to see if it is recommended for the image.
+Most of our images are static, versioned, and require an image update and container recreation to update the app inside. With some exceptions (noted in the relevant readme.md), we do not recommend or support updating apps inside the container. Please consult the [Application Setup](#application-setup) section above to see if it is recommended for the image.
 
 Below are the instructions for updating containers:
 
 ### Via Docker Compose
 
-* Update all images: `docker-compose pull`
-  * or update a single image: `docker-compose pull mastodon`
-* Let compose update all containers as necessary: `docker-compose up -d`
-  * or update a single container: `docker-compose up -d mastodon`
-* You can also remove the old dangling images: `docker image prune`
+* Update images:
+    * All images:
+
+        ```bash
+        docker-compose pull
+        ```
+
+    * Single image:
+
+        ```bash
+        docker-compose pull mastodon
+        ```
+
+* Update containers:
+    * All containers:
+
+        ```bash
+        docker-compose up -d
+        ```
+
+    * Single container:
+
+        ```bash
+        docker-compose up -d mastodon
+        ```
+
+* You can also remove the old dangling images:
+
+    ```bash
+    docker image prune
+    ```
 
 ### Via Docker Run
 
-* Update the image: `docker pull lscr.io/linuxserver/mastodon:latest`
-* Stop the running container: `docker stop mastodon`
-* Delete the container: `docker rm mastodon`
+* Update the image:
+
+    ```bash
+    docker pull lscr.io/linuxserver/mastodon:latest
+    ```
+
+* Stop the running container:
+
+    ```bash
+    docker stop mastodon
+    ```
+
+* Delete the container:
+
+    ```bash
+    docker rm mastodon
+    ```
+
 * Recreate a new container with the same docker run parameters as instructed above (if mapped correctly to a host folder, your `/config` folder and settings will be preserved)
-* You can also remove the old dangling images: `docker image prune`
+* You can also remove the old dangling images:
 
-### Via Watchtower auto-updater (only use if you don't remember the original parameters)
-
-* Pull the latest image at its tag and replace it with the same env variables in one run:
-
-  ```bash
-  docker run --rm \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  containrrr/watchtower \
-  --run-once mastodon
-  ```
-
-* You can also remove the old dangling images: `docker image prune`
-
-**Note:** We do not endorse the use of Watchtower as a solution to automated updates of existing Docker containers. In fact we generally discourage automated updates. However, this is a useful tool for one-time manual updates of containers where you have forgotten the original parameters. In the long term, we highly recommend using [Docker Compose](https://docs.linuxserver.io/general/docker-compose).
+    ```bash
+    docker image prune
+    ```
 
 ### Image Update Notifications - Diun (Docker Image Update Notifier)
 
-* We recommend [Diun](https://crazymax.dev/diun/) for update notifications. Other tools that automatically update containers unattended are not recommended or supported.
+>[!TIP]
+>We recommend [Diun](https://crazymax.dev/diun/) for update notifications. Other tools that automatically update containers unattended are not recommended or supported.
 
 ## Building locally
 
@@ -305,14 +425,24 @@ docker build \
   -t lscr.io/linuxserver/mastodon:latest .
 ```
 
-The ARM variants can be built on x86_64 hardware using `multiarch/qemu-user-static`
+The ARM variants can be built on x86_64 hardware and vice versa using `lscr.io/linuxserver/qemu-static`
 
 ```bash
-docker run --rm --privileged multiarch/qemu-user-static:register --reset
+docker run --rm --privileged lscr.io/linuxserver/qemu-static --reset
 ```
 
 Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64`.
 
 ## Versions
 
+* **21.10.25:** - Add prometheus exporter support.
+* **20.10.25:** - Add vips-heif.
+* **08.07.25:** - Rebase to Alpine 3.22.
+* **06.06.25:** - Rebase to Alpine 3.21, replace deprecated imagemagick with vips.
+* **08.10.24:** - Rebase to Alpine 3.20, enable [Active Record Encryption](https://github.com/mastodon/mastodon/pull/29831/files). Existing users should update their nginx confs to avoid http2 deprecation warnings.
+* **21.09.23:** - Rebase to Alpine 3.18, migrate to s6v3.
+* **25.05.23:** - Adjust apk flags.
+* **09.02.23:** - Add Glitch branch.
+* **09.01.23:** - Updated nginx conf to fix bring inline with Mastodon configuration (fixes Elk integration).
+* **19.12.22:** - Support separate sidekiq queue instances.
 * **05.11.22:** - Initial Release.

jenkins-vars.yml

@@ -6,6 +6,7 @@ external_type: github_stable
 release_type: stable
 release_tag: latest
 ls_branch: main
+image_builder: default
 repo_vars:
   - EXT_GIT_BRANCH = 'main'
   - EXT_USER = 'mastodon'
@@ -23,8 +24,7 @@ repo_vars:
   - CI_WEB='false'
   - CI_PORT='80'
   - CI_SSL='false'
-  - CI_DELAY='120'
-  - CI_DOCKERENV='TZ=US/Pacific'
+  - CI_DELAY='60'
+  - CI_DOCKERENV=''
   - CI_AUTH=''
   - CI_WEBPATH=''
-  

readme-vars.yml

@@ -6,68 +6,89 @@ project_url: "https://github.com/mastodon/mastodon/"
 project_logo: "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mastodon-banner.png"
 project_blurb: |
   [{{ project_name|capitalize }}]({{ project_url }}) is a free, open-source social network server based on ActivityPub where users can follow friends and discover new ones..
-
 project_lsio_github_repo_url: "https://github.com/linuxserver/docker-{{ project_name }}"
-
+project_categories: "Social"
 # supported architectures
 available_architectures:
-  - { arch: "{{ arch_x86_64 }}", tag: "amd64-latest"}
-  - { arch: "{{ arch_arm64 }}", tag: "arm64v8-latest"}
-
+  - {arch: "{{ arch_x86_64 }}", tag: "amd64-latest"}
+  - {arch: "{{ arch_arm64 }}", tag: "arm64v8-latest"}
+# development version
+development_versions: true
+development_versions_items:
+  - {tag: "latest", desc: "Stable releases."}
+  - {tag: "develop", desc: "Pre-releases *only*."}
+  - {tag: "glitch", desc: "[glitch-soc](https://github.com/glitch-soc/mastodon) fork releases."}
 # container parameters
 common_param_env_vars_enabled: true
 param_container_name: "{{ project_name }}"
-
 param_usage_include_env: true
 param_env_vars:
-  - { env_var: "TZ", env_value: "America/New_York", desc: "Specify a timezone to use EG America/New_York"}
-  - { env_var: "LOCAL_DOMAIN", env_value: "example.com", desc: "This is the unique identifier of your server in the network. It cannot be safely changed later."}
-  - { env_var: "REDIS_HOST", env_value: "redis", desc: "Redis server hostname"}
-  - { env_var: "REDIS_PORT", env_value: "6379", desc: "Redis port"}
-  - { env_var: "DB_HOST", env_value: "db", desc: "Postgres database hostname"}
-  - { env_var: "DB_USER", env_value: "mastodon", desc: "Postgres username"}
-  - { env_var: "DB_NAME", env_value: "mastodon", desc: "Postgres db name"}
-  - { env_var: "DB_PASS", env_value: "mastodon", desc: "Postgres password"}
-  - { env_var: "DB_PORT", env_value: "5432", desc: "Portgres port"}
-  - { env_var: "ES_ENABLED", env_value: "false", desc: "Enable or disable Elasticsearch (requires a separate ES instance)"}
-  - { env_var: "SECRET_KEY_BASE", env_value: "", desc: "Browser session secret. Changing it will break all active browser sessions."}
-  - { env_var: "OTP_SECRET", env_value: "", desc: "MFA secret. Changing it will break two-factor authentication."}
-  - { env_var: "VAPID_PRIVATE_KEY", env_value: "", desc: "Push notification private key. Changing it will break push notifications."}
-  - { env_var: "VAPID_PUBLIC_KEY", env_value: "", desc: "Push notification public key. Changing it will break push notifications."}
-  - { env_var: "SMTP_SERVER", env_value: "mail.example.com", desc: "SMTP server for email notifications"}
-  - { env_var: "SMTP_PORT", env_value: "25", desc: "SMTP server port"}
-  - { env_var: "SMTP_LOGIN", env_value: "", desc: "SMTP username"}
-  - { env_var: "SMTP_PASSWORD", env_value: "", desc: "SMTP password"}
-  - { env_var: "SMTP_FROM_ADDRESS", env_value: "notifications@example.com", desc: "From address for emails send from Mastodon"}
-  - { env_var: "S3_ENABLED", env_value: "false", desc: "Enable or disable S3 storage of uploaded files"}
-
+  - {env_var: "LOCAL_DOMAIN", env_value: "example.com", desc: "This is the unique identifier of your server in the network. It cannot be safely changed later."}
+  - {env_var: "REDIS_HOST", env_value: "redis", desc: "Redis server hostname"}
+  - {env_var: "REDIS_PORT", env_value: "6379", desc: "Redis port"}
+  - {env_var: "DB_HOST", env_value: "db", desc: "Postgres database hostname"}
+  - {env_var: "DB_USER", env_value: "mastodon", desc: "Postgres username"}
+  - {env_var: "DB_NAME", env_value: "mastodon", desc: "Postgres db name"}
+  - {env_var: "DB_PASS", env_value: "mastodon", desc: "Postgres password"}
+  - {env_var: "DB_PORT", env_value: "5432", desc: "Postgres port"}
+  - {env_var: "ES_ENABLED", env_value: "false", desc: "Enable or disable Elasticsearch (requires a separate ES instance)"}
+  - {env_var: "ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY", env_value: "", desc: "Primary key for [Active Record Encryption](https://github.com/mastodon/mastodon/pull/29831/files)."}
+  - {env_var: "ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY", env_value: "", desc: "Deterministic key for [Active Record Encryption](https://github.com/mastodon/mastodon/pull/29831/files)."}
+  - {env_var: "ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT", env_value: "", desc: "Derivation salt for [Active Record Encryption](https://github.com/mastodon/mastodon/pull/29831/files)."}
+  - {env_var: "SECRET_KEY_BASE", env_value: "", desc: "Browser session secret. Changing it will break all active browser sessions."}
+  - {env_var: "OTP_SECRET", env_value: "", desc: "MFA secret. Changing it after initial setup will break two-factor authentication."}
+  - {env_var: "VAPID_PRIVATE_KEY", env_value: "", desc: "Push notification private key. Changing it after initial setup will break push notifications."}
+  - {env_var: "VAPID_PUBLIC_KEY", env_value: "", desc: "Push notification public key. Changing it after initial setup will break push notifications."}
+  - {env_var: "SMTP_SERVER", env_value: "mail.example.com", desc: "SMTP server for email notifications"}
+  - {env_var: "SMTP_PORT", env_value: "25", desc: "SMTP server port"}
+  - {env_var: "SMTP_LOGIN", env_value: "", desc: "SMTP username"}
+  - {env_var: "SMTP_PASSWORD", env_value: "", desc: "SMTP password"}
+  - {env_var: "SMTP_FROM_ADDRESS", env_value: "notifications@example.com", desc: "From address for emails send from Mastodon"}
+  - {env_var: "S3_ENABLED", env_value: "false", desc: "Enable or disable S3 storage of uploaded files"}
 opt_param_usage_include_env: true
 opt_param_env_vars:
-  - { env_var: "WEB_DOMAIN", env_value: "mastodon.example.com", desc: "This can be set if you want your server identifier to be different to the subdomain hosting Mastodon. See https://docs.joinmastodon.org/admin/config/#basic"}
-  - { env_var: "ES_HOST", env_value: "es", desc: "Elasticsearch server hostname"}
-  - { env_var: "ES_PORT", env_value: "9200", desc: "Elasticsearch port"}
-  - { env_var: "ES_USER", env_value: "elastic", desc: "Elasticsearch username"}
-  - { env_var: "ES_PASS", env_value: "elastic", desc: "Elasticsearch password"}
-  - { env_var: "S3_BUCKET", env_value: "", desc: "S3 bucket hostname"}
-  - { env_var: "AWS_ACCESS_KEY_ID", env_value: "", desc: "S3 bucket access key ID"}
-  - { env_var: "AWS_SECRET_ACCESS_KEY", env_value: "", desc: "S3 bucket secret access key"}
-  - { env_var: "S3_ALIAS_HOST", env_value: "", desc: "Alternate hostname for object fetching if you are front the S3 connections."}
-
+  - {env_var: "WEB_DOMAIN", env_value: "mastodon.example.com", desc: "This can be set if you want your server identifier to be different to the subdomain hosting Mastodon. See [https://docs.joinmastodon.org/admin/config/#basic](https://docs.joinmastodon.org/admin/config/#basic)"}
+  - {env_var: "ES_HOST", env_value: "es", desc: "Elasticsearch server hostname"}
+  - {env_var: "ES_PORT", env_value: "9200", desc: "Elasticsearch port"}
+  - {env_var: "ES_USER", env_value: "elastic", desc: "Elasticsearch username"}
+  - {env_var: "ES_PASS", env_value: "elastic", desc: "Elasticsearch password"}
+  - {env_var: "S3_BUCKET", env_value: "", desc: "S3 bucket hostname"}
+  - {env_var: "AWS_ACCESS_KEY_ID", env_value: "", desc: "S3 bucket access key ID"}
+  - {env_var: "AWS_SECRET_ACCESS_KEY", env_value: "", desc: "S3 bucket secret access key"}
+  - {env_var: "S3_ALIAS_HOST", env_value: "", desc: "Alternate hostname for object fetching if you are front the S3 connections."}
+  - {env_var: "SIDEKIQ_ONLY", env_value: "false", desc: "Only run the sidekiq service in this container instance. For large scale instances that need better queue handling."}
+  - {env_var: "SIDEKIQ_QUEUE", env_value: "", desc: "The name of the sidekiq queue to run in this container. See [notes](https://docs.joinmastodon.org/admin/scaling/#sidekiq-queues)."}
+  - {env_var: "SIDEKIQ_DEFAULT", env_value: "false", desc: "Set to `true` on the main container if you're running additional sidekiq instances. It will run the `default` queue."}
+  - {env_var: "SIDEKIQ_THREADS", env_value: "5", desc: "The number of threads for sidekiq to use. See [notes](https://docs.joinmastodon.org/admin/scaling/#sidekiq-threads)."}
+  - {env_var: "DB_POOL", env_value: "5", desc: "The size of the DB connection pool, must be *at least* the same as `SIDEKIQ_THREADS`. See [notes](https://docs.joinmastodon.org/admin/scaling/#sidekiq-threads)."}
+  - {env_var: "NO_CHOWN", env_value: "", desc: "Set to `true` to skip chown of /config on init. *READ THE APPLICATION NOTES BEFORE SETTING THIS*."}
+  - {env_var: "MASTODON_PROMETHEUS_EXPORTER_ENABLED", env_value: "", desc: "If set to `true`, Mastodon’s Ruby processes (web & Sidekiq) will enable the Prometheus instrumentation."}
 param_usage_include_ports: true
 param_ports:
-  - { external_port: "80", internal_port: "80", port_desc: "Port for web frontend" }
-  - { external_port: "443", internal_port: "443", port_desc: "Port for web frontend" }
-
+  - {external_port: "80", internal_port: "80", port_desc: "Port for web frontend"}
+  - {external_port: "443", internal_port: "443", port_desc: "Port for web frontend"}
+opt_param_usage_include_ports: true
+opt_param_ports:
+  - {external_port: "9394", internal_port: "9394", port_desc: "Port for Prometheus metrics"}
 param_usage_include_vols: true
 param_volumes:
-  - { vol_path: "/config", vol_host_path: "/path/to/appdata/config", desc: "Contains all relevant configuration files." }
-
+  - {vol_path: "/config", vol_host_path: "/path/to/{{ project_name }}/config", desc: "Contains all relevant configuration files."}
 # application setup block
 app_setup_block_enabled: true
 app_setup_block: |
-  To generate keys for `SECRET_KEY_BASE` & `OTP_SECRET` run `docker run --rm -it -w /app/www --entrypoint rake lscr.io/linuxserver/mastodon secret` once for each.
+  We provide aliases for the common commands that execute in the correct context so that environment variables from secrets are available to them:
 
-  To generate keys for `VAPID_PRIVATE_KEY` & `VAPID_PUBLIC_KEY` run `docker run --rm -it -w /app/www --entrypoint rake lscr.io/linuxserver/mastodon mastodon:webpush:generate_vapid_key`
+  * To generate keys for `SECRET_KEY_BASE` & `OTP_SECRET` run `docker run --rm -it --entrypoint /bin/bash lscr.io/linuxserver/mastodon:latest generate-secret` once for each.
+
+  * To generate keys for `VAPID_PRIVATE_KEY` & `VAPID_PUBLIC_KEY` run `docker run --rm -it --entrypoint /bin/bash lscr.io/linuxserver/mastodon:latest generate-vapid`
+
+  * To generate keys for `ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY`, `ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT`, & `ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY` run `docker run --rm -it --entrypoint /bin/bash lscr.io/linuxserver/mastodon:latest generate-active-record`
+
+  Both of the secret generation aliases above can be run without any other setup having been carried out.
+
+  * To use `tootctl` you can run something like `docker exec -it lscr.io/linuxserver/mastodon /tootctl <command>`
+
+  Using `tootctl` requires you to complete the initial Mastodon configuration first.
 
   This container *requires* separate postgres and redis instances to run.
 
@@ -75,6 +96,91 @@ app_setup_block: |
 
   For more information check out the [mastodon documentation](https://docs.joinmastodon.org/).
 
+  ### Running separate sidekiq instances
+
+  It is currently only supported to run a single queue per container instance *or* all queues in a single container instance.
+
+  All containers must share the same `/config` mount and be on a common docker network.
+
+  ### NO_CHOWN Option
+
+  On larger Mastodon instances, our init process to verify that permissions are set correctly can noticeably slow down the container startup. If you are experiencing this, you can set `NO_CHOWN` to `true` to skip that step of the init.
+
+  *Do NOT set this on first run of the container. If you enable this option you are taking full responsibility for ensuring that the permissions in your /config mount are correct. If you're even slightly unsure, don't set it.*
+
+  ### Strict reverse proxies
+
+  This image automatically redirects to https with a self-signed certificate. If you are using a reverse proxy which validates certificates, you need to [disable this check for the container](https://docs.linuxserver.io/faq#strict-proxy).
+# init diagram
+init_diagram: |
+  "mastodon:latest": {
+    docker-mods
+    base {
+      fix-attr +\nlegacy cont-init
+    }
+    docker-mods -> base
+    legacy-services
+    custom services
+    init-services -> legacy-services
+    init-services -> custom services
+    custom services -> legacy-services
+    legacy-services -> ci-service-check
+    init-migrations -> init-adduser
+    init-nginx-end -> init-config
+    init-os-end -> init-config
+    init-config -> init-config-end
+    init-crontab-config -> init-config-end
+    init-mastodon-config -> init-config-end
+    init-config -> init-crontab-config
+    init-mods-end -> init-custom-files
+    init-adduser -> init-device-perms
+    base -> init-envfile
+    init-os-end -> init-folders
+    init-php -> init-keygen
+    init-nginx-end -> init-mastodon-config
+    base -> init-migrations
+    init-config-end -> init-mods
+    init-mods-package-install -> init-mods-end
+    init-mods -> init-mods-package-install
+    init-samples -> init-nginx
+    init-version-checks -> init-nginx-end
+    init-adduser -> init-os-end
+    init-device-perms -> init-os-end
+    init-envfile -> init-os-end
+    init-keygen -> init-permissions
+    init-nginx -> init-php
+    init-folders -> init-samples
+    init-custom-files -> init-services
+    init-permissions -> init-version-checks
+    init-services -> svc-cron
+    svc-cron -> legacy-services
+    init-services -> svc-mastodon
+    svc-mastodon -> legacy-services
+    init-services -> svc-nginx
+    svc-nginx -> legacy-services
+    init-services -> svc-php-fpm
+    svc-php-fpm -> legacy-services
+    init-services -> svc-prom
+    svc-prom -> legacy-services
+    init-services -> svc-sidekiq
+    svc-sidekiq -> legacy-services
+    init-services -> svc-streaming
+    svc-streaming -> legacy-services
+  }
+  Base Images: {
+    "baseimage-alpine-nginx:3.22" <- "baseimage-alpine:3.22"
+  }
+  "mastodon:latest" <- Base Images
 # changelog
 changelogs:
-  - { date: "05.11.22:", desc: "Initial Release." }
+  - {date: "21.10.25:", desc: "Add prometheus exporter support."}
+  - {date: "20.10.25:", desc: "Add vips-heif."}
+  - {date: "08.07.25:", desc: "Rebase to Alpine 3.22."}
+  - {date: "06.06.25:", desc: "Rebase to Alpine 3.21, replace deprecated imagemagick with vips."}
+  - {date: "08.10.24:", desc: "Rebase to Alpine 3.20, enable [Active Record Encryption](https://github.com/mastodon/mastodon/pull/29831/files). Existing users should update their nginx confs to avoid http2 deprecation warnings."}
+  - {date: "21.09.23:", desc: "Rebase to Alpine 3.18, migrate to s6v3."}
+  - {date: "25.05.23:", desc: "Adjust apk flags."}
+  - {date: "09.02.23:", desc: "Add Glitch branch."}
+  - {date: "09.01.23:", desc: "Updated nginx conf to fix bring inline with Mastodon configuration (fixes Elk integration)."}
+  - {date: "19.12.22:", desc: "Support separate sidekiq queue instances."}
+  - {date: "05.11.22:", desc: "Initial Release."}

root-armhf/etc/cont-init.d/50-armless

@@ -1,15 +0,0 @@
-#!/usr/bin/with-contenv bash
-# shellcheck shell=bash
-
-cat <<-EOF
-    ********************************************************
-    ********************************************************
-    *                                                      *
-    *                         !!!!                         *
-    *         This Mastodon image does not support         *
-    *          32 bit ARM for performance reasons          *
-    *                                                      *
-    *                                                      *
-    ********************************************************
-    ********************************************************
-EOF

root/defaults/nginx/site-confs/default.conf.sample

@@ -1,4 +1,4 @@
-## Version 2022/11/07 - Changelog: https://github.com/linuxserver/docker-mastodon/commits/main/root/defaults/nginx/site-confs/default.conf.sample
+## Version 2024/08/26 - Changelog: https://github.com/linuxserver/docker-mastodon/commits/main/root/defaults/nginx/site-confs/default.conf.sample
 
 map $http_upgrade $connection_upgrade {
     default upgrade;
@@ -18,12 +18,13 @@ proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max
 server {
     listen 80 default_server;
     listen [::]:80 default_server;
-
-    listen 443 ssl http2 default_server;
-    listen [::]:443 ssl http2 default_server;
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
 
     server_name _;
 
+    include /config/nginx/ssl.conf;
+
     root /app/www/public;
 
     gzip on;
@@ -95,7 +96,7 @@ server {
         try_files $uri =404;
     }
 
-    location ^~ /api/v1/streaming/ {
+    location ^~ /api/v1/streaming {
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

root/etc/cont-init.d/50-config

@@ -1,18 +0,0 @@
-#!/usr/bin/with-contenv bash
-# shellcheck shell=bash
-
-mkdir -p \
-    /app/www/tmp \
-    /config/mastodon/public/system
-
-chown -R abc:abc \
-    /app/www/tmp
-
-ln -s /config/mastodon/public/system /app/www/public/system
-
-cd /app/www/ || exit 1
-
-s6-setuidgid abc /usr/bin/bundle exec rails db:prepare
-
-chown -R abc:abc \
-    /config

root/etc/s6-overlay/s6-rc.d/init-mastodon-config/run

@@ -0,0 +1,31 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+mkdir -p \
+    /app/www/tmp \
+    /config/mastodon/public/system
+
+lsiown -R abc:abc \
+    /app/www/tmp
+
+# Remove old pid in the event of an unclean shutdown
+if [[ -f /app/www/tmp/pids/server.pid ]]; then
+    rm /app/www/tmp/pids/server.pid
+fi
+
+if [[ ! -L "/app/www/public/system" ]]; then
+    rm -rf "/app/www/public/system"
+    ln -s "/config/mastodon/public/system" "/app/www/public/system"
+fi
+
+cd /app/www/ || exit 1
+
+# Don't run DB prep if this is a sidekiq-only container
+if [[ ${SIDEKIQ_ONLY,,} != "true" ]]; then
+    s6-setuidgid abc /usr/bin/bundle exec rails db:prepare
+fi
+
+if [[ ${NO_CHOWN,,} != "true" ]]; then
+    lsiown -R abc:abc \
+        /config
+fi

root/etc/s6-overlay/s6-rc.d/init-mastodon-config/type

@@ -0,0 +1 @@
+oneshot

root/etc/s6-overlay/s6-rc.d/init-mastodon-config/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-mastodon-config/run

root/etc/s6-overlay/s6-rc.d/svc-mastodon/notification-fd

@@ -0,0 +1 @@
+3

root/etc/s6-overlay/s6-rc.d/svc-mastodon/run

@@ -0,0 +1,10 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+export RAILS_ENV=production
+export PATH="${PATH}:/app/www/bin"
+export RAILS_SERVE_STATIC_FILES=false
+
+exec \
+    s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 3000" \
+    cd /app/www s6-setuidgid abc /usr/bin/bundle exec rails s -p 3000

root/etc/s6-overlay/s6-rc.d/svc-mastodon/type

@@ -0,0 +1 @@
+longrun

root/etc/s6-overlay/s6-rc.d/svc-prom/notification-fd

@@ -0,0 +1 @@
+5

root/etc/s6-overlay/s6-rc.d/svc-prom/run

@@ -0,0 +1,10 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+export RAILS_ENV=production
+export HOME=/config
+export PATH="${PATH}:/app/www/bin"
+
+exec \
+    s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost ${PROMETHEUS_EXPORTER_PORT:-9394}" \
+    cd /app/www s6-setuidgid abc /app/www/bin/prometheus_exporter

root/etc/s6-overlay/s6-rc.d/svc-prom/type

@@ -0,0 +1 @@
+longrun

root/etc/s6-overlay/s6-rc.d/svc-sidekiq/run

@@ -0,0 +1,30 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+export RAILS_ENV=production
+export PATH="${PATH}:/app/www/bin"
+
+if [[ -n ${SIDEKIQ_THREADS} ]]; then
+    SIDEKIQ_THREADS=$(printf '%d' "${SIDEKIQ_THREADS}")
+else
+    SIDEKIQ_THREADS=$(printf '%d' 5)
+fi
+
+cd /app/www || exit 1
+
+if [[ ${SIDEKIQ_ONLY,,} == "true" ]] && [[ -n ${SIDEKIQ_QUEUE} ]]; then
+    echo "*** Starting sidekiq handling ${SIDEKIQ_QUEUE} queue with ${SIDEKIQ_THREADS} threads ***"
+    exec \
+        s6-setuidgid abc /usr/bin/bundle exec "sidekiq -q ${SIDEKIQ_QUEUE} -c ${SIDEKIQ_THREADS}"
+elif [[ ${SIDEKIQ_ONLY,,} == "true" ]] && [[ -z ${SIDEKIQ_QUEUE} ]]; then
+    echo "*** No sidekiq queue specified, aborting ***"
+    sleep infinity
+elif [[ ${SIDEKIQ_DEFAULT,,} == "true" ]]; then
+    echo "*** Starting sidekiq handling default queue with ${SIDEKIQ_THREADS} threads ***"
+    exec \
+        s6-setuidgid abc /usr/bin/bundle exec "sidekiq -q default -c ${SIDEKIQ_THREADS}"
+else
+    echo "*** Starting sidekiq handling all queues with ${SIDEKIQ_THREADS} threads ***"
+    exec \
+        s6-setuidgid abc /usr/bin/bundle exec "sidekiq -c ${SIDEKIQ_THREADS}"
+fi

root/etc/s6-overlay/s6-rc.d/svc-sidekiq/type

@@ -0,0 +1 @@
+longrun

root/etc/s6-overlay/s6-rc.d/svc-streaming/notification-fd

@@ -0,0 +1 @@
+4

root/etc/s6-overlay/s6-rc.d/svc-streaming/run

@@ -0,0 +1,9 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+export NODE_ENV=production
+export PATH="${PATH}:/app/www/bin"
+
+exec \
+    s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 4000" \
+    cd /app/www s6-setuidgid abc node ./streaming

root/etc/s6-overlay/s6-rc.d/svc-streaming/type

@@ -0,0 +1 @@
+longrun

root/etc/services.d/mastodon/notification-fd

@@ -1 +0,0 @@
-3

root/etc/services.d/mastodon/run

@@ -1,10 +0,0 @@
-#!/usr/bin/with-contenv bash
-# shellcheck shell=bash
-
-RAILS_ENV=production
-PATH="${PATH}:/opt/ruby/bin:/opt/node/bin:/app/www/bin"
-RAILS_SERVE_STATIC_FILES=false
-
-exec \
-    s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 3000" \
-        cd /app/www s6-setuidgid abc /usr/bin/bundle exec rails s -p 3000

root/etc/services.d/sidekiq/run

@@ -1,10 +0,0 @@
-#!/usr/bin/with-contenv bash
-# shellcheck shell=bash
-
-RAILS_ENV=production
-PATH="${PATH}:/opt/ruby/bin:/opt/node/bin:/app/www/bin"
-
-cd /app/www || exit 1
-
-exec \
-    s6-setuidgid abc /usr/bin/bundle exec sidekiq

root/etc/services.d/streaming/notification-fd

@@ -1 +0,0 @@
-4

root/etc/services.d/streaming/run

@@ -1,9 +0,0 @@
-#!/usr/bin/with-contenv bash
-# shellcheck shell=bash
-
-NODE_ENV=production
-PATH="${PATH}:/opt/ruby/bin:/opt/node/bin:/app/www/bin"
-
-exec \
-    s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 4000" \
-        cd /app/www s6-setuidgid abc node ./streaming

root/generate-active-record

@@ -0,0 +1,6 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+cd /app/www || exit 1
+
+rake db:encryption:init

root/generate-secret

@@ -0,0 +1,6 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+cd /app/www || exit 1
+
+bundle exec rails secret

root/generate-vapid

@@ -0,0 +1,6 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+cd /app/www || exit 1
+
+bundle exec rails mastodon:webpush:generate_vapid_key

root/init-hook

@@ -0,0 +1,16 @@
+#!/command/with-contenv bash
+
+# Disable the php-fpm service as the container doesn't use it
+rm /etc/s6-overlay/s6-rc.d/user/contents.d/svc-php-fpm
+
+if [[ ${MASTODON_PROMETHEUS_EXPORTER_ENABLED,,} != "true" ]]; then
+    rm /etc/s6-overlay/s6-rc.d/user/contents.d/svc-prom
+fi
+
+if [[ ${SIDEKIQ_ONLY,,} == "true" ]]; then
+    rm /etc/s6-overlay/s6-rc.d/user/contents.d/svc-mastodon
+    rm /etc/s6-overlay/s6-rc.d/user/contents.d/svc-nginx
+    rm /etc/s6-overlay/s6-rc.d/user/contents.d/svc-streaming
+fi
+
+exec /docker-mods

root/tootctl

@@ -0,0 +1,6 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+cd /app/www || exit 1
+
+bin/tootctl "$@"