{ env, mastodon }:
let
  varDir = "/var/lib/mastodon_immae";
  socketsDir = "/run/mastodon";
  keys.mastodon = {
    dest = "webapps/tools-mastodon";
    user = "mastodon";
    group = "mastodon";
    permissions = "0400";
    text = ''
      REDIS_HOST=${env.redis.host}
      REDIS_PORT=${env.redis.port}
      REDIS_DB=${env.redis.db}
      DB_HOST=${env.postgresql.socket}
      DB_USER=${env.postgresql.user}
      DB_NAME=${env.postgresql.database}
      DB_PASS=${env.postgresql.password}
      DB_PORT=${env.postgresql.port}

      LOCAL_DOMAIN=mastodon.immae.eu
      LOCAL_HTTPS=true
      ALTERNATE_DOMAINS=immae.eu

      PAPERCLIP_SECRET=${env.paperclip_secret}
      SECRET_KEY_BASE=${env.secret_key_base}
      OTP_SECRET=${env.otp_secret}

      VAPID_PRIVATE_KEY=${env.vapid.private}
      VAPID_PUBLIC_KEY=${env.vapid.public}

      SMTP_DELIVERY_METHOD=sendmail
      SMTP_FROM_ADDRESS=mastodon@tools.immae.eu
      SENDMAIL_LOCATION="/run/wrappers/bin/sendmail"
      PAPERCLIP_ROOT_PATH=${varDir}

      STREAMING_CLUSTER_NUM=1

      RAILS_LOG_LEVEL=warn

      # LDAP authentication (optional)
      LDAP_ENABLED=true
      LDAP_HOST=ldap.immae.eu
      LDAP_PORT=636
      LDAP_METHOD=simple_tls
      LDAP_BASE="dc=immae,dc=eu"
      LDAP_BIND_DN="cn=mastodon,ou=services,dc=immae,dc=eu"
      LDAP_PASSWORD="${env.ldap.password}"
      LDAP_UID="uid"
      LDAP_SEARCH_FILTER="(&(%{uid}=%{email})(memberOf=cn=users,cn=mastodon,ou=services,dc=immae,dc=eu))"
    '';
  };

  railsRoot = mastodon.override { inherit varDir; };
in
  {
    inherit varDir railsRoot socketsDir;
    inherit (railsRoot.passthru) gems;
    keys = builtins.attrValues keys;
    nodeSocket = "${socketsDir}/live_immae_node.sock";
    railsSocket = "${socketsDir}/live_immae_puma.sock";
  }