# Hollo 0.9 (Fedify): one login owning several accounts, the nearest thing to PrivaPub's personas. RFC 9421 signatures
# first (cavage after a refusal), FEP-8b32 proofs, FEP-521a keys. On the shared Postgres (database hollo). The town's
# driver makes the login and the accounts through its forms (dialects/hollo.py); ALLOW_PRIVATE_ADDRESS only matters if
# the pasture's subnet is made private again.
HOLLO_IMAGE=${HOLLO_IMAGE:-ghcr.io/fedify-dev/hollo:0.9.19}
. "$here/peers/shared.sh"

hollo_up() {
	shared_postgres_up
	pg_db hollo
	mkdir -p "$here/.state/hollo/media" && chmod a+rwx "$here/.state/hollo/media"
	podman run -d --replace --name pasture-hollo --network $net -v "$here/.state/hollo/media:/var/lib/hollo:z" \
		-e DATABASE_URL=postgres://pasture:pasture@postgres:5432/hollo -e SECRET_KEY=pasture-hollo-not-a-secret-0123456789abcdefghijklmn \
		-e BEHIND_PROXY=true -e ALLOW_PRIVATE_ADDRESS=true -e NODE_EXTRA_CA_CERTS=/pasture/ca/root.crt -e LOG_LEVEL=info \
		-e DRIVE_DISK=fs -e FS_STORAGE_PATH=/var/lib/hollo -e STORAGE_URL_BASE=https://hollo.test/assets/ \
		-v "$ca:/pasture/ca:z,ro" $HOLLO_IMAGE >/dev/null
	for _ in $(seq 1 90); do
		site hollo.test -s -o /dev/null -w '%{http_code}' https://hollo.test:6443/.well-known/nodeinfo 2>/dev/null | grep -q 200 && break
		sleep 2
	done
	# the one login: its accounts are made by the town as it needs them
	# its forms compare Origin with the Host, so the Host leaves out the workstation's port
	site hollo.test -s -o /dev/null -X POST https://hollo.test:6443/setup -H 'Origin: https://hollo.test' -H 'Host: hollo.test' \
		--data-urlencode email=owner@hollo.test --data-urlencode 'password=Hollo-Pasture-Pass-1' --data-urlencode 'password_confirm=Hollo-Pasture-Pass-1'
	echo "hollo: https://hollo.test:6443"
}