# We can't store the secrets in this file, since this is baked into the docker image
if not File.exists?("/var/lib/pleroma/secret.exs") do
  secret = :crypto.strong_rand_bytes(64) |> Base.encode64() |> binary_part(0, 64)
  signing_salt = :crypto.strong_rand_bytes(8) |> Base.encode64() |> binary_part(0, 8)
  {web_push_public_key, web_push_private_key} = :crypto.generate_key(:ecdh, :prime256v1)
  ...
  File.write("/var/lib/pleroma/secret.exs", secret_file)
end

import_config("/var/lib/pleroma/secret.exs")

# For additional user config
if File.exists?("/var/lib/pleroma/config.exs"),
  do: import_config("/var/lib/pleroma/config.exs"),
  else:
    File.write("/var/lib/pleroma/config.exs", """
    import Config

    # For additional configuration outside of environmental variables
    """)

[
  live_view: [signing_salt: "<脱敏>"],
  render_errors: [view: Pleroma.Web.ErrorView, accepts: ["json"]],
  pubsub_server: Pleroma.PubSub,
  secure_cookie_flag: true,
  extra_cookie_attrs: ["SameSite=Lax"],
  protocol: "http",
  http: [ip: {0, 0, 0, 0}, port: 4000],
  secret_key_base: "<脱敏，64 字节 base64>",
  signing_salt: "<脱敏，8 字节>",
  url: [host: "localhost", scheme: "http", port: 8148]   # 用户层覆盖后的实测值
]

[
  description: "Pleroma: An efficient and flexible fediverse server",
  short_description: "",
  background_image: "/images/city.jpg",
  instance_thumbnail: "/instance/thumbnail.jpeg",
  favicon: "/favicon.png",
  description_limit: 5000,
  remote_limit: 100000,
  upload_limit: 16000000,
  avatar_upload_limit: 2000000,
  background_upload_limit: 4000000,
  banner_upload_limit: 4000000,
  poll_limits: %{
    max_expiration: 31536000,
    max_option_chars: 200,
    max_options: 20,
    min_expiration: 0
  },
  invites_enabled: false,
  account_activation_required: false,
  account_approval_required: false,
  federating: true,
  federation_incoming_replies_max_depth: 100,
  allow_relay: true,
  public: true,
  quarantined_instances: [],
  rejected_instances: [],
  allowed_post_formats: ["text/plain", "text/html", "text/markdown",
   "text/bbcode", "text/x.misskeymarkdown"],
  ...
  remote_post_retention_days: 90,
  skip_thread_containment: true,
  limit_to_local_content: :unauthenticated,
  user_bio_length: 5000,
  user_name_length: 100,
  max_account_fields: 10,
  ...
  multi_factor_authentication: [
    totp: [digits: 6, period: 30],
    backup_codes: [number: 5, length: 16]
  ],
  show_reactions: true,
  password_reset_token_validity: 86400,
  profile_directory: true,
  admin_privileges: [:users_read, :users_manage_invites, ... :statistics_read],
  moderator_privileges: [:messages_delete, :reports_manage_reports],
  ...
  max_media_attachments: 1000,
  name: "Pleroma Demo",
  email: "admin@example.com",
  notify_email: "notifications@example.com",
  limit: 5000,
  registrations_open: false,
  healthcheck: true,
  static_dir: "/var/lib/pleroma/static"
]

[adapter: Ecto.Adapters.Postgres, username: "pleroma", database: "pleroma",
 hostname: "db", port: "5432", pool_size: 10]

[rum_enabled: false]

# Pleroma.Upload
[uploader: Pleroma.Uploaders.Local,
 filters: [Pleroma.Upload.Filter.Dedupe],
 link_name: false,
 proxy_remote: false,
 filename_display_max_length: 30,
 default_description: nil,
 base_url: nil,
 allowed_mime_types: ["image", "audio", "video"]]

# Pleroma.Uploaders.Local
[uploads: "/var/lib/pleroma/uploads"]

[enabled: false,
 invalidation: [enabled: false, provider: Pleroma.Web.MediaProxy.Invalidation.Script],
 proxy_opts: [redirect_on_failure: false, max_body_length: 26214400,
   max_read_duration: 30000, http: [follow_redirect: true, pool: :media]],
 whitelist: []]

["admin-fe", "fedi-fe", "glitch-lily", "kenoma", "pl-fe", "pleroma-fe", "soapbox"]

[policies: [Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy,
  Pleroma.Web.ActivityPub.MRF.TagPolicy, Pleroma.Web.ActivityPub.MRF.InlineQuotePolicy],
 transparency: true, transparency_exclusions: []]

$ docker exec pleroma-2.11.0-app /opt/pleroma/bin/pleroma_ctl config groups
（无输出——DB 配置表为空，当前实例配置全在文件轨）

import Config

# 1. 实例身份（真实域名 + TLS，反代终结）
config :pleroma, Pleroma.Web.Endpoint,
  url: [host: "social.example.com", scheme: "https", port: 443]

# 2. 实例名片与准入
config :pleroma, :instance,
  name: "Example Social",
  description: "A friendly Pleroma instance",
  registrations_open: true,
  account_approval_required: true,
  upload_limit: 20_000_000

# 3. 媒体代理（防 IP 泄露）
config :pleroma, :media_proxy, enabled: true

# 4. 上传走 S3（可选，替代本地盘）
config :pleroma, Pleroma.Upload, uploader: Pleroma.Uploaders.S3, base_url: "https://cdn.example.com"
config :pleroma, Pleroma.S3, bucket: "pleroma", host: "s3.example.com",
  path_style: true, bucket_namespace: "uploads"

# 5. 联邦治理：拒收名单 + 关键词过滤
config :pleroma, :instance, rejected_instances: ["spam.example.net"]
config :pleroma, Pleroma.Web.ActivityPub.MRF.SimplePolicy,
  message_rejections: [{"(?i)badword", "Pleroma"}]
config :pleroma, :mrf, policies: [Pleroma.Web.ActivityPub.MRF.SimplePolicy |
  Pleroma.Config.get([:mrf, :policies])]

# 6. 连接池调优（并发高时）
config :pleroma, Pleroma.Repo, pool_size: 20