Pasture: Pixelfed and WordPress join

Pixelfed 0.14.4 (FrankenPHP with Horizon and the scheduler, on the shared
Postgres and Redis) and WordPress 6 with ActivityPub 9.3.1 (on a new shared
MySQL, WP-Cron run by a sidecar) are peers now, each with its scenario:
Pixelfed 26 checks (photos both ways with alt text, its place arriving as
Rome with its coordinates, comments, likes, a boost, edits and deletes),
WordPress 17 (an Article with its title, our reply, like and boost kept as
comments of their kinds, its edit and removal). Pixelfed has a town driver
and a pair spec: 145 checks pass, 2 expected (G-0007).

What they showed: Pixelfed names our posts by their page (fixed in
26dac40); on PostgreSQL its migration making caption nullable never runs,
so every remote boost failed (the pasture applies it); it files a DM it
fetches as followers-only (G-0007, upstream); Passport refuses a token
whose user id equals its client's id. WordPress signs with RFC 9421
first, which PrivaPub now verifies (c5a69d2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

tools/pasture/peers/pixelfed.sh

@@ -0,0 +1,126 @@
+# Pixelfed 0.14: photo posts (Notes with Image attachments, alt text, a `location` Place), comments, likes, follows and
+# collections, and FEP-8fcf followers sync. Laravel on FrankenPHP (serversideup's image), on the shared Postgres
+# (database pixelfed) and Redis (dbs 5 and 6), with Horizon (which runs every federation job) and the scheduler as
+# sidecars of the same image sharing its storage volume. It trusts Caddy's CA through the bundle mounted as its system
+# store; its URL guard refuses private addresses with no switch, which the pasture's public-looking subnet passes. Its
+# admin is pfuser; tokens are Passport personal access tokens made through tinker.
+PIXELFED_IMAGE=${PIXELFED_IMAGE:-ghcr.io/pixelfed/pixelfed:v0.14.4}
+PIXELFED_PASSWORD=Pixelfed-Pasture-1
+. "$here/peers/shared.sh"
+
+pixelfed_env() {
+	local key_file="$here/.state/pixelfed/app.key"
+	[ -s "$key_file" ] || { mkdir -p "$here/.state/pixelfed"; echo "base64:$(head -c 32 /dev/urandom | base64)" > "$key_file"; }
+	cat <<EOF
+APP_NAME=Pasture Pixelfed
+APP_ENV=production
+APP_KEY=$(cat "$key_file")
+APP_DEBUG=false
+APP_URL=https://pixelfed.test
+APP_DOMAIN=pixelfed.test
+ADMIN_DOMAIN=pixelfed.test
+SESSION_DOMAIN=pixelfed.test
+TRUST_PROXIES=*
+LOG_CHANNEL=stderr
+DB_CONNECTION=pgsql
+DB_HOST=postgres
+DB_PORT=5432
+DB_DATABASE=pixelfed
+DB_USERNAME=pasture
+DB_PASSWORD=pasture
+REDIS_CLIENT=phpredis
+REDIS_HOST=redis
+REDIS_PORT=6379
+REDIS_DB=5
+REDIS_CACHE_DB=6
+CACHE_DRIVER=redis
+CACHE_STORE=redis
+QUEUE_DRIVER=redis
+QUEUE_CONNECTION=redis
+SESSION_DRIVER=redis
+BROADCAST_DRIVER=log
+MAIL_MAILER=log
+MAIL_DRIVER=log
+ACTIVITY_PUB=true
+AP_REMOTE_FOLLOW=true
+AP_INBOX=true
+AP_OUTBOX=true
+AP_SHAREDINBOX=true
+OPEN_REGISTRATION=true
+ENFORCE_EMAIL_VERIFICATION=false
+OAUTH_ENABLED=true
+PF_MAX_USERS=100000
+PF_ENFORCE_MAX_USERS=false
+INSTANCE_DISCOVER_PUBLIC=true
+PF_OPTIMIZE_IMAGES=false
+PF_OPTIMIZE_VIDEOS=false
+PF_MIN_REGISTRATION_AGE=0
+EOF
+}
+
+pixelfed_run() { # name, then the command (none: the web server)
+	local name=$1; shift
+	podman run -d --replace --name "$name" --network $net --env-file "$here/.state/pixelfed/env" "$@"
+}
+
+pixelfed_up() {
+	shared_postgres_up
+	shared_redis_up
+	pg_db pixelfed
+	mkdir -p "$here/.state/pixelfed"
+	pixelfed_env > "$here/.state/pixelfed/env"
+	podman volume exists pasture-pixelfed-storage || podman volume create --label pasture=1 pasture-pixelfed-storage >/dev/null
+	local mounts=(-v pasture-pixelfed-storage:/var/www/html/storage -v "$ca/bundle.pem:/etc/ssl/certs/ca-certificates.crt:z,ro")
+	pixelfed_run pasture-pixelfed -e AUTORUN_ENABLED=true "${mounts[@]}" "$PIXELFED_IMAGE" >/dev/null
+	for _ in $(seq 1 100); do
+		site pixelfed.test -s -o /dev/null -w '%{http_code}' https://pixelfed.test:6443/api/nodeinfo/2.0.json 2>/dev/null | grep -q 200 && break
+		sleep 3
+	done
+	pixelfed_run pasture-pixelfed-horizon "${mounts[@]}" "$PIXELFED_IMAGE" php artisan horizon >/dev/null
+	pixelfed_run pasture-pixelfed-cron "${mounts[@]}" "$PIXELFED_IMAGE" php artisan schedule:work >/dev/null
+	pixelfed_settle
+	echo "pixelfed: https://pixelfed.test:6443"
+}
+
+pixelfed_artisan() { podman exec pasture-pixelfed php artisan "$@"; }
+
+# the instance actor, Passport's keys and personal client, the admin pfuser and its token. Passport takes a token whose
+# user id equals its client's id for a client-credentials token and refuses it, so the clients are numbered from a
+# million, past any user. FrankenPHP keeps the keys it read at boot: the web server restarts once they exist.
+pixelfed_settle() {
+	# 0.14.4's migration making caption and rendered nullable on PostgreSQL checks for a connection named "postgres",
+	# never Laravel's "pgsql", so it does nothing and every remote boost (and DM) fails on NOT NULL: done here instead
+	podman exec pasture-postgres psql -U pasture -d pixelfed -qc \
+		"alter table statuses alter column caption drop not null, alter column rendered drop not null" >/dev/null
+	pixelfed_artisan instance:actor >/dev/null 2>&1 || true
+	if ! podman exec pasture-pixelfed test -s storage/oauth-private.key; then
+		pixelfed_artisan passport:keys --force >/dev/null 2>&1 || true
+		podman restart pasture-pixelfed >/dev/null
+		for _ in $(seq 1 60); do podman exec pasture-pixelfed curl -sf -o /dev/null http://localhost:8080/api/nodeinfo/2.0.json && break; sleep 2; done
+	fi
+	if [ "$(podman exec pasture-postgres psql -U pasture -d pixelfed -Atc "select count(*) from oauth_clients where personal_access_client and not revoked and id >= 1000000")" = "0" ]; then
+		podman exec pasture-postgres psql -U pasture -d pixelfed -qc "update oauth_clients set revoked = true where personal_access_client;
+			select setval('oauth_clients_id_seq', greatest((select coalesce(max(id), 0) from oauth_clients), 1000000));" >/dev/null
+		pixelfed_artisan passport:client --personal --name=pasture --no-interaction >/dev/null 2>&1 || true
+	fi
+	pixelfed_user pfuser admin
+	pixelfed_token pfuser > "$here/.state/pixelfed.token"
+	# the cities a post's place is chosen from (a couple of minutes, once)
+	[ "$(podman exec pasture-postgres psql -U pasture -d pixelfed -Atc "select count(*) from places")" != "0" ] \
+		|| pixelfed_artisan import:cities --no-interaction >/dev/null 2>&1 || true
+}
+
+# pixelfed_user <name> [admin]: an account with a confirmed email and the pasture's password (user:admin only asks, and
+# answers no without a terminal, so an admin is made in the database)
+pixelfed_user() {
+	pixelfed_artisan user:create --name="$1" --username="$1" --email="$1@pixelfed.test" --password="$PIXELFED_PASSWORD" \
+		--confirm_email=1 --no-interaction >/dev/null 2>&1 || true
+	[ "${2:-}" = "admin" ] && podman exec pasture-postgres psql -U pasture -d pixelfed -qc "update users set is_admin = true where username = '$1'" >/dev/null
+	return 0
+}
+
+# pixelfed_token <name>: a personal access token with every scope the Mastodon API asks for
+pixelfed_token() {
+	podman exec pasture-pixelfed php artisan tinker --execute \
+		"echo App\\Models\\User::where('username', '$1')->first()->createToken('pasture', ['read', 'write', 'follow', 'push'])->accessToken;" 2>/dev/null | tail -1
+}