Pasture: Mobilizon joins

Mobilizon 5.2.4 on a PostGIS of its own (it needs the extension, which the shared Postgres has not got), trusting
Caddy's CA through the bundle mounted over certifi's and castore's files (hackney trusts only those), with geocoding
pointed at a closed local port. scenarios/mobilizon.sh passes its 23 checks: alice follows a group; the event its
organiser makes arrives as an Event with its start, end and located place; comments both ways; the organiser's edit,
closing the comments (PrivaPub then refuses a reply) and deletes of a comment and the event; a group post with its
title; the unfollow; statistics. An event made through Mobilizon's API without options has its comments closed, so
the scenario opens them. No RSVP yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

tools/pasture/peers/mobilizon.sh

@@ -0,0 +1,61 @@
+# Mobilizon 5.2.4 (kaihuri's image of Framasoft's release): events, groups with their discussions, and participations,
+# which it federates as Join and Leave, answered with Accept or Reject. Elixir, on a PostGIS of its own
+# (shared_postgis_up: it needs the extension, which the shared Postgres has not got). Its federation runs on hackney,
+# which trusts certifi's compiled-in roots, so the pasture's bundle is mounted over certifi's and castore's files and
+# the system store. Geocoding points at a closed local port, so no address lookup leaves the workstation. Accounts come
+# from mobilizon_ctl; its API is GraphQL (/api), signed in with an access token from the login mutation.
+MOBILIZON_IMAGE=${MOBILIZON_IMAGE:-docker.io/kaihuri/mobilizon:5.2.4}
+MOBILIZON_PASSWORD=Mobilizon-Pasture-1
+. "$here/peers/shared.sh"
+
+mobilizon_env() {
+	local keys="$here/.state/mobilizon/keys"
+	[ -s "$keys" ] || { mkdir -p "$here/.state/mobilizon"; for _ in 1 2; do head -c 48 /dev/urandom | base64 -w0; echo; done > "$keys"; }
+	cat <<ENV
+MOBILIZON_INSTANCE_NAME=Pasture Mobilizon
+MOBILIZON_INSTANCE_HOST=mobilizon.test
+MOBILIZON_INSTANCE_PORT=4000
+MOBILIZON_INSTANCE_EMAIL=noreply@mobilizon.test
+MOBILIZON_REPLY_EMAIL=noreply@mobilizon.test
+MOBILIZON_INSTANCE_REGISTRATIONS_OPEN=true
+MOBILIZON_INSTANCE_SECRET_KEY_BASE=$(sed -n 1p "$keys")
+MOBILIZON_INSTANCE_SECRET_KEY=$(sed -n 2p "$keys")
+MOBILIZON_DATABASE_USERNAME=pasture
+MOBILIZON_DATABASE_PASSWORD=pasture
+MOBILIZON_DATABASE_DBNAME=mobilizon
+MOBILIZON_DATABASE_HOST=postgis
+MOBILIZON_LOGLEVEL=info
+MOBILIZON_GEOSPATIAL_SERVICE=Nominatim
+MOBILIZON_GEOSPATIAL_NOMINATIM_ENDPOINT=http://127.0.0.1:9
+ENV
+}
+
+mobilizon_up() {
+	shared_postgis_up
+	podman exec pasture-postgis sh -c "psql -U pasture -tc \"select 1 from pg_database where datname='mobilizon'\" | grep -q 1 || createdb -U pasture mobilizon"
+	for ext in postgis pg_trgm unaccent; do
+		podman exec pasture-postgis psql -U pasture -d mobilizon -qc "create extension if not exists $ext;" >/dev/null
+	done
+	mkdir -p "$here/.state/mobilizon"
+	mobilizon_env > "$here/.state/mobilizon/env"
+	podman volume exists pasture-mobilizon-data || podman volume create --label pasture=1 pasture-mobilizon-data >/dev/null
+	podman run -d --replace --name pasture-mobilizon --network $net --label pasture=1 --env-file "$here/.state/mobilizon/env" \
+		-v pasture-mobilizon-data:/var/lib/mobilizon \
+		-v "$ca/bundle.pem:/etc/ssl/certs/ca-certificates.crt:z,ro" \
+		-v "$ca/bundle.pem:/lib/certifi-2.15.0/priv/cacerts.pem:z,ro" \
+		-v "$ca/bundle.pem:/lib/castore-1.0.19/priv/cacerts.pem:z,ro" \
+		"$MOBILIZON_IMAGE" >/dev/null
+	for _ in $(seq 1 120); do
+		site mobilizon.test -s -o /dev/null -w '%{http_code}' https://mobilizon.test:6443/.well-known/nodeinfo 2>/dev/null | grep -q 200 && break
+		sleep 3
+	done
+	mobilizon_settle
+	echo "mobilizon: https://mobilizon.test:6443"
+}
+
+# mzuser, an account with a profile (mobilizon_ctl splits its arguments on spaces: one word for the display name)
+mobilizon_settle() {
+	podman exec pasture-mobilizon /bin/mobilizon_ctl users.new mzuser@mobilizon.test --password "$MOBILIZON_PASSWORD" \
+		--profile-username mzuser --profile-display-name Mobilizonian >/dev/null 2>&1 || true
+	echo "mzuser@mobilizon.test:$MOBILIZON_PASSWORD" > "$here/.state/mobilizon.token"
+}