[Unit]
Description=Conduwuit limited federation (matrix)
Wants=network-online.target
Wants=traefik.service
After=network-online.target
Documentation=https://conduwuit.puppyirl.gay/

[Container]
ContainerName=conduwuit-limited-federation
NoNewPrivileges=true
Image=ghcr.io/jadedblueeyes/conduwuit:federation-allow-list
ReadOnly=true
Volume=/var/opt/conduwuit-limited-federation:/var/lib/conduwuit:z,U
AutoUpdate=registry

# conduwuit uses quite a few file descriptors, and on some systems it defaults to 1024
Ulimit=nofile=1048567:1048567

Label="traefik.enable=true"
Label="traefik.http.routers.conduwuit-limited-federation.rule=(Host(`matrix-limited-federation.pissing.dev`))"

Label="traefik.http.services.conduwuit-limited-federation.loadbalancer.server.port=6168"
Environment="CONDUWUIT_PORT=6168"

Network=web.network:ip=10.89.0.246,ip6=fd76:6f6d:f45e:ea1a::f10
Label="traefik.docker.network=systemd-web"
Environment="CONDUWUIT_ADDRESS=[\"10.89.0.246\", \"fd76:6f6d:f45e:ea1a::f10\"]"

Label="traefik.http.routers.conduwuit-limited-federation.entrypoints=https,matrix"

Label="traefik.http.routers.conduwuit-limited-federation.middlewares=default@file"

Label="homepage.group=Public"
Label="homepage.name=Conduwuit (limited federation)"
# https://github.com/girlbossceo/conduwuit/blob/032b199129f8648a77bde285f755a78e9ec349a7/src/api/client/unversioned.rs#L142
# Endpoint provided by sliding sync proxy used by some clients such as Element Web as a non-standard health check.
Label="homepage.siteMonitor=https://matrix-limited-federation.pissing.dev/client/server.json" 
Label="homepage.description=Matrix homeserver (matrix-limited-federation.pissing.dev)"
Label=kuma.__monitor=''
Environment='CONDUWUIT_ALLOWED_REMOTE_SERVER_NAMES=["pissing.dev"]'

Environment="CONDUWUIT_SERVER_NAME=matrix-limited-federation.pissing.dev"

Environment="CONDUWUIT_DATABASE_PATH=/var/lib/conduwuit"
Environment="CONDUWUIT_DATABASE_BACKEND=rocksdb"
# in bytes, ~20 MB
Environment="CONDUWUIT_MAX_REQUEST_SIZE=20000000"

Environment="CONDUWUIT_ALLOW_REGISTRATION=true"
Environment="CONDUWUIT_REGISTRATION_TOKEN=pissing-atlantic-proclaim-canine-drivable"
Environment='CONDUWUIT_AUTO_JOIN_ROOMS=["!UgUxfVZAEj2pcBRRdv:ellis.link", "!C8jPKMPkMsnd1wmm5j:ellis.link"]'
Environment="CONDUWUIT_ALLOW_FEDERATION=true"
Environment="CONDUWUIT_ALLOW_PUBLIC_ROOM_DIRECTORY_OVER_FEDERATION=true"

Environment="CONDUWUIT_ALLOW_LEGACY_MEDIA=false"

Environment="CONDUWUIT_TRUSTED_SERVERS=[\"matrix.org\", \"matrix.pissing.dev\", \"matrix.ellis.link\", "tchncs.de", "envs.net"]"
Environment="CONDUWUIT_LOG=info,hickory_proto::xfer::dns_exchange=error"
Environment="CONDUWUIT_WELL_KNOWN={ \
client=https://matrix-limited-federation.pissing.dev, \
server=matrix-limited-federation.pissing.dev:443 \
}"

Environment="CONDUWUIT_TURN_URIS=[\"turns:coturn.ellis.link?transport=udp\",\"turns:coturn.ellis.link?transport=tcp\",\"turn:coturn.ellis.link?transport=udp\",\"turn:coturn.ellis.link?transport=tcp\"]"
Environment="CONDUWUIT_TURN_SECRET=qjRh55G51K7V0ZqB7Z8ZEkxZjBLJMgkwEs8acFjx"

Network=conduwuit-url.network:interface_name=pub
Environment="CONDUWUIT_URL_PREVIEW_DOMAIN_EXPLICIT_ALLOWLIST=[\"*\"]"
Environment="CONDUWUIT_URL_PREVIEW_BOUND_INTERFACE=pub"

# Environment="CONDUWUIT_SENTRY=true"
# Environment="CONDUWUIT_SENTRY_ENDPOINT=https://c885d1475cef5c54bbd32b1512e0ae20@o4507835405369344.ingest.de.sentry.io/4508059491696720"

# Environment="CONDUWUIT_EMERGENCY_PASSWORD="

StopTimeout=100

[Service]

Restart=on-failure
RestartSec=5

TimeoutStopSec=2m
TimeoutStartSec=2m

# StartLimitInterval=1m
StartLimitBurst=5

[Install]
WantedBy=default.target