Merge remote-tracking branch 'upstream/develop' into bnakkoma

Port of: https://akkoma.dev/AkkomaGang/akkoma/pulls/525

.buildpacks

@@ -1 +0,0 @@
-https://github.com/hashnuke/heroku-buildpack-elixir  

.dockerignore

@@ -24,6 +24,7 @@ static
 uploads
 instance
 docker-db
+meili_data
 capture.pcap
 erl_crash.dump
 coveralls.json

.formatter.exs

@@ -1,6 +1,5 @@
 [
-  import_deps: [:ecto, :ecto_sql, :phoenix],
-  subdirectories: ["priv/*/migrations"],
+  import_deps: [:mneme, :ecto, :ecto_sql, :phoenix],
   plugins: [Phoenix.LiveView.HTMLFormatter],
   inputs: [
     "mix.exs",

.gitignore

@@ -81,3 +81,4 @@ docs/venv
 /*.iml
 /static
 /etc
+/docker-compose.override.yml

.woodpecker/build-amd64.yml

@@ -1,13 +1,17 @@
-platform: linux/amd64
+labels:
+  platform: linux/amd64
 
 depends_on:
   - test
 
 variables:
   - &scw-secrets
-    - SCW_ACCESS_KEY
-    - SCW_SECRET_KEY
-    - SCW_DEFAULT_ORGANIZATION_ID
+    SCW_ACCESS_KEY:
+      from_secret: SCW_ACCESS_KEY
+    SCW_SECRET_KEY:
+      from_secret: SCW_SECRET_KEY
+    SCW_DEFAULT_ORGANIZATION_ID:
+      from_secret: SCW_DEFAULT_ORGANIZATION_ID
   - &setup-hex "mix local.hex --force && mix local.rebar --force"
   - &on-release
     when:
@@ -34,7 +38,7 @@ variables:
   - &clean "(rm -rf release || true) && (rm -rf _build || true) && (rm -rf /root/.mix)"
   - &mix-clean "mix deps.clean --all && mix clean"
 
-pipeline:
+steps:
   # Canonical amd64
   debian-bookworm:
     image: hexpm/elixir:1.15.4-erlang-26.0.2-debian-bookworm-20230612
@@ -55,7 +59,7 @@ pipeline:
   release-debian-bookworm:
     image: akkoma/releaser
     <<: *on-release
-    secrets: *scw-secrets
+    environment: *scw-secrets
     commands:
       - export SOURCE=akkoma-amd64.zip
       # AMD64
@@ -84,7 +88,7 @@ pipeline:
   release-debian-bullseye:
     image: akkoma/releaser
     <<: *on-release
-    secrets: *scw-secrets
+    environment: *scw-secrets
     commands:
       - export SOURCE=akkoma-amd64-debian-bullseye.zip
       # AMD64
@@ -110,7 +114,7 @@ pipeline:
   release-musl:
     image: akkoma/releaser
     <<: *on-stable
-    secrets: *scw-secrets
+    environment: *scw-secrets
     commands:
       - export SOURCE=akkoma-amd64-musl.zip
       - export DEST=scaleway:akkoma-updates/$${CI_COMMIT_TAG:-"$CI_COMMIT_BRANCH"}/akkoma-amd64-musl.zip

.woodpecker/build-arm64.yml

@@ -1,13 +1,17 @@
-platform: linux/arm64
+labels:
+  platform: linux/arm64
 
 depends_on:
   - test
 
 variables:
   - &scw-secrets
-    - SCW_ACCESS_KEY
-    - SCW_SECRET_KEY
-    - SCW_DEFAULT_ORGANIZATION_ID
+    SCW_ACCESS_KEY:
+      from_secret: SCW_ACCESS_KEY
+    SCW_SECRET_KEY:
+      from_secret: SCW_SECRET_KEY
+    SCW_DEFAULT_ORGANIZATION_ID:
+      from_secret: SCW_DEFAULT_ORGANIZATION_ID
   - &setup-hex "mix local.hex --force && mix local.rebar --force"
   - &on-release
     when:
@@ -34,7 +38,7 @@ variables:
   - &clean "(rm -rf release || true) && (rm -rf _build || true) && (rm -rf /root/.mix)"
   - &mix-clean "mix deps.clean --all && mix clean"
 
-pipeline:
+steps:
   # Canonical arm64
   debian-bookworm:
     image: hexpm/elixir:1.15.4-erlang-26.0.2-debian-bookworm-20230612
@@ -55,7 +59,7 @@ pipeline:
   release-debian-bookworm:
     image: akkoma/releaser:arm64
     <<: *on-release
-    secrets: *scw-secrets
+    environment: *scw-secrets
     commands:
       - export SOURCE=akkoma-arm64.zip
       - export DEST=scaleway:akkoma-updates/$${CI_COMMIT_TAG:-"$CI_COMMIT_BRANCH"}/akkoma-arm64-ubuntu-jammy.zip
@@ -82,7 +86,7 @@ pipeline:
   release-musl:
     image: akkoma/releaser:arm64
     <<: *on-stable
-    secrets: *scw-secrets
+    environment: *scw-secrets
     commands:
       - export SOURCE=akkoma-arm64-musl.zip
       - export DEST=scaleway:akkoma-updates/$${CI_COMMIT_TAG:-"$CI_COMMIT_BRANCH"}/akkoma-arm64-musl.zip

.woodpecker/docs.yml

@@ -1,14 +1,11 @@
-platform: linux/amd64
+labels:
+  platform: linux/amd64
 
 depends_on:
   - test
   - build-amd64
 
 variables:
-  - &scw-secrets
-    - SCW_ACCESS_KEY
-    - SCW_SECRET_KEY
-    - SCW_DEFAULT_ORGANIZATION_ID
   - &setup-hex "mix local.hex --force && mix local.rebar --force"
   - &on-release
     when:
@@ -45,15 +42,17 @@ variables:
   - &clean "(rm -rf release || true) && (rm -rf _build || true) && (rm -rf /root/.mix)"
   - &mix-clean "mix deps.clean --all && mix clean"
 
-pipeline:
+steps:
   docs:
     <<: *on-point-release
-    secrets:
-    - SCW_ACCESS_KEY
-    - SCW_SECRET_KEY
-    - SCW_DEFAULT_ORGANIZATION_ID
     environment:
       CI: "true"
+      SCW_ACCESS_KEY:
+        from_secret: SCW_ACCESS_KEY
+      SCW_SECRET_KEY:
+        from_secret: SCW_SECRET_KEY
+      SCW_DEFAULT_ORGANIZATION_ID:
+        from_secret: SCW_DEFAULT_ORGANIZATION_ID
     image: python:3.10-slim
     commands:
       - apt-get update && apt-get install -y rclone wget git zip

.woodpecker/lint.yml

@@ -1,10 +1,7 @@
-platform: linux/amd64
+labels:
+  platform: linux/amd64
 
 variables:
-  - &scw-secrets
-    - SCW_ACCESS_KEY
-    - SCW_SECRET_KEY
-    - SCW_DEFAULT_ORGANIZATION_ID
   - &setup-hex "mix local.hex --force && mix local.rebar --force"
   - &on-release
     when:
@@ -41,9 +38,9 @@ variables:
   - &clean "(rm -rf release || true) && (rm -rf _build || true) && (rm -rf /root/.mix)"
   - &mix-clean "mix deps.clean --all && mix clean"
 
-pipeline:
+steps:
   lint:
-    image: akkoma/ci-base:1.15-otp26
+    image: akkoma/ci-base:1.18-otp27
     <<: *on-pr-open
     environment:
       MIX_ENV: test

.woodpecker/test.yml

@@ -1,28 +1,24 @@
-platform: linux/amd64
+labels:
+  platform: linux/amd64
 
 depends_on:
   - lint
 
 matrix:
+  # test the lowest and highest versions
   ELIXIR_VERSION:
     - 1.14
-    - 1.15
+    - 1.18
   OTP_VERSION:
     - 25
-    - 26
+    - 27
   include:
     - ELIXIR_VERSION: 1.14
       OTP_VERSION: 25
-    - ELIXIR_VERSION: 1.15
-      OTP_VERSION: 25
-    - ELIXIR_VERSION: 1.15
-      OTP_VERSION: 26
+    - ELIXIR_VERSION: 1.18
+      OTP_VERSION: 27
 
 variables:
-  - &scw-secrets
-    - SCW_ACCESS_KEY
-    - SCW_SECRET_KEY
-    - SCW_DEFAULT_ORGANIZATION_ID
   - &setup-hex "mix local.hex --force && mix local.rebar --force"
   - &on-release
     when:
@@ -70,7 +66,7 @@ services:
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: postgres
 
-pipeline:
+steps:
   test:
     image: akkoma/ci-base:${ELIXIR_VERSION}-otp${OTP_VERSION}
     <<: *on-pr-open
@@ -89,5 +85,5 @@ pipeline:
       - mix ecto.create
       - mix ecto.migrate
       - mkdir -p test/tmp
-      - mix test --preload-modules --exclude erratic --exclude federated --exclude mocked
-      - mix test --preload-modules --only mocked
+      - mix test --preload-modules --exclude erratic --exclude federated --exclude mocked || mix test --failed
+      - mix test --preload-modules --only mocked || mix test --failed

CHANGELOG.md

@@ -6,22 +6,205 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## Unreleased
 
-## Added
+### Added
+- Prometheus stats now exposes failed ActivityPub deliveries
+  which failed all attempts and the failure reason
+- status and user HTML pages now provide ActivityPub alternate links
+- the `prune_objects` mix task no longer deletes pinned posts by default
+- added `--prune-pinned` and `--keep-followed {posts,full,none}` options to the `prune_objects` mix task
+
+### Fixed
+- Internal actors no longer pretend to have unresolvable follow(er|ing) collections
+- fixed user-level default post expiry duration overriding `expires_in` values explicitly passed during post creation
+- fix crashes on non-UTF8 usernames for the API paths taking both nicknames and IDs
+- fixed divergences in fields used to determine visibility;
+  this lead e.g. to unlisted replies from Pleroma instances being partially treated as private posts
+- fixed our fetch actor advertising bogus follower and following collection ActivityPub IDs
+- fix network-path references not being handled by media proxy
+
+### Changed
+- Internal and relay actors are now again represented with type "Application"
+- `cleanup_attachments` is now enabled by default
+- shared inboxes are now generally preferred over personal inboxes, cutting down on duplicate publishing churn
+- instance actors are now really of type `Service`
+- ActivityPub delivery attempts are spaced out more giving up after 3h instead of ~20min before
+
+## 2025.03
+
+### Added
+- Oban (worker) dashboard at `/akkoma/oban`
+
+### Fixed
+- fixed some holes in SigningKey verification potentially allowing they key-user mapping to be poisoned
+- frontend ZIP files can no longer traverse to paths outside their install dir
+- fixed user updates trying but failing to renew signing key information
+- fixed signing key refresh on key rotation
+
+### Changed
+- Dropped obsolete `ap_enabled` indicator from user table and associated buggy logic
+- The remote user count in prometheus metrics is now an estimate instead of an exact number
+  since the latter proved unreasonably costly to obtain for a merely nice-to-have statistic
+- Various other tweaks improving stat query performance and avoiding unecessary work on received AP documents
+- The HTML content for new posts (both Client-to-Server as well as Server-to-Server communication) will now use a different formatting to represent MFM. See [FEP-c16b](https://codeberg.org/fediverse/fep/src/branch/main/fep/c16b/fep-c16b.md) for more details.
+- HTTP signatures now test the most likely request-target alias first cutting down on overhead
+
+## 2025.01.01
+
+Hotfix: Federation could break if a null value found its way into `should_federate?\1`
+
+## 2025.01
+
+### Added
+- New config option `:instance, :cleanup_attachments_delay`
+- It is now possible to display custom source URLs in akkoma-fe;
+  the settings are part of the frontend configuration
+
+### Fixed
+- Media proxy no longer attempts to proxy embedded images
+- Fix significant uneccessary overhead of attachment cleanup;
+  it no longer attempts to cleanup attachments of deleted remote posts
+- Fix “Delete & Redraft” often losing attachments if attachment cleanup was enabled
+- ObjectAge policy no longer lets unlisted posts slip through
+- ObjectAge policy no longer leaks belated DMs and follower-only posts
+- the NodeINfo endpoint now uses the correct content type
+
+### Changed
+- Anonymous objects now federate completely without an id
+  adopting a proposed AP spec errata and restoring federation
+  with e.g. IceShrimp.NET and fedify-based implementations
+
+## 3.13.3 
+
+### BREAKING
+- Minimum PostgreSQL version is raised to 12
+- Swagger UI moved from `/akkoma/swaggerui/` to `/pleroma/swaggerui/`
+
+### Added
+- Implement [FEP-67ff](https://codeberg.org/fediverse/fep/src/branch/main/fep/67ff/fep-67ff.md) (federation documentation)
+- Meilisearch: it is now possible to use separate keys for search and admin actions
+- New standalone `prune_orphaned_activities` mix task with configurable batch limit
+- The `prune_objects` mix task now accepts a `--limit` parameter for initial object pruning
+
+### Fixed
+- Meilisearch: order of results returned from our REST API now actually matches how Meilisearch ranks results
+- Emoji are now federated as anonymous objects, fixing issues with
+  some strict servers e.g. rejecting e.g. remote emoji reactions
+- AP objects with additional JSON-LD profiles beyond ActivityStreams can now be fetched
+- Single-selection polls no longer expose the voter_count; MastoAPI demands it be null
+  and this confused some clients leading to vote distributions >100%
+
+### Changed
+- Refactored Rich Media to cache the content in the database. Fetching operations that could block status rendering have been eliminated.
+
+## 2024.04.1 (Security)
+
+### Fixed
+- Issue allowing non-owners to use media objects in posts
+- Issue allowing use of non-media objects as attachments and crashing timeline rendering
+- Issue allowing webfinger spoofing in certain situations
+
+## 2024.04
+
+### Added
+- Support for [FEP-fffd](https://codeberg.org/fediverse/fep/src/branch/main/fep/fffd/fep-fffd.md) (proxy objects)
+- Verified support for elixir 1.16
+- Uploadfilter `Pleroma.Upload.Filter.Exiftool.ReadDescription` returns description values to the FE so they can pre fill the image description field
+  NOTE: this filter MUST be placed before `Exiftool.StripMetadata` to work
+
+### Changed
+- Inbound pipeline error handing was modified somewhat, which should lead to less incomprehensible log spam. Hopefully.
+- Uploadfilter `Pleroma.Upload.Filter.Exiftool` was replaced by `Pleroma.Upload.Filter.Exiftool.StripMetadata`;
+  the latter strips all non-essential metadata by default but can be configured.
+  To regain the old behaviour of only stripping GPS data set `purge: ["gps:all"]`.
+- Uploadfilter `Pleroma.Upload.Filter.Exiftool` has been renamed to `Pleroma.Upload.Filter.Exiftool.StripMetadata`
+- MRF.InlineQuotePolicy now prefers to insert display URLs instead of ActivityPub IDs
+- Old accounts are no longer listed in WebFinger as aliases; this was breaking spec
+
+### Fixed
+- Issue preventing fetching anything from IPv6-only instances
+- Issue allowing post content to leak via opengraph tags despite :estrict\_unauthenticated being set
+- Move activities no longer operate on stale user data
+- Missing definitions in our JSON-LD context
+- Issue mangling newlines in code blocks for RSS/Atom feeds
+- static\_fe squeezing non-square avatars and emoji
+- Issue leading to properly JSON-LD compacted emoji reactions being rejected
+- We now use a standard-compliant Accept header when fetching ActivityPub objects
+- /api/pleroma/notification\_settings was rejecting body parameters;
+  this also broke changing this setting via akkoma-fe
+- Issue leading to Mastodon bot accounts being rejected
+- Scope misdetection of remote posts resulting from not recognising
+  JSON-LD-compacted forms of public scope; affected e.g. federation with bovine
+- Ratelimits encountered when fetching objects are now respected; 429 responses will cause a backoff when we get one.
+
+### Removed
+- ActivityPub Client-To-Server write API endpoints have been disabled;
+  read endpoints are planned to be removed next release unless a clear need is demonstrated
+
+## 2024.03
+
+### Added
+- CLI tasks best-effort checking for past abuse of the recent spoofing exploit
+- new `:mrf_steal_emoji, :download_unknown_size` option; defaults to `false`
+
+### Changed
+- `Pleroma.Upload, :base_url` now MUST be configured explicitly if used;
+  use of the same domain as the instance is **strongly** discouraged
+- `:media_proxy, :base_url` now MUST be configured explicitly if used;
+  use of the same domain as the instance is **strongly** discouraged
+- StealEmoji:
+  - now uses the pack.json format;
+    existing users must migrate with an out-of-band script (check release notes)
+  - only steals shortcodes recognised as valid
+  - URLs of stolen emoji is no longer predictable
+- The `Dedupe` upload filter is now always active;
+  `AnonymizeFilenames` is again opt-in
+- received AP data is sanity checked before we attempt to parse it as a user
+- Uploads, emoji and media proxy now restrict Content-Type headers to a safe subset
+- Akkoma will no longer fetch and parse objects hosted on the same domain
+
+### Fixed
+- Critical security issue allowing Akkoma to be used as a vector for
+  (depending on configuration) impersonation of other users or creation
+  of bogus users and posts on the upload domain
+- Critical security issue letting Akkoma fall for the above impersonation
+  payloads due to lack of strict id checking
+- Critical security issue allowing domains redirect to to pose as the initial domain
+  (e.g. with media proxy's fallback redirects)
+- refetched objects can no longer attribute themselves to third-party actors
+  (this had no externally visible effect since actor info is read from the Create activity)
+- our litepub JSON-LD schema is now served with the correct content type
+- remote APNG attachments are now recognised as images
+
+### Upgrade Notes
+
+- As mentioned in "Changed", `Pleroma.Upload, :base_url` **MUST** be configured. Uploads will fail without it.
+  - Akkoma will refuse to start if this is not set.
+- Same with media proxy.
+
+## 2024.02
+
+### Added
 - Full compatibility with Erlang OTP26
 - handling of GET /api/v1/preferences
+- Akkoma API is now documented
+- ability to auto-approve follow requests from users you are already following
+- The SimplePolicy MRF can now strip user backgrounds from selected remote hosts
 
-## Changed
+### Changed
 - OTP builds are now built on erlang OTP26
 - The base Phoenix framework is now updated to 1.7
+- An `outbox` field has been added to actor profiles to comply with AP spec
+- User profile backgrounds do now federate with other Akkoma instances and Sharkey
 
-## Fixed
+### Fixed
 - Documentation issue in which a non-existing nginx file was referenced
 - Issue where a bad inbox URL could break federation
 - Issue where hashtag rel values would be scrubbed
+- Issue where short domains listed in `transparency_obfuscate_domains` were not actually obfuscated
 
 ## 2023.08
 
-## Added
+### Added
 
 - Added a new configuration option to the MediaProxy feature that allows the blocking of specific domains from using the media proxy or being explicitly allowed by the Content-Security-Policy.
   - Please make sure instances you wanted to block media from are not in the MediaProxy `whitelist`, and instead use `blocklist`.
@@ -34,7 +217,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
   - OTP26 is currently "unsupported". It will probably work, but due to the way
     it handles map ordering, the test suite will not pass for it as yet.
 
-## Changed
+### Changed
 
 - Alpine OTP builds are now from alpine 3.18, which is OpenSSLv3 compatible.
   If you use alpine OTP builds you will have to update your local system.
@@ -45,19 +228,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Blocks/Mutes now return from max ID to min ID, in line with mastodon.
 - The AnonymizeFilename filter is now enabled by default.
 
-## Fixed
+### Fixed
 
 - Deactivated users can no longer show up in the emoji reaction list
 - Embedded posts can no longer bypass `:restrict\_unauthenticated`
 - GET/HEAD requests will now work when requesting AWS-based instances.
 
-## Security
+### Security
 
 - Add `no_new_privs` hardening to OpenRC and systemd service files
 - XML parsers cannot load any entities (thanks @Mae@is.badat.dev!)
 - Reduced permissions of config files and directories, distros requiring greater permissions like group-read need to pre-create the directories
 
-## Removed
+### Removed
 
 - Builds for debian oldstable (bullseye)
   - If you are on oldstable you should NOT attempt to update OTP builds without
@@ -65,7 +248,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## 2023.05
 
-## Added
+### Added
 - Custom options for users to accept/reject private messages
   - options: everybody, nobody, people\_i\_follow
 - MRF to reject notes from accounts newer than a given age
@@ -73,16 +256,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
     post gets boosted outside of your local bubble and people your instance
     does not know about reply to it.
 
-## Fixed
+### Fixed
 - Support for `streams` public key URIs
 - Bookmarks are cleaned up on DB prune now
 
-## Security
+### Security
 - Fixed mediaproxy being a bit of a silly billy
 
 ## 2023.04
 
-## Added
+### Added
 - Nodeinfo keys for unauthenticated timeline visibility
 - Option to disable federated timeline
 - Option to make the bubble timeline publicly accessible
@@ -96,7 +279,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## 2023.03
 
-## Fixed
+### Fixed
 - Allowed contentMap to be updated on edit
 - Filter creation now accepts expires\_at
 
@@ -156,7 +339,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## 2022.12
 
-## Added
+### Added
 - Config: HTTP timeout options, :pool\_timeout and :receive\_timeout
 - Added statistic gathering about instances which do/don't have signed fetches when they request from us
 - Ability to set a default post expiry time, after which the post will be deleted. If used in concert with ActivityExpiration MRF, the expiry which comes _sooner_ will be applied.
@@ -166,7 +349,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Option to extend `reject` in MRF-Simple to apply to entire threads, where the originating instance is rejected
 - Extra information to failed HTTP requests
 
-## Changed
+### Changed
 - MastoAPI: Accept BooleanLike input on `/api/v1/accounts/:id/follow` (fixes follows with mastodon.py)
 - Relays from akkoma are now off by default
 - NormalizeMarkup MRF is now on by default
@@ -175,30 +358,30 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Overhauled static-fe view for logged-out users
 - Blocked instances will now not be sent _any_ requests, even fetch ones that would get rejected by MRF anyhow
 
-## Removed
+### Removed
 - FollowBotPolicy
 - Passing of undo/block into MRF
 
-## Upgrade Notes
+### Upgrade Notes
 - If you have an old instance, you will probably want to run `mix pleroma.database prune_task` in the foreground to catch it up with the history of your instance.
 
 ## 2022.11
 
-## Added
+### Added
 - Officially supported docker release
 - Ability to remove followers unilaterally without a block
 - Scraping of nodeinfo from remote instances to display instance info
 - `requested_by` in relationships when the user has requested to follow you
 
-## Changed
+### Changed
 - Follows no longer override domain blocks, a domain block is final
 - Deletes are now the lowest priority to publish and will be handled after creates
 - Domain blocks are now subdomain-matches by default
 
-## Fixed
+### Fixed
 - Registrations via ldap are now compatible with the latest OTP24
 
-## Update notes
+### Update notes
 - If you use LDAP and run from source, please update your elixir/erlang
   to the latest. The changes in OTP24.3 are breaking.
 - You can now remove the leading `*.` from domain blocks, but you do not have to.
@@ -1518,7 +1701,7 @@ curl -Lo ./bin/pleroma_ctl 'https://git.pleroma.social/pleroma/pleroma/raw/devel
 - User-Agent is now sent correctly for all HTTP requests.
 - MRF: Simple policy now properly delists imported or relayed statuses
 
-## Removed
+### Removed
 - Configuration: `config :pleroma, :fe` in favor of the more flexible `config :pleroma, :frontend_configurations`
 
 ## [0.9.99999] - 2019-05-31

FEDERATION.md

@@ -0,0 +1,48 @@
+# Federation
+
+## Supported federation protocols and standards
+
+- [ActivityPub](https://www.w3.org/TR/activitypub/) (Server-to-Server)
+- [WebFinger](https://webfinger.net/)
+- [Http Signatures](https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures)
+- [NodeInfo](https://nodeinfo.diaspora.software/)
+
+## Supported FEPs
+
+- [FEP-67ff: FEDERATION](https://codeberg.org/fediverse/fep/src/branch/main/fep/67ff/fep-67ff.md)
+- [FEP-dc88: Formatting Mathematics](https://codeberg.org/fediverse/fep/src/branch/main/fep/dc88/fep-dc88.md)
+- [FEP-f1d5: NodeInfo in Fediverse Software](https://codeberg.org/fediverse/fep/src/branch/main/fep/f1d5/fep-f1d5.md)
+- [FEP-fffd: Proxy Objects](https://codeberg.org/fediverse/fep/src/branch/main/fep/fffd/fep-fffd.md)
+- [FEP-c16b: Formatting MFM functions](https://codeberg.org/fediverse/fep/src/branch/main/fep/c16b/fep-c16b.md)
+
+## ActivityPub
+
+Akkoma mostly follows the server-to-server parts of the ActivityPub standard,
+but implements quirks for Mastodon compatibility as well as Mastodon-specific
+and custom extensions.
+
+See our documentation and Mastodon’s federation information
+linked further below for details on these quirks and extensions.
+
+Akkoma does not perform JSON-LD processing.
+
+### Required extensions
+
+#### HTTP Signatures
+All AP S2S POST requests to Akkoma instances MUST be signed.
+Depending on instance configuration the same may be true for GET requests.
+
+### FEP-c16b: Formatting MFM functions
+
+The optional extension term `htmlMfm` is currently not used.
+
+## Nodeinfo
+
+Akkoma provides many additional entries in its nodeinfo response,
+see the documentation linked below for details.
+
+## Additional documentation
+
+- [Akkoma’s ActivityPub extensions](https://docs.akkoma.dev/develop/development/ap_extensions/)
+- [Akkoma’s nodeinfo extensions](https://docs.akkoma.dev/develop/development/nodeinfo_extensions/)
+- [Mastodon’s federation requirements](https://github.com/mastodon/mastodon/blob/main/FEDERATION.md)

Procfile

@@ -1,2 +0,0 @@
-web: mix phx.server
-release: mix ecto.migrate

README.md

@@ -2,6 +2,12 @@
 
 <small>It's not that new. This is just a cheap pun on the title of a [furry anime](https://en.wikipedia.org/wiki/BNA:_Brand_New_Animal).</small>
 
+Also keep in mind that B in BNAkkoma stands for 'bleeding-edge', **features can be added, changed or removed at any time!**
+
+If you are experiencing any strange quirks, make sure both your frontend and backend are up to date.
+
+If your software are up to date but the bug is still there, ping me on the fediverse at '@itepechi@fedi.itepechi.me'.
+
 ## What is this?
 
 This is a fork of [AkkomaGang/akkoma](https://akkoma.dev/AkkomaGang/akkoma/), with some opinionated changes to satisfy my needs.
@@ -10,13 +16,15 @@ The main differences between this and the upstream repository are
 
 - Uses the official Elixir image from Docker Hub
 - Automatically builds the Akkoma backend when building the Docker image, instead of requiring complex commands after pulling/building images
-- Files/directories to mount are minified and completely separated from the repository files, allowing better control over file permissions
+- Files/directories to be mounted are completely separated from the repository, making the image portable and allowing better control over file permissions
 - Has an actual Docker entry point, rather than a command that pretends to be an entry point
 - Includes out-of-the-box support for [PGroonga](https://pgroonga.github.io/), the fast and accurate full-text search extension for PostgreSQL
 - Added support for searching media posts, which I really needed
-- Added support to search for posts from people you follow, which is nice to have
+- Added support to search for posts by/accounts of people you follow, which is nice to have
+- Added support to search for local posts/accounts of the current instance, which is also nice to have
 - These search extensions are configurable, so simply turn off if you don't want them
 - Includes some improvements to the initial configuration wizard
+- Added OpenSearch protocol support
 - Improved PWA support, sort of
 - Supports Podman quite well
 
@@ -281,6 +289,18 @@ podman exec -it akkoma-web \
   index
 ```
 
+### 9. Troubleshooting
+
+#### PGroonga search not working as expected
+
+Please make sure that you've applied all migrations using `pleroma_ctl migrate --migrations-path priv/repo/optional_migrations/pgroonga`, then set the options using `pleroma_ctl database set_pgroonga_options`.
+
+Read more at ['Switch to PGroonga'](#switch-to-pgroonga) and ['Change PGroonga indexing options'](#change-pgroonga-indexing-options).
+
+#### Fails to install Pleroma-FE
+
+This sometimes happens. Try installing again later.
+
 ---
 
 ## Akkoma

SECURITY.md

@@ -1,16 +1,21 @@
-# Pleroma backend security policy
-
-## Supported versions
-
-Currently, Pleroma offers bugfixes and security patches only for the latest minor release.
-
-| Version | Support 
-|---------| --------
-| 2.2     | Bugfixes and security patches
+# Akkoma backend security handling
 
 ## Reporting a vulnerability
 
-Please use confidential issues (tick the "This issue is confidential and should only be visible to team members with at least Reporter access." box when submitting) at our [bugtracker](https://git.pleroma.social/pleroma/pleroma/-/issues/new) for reporting vulnerabilities.
+Please send an email (preferably encrypted) or
+a DM via our IRC to one of the following people:
+
+| Forgejo nick | IRC nick      | Email         | GPG                                     |
+| ------------ | ------------- | ------------- | --------------------------------------- |
+| floatinghost | FloatingGhost | *see GPG key* | https://coffee-and-dreams.uk/pubkey.asc |
+
 ## Announcements
 
-New releases are announced at [pleroma.social](https://pleroma.social/announcements/). All security releases are tagged with ["Security"](https://pleroma.social/announcements/tags/security/). You can be notified of them by subscribing to an Atom feed at <https://pleroma.social/announcements/tags/security/feed.xml>. 
+New releases and security issues are announced at
+[meta.akkoma.dev](https://meta.akkoma.dev/c/releases) and
+[@akkoma@ihatebeinga.live](https://ihatebeinga.live/akkoma).
+
+Both also offer RSS feeds
+([meta](https://meta.akkoma.dev/c/releases/7.rss),
+[fedi](https://ihatebeinga.live/users/akkoma.rss))
+so you can keep an eye on it without any accounts.

ci/Dockerfile

@@ -1,7 +1,6 @@
-FROM elixir:1.9.4
-
-RUN apt-get update &&\
-  apt-get install -y libmagic-dev cmake libimage-exiftool-perl ffmpeg &&\
-	mix local.hex --force &&\
-	mix local.rebar --force
-
+ARG TAG
+FROM docker.io/hexpm/elixir:${TAG}
+RUN apk update
+RUN apk add git gcc g++ musl-dev make cmake file-dev rclone wget zip imagemagick ffmpeg perl-image-exiftool exiftool
+RUN mkdir /src
+WORKDIR /src

ci/build-all.sh

@@ -0,0 +1,3 @@
+./build.sh 1.14-otp25 1.14.3-erlang-25.3.2-alpine-3.18.0
+./build.sh 1.15-otp25 1.15.8-erlang-25.3.2.18-alpine-3.19.7
+./build.sh 1.18-otp27 1.18.2-erlang-27.2.4-alpine-3.19.7

ci/build.sh

@@ -0,0 +1,3 @@
+echo "Building $1 using image tag $2"
+docker build -t docker.io/akkoma/ci-base:$1 --build-arg=version=$1 --build-arg=TAG=$2 .
+docker push docker.io/akkoma/ci-base:$1

ci/build_and_push.sh

@@ -1 +0,0 @@
-docker buildx build --platform linux/amd64,linux/arm64,linux/arm/v7 -t git.pleroma.social:5050/pleroma/pleroma/ci-base:latest --push .

config/config.exs

@@ -61,11 +61,11 @@
 # Upload configuration
 config :pleroma, Pleroma.Upload,
   uploader: Pleroma.Uploaders.Local,
-  filters: [Pleroma.Upload.Filter.Dedupe],
+  filters: [],
   link_name: false,
-  proxy_remote: false,
   filename_display_max_length: 30,
-  base_url: nil
+  base_url: nil,
+  allowed_mime_types: ["image", "audio", "video"]
 
 config :pleroma, Pleroma.Uploaders.Local, uploads: "uploads"
 
@@ -148,18 +148,36 @@
   format: "$metadata[$level] $message",
   metadata: [:request_id]
 
+# ———————————————————————————————————————————————————————————————
+#                       W  A  R  N  I  N  G
+# ———————————————————————————————————————————————————————————————
+#
+#  Whenever adding a privileged new custom type for e.g.
+#  ActivityPub objects, ALWAYS map their extension back
+#  to "application/octet-stream".
+#  Else files served by us can automatically end up with
+#  those privileged types causing severe security hazards.
+#  (We need those mappings so Phoenix can assoiate its format
+#   (the "extension") to incoming requests of those MIME types)
+#
+# ———————————————————————————————————————————————————————————————
 config :mime, :types, %{
   "application/xml" => ["xml"],
   "application/xrd+xml" => ["xrd+xml"],
+  "application/opensearchdescription+xml" => ["xml"],
   "application/jrd+json" => ["jrd+json"],
   "application/activity+json" => ["activity+json"],
   "application/ld+json" => ["activity+json"]
 }
 
 config :mime, :extensions, %{
-  "activity+json" => "application/activity+json"
+  "xrd+xml" => "text/plain",
+  "jrd+json" => "text/plain",
+  "activity+json" => "text/plain"
 }
 
+# ———————————————————————————————————————————————————————————————
+
 config :tesla, :adapter, {Tesla.Adapter.Finch, name: MyFinch}
 
 # Configures http settings, upstream proxy etc.
@@ -168,8 +186,10 @@
   receive_timeout: :timer.seconds(15),
   proxy_url: nil,
   user_agent: :default,
-  pool_size: 50,
-  adapter: []
+  pool_size: 10,
+  adapter: [],
+  # see: https://hexdocs.pm/finch/Finch.html#start_link/1
+  pool_max_idle_time: :timer.seconds(30)
 
 config :pleroma, :instance,
   name: "Akkoma",
@@ -232,7 +252,8 @@
   registration_reason_length: 500,
   external_user_synchronization: true,
   extended_nickname_format: true,
-  cleanup_attachments: false,
+  cleanup_attachments: true,
+  cleanup_attachments_delay: 1800,
   multi_factor_authentication: [
     totp: [
       # digits 6 or 8
@@ -280,6 +301,7 @@
   allow_headings: false,
   allow_tables: false,
   allow_fonts: false,
+  allow_math: true,
   scrub_policy: [
     Pleroma.HTML.Scrubber.Default,
     Pleroma.HTML.Transform.MediaProxy
@@ -290,7 +312,6 @@
     alwaysShowSubjectInput: true,
     background: "",
     collapseMessageWithSubject: false,
-    disableChat: false,
     greentext: false,
     hideFilteredStatuses: false,
     hideMutedPosts: false,
@@ -311,7 +332,7 @@
     showFeaturesPanel: true,
     showInstanceSpecificPanel: false,
     subjectLineBehavior: "email",
-    theme: "itepechi",
+    theme: "bnakkoma",
     webPushNotifications: false,
     conversationDisplay: "linear"
   },
@@ -359,7 +380,7 @@
       purpose: "maskable"
     }
   ],
-  theme_color: "#d6cec7",
+  theme_color: "#373737",
   background_color: "#2f2f2f"
 
 config :pleroma, :activitypub,
@@ -370,6 +391,7 @@
   note_replies_output_limit: 5,
   sign_object_fetches: true,
   authorized_fetch_mode: false,
+  min_key_refetch_interval: 86_400,
   max_collection_objects: 50
 
 config :pleroma, :streamer,
@@ -398,6 +420,7 @@
   accept: [],
   avatar_removal: [],
   banner_removal: [],
+  background_removal: [],
   reject_deletes: [],
   handle_threads: true
 
@@ -426,8 +449,6 @@
   threshold: 604_800,
   actions: [:delist, :strip_followers]
 
-config :pleroma, :mrf_follow_bot, follower_nickname: nil
-
 config :pleroma, :mrf_reject_newly_created_account_notes, age: 86_400
 
 config :pleroma, :rich_media,
@@ -438,8 +459,12 @@
     Pleroma.Web.RichMedia.Parsers.TwitterCard,
     Pleroma.Web.RichMedia.Parsers.OEmbed
   ],
-  failure_backoff: :timer.minutes(20),
-  ttl_setters: [Pleroma.Web.RichMedia.Parser.TTL.AwsSignedUrl]
+  failure_backoff: 60_000,
+  ttl_setters: [
+    Pleroma.Web.RichMedia.Parser.TTL.AwsSignedUrl,
+    Pleroma.Web.RichMedia.Parser.TTL.Opengraph
+  ],
+  max_body: 5_000_000
 
 config :pleroma, :media_proxy,
   enabled: false,
@@ -473,10 +498,6 @@
   image_quality: 85,
   min_content_length: 100 * 1024
 
-config :pleroma, :shout,
-  enabled: true,
-  limit: 5_000
-
 config :phoenix, :format_encoders, json: Jason, "activity+json": Jason
 
 config :phoenix, :json_library, Jason
@@ -581,7 +602,9 @@
     mute_expire: 5,
     search_indexing: 10,
     nodeinfo_fetcher: 1,
-    database_prune: 1
+    database_prune: 1,
+    rich_media_backfill: 2,
+    rich_media_expiration: 2
   ],
   plugins: [
     Oban.Plugins.Pruner,
@@ -597,7 +620,8 @@
   retries: [
     federator_incoming: 5,
     federator_outgoing: 5,
-    search_indexing: 2
+    search_indexing: 2,
+    rich_media_backfill: 1
   ],
   timeout: [
     activity_expiration: :timer.seconds(5),
@@ -619,7 +643,8 @@
     mute_expire: :timer.seconds(5),
     search_indexing: :timer.seconds(5),
     nodeinfo_fetcher: :timer.seconds(10),
-    database_prune: :timer.minutes(10)
+    database_prune: :timer.minutes(10),
+    rich_media_backfill: :timer.seconds(30)
   ]
 
 config :pleroma, Pleroma.Formatter,
@@ -820,8 +845,10 @@
 config :pleroma, configurable_from_database: false
 
 config :pleroma, Pleroma.Repo,
-  parameters: [gin_fuzzy_search_limit: "500"],
-  prepare: :unnamed
+  parameters: [
+    gin_fuzzy_search_limit: "500",
+    plan_cache_mode: "force_custom_plan"
+  ]
 
 config :pleroma, :majic_pool, size: 2
 
@@ -870,7 +897,8 @@
     # these features are placed in the ':extensions' section for clarity
     # as they are not in the upstream, at least not yet
     search_type_media: true,
-    search_option_following: true
+    search_option_following: true,
+    search_option_local: true
   }
 
 config :pleroma, Pleroma.Search.Meilisearch,

config/description.exs

@@ -100,18 +100,23 @@
         label: "Base URL",
         type: :string,
         description:
-          "Base URL for the uploads. Required if you use a CDN or host attachments under a different domain.",
+          "Base URL for the uploads. Required if you use a CDN or host attachments under a different domain - it is HIGHLY recommended that you **do not** set this to be the same as the domain akkoma is hosted on.",
         suggestions: [
-          "https://cdn-host.com"
+          "https://media.akkoma.dev/media/"
         ]
       },
       %{
-        key: :proxy_remote,
-        type: :boolean,
-        description: """
-        Proxy requests to the remote uploader.\n
-        Useful if media upload endpoint is not internet accessible.
-        """
+        key: :allowed_mime_types,
+        label: "Allowed MIME types",
+        type: {:list, :string},
+        description:
+          "List of MIME (main) types uploads are allowed to identify themselves with. Other types may still be uploaded, but will identify as a generic binary to clients. WARNING: Loosening this over the defaults can lead to security issues. Removing types is safe, but only add to the list if you are sure you know what you are doing.",
+        suggestions: [
+          "image",
+          "audio",
+          "video",
+          "font"
+        ]
       },
       %{
         key: :filename_display_max_length,
@@ -209,6 +214,26 @@
       }
     ]
   },
+  %{
+    group: :pleroma,
+    key: Pleroma.Upload.Filter.Exiftool.StripMetadata,
+    type: :group,
+    description: "Strip specified metadata from image uploads",
+    children: [
+      %{
+        key: :purge,
+        description: "Metadata fields or groups to strip",
+        type: {:list, :string},
+        suggestions: ["all", "CommonIFD0"]
+      },
+      %{
+        key: :preserve,
+        description: "Metadata fields or groups to preserve (takes precedence over stripping)",
+        type: {:list, :string},
+        suggestions: ["ColorSpaces", "Orientation"]
+      }
+    ]
+  },
   %{
     group: :pleroma,
     key: Pleroma.Emails.Mailer,
@@ -1159,7 +1184,7 @@
             logoMask: true,
             minimalScopesMode: false,
             noAttachmentLinks: false,
-            nsfwCensorImage: "/static/img/nsfw.74818f9.png",
+            nsfwCensorImage: "",
             postContentType: "text/plain",
             redirectRootLogin: "/main/friends",
             redirectRootNoLogin: "/main/all",
@@ -1169,7 +1194,9 @@
             showInstanceSpecificPanel: false,
             subjectLineBehavior: "email",
             theme: "pleroma-dark",
-            webPushNotifications: false
+            webPushNotifications: false,
+            backendCommitUrl: "",
+            frontendCommitUrl: ""
           }
         ],
         children: [
@@ -1260,7 +1287,7 @@
             type: {:string, :image},
             description:
               "URL of the image to use for hiding NSFW media attachments in the timeline",
-            suggestions: ["/static/img/nsfw.74818f9.png"]
+            suggestions: [""]
           },
           %{
             key: :postContentType,
@@ -1373,6 +1400,18 @@
             label: "Stop Gifs",
             type: :boolean,
             description: "Whether to pause animated images until they're hovered on"
+          },
+          %{
+            key: :backendCommitUrl,
+            label: "Backend Commit URL",
+            type: :string,
+            description: "URL prefix for backend commit hashes"
+          },
+          %{
+            key: :frontendCommitUrl,
+            label: "Frontend Commit URL",
+            type: :string,
+            description: "URL prefix for frontend commit hashes"
           }
         ]
       },
@@ -2684,8 +2723,8 @@
       %{
         key: :pool_size,
         type: :integer,
-        description: "Number of concurrent outbound HTTP requests to allow. Default 50.",
-        suggestions: [50]
+        description: "Number of concurrent outbound HTTP requests to allow PER HOST. Default 10.",
+        suggestions: [10]
       },
       %{
         key: :adapter,
@@ -2708,6 +2747,13 @@
             ]
           }
         ]
+      },
+      %{
+        key: :pool_max_idle_time,
+        type: :integer,
+        description:
+          "Number of seconds to retain an HTTP pool; pool will remain if actively in use. Default 30 seconds (in ms).",
+        suggestions: [30_000]
       }
     ]
   },

config/dokku.exs

@@ -1,25 +0,0 @@
-import Config
-
-config :pleroma, Pleroma.Web.Endpoint,
-  http: [
-    port: String.to_integer(System.get_env("PORT") || "4000"),
-    protocol_options: [max_request_line_length: 8192, max_header_value_length: 8192]
-  ],
-  protocol: "http",
-  secure_cookie_flag: false,
-  url: [host: System.get_env("APP_HOST"), scheme: "https", port: 443],
-  secret_key_base: "+S+ULgf7+N37c/lc9K66SMphnjQIRGklTu0BRr2vLm2ZzvK0Z6OH/PE77wlUNtvP"
-
-database_url =
-  System.get_env("DATABASE_URL") ||
-    raise """
-    environment variable DATABASE_URL is missing.
-    For example: ecto://USER:PASS@HOST/DATABASE
-    """
-
-config :pleroma, Pleroma.Repo,
-  # ssl: true,
-  url: database_url,
-  pool_size: String.to_integer(System.get_env("POOL_SIZE") || "10")
-
-config :pleroma, :instance, name: "#{System.get_env("APP_NAME")} CI Instance"

config/test.exs

@@ -22,9 +22,12 @@
 config :pleroma, :auth, oauth_consumer_strategies: []
 
 config :pleroma, Pleroma.Upload,
+  base_url: "http://localhost:4001/media/",
   filters: [],
   link_name: false
 
+config :pleroma, :media_proxy, base_url: "http://localhost:4001"
+
 config :pleroma, Pleroma.Uploaders.Local, uploads: "test/uploads"
 
 config :pleroma, Pleroma.Emails.Mailer, adapter: Swoosh.Adapters.Test, enabled: true
@@ -48,7 +51,8 @@
   hostname: System.get_env("DB_HOST") || "localhost",
   pool: Ecto.Adapters.SQL.Sandbox,
   pool_size: 50,
-  queue_target: 5000
+  queue_target: 5000,
+  log: false
 
 config :pleroma, :dangerzone, override_repo_pool_size: true
 
@@ -60,7 +64,8 @@
 config :pleroma, :rich_media,
   enabled: false,
   ignore_hosts: [],
-  ignore_tld: ["local", "localdomain", "lan"]
+  ignore_tld: ["local", "localdomain", "lan"],
+  max_body: 2_000_000
 
 config :pleroma, :instance,
   multi_factor_authentication: [
@@ -144,6 +149,8 @@
 config :pleroma, :instances_favicons, enabled: false
 config :pleroma, :instances_nodeinfo, enabled: false
 
+config :pleroma, Pleroma.Web.RichMedia.Backfill, provider: Pleroma.Web.RichMedia.Backfill
+
 if File.exists?("./config/test.secret.exs") do
   import_config "test.secret.exs"
 else

coveralls.json

@@ -1,7 +0,0 @@
-{
-  "skip_files": [
-    "test/support",
-    "lib/mix/tasks/pleroma/benchmark.ex",
-    "lib/credo/check/consistency/file_location.ex"
-  ]
-}

diagnostic-tools/binary-leak-checker.sh

@@ -0,0 +1,10 @@
+if [ "$#" -ne 2 ]; then
+	echo "Usage: binary-leak-checker.sh <nodename> <erlang cookie>"
+	exit 1
+fi
+
+echo "The command you want to run is:
+:recon.bin_leak(10)
+"
+
+iex --sname debug --remsh $1 --erl "-setcookie $2" 

docker-compose.yml

@@ -7,6 +7,14 @@ services:
     image: postgres:14-alpine
     ## Use the following image instead if you want to use PGroonga
     # image: groonga/pgroonga:3.1.1-alpine-14
+    ## Uncomment and tweak these values if necessary
+    # command:
+    #   - -c
+    #   - session_preload_libraries=auto_explain
+    #   - -c
+    #   - auto_explain.log_min_duration=250ms
+    #   - -c
+    #   - auto_explain.log_analyze=on
     restart: unless-stopped
     environment:
       POSTGRES_DB: akkoma
@@ -20,6 +28,7 @@ services:
 
   akkoma:
     image: akkoma:latest
+    pull_policy: never
     build: .
     restart: unless-stopped
     environment:

docs/README.md

@@ -15,7 +15,7 @@ source venv/bin/activate
 pip install -r requirements.txt
 
 # Run an http server who rebuilds when files change
-# Accessable on http://127.0.0.1:8000
+# Accessible on http://127.0.0.1:8000
 mkdocs serve
 
 # Build the docs

docs/docs/administration/CLI_tasks/config.md

@@ -1,4 +1,4 @@
-# Transfering the config to/from the database
+# Transferring the config to/from the database
 
 {! administration/CLI_tasks/general_cli_task_info.include !}
 
@@ -34,9 +34,9 @@
 
 Options:
 
-- `<path>` - where to save migrated config. E.g. `--path=/tmp`. If file saved into non standart folder, you must manually copy file into directory where Pleroma can read it. For OTP install path will be `PLEROMA_CONFIG_PATH` or `/etc/akkoma`. For installation from source - `config` directory in the akkoma folder.
-- `<env>` - environment, for which is migrated config. By default is `prod`.
-- To delete transferred settings from database optional flag `-d` can be used
+- `<path>` - where to save migrated config. E.g. `--path=/tmp`. If the file was saved into a non-standard directory, you must manually copy it into a location where Pleroma can read it. For OTP the install path will be `PLEROMA_CONFIG_PATH` or `/etc/akkoma`. For installation from source it’s the `config` directory in the akkoma folder.
+- `<env>` - environment, for which is migrated config. By default, it’s `prod`.
+- To delete transferred settings from database the optional flag `-d` can be used
 
 === "OTP"
     ```sh
@@ -48,7 +48,7 @@ Options:
     mix pleroma.config migrate_from_db [--env=<env>] [-d] [--path=<path>]
     ```
 
-## Dump all of the config settings defined in the database
+## Dump all config settings defined in the database
 
 === "OTP"
 
@@ -172,15 +172,16 @@ it may be easier to dump the values to JSON and then modify them in a text edito
 === "From Source"
 
     ```sh
-    mix pleroma.config dump_to_file group key path 
+    mix pleroma.config dump_to_file group key path
     # For example, to dump the MRF simple configuration:
     mix pleroma.config dump_to_file pleroma mrf_simple /tmp/mrf_simple.json
     ```
 
 ## Loading specific configuration values from JSON
 
-**Note:** This will overwrite any existing value in the database, and can
-cause crashes if you do not have exactly the correct formatting.
+!!!note
+    This will overwrite any existing value in the database, and can
+    cause crashes if you do not have exactly the correct formatting.
 
 Once you have modified the JSON file, you can load it back into the database.
 
@@ -200,6 +201,7 @@ Once you have modified the JSON file, you can load it back into the database.
     mix pleroma.config load_from_file /tmp/mrf_simple.json
     ```
 
-**NOTE** an instance reboot is needed for many changes to take effect,
-you may want to visit `/api/v1/pleroma/admin/restart` on your instance
-to soft-restart the instance.
+!!! note
+    An instance reboot is needed for many changes to take effect,
+    you may want to visit `/api/v1/pleroma/admin/restart` on your instance
+    to soft-restart the instance.

docs/docs/administration/CLI_tasks/database.md

@@ -7,7 +7,7 @@
 
 ## Replace embedded objects with their references
 
-Replaces embedded objects with references to them in the `objects` table. Only needs to be ran once if the instance was created before Pleroma 1.0.5. The reason why this is not a migration is because it could significantly increase the database size after being ran, however after this `VACUUM FULL` will be able to reclaim about 20% (really depends on what is in the database, your mileage may vary) of the db size before the migration.
+Replaces embedded objects with references to them in the `objects` table. Only needs to be ran once if the instance was created before Pleroma 1.0.5. The reason why this is not a migration is because it could significantly increase the database size after being ran, however after this `VACUUM FULL` will be able to reclaim about 20% (really depends on what is in the database, your mileage may vary) of the database size before the migration.
 
 === "OTP"
 
@@ -29,7 +29,7 @@ Replaces embedded objects with references to them in the `objects` table. Only n
 This will prune remote posts older than 90 days (configurable with [`config :pleroma, :instance, remote_post_retention_days`](../../configuration/cheatsheet.md#instance)) from the database. Pruned posts may be refetched in some cases.
 
 !!! note
-    The disk space will only be reclaimed after a proper vacuum. By default Postgresql does this for you on a regular basis, but if your instance has been running for a long time and there are many rows deleted, it may be advantageous to use `VACUUM FULL` (e.g. by using the `--vacuum` option).
+    The disk space will only be reclaimed after a proper vacuum. By default, Postgresql does this for you on a regular basis, but if your instance has been running for a long time and there are many rows deleted, it may be advantageous to use `VACUUM FULL` (e.g. by using the `--vacuum` option).
 
 !!! danger
     You may run out of disk space during the execution of the task or vacuuming if you don't have about 1/3rds of the database size free. Vacuum causes a substantial increase in I/O traffic, and may lead to a degraded experience while it is running.
@@ -48,11 +48,46 @@ This will prune remote posts older than 90 days (configurable with [`config :ple
 
 ### Options
 
-- `--keep-threads` - Don't prune posts when they are part of a thread where at least one post has seen local interaction (e.g. one of the posts is a local post, or is favourited by a local user, or has been repeated by a local user...). It also wont delete posts when at least one of the posts in that thread is kept (e.g. because one of the posts has seen recent activity).
+- `--keep-followed <mode>` - If set to `posts` all posts and boosts of users with local follows will be kept.  
+    If set to `full` it will additionally keep any posts such users interacted with; this requires `--keep-threads`.  
+    By default this is set to `none` and followed users are not treated special.
+- `--keep-threads` - Don't prune posts when they are part of a thread where at least one post has seen local interaction (e.g. one of the posts is a local post, or is favourited by a local user, or has been repeated by a local user...). It also won’t delete posts when at least one of the posts in the thread has seen recent activity or is kept due to `--keep-followed`.
 - `--keep-non-public` - Keep non-public posts like DM's and followers-only, even if they are remote.
+- `--limit` - limits how many remote posts get pruned. This limit does **not** apply to any of the follow up jobs. If wanting to keep the database load in check it is thus advisable to run the standalone `prune_orphaned_activities` task with a limit afterwards instead of passing `--prune-orphaned-activities` to this task.
 - `--prune-orphaned-activities` - Also prune orphaned activities afterwards. Activities are things like Like, Create, Announce, Flag (aka reports)... They can significantly help reduce the database size.
+- `--prune-pinned` - Also prune pinned posts; keeping pinned posts does not suffice to protect their threads from pruning, even when using `--keep-threads`.  
+    Note, if using this option and pinned posts are pruned, they and their threads will just be refetched on the next user update. Therefore it usually doesn't bring much gain while incurring a heavy fetch load after pruning.
 - `--vacuum` - Run `VACUUM FULL` after the objects are pruned. This should not be used on a regular basis, but is useful if your instance has been running for a long time before pruning.
 
+## Prune orphaned activities from the database
+
+This will prune activities which are no longer referenced by anything.
+Such activities might be the result of running `prune_objects` without `--prune-orphaned-activities`.
+The same notes and warnings apply as for `prune_objects`.
+
+The task will print out how many rows were freed in total in its last
+line of output in the form `Deleted 345 rows`.  
+When running the job in limited batches this can be used to determine
+when all orphaned activities have been deleted.
+
+=== "OTP"
+
+    ```sh
+    ./bin/pleroma_ctl database prune_orphaned_activities [option ...]
+    ```
+
+=== "From Source"
+
+    ```sh
+    mix pleroma.database prune_orphaned_activities [option ...]
+    ```
+
+### Options
+
+- `--limit n` - Only delete up to `n` activities in each query making up this job, i.e. if this job runs two queries at most `2n` activities will be deleted. Running this task repeatedly in limited batches can help maintain the instance’s responsiveness while still freeing up some space.
+- `--no-singles` - Do not delete activites referencing single objects
+- `--no-arrays` - Do not delete activites referencing an array of objects
+
 ## Create a conversation for all existing DMs
 
 Can be safely re-run
@@ -100,7 +135,7 @@ Can be safely re-run
 ## Vacuum the database
 
 !!! note
-    By default Postgresql has an autovacuum deamon running. While the tasks described here can help in some cases, they shouldn't be needed on a regular basis. See [the Postgresql docs on vacuuming](https://www.postgresql.org/docs/current/sql-vacuum.html) for more information on this.
+    By default, Postgresql has an autovacuum daemon running. While the tasks described here can help in some cases, they shouldn't be needed on a regular basis. See [the Postgresql docs on vacuuming](https://www.postgresql.org/docs/current/sql-vacuum.html) for more information on this.
 
 ### Analyze
 
@@ -120,7 +155,7 @@ Running an `analyze` vacuum job can improve performance by updating statistics u
 
 ### Full
 
-Running a `full` vacuum job rebuilds your entire database by reading all of the data and rewriting it into smaller
+Running a `full` vacuum job rebuilds your entire database by reading all data and rewriting it into smaller
 and more compact files with an optimized layout. This process will take a long time and use additional disk space as
 it builds the files side-by-side the existing database files. It can make your database faster and use less disk space,
 but should only be run if necessary. **It is safe to cancel this.**
@@ -153,7 +188,7 @@ but should only be run if necessary. **It is safe to cancel this.**
 
 ## Change Text Search Configuration
 
-Change `default_text_search_config` for database and (if necessary) text_search_config used in index, then rebuild index (it may take time). 
+Change `default_text_search_config` for database and (if necessary) text_search_config used in index, then rebuild index (it may take time).
 
 === "OTP"
 
@@ -172,9 +207,9 @@ See [PostgreSQL documentation](https://www.postgresql.org/docs/current/textsearc
 ## Pruning old activities
 
 Over time, transient `Delete` activities and `Tombstone` objects
-can accumulate in your database, inflating its size. This is not ideal. 
-There is a periodic task to prune these transient objects, 
-but on first run this may take a while on older instances to catch up
+can accumulate in your database, inflating its size. This is not ideal.
+There is a periodic task to prune these transient objects,
+but on the first run this may take a while on older instances to catch up
 to the current day.
 
 === "OTP"

docs/docs/administration/CLI_tasks/diagnostics.md

@@ -26,5 +26,5 @@ from the perspective of another given user.
     `./bin/pleroma_ctl diagnostics user_timeline <nickname> <viewing_nickname>`
 
 === "From Source"
-    
-    `mix pleroma.diagnostics user_timeline <nickname> <viewing_nickname>`
+
+    `mix pleroma.diagnostics user_timeline <nickname> <viewing_nickname>`

docs/docs/administration/CLI_tasks/digest.md

@@ -16,7 +16,6 @@
     mix pleroma.digest test <nickname> [since_date]
     ```
 
-
 Example: 
 
 === "OTP"
@@ -30,4 +29,3 @@ Example:
     ```sh
     mix pleroma.digest test donaldtheduck 2019-05-20
     ```
-

docs/docs/administration/CLI_tasks/email.md

@@ -1,4 +1,4 @@
-# EMail administration tasks
+# Email administration tasks
 
 {! administration/CLI_tasks/general_cli_task_info.include !}
 

docs/docs/administration/CLI_tasks/emoji.md

@@ -14,9 +14,8 @@
     mix pleroma.emoji ls-packs [option ...]
     ```
 
-
 ### Options
-- `-m, --manifest PATH/URL` - path to a custom manifest, it can either be an URL starting with `http`, in that case the manifest will be fetched from that address, or a local path
+- `-m, --manifest PATH/URL` - path to a custom manifest, it can either be a URL starting with `http`, in that case the manifest will be fetched from that address, or a local path
 
 ## Fetch, verify and install the specified packs from the manifest into `STATIC-DIR/emoji/PACK-NAME`
 

docs/docs/administration/CLI_tasks/frontend.md

@@ -12,14 +12,14 @@
     mix pleroma.frontend install <frontend> [--ref <ref>] [--file <file>] [--build-url <build-url>] [--path <path>] [--build-dir <build-dir>]
     ```
 
-Frontend can be installed either from local zip file, or automatically downloaded from the web.
+Frontend can be installed either from a local ZIP file, or automatically downloaded from the web.
 
 You can give all the options directly on the command line, but missing information will be filled out by looking at the data configured under `frontends.available` in the config files.
 
 Currently, known `<frontend>` values are:
 
 - [admin-fe](https://akkoma.dev/AkkomaGang/admin-fe)
-- [mastodon-fe](https://akkoma.dev/AkkomaGang/masto-fe)
+- [masto-fe](https://akkoma.dev/AkkomaGang/masto-fe)
 - [pleroma-fe](https://akkoma.dev/AkkomaGang/pleroma-fe)
 
 You can still install frontends that are not configured, see below.
@@ -42,7 +42,7 @@ For a frontend configured under the `available` key, it's enough to install it b
 
 This will download the latest build for the pre-configured `ref` and install it. It can then be configured as the one of the served frontends in the config file (see `primary` or `admin`).
 
-You can override any of the details. To install an Akkoma-FE build from a different URL, you could do this:
+You can override any of the details. To install an akkoma-fe build from a different URL, you could do this:
 
 === "OTP"
 
@@ -56,7 +56,7 @@ You can override any of the details. To install an Akkoma-FE build from a differ
     mix pleroma.frontend install pleroma-fe --ref 2hu_edition --build-url https://example.org/raymoo.zip
     ```
 
-Similarly, you can also install from a local zip file.
+Similarly, you can also install from a local ZIP file.
 
 === "OTP"
 
@@ -90,5 +90,4 @@ The installation process is the same, but you will have to give all the needed o
     mix pleroma.frontend install gensokyo --ref master --build-url https://gensokyo.2hu/builds/marisa.zip
     ```
 
-If you don't have a zip file but just want to install a frontend from a local path, you can simply copy the files over a folder of this template: `${instance_static}/frontends/${name}/${ref}`.
-
+If you don't have a ZIP file but just want to install a frontend from a local path, you can simply copy the files over a folder of this template: `${instance_static}/frontends/${name}/${ref}`.

docs/docs/administration/CLI_tasks/general_cli_task_info.include

@@ -1,5 +1,5 @@
-Every command should be ran as the `akkoma` user from it's home directory. For example if you are superuser, you would have to wrap the command in `su akkoma -s $SHELL -lc "$COMMAND"`.
+Every command should be ran as the `akkoma` user from its home directory. For example if you are superuser, you would have to wrap the command in `su akkoma -s $SHELL -lc "$COMMAND"`.
 
 ??? note "From source note about `MIX_ENV`"
 
-     The `mix` command should be prefixed with the name of environment your Akkoma server is running in, usually it's `MIX_ENV=prod`
+     The `mix` command should be prefixed with the name of the environment your Akkoma server is running in, usually it's `MIX_ENV=prod`

docs/docs/administration/CLI_tasks/instance.md

@@ -15,7 +15,6 @@
     mix pleroma.instance gen [option ...]
     ```
 
-
 If any of the options are left unspecified, you will be prompted interactively.
 
 ### Options
@@ -35,10 +34,11 @@ If any of the options are left unspecified, you will be prompted interactively.
 - `--db-configurable <Y|N>` - Allow/disallow configuring instance from admin part
 - `--uploads-dir <path>` - the directory uploads go in when using a local uploader
 - `--static-dir <path>` - the directory custom public files should be read from (custom emojis, frontend bundle overrides, robots.txt, etc.)
-- `--listen-ip <ip>` - the ip the app should listen to, defaults to 127.0.0.1
+- `--listen-ip <ip>` - the IP the app should listen to, defaults to 127.0.0.1
 - `--listen-port <port>` - the port the app should listen to, defaults to 4000
-- `--strip-uploads <Y|N>` - use ExifTool to strip uploads of sensitive location data
+- `--strip-uploads-metadata <Y|N>` - use ExifTool to strip uploads of metadata when possible
+- `--read-uploads-description <Y|N>` - use ExifTool to read image descriptions from uploads
 - `--anonymize-uploads <Y|N>` - randomize uploaded filenames
 - `--dedupe-uploads <Y|N>` - store files based on their hash to reduce data storage requirements if duplicates are uploaded with different filenames
-- `--skip-release-env` - skip generation the release environment file
+- `--skip-release-env` - skip generation of the release environment file
 - `--release-env-file` - release environment file path

docs/docs/administration/CLI_tasks/oauth_app.md

@@ -4,7 +4,7 @@
 
 ## Create trusted OAuth App.
 
-Optional params:
+Optional parameters:
   * `-s SCOPES` - scopes for app, e.g. `read,write,follow,push`.
 
 === "OTP"
@@ -17,4 +17,4 @@ Optional params:
 
     ```sh
     mix pleroma.app create -n APP_NAME -r REDIRECT_URI
-    ```
+    ```

docs/docs/administration/CLI_tasks/robots_txt.md

@@ -17,5 +17,5 @@ If you want to generate a restrictive `robots.txt`, you can run the following mi
 === "From Source"
 
     ```sh
-    mix pleroma.robotstxt disallow_all
+    mix pleroma.robots_txt disallow_all
     ```

docs/docs/administration/CLI_tasks/security.md

@@ -0,0 +1,56 @@
+# Security-related tasks
+
+{! administration/CLI_tasks/general_cli_task_info.include !}
+
+!!! danger
+    Many of these tasks were written in response to a patched exploit.
+    It is recommended to run those very soon after installing its respective security update.
+    Over time with db migrations they might become less accurate or be removed altogether.
+    If you never ran an affected version, there’s no point in running them.
+
+## Spoofed AcitivityPub objects exploit (2024-03, fixed in 3.11.1)
+
+### Search for uploaded spoofing payloads
+
+Scans local uploads for spoofing payloads.
+If the instance is not using the local uploader it was not affected.
+Attachments wil be scanned anyway in case local uploader was used in the past.
+
+!!! note
+    This cannot reliably detect payloads attached to deleted posts.
+
+=== "OTP"
+
+    ```sh
+    ./bin/pleroma_ctl security spoof-uploaded
+    ```
+
+=== "From Source"
+
+    ```sh
+    mix pleroma.security spoof-uploaded
+    ```
+
+### Search for counterfeit posts in database
+
+Scans all notes in the database for signs of being spoofed.
+
+!!! note
+    Spoofs targeting local accounts can be detected rather reliably
+    (with some restrictions documented in the task’s logs).
+    Counterfeit posts from remote users cannot. A best-effort attempt is made, but
+    a thorough attacker can avoid this and it may yield a small amount of false positives.
+
+    Should you find counterfeit posts of local users, let other admins know so they can delete the too.
+
+=== "OTP"
+
+    ```sh
+    ./bin/pleroma_ctl security spoof-inserted
+    ```
+
+=== "From Source"
+
+    ```sh
+    mix pleroma.security spoof-inserted
+    ```

docs/docs/administration/CLI_tasks/user.md

@@ -16,7 +16,6 @@
     mix pleroma.user new <nickname> <email> [option ...]
     ```
 
-
 ### Options
 - `--name <name>` - the user's display name
 - `--bio <bio>` - the user's bio
@@ -39,8 +38,7 @@
     mix pleroma.user list
     ```
 
-
-## Generate an invite link
+## Generate an invitation link
 
 === "OTP"
 
@@ -54,7 +52,6 @@
     mix pleroma.user invite [option ...]
     ```
 
-
 ### Options
 - `--expires-at DATE` - last day on which token is active (e.g. "2019-04-05")
 - `--max-use NUMBER` - maximum numbers of token uses
@@ -73,7 +70,6 @@
     mix pleroma.user invites
     ```
 
-
 ## Revoke invite
 
 === "OTP"
@@ -88,7 +84,6 @@
     mix pleroma.user revoke_invite <token>
     ```
 
-
 ## Delete a user
 
 === "OTP"
@@ -103,7 +98,6 @@
     mix pleroma.user rm <nickname>
     ```
 
-
 ## Delete user's posts and interactions
 
 === "OTP"
@@ -118,7 +112,6 @@
     mix pleroma.user delete_activities <nickname>
     ```
 
-
 ## Sign user out from all applications (delete user's OAuth tokens and authorizations)
 
 === "OTP"
@@ -161,7 +154,6 @@
     mix pleroma.user deactivate NICKNAME
     ```
 
-
 ## Deactivate all accounts from an instance and unsubscribe local users on it
 
 === "OTP"
@@ -176,7 +168,6 @@
     mix pleroma.user deactivate_all_from_instance <instance>
     ```
 
-
 ## Create a password reset link for user
 
 === "OTP"
@@ -191,8 +182,7 @@
     mix pleroma.user reset_password <nickname>
     ```
 
-
-## Disable Multi Factor Authentication (MFA/2FA) for a user
+## Disable Multi-Factor Authentication (MFA/2FA) for a user
 
 === "OTP"
 
@@ -206,7 +196,6 @@
     mix pleroma.user reset_mfa <nickname>
     ```
 
-
 ## Set the value of the given user's settings
 
 === "OTP"
@@ -241,7 +230,6 @@
     mix pleroma.user tag <nickname> <tags>
     ```
 
-
 ## Delete tags from a user
 
 === "OTP"
@@ -256,7 +244,6 @@
     mix pleroma.user untag <nickname> <tags>
     ```
 
-
 ## Toggle confirmation status of the user
 
 === "OTP"
@@ -304,7 +291,7 @@
 ## Fix following state
 
 Sometimes the system can get into a situation where
-it think you're already following someone and won't send a request
+it thinks you're already following someone and won't send a request
 to the remote instance, or won't let you unfollow someone. This
 bug was fixed, but in case you encounter these weird states:
 
@@ -324,4 +311,4 @@ The first argument is the local user's nickname - if you are `myuser@myinstance`
 
 The second is the remote user, consisting of both nickname AND domain.
 
-If you are a weird follow state situation and cannot resolve it with the above, you may need to co-operate with the remote admin to clear the state their side too - they should provide the arguments *backwards*, i.e `fix_follow_state remote local`.
+If you are a weird follow state situation and cannot resolve it with the above, you may need to co-operate with the remote admin to clear the state their side too - they should provide the arguments *backwards*, i.e. `fix_follow_state remote local`.

docs/docs/administration/backup.md

@@ -4,38 +4,35 @@
 
 1. Stop the Akkoma service.
 2. Go to the working directory of Akkoma (default is `/opt/akkoma`)
-3. Run[¹] `sudo -Hu postgres pg_dump -d akkoma --format=custom -f </path/to/backup_location/akkoma.pgdump>` (make sure the postgres user has write access to the destination file)
-4. Copy `akkoma.pgdump`, `config/prod.secret.exs`[²], `config/setup_db.psql` (if still available) and the `uploads` folder to your backup destination. If you have other modifications, copy those changes too.
+3. Run `sudo -Hu postgres pg_dump -d akkoma --format=custom -f </path/to/backup_location/akkoma.pgdump>`[¹] (make sure the postgres user has write access to the destination file)
+4. Copy `akkoma.pgdump`, `config/config.exs`[²], `uploads` folder, and [static directory](../configuration/static_dir.md) to your backup destination. If you have other modifications, copy those changes too.
 5. Restart the Akkoma service.
 
-[¹]: We assume the database name is "akkoma". If not, you can find the correct name in your config files.  
-[²]: If you've installed using OTP, you need `config/config.exs` instead of `config/prod.secret.exs`.  
+[¹]: We assume the database name is "akkoma". If not, you can find the correct name in your configuration files.  
+[²]: If you have a from source installation, you need `config/prod.secret.exs` instead of `config/config.exs`. The `config/config.exs` file also exists, but in case of from source installations, it only contains the default values and it is tracked by Git, so you don't need to back it up.
 
 ## Restore/Move
 
 1. Optionally reinstall Akkoma (either on the same server or on another server if you want to move servers).
 2. Stop the Akkoma service.
 3. Go to the working directory of Akkoma (default is `/opt/akkoma`)
-4. Copy the above mentioned files back to their original position.
-5. Drop the existing database and user if restoring in-place[¹]. `sudo -Hu postgres psql -c 'DROP DATABASE akkoma;';` `sudo -Hu postgres psql -c 'DROP USER akkoma;'`
-6. Restore the database schema and akkoma role using either of the following options
-    * You can use the original `setup_db.psql` if you have it[²]: `sudo -Hu postgres psql -f config/setup_db.psql`.
-    * Or recreate the database and user yourself (replace the password with the one you find in the config file) `sudo -Hu postgres psql -c "CREATE USER akkoma WITH ENCRYPTED PASSWORD '<database-password-wich-you-can-find-in-your-config-file>'; CREATE DATABASE akkoma OWNER akkoma;"`.
+4. Copy the above-mentioned files back to their original position.
+5. Drop the existing database and user[¹]. `sudo -Hu postgres psql -c 'DROP DATABASE akkoma;';` `sudo -Hu postgres psql -c 'DROP USER akkoma;'`
+6. Restore the database schema and akkoma role[¹] (replace the password with the one you find in the configuration file), `sudo -Hu postgres psql -c "CREATE USER akkoma WITH ENCRYPTED PASSWORD '<database-password-wich-you-can-find-in-your-configuration-file>';"` `sudo -Hu postgres psql -c "CREATE DATABASE akkoma OWNER akkoma;"`.
 7. Now restore the Akkoma instance's data into the empty database schema[¹]: `sudo -Hu postgres pg_restore -d akkoma -v -1 </path/to/backup_location/akkoma.pgdump>`
-8. If you installed a newer Akkoma version, you should run `MIX_ENV=prod mix ecto.migrate`[³]. This task performs database migrations, if there were any.
+8. If you installed a newer Akkoma version, you should run the database migrations `./bin/pleroma_ctl migrate`[²].
 9. Restart the Akkoma service.
 10. Run `sudo -Hu postgres vacuumdb --all --analyze-in-stages`. This will quickly generate the statistics so that postgres can properly plan queries.
-11. If setting up on a new server configure Nginx by using the `installation/akkoma.nginx` config sample or reference the Akkoma installation guide for your OS which contains the Nginx configuration instructions.
+11. If setting up on a new server, configure nginx by using the `installation/nginx/akkoma.nginx` configuration sample or reference the Akkoma installation guide which contains the nginx configuration instructions.
 
-[¹]: We assume the database name and user are both "akkoma". If not, you can find the correct name in your config files.  
-[²]: You can recreate the `config/setup_db.psql` by running the `mix pleroma.instance gen` task again. You can ignore most of the questions, but make the database user, name, and password the same as found in your backed up config file. This will also create a new `config/generated_config.exs` file which you may delete as it is not needed.  
-[³]: Prefix with `MIX_ENV=prod` to run it using the production config file.  
+[¹]: We assume the database name and user are both "akkoma". If not, you can find the correct name in your configuration files.  
+[²]: If you have a from source installation, the command is `MIX_ENV=prod mix ecto.migrate`. Note that we prefix with `MIX_ENV=prod` to use the `config/prod.secret.exs` configuration file.  
 
 ## Remove
 
-1. Optionally you can remove the users of your instance. This will trigger delete requests for their accounts and posts. Note that this is 'best effort' and doesn't mean that all traces of your instance will be gone from the fediverse.
-    * You can do this from the admin-FE where you can select all local users and delete the accounts using the *Moderate multiple users* dropdown.
-    * You can also list local users and delete them individually using the CLI tasks for [Managing users](./CLI_tasks/user.md).
+1. Optionally, you can remove the users of your instance. This will trigger delete requests for their accounts and posts. Note that this is 'best effort' and doesn't mean that all traces of your instance will be gone from the fediverse.
+    * You can do this from the admin-fe where you can select all local users and delete the accounts using the *Moderate multiple users* dropdown.
+    * You can also list local users and delete them individually using the CLI tasks for [managing users](./CLI_tasks/user.md).
 2. Stop the Akkoma service `systemctl stop akkoma`
 3. Disable Akkoma from systemd `systemctl disable akkoma`
 4. Remove the files and folders you created during installation (see installation guide). This includes the akkoma, nginx and systemd files and folders.
@@ -45,3 +42,16 @@
 8. Remove the dependencies that you don't need anymore (see installation guide). Make sure you don't remove packages that are still needed for other software that you have running!
 
 [¹]: We assume the database name and user are both "akkoma". If not, you can find the correct name in your config files.  
+
+## Docker installations
+
+If running behind Docker, it is required to run the above commands inside of a running database container.  
+
+### Example
+Running `docker compose run --rm db pg_dump <...>` will fail and return:
+```
+pg_dump: error: connection to server on socket "/run/postgresql/.s.PGSQL.5432" failed: No such file or directory 
+Is the server running locally and accepting connections on that socket?"
+```
+However, first starting just the database container with `docker compose up db -d`, and then running `docker compose exec db pg_dump -d akkoma --format=custom -f </your/backup/dir/akkoma.pgdump>` will successfully generate a database dump.  
+Then to make the file accessible on the host system you can run `docker compose cp db:</your/backup/dir/akkoma.pgdump> </your/target/location>` to copy if from the container.

docs/docs/administration/monitoring.md

@@ -3,7 +3,7 @@
 If you run akkoma, you may be inclined to collect metrics to ensure your instance is running smoothly,
 and that there's nothing quietly failing in the background.
 
-To facilitate this, akkoma exposes prometheus metrics to be scraped.
+To facilitate this, akkoma exposes a dashboard and prometheus metrics to be scraped.
 
 ## Prometheus
 
@@ -11,7 +11,7 @@ See: [export\_prometheus\_metrics](../../configuration/cheatsheet#instance)
 
 To scrape prometheus metrics, we need an oauth2 token with the `admin:metrics` scope.
 
-consider using [constanze](https://akkoma.dev/AkkomaGang/constanze) to make this easier -
+Consider using [constanze](https://akkoma.dev/AkkomaGang/constanze) to make this easier -
 
 ```bash
 constanze token --client-app --scopes "admin:metrics" --client-name "Prometheus"
@@ -31,3 +31,15 @@ Once you have your token of the form `Bearer $ACCESS_TOKEN`, you can use that in
   - targets:
     - example.com
 ```
+
+## Dashboard
+
+Administrators can access a live dashboard under `/phoenix/live_dashboard`
+giving an overview of uptime, software versions, database stats and more.
+
+The dashboard also includes a variation of the prometheus metrics, however
+they do not exactly match due to respective limitations of the dashboard
+and the prometheus exporter.
+Even more important, the dashboard collects metrics locally in the browser
+only while the page is open and cannot give a view on their past history.
+For proper monitoring it is recommended to set up prometheus.

docs/docs/administration/updating.md

@@ -33,8 +33,8 @@ su -s "$SHELL" akkoma
 ./bin/pleroma_ctl frontend install pleroma-fe --ref stable
 ```
 
-If you selected an alternate flavour on installation, 
-you _may_ need to specify `--flavour`, in the same way as 
+If you selected an alternate flavour on installation,
+you _may_ need to specify `--flavour`, in the same way as
 [when installing](../../installation/otp_en#detecting-flavour).
 
 ## For from source installations (using git)
@@ -62,6 +62,6 @@ mix ecto.migrate
 # Start akkoma (replace with your system service manager's equivalent if different)
 sudo systemctl start akkoma
 
-# Update Akkoma-FE frontend to latest stable. For other Frontends see Frontend Configuration doc for more information.
+# Update akkoma-fe frontend to latest stable. For other Frontends see Frontend Configuration doc for more information.
 mix pleroma.frontend install pleroma-fe --ref stable
 ```

docs/docs/clients.md

@@ -1,12 +1,15 @@
 # Akkoma Clients
-Note: Additional clients may work, but these are known to work with Akkoma.
-Apps listed here might not support all of Akkoma's features.
+This is a list of clients that are known to work with Akkoma.
+
+!!! warning
+    **Clients listed here are not officially supported by the Akkoma project.**
+    Some Akkoma features may be unsupported by these clients.
 
 ## Multiplatform
 ### Kaiteki
 - Homepage: <https://kaiteki.app/>
 - Source Code: <https://github.com/Kaiteki-Fedi/Kaiteki>
-- Contact: [@kaiteki@fedi.software](https://fedi.software/@Kaiteki)
+- Contact: [@kaiteki@social.kaiteki.app](https://social.kaiteki.app/@kaiteki)
 - Platforms: Web, Windows, Linux, Android
 - Features: MastoAPI, Supports multiple backends
 
@@ -38,12 +41,6 @@ Apps listed here might not support all of Akkoma's features.
 - Platforms: Android
 - Features: MastoAPI, No Streaming, Emoji Reactions, Text Formatting, FE Stickers
 
-### Fedi
-- Homepage: <https://www.fediapp.com/>
-- Source Code: Proprietary, but gratis
-- Platforms: iOS, Android
-- Features: MastoAPI, Pleroma-specific features like Reactions
-
 ### Tusky
 - Homepage: <https://tuskyapp.github.io/>
 - Source Code: <https://github.com/tuskyapp/Tusky>
@@ -51,12 +48,18 @@ Apps listed here might not support all of Akkoma's features.
 - Platforms: Android
 - Features: MastoAPI, No Streaming
 
+### Subway Tooter
+- Source Code: <https://github.com/tateisu/SubwayTooter/>
+- Contact: [@SubwayTooter@mastodon.juggler.jp](https://mastodon.juggler.jp/@SubwayTooter)
+- Platforms: Android
+- Features: MastoAPI, Editing, Emoji Reactions (including custom emoji)
+
 ## Alternative Web Interfaces
-### Pinafore
-- Note: Pinafore is unmaintained (See [the author's original article](https://nolanlawson.com/2023/01/09/retiring-pinafore/) for details)
-- Homepage: <https://pinafore.social/>
-- Source Code: <https://github.com/nolanlawson/pinafore>
-- Contact: [@pinafore@mastodon.technology](https://mastodon.technology/users/pinafore)
+### Enafore
+- An actively developed fork of Pinafore with improved Akkoma support
+- Homepage: <https://enafore.social/>
+- Source Code: <https://github.com/enafore/enafore>
+- Contact: [@enfore@enafore.social](https://meta.enafore.social/@enafore)
 - Features: MastoAPI, No Streaming
 
 ### Sengi

docs/docs/configuration/cheatsheet.md

@@ -2,9 +2,9 @@
 
 This is a cheat sheet for Akkoma configuration file, any setting possible to configure should be listed here.
 
-For OTP installations the configuration is typically stored in `/etc/akkoma/config.exs`.
+For OTP installations, the configuration is typically stored in `/etc/akkoma/config.exs`.
 
-For from source installations Akkoma configuration works by first importing the base config `config/config.exs`, then overriding it by the environment config `config/$MIX_ENV.exs` and then overriding it by user config `config/$MIX_ENV.secret.exs`. In from source installations you should always make the changes to the user config and NEVER to the base config to avoid breakages and merge conflicts. So for production you change/add configuration to `config/prod.secret.exs`.
+For from source installations, Akkoma configuration works by first importing the base config `config/config.exs`, then overriding it by the environment config `config/$MIX_ENV.exs` and then overriding it by user config `config/$MIX_ENV.secret.exs`. In from source installations you should always make the changes to the user config and NEVER to the base config to avoid breakages and merge conflicts. I.e. for production you change/add configuration to `config/prod.secret.exs`.
 
 To add configuration to your config file, you can copy it from the base config. The latest version of it can be viewed [here](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/config/config.exs). You can also use this file if you don't know how an option is supposed to be formatted.
 
@@ -12,7 +12,7 @@ To add configuration to your config file, you can copy it from the base config.
 * `name`: The instance’s name.
 * `email`: Email used to reach an Administrator/Moderator of the instance.
 * `notify_email`: Email used for notifications.
-* `description`: The instance’s description, can be seen in nodeinfo and ``/api/v1/instance``.
+* `description`: The instance’s description, can be seen in nodeinfo and `/api/v1/instance`.
 * `limit`: Posts character limit (CW/Subject included in the counter).
 * `description_limit`: The character limit for image descriptions.
 * `remote_limit`: Hard character limit beyond which remote posts will be dropped.
@@ -33,12 +33,12 @@ To add configuration to your config file, you can copy it from the base config.
 * `federation_incoming_replies_max_depth`: Max. depth of reply-to activities fetching on incoming federation, to prevent out-of-memory situations while fetching very long threads. If set to `nil`, threads of any depth will be fetched. Lower this value if you experience out-of-memory crashes.
 * `federation_reachability_timeout_days`: Timeout (in days) of each external federation target being unreachable prior to pausing federating to it.
 * `allow_relay`: Permits remote instances to subscribe to all public posts of your instance. This may increase the visibility of your instance.
-* `public`: Allows unauthenticated access to public resources on your instance. This is essentially used as the default value for `:restrict_unauthenticated`. 
+* `public`: Allows unauthenticated access to public resources on your instance. This is essentially used as the default value for `:restrict_unauthenticated`.
    See `restrict_unauthenticated` for more details.
-* `quarantined_instances`: *DEPRECATED* ActivityPub instances where activities will not be sent. They can still reach there via other means, we just won't send them.
+* `quarantined_instances`: *DEPRECATED* ActivityPub instances where activities will not be sent. They can still see our activities via other means, we just won't send them.
 * `allowed_post_formats`: MIME-type list of formats allowed to be posted (transformed into HTML).
-* `extended_nickname_format`: Set to `true` to use extended local nicknames format (allows underscores/dashes). This will break federation with
-    older software for theses nicknames.
+* `extended_nickname_format`: Set to `true` to use extended local nicknames format (allows underscores/dashes).
+    This will break federation with older software for theses nicknames.
 * `max_pinned_statuses`: The maximum number of pinned statuses. `0` will disable the feature.
 * `autofollowed_nicknames`: Set to nicknames of (local) users that every new user should automatically follow.
 * `autofollowing_nicknames`: Set to nicknames of (local) users that automatically follows every newly registered user.
@@ -46,7 +46,7 @@ To add configuration to your config file, you can copy it from the base config.
 * `max_report_comment_size`: The maximum size of the report comment (Default: `1000`).
 * `safe_dm_mentions`: If set to true, only mentions at the beginning of a post will be used to address people in direct messages. This is to prevent accidental mentioning of people when talking about them (e.g. "@friend hey i really don't like @enemy"). Default: `false`.
 * `healthcheck`: If set to true, system data will be shown on ``/api/v1/pleroma/healthcheck``.
-* `remote_post_retention_days`: The default amount of days to retain remote posts when pruning the database.
+* `remote_post_retention_days`: The default number of days to retain remote posts when pruning the database.
 * `user_bio_length`: A user bio maximum length (default: `5000`).
 * `user_name_length`: A user name maximum length (default: `100`).
 * `skip_thread_containment`: Skip filter out broken threads. The default is `false`.
@@ -58,11 +58,14 @@ To add configuration to your config file, you can copy it from the base config.
 * `registration_reason_length`: Maximum registration reason length (default: `500`).
 * `external_user_synchronization`: Enabling following/followers counters synchronization for external users.
 * `cleanup_attachments`: Remove attachments along with statuses. Does not affect duplicate files and attachments without status. Enabling this will increase load to database when deleting statuses on larger instances.
+* `cleanup_attachments_delay`: How many seconds to wait after post deletion before attempting to deletion; useful for “delete & redraft” functionality (default: `1800`)
 * `show_reactions`: Let favourites and emoji reactions be viewed through the API (default: `true`).
 * `password_reset_token_validity`: The time after which reset tokens aren't accepted anymore, in seconds (default: one day).
-* `local_bubble`: Array of domains representing instances closely related to yours. Used to populate the `bubble` timeline. e.g `["example.com"]`, (default: `[]`)
-* `languages`: List of Language Codes used by the instance. This is used to try and set a default language from the frontend. It will try and find the first match between the languages set here and the user's browser languages. It will default to the first language in this setting if there is no match.. (default `["en"]`)
-* `export_prometheus_metrics`: Enable prometheus metrics, served at `/api/v1/akkoma/metrics`, requiring the `admin:metrics` oauth scope.
+* `local_bubble`: Array of domains representing instances closely related to yours. Used to populate the `bubble` timeline. e.g. `["example.com"]`, (default: `[]`)
+* `languages`: List of Language Codes used by the instance. This is used to try and set a default language from the frontend. It will try and find the first match between the languages set here and the user's browser languages. It will default to the first language in this setting if there is no match. (default `["en"]`)
+* `export_prometheus_metrics`: Enable prometheus metrics, served at `/api/v1/akkoma/metrics`, requiring the `admin:metrics` OAuth scope.
+* `privileged_staff`: Set to `true` to give moderators access to a few higher responsibility actions.
+* `federated_timeline_available`: Set to `false` to remove access to the federated timeline for all users.
 
 ## :database
 * `improved_hashtag_timeline`: Setting to force toggle / force disable improved hashtags timeline. `:enabled` forces hashtags to be fetched from `hashtags` table for hashtags timeline. `:disabled` forces object-embedded hashtags to be used (slower). Keep it `:auto` for automatic behaviour (it is auto-set to `:enabled` [unless overridden] when HashtagsTableMigrator completes).
@@ -73,15 +76,15 @@ To add configuration to your config file, you can copy it from the base config.
 
 ## Welcome
 * `direct_message`: - welcome message sent as a direct message.
-  * `enabled`: Enables the send a direct message to a newly registered user. Defaults to `false`.
+  * `enabled`: Enables sending a direct message to a newly registered user. Defaults to `false`.
   * `sender_nickname`: The nickname of the local user that sends the welcome message.
-  * `message`: A message that will be send to a newly registered users as a direct message.
+  * `message`: A message that will be sent to a newly registered users as a direct message.
 * `email`: - welcome message sent as a email.
-  * `enabled`: Enables the send a welcome email to a newly registered user. Defaults to `false`.
+  * `enabled`: Enables sending a welcome email to newly registered users. Defaults to `false`.
   * `sender`: The email address or tuple with `{nickname, email}` that will use as sender to the welcome email.
   * `subject`: A subject of welcome email.
-  * `html`: A html that will be send to a newly registered users as a email.
-  * `text`: A text that will be send to a newly registered users as a email.
+  * `html`: A html that will be sent to newly registered users as an email.
+  * `text`: A text that will be sent to newly registered users as an email.
 
     Example:
 
@@ -104,31 +107,60 @@ To add configuration to your config file, you can copy it from the base config.
 ## Message rewrite facility
 
 ### :mrf
-* `policies`: Message Rewrite Policy, either one or a list. Here are the ones available by default:
-    * `Pleroma.Web.ActivityPub.MRF.NoOpPolicy`: Doesn’t modify activities (default).
-    * `Pleroma.Web.ActivityPub.MRF.DropPolicy`: Drops all activities. It generally doesn’t makes sense to use in production.
-    * `Pleroma.Web.ActivityPub.MRF.SimplePolicy`: Restrict the visibility of activities from certains instances (See [`:mrf_simple`](#mrf_simple)).
-    * `Pleroma.Web.ActivityPub.MRF.TagPolicy`: Applies policies to individual users based on tags, which can be set using pleroma-fe/admin-fe/any other app that supports Pleroma Admin API. For example it allows marking posts from individual users nsfw (sensitive).
-    * `Pleroma.Web.ActivityPub.MRF.SubchainPolicy`: Selectively runs other MRF policies when messages match (See [`:mrf_subchain`](#mrf_subchain)).
-    * `Pleroma.Web.ActivityPub.MRF.RejectNonPublic`: Drops posts with non-public visibility settings (See [`:mrf_rejectnonpublic`](#mrf_rejectnonpublic)).
-    * `Pleroma.Web.ActivityPub.MRF.EnsureRePrepended`: Rewrites posts to ensure that replies to posts with subjects do not have an identical subject and instead begin with re:.
-    * `Pleroma.Web.ActivityPub.MRF.AntiLinkSpamPolicy`: Rejects posts from likely spambots by rejecting posts from new users that contain links.
-    * `Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy`: Crawls attachments using their MediaProxy URLs so that the MediaProxy cache is primed.
-    * `Pleroma.Web.ActivityPub.MRF.MentionPolicy`: Drops posts mentioning configurable users. (See [`:mrf_mention`](#mrf_mention)).
-    * `Pleroma.Web.ActivityPub.MRF.VocabularyPolicy`: Restricts activities to a configured set of vocabulary. (See [`:mrf_vocabulary`](#mrf_vocabulary)).
-    * `Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy`: Rejects or delists posts based on their age when received. (See [`:mrf_object_age`](#mrf_object_age)).
-    * `Pleroma.Web.ActivityPub.MRF.ActivityExpirationPolicy`: Sets a default expiration on all posts made by users of the local instance. Requires `Pleroma.Workers.PurgeExpiredActivity` to be enabled for processing the scheduled delections.
-    * `Pleroma.Web.ActivityPub.MRF.ForceBotUnlistedPolicy`: Makes all bot posts to disappear from public timelines.
-    * `Pleroma.Web.ActivityPub.MRF.FollowBotPolicy`: Automatically follows newly discovered users from the specified bot account. Local accounts, locked accounts, and users with "#nobot" in their bio are respected and excluded from being followed.
-    * `Pleroma.Web.ActivityPub.MRF.AntiFollowbotPolicy`: Drops follow requests from followbots. Users can still allow bots to follow them by first following the bot.
-    * `Pleroma.Web.ActivityPub.MRF.KeywordPolicy`: Rejects or removes from the federated timeline or replaces keywords. (See [`:mrf_keyword`](#mrf_keyword)).
-    * `Pleroma.Web.ActivityPub.MRF.NormalizeMarkup`: Pass inbound HTML through a scrubber to make sure it doesn't have anything unusual in it. On by default, cannot be turned off.
-    * `Pleroma.Web.ActivityPub.MRF.InlineQuotePolicy`: Append a link to a post that quotes another post with the link to the quoted post, to ensure that software that does not understand quotes can have full context. On by default, cannot be turned off.
 * `transparency`: Make the content of your Message Rewrite Facility settings public (via nodeinfo).
 * `transparency_exclusions`: Exclude specific instance names from MRF transparency.  The use of the exclusions feature will be disclosed in nodeinfo as a boolean value.
 * `transparency_obfuscate_domains`: Show domains with `*` in the middle, to censor them if needed. For example, `ridingho.me` will show as `rid*****.me`
+* `policies`: Message Rewrite Policy, either one or a list. Here are the ones available by default:
+    * `Pleroma.Web.ActivityPub.MRF.NoOpPolicy`: Doesn’t modify activities (default).
+    * `Pleroma.Web.ActivityPub.MRF.DropPolicy`: Drops all activities. It generally doesn’t makes sense to use in production.
+    * `Pleroma.Web.ActivityPub.MRF.ActivityExpirationPolicy`: Sets a default expiration on all posts made by users of the local instance. Requires `Pleroma.Workers.PurgeExpiredActivity` to be enabled for processing the scheduled delections.
+      (See [`:mrf_activity_expiration`](#mrf_activity_expiration))
+    * `Pleroma.Web.ActivityPub.MRF.AntiFollowbotPolicy`: Drops follow requests from followbots. Users can still allow bots to follow them by first following the bot.
+    * `Pleroma.Web.ActivityPub.MRF.AntiLinkSpamPolicy`: Rejects posts from likely spambots by rejecting posts from new users that contain links.
+    * `Pleroma.Web.ActivityPub.MRF.EnsureRePrepended`: Rewrites posts to ensure that replies to posts with subjects do not have an identical subject and instead begin with re:.
+    * `Pleroma.Web.ActivityPub.MRF.ForceBotUnlistedPolicy`: Makes all bot posts to disappear from public timelines.
+    * `Pleroma.Web.ActivityPub.MRF.HellthreadPolicy`: Blocks messages with too many mentions.
+      (See [`mrf_hellthread`](#mrf_hellthread))
+    * `Pleroma.Web.ActivityPub.MRF.KeywordPolicy`: Rejects or removes from the federated timeline or replaces keywords. (See [`:mrf_keyword`](#mrf_keyword)).
+    * `Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy`: Crawls attachments using their MediaProxy URLs so that the MediaProxy cache is primed.
+    * `Pleroma.Web.ActivityPub.MRF.MentionPolicy`: Drops posts mentioning configurable users. (See [`:mrf_mention`](#mrf_mention)).
+    * `Pleroma.Web.ActivityPub.MRF.NoEmptyPolicy`: Drops local activities which have no actual content.
+       (e.g. no attachments and only consists of mentions)
+    * `Pleroma.Web.ActivityPub.MRF.NoPlaceholderTextPolicy`: Strips content placeholders from posts
+      (such as the dot from mastodon)
+    * `Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy`: Rejects or delists posts based on their age when received. (See [`:mrf_object_age`](#mrf_object_age)).
+    * `Pleroma.Web.ActivityPub.MRF.RejectNewlyCreatedAccountNotesPolicy`: Rejects posts of users the server only recently learned about for a while. Great to block spam accounts. (See [`:mrf_reject_newly_created_account_notes`](#mrf_reject_newly_created_account_notes))
+    * `Pleroma.Web.ActivityPub.MRF.RejectNonPublic`: Drops posts with non-public visibility settings (See [`:mrf_rejectnonpublic`](#mrf_rejectnonpublic)).
+    * `Pleroma.Web.ActivityPub.MRF.SimplePolicy`: Restrict the visibility of activities from certains instances (See [`:mrf_simple`](#mrf_simple)).
+    * `Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy`: Steals all eligible emoji encountered in posts from remote instances
+      (See [`:mrf_steal_emoji`](#mrf_steal_emoji))
+    * `Pleroma.Web.ActivityPub.MRF.SubchainPolicy`: Selectively runs other MRF policies when messages match (See [`:mrf_subchain`](#mrf_subchain)).
+    * `Pleroma.Web.ActivityPub.MRF.TagPolicy`: Applies policies to individual users based on tags, which can be set using pleroma-fe/admin-fe/any other app that supports Pleroma Admin API. For example, it allows marking posts from individual users nsfw (sensitive).
+    * `Pleroma.Web.ActivityPub.MRF.UserAllowListPolicy`: Drops all posts except from users specified in a list.
+      (See [`:mrf_user_allowlist`](#mrf_user_allowlist))
+    * `Pleroma.Web.ActivityPub.MRF.VocabularyPolicy`: Restricts activities to a configured set of vocabulary. (See [`:mrf_vocabulary`](#mrf_vocabulary)).
+
+Additionally the following MRFs will *always* be aplied and cannot be disabled:
+
+* `Pleroma.Web.ActivityPub.MRF.DirectMessageDisabledPolicy`: Strips users limiting who can send them DMs from the recipients of non-eligible DMs
+* `Pleroma.Web.ActivityPub.MRF.HashtagPolicy`: Depending on a post’s hashtags it can be rejected, get its sensitive flags force-enabled or removed from the global timeline
+    (See [`:mrf_hashtag`](#mrf_hashtag))
+* `Pleroma.Web.ActivityPub.MRF.InlineQuotePolicy`: Append a link to a post that quotes another post with the link to the quoted post, to ensure that software that does not understand quotes can have full context.
+    (See [`:mrf_inline_quote`](#mrf_inline_quote))
+* `Pleroma.Web.ActivityPub.MRF.NormalizeMarkup`: Pass inbound HTML through a scrubber to make sure it doesn't have anything unusual in it.
+    (See [`:mrf_normalize_markup`](#mrf_normalize_markup))
+
 
 ## Federation
+### :activitypub
+* `unfollow_blocked`: Whether blocks result in people getting unfollowed
+* `outgoing_blocks`: Whether to federate blocks to other instances
+* `blockers_visible`: Whether a user can see the posts of users who blocked them
+* `deny_follow_blocked`: Whether to disallow following an account that has blocked the user in question
+* `sign_object_fetches`: Sign object fetches with HTTP signatures
+* `authorized_fetch_mode`: Require HTTP signatures for AP fetches
+* `max_collection_objects`: The maximum number of objects to fetch from a remote AP collection.
+
 ### MRF policies
 
 !!! note
@@ -138,12 +170,13 @@ To add configuration to your config file, you can copy it from the base config.
 * `media_removal`: List of instances to strip media attachments from and the reason for doing so.
 * `media_nsfw`: List of instances to tag all media as NSFW (sensitive) from and the reason for doing so.
 * `federated_timeline_removal`: List of instances to remove from the Federated Timeline (aka The Whole Known Network) and the reason for doing so.
-* `reject`: List of instances to reject activities (except deletes) from and the reason for doing so. Additionally prevents activities from being sent to that instance.
+* `reject`: List of instances to reject activities (except deletes) from and the reason for doing so. Additionally, prevents activities from being sent to that instance.
 * `accept`: List of instances to only accept activities (except deletes) from and the reason for doing so.
 * `followers_only`: Force posts from the given instances to be visible by followers only and the reason for doing so.
 * `report_removal`: List of instances to reject reports from and the reason for doing so.
 * `avatar_removal`: List of instances to strip avatars from and the reason for doing so.
 * `banner_removal`: List of instances to strip banners from and the reason for doing so.
+* `background_removal`: List of instances to strip user backgrounds from and the reason for doing so.
 * `reject_deletes`: List of instances to reject deletions from and the reason for doing so.
 
 #### :mrf_subchain
@@ -170,8 +203,8 @@ config :pleroma, :mrf_subchain,
 * `reject_threshold`: Number of mentioned users after which the messaged gets rejected. Set to 0 to disable.
 
 #### :mrf_keyword
-* `reject`: A list of patterns which result in message being rejected, each pattern can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html).
-* `federated_timeline_removal`: A list of patterns which result in message being removed from federated timelines (a.k.a unlisted), each pattern can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html).
+* `reject`: A list of patterns which result in a message being rejected, each pattern can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html).
+* `federated_timeline_removal`: A list of patterns which result in message being removed from federated timelines (a.k.a. unlisted), each pattern can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html).
 * `replace`: A list of tuples containing `{pattern, replacement}`, `pattern` can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html).
 
 #### :mrf_mention
@@ -206,7 +239,9 @@ config :pleroma, :mrf_user_allowlist, %{
 #### :mrf_steal_emoji
 * `hosts`: List of hosts to steal emojis from
 * `rejected_shortcodes`: Regex-list of shortcodes to reject
-* `size_limit`: File size limit (in bytes), checked before an emoji is saved to the disk
+* `size_limit`: File size limit (in bytes), checked before download if possible (and remote server honest),
+   otherwise or again checked before saving emoji to the disk
+* `download_unknown_size`: whether to download an emoji when the remote server doesn’t report its size in advance
 
 #### :mrf_activity_expiration
 
@@ -222,14 +257,24 @@ Notes:
 - The hashtags in the configuration do not have a leading `#`.
 - This MRF Policy is always enabled, if you want to disable it you have to set empty lists
 
-### :activitypub
-* `unfollow_blocked`: Whether blocks result in people getting unfollowed
-* `outgoing_blocks`: Whether to federate blocks to other instances
-* `blockers_visible`: Whether a user can see the posts of users who blocked them
-* `deny_follow_blocked`: Whether to disallow following an account that has blocked the user in question
-* `sign_object_fetches`: Sign object fetches with HTTP signatures
-* `authorized_fetch_mode`: Require HTTP signatures for AP fetches
-* `max_collection_objects`: The maximum number of objects to fetch from a remote AP collection.
+#### :mrf_reject_newly_created_account_notes
+After initially encountering an user, all their posts
+will be rejected for the configured time (in seconds).
+Only drops posts. Follows, reposts, etc. are not affected.
+
+* `age`: Time below which to reject (in seconds)
+
+An example: (86400 seconds = 24 hours)
+
+```elixir
+config :pleroma, :mrf_reject_newly_created_account_notes, age: 86400
+```
+
+#### :mrf_inline_quote
+* `prefix`: what prefix to prepend to quoted URLs
+
+#### :mrf_normalize_markup
+* `scrub_policy`: the scrubbing module to use (by default a built-in HTML sanitiser)
 
 ## Pleroma.User
 
@@ -246,11 +291,11 @@ Notes:
 
 ### :frontend_configurations
 
-This can be used to configure a keyword list that keeps the configuration data for any kind of frontend. By default, settings for `pleroma_fe` and `masto_fe` are configured. You can find the documentation for `pleroma_fe` configuration into [Akkoma-FE configuration and customization for instance administrators](https://docs-fe.akkoma.dev/stable/CONFIGURATION/#options).
+This can be used to configure a keyword list that keeps the configuration data for any kind of frontend. By default, settings for `pleroma_fe` and `masto_fe` are configured. You can find the documentation for `pleroma_fe` configuration into [akkoma-fe configuration and customization for instance administrators](https://docs-fe.akkoma.dev/stable/CONFIGURATION/#options).
 
 Frontends can access these settings at `/api/v1/pleroma/frontend_configurations`
 
-To add your own configuration for Akkoma-FE, use it like this:
+To add your own configuration for akkoma-fe, use it like this:
 
 ```elixir
 config :pleroma, :frontend_configurations,
@@ -294,8 +339,8 @@ config :pleroma, :frontends,
 
 * `:primary` - The frontend that will be served at `/`
 * `:admin` - The frontend that will be served at `/pleroma/admin`
-* `:swagger` - Config for developers to act as an API reference to be served at `/akkoma/swaggerui/` (trailing slash _needed_). Disabled by default.
-* `:mastodon` - The mastodon-fe configuration. This shouldn't need to be changed. This is served at `/web` when installed.
+* `:swagger` - Config for developers to act as an API reference to be served at `/pleroma/swaggerui/` (trailing slash _needed_). Disabled by default.
+* `:mastodon` - The masto-fe configuration. This shouldn't need to be changed. This is served at `/web` when installed.
 
 ### :static\_fe
 
@@ -307,20 +352,20 @@ Available options:
 
 ### :assets
 
-This section configures assets to be used with various frontends. Currently the only option
-relates to mascots on the mastodon frontend
+This section configures assets to be used with various frontends.
+Currently, the only option relates to mascots on masto-fe
 
 * `mascots`: KeywordList of mascots, each element __MUST__ contain both a `url` and a
   `mime_type` key.
 * `default_mascot`: An element from `mascots` - This will be used as the default mascot
-  on MastoFE (default: `:pleroma_fox_tan`).
+  on masto-fe (default: `:pleroma_fox_tan`).
 
 ### :manifest
 
-This section describe PWA manifest instance-specific values. Currently this option relate only for MastoFE.
+This section describes PWA manifest instance-specific values. Currently this option relate only for masto-fe.
 
-* `icons`: Describe the icons of the app, this a list of maps describing icons in the same way as the
-  [spec](https://www.w3.org/TR/appmanifest/#imageresource-and-its-members) describes it.
+* `icons`: Describe the icons of the app, this is a list of maps describing icons as
+  detailed in its [spec](https://www.w3.org/TR/appmanifest/#imageresource-and-its-members).
 
   Example:
 
@@ -348,7 +393,7 @@ This section describe PWA manifest instance-specific values. Currently this opti
 
 * `shortcode_globs`: Location of custom emoji files. `*` can be used as a wildcard. Example `["/emoji/custom/**/*.png"]`
 * `pack_extensions`: A list of file extensions for emojis, when no emoji.txt for a pack is present. Example `[".png", ".gif"]`
-* `groups`: Emojis are ordered in groups (tags). This is an array of key-value pairs where the key is the groupname and the value the location or array of locations. `*` can be used as a wildcard. Example `[Custom: ["/emoji/*.png", "/emoji/custom/*.png"]]`
+* `groups`: Emojis are ordered in groups (tags). This is an array of key-value pairs where the key is the group name and the value the location or array of locations. `*` can be used as a wildcard. Example `[Custom: ["/emoji/*.png", "/emoji/custom/*.png"]]`
 * `default_manifest`: Location of the JSON-manifest. This manifest contains information about the emoji-packs you can download. Currently only one manifest can be added (no arrays).
 * `shared_pack_cache_seconds_per_file`: When an emoji pack is shared, the archive is created and cached in
   memory for this amount of seconds multiplied by the number of files.
@@ -356,16 +401,17 @@ This section describe PWA manifest instance-specific values. Currently this opti
 ## :media_proxy
 
 * `enabled`: Enables proxying of remote media to the instance’s proxy
-* `base_url`: The base URL to access a user-uploaded file. Useful when you want to proxy the media files via another host/CDN fronts.
+* `base_url`: The base URL to access a user-uploaded file.
+  Using a (sub)domain distinct from the instance endpoint is **strongly** recommended.
 * `proxy_opts`: All options defined in `Pleroma.ReverseProxy` documentation, defaults to `[max_body_length: (25*1_048_576)]`.
-* `whitelist`: List of hosts with scheme to bypass the mediaproxy (e.g. `https://example.com`)
+* `whitelist`: List of hosts with scheme to bypass the media proxy (e.g. `https://example.com`)
 * `invalidation`: options for remove media from cache after delete object:
   * `enabled`: Enables purge cache
-  * `provider`: Which one of  the [purge cache strategy](#purge-cache-strategy) to use.
+  * `provider`: Which one of the [purge cache strategies](#purge-cache-strategy) to use.
 
 ## :media_preview_proxy
 
-* `enabled`: Enables proxying of remote media preview to the instance’s proxy. Requires enabled media proxy (`media_proxy/enabled`).
+* `enabled`: Enables proxying of remote media preview to the instance’s proxy. Requires media proxy to be enabled (`media_proxy/enabled`).
 * `thumbnail_max_width`: Max width of preview thumbnail for images (video preview always has original dimensions).
 * `thumbnail_max_height`: Max height of preview thumbnail for images (video preview always has original dimensions).
 * `image_quality`: Quality of the output. Ranges from 0 (min quality) to 100 (max quality).
@@ -375,8 +421,8 @@ This section describe PWA manifest instance-specific values. Currently this opti
 
 #### Pleroma.Web.MediaProxy.Invalidation.Script
 
-This strategy allow perform external shell script to purge cache.
-Urls of attachments are passed to the script as arguments.
+This strategy allows executing an external shell script to purge cache.
+URLs of attachments are passed to the script as arguments.
 
 * `script_path`: Path to the external script.
 * `url_format`: Set to `:htcacheclean` if using Apache's htcacheclean utility.
@@ -390,7 +436,7 @@ config :pleroma, Pleroma.Web.MediaProxy.Invalidation.Script,
 
 #### Pleroma.Web.MediaProxy.Invalidation.Http
 
-This strategy allow perform custom http request to purge cache.
+This strategy allows performing a custom HTTP request to purge cache.
 
 * `method`: http method. default is `purge`
 * `headers`: http headers.
@@ -410,12 +456,12 @@ config :pleroma, Pleroma.Web.MediaProxy.Invalidation.Http,
 * `providers`: a list of metadata providers to enable. Providers available:
     * `Pleroma.Web.Metadata.Providers.OpenGraph`
     * `Pleroma.Web.Metadata.Providers.TwitterCard`
-* `unfurl_nsfw`: If set to `true` nsfw attachments will be shown in previews.
+* `unfurl_nsfw`: If set to `true` NSFW attachments will be shown in previews.
 
 ### :rich_media (consumer)
-* `enabled`: if enabled the instance will parse metadata from attached links to generate link previews.
+* `enabled`: if enabled, the instance will parse metadata from attached links to generate link previews.
 * `ignore_hosts`: list of hosts which will be ignored by the metadata parser. For example `["accounts.google.com", "xss.website"]`, defaults to `[]`.
-* `ignore_tld`: list TLDs (top-level domains) which will ignore for parse metadata. default is ["local", "localdomain", "lan"].
+* `ignore_tld`: list of TLDs (top-level domains) which will ignore for parse metadata. The default is ["local", "localdomain", "lan"].
 * `parsers`: list of Rich Media parsers.
 * `failure_backoff`: Amount of milliseconds after request failure, during which the request will not be retried.
 
@@ -426,12 +472,12 @@ config :pleroma, Pleroma.Web.MediaProxy.Invalidation.Http,
 !!! note
     `Phoenix` endpoint configuration, all configuration options can be viewed [here](https://hexdocs.pm/phoenix/Phoenix.Endpoint.html#module-dynamic-configuration), only common options are listed here.
 
-* `http` - a list containing http protocol configuration, all configuration options can be viewed [here](https://hexdocs.pm/plug_cowboy/Plug.Cowboy.html#module-options), only common options are listed here. For deployment using docker, you need to set this to `[ip: {0,0,0,0}, port: 4000]` to make akkoma accessible from other containers (such as your nginx server).
+* `http` - a list containing HTTP protocol configuration, all configuration options can be viewed [here](https://hexdocs.pm/plug_cowboy/Plug.Cowboy.html#module-options), only common options are listed here. For deployment using Docker, you need to set this to `[ip: {0,0,0,0}, port: 4000]` to make akkoma accessible from other containers (such as your nginx server).
   - `ip` - a tuple consisting of 4 integers
   - `port`
-* `url` - a list containing the configuration for generating urls, accepts
+* `url` - a list containing the configuration for generating URLs, accepts
   - `host` - the host without the scheme and a post (e.g `example.com`, not `https://example.com:2020`)
-  - `scheme` - e.g `http`, `https`
+  - `scheme` - e.g. `http`, `https`
   - `port`
   - `path`
 * `extra_cookie_attrs` - a list of `Key=Value` strings to be added as non-standard cookie attributes. Defaults to `["SameSite=Lax"]`. See the [SameSite article](https://www.owasp.org/index.php/SameSite) on OWASP for more info.
@@ -446,14 +492,14 @@ config :pleroma, Pleroma.Web.Endpoint,
   ]
 ```
 
-This will make Akkoma listen on `127.0.0.1` port `8080` and generate urls starting with `https://example.com:2020`
+This will make Akkoma listen on `127.0.0.1` port `8080` and generate URLs starting with `https://example.com:2020`
 
 ### :http_security
 * ``enabled``: Whether the managed content security policy is enabled.
 * ``sts``: Whether to additionally send a `Strict-Transport-Security` header.
 * ``sts_max_age``: The maximum age for the `Strict-Transport-Security` header if sent.
 * ``referrer_policy``: The referrer policy to use, either `"same-origin"` or `"no-referrer"`.
-* ``report_uri``: Adds the specified url to `report-uri` and `report-to` group in CSP header.
+* ``report_uri``: Adds the specified URL to `report-uri` and `report-to` group in CSP header.
 
 ### Pleroma.Web.Plugs.RemoteIp
 
@@ -469,11 +515,10 @@ Available options:
 * `proxies` - A list of upstream proxy IP subnets in CIDR notation from which we will parse the content of `headers`. Defaults to `[]`. IPv4 entries without a bitmask will be assumed to be /32 and IPv6 /128.
 * `reserved` - A list of reserved IP subnets in CIDR notation which should be ignored if found in `headers`. Defaults to `["127.0.0.0/8", "::1/128", "fc00::/7", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]`.
 
-
 ### :rate_limit
 
 !!! note
-   If your instance is behind a reverse proxy ensure [`Pleroma.Web.Plugs.RemoteIp`](#pleroma-plugs-remoteip) is enabled (it is enabled by default).
+   If your instance is behind a reverse proxy, ensure [`Pleroma.Web.Plugs.RemoteIp`](#pleroma-plugs-remoteip) is enabled (it is enabled by default).
 
 A keyword list of rate limiters where a key is a limiter name and value is the limiter configuration. The basic configuration is a tuple where:
 
@@ -493,18 +538,18 @@ config :pleroma, :rate_limit,
 Means that:
 
 1. In 60 seconds, 15 authentication attempts can be performed from the same IP address.
-2. In 1 second, 10 search requests can be performed from the same IP adress by unauthenticated users, while authenticated users can perform 30 search requests per second.
+2. In 1 second, 10 search requests can be performed from the same IP address by unauthenticated users, while authenticated users can perform 30 search requests per second.
 
 Supported rate limiters:
 
 * `:search` - Account/Status search.
-* `:timeline` - Timeline requests (each timeline has it's own limiter).
+* `:timeline` - Timeline requests (each timeline has its own limiter).
 * `:app_account_creation` - Account registration from the API.
 * `:relations_actions` - Following/Unfollowing in general.
 * `:relation_id_action` - Following/Unfollowing for a specific user.
 * `:statuses_actions` - Status actions such as: (un)repeating, (un)favouriting, creating, deleting.
 * `:status_id_action` - (un)Repeating/(un)Favouriting a particular status.
-* `:authentication` - Authentication actions, i.e getting an OAuth token.
+* `:authentication` - Authentication actions, i.e. getting an OAuth token.
 * `:password_reset` - Requesting password reset emails.
 * `:account_confirmation_resend` - Requesting resending account confirmation emails.
 * `:ap_routes` - Requesting statuses via ActivityPub.
@@ -557,9 +602,9 @@ the source code is here: [kocaptcha](https://github.com/koto-bank/kocaptcha). Th
 
 * `uploader`: Which one of the [uploaders](#uploaders) to use.
 * `filters`: List of [upload filters](#upload-filters) to use.
-* `link_name`: When enabled Akkoma will add a `name` parameter to the url of the upload, for example `https://instance.tld/media/corndog.png?name=corndog.png`. This is needed to provide the correct filename in Content-Disposition headers when using filters like `Pleroma.Upload.Filter.Dedupe`
-* `base_url`: The base URL to access a user-uploaded file. Useful when you want to host the media files via another domain or are using a 3rd party S3 provider.
-* `proxy_remote`: If you're using a remote uploader, Akkoma will proxy media requests instead of redirecting to it.
+* `link_name`: When enabled Akkoma will add a `name` parameter to the URL of the upload, for example `https://instance.tld/media/corndog.png?name=corndog.png`. This is needed to provide the correct filename in Content-Disposition headers
+* `base_url`: The base URL to access a user-uploaded file; MUST be configured explicitly.
+  Using a (sub)domain distinct from the instance endpoint is **strongly** recommended. A good value might be `https://media.myakkoma.instance/media/`. 
 * `proxy_opts`: Proxy options, see `Pleroma.ReverseProxy` documentation.
 * `filename_display_max_length`: Set max length of a filename to display. 0 = no limit. Default: 30.
 
@@ -570,7 +615,7 @@ the source code is here: [kocaptcha](https://github.com/koto-bank/kocaptcha). Th
 
 #### Pleroma.Uploaders.Local
 
-* `uploads`: Which directory to store the user-uploads in, relative to pleroma’s working directory.
+* `uploads`: Which directory to store the user-uploads in, relative to akkoma’s working directory.
 
 #### Pleroma.Uploaders.S3
 
@@ -598,20 +643,29 @@ config :ex_aws, :s3,
 
 ### Upload filters
 
+#### Pleroma.Upload.Filter.Dedupe
+
+**Always** active; cannot be turned off.
+Renames files to their hash and prevents duplicate files filling up the disk.
+No specific configuration.
+
 #### Pleroma.Upload.Filter.AnonymizeFilename
 
-This filter replaces the filename (not the path) of an upload. For complete obfuscation, add
-`Pleroma.Upload.Filter.Dedupe` before AnonymizeFilename.
+This filter replaces the declared filename (not the path) of an upload.
 
 * `text`: Text to replace filenames in links. If empty, `{random}.extension` will be used. You can get the original filename extension by using `{extension}`, for example `custom-file-name.{extension}`.
 
-#### Pleroma.Upload.Filter.Dedupe
+#### Pleroma.Upload.Filter.Exiftool.StripMetadata
 
-No specific configuration.
+This filter strips metadata with ExifTool leaving color profiles and orientation intact.
 
-#### Pleroma.Upload.Filter.Exiftool
+* `purge`: List of Exiftool tag names or tag group names to purge
+* `preserve`: List of Exiftool tag names or tag group names to preserve even if they occur in the purge list
 
-This filter only strips the GPS and location metadata with Exiftool leaving color profiles and attributes intact.
+
+#### Pleroma.Upload.Filter.Exiftool.ReadDescription
+
+This filter reads the ImageDescription and iptc:Caption-Abstract fields with Exiftool so clients can prefill the media description field.
 
 No specific configuration.
 
@@ -623,16 +677,16 @@ No specific configuration.
 
 #### Pleroma.Upload.Filter.Mogrify
 
-* `args`: List of actions for the `mogrify` command like `"strip"` or `["strip", "auto-orient", {"implode", "1"}]`.
+* `args`: List of actions for the `mogrify` command, like `"strip"` or `["strip", "auto-orient", {"implode", "1"}]`.
 
 ## Email
 
 ### Pleroma.Emails.Mailer
 * `adapter`: one of the mail adapters listed in [Swoosh readme](https://github.com/swoosh/swoosh#adapters), or `Swoosh.Adapters.Local` for in-memory mailbox.
 * `api_key` / `password` and / or other adapter-specific settings, per the above documentation.
-* `enabled`: Allows enable/disable send  emails. Default: `false`.
+* `enabled`: whether your instance is allowed to send emails. Default: `false`.
 
-An example for Sendgrid adapter:
+An example for SendGrid adapter:
 
 ```elixir
 config :pleroma, Pleroma.Emails.Mailer,
@@ -674,7 +728,7 @@ Email notifications settings.
 
 ### Pleroma.Emails.NewUsersDigestEmail
 
-- `:enabled` - a boolean, enables new users admin digest email when `true`. Defaults to `false`.
+- `:enabled` - a boolean, enables admin-digest email about new users when `true`. Defaults to `false`.
 
 ## Background jobs
 
@@ -769,7 +823,7 @@ config :logger, :ex_syslogger,
   level: :warn
 ```
 
-Another example, keeping console output and adding the pid to syslog output:
+Another example, keeping console output and adding the PID to syslog output:
 ```elixir
 config :logger,
   backends: [:console, {ExSyslogger, :ex_syslogger}]
@@ -816,7 +870,7 @@ This will probably take a long time.
 
 ### :admin_token
 
-Allows to set a token that can be used to authenticate with the admin api without using an actual user by giving it as the `admin_token` parameter or `x-admin-token` HTTP header. Example:
+Allows to set a token that can be used to authenticate with the admin API without using an actual user by giving it as the `admin_token` parameter or `x-admin-token` HTTP header. Example:
 
 ```elixir
 config :pleroma, :admin_token, "somerandomtoken"
@@ -834,7 +888,8 @@ or
 curl -H "X-Admin-Token: somerandomtoken" "http://localhost:4000/api/v1/pleroma/admin/users/invites"
 ```
 
-Warning: it's discouraged to use this feature because of the associated security risk: static / rarely changed instance-wide token is much weaker compared to email-password pair of a real admin user; consider using HTTP Basic Auth or OAuth-based authentication instead.
+!!! warning
+    It's discouraged to use this feature because of the associated security risk: static / rarely changed instance-wide token is much weaker compared to email-password pair of a real admin user; consider using HTTP Basic Auth or OAuth-based authentication instead.
 
 ### :auth
 
@@ -854,8 +909,8 @@ Authentication / authorization settings.
 Use LDAP for user authentication.  When a user logs in to the Akkoma
 instance, the name and password will be verified by trying to authenticate
 (bind) to an LDAP server.  If a user exists in the LDAP directory but there
-is no account with the same name yet on the Akkoma instance then a new
-Akkoma account will be created with the same name as the LDAP user name.
+is no account with the same name yet on the Akkoma instance, then a new
+Akkoma account will be created with the same name as the LDAP username.
 
 * `enabled`: enables LDAP authentication
 * `host`: LDAP server hostname
@@ -876,20 +931,20 @@ OAuth 2.0 provider settings:
 
 * `token_expires_in` - The lifetime in seconds of the access token.
 * `issue_new_refresh_token` - Keeps old refresh token or generate new refresh token when to obtain an access token.
-* `clean_expired_tokens` - Enable a background job to clean expired oauth tokens. Defaults to `false`.
+* `clean_expired_tokens` - Enable a background job to clean expired OAuth tokens. Defaults to `false`.
 
 OAuth 2.0 provider and related endpoints:
 
-* `POST /api/v1/apps` creates client app basing on provided params.
+* `POST /api/v1/apps` creates client app basing on provided parameters.
 * `GET/POST /oauth/authorize` renders/submits authorization form.
 * `POST /oauth/token` creates/renews OAuth token.
 * `POST /oauth/revoke` revokes provided OAuth token.
-* `GET /api/v1/accounts/verify_credentials` (with proper `Authorization` header or `access_token` URI param) returns user info on requester (with `acct` field containing local nickname and `fqn` field containing fully-qualified nickname which could generally be used as email stub for OAuth software that demands email field in identity endpoint response, like Peertube).
+* `GET /api/v1/accounts/verify_credentials` (with proper `Authorization` header or `access_token` URI parameter) returns user info on requester (with `acct` field containing local nickname and `fqn` field containing fully-qualified nickname which could generally be used as email stub for OAuth software that demands email field in identity endpoint response, like Peertube).
 
 ### OAuth consumer mode
 
 OAuth consumer mode allows sign in / sign up via external OAuth providers (e.g. Twitter, Facebook, Google, Microsoft, etc.).
-Implementation is based on Ueberauth; see the list of [available strategies](https://github.com/ueberauth/ueberauth/wiki/List-of-Strategies).
+Implementation is based on Überauth; see the list of [available strategies](https://github.com/ueberauth/ueberauth/wiki/List-of-Strategies).
 
 !!! note
     Each strategy is shipped as a separate dependency; in order to get the strategies, run `OAUTH_CONSUMER_STRATEGIES="..." mix deps.get`, e.g. `OAUTH_CONSUMER_STRATEGIES="twitter facebook google microsoft" mix deps.get`.  The server should also be started with `OAUTH_CONSUMER_STRATEGIES="..." mix phx.server` in case you enable any strategies.
@@ -958,10 +1013,19 @@ config :ueberauth, Ueberauth,
   ]
 ```
 
+You may also need to set up your frontend to use oauth logins. For example, for `akkoma-fe`:
+
+```elixir
+config :pleroma, :frontend_configurations,
+  pleroma_fe: %{
+    loginMethod: "token"
+  }
+```
+
 ## Link parsing
 
 ### :uri_schemes
-* `valid_schemes`: List of the scheme part that is considered valid to be an URL.
+* `valid_schemes`: List of the scheme part that is considered valid to be a URL.
 
 ### Pleroma.Formatter
 
@@ -970,10 +1034,10 @@ Configuration for Akkoma's link formatter which parses mentions, hashtags, and U
 * `class` - specify the class to be added to the generated link (default: `false`)
 * `rel` - specify the rel attribute (default: `ugc`)
 * `new_window` - adds `target="_blank"` attribute (default: `false`)
-* `truncate` - Set to a number to truncate URLs longer then the number. Truncated URLs will end in `...` (default: `false`)
+* `truncate` - Set to a number to truncate URLs longer than the number. Truncated URLs will end in `...` (default: `false`)
 * `strip_prefix` - Strip the scheme prefix (default: `false`)
 * `extra` - link URLs with rarely used schemes (magnet, ipfs, irc, etc.) (default: `true`)
-* `validate_tld` - Set to false to disable TLD validation for URLs/emails. Can be set to :no_scheme to validate TLDs only for urls without a scheme (e.g `example.com` will be validated, but `http://example.loki` won't) (default: `:no_scheme`)
+* `validate_tld` - Set to false to disable TLD validation for URLs/emails. Can be set to :no_scheme to validate TLDs only for URLs without a scheme (e.g `example.com` will be validated, but `http://example.loki` won't) (default: `:no_scheme`)
 
 Example:
 
@@ -1009,7 +1073,7 @@ git clone <MY MODULE>
 
 ## :configurable_from_database
 
-Boolean, enables/disables in-database configuration. Read [Transfering the config to/from the database](../administration/CLI_tasks/config.md) for more information.
+Boolean, enables/disables in-database configuration. Read [transferring the config to/from the database](../administration/CLI_tasks/config.md) for more information.
 
 ## :database_config_whitelist
 
@@ -1059,12 +1123,13 @@ Turning any of the `:restrict_unauthenticated` options to `true` will restrict a
 
 #### When :instance, :public is `false`
 
-When `:instance, :public` is set to `false`, all of the `:restrict_unauthenticated` options will effectively be set to `true` by default,
+When `:instance, :public` is set to `false`, all `:restrict_unauthenticated` options will effectively be set to `true` by default,
 meaning that only authenticated users will be able to access the corresponding resources.
 
 If you'd like to allow unauthenticated access to specific resources, you can turn these settings to `false`.
 
-**Note**: setting `restrict_unauthenticated/timelines/local` to `true` has no practical sense if `restrict_unauthenticated/timelines/federated` is set to `false` (since local public activities will still be delivered to unauthenticated users as part of federated timeline).
+!!! note
+    Setting `restrict_unauthenticated/timelines/local` to `true` has no practical sense if `restrict_unauthenticated/timelines/federated` is set to `false` (since local public activities will still be delivered to unauthenticated users as part of federated timeline).
 
 ## Pleroma.Web.ApiSpec.CastAndValidate
 
@@ -1081,7 +1146,7 @@ Control favicons for instances.
 !!! note
     Requires enabled email
 
-* `:purge_after_days` an integer, remove backup achives after N days.
+* `:purge_after_days` an integer, remove backup archives after N days.
 * `:limit_days` an integer, limit user to export not more often than once per N days.
 * `:dir` a string with a path to backup temporary directory or `nil` to let Akkoma choose temporary directory in the following order:
     1. the directory named by the TMPDIR environment variable
@@ -1093,7 +1158,7 @@ Control favicons for instances.
 ### Theme settings
 
 Settings to change theme as exposed to the outside world, for software
-that scans `index.html` (mainly misskey)
+that scans `index.html` (mainly Misskey)
 
 ```
 config :pleroma, Pleroma.Web.Metadata.Providers.Theme, theme_color: "#593196"
@@ -1118,7 +1183,7 @@ Settings to restrict concurrently running jobs. Jobs which can be configured:
 
 Each job has these settings:
 
-* `:max_running` - max concurrently runnings jobs
+* `:max_running` - max concurrently running jobs
 * `:max_waiting` - max waiting jobs
 
 ### Translation Settings
@@ -1148,6 +1213,6 @@ Translations are available at `/api/v1/statuses/:id/translations/:language`, whe
 
 ### `:argos_translate`
 
-- `:command_argos_translate` - command for `argos-translate`. Can be the command if it's in your PATH, or the full path to the file  (default: `argos-translate`).
+- `:command_argos_translate` - command for `argos-translate`. Can be the command if it's in your PATH, or the full path to the file (default: `argos-translate`).
 - `:command_argospm` - command for `argospm`. Can be the command if it's in your PATH, or the full path to the file (default: `argospm`).
 - `:strip_html` - Strip html from the post before translating it (default: `true`).

docs/docs/configuration/custom_emoji.md

@@ -46,7 +46,7 @@ config :pleroma, :emoji,
   ]
 ```
 
-Order of the `groups` matters, so to override default tags just put your group on top of the list. E.g:
+Order of the `groups` matters, so to override default tags, just put your group on top of the list. E.g:
 ```elixir
 config :pleroma, :emoji,
   shortcode_globs: ["/emoji/custom/**/*.png"],

docs/docs/configuration/frontend_management.md

@@ -2,7 +2,7 @@
 
 Frontends in Akkoma are swappable, you can pick which you'd like.
 
-For a basic setup, you can set a frontends for the key `primary` and `admin` and the options of `name` and `ref`. This will then make Akkoma serve the frontend from a folder constructed by concatenating the instance static path, `frontends` and the name and ref.
+For a basic setup, you can set a frontend for the key `primary` and `admin` and the options of `name` and `ref`. This will then make Akkoma serve the frontend from a folder constructed by concatenating the instance static path, `frontends` and the name and ref.
 
 The key `primary` refers to the frontend that will be served by default for general requests. The key `admin` refers to the frontend that will be served at the `/pleroma/admin` path.
 
@@ -34,15 +34,15 @@ If you choose not to install a frontend for whatever reason, it is recommended t
 
 You can also replace the default "no frontend" page by placing an `index.html` file under your `instance/static/` directory.
 
-## Mastodon-FE
+## masto-fe
 
-Akkoma supports both [glitchsoc](https://github.com/glitch-soc/mastodon)'s more "vanilla" mastodon frontend,
+Akkoma supports both [glitch-soc](https://github.com/glitch-soc/mastodon)'s more "vanilla" mastodon frontend,
 as well as [fedibird](https://github.com/fedibird/mastodon)'s extended frontend which has near-feature-parity with akkoma (with quoting and reactions).
 
-To enable either one, you must run the `frontend.install` task for either `mastodon-fe` or `fedibird-fe` (both `--ref akkoma`), then make sure
+To enable either one, you must run the `frontend.install` task for either `masto-fe` or `fedibird-fe` (both `--ref akkoma`), then make sure
 `:pleroma, :frontends, :mastodon` references the one you want.
 
-## Swagger (openAPI) documentation viewer
+## Swagger (OpenAPI) documentation viewer
 
 If you're a developer and you'd like a human-readable rendering of the
 API documentation, you can enable [Swagger UI](https://github.com/swagger-api/swagger-ui).
@@ -60,4 +60,4 @@ config :pleroma, :frontends,
 
 Then run the [pleroma.frontend cli task](../../administration/CLI_tasks/frontend) with the name of `swagger-ui` to install the distribution files.
 
-You will now be able to view documentation at `/akkoma/swaggerui`
+You will now be able to view documentation at `/pleroma/swaggerui`

docs/docs/configuration/hardening.md

@@ -17,6 +17,16 @@ This sets the Akkoma application server to only listen to the localhost interfac
 
 This sets the `secure` flag on Akkoma’s session cookie. This makes sure, that the cookie is only accepted over encrypted HTTPs connections. This implicitly renames the cookie from `pleroma_key` to `__Host-pleroma-key` which enforces some restrictions. (see [cookie prefixes](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#Cookie_prefixes))
 
+### `Pleroma.Upload, :uploader, :base_url`
+
+> Recommended value: *anything on a different domain than the instance endpoint; e.g. https://media.myinstance.net/*
+
+Uploads are user controlled and (unless you’re running a true single-user
+instance) should therefore not be considered trusted. But the domain is used
+as a pivilege boundary e.g. by HTTP content security policy and ActivityPub.
+Having uploads on the same domain enabled several past vulnerabilities
+able to be exploited by malicious users.
+
 ### `:http_security`
 
 > Recommended value: `true`
@@ -71,7 +81,7 @@ Use private `/tmp` and `/var/tmp` folders inside a new file system namespace, wh
 
 > Recommended value: `true`
 
-The `/home`, `/root`, and `/run/user` folders can not be accessed by this service anymore. If your Akkoma user has its home folder in one of the restricted places, or use one of these folders as its working directory, you have to set this to `false`.
+The `/home`, `/root`, and `/run/user` folders cannot be accessed by this service anymore. If your Akkoma user has its home folder in one of the restricted places, or use one of these folders as its working directory, you have to set this to `false`.
 
 ### ProtectSystem
 

docs/docs/configuration/how_to_serve_another_domain_for_webfinger.md

@@ -11,7 +11,7 @@ Akkoma supports that, but it might be tricky to set up, and any error might prev
 
 It is important to understand that for federation purposes, a user in Akkoma has two unique identifiers associated:
 
-- A webfinger `acct:` URI, used for discovery and as a verifiable global name for the user across Akkoma instances. In our example, our account's acct: URI is `acct:user@example.org`
+- A WebFinger `acct:` URI, used for discovery and as a verifiable global name for the user across Akkoma instances. In our example, our account's acct: URI is `acct:user@example.org`
 - An author/actor URI, used in every other aspect of federation. This is the way in which users are identified in ActivityPub, the underlying protocol used for federation with other Akkoma instances.
 In our case, it is `https://akkoma.example.org/users/user`.
 
@@ -19,7 +19,7 @@ Both account identifiers are unique and required for Akkoma. An important risk i
 
 ## WebFinger
 
-As said earlier, each Akkoma user has an `acct`: URI, which is used for discovery and authentication. When you add @user@example.org, a webfinger query is performed. This is done in two steps:
+As said earlier, each Akkoma user has an `acct`: URI, which is used for discovery and authentication. When you add @user@example.org, a WebFinger query is performed. This is done in two steps:
 
 1. Querying `https://example.org/.well-known/host-meta` (where the domain of the URL matches the domain part of the `acct`: URI) to get information on how to perform the query.
 This file will indeed contain a URL template of the form `https://example.org/.well-known/webfinger?resource={uri}` that will be used in the second step.
@@ -27,7 +27,8 @@ This file will indeed contain a URL template of the form `https://example.org/.w
 
 ## Configuring your Akkoma instance
 
-**_DO NOT ATTEMPT TO CONFIGURE YOUR INSTANCE THIS WAY IF YOU DID NOT UNDERSTAND THE ABOVE_**
+!!! danger
+    DO NOT ATTEMPT TO CONFIGURE YOUR INSTANCE THIS WAY IF YOU DID NOT UNDERSTAND THE ABOVE
 
 ### Configuring Akkoma
 
@@ -47,7 +48,7 @@ config :pleroma, Pleroma.Web.WebFinger, domain: "example.org"
 
 ### Configuring WebFinger domain
 
-Now, you have Akkoma running at `https://akkoma.example.org` as well as a website at `https://example.org`. If you recall how webfinger queries work, the first step is to query `https://example.org/.well-known/host-meta`, which will contain an URL template.
+Now, you have Akkoma running at `https://akkoma.example.org` as well as a website at `https://example.org`. If you recall how WebFinger queries work, the first step is to query `https://example.org/.well-known/host-meta`, which will contain a URL template.
 
 Therefore, the easiest way to configure `example.org` is to redirect `/.well-known/host-meta` to `akkoma.example.org`.
 

docs/docs/configuration/howto_database_config.md

@@ -1,7 +1,7 @@
 # How to activate Akkoma in-database configuration
 ## Explanation
 
-The configuration of Akkoma (and Pleroma) has traditionally been managed with a config file, e.g. `config/prod.secret.exs`. This method requires a restart of the application for any configuration changes to take effect. We have made it possible to control most settings in the AdminFE interface after running a migration script.
+The configuration of Akkoma (and Pleroma) has traditionally been managed with a config file, e.g. `config/prod.secret.exs`. This method requires a restart of the application for any configuration changes to take effect. We have made it possible to control most settings in the admin-fe interface after running a migration script.
 
 ## Migration to database config
 
@@ -75,7 +75,7 @@ The configuration of Akkoma (and Pleroma) has traditionally been managed with a
   config :pleroma, configurable_from_database: true
   ```
 
-5. Restart your instance and you can now access the Settings tab in AdminFE.
+5. Restart your instance and you can now access the Settings tab in admin-fe.
 
 
 ## Reverting back from database config
@@ -131,7 +131,7 @@ You can clear the database config with the following command:
 Additionally, every time you migrate the configuration to the database the config table is automatically truncated to ensure a clean migration.
 
 ### Manually removing a setting
-If you encounter a situation where the server cannot run properly because of an invalid setting in the database and this is preventing you from accessing AdminFE, you can manually remove the offending setting if you know which one it is.
+If you encounter a situation where the server cannot run properly because of an invalid setting in the database and this is preventing you from accessing admin-fe, you can manually remove the offending setting if you know which one it is.
 
 e.g., here is an example showing a the removal of the `config :pleroma, :instance` settings:
 

docs/docs/configuration/howto_mediaproxy.md

@@ -6,29 +6,18 @@ With the `mediaproxy` function you can use nginx to cache this content, so users
 
 ## Activate it
 
-* Edit your nginx config and add the following location: 
-```
-location /proxy {
-        proxy_cache akkoma_media_cache;
-        proxy_cache_lock on;
-        proxy_pass http://localhost:4000;
-}
-```
-Also add the following on top of the configuration, outside of the `server` block:
-```
-proxy_cache_path /tmp/akkoma-media-cache levels=1:2 keys_zone=akkoma_media_cache:10m max_size=10g inactive=720m use_temp_path=off;
-```
-If you came here from one of the installation guides, take a look at the example configuration `/installation/nginx/akkoma.nginx`, where this part is already included.
-
+* Set up a subdomain for the proxy with its nginx config on the same machine
+* Edit the nginx config for the upload/MediaProxy subdomain to point to the subdomain that has been set up
 * Append the following to your `prod.secret.exs` or `dev.secret.exs` (depends on which mode your instance is running):
-```
+```elixir
+# Replace media.example.td with the subdomain you set up earlier
 config :pleroma, :media_proxy,
       enabled: true,
       proxy_opts: [
             redirect_on_failure: true
-      ]
-      #base_url: "https://cache.akkoma.social"
+      ],
+      base_url: "https://media.example.tld"
 ```
-If you want to use a subdomain to serve the files, uncomment `base_url`, change the url and add a comma after `true` in the previous line.
+You **really** should use a subdomain to serve proxied files; while we will fix bugs resulting from this, serving arbitrary remote content on your main domain namespace is a significant attack surface.
 
 * Restart nginx and Akkoma

docs/docs/configuration/howto_proxy.md

@@ -1,5 +1,5 @@
 # How to configure upstream proxy for federation
-If you want to proxify all http requests (e.g. for TOR) that Akkoma makes to an upstream proxy server, edit your config file (`dev.secret.exs` or `prod.secret.exs`) and add the following:
+If you want to proxify all HTTP requests (e.g. for TOR) that Akkoma makes to an upstream proxy server, edit your config file (`dev.secret.exs` or `prod.secret.exs`) and add the following:
 
 ```
 config :pleroma, :http,

docs/docs/configuration/howto_search_cjk.md

@@ -15,7 +15,7 @@ In most cases, you would need an extension installed to support parsing CJK text
  
 Once you have the new search config , make sure you test it with the `pleroma` user in PostgreSQL (change `YOUR.CONFIG` to your real configuration name)
 ```
-SELECT ts_debug('YOUR.CONFIG', '安装和配置Nginx, ElixirとErlangをインストールします');
+SELECT ts_debug('YOUR.CONFIG', '安装和配置nginx, ElixirとErlangをインストールします');
 ```
 Check output of the query, and see if it matches your expectation.
 

docs/docs/configuration/howto_theming_your_instance.md

@@ -47,7 +47,7 @@ Now you'll already be able to select the theme in Pleroma FE from the drop-down.
 
 ### Give the theme a name
 
-When you open one of the themes that ship with Akkoma, you'll notice that the json has a `"name"` key. Add a key-value pair to your theme where the key name is `"name"` and the value the name you want to give your theme. After this you can refresh te page in your browser and the name should be visible in the drop-down.
+When you open one of the themes that ship with Akkoma, you'll notice that the JSON has a `"name"` key. Add a key-value pair to your theme where the key name is `"name"` and the value the name you want to give your theme. After this you can refresh the page in your browser and the name should be visible in the drop-down.
 
 Example of `my-awesome-theme.json` where we add the name "My Awesome Theme"
 ```json
@@ -60,7 +60,7 @@ Example of `my-awesome-theme.json` where we add the name "My Awesome Theme"
 
 ### Set as default theme
 
-Now we can set the new theme as default in the [Pleroma FE configuration](https://docs-fe.akkoma.dev/stable/CONFIGURATION).
+Now we can set the new theme as default in the [Pleroma FE configuration](https://docs-fe.akkoma.dev/stable/CONFIGURATION/).
 
 Example of adding the new theme in the back-end config files
 ```elixir
@@ -70,4 +70,4 @@ config :pleroma, :frontend_configurations,
   }
 ```
 
-If you added it in the back-end configuration file, you'll need to restart your instance for the changes to take effect. If you don't see the changes, it's probably because the browser has cached the previous theme. In that case you'll want to clear browser caches. Alternatively you can use a private/incognito window just to see the changes.
+If you added it in the back-end configuration file, you'll need to restart your instance for the changes to take effect. If you don't see the changes, it's probably because the browser has cached the previous theme. In that case you'll want to clear browser caches. Alternatively, you can use a private/incognito window just to see the changes.

docs/docs/configuration/i2p.md

@@ -1,4 +1,4 @@
-# I2P Federation and Accessability
+# I2P Federation and Accessibility
 
 This guide is going to focus on the Akkoma federation aspect. The actual installation is neatly explained in the official documentation, and more likely to remain up-to-date.
 It might be added to this guide if there will be a need for that.
@@ -15,9 +15,10 @@ One using the config, and one using external software (fedproxy). The external s
 
 ### Using the Config
 
-**Warning:** So far, everytime I followed this way of federating using I2P, the rest of my federation stopped working. I'm leaving this here in case it will help with making it work.
+!!! warning
+    So far, everytime I followed this way of federating using I2P, the rest of my federation stopped working. I'm leaving this here in case it will help with making it work.
 
-Assuming you're running in prod, cd to your Akkoma folder and append the following to `config/prod.secret.exs`:
+Assuming you're running in prod, `cd` to your Akkoma folder and append the following to `config/prod.secret.exs`:
 ```
 config :pleroma, :http, proxy_url: {:socks5, :localhost, 4447}
 ```
@@ -45,7 +46,7 @@ To use [fedproxy](https://github.com/majestrate/fedproxy) you'll need to install
 ```
 apt install golang
 ```
-Use a different user than akkoma or root. Run the following to add the Gopath to your ~/.bashrc.
+Use a different user than akkoma or root. Run the following to add the `GOPATH` to your ~/.bashrc.
 ```
 echo "export GOPATH=/home/ren/.go" >> ~/.bashrc
 ```
@@ -103,7 +104,7 @@ systemctl start i2pd.service
 *Notice:* The stop command initiates a graceful shutdown process, i2pd stops after finishing to route transit tunnels (maximum 10 minutes).
 
 Now you'll have to find your address.
-To do that you can download and use I2PD tools.[^1]  
+To do that, you can download and use I2PD tools.[^1]  
 Or you'll need to access your web-console on localhost:7070.
 If you don't have a GUI, you'll have to SSH tunnel into it like this:
 `ssh -L 7070:127.0.0.1:7070 user@ip -p port`.
@@ -130,59 +131,26 @@ config :pleroma, :http_security,
   enabled: false
 ```
 
-Use this as the Nginx config:
-```
-proxy_cache_path /tmp/akkoma-media-cache levels=1:2 keys_zone=akkoma_media_cache:10m max_size=10g inactive=720m use_temp_path=off;
-# The above already exists in a clearnet instance's config.
-# If not, add it.
-
-server {
-    listen 127.0.0.1:14447;
-    server_name youri2paddress;
-
-    # Comment to enable logs
-    access_log /dev/null;
-    error_log /dev/null;
-
-    gzip_vary on;
-    gzip_proxied any;
-    gzip_comp_level 6;
-    gzip_buffers 16 8k;
-    gzip_http_version 1.1;
-    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml;
-
-    client_max_body_size 16m;
-
-    location / {
-
+In the nginx config, add the following into the `location /` block:
+```nginx
         add_header X-XSS-Protection "0";
         add_header X-Permitted-Cross-Domain-Policies none;
         add_header X-Frame-Options DENY;
         add_header X-Content-Type-Options nosniff;
         add_header Referrer-Policy same-origin;
-
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $http_host;
-
-        proxy_pass http://localhost:4000;
-
-        client_max_body_size 16m;
-    }
-
-    location /proxy {
-        proxy_cache akkoma_media_cache;
-        proxy_cache_lock on;
-        proxy_ignore_client_abort on;
-        proxy_pass http://localhost:4000;
-    }
-}
 ```
-reload Nginx:
+
+Change the `listen` directive to the following:
+```nginx
+listen 127.0.0.1:14447;
 ```
-systemctl stop i2pd.service --no-block
-systemctl start i2pd.service
+
+Set `server_name` to your i2p address.
+
+Reload nginx:
+```
+systemctl restart i2pd.service --no-block
+systemctl reload nginx.service
 ```
 *Notice:* The stop command initiates a graceful shutdown process, i2pd stops after finishing to route transit tunnels (maximum 10 minutes).
 

docs/docs/configuration/integrations/howto_ejabberd.md

@@ -1,10 +1,10 @@
-# Configuring Ejabberd (XMPP Server) to use Akkoma for authentication
+# Configuring ejabberd (XMPP Server) to use Akkoma for authentication
 
-If you want to give your Akkoma users an XMPP (chat) account, you can configure [Ejabberd](https://github.com/processone/ejabberd) to use your Akkoma server for user authentication, automatically giving every local user an XMPP account.
+If you want to give your Akkoma users an XMPP (chat) account, you can configure [ejabberd](https://github.com/processone/ejabberd) to use your Akkoma server for user authentication, automatically giving every local user an XMPP account.
 
-In general, you just have to follow the configuration described at [https://docs.ejabberd.im/admin/configuration/authentication/#external-script](https://docs.ejabberd.im/admin/configuration/authentication/#external-script). Please read this section carefully. 
+In general, you just have to follow the configuration described at [https://docs.ejabberd.im/admin/configuration/authentication/#external-script](https://docs.ejabberd.im/admin/configuration/authentication/#external-script). Please read this section carefully.
 
-Copy the script below to suitable path on your system and set owner and permissions. Also do not forget adjusting `AKKOMA_HOST` and `AKKOMA_PORT`, if necessary.
+Copy the script below to a suitable path on your system and set owner and permissions. Also do not forget adjusting `AKKOMA_HOST` and `AKKOMA_PORT`, if necessary.
 
 ```bash
 cp akkoma_ejabberd_auth.py /etc/ejabberd/akkoma_ejabberd_auth.py
@@ -12,7 +12,7 @@ chown ejabberd /etc/ejabberd/akkoma_ejabberd_auth.py
 chmod 700 /etc/ejabberd/akkoma_ejabberd_auth.py
 ```
 
-Set external auth params in ejabberd.yaml file:
+Set external auth parameters in ejabberd.yaml file:
 
 ```bash
 auth_method: [external]
@@ -23,8 +23,7 @@ auth_use_cache: false
 
 Restart / reload your ejabberd service.
 
-After restarting your Ejabberd server, your users should now be able to connect with their Akkoma credentials.
-
+After restarting your ejabberd server, your users should now be able to connect with their Akkoma credentials.
 
 ```python
 import sys
@@ -33,7 +32,6 @@ import http.client
 from base64 import b64encode
 import logging
 
-
 AKKOMA_HOST = "127.0.0.1"
 AKKOMA_PORT = "4000"
 AUTH_ENDPOINT = "/api/v1/accounts/verify_credentials"

docs/docs/configuration/integrations/howto_mongooseim.md

@@ -5,6 +5,6 @@ If you want to give your Akkoma users an XMPP (chat) account, you can configure
 In general, you just have to follow the configuration described at [https://mongooseim.readthedocs.io/en/latest/authentication-backends/HTTP-authentication-module/](https://mongooseim.readthedocs.io/en/latest/authentication-backends/HTTP-authentication-module/) and do these changes to your mongooseim.cfg.
 
 1. Set the auth_method to `{auth_method, http}`.
-2. Add the http auth pool like this: `{http, global, auth, [{workers, 50}], [{server, "https://yourakkomainstance.com"}]}`
+2. Add the HTTP auth pool like this: `{http, global, auth, [{workers, 50}], [{server, "https://yourakkomainstance.com"}]}`
 
 Restart your MongooseIM server, your users should now be able to connect with their Akkoma credentials.

docs/docs/configuration/mrf.md

@@ -11,7 +11,7 @@ Possible uses include:
 * removing media from messages
 * sending only public messages to a specific instance
 
-The MRF provides user-configurable policies. The default policy is `NoOpPolicy`, which disables the MRF functionality. Akkoma also includes an easy to use policy called `SimplePolicy` which maps messages matching certain pre-defined criterion to actions built into the policy module.
+The MRF provides user-configurable policies. The default policy is `NoOpPolicy`, which disables the MRF functionality. Akkoma also includes an easy-to-use policy called `SimplePolicy` which maps messages matching certain pre-defined criterion to actions built into the policy module.
 
 It is possible to use multiple, active MRF policies at the same time.
 
@@ -29,12 +29,13 @@ config :pleroma, :mrf,
 
 Once `SimplePolicy` is enabled, you can configure various groups in the `:mrf_simple` config object. These groups are:
 
-* `reject`: Servers in this group will have their messages rejected. Also outbound messages will not be sent to these servers.
+* `reject`: Servers in this group will have their messages rejected. Also, outbound messages will not be sent to these servers.
 * `accept`: If not empty, only messages from these instances will be accepted (whitelist federation).
 * `media_nsfw`: Servers in this group will have the #nsfw tag and sensitive setting injected into incoming messages which contain media.
 * `media_removal`: Servers in this group will have media stripped from incoming messages.
 * `avatar_removal`: Avatars from these servers will be stripped from incoming messages.
 * `banner_removal`: Banner images from these servers will be stripped from incoming messages.
+* `background_removal`: User background images from these servers will be stripped from incoming messages.
 * `report_removal`: Servers in this group will have their reports (flags) rejected.
 * `federated_timeline_removal`: Servers in this group will have their messages unlisted from the public timelines by flipping the `to` and `cc` fields.
 * `reject_deletes`: Deletion requests will be rejected from these servers.
@@ -61,6 +62,32 @@ config :pleroma, :mrf_simple,
 
 The effects of MRF policies can be very drastic. It is important to use this functionality carefully. Always try to talk to an admin before writing an MRF policy concerning their instance.
 
+## Hiding or Obfuscating Policies
+
+You can opt out of publicly displaying all MRF policies or only hide or obfuscate selected domains.
+
+To just hide everything set:
+
+```elixir
+config :pleroma, :mrf,
+  ...
+  transparency: false,
+```
+
+To hide or obfuscate only select entries, use:
+
+```elixir
+config :pleroma, :mrf,
+  ...
+  transparency_obfuscate_domains: ["handholdi.ng", "badword.com"],
+  transparency_exclusions: [{"ghost.club", "even a fragment is too spoopy for humans"}]
+```
+
+## More MRF Policies
+
+See the [documentation cheatsheet](cheatsheet.md)
+for all available MRF policies and their options.
+
 ## Writing your own MRF Policy
 
 As discussed above, the MRF system is a modular system that supports pluggable policies. This means that an admin may write a custom MRF policy in Elixir or any other language that runs on the Erlang VM, by specifying the module name in the `policies` config setting.
@@ -124,7 +151,7 @@ Please note that the Akkoma developers consider custom MRF policy modules to fal
 
 ### MRF policies descriptions
 
-If MRF policy depends on config, it can be added into MRF tab to adminFE by adding `config_description/0` method, which returns a map with a specific structure. See existing MRF's like `lib/pleroma/web/activity_pub/mrf/activity_expiration_policy.ex` for examples. Note that more complex inputs, like tuples or maps, may need extra changes in the adminFE and just adding it to `config_description/0` may not be enough to get these inputs working from the adminFE.
+If MRF policy depends on config, it can be added into MRF tab to admin-fe by adding `config_description/0` method, which returns a map with a specific structure. See existing MRF's like `lib/pleroma/web/activity_pub/mrf/activity_expiration_policy.ex` for examples. Note that more complex inputs, like tuples or maps, may need extra changes in the admin-fe and just adding it to `config_description/0` may not be enough to get these inputs working from the admin-fe.
 
 Example:
 

docs/docs/configuration/onion_federation.md

@@ -5,7 +5,7 @@ In addition, federating with such instances will also help furthering that goal.
 This is a guide to show you how it can be easily done.
 
 This guide assumes you already got Akkoma working, and that it's running on the default port 4000.
-This guide also assumes you're using Nginx as the reverse proxy.
+This guide also assumes you're using nginx as the reverse proxy.
 
 To install Tor on Debian / Ubuntu:
 ```
@@ -21,7 +21,7 @@ HiddenServicePort 80 127.0.0.1:8099
 HiddenServiceVersion 3  # Remove if Tor version is below 0.3 ( tor --version )
 HTTPTunnelPort 9080
 ```
-Restart Tor to generate an adress:
+Restart Tor to generate an address:
 ```
 systemctl restart tor@default.service
 ```
@@ -63,7 +63,7 @@ If creating a Tor-only instance, open `config/prod.secret.exs` and under "config
 In addition to that, replace the existing nginx config's contents with the example below.
 
 ## Existing Instance (Clearnet Instance)
-If not a Tor-only instance, 
+If not a Tor-only instance,
 add the nginx config below to your existing config at `/etc/nginx/sites-enabled/akkoma.nginx`.
 
 ---
@@ -74,56 +74,23 @@ config :pleroma, :http_security,
   enabled: false
 ```
 
-Use this as the Nginx config:
-```
-proxy_cache_path /tmp/akkoma-media-cache levels=1:2 keys_zone=akkoma_media_cache:10m max_size=10g inactive=720m use_temp_path=off;
-# The above already exists in a clearnet instance's config.
-# If not, add it.
-
-server {
-    listen 127.0.0.1:8099;
-    server_name youronionaddress;
-
-    # Comment to enable logs
-    access_log /dev/null;
-    error_log /dev/null;
-
-    gzip_vary on;
-    gzip_proxied any;
-    gzip_comp_level 6;
-    gzip_buffers 16 8k;
-    gzip_http_version 1.1;
-    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml;
-
-    client_max_body_size 16m;
-
-    location / {
-
+In the nginx config, add the following into the `location /` block:
+```nginx
         add_header X-XSS-Protection "0";
         add_header X-Permitted-Cross-Domain-Policies none;
         add_header X-Frame-Options DENY;
         add_header X-Content-Type-Options nosniff;
         add_header Referrer-Policy same-origin;
-
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $http_host;
-
-        proxy_pass http://localhost:4000;
-
-        client_max_body_size 16m;
-    }
-
-    location /proxy {
-        proxy_cache akkoma_media_cache;
-        proxy_cache_lock on;
-        proxy_ignore_client_abort on;
-        proxy_pass http://localhost:4000;
-    }
-}
 ```
-reload Nginx:
+
+Change the `listen` directive to the following:
+```nginx
+listen 127.0.0.1:8099;
+```
+
+Set the `server_name` to your onion address.
+
+Reload nginx:
 ```
 systemctl reload nginx
 ```
@@ -134,7 +101,7 @@ You should now be able to both access your instance using Tor and federate with
 
 ### Possible Issues
 
-* In Debian, make sure your hidden service folder `/var/lib/tor/akkoma_hidden_service/` and its contents, has debian-tor as both owner and group by using 
+* In Debian, make sure your hidden service folder `/var/lib/tor/akkoma_hidden_service/` and its contents, has debian-tor as both owner and group by using
 ```
 ls -la /var/lib/tor/
 ```

docs/docs/configuration/optimisation/optimizing_beam.md

@@ -1,6 +1,6 @@
 # Optimizing the BEAM
 
-Akkoma is built upon the Erlang/OTP VM known as BEAM. The BEAM VM is highly optimized for latency, but this has drawbacks in environments without dedicated hardware. One of the tricks used by the BEAM VM is [busy waiting](https://en.wikipedia.org/wiki/Busy_waiting). This allows the application to pretend to be busy working so the OS kernel does not pause the application process and switch to another process waiting for the CPU to execute its workload. It does this by spinning for a period of time which inflates the apparent CPU usage of the application so it is immediately ready to execute another task. This can be observed with utilities like **top(1)** which will show consistently high CPU usage for the process. Switching between procesess is a rather expensive operation and also clears CPU caches further affecting latency and performance. The goal of busy waiting is to avoid this penalty.
+Akkoma is built upon the Erlang/OTP VM known as BEAM. The BEAM VM is highly optimized for latency, but this has drawbacks in environments without dedicated hardware. One of the tricks used by the BEAM VM is [busy waiting](https://en.wikipedia.org/wiki/Busy_waiting). This allows the application to pretend to be busy working so the OS kernel does not pause the application process and switch to another process waiting for the CPU to execute its workload. It does this by spinning for a period of time which inflates the apparent CPU usage of the application so it is immediately ready to execute another task. This can be observed with utilities like **top(1)** which will show consistently high CPU usage for the process. Switching between processes is a rather expensive operation and also clears CPU caches further affecting latency and performance. The goal of busy waiting is to avoid this penalty.
 
 This strategy is very successful in making a performant and responsive application, but is not desirable on Virtual Machines or hardware with few CPU cores. Akkoma instances are often deployed on the same server as the required PostgreSQL database which can lead to situations where the Akkoma application is holding the CPU in a busy-wait loop and as a result the database cannot process requests in a timely manner. The fewer CPUs available, the more this problem is exacerbated. The latency is further amplified by the OS being installed on a Virtual Machine as the Hypervisor uses CPU time-slicing to pause the entire OS and switch between other tasks.
 
@@ -18,18 +18,20 @@ Please only change these settings if you are experiencing issues or really know
 
 * AWS (known to use burst scheduling)
 
-
 ## Example configurations
 
 Tuning the BEAM requires you provide a config file normally called [vm.args](http://erlang.org/doc/man/erl.html#emulator-flags). If you are using systemd to manage the service you can modify the unit file as such:
 
 `ExecStart=/usr/bin/elixir --erl '-args_file /opt/akkoma/config/vm.args' -S /usr/bin/mix phx.server`
 
+If using an OTP release, set the `RELEASE_VM_ARGS` environment variable to the path to the vm.args file.
+
 Check your OS documentation to adopt a similar strategy on other platforms.
 
 ### Virtual Machine and/or few CPU cores
 
-Disable the busy-waiting. This should generally only be done if you're on a platform that does burst scheduling, like AWS.
+Disable the busy-waiting. This should generally be done if you're on a platform that does burst scheduling, like AWS, or if you're running other
+services on the same machine.
 
 **vm.args:**
 
@@ -39,6 +41,8 @@ Disable the busy-waiting. This should generally only be done if you're on a plat
 +sbwtdio none
 ```
 
+These settings are enabled by default for OTP releases
+
 ### Dedicated Hardware
 
 Enable more busy waiting, increase the internal maximum limit of BEAM processes and ports. You can use this if you run on dedicated hardware, but it is not necessary.

docs/docs/configuration/optimisation/varnish_cache.md

@@ -4,29 +4,29 @@ Varnish is a layer that sits between your web server and your backend applicatio
 it does something similar to nginx caching, but tends to be optimised for speed over
 all else.
 
-To set up a varnish cache, first you'll need to install varnish. 
+To set up a Varnish cache, first you'll need to install Varnish. 
 
 This will vary by distribution, and since this is a rather advanced guide,
 no copy-paste instructions are provided. It's probably in your distribution's
 package manager, though. `apt-get install varnish` and so on.
 
-Once you have varnish installed, you'll need to configure it to work with akkoma.
+Once you have Varnish installed, you'll need to configure it to work with akkoma.
 
-Copy the configuration file to the varnish configuration directory:
+Copy the configuration file to the Varnish configuration directory:
 
     cp installation/akkoma.vcl /etc/varnish/akkoma.vcl
 
-You may want to check if varnish added a `default.vcl` file to the same directory,
-if so you can just remove it without issue.
+You may want to check if Varnish added a `default.vcl` file to the same directory,
+if so, you can just remove it without issue.
 
-Then boot up varnish, probably `systemctl start varnish` or `service varnish start`.
+Then boot up Varnish, probably `systemctl start varnish` or `service varnish start`.
 
 Now you should be able to `curl -D- localhost:6081` and see a bunch of
 akkoma javascript.
 
-Once that's out of the way, we can point our webserver at varnish. This
+Once that's out of the way, we can point our webserver at Varnish. This
 
-=== "Nginx"
+=== "nginx"
 
     upstream phoenix {
         server 127.0.0.1:6081 max_fails=5 fail_timeout=60s;
@@ -51,4 +51,4 @@ if (std.port(server.ip) != 443) {
 }
 ```
 
-This will allow your webserver alone to handle redirects.
+This will allow your webserver alone to handle redirects.

docs/docs/configuration/postgresql.md

@@ -4,47 +4,10 @@ Akkoma performance is largely dependent on performance of the underlying databas
 
 ## PGTune
 
-[PgTune](https://pgtune.leopard.in.ua) can be used to get recommended settings. Be sure to set "Number of Connections" to 20, otherwise it might produce settings hurtful to database performance. It is also recommended to not use "Network Storage" option.
+[PgTune](https://pgtune.leopard.in.ua) can be used to get recommended settings. Make sure to set the DB type to "Online transaction processing system" for optimal performance. Also set the number of connections to between 25 and 30. This will allow each connection to have access to more resources while still leaving some room for running maintenance tasks while the instance is still running. 
 
-If your server runs other services, you may want to take that into account. E.g. if you have 4G ram, but 1G of it is already used for other services, it may be better to tell PGTune you only have 3G. In the end, PGTune only provides recomended settings, you can always try to finetune further.
+It is also recommended to not use "Network Storage" option.
 
-### Example configurations
+If your server runs other services, you may want to take that into account. E.g. if you have 4G ram, but 1G of it is already used for other services, it may be better to tell PGTune you only have 3G.
 
-Here are some configuration suggestions for PostgreSQL 10+.
-
-#### 1GB RAM, 1 CPU
-```
-shared_buffers = 256MB
-effective_cache_size = 768MB
-maintenance_work_mem = 64MB
-work_mem = 13107kB
-```
-
-#### 2GB RAM, 2 CPU
-```
-shared_buffers = 512MB
-effective_cache_size = 1536MB
-maintenance_work_mem = 128MB
-work_mem = 26214kB
-max_worker_processes = 2
-max_parallel_workers_per_gather = 1
-max_parallel_workers = 2
-```
-
-## Disable generic query plans
-
-When PostgreSQL receives a query, it decides on a strategy for searching the requested data, this is called a query plan. The query planner has two modes: generic and custom. Generic makes a plan for all queries of the same shape, ignoring the parameters, which is then cached and reused. Custom, on the contrary, generates a unique query plan based on query parameters.
-
-By default PostgreSQL has an algorithm to decide which mode is more efficient for particular query, however this algorithm has been observed to be wrong on some of the queries Akkoma sends, leading to serious performance loss. Therefore, it is recommended to disable generic mode.
-
-
-Akkoma already avoids generic query plans by default, however the method it uses is not the most efficient because it needs to be compatible with all supported PostgreSQL versions. For PostgreSQL 12 and higher additional performance can be gained by adding the following to Akkoma configuration:
-```elixir
-config :pleroma, Pleroma.Repo,
-  prepare: :named,
-  parameters: [
-    plan_cache_mode: "force_custom_plan"
-  ]
-```
-
-A more detailed explaination of the issue can be found at <https://blog.soykaf.com/post/postgresql-elixir-troubles/>.
+In the end, PGTune only provides recommended settings, you can always try to finetune further.

docs/docs/configuration/search.md

@@ -18,7 +18,7 @@ around 4 gigabytes. Like [RUM](./cheatsheet.md#rum-indexing-for-full-text-search
 higher performance and ordering by timestamp in a reasonable amount of time.
 Additionally, the search results seem to be more accurate.
 
-Due to high memory usage, it may be best to set it up on a different machine, if running pleroma on a low-resource
+Due to high memory usage, it may be best to set it up on a different machine, if running akkoma on a low-resource
 computer, and use private key authentication to secure the remote search instance.
 
 To use [meilisearch](https://www.meilisearch.com/), set the search module to `Pleroma.Search.Meilisearch`:
@@ -26,16 +26,17 @@ To use [meilisearch](https://www.meilisearch.com/), set the search module to `Pl
 > config :pleroma, Pleroma.Search, module: Pleroma.Search.Meilisearch
 
 You then need to set the address of the meilisearch instance, and optionally the private key for authentication. You might
-also want to change the `initial_indexing_chunk_size` to be smaller if you're server is not very powerful, but not higher than `100_000`,
-because meilisearch will refuse to process it if it's too big. However, in general you want this to be as big as possible, because meilisearch
+also want to change the `initial_indexing_chunk_size` to be smaller if your server is not very powerful, but not higher than `100_000`,
+because Meilisearch will refuse to process it if it's too big. However, in general you want this to be as big as possible, because Meilisearch
 indexes faster when it can process many posts in a single batch.
 
 > config :pleroma, Pleroma.Search.Meilisearch,
 >    url: "http://127.0.0.1:7700/",
 >    private_key: "private key",
+>    search_key: "search key",
 >    initial_indexing_chunk_size: 100_000
 
-Information about setting up meilisearch can be found in the
+Information about setting up Meilisearch can be found in the
 [official documentation](https://docs.meilisearch.com/learn/getting_started/installation.html).
 You probably want to start it with `MEILI_NO_ANALYTICS=true` environment variable to disable analytics.
 At least version 0.25.0 is required, but you are strongly adviced to use at least 0.26.0, as it introduces
@@ -45,7 +46,7 @@ is hardly usable on a somewhat big instance.
 ### Private key authentication (optional)
 
 To set the private key, use the `MEILI_MASTER_KEY` environment variable when starting. After setting the _master key_,
-you have to get the _private key_, which is actually used for authentication.
+you have to get the _private key_ and possibly _search key_, which are actually used for authentication.
 
 === "OTP"
     ```sh
@@ -57,7 +58,11 @@ you have to get the _private key_, which is actually used for authentication.
     mix pleroma.search.meilisearch show-keys <your master key here>
     ```
 
-You will see a "Default Admin API Key", this is the key you actually put into your configuration file.
+You will see a "Default Admin API Key", this is the key you actually put into
+your configuration file as `private_key`. You should also see a
+"Default Search API key", put this into your config as `search_key`.
+If your version of Meilisearch only showed the former,
+just leave `search_key` completely unset in Akkoma's config.
 
 ### Initial indexing
 
@@ -88,7 +93,7 @@ To start the initial indexing, run the `index` command:
     ```
 
 This will show you the total amount of posts to index, and then show you the amount of posts indexed currently, until the numbers eventually
-become the same. The posts are indexed in big batches and meilisearch will take some time to actually index them, even after you have
+become the same. The posts are indexed in big batches and Meilisearch will take some time to actually index them, even after you have
 inserted all the posts into it. Depending on the amount of posts, this may be as long as several hours. To get information about the status
 of indexing and how many posts have actually been indexed, use the `stats` command:
 
@@ -126,9 +131,9 @@ depends on the amount of text in posts.
 
 **Note: This requires at least ElasticSearch 7**
 
-As with meilisearch, this can be rather memory-hungry, but it is very good at what it does.
+As with Meilisearch, this can be rather memory-hungry, but it is very good at what it does.
 
-To use [elasticsearch](https://www.elastic.co/), set the search module to `Pleroma.Search.Elasticsearch`:
+To use [Elasticsearch](https://www.elastic.co/), set the search module to `Pleroma.Search.Elasticsearch`:
 
 > config :pleroma, Pleroma.Search, module: Pleroma.Search.Elasticsearch
 
@@ -141,7 +146,7 @@ You then need to set the URL and authentication credentials if relevant.
 
 ### Initial indexing
 
-After setting up the configuration, you'll want to index all of your already existsing posts. You'll only have to do it one time, but it might take a while, depending on the amount of posts your instance has seen. 
+After setting up the configuration, you'll want to index all of your already existsing posts. You'll only have to do it one time, but it might take a while, depending on the amount of posts your instance has seen.
 
 The sequence of actions is as follows:
 

docs/docs/configuration/static_dir.md

@@ -49,7 +49,7 @@ Add `$static_dir/instance/thumbnail.jpeg` with your selfie or other neat picture
 
 ## Instance-specific panel
 
-Create and Edit your file at `$static_dir/instance/panel.html`.
+Create and edit your file at `$static_dir/instance/panel.html`.
 
 ## Background
 
@@ -69,7 +69,7 @@ config :pleroma, :frontend_configurations,
 !!! important
     Note the extra `static` folder for the default logo.png location
 
-If you want to give a brand to your instance, You can change the logo of your instance by uploading it to the static directory `$static_dir/static/logo.png`.
+If you want to give a brand to your instance, you can change the logo of your instance by uploading it to the static directory `$static_dir/static/logo.png`.
 
 Alternatively, you can specify the path to your logo in [your configuration](../cheatsheet/#frontend_configurations).
 
@@ -91,21 +91,21 @@ Terms of Service will be shown to all users on the registration page. It's the b
 
 ## Favicon
 
-The favicon will display on the frontend, and in the browser tab. 
+The favicon will display on the frontend, and in the browser tab.
 
 Place a PNG file at `$static_dir/favicon.png` to change the favicon. Not that this
 is _one level above_ where the logo is placed, it should be on the same level as
 the `frontends` directory.
- 	
+
 ## Styling rendered pages
 
 To overwrite the CSS stylesheet of the OAuth form and other static pages, you can upload your own CSS file to `instance/static/static.css`. This will completely replace the CSS used by those pages, so it might be a good idea to copy the one from `priv/static/instance/static.css` and make your changes.
 
-## Overriding pleroma-fe styles
+## Overriding akkoma-fe styles
 
-To overwrite the CSS stylesheet of pleroma-fe, you can put a file at
+To overwrite the CSS stylesheet of akkoma-fe, you can put a file at
 `$static_dir/static/custom.css` containing your styles. These will be loaded
 with the rest of the CSS.
 
 You will probably have to put `!important` on most/all your styles to override the
-default ones, due to the specificity precedence of CSS.
+default ones, due to the specificity precedence of CSS.

docs/docs/configuration/storing_remote_media.md

@@ -1,12 +1,12 @@
 # Storing Remote Media
 
-Akkoma does not store remote/federated media by default. The best way to achieve this is to change Nginx to keep its reverse proxy cache
+Akkoma does not store remote/federated media by default. The best way to achieve this is to change nginx to keep its reverse proxy cache
 for a year and to activate the `MediaProxyWarmingPolicy` MRF policy in Akkoma which will automatically fetch all media through the proxy
 as soon as the post is received by your instance.
 
-## Nginx
+## nginx
 
-The following are excerpts from the [suggested nginx config](../../../installation/nginx/akkoma.nginx) that demonstrates the necessary config for the media proxy to work.
+The following are excerpts from the [suggested nginx config](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/installation/nginx/akkoma.nginx) that demonstrates the necessary config for the media proxy to work.
 
 A `proxy_cache_path` must be defined, for example:
 

docs/docs/development/API/admin_api.md

@@ -137,7 +137,7 @@ Backwards-compatibility for admin API endpoints without version prefixes (`/api/
 
 ## `GET /api/v1/pleroma/admin/users/:nickname/permission_group`
 
-### Get user user permission groups membership
+### Get user permission groups membership
 
 - Params: none
 - Response:
@@ -153,7 +153,7 @@ Backwards-compatibility for admin API endpoints without version prefixes (`/api/
 
 Note: Available `:permission_group` is currently moderator and admin. 404 is returned when the permission group doesn’t exist.
 
-### Get user user permission groups membership per permission group
+### Get user permission groups membership per permission group
 
 - Params: none
 - Response:
@@ -303,7 +303,7 @@ Removes the user(s) from follower recommendations.
 
 ## `GET /api/v1/pleroma/admin/users/:nickname_or_id`
 
-### Retrive the details of a user
+### Retrieve the details of a user
 
 - Params:
   - `nickname` or `id`
@@ -313,7 +313,7 @@ Removes the user(s) from follower recommendations.
 
 ## `GET /api/v1/pleroma/admin/users/:nickname_or_id/statuses`
 
-### Retrive user's latest statuses
+### Retrieve user's latest statuses
 
 - Params:
   - `nickname` or `id`
@@ -337,7 +337,7 @@ Removes the user(s) from follower recommendations.
 
 ## `GET /api/v1/pleroma/admin/instances/:instance/statuses`
 
-### Retrive instance's latest statuses
+### Retrieve instance's latest statuses
 
 - Params:
   - `instance`: instance name
@@ -377,7 +377,7 @@ It may take some time.
 
 ## `GET /api/v1/pleroma/admin/statuses`
 
-### Retrives all latest statuses
+### Retrieves all latest statuses
 
 - Params:
   - *optional* `page_size`: number of statuses to return (default is `20`)
@@ -414,7 +414,7 @@ Params:
 
 Response:
 
-* On success: relay json object
+* On success: relay JSON object
 
 ```json
 {"actor": "https://example.com/relay", "followed_back": true}
@@ -505,7 +505,7 @@ Response:
 
 ## `POST /api/v1/pleroma/admin/users/email_invite`
 
-### Sends registration invite via email
+### Sends a registration invite via email
 
 - Params:
   - `email`
@@ -528,7 +528,6 @@ Response:
 
 ### Get a password reset token for a given nickname
 
-
 - Params: none
 - Response:
 
@@ -541,7 +540,7 @@ Response:
 
 ## `PATCH /api/v1/pleroma/admin/users/force_password_reset`
 
-### Force passord reset for a user with a given nickname
+### Force password reset for a user with a given nickname
 
 - Params:
   - `nicknames`
@@ -960,7 +959,7 @@ Status: 404
 
 ## `GET /api/v1/pleroma/admin/need_reboot`
 
-### Returns the flag whether the pleroma should be restarted
+### Returns whether Akkoma should be restarted
 
 - Params: none
 - Response:
@@ -975,7 +974,7 @@ Status: 404
 
 ### Get list of merged default settings with saved in database.
 
-*If `need_reboot` is `true`, instance must be restarted, so reboot time settings can take effect.*
+*If `need_reboot` is `true`, the instance must be restarted, so reboot time settings can take effect.*
 
 **Only works when configuration from database is enabled.**
 
@@ -1033,7 +1032,6 @@ Most of the settings will be applied in `runtime`, this means that you don't nee
   - `:pools`
 - partially settings inside these keys:
   - `:seconds_valid` in `Pleroma.Captcha`
-  - `:proxy_remote` in `Pleroma.Upload`
   - `:upload_limit` in `:instance`
 
 - Params:
@@ -1045,7 +1043,7 @@ Most of the settings will be applied in `runtime`, this means that you don't nee
     - `delete` - true (*optional*, if setting must be deleted)
     - `subkeys` - array of strings (*optional*, only works when `delete=true` parameter is passed, otherwise will be ignored)
 
-*When a value have several nested settings, you can delete only some nested settings by passing a parameter `subkeys`, without deleting all settings by key.*
+*When a value has several nested settings, you can delete only some nested settings by passing a parameter `subkeys`, without deleting all settings by key.*
 ```
 [subkey: val1, subkey2: val2, subkey3: val3] \\ initial value
 {"group": ":pleroma", "key": "some_key", "delete": true, "subkeys": [":subkey", ":subkey3"]} \\ passing json for deletion
@@ -1094,7 +1092,6 @@ List of settings which support only full update by subkey:
         {"tuple": [":uploader", "Pleroma.Uploaders.Local"]},
         {"tuple": [":filters", ["Pleroma.Upload.Filter.Dedupe"]]},
         {"tuple": [":link_name", true]},
-        {"tuple": [":proxy_remote", false]},
         {"tuple": [":proxy_opts", [
           {"tuple": [":redirect_on_failure", false]},
           {"tuple": [":max_body_length", 1048576]},
@@ -1132,7 +1129,7 @@ List of settings which support only full update by subkey:
 ## ` GET /api/v1/pleroma/admin/config/descriptions`
 
 ### Get JSON with config descriptions.
-Loads json generated from `config/descriptions.exs`.
+Loads JSON generated from `config/descriptions.exs`.
 
 - Params: none
 - Response:

docs/docs/development/API/akkoma_api.md

@@ -0,0 +1,146 @@
+# Akkoma API
+
+Request authentication (if required) and parameters work the same as for [Pleroma API](pleroma_api.md).
+
+## `/api/v1/akkoma/preferred_frontend/available`
+### Returns the available frontends which can be picked as the preferred choice
+* Method: `GET`
+* Authentication: not required
+* Params: none
+* Response: JSON
+* Example response:
+```json
+["pleroma-fe/stable"]
+```
+
+!!! note
+    There’s also a browser UI under `/akkoma/frontend`
+    for interactively querying and changing this.
+
+## `/api/v1/akkoma/preferred_frontend`
+### Configures the preferred frontend of this session
+* Method: `PUT`
+* Authentication: not required
+* Params:
+    * `frontend_name`: STRING containing one of the available frontends
+* Response: JSON
+* Example response:
+```json
+{"frontend_name":"pleroma-fe/stable"}
+```
+
+!!! note
+    There’s also a browser UI under `/akkoma/frontend`
+    for interactively querying and changing this.
+
+## `/api/v1/akkoma/metrics`
+### Provides metrics for Prometheus to scrape
+* Method: `GET`
+* Authentication: required (admin:metrics)
+* Params: none
+* Response: text
+* Example response:
+```
+# HELP pleroma_remote_users_total
+# TYPE pleroma_remote_users_total gauge
+pleroma_remote_users_total 25
+# HELP pleroma_local_statuses_total
+# TYPE pleroma_local_statuses_total gauge
+pleroma_local_statuses_total 17
+# HELP pleroma_domains_total
+# TYPE pleroma_domains_total gauge
+pleroma_domains_total 4
+# HELP pleroma_local_users_total
+# TYPE pleroma_local_users_total gauge
+pleroma_local_users_total 3
+...
+```
+
+## `/api/v1/akkoma/translation/languages`
+### Returns available source and target languages for automated text translation
+* Method: `GET`
+* Authentication: required
+* Params: none
+* Response: JSON
+* Example response:
+```json
+{
+  "source": [
+    {"code":"LV", "name":"Latvian"},
+    {"code":"ZH", "name":"Chinese (traditional)"},
+    {"code":"EN-US", "name":"English (American)"}
+  ],
+  "target": [
+    {"code":"EN-GB", "name":"English (British)"},
+    {"code":"JP", "name":"Japanese"}
+  ]
+}
+```
+
+## `/api/v1/akkoma/frontend_settings/:frontend_name`
+### Lists all configuration profiles of the selected frontend for the current user
+* Method: `GET`
+* Authentication: required
+* Params: none
+* Response: JSON
+* Example response:
+```json
+[
+  {"name":"default","version":31}
+]
+```
+
+## `/api/v1/akkoma/frontend_settings/:frontend_name/:profile_name`
+### Returns the full selected frontend settings profile of the current user
+* Method: `GET`
+* Authentication: required
+* Params: none
+* Response: JSON
+* Example response:
+```json
+{
+  "version": 31,
+  "settings": {
+    "streaming": true,
+    "conversationDisplay": "tree",
+    ...
+  }
+}
+```
+
+## `/api/v1/akkoma/frontend_settings/:frontend_name/:profile_name`
+### Updates the frontend settings profile
+* Method: `PUT`
+* Authentication: required
+* Params:
+    * `version`: INTEGER
+    * `settings`: JSON object containing the entire new settings
+* Response: JSON
+* Example response:
+```json
+{
+  "streaming": false,
+  "conversationDisplay": "tree",
+  ...
+}
+```
+
+!!! note
+    The `version` field must be increased by exactly one on each update
+
+## `/api/v1/akkoma/frontend_settings/:frontend_name/:profile_name`
+### Drops the specified frontend settings profile
+* Method: `DELETE`
+* Authentication: required
+* Params: none
+* Response: JSON
+* Example response:
+```json
+{"deleted":"ok"}
+```
+
+
+## `/api/v1/timelines/bubble`
+### Returns a timeline for the local and closely related instances
+Works like all other Mastodon-API timeline queries with the documented
+[Akkoma-specific additions and tweaks](./differences_in_mastoapi_responses.md#timelines).

docs/docs/development/API/differences_in_mastoapi_responses.md

@@ -1,27 +1,35 @@
 # Differences in Mastodon API responses from vanilla Mastodon
 
-A Akkoma instance can be identified by "<Mastodon version> (compatible; Pleroma <version>)" present in `version` field in response from `/api/v1/instance`
+An Akkoma instance can be identified by "<Mastodon version> (compatible; Akkoma <version>)" present in `version` field in response from `/api/v1/instance`
 
 ## Flake IDs
 
-Akkoma uses 128-bit ids as opposed to Mastodon's 64 bits. However, just like Mastodon's ids, they are lexically sortable strings
+Akkoma uses 128-bit IDs as opposed to Mastodon's 64 bits. However, just like Mastodon's IDs, they are lexically sortable strings
 
 ## Timelines
 
+In addition to Mastodon’s timelines, there is also a “bubble timeline” showing
+posts from the local instance and a set of closely related instances as chosen
+by the administrator. It is available under `/api/v1/timelines/bubble`.
+
 Adding the parameter `with_muted=true` to the timeline queries will also return activities by muted (not by blocked!) users.
 
 Adding the parameter `exclude_visibilities` to the timeline queries will exclude the statuses with the given visibilities. The parameter accepts an array of visibility types (`public`, `unlisted`, `private`, `direct`), e.g., `exclude_visibilities[]=direct&exclude_visibilities[]=private`.
 
-Adding the parameter `reply_visibility` to the public and home timelines queries will filter replies. Possible values: without parameter (default) shows all replies, `following` - replies directed to you or users you follow, `self` - replies directed to you.
+Adding the parameter `reply_visibility` to the public, bubble or home timelines queries will filter replies. Possible values: without parameter (default) shows all replies, `following` - replies directed to you or users you follow, `self` - replies directed to you.
 
 Adding the parameter `instance=lain.com` to the public timeline will show only statuses originating from `lain.com` (or any remote instance).
 
-Home, public, hashtag & list timelines accept these parameters:
+All but the direct timeline accept these parameters:
 
 - `only_media`: show only statuses with media attached
-- `local`: show only local statuses
 - `remote`: show only remote statuses
 
+Home, public, hashtag & list timelines further accept:
+
+- `local`: show only local statuses
+
+
 ## Statuses
 
 - `visibility`: has additional possible values `list` and `local` (for local-only statuses)
@@ -93,11 +101,11 @@ Endpoints which accept `with_relationships` parameter:
 
 Has these additional fields under the `pleroma` object:
 
-- `ap_id`: nullable URL string, ActivityPub id of the user
+- `ap_id`: nullable URL string, ActivityPub ID of the user
 - `background_image`: nullable URL string, background image of the user
 - `tags`: Lists an array of tags for the user
 - `relationship` (object): Includes fields as documented for Mastodon API https://docs.joinmastodon.org/entities/relationship/
-- `is_moderator`: boolean, nullable,  true if user is a moderator
+- `is_moderator`: boolean, nullable, true if user is a moderator
 - `is_admin`: boolean, nullable, true if user is an admin
 - `confirmation_pending`: boolean, true if a new user account is waiting on email confirmation to be activated
 - `hide_favorites`: boolean, true when the user has hiding favorites enabled
@@ -113,12 +121,18 @@ Has these additional fields under the `pleroma` object:
 - `notification_settings`: object, can be absent. See `/api/v1/pleroma/notification_settings` for the parameters/keys returned.
 - `favicon`: nullable URL string, Favicon image of the user's instance
 
+Has these additional fields under the `akkoma` object:
+
+- `instance`: nullable object with metadata about the user’s instance
+- `status_ttl_days`: nullable int, default time after which statuses are deleted
+- `permit_followback`: boolean, whether follows from followed accounts are auto-approved
+
 ### Source
 
 Has these additional fields under the `pleroma` object:
 
-- `show_role`: boolean, nullable, true when the user wants his role (e.g admin, moderator) to be shown
-- `no_rich_text` - boolean, nullable, true when html tags are stripped from all statuses requested from the API
+- `show_role`: boolean, nullable, true when the user wants his role (e.g. admin, moderator) to be shown
+- `no_rich_text` - boolean, nullable, true when HTML tags are stripped from all statuses requested from the API
 - `discoverable`: boolean, true when the user allows external services (search bots) etc. to index / list the account (regardless of this setting, user will still appear in regular search results)
 - `actor_type`: string, the type of this account.
 
@@ -186,7 +200,7 @@ An endpoint to delete multiple statuses by IDs.
 
 Required parameters:
 
-- `ids`: array of activity ids
+- `ids`: array of activity IDs
 
 Usage example: `DELETE /api/v1/notifications/destroy_multiple/?ids[]=1&ids[]=2`.
 
@@ -247,7 +261,7 @@ All images (avatar, banner and background) can be reset to the default by sendin
 
 ### Akkoma Settings Store
 
-Akkoma has mechanism that allows frontends to save blobs of json for each user on the backend. This can be used to save frontend-specific settings for a user that the backend does not need to know about.
+Akkoma has a mechanism that allows frontends to save blobs of json for each user on the backend. This can be used to save frontend-specific settings for a user that the backend does not need to know about.
 
 The parameter should have a form of `{frontend_name: {...}}`, with `frontend_name` identifying your type of client, e.g. `pleroma_fe`. It will overwrite everything under this property, but will not overwrite other frontend's settings.
 
@@ -326,7 +340,7 @@ Permits these additional alert types:
 
 Has these additional fields under the `pleroma` object:
 
-- `unread_count`: contains number unread notifications
+- `unread_count`: contains number of unread notifications
 
 ## Streaming
 
@@ -338,7 +352,7 @@ For viewing remote server timelines, there are `public:remote` and `public:remot
 
 Akkoma streams follow relationships updates as `pleroma:follow_relationships_update` events to the `user` stream.
 
-The message payload consist of:
+The message payload consists of:
 
 - `state`: a relationship state, one of `follow_pending`, `follow_accept` or `follow_reject`.
 

docs/docs/development/ap_extensions.md

@@ -4,7 +4,6 @@
 The following endpoints are additionally present into our actors.
 
 - `oauthRegistrationEndpoint` (`http://litepub.social/ns#oauthRegistrationEndpoint`)
-- `uploadMedia` (`https://www.w3.org/ns/activitystreams#uploadMedia`)
 
 ### oauthRegistrationEndpoint
 
@@ -12,6 +11,279 @@ Points to MastodonAPI `/api/v1/apps` for now.
 
 See <https://docs.joinmastodon.org/methods/apps/>
 
+## Emoji reactions
+
+Emoji reactions are implemented as a new activity type `EmojiReact`.
+A single user is allowed to react multiple times with different emoji to the
+same post. However, they may only react at most once with the same emoji.
+Repeated reaction from the same user with the same emoji are to be ignored.
+Emoji reactions are also distinct from `Like` activities and a user may both
+`Like` and react to a post.
+
+!!! note
+    Misskey also supports emoji reactions, but the implementations differs.
+    It equates likes and reactions and only allows a single reaction per post.
+
+The emoji is placed in the `content` field of the activity
+and the `object` property points to the note reacting to.
+
+Emoji can either be any Unicode emoji sequence or a custom emoji.
+The latter must place their shortcode, including enclosing colons,
+into `content` and put the emoji object inside the `tag` property.
+The `tag` property MAY be omitted for Unicode emoji.
+
+An example reaction with a Unicode emoji:
+```json
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams",
+    "https://example.org/schemas/litepub-0.1.jsonld",
+    {
+      "@language": "und"
+    }
+  ],
+  "type": "EmojiReact",
+  "id": "https://example.org/activities/23143872a0346141",
+  "actor": "https://example.org/users/akko",
+  "nickname": "akko",
+  "to": ["https://remote.example/users/diana", "https://example.org/users/akko/followers"],
+  "cc": ["https://www.w3.org/ns/activitystreams#Public"],
+  "content": "🧡",
+  "object": "https://remote.example/objects/9f0e93499d8314a9"
+}
+```
+
+An example reaction with a custom emoji:
+```json
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams",
+    "https://example.org/schemas/litepub-0.1.jsonld",
+    {
+      "@language": "und"
+    }
+  ],
+  "type": "EmojiReact",
+  "id": "https://example.org/activities/d75586dec0541650",
+  "actor": "https://example.org/users/akko",
+  "nickname": "akko",
+  "to": ["https://remote.example/users/diana", "https://example.org/users/akko/followers"],
+  "cc": ["https://www.w3.org/ns/activitystreams#Public"],
+  "content": ":mouse:",
+  "object": "https://remote.example/objects/9f0e93499d8314a9",
+  "tag": [{
+    "type": "Emoji",
+    "id": null,
+    "name": "mouse",
+    "icon": {
+      "type": "Image",
+      "url": "https://example.org/emoji/mouse/mouse.png"
+    }
+  }]
+}
+```
+
+!!! note
+    Although an emoji reaction can only contain a single emoji,
+    for compatibility with older versions of Pleroma and Akkoma,
+    it is recommended to wrap the emoji object in a single-element array.
+
+When reacting with a remote custom emoji do not include the remote domain in `content`’s shortcode
+*(unlike in our REST API which needs the domain)*:
+```json
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams",
+    "https://example.org/schemas/litepub-0.1.jsonld",
+    {
+      "@language": "und"
+    }
+  ],
+  "type": "EmojiReact",
+  "id": "https://example.org/activities/7993dcae98d8d5ec",
+  "actor": "https://example.org/users/akko",
+  "nickname": "akko",
+  "to": ["https://remote.example/users/diana", "https://example.org/users/akko/followers"],
+  "cc": ["https://www.w3.org/ns/activitystreams#Public"],
+  "content": ":hug:",
+  "object": "https://remote.example/objects/9f0e93499d8314a9",
+  "tag": [{
+    "type": "Emoji",
+    "id": "https://other.example/emojis/hug",
+    "name": "hug",
+    "icon": {
+      "type": "Image",
+      "url": "https://other.example/files/b71cea432b3fad67.webp"
+    }
+  }]
+}
+```
+
+Emoji reactions can be retracted using a standard `Undo` activity:
+```json
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams",
+    "http://example.org/schemas/litepub-0.1.jsonld",
+    {
+      "@language": "und"
+    }
+  ],
+  "type": "Undo",
+  "id": "http://example.org/activities/4685792e-efb6-4309-b508-ae4f355dd695",
+  "actor": "https://example.org/users/akko",
+  "to": ["https://remote.example/users/diana", "https://example.org/users/akko/followers"],
+  "cc": ["https://www.w3.org/ns/activitystreams#Public"],
+  "object": "https://example.org/activities/23143872a0346141"
+}
+```
+
+## User profile backgrounds
+
+Akkoma federates user profile backgrounds the same way as Sharkey.
+
+An actors ActivityPub representation contains an additional
+`backgroundUrl` property containing an `Image` object. This property
+belongs to the `"sharkey": "https://joinsharkey.org/ns#"` namespace.
+
+## Quote Posts
+
+Akkoma allows referencing a single other note as a quote,
+which will be prominently displayed in the interface.
+
+The quoted post is referenced by its ActivityPub id in the `quoteUri` property.
+
+!!! note
+    Old Misskey only understood and modern Misskey still prefers
+    the `_misskey_quote` property for this. Similar some other older
+    software used `quoteUrl` or `quoteURL`.  
+    All current implementations with quote support understand `quoteUri`.
+
+Example:
+```json
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams",
+    "https://example.org/schemas/litepub-0.1.jsonld",
+    {
+      "@language": "und"
+    }
+  ],
+  "type": "Note",
+  "id": "https://example.org/activities/85717e587f95d5c0",
+  "actor": "https://example.org/users/akko",
+  "to": ["https://remote.example/users/diana", "https://example.org/users/akko/followers"],
+  "cc": ["https://www.w3.org/ns/activitystreams#Public"],
+  "context": "https://example.org/contexts/1",
+  "content": "Look at that!",
+  "quoteUri": "http://remote.example/status/85717e587f95d5c0",
+  "contentMap": {
+    "en": "Look at that!"
+  },
+  "source": {
+    "content": "Look at that!",
+    "mediaType": "text/plain"
+  },
+  "published": "2024-04-06T23:40:28Z",
+  "updated": "2024-04-06T23:40:28Z",
+  "attachemnt": [],
+  "tag": []
+}
+```
+
+## Threads
+
+Akkoma assigns all posts of the same thread the same `context`. This is a
+standard ActivityPub property but its meaning is left vague. Akkoma will
+always treat posts with identical `context` as part of the same thread.
+
+`context` must not be assumed to hold any meaning or be dereferencable.
+
+Incoming posts without `context` will be assigned a new context.
+
+!!! note
+    Mastodon uses the non-standard `conversation` property for the same purpose
+    *(named after an older OStatus property)*. For incoming posts without
+    `context` but with `converstions` Akkoma will use the value from
+    `conversations` to fill in `context`.
+    For outgoing posts Akkoma will duplicate the context into `conversation`.
+
+## Post Source
+
+Unlike Mastodon, Akkoma supports drafting posts in multiple source formats
+besides plaintext, like Markdown or MFM. The original input is preserved
+in the standard ActivityPub `source` property *(not supported by Mastodon)*.
+Still, `content` will always be present and contain the prerendered HTML form.
+
+Supported `mediaType` include:
+- `text/plain`
+- `text/markdown`
+- `text/bbcode`
+- `text/x.misskeymarkdown`
+
+## Post Language
+
+!!! note
+    This is also supported in and compatible with Mastodon, but since
+    joinmastodon.org doesn’t document it yet it is included here.
+    [GoToSocial](https://docs.gotosocial.org/en/latest/federation/federating_with_gotosocial/#content-contentmap-and-language)
+    has a more refined version of this which can correctly deal with multiple language entries.
+
+A post can indicate its language by including a `contentMap` object
+which contains a sub key named after the language’s ISO 639-1 code
+and it’s content identical to the post’s `content` field.
+
+Currently Akkoma, just like Mastodon, only properly supports a single language entry,
+in case of multiple entries a random language will be picked.  
+Furthermore, Akkoma currently only reads the `content` field
+and never the value from `contentMap`.
+
+## Local post scope
+
+Post using this scope will never federate to other servers
+but for the sake of completeness it is listed here.
+
+In addition to the usual scopes *(public, unlisted, followers-only, direct)*
+Akkoma supports an “unlisted” post scope. Such posts will not federate to
+other instances and only be shown to logged-in users on the same instance.
+It is included into the local timeline.  
+This may be useful to discuss or announce instance-specific policies and topics.
+
+A post is addressed to the local scope by including `<base url of instance>/#Public`
+in its `to` field. E.g. if the instance is on `https://example.org` it would use
+`https://example.org/#Public`.
+
+An implementation creating a new post MUST NOT address both the local and
+general public scope `as:Public` at the same time. A post addressing the local
+scope MUST NOT be sent to other instances or be possible to fetch by other
+instances regardless of potential other listed addressees.
+
+When receiving a remote post addressing both the public scope and what appears
+to be a local-scope identifier, the post SHOULD be treated without assigning any
+special meaning to the potential local-scope identifier.
+
+!!! note
+    Misskey-derivatives have a similar concept of non-federated posts,
+    however those are also shown publicly on the local web interface
+    and are thus visible to non-members.
+
+## List post scope
+
+Messages originally addressed to a custom list will contain
+a `listMessage` field with an unresolvable pseudo ActivityPub id.
+
+# Deprecated and Removed Extensions
+
+The following extensions were used in the past but have been dropped.
+Documentation is retained here as a reference and since old objects might
+still contains related fields.
+
+## Actor endpoints
+
+The following endpoints used to be present:
+
+- `uploadMedia` (`https://www.w3.org/ns/activitystreams#uploadMedia`)
+
 ### uploadMedia
 
 Inspired by <https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload>, it is part of the ActivityStreams namespace because it used to be part of the ActivityPub specification and got removed from it.
@@ -20,9 +292,8 @@ Content-Type: multipart/form-data
 
 Parameters:
 - (required) `file`: The file being uploaded
-- (optionnal) `description`: A plain-text description of the media, for accessibility purposes.
+- (optional) `description`: A plain-text description of the media, for accessibility purposes.
 
 Response: HTTP 201 Created with the object into the body, no `Location` header provided as it doesn't have an `id`
 
-The object given in the reponse should then be inserted into an Object's `attachment` field.
-
+The object given in the response should then be inserted into an Object's `attachment` field.

docs/docs/development/authentication_authorization.md

@@ -10,7 +10,7 @@
 
   For routes with `:authenticated_api` pipeline, authentication & authorization are expected, thus `OAuthScopesPlug` will be run unless explicitly skipped (also `EnsureAuthenticatedPlug` will be executed immediately before action even if there was an early run to give an early error, since `OAuthScopesPlug` supports `:proceed_unauthenticated` option, and other plugs may support similar options as well).
 
-  For `:api` pipeline routes, it'll be verified whether `OAuthScopesPlug` was called or explicitly skipped, and if it was not then auth information will be dropped for request. Then `EnsurePublicOrAuthenticatedPlug` will be called to ensure that either the instance is not private or user is authenticated (unless explicitly skipped). Such automated checks help to prevent human errors and result in higher security / privacy for users.
+  For `:api` pipeline routes, it'll be verified whether `OAuthScopesPlug` was called or explicitly skipped, and if it was not, then auth information will be dropped for request. Then `EnsurePublicOrAuthenticatedPlug` will be called to ensure that either the instance is not private or user is authenticated (unless explicitly skipped). Such automated checks help to prevent human errors and result in higher security / privacy for users.
 
 ## Non-OAuth authentication
 

docs/docs/development/index.md

@@ -20,16 +20,16 @@ The docs are written in Markdown, including certain extensions, and can be found
 
 Akkoma is written in [Elixir](https://elixir-lang.org/) and uses [Postgresql](https://www.postgresql.org/) for database. We use [Git](https://git-scm.com/) for collaboration and tracking code changes. Furthermore it can typically run on [Unix and Unix-like OS'es](https://en.wikipedia.org/wiki/Unix-like). For development, you should use an OS which [can run Akkoma](../installation/debian_based_en/).
 
-It's good to have at least some basic understanding of at least Git and Elixir. If this is completely new for you, there's some [videos explaining Git](https://git-scm.com/doc) and Codeberg has a nice article explaining the typical [pull requests Git flow](https://docs.codeberg.org/collaborating/pull-requests-and-git-flow/). For Elixir, you can follow Elixir's own [Getting Started guide](https://elixir-lang.org/getting-started/introduction.html).
+It's good to have at least some basic understanding of at least Git and Elixir. If this is completely new for you, there are some [videos explaining Git](https://git-scm.com/doc) and Codeberg has a nice article explaining the typical [pull requests Git flow](https://docs.codeberg.org/collaborating/pull-requests-and-git-flow/). For Elixir, you can follow Elixir's own [Getting Started guide](https://elixir-lang.org/getting-started/introduction.html).
 
 ## Setting up a development environment
 
-The best way to start is getting the software to run from source so you can start poking on it. Check out the [guides for setting up an Akkoma instance for development](setting_up_akkoma_dev/#setting-up-a-akkoma-development-environment).
+The best way to start is getting the software to run from source, so you can start poking on it. Check out the [guides for setting up an Akkoma instance for development](setting_up_akkoma_dev/#setting-up-a-akkoma-development-environment).
 
 ## General overview
 ### Modules
 
-Akkoma has several modules. There are modules for [uploading](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/uploaders), [upload filters](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/upload/filter), [translators](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/akkoma/translators)... The most famous ones are without a doubt the [MRF policies](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/web/activity_pub/mrf). Modules are often self contained and a good way to start with development because you don't have to think about much more than just the module itself. We even have an example on [writing your own MRF policy](/configuration/mrf/#writing-your-own-mrf-policy)!
+Akkoma has several modules. There are modules for [uploading](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/uploaders), [upload filters](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/upload/filter), [translators](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/akkoma/translators)... The most famous ones are without a doubt the [MRF policies](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/web/activity_pub/mrf). Modules are often self-contained and a good way to start with development because you don't have to think about much more than just the module itself. We even have an example on [writing your own MRF policy](/configuration/mrf/#writing-your-own-mrf-policy)!
 
 Another easy entry point is the [mix tasks](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/mix/tasks/pleroma). They too are often self contained and don't need you to go through much of the code.
 

docs/docs/development/nodeinfo_extensions.md

@@ -0,0 +1,141 @@
+# Nodeinfo Extensions
+
+Akkoma currently implements version 2.0 and 2.1 of nodeinfo spec,
+but provides the following additional fields.
+
+## metadata
+
+The spec leaves the content of `metadata` up to implementations
+and indeed Akkoma adds many fields here apart from the commonly
+found `nodeName` and `nodeDescription` fields.
+
+### accountActivationRequired
+Whether or not users need to confirm their email before completing registration.
+*(boolean)*
+
+!!! note
+    Not to be confused with account approval, where each registration needs to
+    be manually approved by an admin. Account approval has no nodeinfo entry.
+
+### features
+
+Array of strings denoting supported server features. E.g. a server supporting
+quote posts should include a `"quote_posting"` entry here.
+
+A non-exhaustive list of possible features:
+- `polls`
+- `quote_posting`
+- `editing`
+- `bubble_timeline`
+- `pleroma_emoji_reactions` *(Unicode emoji)*
+- `custom_emoji_reactions`
+- `akkoma_api`
+- `akkoma:machine_translation`
+- `mastodon_api`
+- `pleroma_api`
+
+### federatedTimelineAvailable
+Whether or not the “federated timeline”, i.e. a timeline containing posts from
+the entire known network, is made available.
+*(boolean)*
+
+### federation
+This section is optional and can contain various custom keys describing federation policies.
+The following are required to be presented:
+- `enabled` *(boolean)* whether the server federates at all
+
+A non-exhaustive list of optional keys:
+- `exclusions` *(boolean)* whether some federation policies are withheld
+- `mrf_simple` *(object)* describes how the Simple MRF policy is configured
+
+### fieldsLimits
+A JSON object documenting restriction for user account info fields.
+All properties are integers.
+
+- `maxFields` maximum number of account info fields local users can create
+- `maxRemoteFields` maximum number of account info fields remote users can have
+   before the user gets rejected or fields truncated
+- `nameLength` maximum length of a field’s name
+- `valueLength` maximum length of a field’s value
+
+### invitesEnabled
+Whether or not signing up via invite codes is possible.
+*(boolean)*
+
+### localBubbleInstances
+Array of domains (as strings) of other instances chosen
+by the admin which are shown in the bubble timeline.
+
+### mailerEnabled
+Whether or not the instance can send out emails.
+*(boolean)*
+
+### nodeDescription
+Human-friendly description of this instance
+*(string)*
+
+### nodeName
+Human-friendly name of this instance
+*(string)*
+
+### pollLimits
+JSON object containing limits for polls created by local users.
+All values are integers.
+- `max_options` maximum number of poll options
+- `max_option_chars` maximum characters per poll option
+- `min_expiration` minimum time in seconds a poll must be open for
+- `max_expiration` maximum time a poll is allowed to be open for
+
+### postFormats
+Array of strings containing media types for supported post source formats.
+A non-exhaustive list of possible values:
+- `text/plain`
+- `text/markdown`
+- `text/bbcode`
+- `text/x.misskeymarkdown`
+
+### private
+Whether or not unauthenticated API access is permitted.
+*(boolean)*
+
+### privilegedStaff
+Whether or not moderators are trusted to perform some
+additional tasks like e.g. issuing password reset emails.
+
+### publicTimelineVisibility
+JSON object containing boolean-valued keys reporting
+if a given timeline can be viewed without login.
+- `local`
+- `federated`
+- `bubble`
+
+### restrictedNicknames
+Array of strings listing nicknames forbidden to be used during signup.
+
+### skipThreadContainment
+Whether broken threads are filtered out
+*(boolean)*
+
+### staffAccounts
+Array containing ActivityPub IDs of local accounts
+with some form of elevated privilege on the instance.
+
+### suggestions
+JSON object containing info on whether the interaction-based
+Mastodon `/api/v1/suggestions` feature is enabled and optionally
+additional implementation-defined fields with more details
+on e.g. how suggested users are selected.
+
+!!! note
+    This has no relation to the newer /api/v2/suggestions API
+    which also (or exclusively) contains staff-curated entries.
+
+- `enabled` *(boolean)* whether or not user recommendations are enabled
+
+### uploadLimits
+JSON object documenting various upload-related size limits.
+All values are integers and in bytes.
+- `avatar` maximum size of uploaded user avatars
+- `banner` maximum size of uploaded user profile banners
+- `background` maximum size of uploaded user profile backgrounds
+- `general` maximum size for all other kinds of uploads

docs/docs/development/setting_up_akkoma_dev.md

@@ -1,4 +1,4 @@
-# Setting up a Akkoma development environment
+# Setting up an Akkoma development environment
 
 Akkoma requires some adjustments from the defaults for running the instance locally. The following should help you to get started.
 
@@ -9,15 +9,15 @@ Akkoma requires some adjustments from the defaults for running the instance loca
     * You can use your own fork of the repository and add akkoma as a remote `git remote add akkoma 'https://akkoma.dev/AkkomaGang/akkoma.git'`
     * For domain you can use `localhost`
     * For the DB you can still choose a dedicated user. The mix tasks sets it up, so it's no extra work for you
-    * instead of creating a `prod.secret.exs`, create `dev.secret.exs`
+    * Instead of creating a `prod.secret.exs`, create `dev.secret.exs`
     * No need to prefix with `MIX_ENV=prod`. We're using dev and that's the default MIX_ENV
     * You can skip nginx and systemd
     * For front-end, you'll probably want to install and use the develop branch instead of the stable branch. There's no guarantee that the stable branch of the FE will always work on the develop branch of the BE.
 2. Change the dev.secret.exs
     * Change the FE settings to use the installed branch (see also [Frontend Management](/configuration/frontend_management/))
-    * Change the scheme in `config :pleroma, Pleroma.Web.Endpoint` to http (see examples below)
+    * Change the scheme in `config :pleroma, Pleroma.Web.Endpoint` to HTTP (see examples below)
     * If you want to change other settings, you can do that too
-3. You can now start the server with `mix phx.server`. Once it's build and started, you can access the instance on `http://<host>:<port>` (e.g.http://localhost:4000 ) and should be able to do everything locally you normally can.
+3. You can now start the server with `mix phx.server`. Once it's build and started, you can access the instance on `http://<host>:<port>` (e.g. http://localhost:4000 ) and should be able to do everything locally you normally can.
 
 Example on how to install pleroma-fe and admin-fe using it's develop branch
 ```sh
@@ -32,7 +32,7 @@ config :pleroma, :frontends,
   admin: %{"name" => "admin-fe", "ref" => "develop"}
 ```
 
-Example config to change the scheme to http. Change the port if you want to run on another port.
+Example config to change the scheme to HTTP. Change the port if you want to run on another port.
 ```elixir
 config :pleroma, Pleroma.Web.Endpoint,
   url: [host: "localhost", scheme: "http", port: 4000],
@@ -53,7 +53,7 @@ config :logger, :console,
 
 ## Testing with HTTPS
 
-If you end up developing alongside other software like misskey,
+If you end up developing alongside other software like Misskey,
 you will not be able to federate without an SSL certificate. You should
 be able to use the snakeoil certificate that comes standard with most
 distributions or generate one from scratch, then force elixir to accept it.

docs/docs/index.md

@@ -3,9 +3,9 @@
 # Introduction to Akkoma
 ## What is Akkoma?
 Akkoma is a federated social networking platform, compatible with Mastodon and other ActivityPub implementations. It is free software licensed under the AGPLv3.
-It actually consists of two components: a backend, named simply Akkoma, and a user-facing frontend, named Akkoma-FE. It also includes the Mastodon frontend, if that's your thing.
-It's part of what we call the fediverse, a federated network of instances which speak common protocols and can communicate with each other.
-One account on an instance is enough to talk to the entire fediverse!
+It actually consists of two components: a backend, named simply Akkoma, and a user-facing frontend, named akkoma-fe. It also includes the Mastodon frontend, if that's your thing.
+It's part of what we call the Fediverse, a federated network of instances which speak common protocols and can communicate with each other.
+One account on an instance is enough to talk to the entire Fediverse!
 
 ## Community Channels
 
@@ -29,15 +29,14 @@ If you don't feel like joining an existing instance, but instead prefer to deplo
 Installation instructions can be found in the installation section of these docs.
 
 ## I got an account, now what?
-Great! Now you can explore the fediverse! Open the login page for your Akkoma instance (e.g. <https://otp.akkoma.dev>) and login with your username and password. (If you don't have an account yet, click on Register)
+Great! Now you can explore the Fediverse! Open the login page for your Akkoma instance (e.g. <https://otp.akkoma.dev>) and login with your username and password. (If you don't have an account yet, click on Register)
 
-### Akkoma-FE
-The default front-end used by Akkoma is Akkoma-FE. You can find more information on what it is and how to use it in the [Introduction to Akkoma-FE](https://docs-fe.akkoma.dev/stable/).
+### akkoma-fe
+The default front-end used by Akkoma is akkoma-fe. You can find more information on what it is and how to use it in the [Introduction to akkoma-fe](https://docs-fe.akkoma.dev/stable/).
 
 ### Mastodon interface
-If the Akkoma-FE interface isn't your thing, or you're just trying something new but you want to keep using the familiar Mastodon interface, we got that too!
-Just add a "/web" after your instance url (e.g. <https://otp.akkoma.dev/web>) and you'll end on the Mastodon web interface, but with a Akkoma backend! MAGIC!
+If the akkoma-fe interface isn't your thing, or you're just trying something new but you want to keep using the familiar Mastodon interface, we got that too!
+Just add a "/web" after your instance URL (e.g. <https://otp.akkoma.dev/web>) and you'll end on the Mastodon web interface, but with a Akkoma backend! MAGIC!
 The Mastodon interface is from the Glitch-soc fork. For more information on the Mastodon interface you can check the [Mastodon](https://docs.joinmastodon.org/) and [Glitch-soc](https://glitch-soc.github.io/docs/) documentation.
 
 Remember, what you see is only the frontend part of Mastodon, the backend is still Akkoma.
-

docs/docs/installation/alpine_linux_en.md

@@ -137,7 +137,7 @@ doas -u akkoma env MIX_ENV=prod mix phx.server
 
 If you want to open your newly installed instance to the world, you should run nginx or some other webserver/proxy in front of Akkoma and you should consider to create an OpenRC service file for Akkoma.
 
-#### Nginx
+#### nginx
 
 * Install nginx, if not already done:
 
@@ -145,47 +145,13 @@ If you want to open your newly installed instance to the world, you should run n
 doas apk add nginx
 ```
 
-* Setup your SSL cert, using your method of choice or certbot. If using certbot, first install it:
-
-```shell
-doas apk add certbot
-```
-
-and then set it up:
-
-```shell
-doas mkdir -p /var/lib/letsencrypt/
-doas certbot certonly --email <your@emailaddress> -d <yourdomain> --standalone
-```
-
-If that doesn’t work, make sure, that nginx is not already running. If it still doesn’t work, try setting up nginx first (change ssl “on” to “off” and try again).
-
 * Copy the example nginx configuration to the nginx folder
 
 ```shell
 doas cp /opt/akkoma/installation/nginx/akkoma.nginx /etc/nginx/conf.d/akkoma.conf
 ```
 
-* Before starting nginx edit the configuration and change it to your needs. You must change change `server_name` and the paths to the certificates. You can use `nano` (install with `apk add nano` if missing).
-
-```
-server {
-    server_name    your.domain;
-    listen         80;
-    ...
-}
-
-server {
-    server_name your.domain;
-    listen 443 ssl http2;
-    ...
-    ssl_trusted_certificate   /etc/letsencrypt/live/your.domain/chain.pem;
-    ssl_certificate           /etc/letsencrypt/live/your.domain/fullchain.pem;
-    ssl_certificate_key       /etc/letsencrypt/live/your.domain/privkey.pem;
-    ...
-}
-```
-
+* Before starting nginx edit the configuration and change it to your needs. You must change change `server_name`. You can use `nano` (install with `apk add nano` if missing).
 * Enable and start nginx:
 
 ```shell
@@ -193,10 +159,37 @@ doas rc-update add nginx
 doas rc-service nginx start
 ```
 
-If you need to renew the certificate in the future, uncomment the relevant location block in the nginx config and run:
+* Setup your SSL cert, using your method of choice or certbot. If using certbot, first install it:
 
 ```shell
-doas certbot certonly --email <your@emailaddress> -d <yourdomain> --webroot -w /var/lib/letsencrypt/
+doas apk add certbot certbot-nginx
+```
+
+and then set it up:
+
+```shell
+doas mkdir -p /var/lib/letsencrypt/
+doas certbot --email <your@emailaddress> -d <yourdomain> -d <media_domain> --nginx
+```
+
+If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. A common source of problems are nginx config syntax errors; this can be checked for by running `nginx -t`.
+
+To automatically renew, set up a cron job like so:
+
+```shell
+# Enable the crond service
+doas rc-update add crond
+doas rc-service crond start
+
+# Test that renewals work
+doas certbot renew --cert-name yourinstance.tld --nginx --dry-run
+
+# Add the renewal task to cron
+echo '#!/bin/sh
+certbot renew --cert-name yourinstance.tld --nginx
+' | doas tee /etc/periodic/daily/renew-akkoma-cert
+doas chmod +x /etc/periodic/daily/renew-akkoma-cert
+
 ```
 
 #### OpenRC service

docs/docs/installation/arch_linux_en.md

@@ -10,6 +10,7 @@ This guide will assume that you have administrative rights, either as root or a
 
 * `postgresql`
 * `elixir`
+* `erlang-headless` or `erlang`
 * `git`
 * `base-devel`
 * `cmake`
@@ -19,7 +20,7 @@ This guide will assume that you have administrative rights, either as root or a
 
 * `nginx` (preferred, example configs for other reverse proxies can be found in the repo)
 * `certbot` (or any other ACME client for Let’s Encrypt certificates)
-* `ImageMagick`
+* `imagemagick`
 * `ffmpeg`
 * `exiftool`
 
@@ -35,6 +36,7 @@ sudo pacman -Syu
 
 ```shell
 sudo pacman -S git base-devel elixir cmake file
+sudo pacman -S --asdeps erlang-headless
 ```
 
 ### Install PostgreSQL
@@ -128,7 +130,7 @@ sudo -Hu akkoma MIX_ENV=prod mix phx.server
 
 If you want to open your newly installed instance to the world, you should run nginx or some other webserver/proxy in front of Akkoma and you should consider to create a systemd service file for Akkoma.
 
-#### Nginx
+#### nginx
 
 * Install nginx, if not already done:
 
@@ -136,16 +138,17 @@ If you want to open your newly installed instance to the world, you should run n
 sudo pacman -S nginx
 ```
 
-* Create directories for available and enabled sites:
+* Copy the example nginx configuration:
 
 ```shell
-sudo mkdir -p /etc/nginx/sites-{available,enabled}
+sudo cp /opt/akkoma/installation/nginx/akkoma.nginx /etc/nginx/conf.d/akkoma.conf
 ```
 
-* Append the following line at the end of the `http` block in `/etc/nginx/nginx.conf`:
+* Before starting nginx edit the configuration and change it to your needs (e.g. change servername, change cert paths)
+* Enable and start nginx:
 
-```Nginx
-include sites-enabled/*;
+```shell
+sudo systemctl enable --now nginx.service
 ```
 
 * Setup your SSL cert, using your method of choice or certbot. If using certbot, first install it:
@@ -158,32 +161,18 @@ and then set it up:
 
 ```shell
 sudo mkdir -p /var/lib/letsencrypt/
-sudo certbot certonly --email <your@emailaddress> -d <yourdomain> --standalone
+sudo certbot --email <your@emailaddress> -d <yourdomain> -d <media_domain> --nginx
 ```
 
-If that doesn’t work, make sure, that nginx is not already running. If it still doesn’t work, try setting up nginx first (change ssl “on” to “off” and try again).
+If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. A common source of problems are nginx config syntax errors; this can be checked for by running `nginx -t`.
 
----
-
-* Copy the example nginx configuration and activate it:
+To make sure renewals work, enable the appropriate systemd timer:
 
 ```shell
-sudo cp /opt/akkoma/installation/nginx/akkoma.nginx /etc/nginx/sites-available/akkoma.nginx
-sudo ln -s /etc/nginx/sites-available/akkoma.nginx /etc/nginx/sites-enabled/akkoma.nginx
+sudo systemctl enable --now certbot-renew.timer
 ```
 
-* Before starting nginx edit the configuration and change it to your needs (e.g. change servername, change cert paths)
-* Enable and start nginx:
-
-```shell
-sudo systemctl enable --now nginx.service
-```
-
-If you need to renew the certificate in the future, uncomment the relevant location block in the nginx config and run:
-
-```shell
-sudo certbot certonly --email <your@emailaddress> -d <yourdomain> --webroot -w /var/lib/letsencrypt/
-```
+Certificate renewal should be handled automatically by Certbot from now on.
 
 #### Other webserver/proxies
 

docs/docs/installation/debian_based_en.md

@@ -35,32 +35,29 @@ sudo useradd -r -s /bin/false -m -d /var/lib/akkoma -U akkoma
 
 ### Install Elixir and Erlang
 
+#### Using `apt`
 If your distribution packages a recent enough version of Elixir, you can install it directly from the distro repositories and skip to the next section of the guide:
 
 ```shell
 sudo apt install elixir erlang-dev erlang-nox
 ```
 
-Otherwise use [asdf](https://github.com/asdf-vm/asdf) to install the latest versions of Elixir and Erlang.
+#### Using `asdf`
+If your distribution does not have a recent version of Elxir in their repositories, you can use [asdf](https://asdf-vm.com/) to install a newer version of Elixir and Erlang.
 
 First, install some dependencies needed to build Elixir and Erlang:
 ```shell
 sudo apt install curl unzip build-essential autoconf m4 libncurses5-dev libssh-dev unixodbc-dev xsltproc libxml2-utils libncurses-dev
 ```
 
-Then login to the `akkoma` user and install asdf:
+Second, make sure that erlang and elixir (via asdf) is reachable from `sudo -Hu akkoma`:
 ```shell
-git clone https://github.com/asdf-vm/asdf.git ~/.asdf --branch v0.11.3
+echo 'Defaults>akkoma secure_path="/var/lib/akkoma/.asdf/shims:/sbin:/bin:/usr/sbin:/usr/bin"' > /etc/sudoers.d/custom_path
 ```
 
-Add the following lines to `~/.bashrc`:
-```shell
-. "$HOME/.asdf/asdf.sh"
-# asdf completions
-. "$HOME/.asdf/completions/asdf.bash"
-```
+Then login to the `akkoma` user.
 
-Restart the shell:
+Install asdf by following steps 1 to 3 on [their website](https://asdf-vm.com/guide/getting-started.html), then restart the shell to load asdf:
 ```shell
 exec $SHELL
 ```
@@ -69,15 +66,15 @@ Next install Erlang:
 ```shell
 asdf plugin add erlang https://github.com/asdf-vm/asdf-erlang.git
 export KERL_CONFIGURE_OPTIONS="--disable-debug --without-javac"
-asdf install erlang 25.3.2.5
-asdf global erlang 25.3.2.5
+asdf install erlang 27.2.4
+asdf set erlang 27.2.4
 ```
 
 Now install Elixir:
 ```shell
-asdf plugin-add elixir https://github.com/asdf-vm/asdf-elixir.git
-asdf install elixir 1.15.4-otp-25
-asdf global elixir 1.15.4-otp-25
+asdf plugin add elixir https://github.com/asdf-vm/asdf-elixir.git
+asdf install elixir 1.18.2-otp-27
+asdf set elixir 1.18.2-otp-27
 ```
 
 Confirm that Elixir is installed correctly by checking the version:
@@ -147,7 +144,7 @@ sudo -Hu akkoma MIX_ENV=prod mix phx.server
 
 If you want to open your newly installed instance to the world, you should run nginx or some other webserver/proxy in front of Akkoma and you should consider to create a systemd service file for Akkoma.
 
-#### Nginx
+#### nginx
 
 * Install nginx, if not already done:
 
@@ -155,23 +152,6 @@ If you want to open your newly installed instance to the world, you should run n
 sudo apt install nginx
 ```
 
-* Setup your SSL cert, using your method of choice or certbot. If using certbot, first install it:
-
-```shell
-sudo apt install certbot
-```
-
-and then set it up:
-
-```shell
-sudo mkdir -p /var/lib/letsencrypt/
-sudo certbot certonly --email <your@emailaddress> -d <yourdomain> --standalone
-```
-
-If that doesn’t work, make sure, that nginx is not already running. If it still doesn’t work, try setting up nginx first (change ssl “on” to “off” and try again).
-
----
-
 * Copy the example nginx configuration and activate it:
 
 ```shell
@@ -186,12 +166,23 @@ sudo ln -s /etc/nginx/sites-available/akkoma.nginx /etc/nginx/sites-enabled/akko
 sudo systemctl enable --now nginx.service
 ```
 
-If you need to renew the certificate in the future, uncomment the relevant location block in the nginx config and run:
+* Setup your SSL cert, using your method of choice or certbot. If using certbot, first install it:
 
 ```shell
-sudo certbot certonly --email <your@emailaddress> -d <yourdomain> --webroot -w /var/lib/letsencrypt/
+sudo apt install certbot python3-certbot-nginx
 ```
 
+and then set it up:
+
+```shell
+sudo mkdir -p /var/lib/letsencrypt/
+sudo certbot --email <your@emailaddress> -d <yourdomain> -d <media_domain> --nginx
+```
+
+If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. A common source of problems are nginx config syntax errors; this can be checked for by running `nginx -t`.
+
+Certificate renewal should be handled automatically by Certbot from now on.
+
 #### Other webserver/proxies
 
 You can find example configurations for them in `/opt/akkoma/installation/`.

docs/docs/installation/docker_en.md

@@ -113,7 +113,7 @@ This is a tad more complex in docker than on the host itself. It
 
 You've got two options. 
 
-#### Running caddy in a container
+#### Running Caddy in a container
 
 This is by far the easiest option. It'll handle HTTPS and all that for you. 
 
@@ -125,7 +125,26 @@ cp docker-resources/Caddyfile.example docker-resources/Caddyfile
 
 Then edit the TLD in your caddyfile to the domain you're serving on.
 
-Uncomment the `caddy` section in the docker compose file,
+Copy the commented out `caddy` section in `docker-compose.yml` into a new file called `docker-compose.override.yml` like so:
+```yaml
+version: "3.7"
+
+services:
+  proxy:
+    image: caddy:2-alpine
+    restart: unless-stopped
+    links:
+      - akkoma
+    ports: [
+       "443:443",
+       "80:80"
+    ]
+    volumes:
+      - ./docker-resources/Caddyfile:/etc/caddy/Caddyfile
+      - ./caddy-data:/data
+      - ./caddy-config:/config
+```
+
 then run `docker compose up -d` again.
 
 #### Running a reverse proxy on the host
@@ -155,6 +174,12 @@ git pull
 docker compose restart akkoma db
 ```
 
+### Modifying the Docker services
+If you want to modify the services defined in the docker compose file, you can
+create a new file called `docker-compose.override.yml`. There you can add any
+overrides or additional services without worrying about git conflicts when a
+new release comes out.
+
 #### Further reading
 
 {! installation/further_reading.include !}

docs/docs/installation/fedora_based_en.md

@@ -127,7 +127,7 @@ sudo -Hu akkoma MIX_ENV=prod mix phx.server
 
 If you want to open your newly installed instance to the world, you should run nginx or some other webserver/proxy in front of Akkoma and you should consider to create a systemd service file for Akkoma.
 
-#### Nginx
+#### nginx
 
 * Install nginx, if not already done:
 
@@ -135,23 +135,6 @@ If you want to open your newly installed instance to the world, you should run n
 sudo dnf install nginx
 ```
 
-* Setup your SSL cert, using your method of choice or certbot. If using certbot, first install it:
-
-```shell
-sudo dnf install certbot
-```
-
-and then set it up:
-
-```shell
-sudo mkdir -p /var/lib/letsencrypt/
-sudo certbot certonly --email <your@emailaddress> -d <yourdomain> --standalone
-```
-
-If that doesn’t work, make sure, that nginx is not already running. If it still doesn’t work, try setting up nginx first (change ssl “on” to “off” and try again).
-
----
-
 * Copy the example nginx configuration and activate it:
 
 ```shell
@@ -165,12 +148,23 @@ sudo cp /opt/akkoma/installation/nginx/akkoma.nginx /etc/nginx/conf.d/akkoma.con
 sudo systemctl enable --now nginx.service
 ```
 
-If you need to renew the certificate in the future, uncomment the relevant location block in the nginx config and run:
+* Setup your SSL cert, using your method of choice or certbot. If using certbot, first install it:
 
 ```shell
-sudo certbot certonly --email <your@emailaddress> -d <yourdomain> --webroot -w /var/lib/letsencrypt/
+sudo dnf install certbot python3-certbot-nginx
 ```
 
+and then set it up:
+
+```shell
+sudo certbot --email <your@emailaddress> -d <yourdomain> -d <media_domain> --nginx
+```
+
+If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. A common source of problems are nginx config syntax errors; this can be checked for by running `nginx -t`.
+
+Certificate renewal should be handled automatically by Certbot from now on.
+
+
 #### Other webserver/proxies
 
 You can find example configurations for them in `/opt/akkoma/installation/`.

docs/docs/installation/frontends.include

@@ -6,7 +6,9 @@ probably install frontends.
 These are no longer bundled with the distribution and need an extra
 command to install.
 
-For most installations, the following will suffice:
+You **must** run frontend management tasks as the akkoma user,
+the same way you downloaded the build or cloned the git repo before.
+But otherwise, for most installations, the following will suffice:
 
 === "OTP" 
     ```sh
@@ -28,4 +30,3 @@ For most installations, the following will suffice:
     ```
 
 For more customised installations, refer to [Frontend Management](../../configuration/frontend_management)
-

docs/docs/installation/generic_dependencies.include

@@ -1,8 +1,8 @@
 ## Required dependencies
 
-* PostgreSQL 9.6+
-* Elixir 1.14+
-* Erlang OTP 25+
+* PostgreSQL 12+
+* Elixir 1.14.1+ (currently tested up to 1.18)
+* Erlang OTP 25+ (currently tested up to OTP27)
 * git
 * file / libmagic
 * gcc (clang might also work)

docs/docs/installation/gentoo_en.md

@@ -181,7 +181,7 @@ It probably won't work over the public internet quite yet, however, as we still
 
 Assuming you want to open your newly installed federated social network to, well, the federation, you should run nginx or some other webserver/proxy in front of Akkoma. It is also a good idea to set up Akkoma to run as a system service.
 
-#### Nginx
+#### nginx
 
 * Install nginx, if not already done:
 
@@ -197,29 +197,10 @@ Assuming you want to open your newly installed federated social network to, well
 
 * Append the following line at the end of the `http` block in `/etc/nginx/nginx.conf`:
 
-```Nginx
+```nginx
 include sites-enabled/*;
 ```
 
-* Setup your SSL cert, using your method of choice or certbot. If using certbot, install it if you haven't already:
-
-```shell
- # emerge --ask app-crypt/certbot app-crypt/certbot-nginx
-```
-
-and then set it up:
-
-```shell
- # mkdir -p /var/lib/letsencrypt/
- # certbot certonly --email <your@emailaddress> -d <yourdomain> --standalone
-```
-
-If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. If that doesn’t work, make sure, that nginx is not already running. If it still doesn’t work, try setting up nginx first (change ssl “on” to “off” and try again). Often the answer to issues with certbot is to use the `--nginx` flag once you have nginx up and running.
-
-If you are using any additional subdomains, such as for a media proxy, you can re-run the same command with the subdomain in question. When it comes time to renew later, you will not need to run multiple times for each domain, one renew will handle it.
-
----
-
 * Copy the example nginx configuration and activate it:
 
 ```shell
@@ -237,9 +218,24 @@ Pay special attention to the line that begins with `ssl_ecdh_curve`. It is stong
 
 ```shell
  # rc-update add nginx default
- # /etc/init.d/nginx start
+ # rc-service nginx start
 ```
 
+* Setup your SSL cert, using your method of choice or certbot. If using certbot, install it if you haven't already:
+
+```shell
+ # emerge --ask app-crypt/certbot app-crypt/certbot-nginx
+```
+
+and then set it up:
+
+```shell
+ # mkdir -p /var/lib/letsencrypt/
+ # certbot --email <your@emailaddress> -d <yourdomain> -d <media_domain> --nginx
+```
+
+If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. A common source of problems are nginx config syntax errors; this can be checked for by running `nginx -t`.
+
 If you are using certbot, it is HIGHLY recommend you set up a cron job that renews your certificate, and that you install the suggested `certbot-nginx` plugin. If you don't do these things, you only have yourself to blame when your instance breaks suddenly because you forgot about it.
 
 First, ensure that the command you will be installing into your crontab works.

docs/docs/installation/migrating_to_akkoma.md

@@ -21,6 +21,33 @@ fork of Akkoma - luckily this isn't very hard.
 You'll need to update the backend, then possibly the frontend, depending
 on your setup.
 
+## Backup diverging features
+
+As time goes on Akkoma and Pleroma added or removed different features
+and reorganised the database in a different way. If you want to be able to
+migrate back to Pleroma without losing any affected data, you’ll want to
+make a backup before starting the migration.  
+If you're not interested in migrating back, skip this section
+*(although it might be a good idea to temporarily keep a full DB backup
+just in case something unexpected happens during migration)*
+
+As of 2024-02 you will want to keep a backup of:
+
+- the entire `chats` and `chat_message_references` tables
+
+The following columns are not deleted by a migration to Akkoma, but a migration
+back to Pleroma or future Akkoma upgrades might affect them, so perhaps back them up as well:
+
+- the `birthday` of users and their `show_birthday` setting
+- the `expires_at` key of in the `user_relationships` table
+    *(used by temporary mutes)*
+
+The way cached instance metadata is stored differs, but since those
+will be refetched and updated anyway, there’s no need for a backup.
+
+Best check all newer migrations unique to Akkoma/Pleroma
+to get an up-to-date picture of what needs to be kept.
+
 ## From Source
 
 If you're running the source Akkoma install, you'll need to set the
@@ -34,16 +61,7 @@ git pull -r
 # to run "git merge stable" instead (or develop if you want)
 ```
 
-### WARNING - Migrating from Pleroma Develop
-If you are on pleroma develop, and have updated since 2022-08, you may have issues with database migrations.
-
-Please roll back the given migrations:
-
-```bash
-MIX_ENV=prod mix ecto.rollback --migrations-path priv/repo/optional_migrations/pleroma_develop_rollbacks -n5
-```
-
-Then compile, migrate and restart as usual.
+And compile as usual.
 
 ## From OTP
 
@@ -53,15 +71,44 @@ This will just be setting the update URL - find your flavour from the [mapping o
 export FLAVOUR=[the flavour you found above]
 
 ./bin/pleroma_ctl update --zip-url https://akkoma-updates.s3-website.fr-par.scw.cloud/stable/akkoma-$FLAVOUR.zip
-./bin/pleroma_ctl migrate
 ```
 
-Then restart. When updating in the future, you canjust use
+When updating in the future, you can just use
 
 ```bash
 ./bin/pleroma_ctl update --branch stable
 ```
 
+
+## Database Migrations
+### WARNING - Migrating from Pleroma past 2022-08
+If you are on Pleroma stable >= 2.5.0 or Pleroma develop, and
+have updated since 2022-08, you may have issues with database migrations.
+
+Please first roll back the given migrations:
+
+=== "OTP"
+    ```bash
+    ./bin/pleroma_ctl rollback --migrations-path priv/repo/optional_migrations/pleroma_develop_rollbacks -n5
+    ```
+=== "From Source"
+    ```bash
+    MIX_ENV=prod mix ecto.rollback --migrations-path priv/repo/optional_migrations/pleroma_develop_rollbacks -n5
+    ```
+
+### Applying Akkoma Database Migrations
+
+Just run
+
+=== "OTP"
+    ```bash
+    ./bin/pleroma_ctl migrate
+    ```
+=== "From Source"
+    ```bash
+    MIX_ENV=prod mix ecto.migrate
+    ```
+
 ## Frontend changes
 
 Akkoma comes with a few frontend changes as well as backend ones,
@@ -130,3 +177,4 @@ MIX_ENV=prod mix ecto.rollback --to 20210416051708
 ```
 
 Then switch back to Pleroma for updates (similar to how was done to migrate to Akkoma), and remove the front-ends. The front-ends are installed in the `frontends` folder in the [static directory](../configuration/static_dir.md). Once you are back to Pleroma, you will need to run the database migrations again. See the Pleroma documentation for this.
+After this use your previous backups to restore data from diverging features.

docs/docs/installation/openbsd_en.md

@@ -16,7 +16,7 @@ pkg_add elixir gmake git postgresql-server postgresql-contrib cmake ffmpeg erlan
 pkg_add erlang-wx # Choose the latest version as package version when promted
 ```
 
-Akkoma requires a reverse proxy, OpenBSD has relayd in base (and is used in this guide) and packages/ports are available for nginx (www/nginx) and apache (www/apache-httpd). Independently of the reverse proxy, [acme-client(1)](https://man.openbsd.org/acme-client) can be used to get a certificate from Let's Encrypt.
+Akkoma requires a reverse proxy, OpenBSD has relayd in base (and is used in this guide) and packages/ports are available for nginx (www/nginx) and Apache (www/apache-httpd). Independently of the reverse proxy, [acme-client(1)](https://man.openbsd.org/acme-client) can be used to get a certificate from Let's Encrypt.
 
 #### Optional software
 

docs/docs/installation/optional/media_graphics_packages.md

@@ -1,32 +1,33 @@
 # Optional software packages needed for specific functionality
 
-For specific Akkoma functionality (which is disabled by default) some or all of the below packages are required:
-  * `ImageMagick`
-  * `ffmpeg`
-  * `exiftool`
+For specific Akkoma functionality (which is disabled by default) some or all of the below projects are required:
+  * ImageMagick
+  * ffmpeg
+  * ExifTool
   
 Please refer to documentation in `docs/installation` on how to install them on specific OS.
   
 Note: the packages are not required with the current default settings of Akkoma.
 
-## `ImageMagick`
+## ImageMagick
 
-`ImageMagick` is a set of tools to create, edit, compose, or convert bitmap images.
+ImageMagick provides a set of tools to create, edit, compose, or convert bitmap images.
 
 It is required for the following Akkoma features:
-  * `Pleroma.Upload.Filters.Mogrify`, `Pleroma.Upload.Filters.Mogrifun` upload filters (related config: `Plaroma.Upload/filters` in `config/config.exs`)
+  * `Pleroma.Upload.Filters.Mogrify`, `Pleroma.Upload.Filters.Mogrifun` upload filters (related config: `Pleroma.Upload/filters` in `config/config.exs`)
   * Media preview proxy for still images (related config: `media_preview_proxy/enabled` in `config/config.exs`)
   
-## `ffmpeg`
+## ffmpeg
 
 `ffmpeg` is software to record, convert and stream audio and video.
 
 It is required for the following Akkoma features:
   * Media preview proxy for videos (related config: `media_preview_proxy/enabled` in `config/config.exs`)
 
-## `exiftool`
+## ExifTool
 
 `exiftool` is media files metadata reader/writer.
 
 It is required for the following Akkoma features:
-  * `Pleroma.Upload.Filters.Exiftool` upload filter (related config: `Plaroma.Upload/filters` in `config/config.exs`)
+  * `Pleroma.Upload.Filters.Exiftool.StripMetadata` upload filter (related config: `Pleroma.Upload/filters` in `config/config.exs`)
+  * `Pleroma.Upload.Filters.Exiftool.ReadDescription` upload filter (related config: `Pleroma.Upload/filters` in `config/config.exs`)

docs/docs/installation/otp_en.md

@@ -9,7 +9,7 @@ This guide covers a installation using an OTP release. To install Akkoma from so
 * For installing OTP releases on RedHat-based distros like Fedora and Centos Stream, please follow [this guide](./otp_redhat_en.md) instead.
 * A (sub)domain pointed to the machine
 
-You will be running commands as root. If you aren't root already, please elevate your priviledges by executing `sudo su`/`su`.
+You will be running commands as root. If you aren't root already, please elevate your priviledges by executing `sudo -i`/`su`.
 
 While in theory OTP releases are possbile to install on any compatible machine, for the sake of simplicity this guide focuses only on Debian/Ubuntu and Alpine.
 
@@ -58,7 +58,7 @@ Other than things bundled in the OTP release Akkoma depends on:
 Per [`docs/installation/optional/media_graphics_packages.md`](optional/media_graphics_packages.md):
   * ImageMagick
   * ffmpeg
-  * exiftool
+  * ExifTool
 
 === "Alpine"
     ```
@@ -176,11 +176,6 @@ su akkoma -s $SHELL -lc "./bin/pleroma stop"
 
 ### Setting up nginx and getting Let's Encrypt SSL certificaties
 
-#### Get a Let's Encrypt certificate
-```sh
-certbot certonly --standalone --preferred-challenges http -d yourinstance.tld
-```
-
 #### Copy Akkoma nginx configuration to the nginx folder
 
 The location of nginx configs is dependent on the distro
@@ -209,6 +204,14 @@ $EDITOR path-to-nginx-config
 # Verify that the config is valid
 nginx -t
 ```
+
+#### Get a Let's Encrypt certificate
+```sh
+certbot --nginx -d yourinstance.tld -d media.yourinstance.tld
+```
+
+If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. A common source of problems are nginx config syntax errors; this can be checked for by running `nginx -t`.
+
 #### Start nginx
 
 === "Alpine"
@@ -245,39 +248,26 @@ At this point if you open your (sub)domain in a browser you should see a 502 err
     systemctl enable akkoma
     ```
 
-If everything worked, you should see Akkoma-FE when visiting your domain. If that didn't happen, try reviewing the installation steps, starting Akkoma in the foreground and seeing if there are any errrors.
+If everything worked, you should see akkoma-fe when visiting your domain. If that didn't happen, try reviewing the installation steps, starting Akkoma in the foreground and seeing if there are any errrors.
 
 {! support.include !}
 
 ## Post installation
 
 ### Setting up auto-renew of the Let's Encrypt certificate
-```sh
-# Create the directory for webroot challenges
-mkdir -p /var/lib/letsencrypt
-
-# Uncomment the webroot method
-$EDITOR path-to-nginx-config
-
-# Verify that the config is valid
-nginx -t
-```
 
 === "Alpine"
     ```
-    # Restart nginx
-    rc-service nginx restart
-
     # Start the cron daemon and make it start on boot
     rc-service crond start
     rc-update add crond
 
     # Ensure the webroot menthod and post hook is working
-    certbot renew --cert-name yourinstance.tld --webroot -w /var/lib/letsencrypt/ --dry-run --post-hook 'rc-service nginx reload'
+    certbot renew --cert-name yourinstance.tld --nginx --dry-run
 
     # Add it to the daily cron
     echo '#!/bin/sh
-    certbot renew --cert-name yourinstance.tld --webroot -w /var/lib/letsencrypt/ --post-hook "rc-service nginx reload"
+    certbot renew --cert-name yourinstance.tld --nginx
     ' > /etc/periodic/daily/renew-akkoma-cert
     chmod +x /etc/periodic/daily/renew-akkoma-cert
 
@@ -286,22 +276,7 @@ nginx -t
     ```
 
 === "Debian/Ubuntu"
-    ```
-    # Restart nginx
-    systemctl restart nginx
-
-    # Ensure the webroot menthod and post hook is working
-    certbot renew --cert-name yourinstance.tld --webroot -w /var/lib/letsencrypt/ --dry-run --post-hook 'systemctl reload nginx'
-
-    # Add it to the daily cron
-    echo '#!/bin/sh
-    certbot renew --cert-name yourinstance.tld --webroot -w /var/lib/letsencrypt/ --post-hook "systemctl reload nginx"
-    ' > /etc/cron.daily/renew-akkoma-cert
-    chmod +x /etc/cron.daily/renew-akkoma-cert
-
-    # If everything worked the output should contain /etc/cron.daily/renew-akkoma-cert
-    run-parts --test /etc/cron.daily
-    ```
+    This should be automatically enabled with the `certbot-renew.timer` systemd unit.
 
 ## Create your first user and set as admin
 ```sh

docs/docs/installation/otp_redhat_en.md

@@ -82,6 +82,7 @@ Other than things bundled in the OTP release Akkoma depends on:
 * PostgreSQL (also utilizes extensions in postgresql-contrib)
 * nginx (could be swapped with another reverse proxy but this guide covers only it)
 * certbot (for Let's Encrypt certificates, could be swapped with another ACME client, but this guide covers only it)
+    * If you are using certbot, also install the `python3-certbot-nginx` package for the nginx plugin
 * libmagic/file
 
 First, update your system, if not already done:
@@ -169,12 +170,6 @@ sudo -Hu akkoma ./bin/pleroma stop
 
 ### Setting up nginx and getting Let's Encrypt SSL certificaties
 
-#### Get a Let's Encrypt certificate
-
-```shell
-certbot certonly --standalone --preferred-challenges http -d yourinstance.tld
-```
-
 #### Copy Akkoma nginx configuration to the nginx folder
 
 ```shell
@@ -195,8 +190,15 @@ sudo nginx -t
 sudo systemctl start nginx
 ```
 
-At this point if you open your (sub)domain in a browser you should see a 502 error, that's because Akkoma is not started yet.
+#### Get a Let's Encrypt certificate
 
+```shell
+sudo certbot --email <your@emailaddress> -d <yourdomain> -d <media_domain> --nginx
+```
+
+If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. A common source of problems are nginx config syntax errors; this can be checked for by running `nginx -t`.
+
+If you're successful with obtaining the certificates, opening your (sub)domain in a browser will result in a 502 error, since Akkoma hasn't been started yet.
 
 ### Setting up a system service
 
@@ -216,7 +218,7 @@ sudo systemctl start akkoma
 sudo systemctl enable akkoma
 ```
 
-If everything worked, you should see a response from Akkoma-BE when visiting your domain. You may need to install frontends like Akkoma-FE and Admin-FE; refer to [this guide](../administration/CLI_tasks/frontend.md) on how to install them.
+If everything worked, you should see a response from Akkoma-BE when visiting your domain. You may need to install frontends like akkoma-fe and admin-fe; refer to [this guide](../administration/CLI_tasks/frontend.md) on how to install them.
 
 If that didn't happen, try reviewing the installation steps, starting Akkoma in the foreground and seeing if there are any errrors.
 
@@ -239,19 +241,11 @@ sudo nginx -t
 # Restart nginx
 sudo systemctl restart nginx
 
-# Ensure the webroot menthod and post hook is working
-sudo certbot renew --cert-name yourinstance.tld --webroot -w /var/lib/letsencrypt/ --dry-run --post-hook 'systemctl reload nginx'
-
-# Add it to the daily cron
-echo '#!/bin/sh
-certbot renew --cert-name yourinstance.tld --webroot -w /var/lib/letsencrypt/ --post-hook "systemctl reload nginx"
-' > /etc/cron.daily/renew-akkoma-cert
-sudo chmod +x /etc/cron.daily/renew-akkoma-cert
-
-# If everything worked the output should contain /etc/cron.daily/renew-akkoma-cert
-sudo run-parts --test /etc/cron.daily
+# Test that renewals work properly
+sudo certbot renew --cert-name yourinstance.tld --nginx --dry-run
 ```
 
+Assuming the commands were run successfully, certbot should be able to renew your certificates automatically via the `certbot-renew.timer` systemd unit.
 
 ## Create your first user and set as admin
 ```shell

docs/docs/installation/yunohost_en.md

@@ -1,9 +0,0 @@
-# Installing on Yunohost
-
-[YunoHost](https://yunohost.org) is a server operating system aimed at self-hosting. The YunoHost community maintains a package of Akkoma which allows you to install Akkoma on YunoHost. You can install it via the normal way through the admin web interface, or through the CLI. More information can be found at [the repo of the package](https://github.com/YunoHost-Apps/akkoma_ynh).
-
-## Questions
-
-Questions and problems related to the YunoHost parts can be done through the [YunoHost channels](https://yunohost.org/en/help).
-
-For questions about Akkoma, check out the [Akkoma community channels](../../#community-channels).

docs/docs/support.include

@@ -1,5 +1,5 @@
 ## Support
 
-If you encounter any issues or have questions regarding the install process, feel free to ask at [meta.akkoma.dev](https://meta.akkoma.dev/).
+If you encounter any issues or have questions regarding the installation process, feel free to ask at [meta.akkoma.dev](https://meta.akkoma.dev/).
 
 Or message via IRC on #akkoma at irc.akkoma.dev (port 6697, SSL)

elixir_buildpack.config

@@ -1,2 +0,0 @@
-elixir_version=1.14.3
-erlang_version=25.3

installation/akkoma.service

@@ -19,6 +19,9 @@ Environment="MIX_ENV=prod"
 ; Don't listen epmd on 0.0.0.0
 Environment="ERL_EPMD_ADDRESS=127.0.0.1"
 
+; Don't busy wait
+Environment="ERL_AFLAGS=+sbwt none +sbwtdcpu none +sbwtdio none"
+
 ; Make sure that all paths fit your installation.
 ; Path to the home directory of the user running the Akkoma service.
 Environment="HOME=/var/lib/akkoma"

installation/apache/akkoma-apache.conf

@@ -60,7 +60,7 @@ ServerTokens Prod
     Include /etc/letsencrypt/options-ssl-apache.conf
 
     # Uncomment the following to enable MediaProxy caching on disk
-    #CacheRoot /tmp/akkoma-media-cache/
+    #CacheRoot /var/tmp/akkoma-media-cache/
     #CacheDirLevels 1
     #CacheDirLength 2
     #CacheEnable disk /proxy

installation/apache/apache-cache-purge.sh.example

@@ -16,7 +16,7 @@
 SCRIPTNAME=${0##*/}
 
 # mod_disk_cache directory
-CACHE_DIRECTORY="/tmp/akkoma-media-cache"
+CACHE_DIRECTORY="/var/tmp/akkoma-media-cache"
 
 ## Removes an item via the htcacheclean utility
 ## $1 - the filename, can be a pattern .

installation/caddy/Caddyfile

@@ -12,26 +12,22 @@ example.tld  {
     output file /var/log/caddy/akkoma.log
   }
 
-  encode gzip
-
   # this is explicitly IPv4 since Pleroma.Web.Endpoint binds on IPv4 only
   # and `localhost.` resolves to [::0] on some systems: see issue #930
   reverse_proxy 127.0.0.1:4000
 
-  # Uncomment if using a separate media subdomain
-  #@mediaproxy path /media/* /proxy/*
-  #handle @mediaproxy {
-  #  redir https://media.example.tld{uri} permanent
-  #}
+  @mediaproxy path /media/* /proxy/*
+  handle @mediaproxy {
+    redir https://media.example.tld{uri} permanent
+  }
 }
 
-# Uncomment if using a separate media subdomain
-#media.example.tld {
-#  @mediaproxy path /media/* /proxy/*
-#  reverse_proxy @mediaproxy 127.0.0.1:4000 {
-#    transport http {
-#      response_header_timeout 10s
-#      read_timeout 15s
-#    }
-#  }
-#}
+media.example.tld {
+  @mediaproxy path /media/* /proxy/*
+  reverse_proxy @mediaproxy 127.0.0.1:4000 {
+    transport http {
+      response_header_timeout 10s
+      read_timeout 15s
+    }
+  }
+}

installation/init.d/akkoma

@@ -1,23 +1,43 @@
 #!/sbin/openrc-run
 supervisor=supervise-daemon
-command_user=akkoma:akkoma
-command_background=1
-# Ask process to terminate within 30 seconds, otherwise kill it
-retry="SIGTERM/30/SIGKILL/5"
-pidfile="/var/run/akkoma.pid"
-directory=/opt/akkoma
-healthcheck_delay=60
-healthcheck_timer=30
 no_new_privs="yes"
+pidfile="/var/run/akkoma.pid"
 
-: ${akkoma_port:-4000}
+# Ask process first to terminate itself within 60s, otherwise kill it
+retry="SIGTERM/60/SIGKILL/5"
 
-# Needs OpenRC >= 0.42
-#respawn_max=0
-#respawn_delay=5
+# if you really want to use start-stop-daemon instead,
+# also put the following in the config:
+#    command_background=1
+
+# Adjust defaults as needed in /etc/conf.d/akkoma;
+# no need to directly edit the service file
+command_user="${command_user:-akkoma:akkoma}"
+directory="${directory:-/var/lib/akkoma/akkoma}"
+akkoma_port="${akkoma_port:-4000}"
+# whether to allow connecting a remote exlixir shell to the running Akkoma instance
+akkoma_console=${akkoma_console:-NO}
+
+output_log="${output_log:-/var/log/akkoma}"
+error_log="${error_log:-/var/log/akkoma}"
+
+# 0 means unlimited restarts
+respawn_max="${respawn_max:-0}"
+respawn_delay="${respawn_delay:-5}"
+# define respawn period to only count crashes within a
+# sliding time window towards respawn_max, e.g.:
+#   respawn_period=2850
+
+healthcheck_delay="${healthcheck_delay:-60}"
+healthcheck_timer="${healthcheck_timer:-30}"
+
+MIX_ENV=prod
+ERL_EPMD_ADDRESS="${ERL_EPMD_ADDRESS:-127.0.0.1}"
+ERL_AFLAGS="${ERL_AFLAGS:-+sbwt none +sbwtdcpu none +sbwtdio none}"
+supervise_daemon_args="${supervise_daemon_args} --env MIX_ENV=${MIX_ENV}"
+supervise_daemon_args="${supervise_daemon_args} --env ERL_EPMD_ADDRESS=${ERL_EPMD_ADDRESS}"
+supervise_daemon_args="${supervise_daemon_args} --env ERL_AFLAGS='${ERL_AFLAGS}'"
 
-# put akkoma_console=YES in /etc/conf.d/akkoma if you want to be able to
-# connect to akkoma via an elixir console
 if yesno "${akkoma_console}"; then
 	command=elixir
 	command_args="--name akkoma@127.0.0.1 --erl '-kernel inet_dist_listen_min 9001 inet_dist_listen_max 9001 inet_dist_use_interface {127,0,0,1}' -S mix phx.server"
@@ -31,13 +51,24 @@ else
 	command_args="phx.server"
 fi
 
-export MIX_ENV=prod
-export ERL_EPMD_ADDRESS=127.0.0.1
-
 depend() {
 	need nginx postgresql
 }
 
+start_pre() {
+	# Ensure logfile ownership and perms are alright
+	checkpath --file --owner "$command_user" "$output_log" "$error_log" \
+	|| eerror "Logfile(s) not owned by $command_user, or not a file!"
+	checkpath --writable "$output_log" "$error_log" \
+	|| eerror "Logfile(s) not writable!"
+
+	# If a recompile is needed perform it with lowest prio
+	# (delaying the actual start) to avoid hogging too much
+	# CPU from other services
+	cd "$directory"
+	doas -u "${command_user%%:*}" env MIX_ENV="$MIX_ENV" nice -n 19 "$command" compile
+}
+
 healthcheck() {
 	# put akkoma_health=YES in /etc/conf.d/akkoma if you want healthchecking
 	# and make sure you have curl installed

installation/nginx/akkoma.nginx

@@ -1,12 +1,9 @@
 # default nginx site config for Akkoma
 #
-# Simple installation instructions:
-# 1. Install your TLS certificate, possibly using Let's Encrypt.
-# 2. Replace 'example.tld' with your instance's domain wherever it appears.
-# 3. Copy this file to /etc/nginx/sites-available/ and then add a symlink to it
-#    in /etc/nginx/sites-enabled/ and run 'nginx -s reload' or restart nginx.
+# See the documentation at docs.akkoma.dev for your particular distro/OS for
+# installation instructions.
 
-proxy_cache_path /tmp/akkoma-media-cache levels=1:2 keys_zone=akkoma_media_cache:10m max_size=10g
+proxy_cache_path /var/tmp/akkoma-media-cache levels=1:2 keys_zone=akkoma_media_cache:10m max_size=1g
                  inactive=720m use_temp_path=off;
 
 # this is explicitly IPv4 since Pleroma.Web.Endpoint binds on IPv4 only
@@ -15,25 +12,19 @@ upstream phoenix {
     server 127.0.0.1:4000 max_fails=5 fail_timeout=60s;
 }
 
-server {
-    server_name    example.tld;
-
-    listen         80;
-    listen         [::]:80;
-
-    # Uncomment this if you need to use the 'webroot' method with certbot. Make sure
-    # that the directory exists and that it is accessible by the webserver. If you followed
-    # the guide, you already ran 'mkdir -p /var/lib/letsencrypt' to create the folder.
-    # You may need to load this file with the ssl server block commented out, run certbot
-    # to get the certificate, and then uncomment it.
-    #
-    # location ~ /\.well-known/acme-challenge {
-    #     root /var/lib/letsencrypt/;
-    # }
-    location / {
-      return         301 https://$server_name$request_uri;
-    }
-}
+# If you are setting up TLS certificates without certbot, uncomment the
+# following to enable HTTP -> HTTPS redirects. Certbot users don't need to do
+# this as it will automatically do this for you.
+# server {
+#     server_name    example.tld media.example.tld;
+#
+#     listen         80;
+#     listen         [::]:80;
+#
+#     location / {
+#         return         301 https://$server_name$request_uri;
+#     }
+# }
 
 # Enable SSL session caching for improved performance
 ssl_session_cache shared:ssl_session_cache:10m;
@@ -41,22 +32,29 @@ ssl_session_cache shared:ssl_session_cache:10m;
 server {
     server_name example.tld;
 
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
-    ssl_session_timeout 1d;
-    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
-    ssl_session_tickets off;
+    # Once certbot is set up, this will automatically be updated to listen to
+    # port 443 with TLS alongside a redirect from plaintext HTTP.
+    listen 80;
+    listen [::]:80;
 
-    ssl_trusted_certificate   /etc/letsencrypt/live/example.tld/chain.pem;
-    ssl_certificate           /etc/letsencrypt/live/example.tld/fullchain.pem;
-    ssl_certificate_key       /etc/letsencrypt/live/example.tld/privkey.pem;
+    # If you are not using Certbot, comment out the above and uncomment/edit the following
+#     listen 443 ssl http2;
+#     listen [::]:443 ssl http2;
+#     ssl_session_timeout 1d;
+#     ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
+#     ssl_session_tickets off;
+#
+#     ssl_trusted_certificate   /etc/letsencrypt/live/example.tld/chain.pem;
+#     ssl_certificate           /etc/letsencrypt/live/example.tld/fullchain.pem;
+#     ssl_certificate_key       /etc/letsencrypt/live/example.tld/privkey.pem;
+#
+#     ssl_protocols TLSv1.2 TLSv1.3;
+#     ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
+#     ssl_prefer_server_ciphers off;
+#     ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
+#     ssl_stapling on;
+#     ssl_stapling_verify on;
 
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
-    ssl_prefer_server_ciphers off;
-    ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
-    ssl_stapling on;
-    ssl_stapling_verify on;
 
     gzip_vary on;
     gzip_proxied any;
@@ -75,9 +73,43 @@ server {
     proxy_set_header Host $http_host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
+    location ~ ^/(media|proxy) {
+        return 404;
+    }
+
     location / {
         proxy_pass http://phoenix;
     }
+}
+
+# Upload and MediaProxy Subdomain
+# (see main domain setup for more details)
+server {
+    server_name media.example.tld;
+
+    # Same as above, will be updated to HTTPS once certbot is set up.
+    listen 80;
+    listen [::]:80;
+
+    # If you are not using certbot, comment the above and copy all the ssl
+    # stuff from above into here.
+
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_buffers 16 8k;
+    gzip_http_version 1.1;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml;
+
+    # the nginx default is 1m, not enough for large media uploads
+    client_max_body_size 16m;
+    ignore_invalid_headers off;
+
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
     location ~ ^/(media|proxy) {
         proxy_cache        akkoma_media_cache;
@@ -91,4 +123,8 @@ server {
         chunked_transfer_encoding on;
         proxy_pass         http://phoenix;
     }
+
+    location / {
+        return 404;
+    }
 }

installation/nginx/nginx-cache-purge.sh.example

@@ -5,7 +5,7 @@
 SCRIPTNAME=${0##*/}
 
 # NGINX cache directory
-CACHE_DIRECTORY="/tmp/akkoma-media-cache"
+CACHE_DIRECTORY="/var/tmp/akkoma-media-cache"
 
 ## Return the files where the items are cached.
 ## $1 - the filename, can be a pattern .

installation/openbsd/rc.d/akkomad

@@ -11,11 +11,13 @@
 #
 
 daemon="/usr/local/bin/elixir"
-daemon_flags="--detached -S /usr/local/bin/mix phx.server"
+daemon_flags="-S /usr/local/bin/mix phx.server"
 daemon_user="_akkoma"
+daemon_execdir="/home/_akkoma/akkoma"
 
 . /etc/rc.d/rc.subr
 
+rc_bg="YES"
 rc_reload=NO
 pexp="phx.server"
 
@@ -24,7 +26,7 @@ rc_check() {
 }
 
 rc_start() {
-	${rcexec} "cd akkoma; ${daemon} ${daemon_flags}"
+	rc_exec "${daemon} ${daemon_flags}"
 }
 
 rc_stop() {

lib/mix/pleroma.ex

@@ -16,7 +16,7 @@ defmodule Mix.Pleroma do
     :fast_html,
     :oban
   ]
-  @cachex_children ["object", "user", "scrubber", "web_resp"]
+  @cachex_children ["object", "user", "scrubber", "web_resp", "http_backoff"]
   @doc "Common functions to be reused in mix tasks"
   def start_pleroma do
     Pleroma.Config.Holder.save_default()
@@ -112,18 +112,26 @@ def shell_prompt(prompt, defval \\ nil, defname \\ nil) do
     end
   end
 
-  def shell_info(message) do
+  def shell_info(message) when is_binary(message) or is_list(message) do
     if mix_shell?(),
       do: Mix.shell().info(message),
       else: IO.puts(message)
   end
 
-  def shell_error(message) do
+  def shell_info(message) do
+    shell_info("#{inspect(message)}")
+  end
+
+  def shell_error(message) when is_binary(message) or is_list(message) do
     if mix_shell?(),
       do: Mix.shell().error(message),
       else: IO.puts(:stderr, message)
   end
 
+  def shell_error(message) do
+    shell_error("#{inspect(message)}")
+  end
+
   @doc "Performs a safe check whether `Mix.shell/0` is available (does not raise if Mix is not loaded)"
   def mix_shell?, do: :erlang.function_exported(Mix, :shell, 0)