signing_key: refactor nested case into with statement

The error branches were already effectively identical before.
This change is purely cosmetic.

.buildpacks

@@ -1 +0,0 @@
-https://github.com/hashnuke/heroku-buildpack-elixir  

.formatter.exs

@@ -1,3 +1,14 @@
 [
-  inputs: ["mix.exs", "{config,lib,test}/**/*.{ex,exs}", "priv/repo/migrations/*.exs", "priv/repo/optional_migrations/**/*.exs", "priv/scrubbers/*.ex"]
+  import_deps: [:ecto, :ecto_sql, :phoenix],
+  subdirectories: ["priv/*/migrations"],
+  plugins: [Phoenix.LiveView.HTMLFormatter],
+  inputs: [
+    "mix.exs",
+    "*.{heex,ex,exs}",
+    "{config,lib,test}/**/*.{heex,ex,exs}",
+    "priv/*/seeds.exs",
+    "priv/repo/migrations/*.exs",
+    "priv/repo/optional_migrations/**/*.exs",
+    "priv/scrubbers/*.ex"
+  ]
 ]

.gitignore

@@ -78,3 +78,4 @@ docs/venv
 # docker stuff
 docker-db
 *.iml
+docker-compose.override.yml

.woodpecker/build-amd64.yml

@@ -1,4 +1,5 @@
-platform: linux/amd64
+labels:
+  platform: linux/amd64
 
 depends_on:
   - test
@@ -34,10 +35,10 @@ variables:
   - &clean "(rm -rf release || true) && (rm -rf _build || true) && (rm -rf /root/.mix)"
   - &mix-clean "mix deps.clean --all && mix clean"
 
-pipeline:
+steps:
   # Canonical amd64
   debian-bookworm:
-    image: hexpm/elixir:1.15.4-erlang-25.3.2.5-debian-bookworm-20230612
+    image: hexpm/elixir:1.15.4-erlang-26.0.2-debian-bookworm-20230612
     <<: *on-release
     environment:
       MIX_ENV: prod
@@ -65,9 +66,35 @@ pipeline:
       - export DEST=scaleway:akkoma-updates/$${CI_COMMIT_TAG:-"$CI_COMMIT_BRANCH"}/akkoma-amd64-ubuntu-jammy.zip
       - /bin/sh /entrypoint.sh
 
+  debian-bullseye:
+    image: hexpm/elixir:1.15.4-erlang-26.0.2-debian-bullseye-20230612
+    <<: *on-release
+    environment:
+      MIX_ENV: prod
+      DEBIAN_FRONTEND: noninteractive
+    commands:
+      - apt-get update && apt-get install -y cmake libmagic-dev rclone zip imagemagick libmagic-dev git build-essential g++ wget
+      - *clean
+      - echo "import Config" > config/prod.secret.exs
+      - *setup-hex
+      - *tag-build
+      - mix deps.get --only prod
+      - mix release --path release
+      - zip akkoma-amd64-debian-bullseye.zip -r release
+
+  release-debian-bullseye:
+    image: akkoma/releaser
+    <<: *on-release
+    secrets: *scw-secrets
+    commands:
+      - export SOURCE=akkoma-amd64-debian-bullseye.zip
+      # AMD64
+      - export DEST=scaleway:akkoma-updates/$${CI_COMMIT_TAG:-"$CI_COMMIT_BRANCH"}/akkoma-amd64-debian-bullseye.zip
+      - /bin/sh /entrypoint.sh
+
   # Canonical amd64-musl
   musl:
-    image: hexpm/elixir:1.14.3-erlang-25.2.2-alpine-3.18.0
+    image: hexpm/elixir:1.15.4-erlang-26.0.2-alpine-3.18.2
     <<: *on-stable
     environment:
       MIX_ENV: prod

.woodpecker/build-arm64.yml

@@ -1,4 +1,5 @@
-platform: linux/arm64
+labels:
+  platform: linux/aarch64
 
 depends_on:
   - test
@@ -34,10 +35,10 @@ variables:
   - &clean "(rm -rf release || true) && (rm -rf _build || true) && (rm -rf /root/.mix)"
   - &mix-clean "mix deps.clean --all && mix clean"
 
-pipeline:
+steps:
   # Canonical arm64
   debian-bookworm:
-    image: hexpm/elixir:1.15.4-erlang-25.3.2.5-debian-bookworm-20230612
+    image: hexpm/elixir:1.15.4-erlang-26.0.2-debian-bookworm-20230612
     <<: *on-release
     environment:
       MIX_ENV: prod
@@ -65,7 +66,7 @@ pipeline:
 
   # Canonical arm64-musl
   musl:
-    image: hexpm/elixir:1.15.4-erlang-25.3.2.5-alpine-3.18.2
+    image: hexpm/elixir:1.15.4-erlang-26.0.2-alpine-3.18.2
     <<: *on-stable
     environment:
       MIX_ENV: prod

.woodpecker/docs.yml

@@ -1,4 +1,5 @@
-platform: linux/amd64
+labels:
+  platform: linux/amd64
 
 depends_on:
   - test
@@ -45,7 +46,7 @@ variables:
   - &clean "(rm -rf release || true) && (rm -rf _build || true) && (rm -rf /root/.mix)"
   - &mix-clean "mix deps.clean --all && mix clean"
 
-pipeline:
+steps:
   docs:
     <<: *on-point-release
     secrets:

.woodpecker/lint.yml

@@ -0,0 +1,56 @@
+labels:
+  platform: linux/amd64
+
+variables:
+  - &scw-secrets
+    - SCW_ACCESS_KEY
+    - SCW_SECRET_KEY
+    - SCW_DEFAULT_ORGANIZATION_ID
+  - &setup-hex "mix local.hex --force && mix local.rebar --force"
+  - &on-release
+    when:
+      event:
+        - push
+        - tag
+      branch:
+        - develop
+        - stable
+        - refs/tags/v*
+        - refs/tags/stable-*
+  - &on-stable
+    when:
+      event:
+        - push
+        - tag
+      branch:
+        - stable
+        - refs/tags/stable-*
+  - &on-point-release
+    when:
+      event:
+        - push
+      branch:
+        - develop
+        - stable
+  - &on-pr-open
+    when:
+      event:
+        - pull_request
+
+  - &tag-build "export BUILD_TAG=$${CI_COMMIT_TAG:-\"$CI_COMMIT_BRANCH\"} && export PLEROMA_BUILD_BRANCH=$BUILD_TAG"
+
+  - &clean "(rm -rf release || true) && (rm -rf _build || true) && (rm -rf /root/.mix)"
+  - &mix-clean "mix deps.clean --all && mix clean"
+
+steps:
+  lint:
+    image: akkoma/ci-base:1.16-otp26
+    <<: *on-pr-open
+    environment:
+      MIX_ENV: test
+    commands:
+      - mix local.hex --force
+      - mix local.rebar --force
+      - mix deps.get
+      - mix compile
+      - mix format --check-formatted

.woodpecker/test.yml

@@ -1,20 +1,20 @@
-platform: linux/amd64
+labels:
+  platform: linux/amd64
+
+depends_on:
+  - lint
 
 matrix:
   ELIXIR_VERSION:
     - 1.14
     - 1.15
+    - 1.16
   OTP_VERSION:
     - 25
     - 26
   include:
-    - ELIXIR_VERSION: 1.14
-      OTP_VERSION: 25
-    - ELIXIR_VERSION: 1.15
-      OTP_VERSION: 25
-    # Soon
-    #- ELIXIR_VERSION: 1.15
-    #  OTP_VERSION: 26
+    - ELIXIR_VERSION: 1.16
+      OTP_VERSION: 26
 
 variables:
   - &scw-secrets
@@ -68,30 +68,7 @@ services:
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: postgres
 
-pipeline:
-  lint:
-    <<: *on-pr-open
-    image: akkoma/ci-base:1.15
-    commands:
-    - mix local.hex --force
-    - mix local.rebar --force
-    - mix format --check-formatted
-
-  build:
-    image: akkoma/ci-base:${ELIXIR_VERSION}-otp${OTP_VERSION}
-    <<: *on-pr-open
-    environment:
-      MIX_ENV: test
-      POSTGRES_DB: pleroma_test_${ELIXIR_VERSION}_${OTP_VERSION}
-      POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres
-      DB_HOST: postgres
-    commands:
-      - mix local.hex --force
-      - mix local.rebar --force
-      - mix deps.get
-      - mix compile
-
+steps:
   test:
     image: akkoma/ci-base:${ELIXIR_VERSION}-otp${OTP_VERSION}
     <<: *on-pr-open
@@ -110,5 +87,5 @@ pipeline:
       - mix ecto.create
       - mix ecto.migrate
       - mkdir -p test/tmp
-    - mix test --preload-modules --exclude erratic --exclude federated --exclude mocked
-    - mix test --preload-modules --only mocked
+      - mix test --preload-modules --exclude erratic --exclude federated --exclude mocked || mix test --failed
+      - mix test --preload-modules --only mocked || mix test --failed

CHANGELOG.md

@@ -4,7 +4,136 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
-## Unreleased
+## 3.13.3 
+
+## BREAKING
+- Minimum PostgreSQL version is raised to 12
+- Swagger UI moved from `/akkoma/swaggerui/` to `/pleroma/swaggerui/`
+
+## Added
+- Implement [FEP-67ff](https://codeberg.org/fediverse/fep/src/branch/main/fep/67ff/fep-67ff.md) (federation documentation)
+- Meilisearch: it is now possible to use separate keys for search and admin actions
+- New standalone `prune_orphaned_activities` mix task with configurable batch limit
+- The `prune_objects` mix task now accepts a `--limit` parameter for initial object pruning
+
+## Fixed
+- Meilisearch: order of results returned from our REST API now actually matches how Meilisearch ranks results
+- Emoji are now federated as anonymous objects, fixing issues with
+  some strict servers e.g. rejecting e.g. remote emoji reactions
+- AP objects with additional JSON-LD profiles beyond ActivityStreams can now be fetched
+- Single-selection polls no longer expose the voter_count; MastoAPI demands it be null
+  and this confused some clients leading to vote distributions >100%
+
+## Changed
+- Refactored Rich Media to cache the content in the database. Fetching operations that could block status rendering have been eliminated.
+
+## 2024.04.1 (Security)
+
+## Fixed
+- Issue allowing non-owners to use media objects in posts
+- Issue allowing use of non-media objects as attachments and crashing timeline rendering
+- Issue allowing webfinger spoofing in certain situations
+
+## 2024.04
+
+## Added
+- Support for [FEP-fffd](https://codeberg.org/fediverse/fep/src/branch/main/fep/fffd/fep-fffd.md) (proxy objects)
+- Verified support for elixir 1.16
+- Uploadfilter `Pleroma.Upload.Filter.Exiftool.ReadDescription` returns description values to the FE so they can pre fill the image description field
+  NOTE: this filter MUST be placed before `Exiftool.StripMetadata` to work
+
+## Changed
+- Inbound pipeline error handing was modified somewhat, which should lead to less incomprehensible log spam. Hopefully.
+- Uploadfilter `Pleroma.Upload.Filter.Exiftool` was replaced by `Pleroma.Upload.Filter.Exiftool.StripMetadata`;
+  the latter strips all non-essential metadata by default but can be configured.
+  To regain the old behaviour of only stripping GPS data set `purge: ["gps:all"]`.
+- Uploadfilter `Pleroma.Upload.Filter.Exiftool` has been renamed to `Pleroma.Upload.Filter.Exiftool.StripMetadata`
+- MRF.InlineQuotePolicy now prefers to insert display URLs instead of ActivityPub IDs
+- Old accounts are no longer listed in WebFinger as aliases; this was breaking spec
+
+## Fixed
+- Issue preventing fetching anything from IPv6-only instances
+- Issue allowing post content to leak via opengraph tags despite :estrict\_unauthenticated being set
+- Move activities no longer operate on stale user data
+- Missing definitions in our JSON-LD context
+- Issue mangling newlines in code blocks for RSS/Atom feeds
+- static\_fe squeezing non-square avatars and emoji
+- Issue leading to properly JSON-LD compacted emoji reactions being rejected
+- We now use a standard-compliant Accept header when fetching ActivityPub objects
+- /api/pleroma/notification\_settings was rejecting body parameters;
+  this also broke changing this setting via akkoma-fe
+- Issue leading to Mastodon bot accounts being rejected
+- Scope misdetection of remote posts resulting from not recognising
+  JSON-LD-compacted forms of public scope; affected e.g. federation with bovine
+- Ratelimits encountered when fetching objects are now respected; 429 responses will cause a backoff when we get one.
+
+## Removed
+- ActivityPub Client-To-Server write API endpoints have been disabled;
+  read endpoints are planned to be removed next release unless a clear need is demonstrated
+
+## 2024.03
+
+## Added
+- CLI tasks best-effort checking for past abuse of the recent spoofing exploit
+- new `:mrf_steal_emoji, :download_unknown_size` option; defaults to `false`
+
+## Changed
+- `Pleroma.Upload, :base_url` now MUST be configured explicitly if used;
+  use of the same domain as the instance is **strongly** discouraged
+- `:media_proxy, :base_url` now MUST be configured explicitly if used;
+  use of the same domain as the instance is **strongly** discouraged
+- StealEmoji:
+  - now uses the pack.json format;
+    existing users must migrate with an out-of-band script (check release notes)
+  - only steals shortcodes recognised as valid
+  - URLs of stolen emoji is no longer predictable
+- The `Dedupe` upload filter is now always active;
+  `AnonymizeFilenames` is again opt-in
+- received AP data is sanity checked before we attempt to parse it as a user
+- Uploads, emoji and media proxy now restrict Content-Type headers to a safe subset
+- Akkoma will no longer fetch and parse objects hosted on the same domain
+
+## Fixed
+- Critical security issue allowing Akkoma to be used as a vector for
+  (depending on configuration) impersonation of other users or creation
+  of bogus users and posts on the upload domain
+- Critical security issue letting Akkoma fall for the above impersonation
+  payloads due to lack of strict id checking
+- Critical security issue allowing domains redirect to to pose as the initial domain
+  (e.g. with media proxy's fallback redirects)
+- refetched objects can no longer attribute themselves to third-party actors
+  (this had no externally visible effect since actor info is read from the Create activity)
+- our litepub JSON-LD schema is now served with the correct content type
+- remote APNG attachments are now recognised as images
+
+## Upgrade Notes
+
+- As mentioned in "Changed", `Pleroma.Upload, :base_url` **MUST** be configured. Uploads will fail without it.
+  - Akkoma will refuse to start if this is not set.
+- Same with media proxy.
+
+## 2024.02
+
+## Added
+- Full compatibility with Erlang OTP26
+- handling of GET /api/v1/preferences
+- Akkoma API is now documented
+- ability to auto-approve follow requests from users you are already following
+- The SimplePolicy MRF can now strip user backgrounds from selected remote hosts
+
+## Changed
+- OTP builds are now built on erlang OTP26
+- The base Phoenix framework is now updated to 1.7
+- An `outbox` field has been added to actor profiles to comply with AP spec
+- User profile backgrounds do now federate with other Akkoma instances and Sharkey
+
+## Fixed
+- Documentation issue in which a non-existing nginx file was referenced
+- Issue where a bad inbox URL could break federation
+- Issue where hashtag rel values would be scrubbed
+- Issue where short domains listed in `transparency_obfuscate_domains` were not actually obfuscated
+
+## 2023.08
 
 ## Added
 
@@ -39,7 +168,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ## Security
 
 - Add `no_new_privs` hardening to OpenRC and systemd service files
-- Ensured that XML parsers cannot load external entities (thanks @Mae@is.badat.dev!)
+- XML parsers cannot load any entities (thanks @Mae@is.badat.dev!)
 - Reduced permissions of config files and directories, distros requiring greater permissions like group-read need to pre-create the directories
 
 ## Removed

Dockerfile

@@ -1,4 +1,4 @@
-FROM hexpm/elixir:1.15.4-erlang-25.3.2.5-alpine-3.18.2
+FROM hexpm/elixir:1.15.4-erlang-26.0.2-alpine-3.18.2
 
 ENV MIX_ENV=prod
 ENV ERL_EPMD_ADDRESS=127.0.0.1

FEDERATION.md

@@ -0,0 +1,42 @@
+# Federation
+
+## Supported federation protocols and standards
+
+- [ActivityPub](https://www.w3.org/TR/activitypub/) (Server-to-Server)
+- [WebFinger](https://webfinger.net/)
+- [Http Signatures](https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures)
+- [NodeInfo](https://nodeinfo.diaspora.software/)
+
+## Supported FEPs
+
+- [FEP-67ff: FEDERATION](https://codeberg.org/fediverse/fep/src/branch/main/fep/67ff/fep-67ff.md)
+- [FEP-f1d5: NodeInfo in Fediverse Software](https://codeberg.org/fediverse/fep/src/branch/main/fep/f1d5/fep-f1d5.md)
+- [FEP-fffd: Proxy Objects](https://codeberg.org/fediverse/fep/src/branch/main/fep/fffd/fep-fffd.md)
+
+## ActivityPub
+
+Akkoma mostly follows the server-to-server parts of the ActivityPub standard,
+but implements quirks for Mastodon compatibility as well as Mastodon-specific
+and custom extensions.
+
+See our documentation and Mastodon’s federation information
+linked further below for details on these quirks and extensions.
+
+Akkoma does not perform JSON-LD processing.
+
+### Required extensions
+
+#### HTTP Signatures
+All AP S2S POST requests to Akkoma instances MUST be signed.
+Depending on instance configuration the same may be true for GET requests.
+
+## Nodeinfo
+
+Akkoma provides many additional entries in its nodeinfo response,
+see the documentation linked below for details.
+
+## Additional documentation
+
+- [Akkoma’s ActivityPub extensions](https://docs.akkoma.dev/develop/development/ap_extensions/)
+- [Akkoma’s nodeinfo extensions](https://docs.akkoma.dev/develop/development/nodeinfo_extensions/)
+- [Mastodon’s federation requirements](https://github.com/mastodon/mastodon/blob/main/FEDERATION.md)

Procfile

@@ -1,2 +0,0 @@
-web: mix phx.server
-release: mix ecto.migrate

SECURITY.md

@@ -0,0 +1,21 @@
+# Akkoma backend security handling
+
+## Reporting a vulnerability
+
+Please send an email (preferably encrypted) or
+a DM via our IRC to one of the following people:
+
+| Forgejo nick | IRC nick      | Email         | GPG                                     |
+| ------------ | ------------- | ------------- | --------------------------------------- |
+| floatinghost | FloatingGhost | *see GPG key* | https://coffee-and-dreams.uk/pubkey.asc |
+
+## Announcements
+
+New releases and security issues are announced at
+[meta.akkoma.dev](https://meta.akkoma.dev/c/releases) and
+[@akkoma@ihatebeinga.live](https://ihatebeinga.live/akkoma).
+
+Both also offer RSS feeds
+([meta](https://meta.akkoma.dev/c/releases/7.rss),
+[fedi](https://ihatebeinga.live/users/akkoma.rss))
+so you can keep an eye on it without any accounts.

config/config.exs

@@ -61,11 +61,11 @@
 # Upload configuration
 config :pleroma, Pleroma.Upload,
   uploader: Pleroma.Uploaders.Local,
-  filters: [Pleroma.Upload.Filter.Dedupe],
+  filters: [],
   link_name: false,
-  proxy_remote: false,
   filename_display_max_length: 30,
-  base_url: nil
+  base_url: nil,
+  allowed_mime_types: ["image", "audio", "video"]
 
 config :pleroma, Pleroma.Uploaders.Local, uploads: "uploads"
 
@@ -110,17 +110,6 @@
     "xmpp"
   ]
 
-websocket_config = [
-  path: "/websocket",
-  serializer: [
-    {Phoenix.Socket.V1.JSONSerializer, "~> 1.0.0"},
-    {Phoenix.Socket.V2.JSONSerializer, "~> 2.0.0"}
-  ],
-  timeout: 60_000,
-  transport_log: false,
-  compress: false
-]
-
 # Configures the endpoint
 config :pleroma, Pleroma.Web.Endpoint,
   url: [host: "localhost"],
@@ -130,10 +119,7 @@
       {:_,
        [
          {"/api/v1/streaming", Pleroma.Web.MastodonAPI.WebsocketHandler, []},
-         {"/websocket", Phoenix.Endpoint.CowboyWebSocket,
-          {Phoenix.Transports.WebSocket,
-           {Pleroma.Web.Endpoint, Pleroma.Web.UserSocket, websocket_config}}},
-         {:_, Phoenix.Endpoint.Cowboy2Handler, {Pleroma.Web.Endpoint, []}}
+         {:_, Plug.Cowboy.Handler, {Pleroma.Web.Endpoint, []}}
        ]}
     ]
   ],
@@ -162,14 +148,38 @@
   format: "$metadata[$level] $message",
   metadata: [:request_id]
 
+# ———————————————————————————————————————————————————————————————
+#                       W  A  R  N  I  N  G
+# ———————————————————————————————————————————————————————————————
+#
+#  Whenever adding a privileged new custom type for e.g.
+#  ActivityPub objects, ALWAYS map their extension back
+#  to "application/octet-stream".
+#  Else files served by us can automatically end up with
+#  those privileged types causing severe security hazards.
+#  (We need those mappings so Phoenix can assoiate its format
+#   (the "extension") to incoming requests of those MIME types)
+#
+# ———————————————————————————————————————————————————————————————
 config :mime, :types, %{
   "application/xml" => ["xml"],
   "application/xrd+xml" => ["xrd+xml"],
   "application/jrd+json" => ["jrd+json"],
   "application/activity+json" => ["activity+json"],
-  "application/ld+json" => ["activity+json"]
+  "application/ld+json" => ["activity+json"],
+  # Can be removed when bumping MIME past 2.0.5
+  # see https://akkoma.dev/AkkomaGang/akkoma/issues/657
+  "image/apng" => ["apng"]
 }
 
+config :mime, :extensions, %{
+  "xrd+xml" => "text/plain",
+  "jrd+json" => "text/plain",
+  "activity+json" => "text/plain"
+}
+
+# ———————————————————————————————————————————————————————————————
+
 config :tesla, :adapter, {Tesla.Adapter.Finch, name: MyFinch}
 
 # Configures http settings, upstream proxy etc.
@@ -178,8 +188,10 @@
   receive_timeout: :timer.seconds(15),
   proxy_url: nil,
   user_agent: :default,
-  pool_size: 50,
-  adapter: []
+  pool_size: 10,
+  adapter: [],
+  # see: https://hexdocs.pm/finch/Finch.html#start_link/1
+  pool_max_idle_time: :timer.seconds(30)
 
 config :pleroma, :instance,
   name: "Akkoma",
@@ -300,7 +312,6 @@
     alwaysShowSubjectInput: true,
     background: "/images/city.jpg",
     collapseMessageWithSubject: false,
-    disableChat: false,
     greentext: false,
     hideFilteredStatuses: false,
     hideMutedPosts: false,
@@ -388,6 +399,7 @@
   accept: [],
   avatar_removal: [],
   banner_removal: [],
+  background_removal: [],
   reject_deletes: [],
   handle_threads: true
 
@@ -416,8 +428,6 @@
   threshold: 604_800,
   actions: [:delist, :strip_followers]
 
-config :pleroma, :mrf_follow_bot, follower_nickname: nil
-
 config :pleroma, :mrf_reject_newly_created_account_notes, age: 86_400
 
 config :pleroma, :rich_media,
@@ -428,8 +438,12 @@
     Pleroma.Web.RichMedia.Parsers.TwitterCard,
     Pleroma.Web.RichMedia.Parsers.OEmbed
   ],
-  failure_backoff: :timer.minutes(20),
-  ttl_setters: [Pleroma.Web.RichMedia.Parser.TTL.AwsSignedUrl]
+  failure_backoff: 60_000,
+  ttl_setters: [
+    Pleroma.Web.RichMedia.Parser.TTL.AwsSignedUrl,
+    Pleroma.Web.RichMedia.Parser.TTL.Opengraph
+  ],
+  max_body: 5_000_000
 
 config :pleroma, :media_proxy,
   enabled: false,
@@ -463,10 +477,6 @@
   image_quality: 85,
   min_content_length: 100 * 1024
 
-config :pleroma, :shout,
-  enabled: true,
-  limit: 5_000
-
 config :phoenix, :format_encoders, json: Jason, "activity+json": Jason
 
 config :phoenix, :json_library, Jason
@@ -571,7 +581,9 @@
     mute_expire: 5,
     search_indexing: 10,
     nodeinfo_fetcher: 1,
-    database_prune: 1
+    database_prune: 1,
+    rich_media_backfill: 2,
+    rich_media_expiration: 2
   ],
   plugins: [
     Oban.Plugins.Pruner,
@@ -587,7 +599,8 @@
   retries: [
     federator_incoming: 5,
     federator_outgoing: 5,
-    search_indexing: 2
+    search_indexing: 2,
+    rich_media_backfill: 3
   ],
   timeout: [
     activity_expiration: :timer.seconds(5),
@@ -609,7 +622,8 @@
     mute_expire: :timer.seconds(5),
     search_indexing: :timer.seconds(5),
     nodeinfo_fetcher: :timer.seconds(10),
-    database_prune: :timer.minutes(10)
+    database_prune: :timer.minutes(10),
+    rich_media_backfill: :timer.seconds(30)
   ]
 
 config :pleroma, Pleroma.Formatter,
@@ -808,8 +822,10 @@
 config :pleroma, configurable_from_database: false
 
 config :pleroma, Pleroma.Repo,
-  parameters: [gin_fuzzy_search_limit: "500"],
-  prepare: :unnamed
+  parameters: [
+    gin_fuzzy_search_limit: "500",
+    plan_cache_mode: "force_custom_plan"
+  ]
 
 config :pleroma, :majic_pool, size: 2
 

config/description.exs

@@ -100,18 +100,23 @@
         label: "Base URL",
         type: :string,
         description:
-          "Base URL for the uploads. Required if you use a CDN or host attachments under a different domain.",
+          "Base URL for the uploads. Required if you use a CDN or host attachments under a different domain - it is HIGHLY recommended that you **do not** set this to be the same as the domain akkoma is hosted on.",
         suggestions: [
-          "https://cdn-host.com"
+          "https://media.akkoma.dev/media/"
         ]
       },
       %{
-        key: :proxy_remote,
-        type: :boolean,
-        description: """
-        Proxy requests to the remote uploader.\n
-        Useful if media upload endpoint is not internet accessible.
-        """
+        key: :allowed_mime_types,
+        label: "Allowed MIME types",
+        type: {:list, :string},
+        description:
+          "List of MIME (main) types uploads are allowed to identify themselves with. Other types may still be uploaded, but will identify as a generic binary to clients. WARNING: Loosening this over the defaults can lead to security issues. Removing types is safe, but only add to the list if you are sure you know what you are doing.",
+        suggestions: [
+          "image",
+          "audio",
+          "video",
+          "font"
+        ]
       },
       %{
         key: :filename_display_max_length,
@@ -209,6 +214,26 @@
       }
     ]
   },
+  %{
+    group: :pleroma,
+    key: Pleroma.Upload.Filter.Exiftool.StripMetadata,
+    type: :group,
+    description: "Strip specified metadata from image uploads",
+    children: [
+      %{
+        key: :purge,
+        description: "Metadata fields or groups to strip",
+        type: {:list, :string},
+        suggestions: ["all", "CommonIFD0"]
+      },
+      %{
+        key: :preserve,
+        description: "Metadata fields or groups to preserve (takes precedence over stripping)",
+        type: {:list, :string},
+        suggestions: ["ColorSpaces", "Orientation"]
+      }
+    ]
+  },
   %{
     group: :pleroma,
     key: Pleroma.Emails.Mailer,
@@ -2684,8 +2709,8 @@
       %{
         key: :pool_size,
         type: :integer,
-        description: "Number of concurrent outbound HTTP requests to allow. Default 50.",
-        suggestions: [50]
+        description: "Number of concurrent outbound HTTP requests to allow PER HOST. Default 10.",
+        suggestions: [10]
       },
       %{
         key: :adapter,
@@ -2708,6 +2733,13 @@
             ]
           }
         ]
+      },
+      %{
+        key: :pool_max_idle_time,
+        type: :integer,
+        description:
+          "Number of seconds to retain an HTTP pool; pool will remain if actively in use. Default 30 seconds (in ms).",
+        suggestions: [30_000]
       }
     ]
   },

config/dokku.exs

@@ -1,25 +0,0 @@
-import Config
-
-config :pleroma, Pleroma.Web.Endpoint,
-  http: [
-    port: String.to_integer(System.get_env("PORT") || "4000"),
-    protocol_options: [max_request_line_length: 8192, max_header_value_length: 8192]
-  ],
-  protocol: "http",
-  secure_cookie_flag: false,
-  url: [host: System.get_env("APP_HOST"), scheme: "https", port: 443],
-  secret_key_base: "+S+ULgf7+N37c/lc9K66SMphnjQIRGklTu0BRr2vLm2ZzvK0Z6OH/PE77wlUNtvP"
-
-database_url =
-  System.get_env("DATABASE_URL") ||
-    raise """
-    environment variable DATABASE_URL is missing.
-    For example: ecto://USER:PASS@HOST/DATABASE
-    """
-
-config :pleroma, Pleroma.Repo,
-  # ssl: true,
-  url: database_url,
-  pool_size: String.to_integer(System.get_env("POOL_SIZE") || "10")
-
-config :pleroma, :instance, name: "#{System.get_env("APP_NAME")} CI Instance"

config/test.exs

@@ -22,9 +22,12 @@
 config :pleroma, :auth, oauth_consumer_strategies: []
 
 config :pleroma, Pleroma.Upload,
+  base_url: "http://localhost:4001/media/",
   filters: [],
   link_name: false
 
+config :pleroma, :media_proxy, base_url: "http://localhost:4001"
+
 config :pleroma, Pleroma.Uploaders.Local, uploads: "test/uploads"
 
 config :pleroma, Pleroma.Emails.Mailer, adapter: Swoosh.Adapters.Test, enabled: true
@@ -48,7 +51,8 @@
   hostname: System.get_env("DB_HOST") || "localhost",
   pool: Ecto.Adapters.SQL.Sandbox,
   pool_size: 50,
-  queue_target: 5000
+  queue_target: 5000,
+  log: false
 
 config :pleroma, :dangerzone, override_repo_pool_size: true
 
@@ -60,7 +64,8 @@
 config :pleroma, :rich_media,
   enabled: false,
   ignore_hosts: [],
-  ignore_tld: ["local", "localdomain", "lan"]
+  ignore_tld: ["local", "localdomain", "lan"],
+  max_body: 2_000_000
 
 config :pleroma, :instance,
   multi_factor_authentication: [
@@ -138,6 +143,8 @@
 config :pleroma, :instances_favicons, enabled: false
 config :pleroma, :instances_nodeinfo, enabled: false
 
+config :pleroma, Pleroma.Web.RichMedia.Backfill, provider: Pleroma.Web.RichMedia.Backfill
+
 if File.exists?("./config/test.secret.exs") do
   import_config "test.secret.exs"
 else

coveralls.json

@@ -1,7 +0,0 @@
-{
-  "skip_files": [
-    "test/support",
-    "lib/mix/tasks/pleroma/benchmark.ex",
-    "lib/credo/check/consistency/file_location.ex"
-  ]
-}

diagnostic-tools/binary-leak-checker.sh

@@ -0,0 +1,10 @@
+if [ "$#" -ne 2 ]; then
+	echo "Usage: binary-leak-checker.sh <nodename> <erlang cookie>"
+	exit 1
+fi
+
+echo "The command you want to run is:
+:recon.bin_leak(10)
+"
+
+iex --sname debug --remsh $1 --erl "-setcookie $2" 

docker-compose.yml

@@ -4,6 +4,7 @@ services:
   db:
     image: akkoma-db:latest
     build: ./docker-resources/database
+    shm_size: 4gb
     restart: unless-stopped
     user: ${DOCKER_USER}
     environment: {
@@ -45,7 +46,7 @@ services:
     volumes:
       - .:/opt/akkoma
 
-  # Uncomment the following if you want to use a reverse proxy
+  # Copy this into docker-compose.override.yml and uncomment there if you want to use a reverse proxy
   #proxy:
   #  image: caddy:2-alpine
   #  restart: unless-stopped

docker-entrypoint.sh

@@ -11,4 +11,4 @@ echo "-- Running migrations..."
 mix ecto.migrate
 
 echo "-- Starting!"
-mix phx.server
+elixir --erl "+sbwt none +sbwtdcpu none +sbwtdio none" -S mix phx.server

docs/README.md

@@ -15,12 +15,12 @@ source venv/bin/activate
 pip install -r requirements.txt
 
 # Run an http server who rebuilds when files change
-# Accessible on http://127.0.0.1:8000
+# Accessable on http://127.0.0.1:8000
 mkdocs serve
 
 # Build the docs
 # The static html pages will have been created in the folder "site"
-# You can serve them from a server by pointing your server software (NGINX, Apache...) to this location
+# You can serve them from a server by pointing your server software (nginx, apache...) to this location
 mkdocs build
 
 # To get out of the virtual environment, you do

docs/docs/administration/CLI_tasks/config.md

@@ -1,4 +1,4 @@
-# Transferring the config to/from the database
+# Transfering the config to/from the database
 
 {! administration/CLI_tasks/general_cli_task_info.include !}
 
@@ -34,9 +34,9 @@
 
 Options:
 
-- `<path>` - where to save migrated config. E.g. `--path=/tmp`. If a file saved into a non-standard folder, you must manually copy the file into directory where Pleroma can read it. For OTP install path will be `PLEROMA_CONFIG_PATH` or `/etc/akkoma`. For installation from source - `config` directory in the Akkoma folder.
-- `<env>` - environment, for which is migrated config. By default, is `prod`.
-- To delete transferred settings from database, optional flag `-d` can be used
+- `<path>` - where to save migrated config. E.g. `--path=/tmp`. If file saved into non standart folder, you must manually copy file into directory where Pleroma can read it. For OTP install path will be `PLEROMA_CONFIG_PATH` or `/etc/akkoma`. For installation from source - `config` directory in the akkoma folder.
+- `<env>` - environment, for which is migrated config. By default is `prod`.
+- To delete transferred settings from database optional flag `-d` can be used
 
 === "OTP"
     ```sh
@@ -48,7 +48,7 @@ Options:
     mix pleroma.config migrate_from_db [--env=<env>] [-d] [--path=<path>]
     ```
 
-## Dump all the config settings defined in the database
+## Dump all of the config settings defined in the database
 
 === "OTP"
 
@@ -179,8 +179,8 @@ it may be easier to dump the values to JSON and then modify them in a text edito
 
 ## Loading specific configuration values from JSON
 
-!!! note
-    This will overwrite any existing value in the database, and can cause crashes if you do not have exactly the correct formatting.
+**Note:** This will overwrite any existing value in the database, and can
+cause crashes if you do not have exactly the correct formatting.
 
 Once you have modified the JSON file, you can load it back into the database.
 
@@ -200,5 +200,6 @@ Once you have modified the JSON file, you can load it back into the database.
     mix pleroma.config load_from_file /tmp/mrf_simple.json
     ```
 
-!!! note
-    An instance reboot is needed for many changes to take effect, you may want to visit `/api/v1/pleroma/admin/restart` on your instance to soft-restart the instance.
+**NOTE** an instance reboot is needed for many changes to take effect,
+you may want to visit `/api/v1/pleroma/admin/restart` on your instance
+to soft-restart the instance.

docs/docs/administration/CLI_tasks/database.md

@@ -7,7 +7,7 @@
 
 ## Replace embedded objects with their references
 
-Replaces embedded objects with references to them in the `objects` table. Only needs to be ran once if the instance was created before Pleroma 1.0.5. The reason why this is not a migration is because it could significantly increase the database size after being ran, however after this `VACUUM FULL` will be able to reclaim about 20% (really depends on what is in the database, your mileage may vary) of the database size before the migration.
+Replaces embedded objects with references to them in the `objects` table. Only needs to be ran once if the instance was created before Pleroma 1.0.5. The reason why this is not a migration is because it could significantly increase the database size after being ran, however after this `VACUUM FULL` will be able to reclaim about 20% (really depends on what is in the database, your mileage may vary) of the db size before the migration.
 
 === "OTP"
 
@@ -29,7 +29,7 @@ Replaces embedded objects with references to them in the `objects` table. Only n
 This will prune remote posts older than 90 days (configurable with [`config :pleroma, :instance, remote_post_retention_days`](../../configuration/cheatsheet.md#instance)) from the database. Pruned posts may be refetched in some cases.
 
 !!! note
-    The disk space will only be reclaimed after a proper vacuum. By default, PostgreSQL does this for you on a regular basis, but if your instance has been running for a long time and there are many rows deleted, it may be advantageous to use `VACUUM FULL` (e.g. by using the `--vacuum` option).
+    The disk space will only be reclaimed after a proper vacuum. By default Postgresql does this for you on a regular basis, but if your instance has been running for a long time and there are many rows deleted, it may be advantageous to use `VACUUM FULL` (e.g. by using the `--vacuum` option).
 
 !!! danger
     You may run out of disk space during the execution of the task or vacuuming if you don't have about 1/3rds of the database size free. Vacuum causes a substantial increase in I/O traffic, and may lead to a degraded experience while it is running.
@@ -50,9 +50,39 @@ This will prune remote posts older than 90 days (configurable with [`config :ple
 
 - `--keep-threads` - Don't prune posts when they are part of a thread where at least one post has seen local interaction (e.g. one of the posts is a local post, or is favourited by a local user, or has been repeated by a local user...). It also wont delete posts when at least one of the posts in that thread is kept (e.g. because one of the posts has seen recent activity).
 - `--keep-non-public` - Keep non-public posts like DM's and followers-only, even if they are remote.
+- `--limit` - limits how many remote posts get pruned. This limit does **not** apply to any of the follow up jobs. If wanting to keep the database load in check it is thus advisable to run the standalone `prune_orphaned_activities` task with a limit afterwards instead of passing `--prune-orphaned-activities` to this task.
 - `--prune-orphaned-activities` - Also prune orphaned activities afterwards. Activities are things like Like, Create, Announce, Flag (aka reports)... They can significantly help reduce the database size.
 - `--vacuum` - Run `VACUUM FULL` after the objects are pruned. This should not be used on a regular basis, but is useful if your instance has been running for a long time before pruning.
 
+## Prune orphaned activities from the database
+
+This will prune activities which are no longer referenced by anything.
+Such activities might be the result of running `prune_objects` without `--prune-orphaned-activities`.
+The same notes and warnings apply as for `prune_objects`.
+
+The task will print out how many rows were freed in total in its last
+line of output in the form `Deleted 345 rows`.  
+When running the job in limited batches this can be used to determine
+when all orphaned activities have been deleted.
+
+=== "OTP"
+
+    ```sh
+    ./bin/pleroma_ctl database prune_orphaned_activities [option ...]
+    ```
+
+=== "From Source"
+
+    ```sh
+    mix pleroma.database prune_orphaned_activities [option ...]
+    ```
+
+### Options
+
+- `--limit n` - Only delete up to `n` activities in each query making up this job, i.e. if this job runs two queries at most `2n` activities will be deleted. Running this task repeatedly in limited batches can help maintain the instance’s responsiveness while still freeing up some space.
+- `--no-singles` - Do not delete activites referencing single objects
+- `--no-arrays` - Do not delete activites referencing an array of objects
+
 ## Create a conversation for all existing DMs
 
 Can be safely re-run
@@ -100,7 +130,7 @@ Can be safely re-run
 ## Vacuum the database
 
 !!! note
-    By default, PostgreSQL has an autovacuum daemon running. While the tasks described here can help in some cases, they shouldn't be needed on a regular basis. See [the PostgreSQL docs on vacuuming](https://www.postgresql.org/docs/current/sql-vacuum.html) for more information on this.
+    By default Postgresql has an autovacuum deamon running. While the tasks described here can help in some cases, they shouldn't be needed on a regular basis. See [the Postgresql docs on vacuuming](https://www.postgresql.org/docs/current/sql-vacuum.html) for more information on this.
 
 ### Analyze
 
@@ -120,7 +150,7 @@ Running an `analyze` vacuum job can improve performance by updating statistics u
 
 ### Full
 
-Running a `full` vacuum job rebuilds your entire database by reading all the data and rewriting it into smaller
+Running a `full` vacuum job rebuilds your entire database by reading all of the data and rewriting it into smaller
 and more compact files with an optimized layout. This process will take a long time and use additional disk space as
 it builds the files side-by-side the existing database files. It can make your database faster and use less disk space,
 but should only be run if necessary. **It is safe to cancel this.**
@@ -174,7 +204,7 @@ See [PostgreSQL documentation](https://www.postgresql.org/docs/current/textsearc
 Over time, transient `Delete` activities and `Tombstone` objects
 can accumulate in your database, inflating its size. This is not ideal. 
 There is a periodic task to prune these transient objects, 
-but on the first run this may take a while on older instances to catch up
+but on first run this may take a while on older instances to catch up
 to the current day.
 
 === "OTP"

docs/docs/administration/CLI_tasks/diagnostics.md

@@ -2,7 +2,7 @@
 
 A few tasks to help with debugging, troubleshooting, and diagnosing problems.
 
-They mostly relate to common PostgreSQL queries.
+They mostly relate to common postgres queries. 
 
 ## Home timeline query plan
 

docs/docs/administration/CLI_tasks/digest.md

@@ -16,6 +16,7 @@
     mix pleroma.digest test <nickname> [since_date]
     ```
 
+
 Example: 
 
 === "OTP"
@@ -29,3 +30,4 @@ Example:
     ```sh
     mix pleroma.digest test donaldtheduck 2019-05-20
     ```
+

docs/docs/administration/CLI_tasks/email.md

@@ -1,4 +1,4 @@
-# Email administration tasks
+# EMail administration tasks
 
 {! administration/CLI_tasks/general_cli_task_info.include !}
 

docs/docs/administration/CLI_tasks/emoji.md

@@ -14,8 +14,9 @@
     mix pleroma.emoji ls-packs [option ...]
     ```
 
+
 ### Options
-- `-m, --manifest PATH/URL` - path to a custom manifest, it can either be a URL starting with `http`, in that case the manifest will be fetched from that address, or a local path
+- `-m, --manifest PATH/URL` - path to a custom manifest, it can either be an URL starting with `http`, in that case the manifest will be fetched from that address, or a local path
 
 ## Fetch, verify and install the specified packs from the manifest into `STATIC-DIR/emoji/PACK-NAME`
 

docs/docs/administration/CLI_tasks/frontend.md

@@ -12,15 +12,15 @@
     mix pleroma.frontend install <frontend> [--ref <ref>] [--file <file>] [--build-url <build-url>] [--path <path>] [--build-dir <build-dir>]
     ```
 
-Frontend can be installed either from a local zip file, or automatically downloaded from the web.
+Frontend can be installed either from local zip file, or automatically downloaded from the web.
 
 You can give all the options directly on the command line, but missing information will be filled out by looking at the data configured under `frontends.available` in the config files.
 
 Currently, known `<frontend>` values are:
 
-- [Admin-fe](https://akkoma.dev/AkkomaGang/admin-fe)
-- [Masto-fe](https://akkoma.dev/AkkomaGang/masto-fe)
-- [Pleroma-fe](https://akkoma.dev/AkkomaGang/pleroma-fe)
+- [admin-fe](https://akkoma.dev/AkkomaGang/admin-fe)
+- [mastodon-fe](https://akkoma.dev/AkkomaGang/masto-fe)
+- [pleroma-fe](https://akkoma.dev/AkkomaGang/pleroma-fe)
 
 You can still install frontends that are not configured, see below.
 
@@ -91,3 +91,4 @@ The installation process is the same, but you will have to give all the needed o
     ```
 
 If you don't have a zip file but just want to install a frontend from a local path, you can simply copy the files over a folder of this template: `${instance_static}/frontends/${name}/${ref}`.
+

docs/docs/administration/CLI_tasks/general_cli_task_info.include

@@ -1,5 +1,5 @@
-Every command should be ran as the `akkoma` user from its home directory. For example, if you are superuser, you would have to wrap the command in `su akkoma -s $SHELL -lc "$COMMAND"`.
+Every command should be ran as the `akkoma` user from it's home directory. For example if you are superuser, you would have to wrap the command in `su akkoma -s $SHELL -lc "$COMMAND"`.
 
 ??? note "From source note about `MIX_ENV`"
 
-     The `mix` command should be prefixed with the name of the environment your Akkoma server is running in, usually it's `MIX_ENV=prod`
+     The `mix` command should be prefixed with the name of environment your Akkoma server is running in, usually it's `MIX_ENV=prod`

docs/docs/administration/CLI_tasks/instance.md

@@ -15,6 +15,7 @@
     mix pleroma.instance gen [option ...]
     ```
 
+
 If any of the options are left unspecified, you will be prompted interactively.
 
 ### Options
@@ -34,10 +35,11 @@ If any of the options are left unspecified, you will be prompted interactively.
 - `--db-configurable <Y|N>` - Allow/disallow configuring instance from admin part
 - `--uploads-dir <path>` - the directory uploads go in when using a local uploader
 - `--static-dir <path>` - the directory custom public files should be read from (custom emojis, frontend bundle overrides, robots.txt, etc.)
-- `--listen-ip <ip>` - the IP the app should listen to, defaults to 127.0.0.1
+- `--listen-ip <ip>` - the ip the app should listen to, defaults to 127.0.0.1
 - `--listen-port <port>` - the port the app should listen to, defaults to 4000
-- `--strip-uploads <Y|N>` - use ExifTool to strip uploads of sensitive location data
+- `--strip-uploads-metadata <Y|N>` - use ExifTool to strip uploads of metadata when possible
+- `--read-uploads-description <Y|N>` - use ExifTool to read image descriptions from uploads
 - `--anonymize-uploads <Y|N>` - randomize uploaded filenames
 - `--dedupe-uploads <Y|N>` - store files based on their hash to reduce data storage requirements if duplicates are uploaded with different filenames
-- `--skip-release-env` - skip generation of the release environment file
+- `--skip-release-env` - skip generation the release environment file
 - `--release-env-file` - release environment file path

docs/docs/administration/CLI_tasks/oauth_app.md

@@ -4,7 +4,7 @@
 
 ## Create trusted OAuth App.
 
-Optional parameters:
+Optional params:
   * `-s SCOPES` - scopes for app, e.g. `read,write,follow,push`.
 
 === "OTP"

docs/docs/administration/CLI_tasks/robots_txt.md

@@ -17,5 +17,5 @@ If you want to generate a restrictive `robots.txt`, you can run the following mi
 === "From Source"
 
     ```sh
-    mix pleroma.robotstxt disallow_all
+    mix pleroma.robots_txt disallow_all
     ```

docs/docs/administration/CLI_tasks/security.md

@@ -0,0 +1,56 @@
+# Security-related tasks
+
+{! administration/CLI_tasks/general_cli_task_info.include !}
+
+!!! danger
+    Many of these tasks were written in response to a patched exploit.
+    It is recommended to run those very soon after installing its respective security update.
+    Over time with db migrations they might become less accurate or be removed altogether.
+    If you never ran an affected version, there’s no point in running them.
+
+## Spoofed AcitivityPub objects exploit (2024-03, fixed in 3.11.1)
+
+### Search for uploaded spoofing payloads
+
+Scans local uploads for spoofing payloads.
+If the instance is not using the local uploader it was not affected.
+Attachments wil be scanned anyway in case local uploader was used in the past.
+
+!!! note
+    This cannot reliably detect payloads attached to deleted posts.
+
+=== "OTP"
+
+    ```sh
+    ./bin/pleroma_ctl security spoof-uploaded
+    ```
+
+=== "From Source"
+
+    ```sh
+    mix pleroma.security spoof-uploaded
+    ```
+
+### Search for counterfeit posts in database
+
+Scans all notes in the database for signs of being spoofed.
+
+!!! note
+    Spoofs targeting local accounts can be detected rather reliably
+    (with some restrictions documented in the task’s logs).
+    Counterfeit posts from remote users cannot. A best-effort attempt is made, but
+    a thorough attacker can avoid this and it may yield a small amount of false positives.
+
+    Should you find counterfeit posts of local users, let other admins know so they can delete the too.
+
+=== "OTP"
+
+    ```sh
+    ./bin/pleroma_ctl security spoof-inserted
+    ```
+
+=== "From Source"
+
+    ```sh
+    mix pleroma.security spoof-inserted
+    ```

docs/docs/administration/CLI_tasks/user.md

@@ -16,6 +16,7 @@
     mix pleroma.user new <nickname> <email> [option ...]
     ```
 
+
 ### Options
 - `--name <name>` - the user's display name
 - `--bio <bio>` - the user's bio
@@ -38,7 +39,8 @@
     mix pleroma.user list
     ```
 
-## Generate an invitation link
+
+## Generate an invite link
 
 === "OTP"
 
@@ -52,6 +54,7 @@
     mix pleroma.user invite [option ...]
     ```
 
+
 ### Options
 - `--expires-at DATE` - last day on which token is active (e.g. "2019-04-05")
 - `--max-use NUMBER` - maximum numbers of token uses
@@ -70,6 +73,7 @@
     mix pleroma.user invites
     ```
 
+
 ## Revoke invite
 
 === "OTP"
@@ -84,6 +88,7 @@
     mix pleroma.user revoke_invite <token>
     ```
 
+
 ## Delete a user
 
 === "OTP"
@@ -98,6 +103,7 @@
     mix pleroma.user rm <nickname>
     ```
 
+
 ## Delete user's posts and interactions
 
 === "OTP"
@@ -112,6 +118,7 @@
     mix pleroma.user delete_activities <nickname>
     ```
 
+
 ## Sign user out from all applications (delete user's OAuth tokens and authorizations)
 
 === "OTP"
@@ -154,6 +161,7 @@
     mix pleroma.user deactivate NICKNAME
     ```
 
+
 ## Deactivate all accounts from an instance and unsubscribe local users on it
 
 === "OTP"
@@ -168,6 +176,7 @@
     mix pleroma.user deactivate_all_from_instance <instance>
     ```
 
+
 ## Create a password reset link for user
 
 === "OTP"
@@ -182,7 +191,8 @@
     mix pleroma.user reset_password <nickname>
     ```
 
-## Disable Multi-Factor Authentication (MFA/2FA) for a user
+
+## Disable Multi Factor Authentication (MFA/2FA) for a user
 
 === "OTP"
 
@@ -196,6 +206,7 @@
     mix pleroma.user reset_mfa <nickname>
     ```
 
+
 ## Set the value of the given user's settings
 
 === "OTP"
@@ -230,6 +241,7 @@
     mix pleroma.user tag <nickname> <tags>
     ```
 
+
 ## Delete tags from a user
 
 === "OTP"
@@ -244,6 +256,7 @@
     mix pleroma.user untag <nickname> <tags>
     ```
 
+
 ## Toggle confirmation status of the user
 
 === "OTP"
@@ -291,7 +304,7 @@
 ## Fix following state
 
 Sometimes the system can get into a situation where
-it thinks you're already following someone and won't send a request
+it think you're already following someone and won't send a request
 to the remote instance, or won't let you unfollow someone. This
 bug was fixed, but in case you encounter these weird states:
 
@@ -311,4 +324,4 @@ The first argument is the local user's nickname - if you are `myuser@myinstance`
 
 The second is the remote user, consisting of both nickname AND domain.
 
-If you are a weird follow state situation and cannot resolve it with the above, you may need to co-operate with the remote admin to clear the state their side too - they should provide the arguments *backwards*, i.e. `fix_follow_state remote local`.
+If you are a weird follow state situation and cannot resolve it with the above, you may need to co-operate with the remote admin to clear the state their side too - they should provide the arguments *backwards*, i.e `fix_follow_state remote local`.

docs/docs/administration/backup.md

@@ -4,44 +4,54 @@
 
 1. Stop the Akkoma service.
 2. Go to the working directory of Akkoma (default is `/opt/akkoma`)
-3. Run[¹] `sudo -Hu postgres pg_dump -d akkoma --format=custom -f </path/to/backup_location/akkoma.pgdump>` (make sure the postgres user has write access to the destination file)
-4. Copy `akkoma.pgdump`, `config/prod.secret.exs`[²], `config/setup_db.psql` (if still available) and the `uploads` folder to your backup destination. If you have other modifications, copy those changes too.
+3. Run `sudo -Hu postgres pg_dump -d akkoma --format=custom -f </path/to/backup_location/akkoma.pgdump>`[¹] (make sure the postgres user has write access to the destination file)
+4. Copy `akkoma.pgdump`, `config/config.exs`[²], `uploads` folder, and [static directory](../configuration/static_dir.md) to your backup destination. If you have other modifications, copy those changes too.
 5. Restart the Akkoma service.
 
-[¹]: We assume the database name is "akkoma". If not, you can find the correct name in your config files.
-[²]: If you've installed using OTP, you need `config/config.exs` instead of `config/prod.secret.exs`.
+[¹]: We assume the database name is "akkoma". If not, you can find the correct name in your configuration files.  
+[²]: If you have a from source installation, you need `config/prod.secret.exs` instead of `config/config.exs`. The `config/config.exs` file also exists, but in case of from source installations, it only contains the default values and it is tracked by Git, so you don't need to back it up.  
 
 ## Restore/Move
 
 1. Optionally reinstall Akkoma (either on the same server or on another server if you want to move servers).
 2. Stop the Akkoma service.
 3. Go to the working directory of Akkoma (default is `/opt/akkoma`)
-4. Copy the above-mentioned files back to their original position.
-5. Drop the existing database and user if restoring in-place[¹]. `sudo -Hu postgres psql -c 'DROP DATABASE akkoma;';` `sudo -Hu postgres psql -c 'DROP USER akkoma;'`
-6. Restore the database schema and akkoma role using either of the following options
-    * You can use the original `setup_db.psql` if you have it[²]: `sudo -Hu postgres psql -f config/setup_db.psql`.
-    * Or recreate the database and user yourself (replace the password with the one you find in the config file) `sudo -Hu postgres psql -c "CREATE USER akkoma WITH ENCRYPTED PASSWORD '<database-password-wich-you-can-find-in-your-config-file>'; CREATE DATABASE akkoma OWNER akkoma;"`.
+4. Copy the above mentioned files back to their original position.
+5. Drop the existing database and user[¹]. `sudo -Hu postgres psql -c 'DROP DATABASE akkoma;';` `sudo -Hu postgres psql -c 'DROP USER akkoma;'`
+6. Restore the database schema and akkoma role[¹] (replace the password with the one you find in the configuration file), `sudo -Hu postgres psql -c "CREATE USER akkoma WITH ENCRYPTED PASSWORD '<database-password-wich-you-can-find-in-your-configuration-file>';"` `sudo -Hu postgres psql -c "CREATE DATABASE akkoma OWNER akkoma;"`.
 7. Now restore the Akkoma instance's data into the empty database schema[¹]: `sudo -Hu postgres pg_restore -d akkoma -v -1 </path/to/backup_location/akkoma.pgdump>`
-8. If you installed a newer Akkoma version, you should run `MIX_ENV=prod mix ecto.migrate`[³]. This task performs database migrations, if there were any.
+8. If you installed a newer Akkoma version, you should run the database migrations `./bin/pleroma_ctl migrate`[²].
 9. Restart the Akkoma service.
-10. Run `sudo -Hu postgres vacuumdb --all --analyze-in-stages`. This will quickly generate the statistics so that PostgreSQL can properly plan queries.
-11. If setting up on a new server configure NGINX by using the `installation/akkoma.nginx` config sample or reference the Akkoma installation guide for your OS which contains the NGINX configuration instructions.
+10. Run `sudo -Hu postgres vacuumdb --all --analyze-in-stages`. This will quickly generate the statistics so that postgres can properly plan queries.
+11. If setting up on a new server, configure Nginx by using the `installation/nginx/akkoma.nginx` configuration sample or reference the Akkoma installation guide which contains the Nginx configuration instructions.
 
-[¹]: We assume the database name and user are both "akkoma". If not, you can find the correct name in your config files.
-[²]: You can recreate the `config/setup_db.psql` by running the `mix pleroma.instance gen` task again. You can ignore most of the questions, but make the database user, name, and password the same as found in your backed up config file. This will also create a new `config/generated_config.exs` file which you may delete as it is not needed.
-[³]: Prefix with `MIX_ENV=prod` to run it using the production config file.
+[¹]: We assume the database name and user are both "akkoma". If not, you can find the correct name in your configuration files.  
+[²]: If you have a from source installation, the command is `MIX_ENV=prod mix ecto.migrate`. Note that we prefix with `MIX_ENV=prod` to use the `config/prod.secret.exs` configuration file.  
 
 ## Remove
 
-1. Optionally, you can remove the users of your instance. This will trigger delete requests for their accounts and posts. Note that this is 'best effort' and doesn't mean that all traces of your instance will be gone from the Fediverse.
+1. Optionally you can remove the users of your instance. This will trigger delete requests for their accounts and posts. Note that this is 'best effort' and doesn't mean that all traces of your instance will be gone from the fediverse.
     * You can do this from the admin-FE where you can select all local users and delete the accounts using the *Moderate multiple users* dropdown.
-    * You can also list local users and delete them individually using the CLI tasks for [managing users](./CLI_tasks/user.md).
+    * You can also list local users and delete them individually using the CLI tasks for [Managing users](./CLI_tasks/user.md).
 2. Stop the Akkoma service `systemctl stop akkoma`
 3. Disable Akkoma from systemd `systemctl disable akkoma`
-4. Remove the files and folders you created during installation (see installation guide). This includes the Akkoma, NGINX and systemd files and folders.
-5. Reload NGINX now that the configuration is removed `systemctl reload nginx`
+4. Remove the files and folders you created during installation (see installation guide). This includes the akkoma, nginx and systemd files and folders.
+5. Reload nginx now that the configuration is removed `systemctl reload nginx`
 6. Remove the database and database user[¹] `sudo -Hu postgres psql -c 'DROP DATABASE akkoma;';` `sudo -Hu postgres psql -c 'DROP USER akkoma;'`
 7. Remove the system user `userdel akkoma`
 8. Remove the dependencies that you don't need anymore (see installation guide). Make sure you don't remove packages that are still needed for other software that you have running!
 
 [¹]: We assume the database name and user are both "akkoma". If not, you can find the correct name in your config files.  
+
+## Docker installations
+
+If running behind Docker, it is required to run the above commands inside of a running database container.  
+
+### Example
+Running `docker compose run --rm db pg_dump <...>` will fail and return:
+```
+pg_dump: error: connection to server on socket "/run/postgresql/.s.PGSQL.5432" failed: No such file or directory 
+Is the server running locally and accepting connections on that socket?"
+```
+However, first starting just the database container with `docker compose up db -d`, and then running `docker compose exec db pg_dump -d akkoma --format=custom -f </your/backup/dir/akkoma.pgdump>` will successfully generate a database dump.  
+Then to make the file accessible on the host system you can run `docker compose cp db:</your/backup/dir/akkoma.pgdump> </your/target/location>` to copy if from the container.

docs/docs/administration/monitoring.md

@@ -1,25 +1,25 @@
 # Monitoring Akkoma
 
-If you run Akkoma, you may be inclined to collect metrics to ensure your instance is running smoothly,
+If you run akkoma, you may be inclined to collect metrics to ensure your instance is running smoothly,
 and that there's nothing quietly failing in the background.
 
-To facilitate this, Akkoma exposes Prometheus metrics to be scraped.
+To facilitate this, akkoma exposes a dashboard and prometheus metrics to be scraped.
 
 ## Prometheus
 
 See: [export\_prometheus\_metrics](../../configuration/cheatsheet#instance)
 
-To scrape Prometheus metrics, we need an oauth2 token with the `admin:metrics` scope.
+To scrape prometheus metrics, we need an oauth2 token with the `admin:metrics` scope.
 
-Consider using [constanze](https://akkoma.dev/AkkomaGang/constanze) to make this easier -
+consider using [constanze](https://akkoma.dev/AkkomaGang/constanze) to make this easier -
 
 ```bash
 constanze token --client-app --scopes "admin:metrics" --client-name "Prometheus"
 ```
 
-Or see `scripts/create_metrics_app.sh` in the source tree for the process to get this token.
+or see `scripts/create_metrics_app.sh` in the source tree for the process to get this token.
 
-Once you have your token of the form `Bearer $ACCESS_TOKEN`, you can use that in your Prometheus config:
+Once you have your token of the form `Bearer $ACCESS_TOKEN`, you can use that in your prometheus config:
 
 ```yaml
 - job_name: akkoma
@@ -31,3 +31,15 @@ Once you have your token of the form `Bearer $ACCESS_TOKEN`, you can use that in
   - targets:
     - example.com
 ```
+
+## Dashboard
+
+Administrators can access a live dashboard under `/phoenix/live_dashboard`
+giving an overview of uptime, software versions, database stats and more.
+
+The dashboard also includes a variation of the prometheus metrics, however
+they do not exactly match due to respective limitations of the dashboard
+and the prometheus exporter.
+Even more important, the dashboard collects metrics locally in the browser
+only while the page is open and cannot give a view on their past history.
+For proper monitoring it is recommended to set up prometheus.

docs/docs/administration/updating.md

@@ -20,13 +20,13 @@ su -s "$SHELL" akkoma
 # Download latest stable release
 ./bin/pleroma_ctl update --branch stable
 
-# Stop Akkoma
+# Stop akkoma
 ./bin/pleroma stop # or using the system service manager (e.g. systemctl stop akkoma)
 
 # Run database migrations
 ./bin/pleroma_ctl migrate
 
-# Start Akkoma
+# Start akkoma
 ./bin/pleroma daemon # or using the system service manager (e.g. systemctl start akkoma)
 
 # Update frontend(s). See Frontend Configuration doc for more information.
@@ -53,13 +53,13 @@ export MIX_ENV=prod
 mix deps.get
 mix compile
 
-# Stop Akkoma (replace with your system service manager's equivalent if different)
+# Stop akkoma (replace with your system service manager's equivalent if different)
 sudo systemctl stop akkoma
 
 # Run database migrations
 mix ecto.migrate
 
-# Start Akkoma (replace with your system service manager's equivalent if different)
+# Start akkoma (replace with your system service manager's equivalent if different)
 sudo systemctl start akkoma
 
 # Update Akkoma-FE frontend to latest stable. For other Frontends see Frontend Configuration doc for more information.

docs/docs/clients.md

@@ -1,12 +1,15 @@
 # Akkoma Clients
-!!! note
-    Additional clients may work, but these are known to work with Akkoma. Apps listed here might not support all of Akkoma's features.
+This is a list of clients that are known to work with Akkoma.
+
+!!! warning
+    **Clients listed here are not officially supported by the Akkoma project.**
+    Some Akkoma features may be unsupported by these clients.
 
 ## Multiplatform
 ### Kaiteki
 - Homepage: <https://kaiteki.app/>
 - Source Code: <https://github.com/Kaiteki-Fedi/Kaiteki>
-- Contact: [@kaiteki@fedi.software](https://fedi.software/@Kaiteki)
+- Contact: [@kaiteki@social.kaiteki.app](https://social.kaiteki.app/@kaiteki)
 - Platforms: Web, Windows, Linux, Android
 - Features: MastoAPI, Supports multiple backends
 
@@ -38,12 +41,6 @@
 - Platforms: Android
 - Features: MastoAPI, No Streaming, Emoji Reactions, Text Formatting, FE Stickers
 
-### Fedi
-- Homepage: <https://www.fediapp.com/>
-- Source Code: Proprietary, but gratis
-- Platforms: iOS, Android
-- Features: MastoAPI, Pleroma-specific features like Reactions
-
 ### Tusky
 - Homepage: <https://tuskyapp.github.io/>
 - Source Code: <https://github.com/tuskyapp/Tusky>
@@ -51,12 +48,18 @@
 - Platforms: Android
 - Features: MastoAPI, No Streaming
 
+### Subway Tooter
+- Source Code: <https://github.com/tateisu/SubwayTooter/>
+- Contact: [@SubwayTooter@mastodon.juggler.jp](https://mastodon.juggler.jp/@SubwayTooter)
+- Platforms: Android
+- Features: MastoAPI, Editing, Emoji Reactions (including custom emoji)
+
 ## Alternative Web Interfaces
-### Pinafore
-- Note: Pinafore is unmaintained (See [the author's original article](https://nolanlawson.com/2023/01/09/retiring-pinafore/) for details)
-- Homepage: <https://pinafore.social/>
-- Source Code: <https://github.com/nolanlawson/pinafore>
-- Contact: [@pinafore@mastodon.technology](https://mastodon.technology/users/pinafore)
+### Enafore
+- An actively developed fork of Pinafore with improved Akkoma support
+- Homepage: <https://enafore.social/>
+- Source Code: <https://github.com/enafore/enafore>
+- Contact: [@enfore@enafore.social](https://meta.enafore.social/@enafore)
 - Features: MastoAPI, No Streaming
 
 ### Sengi
@@ -72,5 +75,5 @@
 ### BloatFE
 - Source Code: <https://git.freesoftwareextremist.com/bloat/>
 - Contact: [@r@freesoftwareextremist.com](https://freesoftwareextremist.com/users/r)
-- Features: Does not require JavaScript
+- Features: Does not requires JavaScript
 - Features: MastoAPI

docs/docs/configuration/cheatsheet.md

@@ -2,9 +2,9 @@
 
 This is a cheat sheet for Akkoma configuration file, any setting possible to configure should be listed here.
 
-For OTP installations, the configuration is typically stored in `/etc/akkoma/config.exs`.
+For OTP installations the configuration is typically stored in `/etc/akkoma/config.exs`.
 
-For from source installations, Akkoma configuration works by first importing the base config `config/config.exs`, then overriding it by the environment config `config/$MIX_ENV.exs` and then overriding it by user config `config/$MIX_ENV.secret.exs`. In from source installations, you should always make the changes to the user config and NEVER to the base config to avoid breakages and merge conflicts. So, for production you change/add configuration to `config/prod.secret.exs`.
+For from source installations Akkoma configuration works by first importing the base config `config/config.exs`, then overriding it by the environment config `config/$MIX_ENV.exs` and then overriding it by user config `config/$MIX_ENV.secret.exs`. In from source installations you should always make the changes to the user config and NEVER to the base config to avoid breakages and merge conflicts. So for production you change/add configuration to `config/prod.secret.exs`.
 
 To add configuration to your config file, you can copy it from the base config. The latest version of it can be viewed [here](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/config/config.exs). You can also use this file if you don't know how an option is supposed to be formatted.
 
@@ -12,7 +12,7 @@ To add configuration to your config file, you can copy it from the base config.
 * `name`: The instance’s name.
 * `email`: Email used to reach an Administrator/Moderator of the instance.
 * `notify_email`: Email used for notifications.
-* `description`: The instance’s description, can be seen in nodeinfo and `/api/v1/instance`.
+* `description`: The instance’s description, can be seen in nodeinfo and ``/api/v1/instance``.
 * `limit`: Posts character limit (CW/Subject included in the counter).
 * `description_limit`: The character limit for image descriptions.
 * `remote_limit`: Hard character limit beyond which remote posts will be dropped.
@@ -35,9 +35,10 @@ To add configuration to your config file, you can copy it from the base config.
 * `allow_relay`: Permits remote instances to subscribe to all public posts of your instance. This may increase the visibility of your instance.
 * `public`: Allows unauthenticated access to public resources on your instance. This is essentially used as the default value for `:restrict_unauthenticated`. 
    See `restrict_unauthenticated` for more details.
-* `quarantined_instances`: *DEPRECATED* ActivityPub instances where activities will not be sent. They can still reach them via other means; we just won't send them.
+* `quarantined_instances`: *DEPRECATED* ActivityPub instances where activities will not be sent. They can still reach there via other means, we just won't send them.
 * `allowed_post_formats`: MIME-type list of formats allowed to be posted (transformed into HTML).
-* `extended_nickname_format`: Set to `true` to use extended local nicknames format (allows underscores/dashes). This will break federation with older software for these nicknames.
+* `extended_nickname_format`: Set to `true` to use extended local nicknames format (allows underscores/dashes). This will break federation with
+    older software for theses nicknames.
 * `max_pinned_statuses`: The maximum number of pinned statuses. `0` will disable the feature.
 * `autofollowed_nicknames`: Set to nicknames of (local) users that every new user should automatically follow.
 * `autofollowing_nicknames`: Set to nicknames of (local) users that automatically follows every newly registered user.
@@ -45,7 +46,7 @@ To add configuration to your config file, you can copy it from the base config.
 * `max_report_comment_size`: The maximum size of the report comment (Default: `1000`).
 * `safe_dm_mentions`: If set to true, only mentions at the beginning of a post will be used to address people in direct messages. This is to prevent accidental mentioning of people when talking about them (e.g. "@friend hey i really don't like @enemy"). Default: `false`.
 * `healthcheck`: If set to true, system data will be shown on ``/api/v1/pleroma/healthcheck``.
-* `remote_post_retention_days`: The default number of days to retain remote posts when pruning the database.
+* `remote_post_retention_days`: The default amount of days to retain remote posts when pruning the database.
 * `user_bio_length`: A user bio maximum length (default: `5000`).
 * `user_name_length`: A user name maximum length (default: `100`).
 * `skip_thread_containment`: Skip filter out broken threads. The default is `false`.
@@ -59,9 +60,11 @@ To add configuration to your config file, you can copy it from the base config.
 * `cleanup_attachments`: Remove attachments along with statuses. Does not affect duplicate files and attachments without status. Enabling this will increase load to database when deleting statuses on larger instances.
 * `show_reactions`: Let favourites and emoji reactions be viewed through the API (default: `true`).
 * `password_reset_token_validity`: The time after which reset tokens aren't accepted anymore, in seconds (default: one day).
-* `local_bubble`: Array of domains representing instances closely related to yours. Used to populate the `bubble` timeline. e.g. `["example.com"]`, (default: `[]`)
-* `languages`: List of Language Codes used by the instance. This is used to try and set a default language from the frontend. It will try and find the first match between the languages set here and the user's browser languages. It will default to the first language in this setting if there is no match. (default `["en"]`)
-* `export_prometheus_metrics`: Enable Prometheus metrics, served at `/api/v1/akkoma/metrics`, requiring the `admin:metrics` OAuth scope.
+* `local_bubble`: Array of domains representing instances closely related to yours. Used to populate the `bubble` timeline. e.g `["example.com"]`, (default: `[]`)
+* `languages`: List of Language Codes used by the instance. This is used to try and set a default language from the frontend. It will try and find the first match between the languages set here and the user's browser languages. It will default to the first language in this setting if there is no match.. (default `["en"]`)
+* `export_prometheus_metrics`: Enable prometheus metrics, served at `/api/v1/akkoma/metrics`, requiring the `admin:metrics` oauth scope.
+* `privileged_staff`: Set to `true` to give moderators access to a few higher responsibility actions.
+* `federated_timeline_available`: Set to `false` to remove access to the federated timeline for all users.
 
 ## :database
 * `improved_hashtag_timeline`: Setting to force toggle / force disable improved hashtags timeline. `:enabled` forces hashtags to be fetched from `hashtags` table for hashtags timeline. `:disabled` forces object-embedded hashtags to be used (slower). Keep it `:auto` for automatic behaviour (it is auto-set to `:enabled` [unless overridden] when HashtagsTableMigrator completes).
@@ -72,15 +75,15 @@ To add configuration to your config file, you can copy it from the base config.
 
 ## Welcome
 * `direct_message`: - welcome message sent as a direct message.
-  * `enabled`: Enables to send a direct message to a newly registered user. Defaults to `false`.
+  * `enabled`: Enables the send a direct message to a newly registered user. Defaults to `false`.
   * `sender_nickname`: The nickname of the local user that sends the welcome message.
-  * `message`: A message that will be sent to a newly registered users as a direct message.
-* `email`: - welcome message sent as an email.
-  * `enabled`: Enables to send a welcome email to a newly registered user. Defaults to `false`.
+  * `message`: A message that will be send to a newly registered users as a direct message.
+* `email`: - welcome message sent as a email.
+  * `enabled`: Enables the send a welcome email to a newly registered user. Defaults to `false`.
   * `sender`: The email address or tuple with `{nickname, email}` that will use as sender to the welcome email.
   * `subject`: A subject of welcome email.
-  * `html`: HTML that will be sent to a newly registered users as an email.
-  * `text`: A text that will be sent to a newly registered users as an email.
+  * `html`: A html that will be send to a newly registered users as a email.
+  * `text`: A text that will be send to a newly registered users as a email.
 
     Example:
 
@@ -103,31 +106,60 @@ To add configuration to your config file, you can copy it from the base config.
 ## Message rewrite facility
 
 ### :mrf
-* `policies`: Message Rewrite Policy, either one or a list. Here are the ones available by default:
-    * `Pleroma.Web.ActivityPub.MRF.NoOpPolicy`: Doesn’t modify activities (default).
-    * `Pleroma.Web.ActivityPub.MRF.DropPolicy`: Drops all activities. It generally doesn’t make sense to use in production.
-    * `Pleroma.Web.ActivityPub.MRF.SimplePolicy`: Restrict the visibility of activities from certain instances (See [`:mrf_simple`](#mrf_simple)).
-    * `Pleroma.Web.ActivityPub.MRF.TagPolicy`: Applies policies to individual users based on tags, which can be set using pleroma-fe/admin-fe/any other app that supports Pleroma Admin API. For example, it allows marking posts from individual users nsfw (sensitive).
-    * `Pleroma.Web.ActivityPub.MRF.SubchainPolicy`: Selectively runs other MRF policies when messages match (See [`:mrf_subchain`](#mrf_subchain)).
-    * `Pleroma.Web.ActivityPub.MRF.RejectNonPublic`: Drops posts with non-public visibility settings (See [`:mrf_rejectnonpublic`](#mrf_rejectnonpublic)).
-    * `Pleroma.Web.ActivityPub.MRF.EnsureRePrepended`: Rewrites posts to ensure that replies to posts with subjects do not have an identical subject and instead begin with re:.
-    * `Pleroma.Web.ActivityPub.MRF.AntiLinkSpamPolicy`: Rejects posts from likely spambots by rejecting posts from new users that contain links.
-    * `Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy`: Crawls attachments using their MediaProxy URLs so that the MediaProxy cache is primed.
-    * `Pleroma.Web.ActivityPub.MRF.MentionPolicy`: Drops posts mentioning configurable users. (See [`:mrf_mention`](#mrf_mention)).
-    * `Pleroma.Web.ActivityPub.MRF.VocabularyPolicy`: Restricts activities to a configured set of vocabulary. (See [`:mrf_vocabulary`](#mrf_vocabulary)).
-    * `Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy`: Rejects or delists posts based on their age when received. (See [`:mrf_object_age`](#mrf_object_age)).
-    * `Pleroma.Web.ActivityPub.MRF.ActivityExpirationPolicy`: Sets a default expiration on all posts made by users of the local instance. Requires `Pleroma.Workers.PurgeExpiredActivity` to be enabled for processing the scheduled delections.
-    * `Pleroma.Web.ActivityPub.MRF.ForceBotUnlistedPolicy`: Makes all bot posts to disappear from public timelines.
-    * `Pleroma.Web.ActivityPub.MRF.FollowBotPolicy`: Automatically follows newly discovered users from the specified bot account. Local accounts, locked accounts, and users with "#nobot" in their bio are respected and excluded from being followed.
-    * `Pleroma.Web.ActivityPub.MRF.AntiFollowbotPolicy`: Drops follow requests from followbots. Users can still allow bots to follow them by first following the bot.
-    * `Pleroma.Web.ActivityPub.MRF.KeywordPolicy`: Rejects or removes from the federated timeline or replaces keywords. (See [`:mrf_keyword`](#mrf_keyword)).
-    * `Pleroma.Web.ActivityPub.MRF.NormalizeMarkup`: Pass inbound HTML through a scrubber to make sure it doesn't have anything unusual in it. On by default, cannot be turned off.
-    * `Pleroma.Web.ActivityPub.MRF.InlineQuotePolicy`: Append a link to a post that quotes another post with the link to the quoted post, to ensure that software that does not understand quotes can have full context. On by default, cannot be turned off.
 * `transparency`: Make the content of your Message Rewrite Facility settings public (via nodeinfo).
 * `transparency_exclusions`: Exclude specific instance names from MRF transparency.  The use of the exclusions feature will be disclosed in nodeinfo as a boolean value.
 * `transparency_obfuscate_domains`: Show domains with `*` in the middle, to censor them if needed. For example, `ridingho.me` will show as `rid*****.me`
+* `policies`: Message Rewrite Policy, either one or a list. Here are the ones available by default:
+    * `Pleroma.Web.ActivityPub.MRF.NoOpPolicy`: Doesn’t modify activities (default).
+    * `Pleroma.Web.ActivityPub.MRF.DropPolicy`: Drops all activities. It generally doesn’t makes sense to use in production.
+    * `Pleroma.Web.ActivityPub.MRF.ActivityExpirationPolicy`: Sets a default expiration on all posts made by users of the local instance. Requires `Pleroma.Workers.PurgeExpiredActivity` to be enabled for processing the scheduled delections.
+      (See [`:mrf_activity_expiration`](#mrf_activity_expiration))
+    * `Pleroma.Web.ActivityPub.MRF.AntiFollowbotPolicy`: Drops follow requests from followbots. Users can still allow bots to follow them by first following the bot.
+    * `Pleroma.Web.ActivityPub.MRF.AntiLinkSpamPolicy`: Rejects posts from likely spambots by rejecting posts from new users that contain links.
+    * `Pleroma.Web.ActivityPub.MRF.EnsureRePrepended`: Rewrites posts to ensure that replies to posts with subjects do not have an identical subject and instead begin with re:.
+    * `Pleroma.Web.ActivityPub.MRF.ForceBotUnlistedPolicy`: Makes all bot posts to disappear from public timelines.
+    * `Pleroma.Web.ActivityPub.MRF.HellthreadPolicy`: Blocks messages with too many mentions.
+      (See [`mrf_hellthread`](#mrf_hellthread))
+    * `Pleroma.Web.ActivityPub.MRF.KeywordPolicy`: Rejects or removes from the federated timeline or replaces keywords. (See [`:mrf_keyword`](#mrf_keyword)).
+    * `Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy`: Crawls attachments using their MediaProxy URLs so that the MediaProxy cache is primed.
+    * `Pleroma.Web.ActivityPub.MRF.MentionPolicy`: Drops posts mentioning configurable users. (See [`:mrf_mention`](#mrf_mention)).
+    * `Pleroma.Web.ActivityPub.MRF.NoEmptyPolicy`: Drops local activities which have no actual content.
+       (e.g. no attachments and only consists of mentions)
+    * `Pleroma.Web.ActivityPub.MRF.NoPlaceholderTextPolicy`: Strips content placeholders from posts
+      (such as the dot from mastodon)
+    * `Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy`: Rejects or delists posts based on their age when received. (See [`:mrf_object_age`](#mrf_object_age)).
+    * `Pleroma.Web.ActivityPub.MRF.RejectNewlyCreatedAccountNotesPolicy`: Rejects posts of users the server only recently learned about for a while. Great to block spam accounts. (See [`:mrf_reject_newly_created_account_notes`](#mrf_reject_newly_created_account_notes))
+    * `Pleroma.Web.ActivityPub.MRF.RejectNonPublic`: Drops posts with non-public visibility settings (See [`:mrf_rejectnonpublic`](#mrf_rejectnonpublic)).
+    * `Pleroma.Web.ActivityPub.MRF.SimplePolicy`: Restrict the visibility of activities from certains instances (See [`:mrf_simple`](#mrf_simple)).
+    * `Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy`: Steals all eligible emoji encountered in posts from remote instances
+      (See [`:mrf_steal_emoji`](#mrf_steal_emoji))
+    * `Pleroma.Web.ActivityPub.MRF.SubchainPolicy`: Selectively runs other MRF policies when messages match (See [`:mrf_subchain`](#mrf_subchain)).
+    * `Pleroma.Web.ActivityPub.MRF.TagPolicy`: Applies policies to individual users based on tags, which can be set using pleroma-fe/admin-fe/any other app that supports Pleroma Admin API. For example it allows marking posts from individual users nsfw (sensitive).
+    * `Pleroma.Web.ActivityPub.MRF.UserAllowListPolicy`: Drops all posts except from users specified in a list.
+      (See [`:mrf_user_allowlist`](#mrf_user_allowlist))
+    * `Pleroma.Web.ActivityPub.MRF.VocabularyPolicy`: Restricts activities to a configured set of vocabulary. (See [`:mrf_vocabulary`](#mrf_vocabulary)).
+
+Additionally the following MRFs will *always* be aplied and cannot be disabled:
+
+* `Pleroma.Web.ActivityPub.MRF.DirectMessageDisabledPolicy`: Strips users limiting who can send them DMs from the recipients of non-eligible DMs
+* `Pleroma.Web.ActivityPub.MRF.HashtagPolicy`: Depending on a post’s hashtags it can be rejected, get its sensitive flags force-enabled or removed from the global timeline
+    (See [`:mrf_hashtag`](#mrf_hashtag))
+* `Pleroma.Web.ActivityPub.MRF.InlineQuotePolicy`: Append a link to a post that quotes another post with the link to the quoted post, to ensure that software that does not understand quotes can have full context.
+    (See [`:mrf_inline_quote`](#mrf_inline_quote))
+* `Pleroma.Web.ActivityPub.MRF.NormalizeMarkup`: Pass inbound HTML through a scrubber to make sure it doesn't have anything unusual in it.
+    (See [`:mrf_normalize_markup`](#mrf_normalize_markup))
+
 
 ## Federation
+### :activitypub
+* `unfollow_blocked`: Whether blocks result in people getting unfollowed
+* `outgoing_blocks`: Whether to federate blocks to other instances
+* `blockers_visible`: Whether a user can see the posts of users who blocked them
+* `deny_follow_blocked`: Whether to disallow following an account that has blocked the user in question
+* `sign_object_fetches`: Sign object fetches with HTTP signatures
+* `authorized_fetch_mode`: Require HTTP signatures for AP fetches
+* `max_collection_objects`: The maximum number of objects to fetch from a remote AP collection.
+
 ### MRF policies
 
 !!! note
@@ -135,14 +167,15 @@ To add configuration to your config file, you can copy it from the base config.
 
 #### :mrf_simple
 * `media_removal`: List of instances to strip media attachments from and the reason for doing so.
-* `media_nsfw`: List of instances to tag all media as NSFW (sensitive) from, and the reason for doing so.
+* `media_nsfw`: List of instances to tag all media as NSFW (sensitive) from and the reason for doing so.
 * `federated_timeline_removal`: List of instances to remove from the Federated Timeline (aka The Whole Known Network) and the reason for doing so.
-* `reject`: List of instances to reject activities (except deletes) from and the reason for doing so. Additionally, prevents activities from being sent to that instance.
-* `accept`: List of instances to only accept activities (except deletes) from, and the reason for doing so.
-* `followers_only`: Force posts from the given instances to be visible by followers only, and the reason for doing so.
+* `reject`: List of instances to reject activities (except deletes) from and the reason for doing so. Additionally prevents activities from being sent to that instance.
+* `accept`: List of instances to only accept activities (except deletes) from and the reason for doing so.
+* `followers_only`: Force posts from the given instances to be visible by followers only and the reason for doing so.
 * `report_removal`: List of instances to reject reports from and the reason for doing so.
 * `avatar_removal`: List of instances to strip avatars from and the reason for doing so.
 * `banner_removal`: List of instances to strip banners from and the reason for doing so.
+* `background_removal`: List of instances to strip user backgrounds from and the reason for doing so.
 * `reject_deletes`: List of instances to reject deletions from and the reason for doing so.
 
 #### :mrf_subchain
@@ -169,8 +202,8 @@ config :pleroma, :mrf_subchain,
 * `reject_threshold`: Number of mentioned users after which the messaged gets rejected. Set to 0 to disable.
 
 #### :mrf_keyword
-* `reject`: A list of patterns which result in a message being rejected, each pattern can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html).
-* `federated_timeline_removal`: A list of patterns which result in message being removed from federated timelines (a.k.a. unlisted), each pattern can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html).
+* `reject`: A list of patterns which result in message being rejected, each pattern can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html).
+* `federated_timeline_removal`: A list of patterns which result in message being removed from federated timelines (a.k.a unlisted), each pattern can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html).
 * `replace`: A list of tuples containing `{pattern, replacement}`, `pattern` can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html).
 
 #### :mrf_mention
@@ -205,7 +238,9 @@ config :pleroma, :mrf_user_allowlist, %{
 #### :mrf_steal_emoji
 * `hosts`: List of hosts to steal emojis from
 * `rejected_shortcodes`: Regex-list of shortcodes to reject
-* `size_limit`: File size limit (in bytes), checked before an emoji is saved to the disk
+* `size_limit`: File size limit (in bytes), checked before download if possible (and remote server honest),
+   otherwise or again checked before saving emoji to the disk
+* `download_unknown_size`: whether to download an emoji when the remote server doesn’t report its size in advance
 
 #### :mrf_activity_expiration
 
@@ -221,14 +256,24 @@ Notes:
 - The hashtags in the configuration do not have a leading `#`.
 - This MRF Policy is always enabled, if you want to disable it you have to set empty lists
 
-### :activitypub
-* `unfollow_blocked`: Whether blocks result in people getting unfollowed
-* `outgoing_blocks`: Whether to federate blocks to other instances
-* `blockers_visible`: Whether a user can see the posts of users who blocked them
-* `deny_follow_blocked`: Whether to disallow following an account that has blocked the user in question
-* `sign_object_fetches`: Sign object fetches with HTTP signatures
-* `authorized_fetch_mode`: Require HTTP signatures for AP fetches
-* `max_collection_objects`: The maximum number of objects to fetch from a remote AP collection.
+#### :mrf_reject_newly_created_account_notes
+After initially encountering an user, all their posts
+will be rejected for the configured time (in seconds).
+Only drops posts. Follows, reposts, etc. are not affected.
+
+* `age`: Time below which to reject (in seconds)
+
+An example: (86400 seconds = 24 hours)
+
+```elixir
+config :pleroma, :mrf_reject_newly_created_account_notes, age: 86400
+```
+
+#### :mrf_inline_quote
+* `prefix`: what prefix to prepend to quoted URLs
+
+#### :mrf_normalize_markup
+* `scrub_policy`: the scrubbing module to use (by default a built-in HTML sanitiser)
 
 ## Pleroma.User
 
@@ -266,7 +311,7 @@ These settings **need to be complete**, they will override the defaults.
 
 ### :frontends
 
-These settings tell Akkoma which frontend files to serve the user.
+These settings tell akkoma which frontend files to serve the user.
 
 See: [Frontend Management](../frontend_management)
 
@@ -293,7 +338,7 @@ config :pleroma, :frontends,
 
 * `:primary` - The frontend that will be served at `/`
 * `:admin` - The frontend that will be served at `/pleroma/admin`
-* `:swagger` - Config for developers to act as an API reference to be served at `/akkoma/swaggerui/` (trailing slash _needed_). Disabled by default.
+* `:swagger` - Config for developers to act as an API reference to be served at `/pleroma/swaggerui/` (trailing slash _needed_). Disabled by default.
 * `:mastodon` - The mastodon-fe configuration. This shouldn't need to be changed. This is served at `/web` when installed.
 
 ### :static\_fe
@@ -306,19 +351,19 @@ Available options:
 
 ### :assets
 
-This section configures assets to be used with various frontends. Currently, the only option
-relates to mascots on the Mastodon frontend
+This section configures assets to be used with various frontends. Currently the only option
+relates to mascots on the mastodon frontend
 
 * `mascots`: KeywordList of mascots, each element __MUST__ contain both a `url` and a
   `mime_type` key.
 * `default_mascot`: An element from `mascots` - This will be used as the default mascot
-  on Masto-fe (default: `:pleroma_fox_tan`).
+  on MastoFE (default: `:pleroma_fox_tan`).
 
 ### :manifest
 
-This section describes PWA manifest instance-specific values. Currently, this option relates only to Masto-fe.
+This section describe PWA manifest instance-specific values. Currently this option relate only for MastoFE.
 
-* `icons`: Describe the icons of the app, this is a list of maps describing icons in the same way as the
+* `icons`: Describe the icons of the app, this a list of maps describing icons in the same way as the
   [spec](https://www.w3.org/TR/appmanifest/#imageresource-and-its-members) describes it.
 
   Example:
@@ -347,7 +392,7 @@ This section describes PWA manifest instance-specific values. Currently, this op
 
 * `shortcode_globs`: Location of custom emoji files. `*` can be used as a wildcard. Example `["/emoji/custom/**/*.png"]`
 * `pack_extensions`: A list of file extensions for emojis, when no emoji.txt for a pack is present. Example `[".png", ".gif"]`
-* `groups`: Emojis are ordered in groups (tags). This is an array of key-value pairs, where the key is the group name and the value the location or array of locations. `*` can be used as a wildcard. Example `[Custom: ["/emoji/*.png", "/emoji/custom/*.png"]]`
+* `groups`: Emojis are ordered in groups (tags). This is an array of key-value pairs where the key is the groupname and the value the location or array of locations. `*` can be used as a wildcard. Example `[Custom: ["/emoji/*.png", "/emoji/custom/*.png"]]`
 * `default_manifest`: Location of the JSON-manifest. This manifest contains information about the emoji-packs you can download. Currently only one manifest can be added (no arrays).
 * `shared_pack_cache_seconds_per_file`: When an emoji pack is shared, the archive is created and cached in
   memory for this amount of seconds multiplied by the number of files.
@@ -355,16 +400,17 @@ This section describes PWA manifest instance-specific values. Currently, this op
 ## :media_proxy
 
 * `enabled`: Enables proxying of remote media to the instance’s proxy
-* `base_url`: The base URL to access a user-uploaded file. Useful when you want to proxy the media files via another host/CDN fronts.
+* `base_url`: The base URL to access a user-uploaded file.
+  Using a (sub)domain distinct from the instance endpoint is **strongly** recommended.
 * `proxy_opts`: All options defined in `Pleroma.ReverseProxy` documentation, defaults to `[max_body_length: (25*1_048_576)]`.
-* `whitelist`: List of hosts with scheme to bypass the media proxy (e.g. `https://example.com`)
+* `whitelist`: List of hosts with scheme to bypass the mediaproxy (e.g. `https://example.com`)
 * `invalidation`: options for remove media from cache after delete object:
   * `enabled`: Enables purge cache
-  * `provider`: Which one of the [purge cache strategies](#purge-cache-strategy) to use.
+  * `provider`: Which one of  the [purge cache strategy](#purge-cache-strategy) to use.
 
 ## :media_preview_proxy
 
-* `enabled`: Enables proxying of remote media preview to the instance’s proxy. Requires media proxy to be enabled (`media_proxy/enabled`).
+* `enabled`: Enables proxying of remote media preview to the instance’s proxy. Requires enabled media proxy (`media_proxy/enabled`).
 * `thumbnail_max_width`: Max width of preview thumbnail for images (video preview always has original dimensions).
 * `thumbnail_max_height`: Max height of preview thumbnail for images (video preview always has original dimensions).
 * `image_quality`: Quality of the output. Ranges from 0 (min quality) to 100 (max quality).
@@ -374,8 +420,8 @@ This section describes PWA manifest instance-specific values. Currently, this op
 
 #### Pleroma.Web.MediaProxy.Invalidation.Script
 
-This strategy allows performing an external shell script to purge cache.
-URLs of attachments are passed to the script as arguments.
+This strategy allow perform external shell script to purge cache.
+Urls of attachments are passed to the script as arguments.
 
 * `script_path`: Path to the external script.
 * `url_format`: Set to `:htcacheclean` if using Apache's htcacheclean utility.
@@ -389,10 +435,10 @@ config :pleroma, Pleroma.Web.MediaProxy.Invalidation.Script,
 
 #### Pleroma.Web.MediaProxy.Invalidation.Http
 
-This strategy allows performing a custom HTTP request to purge cache.
+This strategy allow perform custom http request to purge cache.
 
-* `method`: HTTP method. Default is `purge`
-* `headers`: HTTP headers.
+* `method`: http method. default is `purge`
+* `headers`: http headers.
 * `options`: request options.
 
 Example:
@@ -409,12 +455,12 @@ config :pleroma, Pleroma.Web.MediaProxy.Invalidation.Http,
 * `providers`: a list of metadata providers to enable. Providers available:
     * `Pleroma.Web.Metadata.Providers.OpenGraph`
     * `Pleroma.Web.Metadata.Providers.TwitterCard`
-* `unfurl_nsfw`: If set to `true` NSFW attachments will be shown in previews.
+* `unfurl_nsfw`: If set to `true` nsfw attachments will be shown in previews.
 
 ### :rich_media (consumer)
-* `enabled`: if enabled, the instance will parse metadata from attached links to generate link previews.
-* `ignore_hosts`: list of hosts which will be ignored by the metadata parser. For example, `["accounts.google.com", "xss.website"]`, defaults to `[]`.
-* `ignore_tld`: list of TLDs (top-level domains) which will be ignored by the metadata parser. Default is ["local", "localdomain", "lan"].
+* `enabled`: if enabled the instance will parse metadata from attached links to generate link previews.
+* `ignore_hosts`: list of hosts which will be ignored by the metadata parser. For example `["accounts.google.com", "xss.website"]`, defaults to `[]`.
+* `ignore_tld`: list TLDs (top-level domains) which will ignore for parse metadata. default is ["local", "localdomain", "lan"].
 * `parsers`: list of Rich Media parsers.
 * `failure_backoff`: Amount of milliseconds after request failure, during which the request will not be retried.
 
@@ -425,12 +471,12 @@ config :pleroma, Pleroma.Web.MediaProxy.Invalidation.Http,
 !!! note
     `Phoenix` endpoint configuration, all configuration options can be viewed [here](https://hexdocs.pm/phoenix/Phoenix.Endpoint.html#module-dynamic-configuration), only common options are listed here.
 
-* `http` - a list containing HTTP protocol configuration, all configuration options can be viewed [here](https://hexdocs.pm/plug_cowboy/Plug.Cowboy.html#module-options), only common options are listed here. For deployment using Docker, you need to set this to `[ip: {0,0,0,0}, port: 4000]` to make Akkoma accessible from other containers (such as your NGINX server).
+* `http` - a list containing http protocol configuration, all configuration options can be viewed [here](https://hexdocs.pm/plug_cowboy/Plug.Cowboy.html#module-options), only common options are listed here. For deployment using docker, you need to set this to `[ip: {0,0,0,0}, port: 4000]` to make akkoma accessible from other containers (such as your nginx server).
   - `ip` - a tuple consisting of 4 integers
   - `port`
-* `url` - a list containing the configuration for generating URLs, accepts
-  - `host` - the host without the scheme and a post (e.g. `example.com`, not `https://example.com:2020`)
-  - `scheme` - e.g. `http`, `https`
+* `url` - a list containing the configuration for generating urls, accepts
+  - `host` - the host without the scheme and a post (e.g `example.com`, not `https://example.com:2020`)
+  - `scheme` - e.g `http`, `https`
   - `port`
   - `path`
 * `extra_cookie_attrs` - a list of `Key=Value` strings to be added as non-standard cookie attributes. Defaults to `["SameSite=Lax"]`. See the [SameSite article](https://www.owasp.org/index.php/SameSite) on OWASP for more info.
@@ -445,14 +491,14 @@ config :pleroma, Pleroma.Web.Endpoint,
   ]
 ```
 
-This will make Akkoma listen on `127.0.0.1` port `8080` and generate URLs starting with `https://example.com:2020`
+This will make Akkoma listen on `127.0.0.1` port `8080` and generate urls starting with `https://example.com:2020`
 
 ### :http_security
 * ``enabled``: Whether the managed content security policy is enabled.
 * ``sts``: Whether to additionally send a `Strict-Transport-Security` header.
 * ``sts_max_age``: The maximum age for the `Strict-Transport-Security` header if sent.
 * ``referrer_policy``: The referrer policy to use, either `"same-origin"` or `"no-referrer"`.
-* ``report_uri``: Adds the specified URL to `report-uri` and `report-to` group in CSP header.
+* ``report_uri``: Adds the specified url to `report-uri` and `report-to` group in CSP header.
 
 ### Pleroma.Web.Plugs.RemoteIp
 
@@ -465,18 +511,19 @@ Available options:
 
 * `enabled` - Enable/disable the plug. Defaults to `false`.
 * `headers` - A list of strings naming the HTTP headers to use when deriving the true client IP address. Defaults to `["x-forwarded-for"]`.
-* `proxies` - A list of upstream proxy IP subnets in CIDR notation, from which we will parse the content of `headers`. Defaults to `[]`. IPv4 entries without a bitmask will be assumed to be /32 and IPv6 /128.
+* `proxies` - A list of upstream proxy IP subnets in CIDR notation from which we will parse the content of `headers`. Defaults to `[]`. IPv4 entries without a bitmask will be assumed to be /32 and IPv6 /128.
 * `reserved` - A list of reserved IP subnets in CIDR notation which should be ignored if found in `headers`. Defaults to `["127.0.0.0/8", "::1/128", "fc00::/7", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]`.
 
+
 ### :rate_limit
 
 !!! note
-   If your instance is behind a reverse proxy, ensure [`Pleroma.Web.Plugs.RemoteIp`](#pleroma-plugs-remoteip) is enabled (it is enabled by default).
+   If your instance is behind a reverse proxy ensure [`Pleroma.Web.Plugs.RemoteIp`](#pleroma-plugs-remoteip) is enabled (it is enabled by default).
 
-A keyword list of rate limiters, where a key is a limiter name and value is the limiter configuration. The basic configuration is a tuple where:
+A keyword list of rate limiters where a key is a limiter name and value is the limiter configuration. The basic configuration is a tuple where:
 
-* The first element: `scale` (Integer). The timescale in milliseconds.
-* The second element: `limit` (Integer). How many requests to limit in the timescale provided.
+* The first element: `scale` (Integer). The time scale in milliseconds.
+* The second element: `limit` (Integer). How many requests to limit in the time scale provided.
 
 It is also possible to have different limits for unauthenticated and authenticated users: the keyword value must be a list of two tuples where the first one is a config for unauthenticated users and the second one is for authenticated.
 
@@ -491,18 +538,18 @@ config :pleroma, :rate_limit,
 Means that:
 
 1. In 60 seconds, 15 authentication attempts can be performed from the same IP address.
-2. In 1 second, 10 search requests can be performed from the same IP address by unauthenticated users, while authenticated users can perform 30 search requests per second.
+2. In 1 second, 10 search requests can be performed from the same IP adress by unauthenticated users, while authenticated users can perform 30 search requests per second.
 
 Supported rate limiters:
 
 * `:search` - Account/Status search.
-* `:timeline` - Timeline requests (each timeline has its own limiter).
+* `:timeline` - Timeline requests (each timeline has it's own limiter).
 * `:app_account_creation` - Account registration from the API.
 * `:relations_actions` - Following/Unfollowing in general.
 * `:relation_id_action` - Following/Unfollowing for a specific user.
 * `:statuses_actions` - Status actions such as: (un)repeating, (un)favouriting, creating, deleting.
 * `:status_id_action` - (un)Repeating/(un)Favouriting a particular status.
-* `:authentication` - Authentication actions, i.e. getting an OAuth token.
+* `:authentication` - Authentication actions, i.e getting an OAuth token.
 * `:password_reset` - Requesting password reset emails.
 * `:account_confirmation_resend` - Requesting resending account confirmation emails.
 * `:ap_routes` - Requesting statuses via ActivityPub.
@@ -555,9 +602,9 @@ the source code is here: [kocaptcha](https://github.com/koto-bank/kocaptcha). Th
 
 * `uploader`: Which one of the [uploaders](#uploaders) to use.
 * `filters`: List of [upload filters](#upload-filters) to use.
-* `link_name`: When enabled, Akkoma will add a `name` parameter to the URL of the upload, for example `https://instance.tld/media/corndog.png?name=corndog.png`. This is needed to provide the correct filename in Content-Disposition headers when using filters like `Pleroma.Upload.Filter.Dedupe`
-* `base_url`: The base URL to access a user-uploaded file. Useful when you want to host the media files via another domain or are using a 3rd party S3 provider.
-* `proxy_remote`: If you're using a remote uploader, Akkoma will proxy media requests instead of redirecting to it.
+* `link_name`: When enabled Akkoma will add a `name` parameter to the url of the upload, for example `https://instance.tld/media/corndog.png?name=corndog.png`. This is needed to provide the correct filename in Content-Disposition headers
+* `base_url`: The base URL to access a user-uploaded file; MUST be configured explicitly.
+  Using a (sub)domain distinct from the instance endpoint is **strongly** recommended. A good value might be `https://media.myakkoma.instance/media/`. 
 * `proxy_opts`: Proxy options, see `Pleroma.ReverseProxy` documentation.
 * `filename_display_max_length`: Set max length of a filename to display. 0 = no limit. Default: 30.
 
@@ -568,7 +615,7 @@ the source code is here: [kocaptcha](https://github.com/koto-bank/kocaptcha). Th
 
 #### Pleroma.Uploaders.Local
 
-* `uploads`: Which directory to store the user-uploads in, relative to Akkoma’s working directory.
+* `uploads`: Which directory to store the user-uploads in, relative to pleroma’s working directory.
 
 #### Pleroma.Uploaders.S3
 
@@ -596,20 +643,29 @@ config :ex_aws, :s3,
 
 ### Upload filters
 
+#### Pleroma.Upload.Filter.Dedupe
+
+**Always** active; cannot be turned off.
+Renames files to their hash and prevents duplicate files filling up the disk.
+No specific configuration.
+
 #### Pleroma.Upload.Filter.AnonymizeFilename
 
-This filter replaces the filename (not the path) of an upload. For complete obfuscation, add
-`Pleroma.Upload.Filter.Dedupe` before AnonymizeFilename.
+This filter replaces the declared filename (not the path) of an upload.
 
 * `text`: Text to replace filenames in links. If empty, `{random}.extension` will be used. You can get the original filename extension by using `{extension}`, for example `custom-file-name.{extension}`.
 
-#### Pleroma.Upload.Filter.Dedupe
+#### Pleroma.Upload.Filter.Exiftool.StripMetadata
 
-No specific configuration.
+This filter strips metadata with Exiftool leaving color profiles and orientation intact.
 
-#### Pleroma.Upload.Filter.Exiftool
+* `purge`: List of Exiftool tag names or tag group names to purge
+* `preserve`: List of Exiftool tag names or tag group names to preserve even if they occur in the purge list
 
-This filter only strips the GPS and location metadata with ExifTool leaving color profiles and attributes intact.
+
+#### Pleroma.Upload.Filter.Exiftool.ReadDescription
+
+This filter reads the ImageDescription and iptc:Caption-Abstract fields with Exiftool so clients can prefill the media description field.
 
 No specific configuration.
 
@@ -621,16 +677,16 @@ No specific configuration.
 
 #### Pleroma.Upload.Filter.Mogrify
 
-* `args`: List of actions for the `mogrify` command, like `"strip"` or `["strip", "auto-orient", {"implode", "1"}]`.
+* `args`: List of actions for the `mogrify` command like `"strip"` or `["strip", "auto-orient", {"implode", "1"}]`.
 
 ## Email
 
 ### Pleroma.Emails.Mailer
-* `adapter`: One of the mail adapters listed in [Swoosh README](https://github.com/swoosh/swoosh#adapters), or `Swoosh.Adapters.Local` for in-memory mailbox.
+* `adapter`: one of the mail adapters listed in [Swoosh readme](https://github.com/swoosh/swoosh#adapters), or `Swoosh.Adapters.Local` for in-memory mailbox.
 * `api_key` / `password` and / or other adapter-specific settings, per the above documentation.
-* `enabled`: Allows your instance to send emails. Default: `false`.
+* `enabled`: Allows enable/disable send  emails. Default: `false`.
 
-An example for SendGrid adapter:
+An example for Sendgrid adapter:
 
 ```elixir
 config :pleroma, Pleroma.Emails.Mailer,
@@ -672,7 +728,7 @@ Email notifications settings.
 
 ### Pleroma.Emails.NewUsersDigestEmail
 
-- `:enabled` - a boolean, enables new users' admin digest email when `true`. Defaults to `false`.
+- `:enabled` - a boolean, enables new users admin digest email when `true`. Defaults to `false`.
 
 ## Background jobs
 
@@ -680,7 +736,7 @@ Email notifications settings.
 
 [Oban](https://github.com/sorentwo/oban) asynchronous job processor configuration.
 
-Configuration options described in [Oban README](https://github.com/sorentwo/oban#usage):
+Configuration options described in [Oban readme](https://github.com/sorentwo/oban#usage):
 
 * `repo` - app's Ecto repo (`Pleroma.Repo`)
 * `log` - logs verbosity
@@ -767,7 +823,7 @@ config :logger, :ex_syslogger,
   level: :warn
 ```
 
-Another example, keeping console output and adding the PID to syslog output:
+Another example, keeping console output and adding the pid to syslog output:
 ```elixir
 config :logger,
   backends: [:console, {ExSyslogger, :ex_syslogger}]
@@ -804,7 +860,7 @@ RUM indexes are an alternative indexing scheme that is not included in PostgreSQ
 
 Their advantage over the standard GIN indexes is that they allow efficient ordering of search results by timestamp, which makes search queries a lot faster on larger servers, by one or two orders of magnitude. They take up around 3 times as much space as GIN indexes.
 
-To enable them, both the `rum_enabled` flag has to be set, and the following special migration has to be run:
+To enable them, both the `rum_enabled` flag has to be set and the following special migration has to be run:
 
 `mix ecto.migrate --migrations-path priv/repo/optional_migrations/rum_indexing/`
 
@@ -814,7 +870,7 @@ This will probably take a long time.
 
 ### :admin_token
 
-Allows to set a token that can be used to authenticate with the admin API without using an actual user by giving it as the `admin_token` parameter or `x-admin-token` HTTP header. Example:
+Allows to set a token that can be used to authenticate with the admin api without using an actual user by giving it as the `admin_token` parameter or `x-admin-token` HTTP header. Example:
 
 ```elixir
 config :pleroma, :admin_token, "somerandomtoken"
@@ -832,15 +888,14 @@ or
 curl -H "X-Admin-Token: somerandomtoken" "http://localhost:4000/api/v1/pleroma/admin/users/invites"
 ```
 
-!!! warning
-    It's discouraged to use this feature because of the associated security risk: static / rarely changed instance-wide token is much weaker compared to email-password pair of a real admin user; consider using HTTP Basic Auth or OAuth-based authentication instead.
+Warning: it's discouraged to use this feature because of the associated security risk: static / rarely changed instance-wide token is much weaker compared to email-password pair of a real admin user; consider using HTTP Basic Auth or OAuth-based authentication instead.
 
 ### :auth
 
 Authentication / authorization settings.
 
-* `auth_template`: authentication form template. By default, it's `show.html` which corresponds to `lib/pleroma/web/templates/o_auth/o_auth/show.html.eex`.
-* `oauth_consumer_template`: OAuth consumer mode authentication form template. By default, it's `consumer.html` which corresponds to `lib/pleroma/web/templates/o_auth/o_auth/consumer.html.eex`.
+* `auth_template`: authentication form template. By default it's `show.html` which corresponds to `lib/pleroma/web/templates/o_auth/o_auth/show.html.eex`.
+* `oauth_consumer_template`: OAuth consumer mode authentication form template. By default it's `consumer.html` which corresponds to `lib/pleroma/web/templates/o_auth/o_auth/consumer.html.eex`.
 * `oauth_consumer_strategies`: the list of enabled OAuth consumer strategies; by default it's set by `OAUTH_CONSUMER_STRATEGIES` environment variable. Each entry in this space-delimited string should be of format `<strategy>` or `<strategy>:<dependency>` (e.g. `twitter` or `keycloak:ueberauth_keycloak_strategy` in case dependency is named differently than `ueberauth_<strategy>`).
 
 ### Pleroma.Web.Auth.Authenticator
@@ -853,8 +908,8 @@ Authentication / authorization settings.
 Use LDAP for user authentication.  When a user logs in to the Akkoma
 instance, the name and password will be verified by trying to authenticate
 (bind) to an LDAP server.  If a user exists in the LDAP directory but there
-is no account with the same name yet on the Akkoma instance, then a new
-Akkoma account will be created with the same name as the LDAP username.
+is no account with the same name yet on the Akkoma instance then a new
+Akkoma account will be created with the same name as the LDAP user name.
 
 * `enabled`: enables LDAP authentication
 * `host`: LDAP server hostname
@@ -875,20 +930,20 @@ OAuth 2.0 provider settings:
 
 * `token_expires_in` - The lifetime in seconds of the access token.
 * `issue_new_refresh_token` - Keeps old refresh token or generate new refresh token when to obtain an access token.
-* `clean_expired_tokens` - Enable a background job to clean expired OAuth tokens. Defaults to `false`.
+* `clean_expired_tokens` - Enable a background job to clean expired oauth tokens. Defaults to `false`.
 
 OAuth 2.0 provider and related endpoints:
 
-* `POST /api/v1/apps` creates client app basing on provided parameters.
+* `POST /api/v1/apps` creates client app basing on provided params.
 * `GET/POST /oauth/authorize` renders/submits authorization form.
 * `POST /oauth/token` creates/renews OAuth token.
 * `POST /oauth/revoke` revokes provided OAuth token.
-* `GET /api/v1/accounts/verify_credentials` (with proper `Authorization` header or `access_token` URI parameter) returns user info on requester (with `acct` field containing local nickname and `fqn` field containing fully-qualified nickname which could generally be used as email stub for OAuth software that demands email field in identity endpoint response, like Peertube).
+* `GET /api/v1/accounts/verify_credentials` (with proper `Authorization` header or `access_token` URI param) returns user info on requester (with `acct` field containing local nickname and `fqn` field containing fully-qualified nickname which could generally be used as email stub for OAuth software that demands email field in identity endpoint response, like Peertube).
 
-### OAuth's consumer mode
+### OAuth consumer mode
 
-OAuth's consumer mode allows sign in / sign up via external OAuth providers (e.g. Twitter, Facebook, Google, Microsoft, etc.).
-Implementation is based on Überauth; see the list of [available strategies](https://github.com/ueberauth/ueberauth/wiki/List-of-Strategies).
+OAuth consumer mode allows sign in / sign up via external OAuth providers (e.g. Twitter, Facebook, Google, Microsoft, etc.).
+Implementation is based on Ueberauth; see the list of [available strategies](https://github.com/ueberauth/ueberauth/wiki/List-of-Strategies).
 
 !!! note
     Each strategy is shipped as a separate dependency; in order to get the strategies, run `OAUTH_CONSUMER_STRATEGIES="..." mix deps.get`, e.g. `OAUTH_CONSUMER_STRATEGIES="twitter facebook google microsoft" mix deps.get`.  The server should also be started with `OAUTH_CONSUMER_STRATEGIES="..." mix phx.server` in case you enable any strategies.
@@ -897,7 +952,7 @@ Implementation is based on Überauth; see the list of [available strategies](htt
     Each strategy requires separate setup (on external provider side and Akkoma side). Below are the guidelines on setting up most popular strategies.
 
 !!! note
-    Make sure that `"SameSite=Lax"` is set in `extra_cookie_attrs` when you have this feature enabled. OAuth's consumer mode will not work with `"SameSite=Strict"`
+    Make sure that `"SameSite=Lax"` is set in `extra_cookie_attrs` when you have this feature enabled. OAuth consumer mode will not work with `"SameSite=Strict"`
 
 * For Twitter, [register an app](https://developer.twitter.com/en/apps), configure callback URL to https://<your_host>/oauth/twitter/callback
 
@@ -907,7 +962,7 @@ Implementation is based on Überauth; see the list of [available strategies](htt
 
 * For Microsoft, [register an app](https://portal.azure.com), configure callback URL to https://<your_host>/oauth/microsoft/callback
 
-Once the app is configured on external OAuth provider side, add app's credentials and strategy-specific settings (if any — e.g., see Microsoft below) to `config/prod.secret.exs`,
+Once the app is configured on external OAuth provider side, add app's credentials and strategy-specific settings (if any — e.g. see Microsoft below) to `config/prod.secret.exs`,
 per strategy's documentation (e.g. [ueberauth_twitter](https://github.com/ueberauth/ueberauth_twitter)). Example config basing on environment variables:
 
 ```elixir
@@ -957,10 +1012,19 @@ config :ueberauth, Ueberauth,
   ]
 ```
 
+You may also need to set up your frontend to use oauth logins. For example, for `akkoma-fe`:
+
+```elixir
+config :pleroma, :frontend_configurations,
+  pleroma_fe: %{
+    loginMethod: "token"
+  }
+```
+
 ## Link parsing
 
 ### :uri_schemes
-* `valid_schemes`: List of the scheme part that is considered valid to be a URL.
+* `valid_schemes`: List of the scheme part that is considered valid to be an URL.
 
 ### Pleroma.Formatter
 
@@ -969,10 +1033,10 @@ Configuration for Akkoma's link formatter which parses mentions, hashtags, and U
 * `class` - specify the class to be added to the generated link (default: `false`)
 * `rel` - specify the rel attribute (default: `ugc`)
 * `new_window` - adds `target="_blank"` attribute (default: `false`)
-* `truncate` - Set to a number to truncate URLs longer than the number. Truncated URLs will end in `...` (default: `false`)
+* `truncate` - Set to a number to truncate URLs longer then the number. Truncated URLs will end in `...` (default: `false`)
 * `strip_prefix` - Strip the scheme prefix (default: `false`)
-* `extra` - link URLs with rarely used schemes (magnet, IPFS, IRC, etc.) (default: `true`)
-* `validate_tld` - Set to false to disable TLD validation for URLs/emails. Can be set to :no_scheme to validate TLDs only for URLs without a scheme (e.g. `example.com` will be validated, but `http://example.loki` won't) (default: `:no_scheme`)
+* `extra` - link URLs with rarely used schemes (magnet, ipfs, irc, etc.) (default: `true`)
+* `validate_tld` - Set to false to disable TLD validation for URLs/emails. Can be set to :no_scheme to validate TLDs only for urls without a scheme (e.g `example.com` will be validated, but `http://example.loki` won't) (default: `:no_scheme`)
 
 Example:
 
@@ -1008,7 +1072,7 @@ git clone <MY MODULE>
 
 ## :configurable_from_database
 
-Boolean, enables/disables in-database configuration. Read [Transferring the config to/from the database](../administration/CLI_tasks/config.md) for more information.
+Boolean, enables/disables in-database configuration. Read [Transfering the config to/from the database](../administration/CLI_tasks/config.md) for more information.
 
 ## :database_config_whitelist
 
@@ -1058,13 +1122,12 @@ Turning any of the `:restrict_unauthenticated` options to `true` will restrict a
 
 #### When :instance, :public is `false`
 
-When `:instance, :public` is set to `false`, all the `:restrict_unauthenticated` options will effectively be set to `true` by default,
+When `:instance, :public` is set to `false`, all of the `:restrict_unauthenticated` options will effectively be set to `true` by default,
 meaning that only authenticated users will be able to access the corresponding resources.
 
 If you'd like to allow unauthenticated access to specific resources, you can turn these settings to `false`.
 
-!!! note
-    Setting `restrict_unauthenticated/timelines/local` to `true` has no practical sense if `restrict_unauthenticated/timelines/federated` is set to `false` (since local public activities will still be delivered to unauthenticated users as part of federated timeline).
+**Note**: setting `restrict_unauthenticated/timelines/local` to `true` has no practical sense if `restrict_unauthenticated/timelines/federated` is set to `false` (since local public activities will still be delivered to unauthenticated users as part of federated timeline).
 
 ## Pleroma.Web.ApiSpec.CastAndValidate
 
@@ -1081,7 +1144,7 @@ Control favicons for instances.
 !!! note
     Requires enabled email
 
-* `:purge_after_days` an integer, remove backup archives after N days.
+* `:purge_after_days` an integer, remove backup achives after N days.
 * `:limit_days` an integer, limit user to export not more often than once per N days.
 * `:dir` a string with a path to backup temporary directory or `nil` to let Akkoma choose temporary directory in the following order:
     1. the directory named by the TMPDIR environment variable
@@ -1093,14 +1156,14 @@ Control favicons for instances.
 ### Theme settings
 
 Settings to change theme as exposed to the outside world, for software
-that scans `index.html` (mainly Misskey)
+that scans `index.html` (mainly misskey)
 
 ```
 config :pleroma, Pleroma.Web.Metadata.Providers.Theme, theme_color: "#593196"
 ```
 
 This sets the `theme-color` meta tag on `index.html`, and is basically
-a hack to make Misskey find the right thing.
+a hack to make misskey find the right thing.
 
 ## Ephemeral activities (Pleroma.Workers.PurgeExpiredActivity)
 
@@ -1118,7 +1181,7 @@ Settings to restrict concurrently running jobs. Jobs which can be configured:
 
 Each job has these settings:
 
-* `:max_running` - max concurrently running jobs
+* `:max_running` - max concurrently runnings jobs
 * `:max_waiting` - max waiting jobs
 
 ### Translation Settings
@@ -1127,7 +1190,7 @@ Settings to automatically translate statuses for end users. Currently supported
 translation services are DeepL and LibreTranslate. The supported command line tool is [Argos Translate](https://github.com/argosopentech/argos-translate).
 
 Translations are available at `/api/v1/statuses/:id/translations/:language`, where
-`language` is the target language code (e.g., `en`)
+`language` is the target language code (e.g `en`)
 
 ### `:translator`
 

docs/docs/configuration/custom_emoji.md

@@ -46,7 +46,7 @@ config :pleroma, :emoji,
   ]
 ```
 
-Order of the `groups` matters, so to override default tags, just put your group on top of the list. E.g:
+Order of the `groups` matters, so to override default tags just put your group on top of the list. E.g:
 ```elixir
 config :pleroma, :emoji,
   shortcode_globs: ["/emoji/custom/**/*.png"],
@@ -74,7 +74,7 @@ Managing your emoji can be hard work, and you just want to have the cool emoji y
 
 You can use the `Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy` [Message Rewrite Facility](../configuration/cheatsheet.md#mrf) to automatically add to your instance emoji that messages from specific servers contain. Note that this happens on message processing, so the emoji will be added only after your instance receives some interaction containing emoji _after_ configuring this.
 
-To activate this, you have to [configure](../configuration/cheatsheet.md#mrf_steal_emoji) it in your configuration file. For example if you wanted to steal any emoji that is not related to cinnamon and not larger than about 10K from `coolemoji.space` and `spiceenthusiasts.biz`, you would add the following:
+To activate this you have to [configure](../configuration/cheatsheet.md#mrf_steal_emoji) it in your configuration file. For example if you wanted to steal any emoji that is not related to cinnamon and not larger than about 10K from `coolemoji.space` and `spiceenthusiasts.biz`, you would add the following:
 ```elixir
 config :pleroma, :mrf,
   policies: [

docs/docs/configuration/frontend_management.md

@@ -2,7 +2,7 @@
 
 Frontends in Akkoma are swappable, you can pick which you'd like.
 
-For a basic setup, you can set a frontend for the key `primary` and `admin` and the options of `name` and `ref`. This will then make Akkoma serve the frontend from a folder constructed by concatenating the instance static path, `frontends` and the name and ref.
+For a basic setup, you can set a frontends for the key `primary` and `admin` and the options of `name` and `ref`. This will then make Akkoma serve the frontend from a folder constructed by concatenating the instance static path, `frontends` and the name and ref.
 
 The key `primary` refers to the frontend that will be served by default for general requests. The key `admin` refers to the frontend that will be served at the `/pleroma/admin` path.
 
@@ -34,17 +34,17 @@ If you choose not to install a frontend for whatever reason, it is recommended t
 
 You can also replace the default "no frontend" page by placing an `index.html` file under your `instance/static/` directory.
 
-## Masto-fe
+## Mastodon-FE
 
-Akkoma supports both [glitch-soc](https://github.com/glitch-soc/mastodon)'s more "vanilla" mastodon frontend,
+Akkoma supports both [glitchsoc](https://github.com/glitch-soc/mastodon)'s more "vanilla" mastodon frontend,
 as well as [fedibird](https://github.com/fedibird/mastodon)'s extended frontend which has near-feature-parity with akkoma (with quoting and reactions).
 
 To enable either one, you must run the `frontend.install` task for either `mastodon-fe` or `fedibird-fe` (both `--ref akkoma`), then make sure
 `:pleroma, :frontends, :mastodon` references the one you want.
 
-## Swagger (OpenAPI) documentation viewer
+## Swagger (openAPI) documentation viewer
 
-If you're a developer, and you'd like a human-readable rendering of the
+If you're a developer and you'd like a human-readable rendering of the
 API documentation, you can enable [Swagger UI](https://github.com/swagger-api/swagger-ui).
 
 In your config:
@@ -60,4 +60,4 @@ config :pleroma, :frontends,
 
 Then run the [pleroma.frontend cli task](../../administration/CLI_tasks/frontend) with the name of `swagger-ui` to install the distribution files.
 
-You will now be able to view documentation at `/akkoma/swaggerui`
+You will now be able to view documentation at `/pleroma/swaggerui`

docs/docs/configuration/hardening.md

@@ -17,6 +17,16 @@ This sets the Akkoma application server to only listen to the localhost interfac
 
 This sets the `secure` flag on Akkoma’s session cookie. This makes sure, that the cookie is only accepted over encrypted HTTPs connections. This implicitly renames the cookie from `pleroma_key` to `__Host-pleroma-key` which enforces some restrictions. (see [cookie prefixes](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#Cookie_prefixes))
 
+### `Pleroma.Upload, :uploader, :base_url`
+
+> Recommended value: *anything on a different domain than the instance endpoint; e.g. https://media.myinstance.net/*
+
+Uploads are user controlled and (unless you’re running a true single-user
+instance) should therefore not be considered trusted. But the domain is used
+as a pivilege boundary e.g. by HTTP content security policy and ActivityPub.
+Having uploads on the same domain enabled several past vulnerabilities
+able to be exploited by malicious users.
+
 ### `:http_security`
 
 > Recommended value: `true`
@@ -71,7 +81,7 @@ Use private `/tmp` and `/var/tmp` folders inside a new file system namespace, wh
 
 > Recommended value: `true`
 
-The `/home`, `/root`, and `/run/user` folders cannot be accessed by this service anymore. If your Akkoma user has its home folder in one of the restricted places, or use one of these folders as its working directory, you have to set this to `false`.
+The `/home`, `/root`, and `/run/user` folders can not be accessed by this service anymore. If your Akkoma user has its home folder in one of the restricted places, or use one of these folders as its working directory, you have to set this to `false`.
 
 ### ProtectSystem
 

docs/docs/configuration/how_to_serve_another_domain_for_webfinger.md

@@ -11,7 +11,7 @@ Akkoma supports that, but it might be tricky to set up, and any error might prev
 
 It is important to understand that for federation purposes, a user in Akkoma has two unique identifiers associated:
 
-- A Webfinger `acct:` URI, used for discovery and as a verifiable global name for the user across Akkoma instances. In our example, our account's acct: URI is `acct:user@example.org`
+- A webfinger `acct:` URI, used for discovery and as a verifiable global name for the user across Akkoma instances. In our example, our account's acct: URI is `acct:user@example.org`
 - An author/actor URI, used in every other aspect of federation. This is the way in which users are identified in ActivityPub, the underlying protocol used for federation with other Akkoma instances.
 In our case, it is `https://akkoma.example.org/users/user`.
 
@@ -19,7 +19,7 @@ Both account identifiers are unique and required for Akkoma. An important risk i
 
 ## WebFinger
 
-As said earlier, each Akkoma user has an `acct`: URI, which is used for discovery and authentication. When you add @user@example.org, a Webfinger query is performed. This is done in two steps:
+As said earlier, each Akkoma user has an `acct`: URI, which is used for discovery and authentication. When you add @user@example.org, a webfinger query is performed. This is done in two steps:
 
 1. Querying `https://example.org/.well-known/host-meta` (where the domain of the URL matches the domain part of the `acct`: URI) to get information on how to perform the query.
 This file will indeed contain a URL template of the form `https://example.org/.well-known/webfinger?resource={uri}` that will be used in the second step.
@@ -27,8 +27,7 @@ This file will indeed contain a URL template of the form `https://example.org/.w
 
 ## Configuring your Akkoma instance
 
-!!! danger
-    Do not attempt to configure your instance this way if you did not understand the above
+**_DO NOT ATTEMPT TO CONFIGURE YOUR INSTANCE THIS WAY IF YOU DID NOT UNDERSTAND THE ABOVE_**
 
 ### Configuring Akkoma
 
@@ -48,11 +47,11 @@ config :pleroma, Pleroma.Web.WebFinger, domain: "example.org"
 
 ### Configuring WebFinger domain
 
-Now, you have Akkoma running at `https://akkoma.example.org` as well as a website at `https://example.org`. If you recall how Webfinger queries work, the first step is to query `https://example.org/.well-known/host-meta`, which will contain a URL template.
+Now, you have Akkoma running at `https://akkoma.example.org` as well as a website at `https://example.org`. If you recall how webfinger queries work, the first step is to query `https://example.org/.well-known/host-meta`, which will contain an URL template.
 
 Therefore, the easiest way to configure `example.org` is to redirect `/.well-known/host-meta` to `akkoma.example.org`.
 
-With NGINX, it would be as simple as adding:
+With nginx, it would be as simple as adding:
 
 ```nginx
 location = /.well-known/host-meta {

docs/docs/configuration/howto_database_config.md

@@ -1,7 +1,7 @@
 # How to activate Akkoma in-database configuration
 ## Explanation
 
-The configuration of Akkoma (and Pleroma) has traditionally been managed with a config file, e.g. `config/prod.secret.exs`. This method requires a restart of the application for any configuration changes to take effect. We have made it possible to control most settings in the Admin-fe interface after running a migration script.
+The configuration of Akkoma (and Pleroma) has traditionally been managed with a config file, e.g. `config/prod.secret.exs`. This method requires a restart of the application for any configuration changes to take effect. We have made it possible to control most settings in the AdminFE interface after running a migration script.
 
 ## Migration to database config
 
@@ -42,10 +42,9 @@ The configuration of Akkoma (and Pleroma) has traditionally been managed with a
   config :pleroma, configurable_from_database: true
   ```
 
-!!! note
-    This step is not required
+4. ⚠️ **THIS IS NOT REQUIRED** ⚠️
 
-  Now you can edit your config file and strip it down to the only settings which are not possible to control in the database. e.g., the PostgreSQL (Repo) and webserver (Endpoint) settings cannot be controlled in the database because the application needs the settings to start up and access the database.
+  Now you can edit your config file and strip it down to the only settings which are not possible to control in the database. e.g., the Postgres (Repo) and webserver (Endpoint) settings cannot be controlled in the database because the application needs the settings to start up and access the database.
 
   Any settings in the database will override those in the config file, but you may find it less confusing if the setting is only declared in one place.
 
@@ -75,7 +74,8 @@ The configuration of Akkoma (and Pleroma) has traditionally been managed with a
   config :pleroma, configurable_from_database: true
   ```
 
-5. Restart your instance, and you can now access the Settings tab in admin-fe.
+5. Restart your instance and you can now access the Settings tab in AdminFE.
+
 
 ## Reverting back from database config
 
@@ -127,12 +127,12 @@ You can clear the database config with the following command:
   $ ./bin/pleroma_ctl config reset
   ```
 
-Additionally, every time you migrate the configuration to the database, the config table is automatically truncated to ensure a clean migration.
+Additionally, every time you migrate the configuration to the database the config table is automatically truncated to ensure a clean migration.
 
 ### Manually removing a setting
-If you encounter a situation where the server cannot run properly because of an invalid setting in the database and this is preventing you from accessing admin-fe, you can manually remove the offending setting if you know which one it is.
+If you encounter a situation where the server cannot run properly because of an invalid setting in the database and this is preventing you from accessing AdminFE, you can manually remove the offending setting if you know which one it is.
 
-e.g., here is an example showing the removal of the `config :pleroma, :instance` settings:
+e.g., here is an example showing a the removal of the `config :pleroma, :instance` settings:
 
   **Source:**
 
@@ -152,4 +152,4 @@ e.g., here is an example showing the removal of the `config :pleroma, :instance`
   config :pleroma, :instance deleted from the ConfigDB.
   ```
 
-Now, the `config :pleroma, :instance` settings have been removed from the database.
+Now the `config :pleroma, :instance` settings have been removed from the database.

docs/docs/configuration/howto_mediaproxy.md

@@ -1,34 +1,23 @@
 # How to activate mediaproxy
 ## Explanation
 
-Without the `mediaproxy` function, Akkoma doesn't store any remote content like pictures, video etc. locally. So, every time you open Akkoma, the content is loaded from the source server, from where the post is coming. This can result in slowly loading content or/and increased bandwidth usage on the source server.
-With the `mediaproxy` function, you can use NGINX to cache this content, so users can access it faster, because it's loaded from your server.
+Without the `mediaproxy` function, Akkoma doesn't store any remote content like pictures, video etc. locally. So every time you open Akkoma, the content is loaded from the source server, from where the post is coming. This can result in slowly loading content or/and increased bandwidth usage on the source server.
+With the `mediaproxy` function you can use nginx to cache this content, so users can access it faster, because it's loaded from your server.
 
 ## Activate it
 
-* Edit your NGINX config and add the following location:
-```
-location /proxy {
-        proxy_cache akkoma_media_cache;
-        proxy_cache_lock on;
-        proxy_pass http://localhost:4000;
-}
-```
-Also add the following on top of the configuration, outside the `server` block:
-```
-proxy_cache_path /tmp/akkoma-media-cache levels=1:2 keys_zone=akkoma_media_cache:10m max_size=10g inactive=720m use_temp_path=off;
-```
-If you came here from one of the installation guides, take a look at the example configuration `/installation/nginx/akkoma.nginx`, where this part is already included.
-
+* Set up a subdomain for the proxy with its nginx config on the same machine
+* Edit the nginx config for the upload/MediaProxy subdomain to point to the subdomain that has been set up
 * Append the following to your `prod.secret.exs` or `dev.secret.exs` (depends on which mode your instance is running):
-```
+```elixir
+# Replace media.example.td with the subdomain you set up earlier
 config :pleroma, :media_proxy,
       enabled: true,
       proxy_opts: [
             redirect_on_failure: true
-      ]
-      #base_url: "https://cache.akkoma.social"
+      ],
+      base_url: "https://media.example.tld"
 ```
-If you want to use a subdomain to serve the files, uncomment `base_url`, change the URL and add a comma after `true` in the previous line.
+You **really** should use a subdomain to serve proxied files; while we will fix bugs resulting from this, serving arbitrary remote content on your main domain namespace is a significant attack surface.
 
-* Restart NGINX and Akkoma
+* Restart nginx and Akkoma

docs/docs/configuration/howto_proxy.md

@@ -1,5 +1,5 @@
 # How to configure upstream proxy for federation
-If you want to proxify all HTTP requests (e.g. for TOR) that Akkoma makes to an upstream proxy server, edit your config file (`dev.secret.exs` or `prod.secret.exs`) and add the following:
+If you want to proxify all http requests (e.g. for TOR) that Akkoma makes to an upstream proxy server, edit your config file (`dev.secret.exs` or `prod.secret.exs`) and add the following:
 
 ```
 config :pleroma, :http,

docs/docs/configuration/howto_search_cjk.md

@@ -1,22 +1,24 @@
 # How to enable text search for Chinese, Japanese and Korean
 
-Akkoma's full text search feature is powered by PostgreSQL's native [text search](https://www.postgresql.org/docs/current/textsearch.html), it works well out of box for most of languages, but needs extra configurations for some Asian languages like Chinese, Japanese and Korean (CJK).
+Akkoma's full text search feature is powered by PostgreSQL's native [text search](https://www.postgresql.org/docs/current/textsearch.html), it works well out of box for most of languages, but needs extra configurations for some asian languages like Chinese, Japanese and Korean (CJK).
+
 
 ## Setup and test the new search config
 
 In most cases, you would need an extension installed to support parsing CJK text. Here are a few extensions you may choose from, or you are more than welcome to share additional ones you found working for you with the rest of Akkoma community.
 
- * [A generic n-gram parser](https://github.com/huangjimmy/pg_cjk_parser) supports Simplified/Traditional Chinese, Japanese, and Korean
- * [A Korean parser](https://github.com/i0seph/textsearch_ko) based on mecab
- * [A Japanese parser](https://www.amris.co.jp/tsja/index.html) based on mecab
- * [Ahparser](https://github.com/amutu/zhparser/) is a PostgreSQL extension base on the Simple Chinese Word Segmentation(SCWS)
- * [Another Chinese parser](https://github.com/jaiminpan/pg_jieba) based on Jieba Chinese Word Segmentation
+ * [a generic n-gram parser](https://github.com/huangjimmy/pg_cjk_parser) supports Simplifed/Traditional Chinese, Japanese, and Korean
+ * [a Korean parser](https://github.com/i0seph/textsearch_ko) based on mecab
+ * [a Japanese parser](https://www.amris.co.jp/tsja/index.html) based on mecab
+ * [zhparser](https://github.com/amutu/zhparser/) is a PostgreSQL extension base on the Simple Chinese Word Segmentation(SCWS)
+ * [another Chinese parser](https://github.com/jaiminpan/pg_jieba) based on Jieba Chinese Word Segmentation
  
-Once you have the new search config, make sure you test it with the `pleroma` user in PostgreSQL (change `YOUR.CONFIG` to your real configuration name)
+Once you have the new search config , make sure you test it with the `pleroma` user in PostgreSQL (change `YOUR.CONFIG` to your real configuration name)
 ```
-SELECT ts_debug('YOUR.CONFIG', '安装和配置NGINX, ElixirとErlangをインストールします');
+SELECT ts_debug('YOUR.CONFIG', '安装和配置Nginx, ElixirとErlangをインストールします');
 ```
-Check the output of the query, and see if it matches your expectation.
+Check output of the query, and see if it matches your expectation.
+
 
 ## Update text search config and index in database
 
@@ -32,8 +34,7 @@ Check the output of the query, and see if it matches your expectation.
     mix pleroma.database set_text_search_config YOUR.CONFIG
     ```
 
-!!! note
-    Index update may take a while, and it can be done while the instance is up and running, so you may restart db connection as soon as you see `Recreate index` in task output.
+Note: index update may take a while, and it can be done while the instance is up and running, so you may restart db connection as soon as you see `Recreate index` in task output.
 
 ## Restart database connection
 Since some changes above will only apply with a new database connection, you will have to restart either Akkoma or PostgreSQL process, or use `pg_terminate_backend` SQL command without restarting either. 

docs/docs/configuration/howto_set_richmedia_cache_ttl_based_on_image.md

@@ -1,10 +1,10 @@
-# How to set rich media cache TTL based on image TTL
+# How to set rich media cache ttl based on image ttl
 ## Explanation
 
-Rich media is cached without the TTL, but the rich media may have an image which can expire, like AWS-signed URL.
-In such cases, the old image URL (expired) is returned from the media cache.
+Richmedia are cached without the ttl but the rich media may have image which can expire, like aws signed url.
+In such cases the old image url (expired) is returned from the media cache.
 
-So, to avoid such situation, we can define a module that will set TTL based on image.
+So to avoid such situation we can define a module that will set ttl based on image.
 The module must adopt behaviour `Pleroma.Web.RichMedia.Parser.TTL`
 
 ### Example
@@ -16,8 +16,8 @@ defmodule MyModule do
   @impl Pleroma.Web.RichMedia.Parser.TTL
   def ttl(data, url) do
     image_url = Map.get(data, :image)
-    # do some parsing in the url and get the TTL of the image
-    # return TTL is unix time
+    # do some parsing in the url and get the ttl of the image
+    # return ttl is unix time
     parse_ttl_from_url(image_url)
   end
 end

docs/docs/configuration/howto_theming_your_instance.md

@@ -8,7 +8,7 @@ To add a custom theme to your instance, you'll first need to get a custom theme,
 
 * You can create your own theme using the Akkoma FE by going to settings (gear on the top right) and choose the Theme tab. Here you have the options to create a personal theme.
 * To download your theme, you can do Save preset
-* If you want to upload a theme to customize it further, you can upload it using Load preset
+* If you want to upload a theme to customise it further, you can upload it using Load preset
 
 This will only save the theme for you personally. To make it available to the whole instance, you'll need to upload it to the server.
 
@@ -47,7 +47,7 @@ Now you'll already be able to select the theme in Pleroma FE from the drop-down.
 
 ### Give the theme a name
 
-When you open one of the themes that ship with Akkoma, you'll notice that the JSON has a `"name"` key. Add a key-value pair to your theme where the key name is `"name"` and the value the name you want to give your theme. After this you can refresh the page in your browser and the name should be visible in the drop-down.
+When you open one of the themes that ship with Akkoma, you'll notice that the json has a `"name"` key. Add a key-value pair to your theme where the key name is `"name"` and the value the name you want to give your theme. After this you can refresh te page in your browser and the name should be visible in the drop-down.
 
 Example of `my-awesome-theme.json` where we add the name "My Awesome Theme"
 ```json
@@ -70,4 +70,4 @@ config :pleroma, :frontend_configurations,
   }
 ```
 
-If you added it in the back-end configuration file, you'll need to restart your instance for the changes to take effect. If you don't see the changes, it's probably because the browser has cached the previous theme. In that case you'll want to clear browser caches. Alternatively, you can use a private/incognito window just to see the changes.
+If you added it in the back-end configuration file, you'll need to restart your instance for the changes to take effect. If you don't see the changes, it's probably because the browser has cached the previous theme. In that case you'll want to clear browser caches. Alternatively you can use a private/incognito window just to see the changes.

docs/docs/configuration/i2p.md

@@ -1,4 +1,4 @@
-# I2P Federation and Accessibility
+# I2P Federation and Accessability
 
 This guide is going to focus on the Akkoma federation aspect. The actual installation is neatly explained in the official documentation, and more likely to remain up-to-date.
 It might be added to this guide if there will be a need for that.
@@ -15,10 +15,9 @@ One using the config, and one using external software (fedproxy). The external s
 
 ### Using the Config
 
-!!! warning
-    So far, everytime I followed this way of federating using I2P, the rest of my federation stopped working. I'm leaving this here in case it will help with making it work.
+**Warning:** So far, everytime I followed this way of federating using I2P, the rest of my federation stopped working. I'm leaving this here in case it will help with making it work.
 
-Assuming you're running in prod, `cd` to your Akkoma folder and append the following to `config/prod.secret.exs`:
+Assuming you're running in prod, cd to your Akkoma folder and append the following to `config/prod.secret.exs`:
 ```
 config :pleroma, :http, proxy_url: {:socks5, :localhost, 4447}
 ```
@@ -40,13 +39,13 @@ You can change the socks proxy port in `/etc/i2pd/i2pd.conf`.
 
 ### Using Fedproxy
 
-Fedproxy passes through Clearnet requests direct to where they are going. It doesn't force anything over Tor.
+Fedproxy passes through clearnet requests direct to where they are going. It doesn't force anything over Tor.
 
 To use [fedproxy](https://github.com/majestrate/fedproxy) you'll need to install Golang.
 ```
 apt install golang
 ```
-Use a different user than Akkoma or root. Run the following to add the GOPATH to your ~/.bashrc.
+Use a different user than akkoma or root. Run the following to add the Gopath to your ~/.bashrc.
 ```
 echo "export GOPATH=/home/ren/.go" >> ~/.bashrc
 ```
@@ -63,7 +62,7 @@ fedproxy 127.0.0.1:2000 127.0.0.1:4447
 If you want to also use it for Tor, add `127.0.0.1:9050` to that command.
 You'll also need to modify your Akkoma config.
 
-Assuming you're running in prod,  `cd` to your Akkoma folder and append the following to `config/prod.secret.exs`:
+Assuming you're running in prod, cd to your Akkoma folder and append the following to `config/prod.secret.exs`:
 ```
 config :pleroma, :http, proxy_url: {:socks5, :localhost, 2000}
 ```
@@ -104,12 +103,12 @@ systemctl start i2pd.service
 *Notice:* The stop command initiates a graceful shutdown process, i2pd stops after finishing to route transit tunnels (maximum 10 minutes).
 
 Now you'll have to find your address.
-To do that, you can download and use I2PD tools.[^1]
-Or, you'll need to access your web-console on localhost:7070.
+To do that you can download and use I2PD tools.[^1]  
+Or you'll need to access your web-console on localhost:7070.
 If you don't have a GUI, you'll have to SSH tunnel into it like this:
 `ssh -L 7070:127.0.0.1:7070 user@ip -p port`.
 Now you can access it at localhost:7070.
-Go to I2P tunnels page. Look for Server tunnels, and you will see an address that ends with `.b32.i2p` next to "akkoma".
+Go to I2P tunnels page. Look for Server tunnels and you will see an address that ends with `.b32.i2p` next to "akkoma".
 This is your site's address.
 
 ### I2P-only Instance
@@ -118,72 +117,39 @@ If creating an I2P-only instance, open `config/prod.secret.exs` and under "confi
 ```
    url: [host: "i2paddress", scheme: "http", port: 80],
 ```
-In addition to that, replace the existing NGINX config's contents with the example below.
+In addition to that, replace the existing nginx config's contents with the example below.
 
 ### Existing Instance (Clearnet Instance)
 
 If not an I2P-only instance, add the nginx config below to your existing config at `/etc/nginx/sites-enabled/akkoma.nginx`.
 
-And for both cases, disable CSP in Akkoma's config (STS is disabled by default) so you can define those yourself separately from the Clearnet (if your instance is also on the Clearnet).
+And for both cases, disable CSP in Akkoma's config (STS is disabled by default) so you can define those yourself separately from the clearnet (if your instance is also on the clearnet).
 Copy the following into the `config/prod.secret.exs` in your Akkoma folder (/home/akkoma/akkoma/):
 ```
 config :pleroma, :http_security,
   enabled: false
 ```
 
-Use this as the NGINX config:
-```
-proxy_cache_path /tmp/akkoma-media-cache levels=1:2 keys_zone=akkoma_media_cache:10m max_size=10g inactive=720m use_temp_path=off;
-# The above already exists in a clearnet instance's config.
-# If not, add it.
-
-server {
-    listen 127.0.0.1:14447;
-    server_name youri2paddress;
-
-    # Comment to enable logs
-    access_log /dev/null;
-    error_log /dev/null;
-
-    gzip_vary on;
-    gzip_proxied any;
-    gzip_comp_level 6;
-    gzip_buffers 16 8k;
-    gzip_http_version 1.1;
-    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml;
-
-    client_max_body_size 16m;
-
-    location / {
-
+In the Nginx config, add the following into the `location /` block:
+```nginx
         add_header X-XSS-Protection "0";
         add_header X-Permitted-Cross-Domain-Policies none;
         add_header X-Frame-Options DENY;
         add_header X-Content-Type-Options nosniff;
         add_header Referrer-Policy same-origin;
-
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $http_host;
-
-        proxy_pass http://localhost:4000;
-
-        client_max_body_size 16m;
-    }
-
-    location /proxy {
-        proxy_cache akkoma_media_cache;
-        proxy_cache_lock on;
-        proxy_ignore_client_abort on;
-        proxy_pass http://localhost:4000;
-    }
-}
 ```
-reload NGINX:
+
+Change the `listen` directive to the following:
+```nginx
+listen 127.0.0.1:14447;
 ```
-systemctl stop i2pd.service --no-block
-systemctl start i2pd.service
+
+Set `server_name` to your i2p address.
+
+Reload Nginx:
+```
+systemctl restart i2pd.service --no-block
+systemctl reload nginx.service
 ```
 *Notice:* The stop command initiates a graceful shutdown process, i2pd stops after finishing to route transit tunnels (maximum 10 minutes).
 

docs/docs/configuration/integrations/howto_ejabberd.md

@@ -1,10 +1,10 @@
-# Configuring ejabberd (XMPP Server) to use Akkoma for authentication
+# Configuring Ejabberd (XMPP Server) to use Akkoma for authentication
 
-If you want to give your Akkoma users an XMPP (chat) account, you can configure [ejabberd](https://github.com/processone/ejabberd) to use your Akkoma server for user authentication, automatically giving every local user an XMPP account.
+If you want to give your Akkoma users an XMPP (chat) account, you can configure [Ejabberd](https://github.com/processone/ejabberd) to use your Akkoma server for user authentication, automatically giving every local user an XMPP account.
 
 In general, you just have to follow the configuration described at [https://docs.ejabberd.im/admin/configuration/authentication/#external-script](https://docs.ejabberd.im/admin/configuration/authentication/#external-script). Please read this section carefully. 
 
-Copy the script below to a suitable path on your system and set owner and permissions. Also, do not forget adjusting `AKKOMA_HOST` and `AKKOMA_PORT`, if necessary.
+Copy the script below to suitable path on your system and set owner and permissions. Also do not forget adjusting `AKKOMA_HOST` and `AKKOMA_PORT`, if necessary.
 
 ```bash
 cp akkoma_ejabberd_auth.py /etc/ejabberd/akkoma_ejabberd_auth.py
@@ -12,7 +12,7 @@ chown ejabberd /etc/ejabberd/akkoma_ejabberd_auth.py
 chmod 700 /etc/ejabberd/akkoma_ejabberd_auth.py
 ```
 
-Set external auth parameters in ejabberd.yaml file:
+Set external auth params in ejabberd.yaml file:
 
 ```bash
 auth_method: [external]
@@ -23,7 +23,8 @@ auth_use_cache: false
 
 Restart / reload your ejabberd service.
 
-After restarting your ejabberd server, your users should now be able to connect with their Akkoma credentials.
+After restarting your Ejabberd server, your users should now be able to connect with their Akkoma credentials.
+
 
 ```python
 import sys
@@ -32,6 +33,7 @@ import http.client
 from base64 import b64encode
 import logging
 
+
 AKKOMA_HOST = "127.0.0.1"
 AKKOMA_PORT = "4000"
 AUTH_ENDPOINT = "/api/v1/accounts/verify_credentials"
@@ -40,10 +42,12 @@ LOGFILE = "/var/log/ejabberd/akkoma_auth.log"
 
 logging.basicConfig(filename=LOGFILE, level=logging.INFO)
 
+
 # Akkoma functions
 def create_connection():
     return http.client.HTTPConnection(AKKOMA_HOST, AKKOMA_PORT)
 
+
 def verify_credentials(user: str, password: str) -> bool:
     user_pass_b64 = b64encode("{}:{}".format(
         user, password).encode('utf-8')).decode("ascii")
@@ -65,6 +69,7 @@ def verify_credentials(user: str, password: str) -> bool:
         logging.info("Can not connect: %s", str(e))
         return False
 
+
 def does_user_exist(user: str) -> bool:
     conn = create_connection()
     conn.request("GET", "{}/{}".format(USER_ENDPOINT, user))
@@ -75,12 +80,15 @@ def does_user_exist(user: str) -> bool:
 
     return False
 
+
 def auth(username: str, server: str, password: str) -> bool:
     return verify_credentials(username, password)
 
+
 def isuser(username, server):
     return does_user_exist(username)
 
+
 def read():
     (pkt_size,) = struct.unpack('>H', bytes(sys.stdin.read(2), encoding='utf8'))
     pkt = sys.stdin.read(pkt_size)
@@ -106,6 +114,7 @@ def read():
     else:
         write(False)
 
+
 def write(result):
     if result:
         sys.stdout.write('\x00\x02\x00\x01')
@@ -113,6 +122,7 @@ def write(result):
         sys.stdout.write('\x00\x02\x00\x00')
     sys.stdout.flush()
 
+
 if __name__ == "__main__":
     logging.info("Starting akkoma ejabberd auth daemon...")
     while True:

docs/docs/configuration/integrations/howto_mongooseim.md

@@ -5,6 +5,6 @@ If you want to give your Akkoma users an XMPP (chat) account, you can configure
 In general, you just have to follow the configuration described at [https://mongooseim.readthedocs.io/en/latest/authentication-backends/HTTP-authentication-module/](https://mongooseim.readthedocs.io/en/latest/authentication-backends/HTTP-authentication-module/) and do these changes to your mongooseim.cfg.
 
 1. Set the auth_method to `{auth_method, http}`.
-2. Add the HTTP auth pool like this: `{http, global, auth, [{workers, 50}], [{server, "https://yourakkomainstance.com"}]}`
+2. Add the http auth pool like this: `{http, global, auth, [{workers, 50}], [{server, "https://yourakkomainstance.com"}]}`
 
 Restart your MongooseIM server, your users should now be able to connect with their Akkoma credentials.

docs/docs/configuration/mrf.md

@@ -11,7 +11,7 @@ Possible uses include:
 * removing media from messages
 * sending only public messages to a specific instance
 
-The MRF provides user-configurable policies. The default policy is `NoOpPolicy`, which disables the MRF functionality. Akkoma also includes an easy-to-use policy called `SimplePolicy` which maps messages matching certain pre-defined criterion to actions built into the policy module.
+The MRF provides user-configurable policies. The default policy is `NoOpPolicy`, which disables the MRF functionality. Akkoma also includes an easy to use policy called `SimplePolicy` which maps messages matching certain pre-defined criterion to actions built into the policy module.
 
 It is possible to use multiple, active MRF policies at the same time.
 
@@ -29,12 +29,13 @@ config :pleroma, :mrf,
 
 Once `SimplePolicy` is enabled, you can configure various groups in the `:mrf_simple` config object. These groups are:
 
-* `reject`: Servers in this group will have their messages rejected. Also, outbound messages will not be sent to these servers.
+* `reject`: Servers in this group will have their messages rejected. Also outbound messages will not be sent to these servers.
 * `accept`: If not empty, only messages from these instances will be accepted (whitelist federation).
 * `media_nsfw`: Servers in this group will have the #nsfw tag and sensitive setting injected into incoming messages which contain media.
 * `media_removal`: Servers in this group will have media stripped from incoming messages.
 * `avatar_removal`: Avatars from these servers will be stripped from incoming messages.
 * `banner_removal`: Banner images from these servers will be stripped from incoming messages.
+* `background_removal`: User background images from these servers will be stripped from incoming messages.
 * `report_removal`: Servers in this group will have their reports (flags) rejected.
 * `federated_timeline_removal`: Servers in this group will have their messages unlisted from the public timelines by flipping the `to` and `cc` fields.
 * `reject_deletes`: Deletion requests will be rejected from these servers.
@@ -61,6 +62,32 @@ config :pleroma, :mrf_simple,
 
 The effects of MRF policies can be very drastic. It is important to use this functionality carefully. Always try to talk to an admin before writing an MRF policy concerning their instance.
 
+## Hiding or Obfuscating Policies
+
+You can opt out of publicly displaying all MRF policies or only hide or obfuscate selected domains.
+
+To just hide everything set:
+
+```elixir
+config :pleroma, :mrf,
+  ...
+  transparency: false,
+```
+
+To hide or obfuscate only select entries, use:
+
+```elixir
+config :pleroma, :mrf,
+  ...
+  transparency_obfuscate_domains: ["handholdi.ng", "badword.com"],
+  transparency_exclusions: [{"ghost.club", "even a fragment is too spoopy for humans"}]
+```
+
+## More MRF Policies
+
+See the [documentation cheatsheet](cheatsheet.md)
+for all available MRF policies and their options.
+
 ## Writing your own MRF Policy
 
 As discussed above, the MRF system is a modular system that supports pluggable policies. This means that an admin may write a custom MRF policy in Elixir or any other language that runs on the Erlang VM, by specifying the module name in the `policies` config setting.
@@ -124,7 +151,7 @@ Please note that the Akkoma developers consider custom MRF policy modules to fal
 
 ### MRF policies descriptions
 
-If MRF policy depends on config, it can be added into MRF tab to Admin-fe by adding `config_description/0` method, which returns a map with a specific structure. See existing MRF's like `lib/pleroma/web/activity_pub/mrf/activity_expiration_policy.ex` for examples. Note that more complex inputs, like tuples or maps, may need extra changes in the Admin-fe and just adding it to `config_description/0` may not be enough to get these inputs working from the Admin-fe.
+If MRF policy depends on config, it can be added into MRF tab to adminFE by adding `config_description/0` method, which returns a map with a specific structure. See existing MRF's like `lib/pleroma/web/activity_pub/mrf/activity_expiration_policy.ex` for examples. Note that more complex inputs, like tuples or maps, may need extra changes in the adminFE and just adding it to `config_description/0` may not be enough to get these inputs working from the adminFE.
 
 Example:
 

docs/docs/configuration/onion_federation.md

@@ -5,15 +5,14 @@ In addition, federating with such instances will also help furthering that goal.
 This is a guide to show you how it can be easily done.
 
 This guide assumes you already got Akkoma working, and that it's running on the default port 4000.
-This guide also assumes you're using NGINX as the reverse proxy.
+This guide also assumes you're using Nginx as the reverse proxy.
 
 To install Tor on Debian / Ubuntu:
 ```
 apt -yq install tor
 ```
 
-!!! warning
-    Onion instances not using a Tor version supporting V3 addresses will not be able to federate with you.
+**WARNING:** Onion instances not using a Tor version supporting V3 addresses will not be able to federate with you. 
 
 Create the hidden service for your Akkoma instance in `/etc/tor/torrc`, with an HTTP tunnel:
 ```
@@ -22,7 +21,7 @@ HiddenServicePort 80 127.0.0.1:8099
 HiddenServiceVersion 3  # Remove if Tor version is below 0.3 ( tor --version )
 HTTPTunnelPort 9080
 ```
-Restart Tor to generate an address:
+Restart Tor to generate an adress:
 ```
 systemctl restart tor@default.service
 ```
@@ -61,70 +60,37 @@ If creating a Tor-only instance, open `config/prod.secret.exs` and under "config
 ```
    url: [host: "onionaddress", scheme: "http", port: 80],
 ```
-In addition to that, replace the existing NGINX config's contents with the example below.
+In addition to that, replace the existing nginx config's contents with the example below.
 
 ## Existing Instance (Clearnet Instance)
 If not a Tor-only instance, 
-add the NGINX config below to your existing config at `/etc/nginx/sites-enabled/akkoma.nginx`.
+add the nginx config below to your existing config at `/etc/nginx/sites-enabled/akkoma.nginx`.
 
 ---
-For both cases, disable CSP in Akkoma's config (STS is disabled by default) so you can define those yourself separately from the Clearnet (if your instance is also on the Clearnet).
+For both cases, disable CSP in Akkoma's config (STS is disabled by default) so you can define those yourself separately from the clearnet (if your instance is also on the clearnet).
 Copy the following into the `config/prod.secret.exs` in your Akkoma folder (/home/akkoma/akkoma/):
 ```
 config :pleroma, :http_security,
   enabled: false
 ```
 
-Use this as the NGINX config:
-```
-proxy_cache_path /tmp/akkoma-media-cache levels=1:2 keys_zone=akkoma_media_cache:10m max_size=10g inactive=720m use_temp_path=off;
-# The above already exists in a clearnet instance's config.
-# If not, add it.
-
-server {
-    listen 127.0.0.1:8099;
-    server_name youronionaddress;
-
-    # Comment to enable logs
-    access_log /dev/null;
-    error_log /dev/null;
-
-    gzip_vary on;
-    gzip_proxied any;
-    gzip_comp_level 6;
-    gzip_buffers 16 8k;
-    gzip_http_version 1.1;
-    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml;
-
-    client_max_body_size 16m;
-
-    location / {
-
+In the Nginx config, add the following into the `location /` block:
+```nginx
         add_header X-XSS-Protection "0";
         add_header X-Permitted-Cross-Domain-Policies none;
         add_header X-Frame-Options DENY;
         add_header X-Content-Type-Options nosniff;
         add_header Referrer-Policy same-origin;
-
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $http_host;
-
-        proxy_pass http://localhost:4000;
-
-        client_max_body_size 16m;
-    }
-
-    location /proxy {
-        proxy_cache akkoma_media_cache;
-        proxy_cache_lock on;
-        proxy_ignore_client_abort on;
-        proxy_pass http://localhost:4000;
-    }
-}
 ```
-reload NGINX:
+
+Change the `listen` directive to the following:
+```nginx
+listen 127.0.0.1:8099;
+```
+
+Set the `server_name` to your onion address.
+
+Reload Nginx:
 ```
 systemctl reload nginx
 ```

docs/docs/configuration/optimisation/optimizing_beam.md

@@ -1,6 +1,6 @@
 # Optimizing the BEAM
 
-Akkoma is built upon the Erlang/OTP VM known as BEAM. The BEAM VM is highly optimized for latency, but this has drawbacks in environments without dedicated hardware. One of the tricks used by the BEAM VM is [busy waiting](https://en.wikipedia.org/wiki/Busy_waiting). This allows the application to pretend to be busy working so the OS kernel does not pause the application process and switch to another process waiting for the CPU to execute its workload. It does this by spinning for a period of time which inflates the apparent CPU usage of the application so it is immediately ready to execute another task. This can be observed with utilities like **top(1)** which will show consistently high CPU usage for the process. Switching between processes is a rather expensive operation and also clears CPU caches further affecting latency and performance. The goal of busy waiting is to avoid this penalty.
+Akkoma is built upon the Erlang/OTP VM known as BEAM. The BEAM VM is highly optimized for latency, but this has drawbacks in environments without dedicated hardware. One of the tricks used by the BEAM VM is [busy waiting](https://en.wikipedia.org/wiki/Busy_waiting). This allows the application to pretend to be busy working so the OS kernel does not pause the application process and switch to another process waiting for the CPU to execute its workload. It does this by spinning for a period of time which inflates the apparent CPU usage of the application so it is immediately ready to execute another task. This can be observed with utilities like **top(1)** which will show consistently high CPU usage for the process. Switching between procesess is a rather expensive operation and also clears CPU caches further affecting latency and performance. The goal of busy waiting is to avoid this penalty.
 
 This strategy is very successful in making a performant and responsive application, but is not desirable on Virtual Machines or hardware with few CPU cores. Akkoma instances are often deployed on the same server as the required PostgreSQL database which can lead to situations where the Akkoma application is holding the CPU in a busy-wait loop and as a result the database cannot process requests in a timely manner. The fewer CPUs available, the more this problem is exacerbated. The latency is further amplified by the OS being installed on a Virtual Machine as the Hypervisor uses CPU time-slicing to pause the entire OS and switch between other tasks.
 
@@ -18,17 +18,21 @@ Please only change these settings if you are experiencing issues or really know
 
 * AWS (known to use burst scheduling)
 
+
 ## Example configurations
 
-Tuning the BEAM requires you provide a config file, normally called [vm.args](http://erlang.org/doc/man/erl.html#emulator-flags). If you are using systemd to manage the service you can modify the unit file as such:
+Tuning the BEAM requires you provide a config file normally called [vm.args](http://erlang.org/doc/man/erl.html#emulator-flags). If you are using systemd to manage the service you can modify the unit file as such:
 
 `ExecStart=/usr/bin/elixir --erl '-args_file /opt/akkoma/config/vm.args' -S /usr/bin/mix phx.server`
 
+If using an OTP release, set the `RELEASE_VM_ARGS` environment variable to the path to the vm.args file.
+
 Check your OS documentation to adopt a similar strategy on other platforms.
 
 ### Virtual Machine and/or few CPU cores
 
-Disable the busy-waiting. This should generally only be done if you're on a platform that does burst scheduling, like AWS.
+Disable the busy-waiting. This should generally be done if you're on a platform that does burst scheduling, like AWS, or if you're running other
+services on the same machine.
 
 **vm.args:**
 
@@ -38,6 +42,8 @@ Disable the busy-waiting. This should generally only be done if you're on a plat
 +sbwtdio none
 ```
 
+These settings are enabled by default for OTP releases
+
 ### Dedicated Hardware
 
 Enable more busy waiting, increase the internal maximum limit of BEAM processes and ports. You can use this if you run on dedicated hardware, but it is not necessary.

docs/docs/configuration/optimisation/varnish_cache.md

@@ -1,37 +1,38 @@
 # Using a Varnish Cache
 
 Varnish is a layer that sits between your web server and your backend application -
-it does something similar to NGINX caching, but tends to be optimized for speed over
+it does something similar to nginx caching, but tends to be optimised for speed over
 all else.
 
-To set up a Varnish cache, first you'll need to install Varnish.
+To set up a varnish cache, first you'll need to install varnish. 
 
 This will vary by distribution, and since this is a rather advanced guide,
 no copy-paste instructions are provided. It's probably in your distribution's
 package manager, though. `apt-get install varnish` and so on.
 
-Once you have Varnish installed, you'll need to configure it to work with Akkoma.
+Once you have varnish installed, you'll need to configure it to work with akkoma.
 
-Copy the configuration file to the Varnish configuration directory:
+Copy the configuration file to the varnish configuration directory:
 
     cp installation/akkoma.vcl /etc/varnish/akkoma.vcl
 
-You may want to check if Varnish added a `default.vcl` file to the same directory,
-if so, you can just remove it without issue.
+You may want to check if varnish added a `default.vcl` file to the same directory,
+if so you can just remove it without issue.
 
-Then boot up Varnish, probably `systemctl start varnish` or `service varnish start`.
+Then boot up varnish, probably `systemctl start varnish` or `service varnish start`.
 
 Now you should be able to `curl -D- localhost:6081` and see a bunch of
-Akkoma JavaScript.
+akkoma javascript.
 
-Once that's out of the way, we can point our webserver at Varnish. This
+Once that's out of the way, we can point our webserver at varnish. This
 
-=== "NGINX"
+=== "Nginx"
 
     upstream phoenix {
         server 127.0.0.1:6081 max_fails=5 fail_timeout=60s;
     }
 
+
 === "Caddy"
 
     reverse_proxy 127.0.0.1:6081

docs/docs/configuration/postgresql.md

@@ -4,46 +4,10 @@ Akkoma performance is largely dependent on performance of the underlying databas
 
 ## PGTune
 
-[PgTune](https://pgtune.leopard.in.ua) can be used to get recommended settings. Be sure to set "Number of Connections" to 20, otherwise it might produce settings hurtful to database performance. It is also recommended to not use "Network Storage" option.
+[PgTune](https://pgtune.leopard.in.ua) can be used to get recommended settings. Make sure to set the DB type to "Online transaction processing system" for optimal performance. Also set the number of connections to between 25 and 30. This will allow each connection to have access to more resources while still leaving some room for running maintenance tasks while the instance is still running. 
 
-If your server runs other services, you may want to take that into account. E.g. if you have 4G ram, but 1G of it is already used for other services, it may be better to tell PGTune you only have 3G. In the end, PGTune only provides recommended settings, you can always try to finetune further.
+It is also recommended to not use "Network Storage" option.
 
-### Example configurations
+If your server runs other services, you may want to take that into account. E.g. if you have 4G ram, but 1G of it is already used for other services, it may be better to tell PGTune you only have 3G.
 
-Here are some configuration suggestions for PostgreSQL 10+.
-
-#### 1GB RAM, 1 CPU
-```
-shared_buffers = 256MB
-effective_cache_size = 768MB
-maintenance_work_mem = 64MB
-work_mem = 13107kB
-```
-
-#### 2GB RAM, 2 CPU
-```
-shared_buffers = 512MB
-effective_cache_size = 1536MB
-maintenance_work_mem = 128MB
-work_mem = 26214kB
-max_worker_processes = 2
-max_parallel_workers_per_gather = 1
-max_parallel_workers = 2
-```
-
-## Disable generic query plans
-
-When PostgreSQL receives a query, it decides on a strategy for searching the requested data, this is called a query plan. The query planner has two modes: generic and custom. Generic makes a plan for all queries of the same shape, ignoring the parameters, which is then cached and reused. Custom, on the contrary, generates a unique query plan based on query parameters.
-
-By default, PostgreSQL has an algorithm to decide which mode is more efficient for a particular query, however this algorithm has been observed to be wrong on some of the queries Akkoma sends, leading to serious performance loss. Therefore, it is recommended to disable generic mode.
-
-Akkoma already avoids generic query plans by default, however the method it uses is not the most efficient because it needs to be compatible with all supported PostgreSQL versions. For PostgreSQL 12 and higher additional performance can be gained by adding the following to Akkoma configuration:
-```elixir
-config :pleroma, Pleroma.Repo,
-  prepare: :named,
-  parameters: [
-    plan_cache_mode: "force_custom_plan"
-  ]
-```
-
-A more detailed explanation of the issue can be found at <https://blog.soykaf.com/post/postgresql-elixir-troubles/>.
+In the end, PGTune only provides recomended settings, you can always try to finetune further.

docs/docs/configuration/search.md

@@ -13,39 +13,40 @@ While it has no external dependencies, it has problems with performance and rele
 ## Meilisearch
 
 Note that it's quite a bit more memory hungry than PostgreSQL (around 4-5G for ~1.2 million
-posts while idle and up to 7G while indexing, initially). The disk usage for this additional index is also
+posts while idle and up to 7G while indexing initially). The disk usage for this additional index is also
 around 4 gigabytes. Like [RUM](./cheatsheet.md#rum-indexing-for-full-text-search) indexes, it offers considerably
 higher performance and ordering by timestamp in a reasonable amount of time.
 Additionally, the search results seem to be more accurate.
 
-Due to high memory usage, it may be best to set it up on a different machine, if running Pleroma on a low-resource
+Due to high memory usage, it may be best to set it up on a different machine, if running pleroma on a low-resource
 computer, and use private key authentication to secure the remote search instance.
 
-To use [Meilisearch](https://www.meilisearch.com/), set the search module to `Pleroma.Search.Meilisearch`:
+To use [meilisearch](https://www.meilisearch.com/), set the search module to `Pleroma.Search.Meilisearch`:
 
 > config :pleroma, Pleroma.Search, module: Pleroma.Search.Meilisearch
 
-You then need to set the address of the Meilisearch instance, and optionally the private key for authentication. You might
-also want to change the `initial_indexing_chunk_size` to be smaller if your server is not very powerful, but not higher than `100_000`,
-because Meilisearch will refuse to process it if it's too big. However, in general you want this to be as big as possible, because Meilisearch
+You then need to set the address of the meilisearch instance, and optionally the private key for authentication. You might
+also want to change the `initial_indexing_chunk_size` to be smaller if you're server is not very powerful, but not higher than `100_000`,
+because meilisearch will refuse to process it if it's too big. However, in general you want this to be as big as possible, because meilisearch
 indexes faster when it can process many posts in a single batch.
 
 > config :pleroma, Pleroma.Search.Meilisearch,
 >    url: "http://127.0.0.1:7700/",
 >    private_key: "private key",
+>    search_key: "search key",
 >    initial_indexing_chunk_size: 100_000
 
-Information about setting up Meilisearch can be found in the
+Information about setting up meilisearch can be found in the
 [official documentation](https://docs.meilisearch.com/learn/getting_started/installation.html).
 You probably want to start it with `MEILI_NO_ANALYTICS=true` environment variable to disable analytics.
-At least version 0.25.0 is required, but you are strongly advised to use at least 0.26.0, as it introduces
-the `--enable-auto-batching` option, which drastically improves performance. Without this option, the search
+At least version 0.25.0 is required, but you are strongly adviced to use at least 0.26.0, as it introduces
+the `--enable-auto-batching` option which drastically improves performance. Without this option, the search
 is hardly usable on a somewhat big instance.
 
 ### Private key authentication (optional)
 
 To set the private key, use the `MEILI_MASTER_KEY` environment variable when starting. After setting the _master key_,
-you have to get the _private key_, which is actually used for authentication.
+you have to get the _private key_ and possibly _search key_, which are actually used for authentication.
 
 === "OTP"
     ```sh
@@ -57,13 +58,17 @@ you have to get the _private key_, which is actually used for authentication.
     mix pleroma.search.meilisearch show-keys <your master key here>
     ```
 
-You will see a "Default Admin API Key", this is the key you actually put into your configuration file.
+You will see a "Default Admin API Key", this is the key you actually put into
+your configuration file as `private_key`. You should also see a
+"Default Search API key", put this into your config as `search_key`.
+If your version of Meilisearch only showed the former,
+just leave `search_key` completely unset in Akkoma's config.
 
 ### Initial indexing
 
-After setting up the configuration, you'll want to index all of your already existing posts. Only public posts are indexed.  You'll only
+After setting up the configuration, you'll want to index all of your already existsing posts. Only public posts are indexed.  You'll only
 have to do it one time, but it might take a while, depending on the amount of posts your instance has seen. This is also a fairly RAM
-consuming process for `Meilisearch`, and it will take a lot of RAM when running if you have a lot of posts (seems to be around 5G for ~1.2
+consuming process for `meilisearch`, and it will take a lot of RAM when running if you have a lot of posts (seems to be around 5G for ~1.2
 million posts while idle and up to 7G while indexing initially, but your experience may be different).
 
 The sequence of actions is as follows:
@@ -73,7 +78,7 @@ The sequence of actions is as follows:
 3. Start the initial indexing process (as described below with `index`),
    and wait until the task says it sent everything from the database to index
 4. Wait until everything is actually indexed (by checking with `stats` as described below),
-   at this point, you don't have to do anything, just wait a while.
+   at this point you don't have to do anything, just wait a while.
 
 To start the initial indexing, run the `index` command:
 
@@ -88,7 +93,7 @@ To start the initial indexing, run the `index` command:
     ```
 
 This will show you the total amount of posts to index, and then show you the amount of posts indexed currently, until the numbers eventually
-become the same. The posts are indexed in big batches and Meilisearch will take some time to actually index them, even after you have
+become the same. The posts are indexed in big batches and meilisearch will take some time to actually index them, even after you have
 inserted all the posts into it. Depending on the amount of posts, this may be as long as several hours. To get information about the status
 of indexing and how many posts have actually been indexed, use the `stats` command:
 
@@ -124,16 +129,15 @@ depends on the amount of text in posts.
 
 ## Elasticsearch
 
-!!! note
-    This requires at least Elasticsearch 7
+**Note: This requires at least ElasticSearch 7**
 
-As with Meilisearch, this can be rather memory-hungry, but it is very good at what it does.
+As with meilisearch, this can be rather memory-hungry, but it is very good at what it does.
 
-To use [Elasticsearch]( https://www.elastic.co/elasticsearch/), set the search module to `Pleroma.Search.Elasticsearch`:
+To use [elasticsearch](https://www.elastic.co/), set the search module to `Pleroma.Search.Elasticsearch`:
 
 > config :pleroma, Pleroma.Search, module: Pleroma.Search.Elasticsearch
 
-You then need to set the URL and authentication credentials, if relevant.
+You then need to set the URL and authentication credentials if relevant.
 
 > config :pleroma, Pleroma.Search.Elasticsearch.Cluster,
 >    url: "http://127.0.0.1:9200/",
@@ -142,7 +146,7 @@ You then need to set the URL and authentication credentials, if relevant.
 
 ### Initial indexing
 
-After setting up the configuration, you'll want to index all of your already existing posts. You'll only have to do it one time, but it might take a while, depending on the amount of posts your instance has seen.
+After setting up the configuration, you'll want to index all of your already existsing posts. You'll only have to do it one time, but it might take a while, depending on the amount of posts your instance has seen. 
 
 The sequence of actions is as follows:
 

docs/docs/configuration/static_dir.md

@@ -26,7 +26,7 @@ If you use a From Source installation and want to manage your custom files in th
 
 ## robots.txt
 
-There's a mix task to [generate a new robot.txt](../../administration/CLI_tasks/robots_txt/).
+There's a mix tasks to [generate a new robot.txt](../../administration/CLI_tasks/robots_txt/).
 
 For more complex things, you can write your own robots.txt to `$static_dir/robots.txt`.
 
@@ -49,7 +49,7 @@ Add `$static_dir/instance/thumbnail.jpeg` with your selfie or other neat picture
 
 ## Instance-specific panel
 
-Create and edit your file at `$static_dir/instance/panel.html`.
+Create and Edit your file at `$static_dir/instance/panel.html`.
 
 ## Background
 
@@ -69,7 +69,7 @@ config :pleroma, :frontend_configurations,
 !!! important
     Note the extra `static` folder for the default logo.png location
 
-If you want to give a brand to your instance, you can change the logo of your instance by uploading it to the static directory `$static_dir/static/logo.png`.
+If you want to give a brand to your instance, You can change the logo of your instance by uploading it to the static directory `$static_dir/static/logo.png`.
 
 Alternatively, you can specify the path to your logo in [your configuration](../cheatsheet/#frontend_configurations).
 
@@ -101,9 +101,9 @@ the `frontends` directory.
 
 To overwrite the CSS stylesheet of the OAuth form and other static pages, you can upload your own CSS file to `instance/static/static.css`. This will completely replace the CSS used by those pages, so it might be a good idea to copy the one from `priv/static/instance/static.css` and make your changes.
 
-## Overriding Pleroma-fe styles
+## Overriding pleroma-fe styles
 
-To overwrite the CSS stylesheet of Pleroma-fe, you can put a file at
+To overwrite the CSS stylesheet of pleroma-fe, you can put a file at
 `$static_dir/static/custom.css` containing your styles. These will be loaded
 with the rest of the CSS.
 

docs/docs/configuration/storing_remote_media.md

@@ -1,12 +1,12 @@
 # Storing Remote Media
 
-Akkoma does not store remote/federated media by default. The best way to achieve this is to change NGINX to keep its reverse proxy cache
+Akkoma does not store remote/federated media by default. The best way to achieve this is to change Nginx to keep its reverse proxy cache
 for a year and to activate the `MediaProxyWarmingPolicy` MRF policy in Akkoma which will automatically fetch all media through the proxy
 as soon as the post is received by your instance.
 
-## NGINX
+## Nginx
 
-The following are excerpts from the [suggested NGINX config](../../../installation/nginx/akkoma.nginx) that demonstrates the necessary config for the media proxy to work.
+The following are excerpts from the [suggested nginx config](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/installation/nginx/akkoma.nginx) that demonstrates the necessary config for the media proxy to work.
 
 A `proxy_cache_path` must be defined, for example:
 

docs/docs/development/API/admin_api.md

@@ -1,6 +1,6 @@
 # Admin API
 
-Authentication is required, and the user must be an admin.
+Authentication is required and the user must be an admin.
 
 Backwards-compatibility for admin API endpoints without version prefixes (`/api/pleroma/admin/*`) has been removed as of Akkoma 3.6.0. Please use `/api/v1/pleroma/admin/*` instead.
 
@@ -137,7 +137,7 @@ Backwards-compatibility for admin API endpoints without version prefixes (`/api/
 
 ## `GET /api/v1/pleroma/admin/users/:nickname/permission_group`
 
-### Get user permission groups membership
+### Get user user permission groups membership
 
 - Params: none
 - Response:
@@ -151,10 +151,9 @@ Backwards-compatibility for admin API endpoints without version prefixes (`/api/
 
 ## `GET /api/v1/pleroma/admin/users/:nickname/permission_group/:permission_group`
 
-!!! note
-    Available `:permission_group` is currently moderator and admin. 404 is returned when the permission group doesn’t exist.
+Note: Available `:permission_group` is currently moderator and admin. 404 is returned when the permission group doesn’t exist.
 
-### Get user permission groups membership per permission group
+### Get user user permission groups membership per permission group
 
 - Params: none
 - Response:
@@ -304,7 +303,7 @@ Removes the user(s) from follower recommendations.
 
 ## `GET /api/v1/pleroma/admin/users/:nickname_or_id`
 
-### Retrieve the details of a user
+### Retrive the details of a user
 
 - Params:
   - `nickname` or `id`
@@ -314,7 +313,7 @@ Removes the user(s) from follower recommendations.
 
 ## `GET /api/v1/pleroma/admin/users/:nickname_or_id/statuses`
 
-### Retrieve user's latest statuses
+### Retrive user's latest statuses
 
 - Params:
   - `nickname` or `id`
@@ -338,7 +337,7 @@ Removes the user(s) from follower recommendations.
 
 ## `GET /api/v1/pleroma/admin/instances/:instance/statuses`
 
-### Retrieve instance's latest statuses
+### Retrive instance's latest statuses
 
 - Params:
   - `instance`: instance name
@@ -364,8 +363,8 @@ Removes the user(s) from follower recommendations.
 
 ### Delete all users and activities from a remote instance
 
-!!! note
-    This will trigger a job to remove instance content in the background. It may take some time.
+Note: this will trigger a job to remove instance content in the background.
+It may take some time.
 
 - Params:
   - `instance`: remote instance host
@@ -378,7 +377,7 @@ Removes the user(s) from follower recommendations.
 
 ## `GET /api/v1/pleroma/admin/statuses`
 
-### Retrieves all latest statuses
+### Retrives all latest statuses
 
 - Params:
   - *optional* `page_size`: number of statuses to return (default is `20`)
@@ -415,7 +414,7 @@ Params:
 
 Response:
 
-* On success: relay JSON object
+* On success: relay json object
 
 ```json
 {"actor": "https://example.com/relay", "followed_back": true}
@@ -427,7 +426,7 @@ Response:
 
 - Params:
   - `relay_url`
-  - *optional* `force`: forcefully unfollow a relay, even when the relay is not available. (default is `false`)
+  - *optional* `force`: forcefully unfollow a relay even when the relay is not available. (default is `false`)
 
 Response:
 
@@ -506,7 +505,7 @@ Response:
 
 ## `POST /api/v1/pleroma/admin/users/email_invite`
 
-### Sends registration invites via email
+### Sends registration invite via email
 
 - Params:
   - `email`
@@ -529,6 +528,7 @@ Response:
 
 ### Get a password reset token for a given nickname
 
+
 - Params: none
 - Response:
 
@@ -541,7 +541,7 @@ Response:
 
 ## `PATCH /api/v1/pleroma/admin/users/force_password_reset`
 
-### Force password reset for a user with a given nickname
+### Force passord reset for a user with a given nickname
 
 - Params:
   - `nicknames`
@@ -549,7 +549,7 @@ Response:
 
 ## PUT `/api/v1/pleroma/admin/users/disable_mfa`
 
-### Disable MFA for user's account.
+### Disable mfa for user's account.
 
 - Params:
   - `nickname`
@@ -960,7 +960,7 @@ Status: 404
 
 ## `GET /api/v1/pleroma/admin/need_reboot`
 
-### Returns the flag whether the Akkoma should be restarted
+### Returns the flag whether the pleroma should be restarted
 
 - Params: none
 - Response:
@@ -975,7 +975,7 @@ Status: 404
 
 ### Get list of merged default settings with saved in database.
 
-*If `need_reboot` is `true`, the instance must be restarted, so reboot time settings can take effect.*
+*If `need_reboot` is `true`, instance must be restarted, so reboot time settings can take effect.*
 
 **Only works when configuration from database is enabled.**
 
@@ -1002,7 +1002,7 @@ Status: 404
 
 ### Update config settings
 
-*If `need_reboot` is `true`, the instance must be restarted, so reboot time settings can take effect.*
+*If `need_reboot` is `true`, instance must be restarted, so reboot time settings can take effect.*
 
 **Only works when configuration from database is enabled.**
 
@@ -1033,7 +1033,6 @@ Most of the settings will be applied in `runtime`, this means that you don't nee
   - `:pools`
 - partially settings inside these keys:
   - `:seconds_valid` in `Pleroma.Captcha`
-  - `:proxy_remote` in `Pleroma.Upload`
   - `:upload_limit` in `:instance`
 
 - Params:
@@ -1045,7 +1044,7 @@ Most of the settings will be applied in `runtime`, this means that you don't nee
     - `delete` - true (*optional*, if setting must be deleted)
     - `subkeys` - array of strings (*optional*, only works when `delete=true` parameter is passed, otherwise will be ignored)
 
-*When a value has several nested settings, you can delete only some nested settings by passing a parameter `subkeys`, without deleting all settings by key.*
+*When a value have several nested settings, you can delete only some nested settings by passing a parameter `subkeys`, without deleting all settings by key.*
 ```
 [subkey: val1, subkey2: val2, subkey3: val3] \\ initial value
 {"group": ":pleroma", "key": "some_key", "delete": true, "subkeys": [":subkey", ":subkey3"]} \\ passing json for deletion
@@ -1094,7 +1093,6 @@ List of settings which support only full update by subkey:
         {"tuple": [":uploader", "Pleroma.Uploaders.Local"]},
         {"tuple": [":filters", ["Pleroma.Upload.Filter.Dedupe"]]},
         {"tuple": [":link_name", true]},
-        {"tuple": [":proxy_remote", false]},
         {"tuple": [":proxy_opts", [
           {"tuple": [":redirect_on_failure", false]},
           {"tuple": [":max_body_length", 1048576]},
@@ -1132,7 +1130,7 @@ List of settings which support only full update by subkey:
 ## ` GET /api/v1/pleroma/admin/config/descriptions`
 
 ### Get JSON with config descriptions.
-Loads JSON generated from `config/descriptions.exs`.
+Loads json generated from `config/descriptions.exs`.
 
 - Params: none
 - Response:
@@ -1268,6 +1266,7 @@ Loads JSON generated from `config/descriptions.exs`.
 }
 ```
 
+
 ## `POST /api/v1/pleroma/admin/oauth_app`
 
 ### Create OAuth App

docs/docs/development/API/akkoma_api.md

@@ -0,0 +1,146 @@
+# Akkoma API
+
+Request authentication (if required) and parameters work the same as for [Pleroma API](pleroma_api.md).
+
+## `/api/v1/akkoma/preferred_frontend/available`
+### Returns the available frontends which can be picked as the preferred choice
+* Method: `GET`
+* Authentication: not required
+* Params: none
+* Response: JSON
+* Example response:
+```json
+["pleroma-fe/stable"]
+```
+
+!!! note
+    There’s also a browser UI under `/akkoma/frontend`
+    for interactively querying and changing this.
+
+## `/api/v1/akkoma/preferred_frontend`
+### Configures the preferred frontend of this session
+* Method: `PUT`
+* Authentication: not required
+* Params:
+    * `frontend_name`: STRING containing one of the available frontends
+* Response: JSON
+* Example response:
+```json
+{"frontend_name":"pleroma-fe/stable"}
+```
+
+!!! note
+    There’s also a browser UI under `/akkoma/frontend`
+    for interactively querying and changing this.
+
+## `/api/v1/akkoma/metrics`
+### Provides metrics for Prometheus to scrape
+* Method: `GET`
+* Authentication: required (admin:metrics)
+* Params: none
+* Response: text
+* Example response:
+```
+# HELP pleroma_remote_users_total
+# TYPE pleroma_remote_users_total gauge
+pleroma_remote_users_total 25
+# HELP pleroma_local_statuses_total
+# TYPE pleroma_local_statuses_total gauge
+pleroma_local_statuses_total 17
+# HELP pleroma_domains_total
+# TYPE pleroma_domains_total gauge
+pleroma_domains_total 4
+# HELP pleroma_local_users_total
+# TYPE pleroma_local_users_total gauge
+pleroma_local_users_total 3
+...
+```
+
+## `/api/v1/akkoma/translation/languages`
+### Returns available source and target languages for automated text translation
+* Method: `GET`
+* Authentication: required
+* Params: none
+* Response: JSON
+* Example response:
+```json
+{
+  "source": [
+    {"code":"LV", "name":"Latvian"},
+    {"code":"ZH", "name":"Chinese (traditional)"},
+    {"code":"EN-US", "name":"English (American)"}
+  ],
+  "target": [
+    {"code":"EN-GB", "name":"English (British)"},
+    {"code":"JP", "name":"Japanese"}
+  ]
+}
+```
+
+## `/api/v1/akkoma/frontend_settings/:frontend_name`
+### Lists all configuration profiles of the selected frontend for the current user
+* Method: `GET`
+* Authentication: required
+* Params: none
+* Response: JSON
+* Example response:
+```json
+[
+  {"name":"default","version":31}
+]
+```
+
+## `/api/v1/akkoma/frontend_settings/:frontend_name/:profile_name`
+### Returns the full selected frontend settings profile of the current user
+* Method: `GET`
+* Authentication: required
+* Params: none
+* Response: JSON
+* Example response:
+```json
+{
+  "version": 31,
+  "settings": {
+    "streaming": true,
+    "conversationDisplay": "tree",
+    ...
+  }
+}
+```
+
+## `/api/v1/akkoma/frontend_settings/:frontend_name/:profile_name`
+### Updates the frontend settings profile
+* Method: `PUT`
+* Authentication: required
+* Params:
+    * `version`: INTEGER
+    * `settings`: JSON object containing the entire new settings
+* Response: JSON
+* Example response:
+```json
+{
+  "streaming": false,
+  "conversationDisplay": "tree",
+  ...
+}
+```
+
+!!! note
+    The `version` field must be increased by exactly one on each update
+
+## `/api/v1/akkoma/frontend_settings/:frontend_name/:profile_name`
+### Drops the specified frontend settings profile
+* Method: `DELETE`
+* Authentication: required
+* Params: none
+* Response: JSON
+* Example response:
+```json
+{"deleted":"ok"}
+```
+
+
+## `/api/v1/timelines/bubble`
+### Returns a timeline for the local and closely related instances
+Works like all other Mastodon-API timeline queries with the documented
+[Akkoma-specific additions and tweaks](./differences_in_mastoapi_responses.md#timelines).

docs/docs/development/API/differences_in_mastoapi_responses.md

@@ -1,27 +1,35 @@
 # Differences in Mastodon API responses from vanilla Mastodon
 
-An Akkoma instance can be identified by "<Mastodon version> (compatible; Pleroma <version>)" present in `version` field in response from `/api/v1/instance`
+A Akkoma instance can be identified by "<Mastodon version> (compatible; Akkoma <version>)" present in `version` field in response from `/api/v1/instance`
 
 ## Flake IDs
 
-Akkoma uses 128-bit IDs as opposed to Mastodon's 64 bits. However, just like Mastodon's IDs, they are lexically sortable strings
+Akkoma uses 128-bit ids as opposed to Mastodon's 64 bits. However, just like Mastodon's ids, they are lexically sortable strings
 
 ## Timelines
 
+In addition to Mastodon’s timelines, there is also a “bubble timeline” showing
+posts from the local instance and a set of closely related instances as chosen
+by the administrator. It is available under `/api/v1/timelines/bubble`.
+
 Adding the parameter `with_muted=true` to the timeline queries will also return activities by muted (not by blocked!) users.
 
 Adding the parameter `exclude_visibilities` to the timeline queries will exclude the statuses with the given visibilities. The parameter accepts an array of visibility types (`public`, `unlisted`, `private`, `direct`), e.g., `exclude_visibilities[]=direct&exclude_visibilities[]=private`.
 
-Adding the parameter `reply_visibility` to the public and home timelines queries will filter replies. Possible values: without parameter (default) shows all replies, `following` - replies directed to you or users you follow, `self` - replies directed to you.
+Adding the parameter `reply_visibility` to the public, bubble or home timelines queries will filter replies. Possible values: without parameter (default) shows all replies, `following` - replies directed to you or users you follow, `self` - replies directed to you.
 
 Adding the parameter `instance=lain.com` to the public timeline will show only statuses originating from `lain.com` (or any remote instance).
 
-Home, public, hashtag & list timelines accept these parameters:
+All but the direct timeline accept these parameters:
 
 - `only_media`: show only statuses with media attached
-- `local`: show only local statuses
 - `remote`: show only remote statuses
 
+Home, public, hashtag & list timelines further accept:
+
+- `local`: show only local statuses
+
+
 ## Statuses
 
 - `visibility`: has additional possible values `list` and `local` (for local-only statuses)
@@ -33,8 +41,8 @@ Has these additional fields under the `pleroma` object:
 - `conversation_id`: the ID of the AP context the status is associated with (if any)
 - `direct_conversation_id`: the ID of the Mastodon direct message conversation the status is associated with (if any)
 - `in_reply_to_account_acct`: the `acct` property of User entity for replied user (if any)
-- `content`: a map consisting of alternate representations of the `content` property, with the key being its mimetype. Currently, the only alternate representation supported is `text/plain`
-- `spoiler_text`: a map consisting of alternate representations of the `spoiler_text` property, with the key being its mimetype. Currently, the only alternate representation supported is `text/plain`
+- `content`: a map consisting of alternate representations of the `content` property with the key being its mimetype. Currently, the only alternate representation supported is `text/plain`
+- `spoiler_text`: a map consisting of alternate representations of the `spoiler_text` property with the key being its mimetype. Currently, the only alternate representation supported is `text/plain`
 - `expires_at`: a datetime (iso8601) that states when the post will expire (be deleted automatically), or empty if the post won't expire
 - `thread_muted`: true if the thread the post belongs to is muted
 - `emoji_reactions`: A list with emoji / reaction maps. The format is `{name: "☕", count: 2, me: true, account_ids: ["UserID1", "UserID2"]}`.
@@ -93,7 +101,7 @@ Endpoints which accept `with_relationships` parameter:
 
 Has these additional fields under the `pleroma` object:
 
-- `ap_id`: nullable URL string, ActivityPub ID of the user
+- `ap_id`: nullable URL string, ActivityPub id of the user
 - `background_image`: nullable URL string, background image of the user
 - `tags`: Lists an array of tags for the user
 - `relationship` (object): Includes fields as documented for Mastodon API https://docs.joinmastodon.org/entities/relationship/
@@ -113,12 +121,18 @@ Has these additional fields under the `pleroma` object:
 - `notification_settings`: object, can be absent. See `/api/v1/pleroma/notification_settings` for the parameters/keys returned.
 - `favicon`: nullable URL string, Favicon image of the user's instance
 
+Has these additional fields under the `akkoma` object:
+
+- `instance`: nullable object with metadata about the user’s instance
+- `status_ttl_days`: nullable int, default time after which statuses are deleted
+- `permit_followback`: boolean, whether follows from followed accounts are auto-approved
+
 ### Source
 
 Has these additional fields under the `pleroma` object:
 
-- `show_role`: boolean, nullable, true when the user wants his role (e.g. admin, moderator) to be shown
-- `no_rich_text` - boolean, nullable, true when HTML tags are stripped from all statuses requested from the API
+- `show_role`: boolean, nullable, true when the user wants his role (e.g admin, moderator) to be shown
+- `no_rich_text` - boolean, nullable, true when html tags are stripped from all statuses requested from the API
 - `discoverable`: boolean, true when the user allows external services (search bots) etc. to index / list the account (regardless of this setting, user will still appear in regular search results)
 - `actor_type`: string, the type of this account.
 
@@ -186,7 +200,7 @@ An endpoint to delete multiple statuses by IDs.
 
 Required parameters:
 
-- `ids`: array of activity IDs
+- `ids`: array of activity ids
 
 Usage example: `DELETE /api/v1/notifications/destroy_multiple/?ids[]=1&ids[]=2`.
 
@@ -209,7 +223,7 @@ An endpoint to get multiple statuses by IDs.
 
 Required parameters:
 
-- `ids`: array of activity IDs
+- `ids`: array of activity ids
 
 Usage example: `GET /api/v1/statuses/?ids[]=1&ids[]=2`.
 
@@ -247,7 +261,7 @@ All images (avatar, banner and background) can be reset to the default by sendin
 
 ### Akkoma Settings Store
 
-Akkoma has a mechanism that allows frontends to save blobs of JSON for each user on the backend. This can be used to save frontend-specific settings for a user that the backend does not need to know about.
+Akkoma has mechanism that allows frontends to save blobs of json for each user on the backend. This can be used to save frontend-specific settings for a user that the backend does not need to know about.
 
 The parameter should have a form of `{frontend_name: {...}}`, with `frontend_name` identifying your type of client, e.g. `pleroma_fe`. It will overwrite everything under this property, but will not overwrite other frontend's settings.
 
@@ -326,7 +340,7 @@ Permits these additional alert types:
 
 Has these additional fields under the `pleroma` object:
 
-- `unread_count`: contains number of unread notifications
+- `unread_count`: contains number unread notifications
 
 ## Streaming
 
@@ -338,7 +352,7 @@ For viewing remote server timelines, there are `public:remote` and `public:remot
 
 Akkoma streams follow relationships updates as `pleroma:follow_relationships_update` events to the `user` stream.
 
-The message payload consists of:
+The message payload consist of:
 
 - `state`: a relationship state, one of `follow_pending`, `follow_accept` or `follow_reject`.
 

docs/docs/development/ap_extensions.md

@@ -4,7 +4,6 @@
 The following endpoints are additionally present into our actors.
 
 - `oauthRegistrationEndpoint` (`http://litepub.social/ns#oauthRegistrationEndpoint`)
-- `uploadMedia` (`https://www.w3.org/ns/activitystreams#uploadMedia`)
 
 ### oauthRegistrationEndpoint
 
@@ -12,6 +11,279 @@ Points to MastodonAPI `/api/v1/apps` for now.
 
 See <https://docs.joinmastodon.org/methods/apps/>
 
+## Emoji reactions
+
+Emoji reactions are implemented as a new activity type `EmojiReact`.
+A single user is allowed to react multiple times with different emoji to the
+same post. However, they may only react at most once with the same emoji.
+Repeated reaction from the same user with the same emoji are to be ignored.
+Emoji reactions are also distinct from `Like` activities and a user may both
+`Like` and react to a post.
+
+!!! note
+    Misskey also supports emoji reactions, but the implementations differs.
+    It equates likes and reactions and only allows a single reaction per post.
+
+The emoji is placed in the `content` field of the activity
+and the `object` property points to the note reacting to.
+
+Emoji can either be any Unicode emoji sequence or a custom emoji.
+The latter must place their shortcode, including enclosing colons,
+into `content` and put the emoji object inside the `tag` property.
+The `tag` property MAY be omitted for Unicode emoji.
+
+An example reaction with a Unicode emoji:
+```json
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams",
+    "https://example.org/schemas/litepub-0.1.jsonld",
+    {
+      "@language": "und"
+    }
+  ],
+  "type": "EmojiReact",
+  "id": "https://example.org/activities/23143872a0346141",
+  "actor": "https://example.org/users/akko",
+  "nickname": "akko",
+  "to": ["https://remote.example/users/diana", "https://example.org/users/akko/followers"],
+  "cc": ["https://www.w3.org/ns/activitystreams#Public"],
+  "content": "🧡",
+  "object": "https://remote.example/objects/9f0e93499d8314a9"
+}
+```
+
+An example reaction with a custom emoji:
+```json
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams",
+    "https://example.org/schemas/litepub-0.1.jsonld",
+    {
+      "@language": "und"
+    }
+  ],
+  "type": "EmojiReact",
+  "id": "https://example.org/activities/d75586dec0541650",
+  "actor": "https://example.org/users/akko",
+  "nickname": "akko",
+  "to": ["https://remote.example/users/diana", "https://example.org/users/akko/followers"],
+  "cc": ["https://www.w3.org/ns/activitystreams#Public"],
+  "content": ":mouse:",
+  "object": "https://remote.example/objects/9f0e93499d8314a9",
+  "tag": [{
+    "type": "Emoji",
+    "id": null,
+    "name": "mouse",
+    "icon": {
+      "type": "Image",
+      "url": "https://example.org/emoji/mouse/mouse.png"
+    }
+  }]
+}
+```
+
+!!! note
+    Although an emoji reaction can only contain a single emoji,
+    for compatibility with older versions of Pleroma and Akkoma,
+    it is recommended to wrap the emoji object in a single-element array.
+
+When reacting with a remote custom emoji do not include the remote domain in `content`’s shortcode
+*(unlike in our REST API which needs the domain)*:
+```json
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams",
+    "https://example.org/schemas/litepub-0.1.jsonld",
+    {
+      "@language": "und"
+    }
+  ],
+  "type": "EmojiReact",
+  "id": "https://example.org/activities/7993dcae98d8d5ec",
+  "actor": "https://example.org/users/akko",
+  "nickname": "akko",
+  "to": ["https://remote.example/users/diana", "https://example.org/users/akko/followers"],
+  "cc": ["https://www.w3.org/ns/activitystreams#Public"],
+  "content": ":hug:",
+  "object": "https://remote.example/objects/9f0e93499d8314a9",
+  "tag": [{
+    "type": "Emoji",
+    "id": "https://other.example/emojis/hug",
+    "name": "hug",
+    "icon": {
+      "type": "Image",
+      "url": "https://other.example/files/b71cea432b3fad67.webp"
+    }
+  }]
+}
+```
+
+Emoji reactions can be retracted using a standard `Undo` activity:
+```json
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams",
+    "http://example.org/schemas/litepub-0.1.jsonld",
+    {
+      "@language": "und"
+    }
+  ],
+  "type": "Undo",
+  "id": "http://example.org/activities/4685792e-efb6-4309-b508-ae4f355dd695",
+  "actor": "https://example.org/users/akko",
+  "to": ["https://remote.example/users/diana", "https://example.org/users/akko/followers"],
+  "cc": ["https://www.w3.org/ns/activitystreams#Public"],
+  "object": "https://example.org/activities/23143872a0346141"
+}
+```
+
+## User profile backgrounds
+
+Akkoma federates user profile backgrounds the same way as Sharkey.
+
+An actors ActivityPub representation contains an additional
+`backgroundUrl` property containing an `Image` object. This property
+belongs to the `"sharkey": "https://joinsharkey.org/ns#"` namespace.
+
+## Quote Posts
+
+Akkoma allows referencing a single other note as a quote,
+which will be prominently displayed in the interface.
+
+The quoted post is referenced by its ActivityPub id in the `quoteUri` property.
+
+!!! note
+    Old Misskey only understood and modern Misskey still prefers
+    the `_misskey_quote` property for this. Similar some other older
+    software used `quoteUrl` or `quoteURL`.  
+    All current implementations with quote support understand `quoteUri`.
+
+Example:
+```json
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams",
+    "https://example.org/schemas/litepub-0.1.jsonld",
+    {
+      "@language": "und"
+    }
+  ],
+  "type": "Note",
+  "id": "https://example.org/activities/85717e587f95d5c0",
+  "actor": "https://example.org/users/akko",
+  "to": ["https://remote.example/users/diana", "https://example.org/users/akko/followers"],
+  "cc": ["https://www.w3.org/ns/activitystreams#Public"],
+  "context": "https://example.org/contexts/1",
+  "content": "Look at that!",
+  "quoteUri": "http://remote.example/status/85717e587f95d5c0",
+  "contentMap": {
+    "en": "Look at that!"
+  },
+  "source": {
+    "content": "Look at that!",
+    "mediaType": "text/plain"
+  },
+  "published": "2024-04-06T23:40:28Z",
+  "updated": "2024-04-06T23:40:28Z",
+  "attachemnt": [],
+  "tag": []
+}
+```
+
+## Threads
+
+Akkoma assigns all posts of the same thread the same `context`. This is a
+standard ActivityPub property but its meaning is left vague. Akkoma will
+always treat posts with identical `context` as part of the same thread.
+
+`context` must not be assumed to hold any meaning or be dereferencable.
+
+Incoming posts without `context` will be assigned a new context.
+
+!!! note
+    Mastodon uses the non-standard `conversation` property for the same purpose
+    *(named after an older OStatus property)*. For incoming posts without
+    `context` but with `converstions` Akkoma will use the value from
+    `conversations` to fill in `context`.
+    For outgoing posts Akkoma will duplicate the context into `conversation`.
+
+## Post Source
+
+Unlike Mastodon, Akkoma supports drafting posts in multiple source formats
+besides plaintext, like Markdown or MFM. The original input is preserved
+in the standard ActivityPub `source` property *(not supported by Mastodon)*.
+Still, `content` will always be present and contain the prerendered HTML form.
+
+Supported `mediaType` include:
+- `text/plain`
+- `text/markdown`
+- `text/bbcode`
+- `text/x.misskeymarkdown`
+
+## Post Language
+
+!!! note
+    This is also supported in and compatible with Mastodon, but since
+    joinmastodon.org doesn’t document it yet it is included here.
+    [GoToSocial](https://docs.gotosocial.org/en/latest/federation/federating_with_gotosocial/#content-contentmap-and-language)
+    has a more refined version of this which can correctly deal with multiple language entries.
+
+A post can indicate its language by including a `contentMap` object
+which contains a sub key named after the language’s ISO 639-1 code
+and it’s content identical to the post’s `content` field.
+
+Currently Akkoma, just like Mastodon, only properly supports a single language entry,
+in case of multiple entries a random language will be picked.  
+Furthermore, Akkoma currently only reads the `content` field
+and never the value from `contentMap`.
+
+## Local post scope
+
+Post using this scope will never federate to other servers
+but for the sake of completeness it is listed here.
+
+In addition to the usual scopes *(public, unlisted, followers-only, direct)*
+Akkoma supports an “unlisted” post scope. Such posts will not federate to
+other instances and only be shown to logged-in users on the same instance.
+It is included into the local timeline.  
+This may be useful to discuss or announce instance-specific policies and topics.
+
+A post is addressed to the local scope by including `<base url of instance>/#Public`
+in its `to` field. E.g. if the instance is on `https://example.org` it would use
+`https://example.org/#Public`.
+
+An implementation creating a new post MUST NOT address both the local and
+general public scope `as:Public` at the same time. A post addressing the local
+scope MUST NOT be sent to other instances or be possible to fetch by other
+instances regardless of potential other listed addressees.
+
+When receiving a remote post addressing both the public scope and what appears
+to be a local-scope identifier, the post SHOULD be treated without assigning any
+special meaning to the potential local-scope identifier.
+
+!!! note
+    Misskey-derivatives have a similar concept of non-federated posts,
+    however those are also shown publicly on the local web interface
+    and are thus visible to non-members.
+
+## List post scope
+
+Messages originally addressed to a custom list will contain
+a `listMessage` field with an unresolvable pseudo ActivityPub id.
+
+# Deprecated and Removed Extensions
+
+The following extensions were used in the past but have been dropped.
+Documentation is retained here as a reference and since old objects might
+still contains related fields.
+
+## Actor endpoints
+
+The following endpoints used to be present:
+
+- `uploadMedia` (`https://www.w3.org/ns/activitystreams#uploadMedia`)
+
 ### uploadMedia
 
 Inspired by <https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload>, it is part of the ActivityStreams namespace because it used to be part of the ActivityPub specification and got removed from it.

docs/docs/development/authentication_authorization.md

@@ -10,7 +10,7 @@
 
   For routes with `:authenticated_api` pipeline, authentication & authorization are expected, thus `OAuthScopesPlug` will be run unless explicitly skipped (also `EnsureAuthenticatedPlug` will be executed immediately before action even if there was an early run to give an early error, since `OAuthScopesPlug` supports `:proceed_unauthenticated` option, and other plugs may support similar options as well).
 
-  For `:api` pipeline routes, it'll be verified whether `OAuthScopesPlug` was called or explicitly skipped, and if it was not, then auth information will be dropped for request. Then `EnsurePublicOrAuthenticatedPlug` will be called to ensure that either the instance is not private or user is authenticated (unless explicitly skipped). Such automated checks help to prevent human errors and result in higher security / privacy for users.
+  For `:api` pipeline routes, it'll be verified whether `OAuthScopesPlug` was called or explicitly skipped, and if it was not then auth information will be dropped for request. Then `EnsurePublicOrAuthenticatedPlug` will be called to ensure that either the instance is not private or user is authenticated (unless explicitly skipped). Such automated checks help to prevent human errors and result in higher security / privacy for users.
 
 ## Non-OAuth authentication
 

docs/docs/development/index.md

@@ -18,24 +18,24 @@ The docs are written in Markdown, including certain extensions, and can be found
 
 ## Technology
 
-Akkoma is written in [Elixir](https://elixir-lang.org/) and uses [PostgreSQL](https://www.postgresql.org/) for database. We use [Git](https://git-scm.com/) for collaboration and tracking code changes. Furthermore it can typically run on [Unix and Unix-like OS'es](https://en.wikipedia.org/wiki/Unix-like). For development, you should use an OS which [can run Akkoma](../installation/debian_based_en/).
+Akkoma is written in [Elixir](https://elixir-lang.org/) and uses [Postgresql](https://www.postgresql.org/) for database. We use [Git](https://git-scm.com/) for collaboration and tracking code changes. Furthermore it can typically run on [Unix and Unix-like OS'es](https://en.wikipedia.org/wiki/Unix-like). For development, you should use an OS which [can run Akkoma](../installation/debian_based_en/).
 
-It's good to have at least some basic understanding of at least Git and Elixir. If this is completely new for you, there are some [videos explaining Git](https://git-scm.com/doc) and Codeberg has a nice article explaining the typical [pull requests Git flow](https://docs.codeberg.org/collaborating/pull-requests-and-git-flow/). For Elixir, you can follow Elixir's own [Getting Started guide](https://elixir-lang.org/getting-started/introduction.html).
+It's good to have at least some basic understanding of at least Git and Elixir. If this is completely new for you, there's some [videos explaining Git](https://git-scm.com/doc) and Codeberg has a nice article explaining the typical [pull requests Git flow](https://docs.codeberg.org/collaborating/pull-requests-and-git-flow/). For Elixir, you can follow Elixir's own [Getting Started guide](https://elixir-lang.org/getting-started/introduction.html).
 
 ## Setting up a development environment
 
-The best way to start is getting the software to run from source, so you can start poking on it. Check out the [guides for setting up an Akkoma instance for development](setting_up_akkoma_dev/#setting-up-a-akkoma-development-environment).
+The best way to start is getting the software to run from source so you can start poking on it. Check out the [guides for setting up an Akkoma instance for development](setting_up_akkoma_dev/#setting-up-a-akkoma-development-environment).
 
 ## General overview
 ### Modules
 
-Akkoma has several modules. There are modules for [uploading](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/uploaders), [upload filters](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/upload/filter), [translators](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/akkoma/translators)... The most famous ones are without a doubt the [MRF policies](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/web/activity_pub/mrf). Modules are often self-contained and a good way to start with development because you don't have to think about much more than just the module itself. We even have an example on [writing your own MRF policy](/configuration/mrf/#writing-your-own-mrf-policy)!
+Akkoma has several modules. There are modules for [uploading](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/uploaders), [upload filters](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/upload/filter), [translators](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/akkoma/translators)... The most famous ones are without a doubt the [MRF policies](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/web/activity_pub/mrf). Modules are often self contained and a good way to start with development because you don't have to think about much more than just the module itself. We even have an example on [writing your own MRF policy](/configuration/mrf/#writing-your-own-mrf-policy)!
 
 Another easy entry point is the [mix tasks](https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/mix/tasks/pleroma). They too are often self contained and don't need you to go through much of the code.
 
 ### Activity Streams/Activity Pub
 
-Akkoma uses Activity Streams for both federation, and internal representation. It may be interesting to at least go over the specifications of [Activity Pub](https://www.w3.org/TR/activitypub/), [Activity Streams 2.0](https://www.w3.org/TR/activitystreams-core/), and [Activity Streams Vocabulary](https://www.w3.org/TR/activitystreams-vocabulary/). Note that these are not enough to have a full grasp of how everything works, but should at least give you the basics to understand how messages are passed between and inside Akkoma instances.
+Akkoma uses Activity Streams for both federation, as well as internal representation. It may be interesting to at least go over the specifications of [Activity Pub](https://www.w3.org/TR/activitypub/), [Activity Streams 2.0](https://www.w3.org/TR/activitystreams-core/), and [Activity Streams Vocabulary](https://www.w3.org/TR/activitystreams-vocabulary/). Note that these are not enough to have a full grasp of how everything works, but should at least give you the basics to understand how messages are passed between and inside Akkoma instances.
 
 ## Don't forget
 

docs/docs/development/nodeinfo_extensions.md

@@ -0,0 +1,141 @@
+# Nodeinfo Extensions
+
+Akkoma currently implements version 2.0 and 2.1 of nodeinfo spec,
+but provides the following additional fields.
+
+## metadata
+
+The spec leaves the content of `metadata` up to implementations
+and indeed Akkoma adds many fields here apart from the commonly
+found `nodeName` and `nodeDescription` fields.
+
+### accountActivationRequired
+Whether or not users need to confirm their email before completing registration.
+*(boolean)*
+
+!!! note
+    Not to be confused with account approval, where each registration needs to
+    be manually approved by an admin. Account approval has no nodeinfo entry.
+
+### features
+
+Array of strings denoting supported server features. E.g. a server supporting
+quote posts should include a `"quote_posting"` entry here.
+
+A non-exhaustive list of possible features:
+- `polls`
+- `quote_posting`
+- `editing`
+- `bubble_timeline`
+- `pleroma_emoji_reactions` *(Unicode emoji)*
+- `custom_emoji_reactions`
+- `akkoma_api`
+- `akkoma:machine_translation`
+- `mastodon_api`
+- `pleroma_api`
+
+### federatedTimelineAvailable
+Whether or not the “federated timeline”, i.e. a timeline containing posts from
+the entire known network, is made available.
+*(boolean)*
+
+### federation
+This section is optional and can contain various custom keys describing federation policies.
+The following are required to be presented:
+- `enabled` *(boolean)* whether the server federates at all
+
+A non-exhaustive list of optional keys:
+- `exclusions` *(boolean)* whether some federation policies are withheld
+- `mrf_simple` *(object)* describes how the Simple MRF policy is configured
+
+### fieldsLimits
+A JSON object documenting restriction for user account info fields.
+All properties are integers.
+
+- `maxFields` maximum number of account info fields local users can create
+- `maxRemoteFields` maximum number of account info fields remote users can have
+   before the user gets rejected or fields truncated
+- `nameLength` maximum length of a field’s name
+- `valueLength` maximum length of a field’s value
+
+### invitesEnabled
+Whether or not signing up via invite codes is possible.
+*(boolean)*
+
+### localBubbleInstances
+Array of domains (as strings) of other instances chosen
+by the admin which are shown in the bubble timeline.
+
+### mailerEnabled
+Whether or not the instance can send out emails.
+*(boolean)*
+
+### nodeDescription
+Human-friendly description of this instance
+*(string)*
+
+### nodeName
+Human-friendly name of this instance
+*(string)*
+
+### pollLimits
+JSON object containing limits for polls created by local users.
+All values are integers.
+- `max_options` maximum number of poll options
+- `max_option_chars` maximum characters per poll option
+- `min_expiration` minimum time in seconds a poll must be open for
+- `max_expiration` maximum time a poll is allowed to be open for
+
+### postFormats
+Array of strings containing media types for supported post source formats.
+A non-exhaustive list of possible values:
+- `text/plain`
+- `text/markdown`
+- `text/bbcode`
+- `text/x.misskeymarkdown`
+
+### private
+Whether or not unauthenticated API access is permitted.
+*(boolean)*
+
+### privilegedStaff
+Whether or not moderators are trusted to perform some
+additional tasks like e.g. issuing password reset emails.
+
+### publicTimelineVisibility
+JSON object containing boolean-valued keys reporting
+if a given timeline can be viewed without login.
+- `local`
+- `federated`
+- `bubble`
+
+### restrictedNicknames
+Array of strings listing nicknames forbidden to be used during signup.
+
+### skipThreadContainment
+Whether broken threads are filtered out
+*(boolean)*
+
+### staffAccounts
+Array containing ActivityPub IDs of local accounts
+with some form of elevated privilege on the instance.
+
+### suggestions
+JSON object containing info on whether the interaction-based
+Mastodon `/api/v1/suggestions` feature is enabled and optionally
+additional implementation-defined fields with more details
+on e.g. how suggested users are selected.
+
+!!! note
+    This has no relation to the newer /api/v2/suggestions API
+    which also (or exclusively) contains staff-curated entries.
+
+- `enabled` *(boolean)* whether or not user recommendations are enabled
+
+### uploadLimits
+JSON object documenting various upload-related size limits.
+All values are integers and in bytes.
+- `avatar` maximum size of uploaded user avatars
+- `banner` maximum size of uploaded user profile banners
+- `background` maximum size of uploaded user profile backgrounds
+- `general` maximum size for all other kinds of uploads

docs/docs/development/setting_up_akkoma_dev.md

@@ -1,38 +1,38 @@
-# Setting up an Akkoma development environment
+# Setting up a Akkoma development environment
 
 Akkoma requires some adjustments from the defaults for running the instance locally. The following should help you to get started.
 
 ## Installing
 
 1. Install Akkoma as explained in [the docs](../installation/debian_based_en.md), with some exceptions:
-    * No need to create a dedicated Akkoma user, it's easier to just use your own user
-    * You can use your own fork of the repository and add Akkoma as a remote `git remote add akkoma 'https://akkoma.dev/AkkomaGang/akkoma.git'`
-    * For domain, you can use `localhost`
-    * For the DB, you can still choose a dedicated user. The mix tasks sets it up, so it's no extra work for you
-    * Instead of creating a `prod.secret.exs`, create `dev.secret.exs`
+    * No need to create a dedicated akkoma user, it's easier to just use your own user
+    * You can use your own fork of the repository and add akkoma as a remote `git remote add akkoma 'https://akkoma.dev/AkkomaGang/akkoma.git'`
+    * For domain you can use `localhost`
+    * For the DB you can still choose a dedicated user. The mix tasks sets it up, so it's no extra work for you
+    * instead of creating a `prod.secret.exs`, create `dev.secret.exs`
     * No need to prefix with `MIX_ENV=prod`. We're using dev and that's the default MIX_ENV
-    * You can skip NGINX and systemd
+    * You can skip nginx and systemd
     * For front-end, you'll probably want to install and use the develop branch instead of the stable branch. There's no guarantee that the stable branch of the FE will always work on the develop branch of the BE.
 2. Change the dev.secret.exs
     * Change the FE settings to use the installed branch (see also [Frontend Management](/configuration/frontend_management/))
-    * Change the scheme in `config :pleroma, Pleroma.Web.Endpoint` to HTTP (see examples below)
+    * Change the scheme in `config :pleroma, Pleroma.Web.Endpoint` to http (see examples below)
     * If you want to change other settings, you can do that too
-3. You can now start the server with `mix phx.server`. Once it's build and started, you can access the instance on `http://<host>:<port>` (e.g. http://localhost:4000 ) and should be able to do everything locally you normally can.
+3. You can now start the server with `mix phx.server`. Once it's build and started, you can access the instance on `http://<host>:<port>` (e.g.http://localhost:4000 ) and should be able to do everything locally you normally can.
 
-Example on how to install Pleroma-fe and Admin-fe using its develop branch
+Example on how to install pleroma-fe and admin-fe using it's develop branch
 ```sh
 mix pleroma.frontend install pleroma-fe --ref develop
 mix pleroma.frontend install admin-fe --ref develop
 ```
 
-Example config to use the Pleroma-fe and Admin-fe installed from the develop branch
+Example config to use the pleroma-fe and admin-fe installed from the develop branch
 ```elixir
 config :pleroma, :frontends,
   primary: %{"name" => "pleroma-fe", "ref" => "develop"},
   admin: %{"name" => "admin-fe", "ref" => "develop"}
 ```
 
-Example config to change the scheme to HTTP. Change the port if you want to run on another port.
+Example config to change the scheme to http. Change the port if you want to run on another port.
 ```elixir
 config :pleroma, Pleroma.Web.Endpoint,
   url: [host: "localhost", scheme: "http", port: 4000],
@@ -53,7 +53,7 @@ config :logger, :console,
 
 ## Testing with HTTPS
 
-If you end up developing alongside other software like Misskey,
+If you end up developing alongside other software like misskey,
 you will not be able to federate without an SSL certificate. You should
 be able to use the snakeoil certificate that comes standard with most
 distributions or generate one from scratch, then force elixir to accept it.

docs/docs/index.md

@@ -1,12 +1,11 @@
-!!! note
-    Akkoma documentation is still being updated, so you may still see references to Pleroma in many places.
+**Note:** Akkoma documentation is still being updated, so you may still see references to Pleroma in many places.
 
 # Introduction to Akkoma
 ## What is Akkoma?
 Akkoma is a federated social networking platform, compatible with Mastodon and other ActivityPub implementations. It is free software licensed under the AGPLv3.
 It actually consists of two components: a backend, named simply Akkoma, and a user-facing frontend, named Akkoma-FE. It also includes the Mastodon frontend, if that's your thing.
-It's part of what we call the Fediverse, a federated network of instances which speak common protocols and can communicate with each other.
-One account on an instance is enough to talk to the entire Fediverse!
+It's part of what we call the fediverse, a federated network of instances which speak common protocols and can communicate with each other.
+One account on an instance is enough to talk to the entire fediverse!
 
 ## Community Channels
 
@@ -30,14 +29,15 @@ If you don't feel like joining an existing instance, but instead prefer to deplo
 Installation instructions can be found in the installation section of these docs.
 
 ## I got an account, now what?
-Great! Now you can explore the Fediverse! Open the login page for your Akkoma instance (e.g. <https://otp.akkoma.dev>) and login with your username and password. (If you don't have an account yet, click on Register)
+Great! Now you can explore the fediverse! Open the login page for your Akkoma instance (e.g. <https://otp.akkoma.dev>) and login with your username and password. (If you don't have an account yet, click on Register)
 
 ### Akkoma-FE
 The default front-end used by Akkoma is Akkoma-FE. You can find more information on what it is and how to use it in the [Introduction to Akkoma-FE](https://docs-fe.akkoma.dev/stable/).
 
 ### Mastodon interface
-If the Akkoma-FE interface isn't your thing, or you're just trying something new, but you want to keep using the familiar Mastodon interface, we got that too!
-Just add a "/web" after your instance URL (e.g. <https://otp.akkoma.dev/web>) and you'll end on the Mastodon web interface, but with an Akkoma backend! MAGIC!
-The Mastodon interface is from the Glitch-soc fork. For more information on the Mastodon interface, you can check the [Mastodon](https://docs.joinmastodon.org/) and [Glitch-soc](https://glitch-soc.github.io/docs/) documentation.
+If the Akkoma-FE interface isn't your thing, or you're just trying something new but you want to keep using the familiar Mastodon interface, we got that too!
+Just add a "/web" after your instance url (e.g. <https://otp.akkoma.dev/web>) and you'll end on the Mastodon web interface, but with a Akkoma backend! MAGIC!
+The Mastodon interface is from the Glitch-soc fork. For more information on the Mastodon interface you can check the [Mastodon](https://docs.joinmastodon.org/) and [Glitch-soc](https://glitch-soc.github.io/docs/) documentation.
 
 Remember, what you see is only the frontend part of Mastodon, the backend is still Akkoma.
+

docs/docs/installation/alpine_linux_en.md

@@ -14,7 +14,7 @@ If you want to run this guide with root, ignore the `doas` at the beginning of t
 
 ### Prepare the system
 
-* The community repository must be enabled in `/etc/apk/repositories`. Depending on which version and mirror you use, this looks like `https://dl-5.alpinelinux.org/alpine/v3.16/community`. If you autogenerated the mirror during installation:
+* The community repository must be enabled in `/etc/apk/repositories`. Depending on which version and mirror you use this looks like `https://dl-5.alpinelinux.org/alpine/v3.16/community`. If you autogenerated the mirror during installation:
 
 ```shell
 awk 'NR==2' /etc/apk/repositories | sed 's/main/community/' | tee -a /etc/apk/repositories
@@ -41,7 +41,7 @@ doas apk add git build-base cmake file-dev
 doas apk add erlang elixir
 ```
 
-* Install `erlang-eldap` if you want to enable LDAP authenticator
+* Install `erlang-eldap` if you want to enable ldap authenticator
 
 ```shell
 doas apk add erlang-eldap
@@ -49,7 +49,7 @@ doas apk add erlang-eldap
 
 ### Install PostgreSQL
 
-* Install PostgreSQL server:
+* Install Postgresql server:
 
 ```shell
 doas apk add postgresql postgresql-contrib
@@ -61,7 +61,7 @@ doas apk add postgresql postgresql-contrib
 doas rc-service postgresql start
 ```
 
-* Enable and start PostgreSQL server:
+* Enable and start postgresql server:
 
 ```shell
 doas rc-update add postgresql
@@ -73,7 +73,7 @@ doas rc-update add postgresql
 doas apk add ffmpeg imagemagick exiftool
 ```
 
-### Install Akkoma-be
+### Install AkkomaBE
 
 * Add a new system user for the Akkoma service:
 
@@ -82,10 +82,9 @@ doas addgroup akkoma
 doas adduser -S -s /bin/false -h /opt/akkoma -H -G akkoma akkoma
 ```
 
-!!! note
-    To execute a single command as the Akkoma system user, use `doas -u akkoma command`. You can also switch to a shell by using `doas -su akkoma`. If you don’t have and want `doas` on your system, you can use `su` as root user (UID 0) for a single command by using `su -l akkoma -s $SHELL -c 'command'` and `su -l akkoma -s $SHELL` for starting a shell.
+**Note**: To execute a single command as the Akkoma system user, use `doas -u akkoma command`. You can also switch to a shell by using `doas -su akkoma`. If you don’t have and want `doas` on your system, you can use `su` as root user (UID 0) for a single command by using `su -l akkoma -s $SHELL -c 'command'` and `su -l akkoma -s $SHELL` for starting a shell.
 
-* Git clone the akkoma-be repository from stable-branch and make the Akkoma user the owner of the directory:
+* Git clone the AkkomaBE repository from stable-branch and make the Akkoma user the owner of the directory:
 
 ```shell
 doas mkdir -p /opt/akkoma
@@ -107,8 +106,8 @@ doas -u akkoma mix deps.get
 
 * Generate the configuration: `doas -u akkoma env MIX_ENV=prod mix pleroma.instance gen`
   * Answer with `yes` if it asks you to install `rebar3`.
-  * This may take some time, because parts of Akkoma get compiled first.
-  * After that, it will ask you a few questions about your instance and generates a configuration file in `config/generated_config.exs`.
+  * This may take some time, because parts of akkoma get compiled first.
+  * After that it will ask you a few questions about your instance and generates a configuration file in `config/generated_config.exs`.
 
 * Check the configuration and if all looks right, rename it, so Akkoma will load it (`prod.secret.exs` for productive instances):
 
@@ -116,7 +115,7 @@ doas -u akkoma mix deps.get
 doas -u akkoma mv config/{generated_config.exs,prod.secret.exs}
 ```
 
-* The previous command also creates the file `config/setup_db.psql`, with which you can create the database:
+* The previous command creates also the file `config/setup_db.psql`, with which you can create the database:
 
 ```shell
 doas -u postgres psql -f config/setup_db.psql
@@ -136,68 +135,61 @@ doas -u akkoma env MIX_ENV=prod mix phx.server
 
 ### Finalize installation
 
-If you want to open your newly installed instance to the world, you should run NGINX or some other webserver/proxy in front of Akkoma and you should consider to create an OpenRC service file for Akkoma.
+If you want to open your newly installed instance to the world, you should run nginx or some other webserver/proxy in front of Akkoma and you should consider to create an OpenRC service file for Akkoma.
 
-#### NGINX
+#### Nginx
 
-* Install NGINX, if not already done:
+* Install nginx, if not already done:
 
 ```shell
 doas apk add nginx
 ```
 
-* Set up your SSL cert, using your method of choice or Certbot. If using Certbot, first install it:
-
-```shell
-doas apk add certbot
-```
-
-and then set it up:
-
-```shell
-doas mkdir -p /var/lib/letsencrypt/
-doas certbot certonly --email <your@emailaddress> -d <yourdomain> --standalone
-```
-
-If that doesn’t work, make sure, that NGINX is not already running. If it still doesn’t work, try setting up NGINX first (change SSL “on” to “off” and try again).
-
-* Copy the example NGINX configuration to the NGINX folder
+* Copy the example nginx configuration to the nginx folder
 
 ```shell
 doas cp /opt/akkoma/installation/nginx/akkoma.nginx /etc/nginx/conf.d/akkoma.conf
 ```
 
-* Before starting NGINX, edit the configuration and change it to your needs. You must change `server_name` and the paths to the certificates. You can use `nano` (install with `apk add nano` if missing).
-
-```
-server {
-    server_name    your.domain;
-    listen         80;
-    ...
-}
-
-server {
-    server_name your.domain;
-    listen 443 ssl http2;
-    ...
-    ssl_trusted_certificate   /etc/letsencrypt/live/your.domain/chain.pem;
-    ssl_certificate           /etc/letsencrypt/live/your.domain/fullchain.pem;
-    ssl_certificate_key       /etc/letsencrypt/live/your.domain/privkey.pem;
-    ...
-}
-```
-
-* Enable and start NGINX:
+* Before starting nginx edit the configuration and change it to your needs. You must change change `server_name`. You can use `nano` (install with `apk add nano` if missing).
+* Enable and start nginx:
 
 ```shell
 doas rc-update add nginx
 doas rc-service nginx start
 ```
 
-If you need to renew the certificate in the future, uncomment the relevant location block in the NGINX config and run:
+* Setup your SSL cert, using your method of choice or certbot. If using certbot, first install it:
 
 ```shell
-doas certbot certonly --email <your@emailaddress> -d <yourdomain> --webroot -w /var/lib/letsencrypt/
+doas apk add certbot certbot-nginx
+```
+
+and then set it up:
+
+```shell
+doas mkdir -p /var/lib/letsencrypt/
+doas certbot --email <your@emailaddress> -d <yourdomain> -d <media_domain> --nginx
+```
+
+If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. A common source of problems are nginx config syntax errors; this can be checked for by running `nginx -t`.
+
+To automatically renew, set up a cron job like so:
+
+```shell
+# Enable the crond service
+doas rc-update add crond
+doas rc-service crond start
+
+# Test that renewals work
+doas certbot renew --cert-name yourinstance.tld --nginx --dry-run
+
+# Add the renewal task to cron
+echo '#!/bin/sh
+certbot renew --cert-name yourinstance.tld --nginx
+' | doas tee /etc/periodic/daily/renew-akkoma-cert
+doas chmod +x /etc/periodic/daily/renew-akkoma-cert
+
 ```
 
 #### OpenRC service

docs/docs/installation/arch_linux_en.md

@@ -19,7 +19,7 @@ This guide will assume that you have administrative rights, either as root or a
 
 * `nginx` (preferred, example configs for other reverse proxies can be found in the repo)
 * `certbot` (or any other ACME client for Let’s Encrypt certificates)
-* `imagemagick`
+* `ImageMagick`
 * `ffmpeg`
 * `exiftool`
 
@@ -31,7 +31,7 @@ This guide will assume that you have administrative rights, either as root or a
 sudo pacman -Syu
 ```
 
-* Install some of the above-mentioned programs:
+* Install some of the above mentioned programs:
 
 ```shell
 sudo pacman -S git base-devel elixir cmake file
@@ -65,7 +65,7 @@ sudo systemctl enable --now postgresql.service
 sudo pacman -S ffmpeg imagemagick perl-image-exiftool
 ```
 
-### Install Akkoma-be
+### Install AkkomaBE
 
 * Add a new system user for the Akkoma service:
 
@@ -73,10 +73,9 @@ sudo pacman -S ffmpeg imagemagick perl-image-exiftool
 sudo useradd -r -s /bin/false -m -d /var/lib/akkoma -U akkoma
 ```
 
-!!! note
-    To execute a single command as the Akkoma system user, use `sudo -Hu akkoma command`. You can also switch to a shell by using `sudo -Hu akkoma $SHELL`. If you don’t have and want `sudo` on your system, you can use `su` as root user (UID 0) for a single command by using `su -l akkoma -s $SHELL -c 'command'` and `su -l akkoma -s $SHELL` for starting a shell.
+**Note**: To execute a single command as the Akkoma system user, use `sudo -Hu akkoma command`. You can also switch to a shell by using `sudo -Hu akkoma $SHELL`. If you don’t have and want `sudo` on your system, you can use `su` as root user (UID 0) for a single command by using `su -l akkoma -s $SHELL -c 'command'` and `su -l akkoma -s $SHELL` for starting a shell.
 
-* Git clone the akkoma-be repository from stable-branch and make the Akkoma user the owner of the directory:
+* Git clone the AkkomaBE repository from stable-branch and make the Akkoma user the owner of the directory:
 
 ```shell
 sudo mkdir -p /opt/akkoma
@@ -98,8 +97,8 @@ sudo -Hu akkoma mix deps.get
 
 * Generate the configuration: `sudo -Hu akkoma MIX_ENV=prod mix pleroma.instance gen`
   * Answer with `yes` if it asks you to install `rebar3`.
-  * This may take some time, because parts of Akkoma get compiled first.
-  * After that, it will ask you a few questions about your instance and generates a configuration file in `config/generated_config.exs`.
+  * This may take some time, because parts of akkoma get compiled first.
+  * After that it will ask you a few questions about your instance and generates a configuration file in `config/generated_config.exs`.
 
 * Check the configuration and if all looks right, rename it, so Akkoma will load it (`prod.secret.exs` for productive instances):
 
@@ -107,7 +106,7 @@ sudo -Hu akkoma mix deps.get
 sudo -Hu akkoma mv config/{generated_config.exs,prod.secret.exs}
 ```
 
-* The previous command also creates the file `config/setup_db.psql`, with which you can create the database:
+* The previous command creates also the file `config/setup_db.psql`, with which you can create the database:
 
 ```shell
 sudo -Hu postgres psql -f config/setup_db.psql
@@ -127,29 +126,30 @@ sudo -Hu akkoma MIX_ENV=prod mix phx.server
 
 ### Finalize installation
 
-If you want to open your newly installed instance to the world, you should run NGINX or some other webserver/proxy in front of Akkoma and you should consider to create a systemd service file for Akkoma.
+If you want to open your newly installed instance to the world, you should run nginx or some other webserver/proxy in front of Akkoma and you should consider to create a systemd service file for Akkoma.
 
-#### NGINX
+#### Nginx
 
-* Install NGINX, if not already done:
+* Install nginx, if not already done:
 
 ```shell
 sudo pacman -S nginx
 ```
 
-* Create directories for available and enabled sites:
+* Copy the example nginx configuration:
 
 ```shell
-sudo mkdir -p /etc/nginx/sites-{available,enabled}
+sudo cp /opt/akkoma/installation/nginx/akkoma.nginx /etc/nginx/conf.d/akkoma.conf
 ```
 
-* Append the following line at the end of the `http` block in `/etc/nginx/nginx.conf`:
+* Before starting nginx edit the configuration and change it to your needs (e.g. change servername, change cert paths)
+* Enable and start nginx:
 
-```Nginx
-include sites-enabled/*;
+```shell
+sudo systemctl enable --now nginx.service
 ```
 
-* Setup your SSL cert, using your method of choice or Certbot. If using Certbot, first install it:
+* Setup your SSL cert, using your method of choice or certbot. If using certbot, first install it:
 
 ```shell
 sudo pacman -S certbot certbot-nginx
@@ -159,32 +159,18 @@ and then set it up:
 
 ```shell
 sudo mkdir -p /var/lib/letsencrypt/
-sudo certbot certonly --email <your@emailaddress> -d <yourdomain> --standalone
+sudo certbot --email <your@emailaddress> -d <yourdomain> -d <media_domain> --nginx
 ```
 
-If that doesn’t work, make sure, that NGINX is not already running. If it still doesn’t work, try setting up NGINX first (change SSL “on” to “off” and try again).
+If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. A common source of problems are nginx config syntax errors; this can be checked for by running `nginx -t`.
 
----
-
-* Copy the example NGINX configuration and activate it:
+To make sure renewals work, enable the appropriate systemd timer:
 
 ```shell
-sudo cp /opt/akkoma/installation/nginx/akkoma.nginx /etc/nginx/sites-available/akkoma.nginx
-sudo ln -s /etc/nginx/sites-available/akkoma.nginx /etc/nginx/sites-enabled/akkoma.nginx
+sudo systemctl enable --now certbot-renew.timer
 ```
 
-* Before starting NGINX edit the configuration and change it to your needs (e.g. change servername, change cert paths)
-* Enable and start NGINX:
-
-```shell
-sudo systemctl enable --now nginx.service
-```
-
-If you need to renew the certificate in the future, uncomment the relevant location block in the NGINX config and run:
-
-```shell
-sudo certbot certonly --email <your@emailaddress> -d <yourdomain> --webroot -w /var/lib/letsencrypt/
-```
+Certificate renewal should be handled automatically by Certbot from now on.
 
 #### Other webserver/proxies
 

docs/docs/installation/debian_based_en.md

@@ -17,7 +17,7 @@ sudo apt update
 sudo apt full-upgrade
 ```
 
-* Install some of the above-mentioned programs:
+* Install some of the above mentioned programs:
 
 ```shell
 sudo apt install git build-essential postgresql postgresql-contrib cmake libmagic-dev
@@ -31,8 +31,7 @@ sudo apt install git build-essential postgresql postgresql-contrib cmake libmagi
 sudo useradd -r -s /bin/false -m -d /var/lib/akkoma -U akkoma
 ```
 
-!!! note
-    To execute a single command as the Akkoma system user, use `sudo -Hu akkoma command`. You can also switch to a shell by using `sudo -Hu akkoma $SHELL`. If you don’t have and want `sudo` on your system, you can use `su` as root user (UID 0) for a single command by using `su -l akkoma -s $SHELL -c 'command'` and `su -l akkoma -s $SHELL` for starting a shell.
+**Note**: To execute a single command as the Akkoma system user, use `sudo -Hu akkoma command`. You can also switch to a shell by using `sudo -Hu akkoma $SHELL`. If you don’t have and want `sudo` on your system, you can use `su` as root user (UID 0) for a single command by using `su -l akkoma -s $SHELL -c 'command'` and `su -l akkoma -s $SHELL` for starting a shell.
 
 ### Install Elixir and Erlang
 
@@ -92,9 +91,9 @@ elixir --version
 sudo apt install imagemagick ffmpeg libimage-exiftool-perl
 ```
 
-### Install Akkoma-be
+### Install AkkomaBE
 
-* Log into the `akkoma` user and clone the Akkoma-be repository from the stable branch and make the Akkoma user the owner of the directory:
+* Log into the `akkoma` user and clone the AkkomaBE repository from the stable branch and make the Akkoma user the owner of the directory:
 
 ```shell
 sudo mkdir -p /opt/akkoma
@@ -116,8 +115,8 @@ sudo -Hu akkoma mix deps.get
 
 * Generate the configuration: `sudo -Hu akkoma MIX_ENV=prod mix pleroma.instance gen`
   * Answer with `yes` if it asks you to install `rebar3`.
-  * This may take some time, because parts of Akkoma get compiled first.
-  * After that, it will ask you a few questions about your instance and generates a configuration file in `config/generated_config.exs`.
+  * This may take some time, because parts of akkoma get compiled first.
+  * After that it will ask you a few questions about your instance and generates a configuration file in `config/generated_config.exs`.
 
 * Check the configuration and if all looks right, rename it, so Akkoma will load it (`prod.secret.exs` for productive instances):
 
@@ -125,7 +124,8 @@ sudo -Hu akkoma mix deps.get
 sudo -Hu akkoma mv config/{generated_config.exs,prod.secret.exs}
 ```
 
-* The previous command also creates the file `config/setup_db.psql`, with which you can create the database:
+
+* The previous command creates also the file `config/setup_db.psql`, with which you can create the database:
 
 ```shell
 sudo -Hu postgres psql -f config/setup_db.psql
@@ -145,53 +145,47 @@ sudo -Hu akkoma MIX_ENV=prod mix phx.server
 
 ### Finalize installation
 
-If you want to open your newly installed instance to the world, you should run NGINX or some other webserver/proxy in front of Akkoma and you should consider to create a systemd service file for Akkoma.
+If you want to open your newly installed instance to the world, you should run nginx or some other webserver/proxy in front of Akkoma and you should consider to create a systemd service file for Akkoma.
 
-#### NGINX
+#### Nginx
 
-* Install NGINX, if not already done:
+* Install nginx, if not already done:
 
 ```shell
 sudo apt install nginx
 ```
 
-* Setup your SSL cert, using your method of choice or Certbot. If using Certbot, first install it:
-
-```shell
-sudo apt install certbot
-```
-
-and then set it up:
-
-```shell
-sudo mkdir -p /var/lib/letsencrypt/
-sudo certbot certonly --email <your@emailaddress> -d <yourdomain> --standalone
-```
-
-If that doesn’t work, make sure, that NGINX is not already running. If it still doesn’t work, try setting up NGINX first (change SSL “on” to “off” and try again).
-
----
-
-* Copy the example NGINX configuration and activate it:
+* Copy the example nginx configuration and activate it:
 
 ```shell
 sudo cp /opt/akkoma/installation/nginx/akkoma.nginx /etc/nginx/sites-available/akkoma.nginx
 sudo ln -s /etc/nginx/sites-available/akkoma.nginx /etc/nginx/sites-enabled/akkoma.nginx
 ```
 
-* Before starting NGINX edit the configuration and change it to your needs (e.g. change servername, change cert paths)
-* Enable and start NGINX:
+* Before starting nginx edit the configuration and change it to your needs (e.g. change servername, change cert paths)
+* Enable and start nginx:
 
 ```shell
 sudo systemctl enable --now nginx.service
 ```
 
-If you need to renew the certificate in the future, uncomment the relevant location block in the NGINX config and run:
+* Setup your SSL cert, using your method of choice or certbot. If using certbot, first install it:
 
 ```shell
-sudo certbot certonly --email <your@emailaddress> -d <yourdomain> --webroot -w /var/lib/letsencrypt/
+sudo apt install certbot python3-certbot-nginx
 ```
 
+and then set it up:
+
+```shell
+sudo mkdir -p /var/lib/letsencrypt/
+sudo certbot --email <your@emailaddress> -d <yourdomain> -d <media_domain> --nginx
+```
+
+If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. A common source of problems are nginx config syntax errors; this can be checked for by running `nginx -t`.
+
+Certificate renewal should be handled automatically by Certbot from now on.
+
 #### Other webserver/proxies
 
 You can find example configurations for them in `/opt/akkoma/installation/`.

docs/docs/installation/docker_en.md

@@ -2,19 +2,19 @@
 
 ## Installation
 
-This guide will show you how to get Akkoma working in a Docker container,
+This guide will show you how to get akkoma working in a docker container,
 if you want isolation, or if you run a distribution not supported by the OTP
 releases.
 
-If you want to migrate from or OTP to Docker, check out [the migration guide](./migrating_to_docker_en.md).
+If you want to migrate from or OTP to docker, check out [the migration guide](./migrating_to_docker_en.md).
 
 ### Prepare the system
 
-* Install Docker and Docker Compose
+* Install docker and docker compose
   * [Docker](https://docs.docker.com/engine/install/) 
-  * [Docker Compose](https://docs.docker.com/compose/install/)
+  * [Docker-compose](https://docs.docker.com/compose/install/)
   * This will usually just be a repository installation and a package manager invocation.
-* Clone the Akkoma repository
+* Clone the akkoma repository
   * `git clone https://akkoma.dev/AkkomaGang/akkoma.git -b stable`
   * `cd akkoma`
 
@@ -26,11 +26,11 @@ echo "DOCKER_USER=$(id -u):$(id -g)" >> .env
 ```
 
 This probably won't need to be changed, it's only there to set basic environment
-variables for the Docker Compose file.
+variables for the docker compose file.
 
 ### Building the container
 
-The container provided is a thin wrapper around Akkoma's dependencies,
+The container provided is a thin wrapper around akkoma's dependencies, 
 it does not contain the code itself. This is to allow for easy updates
 and debugging if required.
 
@@ -39,7 +39,7 @@ and debugging if required.
 ```
 
 This will generate a container called `akkoma` which we can use
-in our Compose environment.
+in our compose environment.
 
 ### Generating your instance
 
@@ -52,7 +52,7 @@ mkdir pgdata
 
 This will ask you a few questions - the defaults are fine for most things,
 the database hostname is `db`, the database password is `akkoma`
-(not auto generated), and you will want to set the IP to `0.0.0.0`.
+(not auto generated), and you will want to set the ip to `0.0.0.0`.
 
 Now we'll want to copy over the config it just created
 
@@ -89,7 +89,7 @@ docker compose up
 
 If everything went well, you should be able to access your instance at http://localhost:4000
 
-You can `ctrl-c` out of the Docker Compose now to shutdown the server.
+You can `ctrl-c` out of the docker compose now to shutdown the server.
 
 ### Running in the background
 
@@ -109,7 +109,7 @@ And follow the prompts
 
 ### Reverse proxies
 
-This is a tad more complex in Docker than on the host itself. It
+This is a tad more complex in docker than on the host itself. It
 
 You've got two options. 
 
@@ -125,7 +125,26 @@ cp docker-resources/Caddyfile.example docker-resources/Caddyfile
 
 Then edit the TLD in your caddyfile to the domain you're serving on.
 
-Uncomment the `caddy` section in the Docker Compose file,
+Copy the commented out `caddy` section in `docker-compose.yml` into a new file called `docker-compose.override.yml` like so:
+```yaml
+version: "3.7"
+
+services:
+  proxy:
+    image: caddy:2-alpine
+    restart: unless-stopped
+    links:
+      - akkoma
+    ports: [
+       "443:443",
+       "80:80"
+    ]
+    volumes:
+      - ./docker-resources/Caddyfile:/etc/caddy/Caddyfile
+      - ./caddy-data:/data
+      - ./caddy-config:/config
+```
+
 then run `docker compose up -d` again.
 
 #### Running a reverse proxy on the host
@@ -155,6 +174,12 @@ git pull
 docker compose restart akkoma db
 ```
 
+### Modifying the Docker services
+If you want to modify the services defined in the docker compose file, you can
+create a new file called `docker-compose.override.yml`. There you can add any
+overrides or additional services without worrying about git conflicts when a
+new release comes out.
+
 #### Further reading
 
 {! installation/further_reading.include !}

docs/docs/installation/fedora_based_en.md

@@ -1,16 +1,16 @@
 # Installing on Fedora
 
-## OTP releases and RedHat-based distributions
+## OTP releases and RedHat-distributions
 
-While the OTP releases of Akkoma work on most Linux distributions, they do not work correctly with RedHat-based distributions. Therefore, from-source installations are the recommended way to go when trying to install Akkoma on Fedora, Centos Stream or Red Hat.
+While the OTP releases of Akkoma work on most Linux distributions, they do not work correctly with RedHat-distributions. Therefore from-source installations are the recommended way to go when trying to install Akkoma on Fedora, Centos Stream or RedHat.
 
-However, it is possible to compile your own OTP release of Akkoma for Red Hat. Keep in mind that this has a few drawbacks, and has no particular advantage over a from-source installation, since you'll need to install Erlang and Elixir anyway.
+However, it is possible to compile your own OTP release of Akkoma for RedHat. Keep in mind that this has a few drawbacks, and has no particular advantage over a from-source installation, since you'll need to install Erlang and Elixir anyway.
 
-This guide will cover a from-source installation. For instructions on how to build your own OTP release, please check out [the OTP for Red Hat guide](./otp_redhat_en.md).
+This guide will cover a from-source installation. For instructions on how to build your own OTP release, please check out [the OTP for RedHat guide](./otp_redhat_en.md).
 
 ## Installation
 
-This guide will assume you are on Fedora 36. This guide should also work with current releases of CentOS Stream and Red Hat, although it has not been tested yet. It also assumes that you have administrative rights, either as root or a user with [sudo permissions](https://docs.fedoraproject.org/en-US/quick-docs/adding_user_to_sudoers_file/). If you want to run this guide with root, ignore the `sudo` at the beginning of the lines, unless it calls a user like `sudo -Hu akkoma`; in this case, use `su <username> -s $SHELL -c 'command'` instead.
+This guide will assume you are on Fedora 36. This guide should also work with current releases of Centos Stream and RedHat, although it has not been tested yet. It also assumes that you have administrative rights, either as root or a user with [sudo permissions](https://docs.fedoraproject.org/en-US/quick-docs/adding_user_to_sudoers_file/). If you want to run this guide with root, ignore the `sudo` at the beginning of the lines, unless it calls a user like `sudo -Hu akkoma`; in this case, use `su <username> -s $SHELL -c 'command'` instead.
 
 {! installation/generic_dependencies.include !}
 
@@ -22,13 +22,13 @@ This guide will assume you are on Fedora 36. This guide should also work with cu
 sudo dnf upgrade --refresh
 ```
 
-* Install some of the above-mentioned programs:
+* Install some of the above mentioned programs:
 
 ```shell
 sudo dnf install git gcc g++ make cmake file-devel postgresql-server postgresql-contrib
 ```
 
-* Enable and initialize PostgreSQL:
+* Enable and initialize Postgres:
 ```shell
 sudo postgresql-setup --initdb --unit postgresql
 # Allow password auth for postgres
@@ -44,9 +44,10 @@ sudo systemctl enable --now postgresql.service
 sudo dnf install elixir erlang-os_mon erlang-eldap erlang-xmerl erlang-erl_interface erlang-syntax_tools
 ```
 
+
 ### Optional packages: [`docs/installation/optional/media_graphics_packages.md`](../installation/optional/media_graphics_packages.md)
 
-* Install FFmpeg (requires setting up the RPM-fusion repositories):
+* Install ffmpeg (requires setting up the RPM-fusion repositories):
 
 ```shell
 sudo dnf -y install https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm
@@ -61,7 +62,8 @@ sudo dnf install ImageMagick perl-Image-ExifTool
 ```
 
 
-### Install Akkoma-be
+
+### Install AkkomaBE
 
 * Add a new system user for the Akkoma service:
 
@@ -69,10 +71,9 @@ sudo dnf install ImageMagick perl-Image-ExifTool
 sudo useradd -r -s /bin/false -m -d /var/lib/akkoma -U akkoma
 ```
 
-!!! note
-    To execute a single command as the Akkoma system user, use `sudo -Hu akkoma command`. You can also switch to a shell by using `sudo -Hu akkoma $SHELL`. If you don’t have and want `sudo` on your system, you can use `su` as root user (UID 0) for a single command by using `su -l akkoma -s $SHELL -c 'command'` and `su -l akkoma -s $SHELL` for starting a shell.
+**Note**: To execute a single command as the Akkoma system user, use `sudo -Hu akkoma command`. You can also switch to a shell by using `sudo -Hu akkoma $SHELL`. If you don’t have and want `sudo` on your system, you can use `su` as root user (UID 0) for a single command by using `su -l akkoma -s $SHELL -c 'command'` and `su -l akkoma -s $SHELL` for starting a shell.
 
-* Git clone the akkoma-be repository from stable-branch and make the Akkoma user the owner of the directory:
+* Git clone the AkkomaBE repository from stable-branch and make the Akkoma user the owner of the directory:
 
 ```shell
 sudo mkdir -p /opt/akkoma
@@ -94,8 +95,8 @@ sudo -Hu akkoma mix deps.get
 
 * Generate the configuration: `sudo -Hu akkoma MIX_ENV=prod mix pleroma.instance gen`
   * Answer with `yes` if it asks you to install `rebar3`.
-  * This may take some time, because parts of Akkoma get compiled first.
-  * After that, it will ask you a few questions about your instance and generates a configuration file in `config/generated_config.exs`.
+  * This may take some time, because parts of akkoma get compiled first.
+  * After that it will ask you a few questions about your instance and generates a configuration file in `config/generated_config.exs`.
 
 * Check the configuration and if all looks right, rename it, so Akkoma will load it (`prod.secret.exs` for productive instances):
 
@@ -103,7 +104,8 @@ sudo -Hu akkoma mix deps.get
 sudo -Hu akkoma mv config/{generated_config.exs,prod.secret.exs}
 ```
 
-* The previous command also creates the file `config/setup_db.psql`, with which you can create the database:
+
+* The previous command creates also the file `config/setup_db.psql`, with which you can create the database:
 
 ```shell
 sudo -Hu postgres psql -f config/setup_db.psql
@@ -123,52 +125,46 @@ sudo -Hu akkoma MIX_ENV=prod mix phx.server
 
 ### Finalize installation
 
-If you want to open your newly installed instance to the world, you should run NGINX or some other webserver/proxy in front of Akkoma and you should consider to create a systemd service file for Akkoma.
+If you want to open your newly installed instance to the world, you should run nginx or some other webserver/proxy in front of Akkoma and you should consider to create a systemd service file for Akkoma.
 
-#### NGINX
+#### Nginx
 
-* Install NGINX, if not already done:
+* Install nginx, if not already done:
 
 ```shell
 sudo dnf install nginx
 ```
 
-* Setup your SSL cert, using your method of choice or Certbot. If using Certbot, first install it:
-
-```shell
-sudo dnf install certbot
-```
-
-and then set it up:
-
-```shell
-sudo mkdir -p /var/lib/letsencrypt/
-sudo certbot certonly --email <your@emailaddress> -d <yourdomain> --standalone
-```
-
-If that doesn’t work, make sure, that NGINX is not already running. If it still doesn’t work, try setting up NGINX first (change SSL “on” to “off” and try again).
-
----
-
-* Copy the example NGINX configuration and activate it:
+* Copy the example nginx configuration and activate it:
 
 ```shell
 sudo cp /opt/akkoma/installation/nginx/akkoma.nginx /etc/nginx/conf.d/akkoma.conf
 ```
 
-* Before starting NGINX edit the configuration and change it to your needs (e.g. change servername, change cert paths)
-* Enable and start NGINX:
+* Before starting nginx edit the configuration and change it to your needs (e.g. change servername, change cert paths)
+* Enable and start nginx:
 
 ```shell
 sudo systemctl enable --now nginx.service
 ```
 
-If you need to renew the certificate in the future, uncomment the relevant location block in the NGINX config and run:
+* Setup your SSL cert, using your method of choice or certbot. If using certbot, first install it:
 
 ```shell
-sudo certbot certonly --email <your@emailaddress> -d <yourdomain> --webroot -w /var/lib/letsencrypt/
+sudo dnf install certbot python3-certbot-nginx
 ```
 
+and then set it up:
+
+```shell
+sudo certbot --email <your@emailaddress> -d <yourdomain> -d <media_domain> --nginx
+```
+
+If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. A common source of problems are nginx config syntax errors; this can be checked for by running `nginx -t`.
+
+Certificate renewal should be handled automatically by Certbot from now on.
+
+
 #### Other webserver/proxies
 
 You can find example configurations for them in `/opt/akkoma/installation/`.

docs/docs/installation/freebsd_en.md

@@ -21,7 +21,7 @@ Setup the required services to automatically start at boot, using `sysrc(8)`.
 # sysrc postgresql_enable=YES
 ```
 
-## Initialize PostgreSQL
+## Initialize postgres
 
 ```
 # service postgresql initdb
@@ -70,11 +70,11 @@ it'll be protecting your database. As root, you can now initialize the database:
 # sudo -Hu postgres -g postgres psql -f config/setup_db.psql
 ```
 
-PostgreSQL allows connections from all users without a password by default. To
+Postgres allows connections from all users without a password by default. To
 fix this, edit `/var/db/postgres/data12/pg_hba.conf`. Change every `trust` to
 `password`.
 
-Once this is done, restart PostgreSQL with:
+Once this is done, restart Postgres with:
 ```
 # service postgresql restart
 ```
@@ -109,7 +109,7 @@ Next, obtain your account fingerprint:
 # sudo -Hu acme -g acme acme.sh --register-account
 ```
 
-You need to add the following to your NGINX configuration for the server
+You need to add the following to your nginx configuration for the server
 running on port 80:
 
 ```
@@ -119,9 +119,9 @@ running on port 80:
   }
 ```
 
-Replace the string after `$1.` with your fingerprint.
+Replace the string after after `$1.` with your fingerprint.
 
-Start NGINX:
+Start nginx:
 
 ```
 # service nginx start
@@ -141,9 +141,9 @@ Let's add auto-renewal to `/etc/crontab`
 /usr/local/bin/sudo -Hu acme -g acme /usr/local/sbin/acme.sh -r -d example.com --stateless
 ```
 
-### Configuring NGINX
+### Configuring nginx
 
-FreeBSD's default NGINX configuration does not contain an include directive, which is
+FreeBSD's default nginx configuration does not contain an include directive, which is
 typically used for multiple sites. Therefore, you will need to first create the required
 directory as follows:
 
@@ -211,7 +211,7 @@ sudo -Hu akkoma MIX_ENV=prod mix pleroma.user new <username> <your@emailaddress>
 
 ## Conclusion
 
-Restart NGINX with `# service nginx restart` and you should be up and running.
+Restart nginx with `# service nginx restart` and you should be up and running.
 
 Make sure your time is in sync, or other instances will receive your posts with
 incorrect timestamps. You should have ntpd running.

docs/docs/installation/frontends.include

@@ -6,7 +6,9 @@ probably install frontends.
 These are no longer bundled with the distribution and need an extra
 command to install.
 
-For most installations, the following will suffice:
+You **must** run frontend management tasks as the akkoma user,
+the same way you downloaded the build or cloned the git repo before.
+But otherwise, for most installations, the following will suffice:
 
 === "OTP" 
     ```sh
@@ -27,4 +29,4 @@ For most installations, the following will suffice:
     ./docker-resources/manage.sh mix pleroma.frontend install admin-fe --ref stable
     ```
 
-For more customized installations, refer to [Frontend Management](../../configuration/frontend_management)
+For more customised installations, refer to [Frontend Management](../../configuration/frontend_management)

docs/docs/installation/generic_dependencies.include

@@ -1,11 +1,11 @@
 ## Required dependencies
 
-* PostgreSQL 9.6+
-* Elixir 1.14+
-* Erlang OTP 24+
+* PostgreSQL 12+
+* Elixir 1.14+ (currently tested up to 1.16)
+* Erlang OTP 25+ (currently tested up to OTP26)
 * git
 * file / libmagic
-* GCC (clang might also work)
+* gcc (clang might also work)
 * GNU make
 * CMake
 
@@ -13,4 +13,4 @@
 
 * ImageMagick
 * FFmpeg
-* ExifTool
+* exiftool

docs/docs/installation/gentoo_en.md

@@ -18,13 +18,13 @@ dev-db/postgresql uuid
 
 You could opt to add `USE="uuid"` to `/etc/portage/make.conf` if you'd rather set this as a global USE flags, but this flags does unrelated things in other packages, so keep that in mind if you elect to do so.
 
-If you are planning to use `NGINX`, as this guide suggests, you should also add the following flag to the same file.
+If you are planning to use `nginx`, as this guide suggests, you should also add the following flag to the same file.
 
 ```text
 www-servers/nginx NGINX_MODULES_HTTP: slice
 ```
 
-Double-check your compiler flags in `/etc/portage/make.conf`. If you require any special compilation flags or would like to set up remote builds, now is the time to do so. Be sure that your CFLAGS and MAKEOPTS make sense for the platform you are using. It is not recommended to use above `-O2` or risky optimization flags for a production server.
+Double check your compiler flags in `/etc/portage/make.conf`. If you require any special compilation flags or would like to set up remote builds, now is the time to do so. Be sure that your CFLAGS and MAKEOPTS make sense for the platform you are using. It is not recommended to use above `-O2` or risky optimization flags for a production server.
 
 ### Installing a cron daemon
 
@@ -42,7 +42,7 @@ Gentoo quite pointedly does not come with a cron daemon installed, and as such i
 
 * `www-servers/nginx` (preferred, example configs for other reverse proxies can be found in the repo)
 * `app-crypt/certbot` (or any other ACME client for Let’s Encrypt certificates)
-* `app-crypt/certbot-nginx` (NGINX Certbot plugin that allows use of the all-powerful `--nginx` flag on Certbot)
+* `app-crypt/certbot-nginx` (nginx certbot plugin that allows use of the all-powerful `--nginx` flag on certbot)
 * `media-gfx/imagemagick`
 * `media-video/ffmpeg`
 * `media-libs/exiftool`
@@ -63,29 +63,29 @@ Gentoo quite pointedly does not come with a cron daemon installed, and as such i
 
 If you would not like to install the optional packages, remove them from this line.
 
-If you're running this from a low-powered virtual machine, it should work, though it will take some time. There were no issues on a VPS with a single core and 1GB of RAM; if you are using an even more limited device and run into issues, you can try creating a swapfile or use a more powerful machine running Gentoo to [cross build](https://wiki.gentoo.org/wiki/Cross_build_environment). If you have a wait ahead of you, now would be a good time to take a break, strech a bit, refresh your beverage of choice and/or get a snack, and reply to Arch users' posts with "I use Gentoo btw" as we do.
+If you're running this from a low-powered virtual machine, it should work though it will take some time. There were no issues on a VPS with a single core and 1GB of RAM; if you are using an even more limited device and run into issues, you can try creating a swapfile or use a more powerful machine running Gentoo to [cross build](https://wiki.gentoo.org/wiki/Cross_build_environment). If you have a wait ahead of you, now would be a good time to take a break, strech a bit, refresh your beverage of choice and/or get a snack, and reply to Arch users' posts with "I use Gentoo btw" as we do.
 
 ### Install PostgreSQL
 
 [Gentoo  Wiki article](https://wiki.gentoo.org/wiki/PostgreSQL) as well as [PostgreSQL QuickStart](https://wiki.gentoo.org/wiki/PostgreSQL/QuickStart) might be worth a quick glance, as the way Gentoo handles postgres is slightly unusual, with built in capability to have two different databases running for testing and live or whatever other purpouse. While it is still straightforward to install, it does mean that the version numbers used in this guide might change for future updates, so keep an eye out for the output you get from `emerge` to ensure you are using the correct ones.
 
-* Install PostgreSQL if you have not done so already:
+* Install postgresql if you have not done so already:
 
 ```shell
  # emerge --ask dev-db/postgresql
 ```
 
-Ensure that `/etc/conf.d/postgresql-11` has the encoding you want (it defaults to UTF8, which is probably what you want) and make any adjustments to the data directory if you find it necessary. Be sure to adjust the number at the end depending on what version of PostgreSQL you actually installed.
+Ensure that `/etc/conf.d/postgresql-11` has the encoding you want (it defaults to UTF8 which is probably what you want) and make any adjustments to the data directory if you find it necessary. Be sure to adjust the number at the end depending on what version of postgres you actually installed.
 
 * Initialize the database cluster
 
-The output from emerging PostgreSQL should give you a command for initializing the PostgreSQL database. The default slot should be indicated in this command, ensure that it matches the command below.
+The output from emerging postgresql should give you a command for initializing the postgres database. The default slot should be indicated in this command, ensure that it matches the command below.
 
 ```shell
  # emerge --config dev-db/postgresql:11
 ```
 
-* Start PostgreSQL and enable the system service
+* Start postgres and enable the system service
 
 ```shell
  # /etc/init.d/postgresql-11 start
@@ -104,11 +104,11 @@ Not only does this make it much easier to deploy changes you make, as you can co
 # emerge --ask media-video/ffmpeg media-gfx/imagemagick media-libs/exiftool
 ```
 
-### Install Akkoma-be
+### Install AkkomaBE
 
 * Add a new system user for the Akkoma service and set up default directories:
 
-Remove `,wheel` if you do not want this user to be able to use `sudo`, however, note that being able to `sudo` as the `akkoma` user will make finishing the insallation and common maintenence tasks somewhat easier:
+Remove `,wheel` if you do not want this user to be able to use `sudo`, however note that being able to `sudo` as the `akkoma` user will make finishing the insallation and common maintenence tasks somewhat easier:
 
 ```shell
  # useradd -m -G users,wheel -s /bin/bash akkoma
@@ -116,10 +116,9 @@ Remove `,wheel` if you do not want this user to be able to use `sudo`, however,
 
 Optional: If you are using sudo, review your sudo setup to ensure it works for you. The `/etc/sudoers` file has a lot of options and examples to help you, and [the Gentoo sudo guide](https://wiki.gentoo.org/wiki/Sudo) has more information. Finishing this installation will be somewhat easier if you have a way to sudo from the `akkoma` user, but it might be best to not allow that user to sudo during normal operation, and as such there will be a reminder at the end of this guide to double check if you would like to lock down the `akkoma` user after initial setup.
 
-!!! note
-    To execute a single command as the Akkoma system user, use `sudo -Hu akkoma command`. You can also switch to a shell by using `sudo -Hu akkoma $SHELL`. If you don't have or want `sudo` or would like to use the system as the `akkoma` user for instance maintenance tasks, you can simply use `su - akkoma` to switch to the `akkoma` user.
+**Note**: To execute a single command as the Akkoma system user, use `sudo -Hu akkoma command`. You can also switch to a shell by using `sudo -Hu akkoma $SHELL`. If you don't have or want `sudo` or would like to use the system as the `akkoma` user for instance maintenance tasks, you can simply use `su - akkoma` to switch to the `akkoma` user.
 
-* Git clone the akkoma-be repository and make the Akkoma user the owner of the directory:
+* Git clone the AkkomaBE repository and make the Akkoma user the owner of the directory:
 
 It is highly recommended you use your own fork for the `https://path/to/repo` part below, however if you foolishly decide to forego using your own fork, the primary repo `https://akkoma.dev/AkkomaGang/akkoma.git` will work here.
 
@@ -150,7 +149,7 @@ akkoma$ MIX_ENV=prod mix pleroma.instance gen
 
   * This part precompiles some parts of Akkoma, so it might take a few moments
 
-  * After that, it will ask you a few questions about your instance and generates a configuration file in `config/generated_config.exs`.
+  * After that it will ask you a few questions about your instance and generates a configuration file in `config/generated_config.exs`.
 
   * Spend some time with `generated_config.exs` to ensure that everything is in order. If you plan on using an S3-compatible service to store your local media, that can be done here. You will likely mostly be using `prod.secret.exs` for a production instance, however if you would like to set up a development environment, make a copy to `dev.secret.exs` and adjust settings as needed as well.
 
@@ -158,7 +157,7 @@ akkoma$ MIX_ENV=prod mix pleroma.instance gen
 akkoma$ mv config/generated_config.exs config/prod.secret.exs
 ```
 
-* The previous command also creates the file `config/setup_db.psql`, with which you can create the database. Ensure that it is using the correct database name on the `CREATE DATABASE` and the `\c` lines, then run the PostgreSQL script:
+* The previous command creates also the file `config/setup_db.psql`, with which you can create the database. Ensure that it is using the correct database name on the `CREATE DATABASE` and the `\c` lines, then run the postgres script:
 
 ```shell
 akkoma$ sudo -Hu postgres psql -f config/setup_db.psql
@@ -176,15 +175,15 @@ akkoma$ MIX_ENV=prod mix ecto.migrate
 akkoma$ MIX_ENV=prod mix phx.server
 ```
 
-It probably won't work over the public internet quite yet, however, as we still need to set up a web server to proxy to the Akkoma application, as well as configure SSL.
+It probably won't work over the public internet quite yet, however, as we still need to set up a web servere to proxy to the akkoma application, as well as configure SSL.
 
 ### Finalize installation
 
-Assuming you want to open your newly installed federated social network to, well, the federation, you should run NGINX or some other webserver/proxy in front of Akkoma. It is also a good idea to set up Akkoma to run as a system service.
+Assuming you want to open your newly installed federated social network to, well, the federation, you should run nginx or some other webserver/proxy in front of Akkoma. It is also a good idea to set up Akkoma to run as a system service.
 
-#### NGINX
+#### Nginx
 
-* Install NGINX, if not already done:
+* Install nginx, if not already done:
 
 ```shell
  # emerge --ask www-servers/nginx
@@ -202,7 +201,27 @@ Assuming you want to open your newly installed federated social network to, well
 include sites-enabled/*;
 ```
 
-* Setup your SSL cert, using your method of choice or Certbot. If using Certbot, install it if you haven't already:
+* Copy the example nginx configuration and activate it:
+
+```shell
+ # cp /home/akkoma/akkoma/installation/nginx/akkoma.nginx /etc/nginx/sites-available/
+ # ln -s /etc/nginx/sites-available/akkoma.nginx /etc/nginx/sites-enabled/akkoma.nginx
+```
+
+* Take some time to ensure that your nginx config is correct
+
+Replace all instances of `example.tld` with your instance's public URL. If for whatever reason you made changes to the port that your akkoma app runs on, be sure that is reflected in your configuration.
+
+Pay special attention to the line that begins with `ssl_ecdh_curve`. It is stongly advised to comment that line out so that OpenSSL will use its full capabilities, and it is also possible you are running OpenSSL 1.0.2 necessitating that you do this.
+
+* Enable and start nginx:
+
+```shell
+ # rc-update add nginx default
+ # rc-service nginx start
+```
+
+* Setup your SSL cert, using your method of choice or certbot. If using certbot, install it if you haven't already:
 
 ```shell
  # emerge --ask app-crypt/certbot app-crypt/certbot-nginx
@@ -212,36 +231,12 @@ and then set it up:
 
 ```shell
  # mkdir -p /var/lib/letsencrypt/
- # certbot certonly --email <your@emailaddress> -d <yourdomain> --standalone
+ # certbot --email <your@emailaddress> -d <yourdomain> -d <media_domain> --nginx
 ```
 
-If that doesn't work the first time, add `--dry-run` to further attempts to avoid being rate-limited as you identify the issue, and do not remove it until the dry run succeeds. If that doesn’t work, make sure, that NGINX is not already running. If it still doesn’t work, try setting up NGINX first (change SSL “on” to “off” and try again). Often the answer to issues with certbot is to use the `--nginx` flag once you have NGINX up and running.
+If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. A common source of problems are nginx config syntax errors; this can be checked for by running `nginx -t`.
 
-If you are using any additional subdomains, such as for a media proxy, you can re-run the same command with the subdomain in question. When it comes time to renew later, you will not need to run multiple times for each domain, one renew will handle it.
-
----
-
-* Copy the example NGINX configuration and activate it:
-
-```shell
- # cp /home/akkoma/akkoma/installation/nginx/akkoma.nginx /etc/nginx/sites-available/
- # ln -s /etc/nginx/sites-available/akkoma.nginx /etc/nginx/sites-enabled/akkoma.nginx
-```
-
-* Take some time to ensure that your NGINX config is correct
-
-Replace all instances of `example.tld` with your instance's public URL. If for whatever reason you made changes to the port that your Akkoma app runs on, be sure that is reflected in your configuration.
-
-Pay special attention to the line that begins with `ssl_ecdh_curve`. It is strongly advised to comment that line out so that OpenSSL will use its full capabilities, and it is also possible you are running OpenSSL 1.0.2 necessitating that you do this.
-
-* Enable and start NGINX:
-
-```shell
- # rc-update add nginx default
- # /etc/init.d/nginx start
-```
-
-If you are using Certbot, it is HIGHLY recommended you set up a cron job that renews your certificate, and that you install the suggested `certbot-nginx` plugin. If you don't do these things, you only have yourself to blame when your instance breaks suddenly because you forgot about it.
+If you are using certbot, it is HIGHLY recommend you set up a cron job that renews your certificate, and that you install the suggested `certbot-nginx` plugin. If you don't do these things, you only have yourself to blame when your instance breaks suddenly because you forgot about it.
 
 First, ensure that the command you will be installing into your crontab works.
 
@@ -249,7 +244,7 @@ First, ensure that the command you will be installing into your crontab works.
  # /usr/bin/certbot renew --nginx
 ```
 
-Assuming not much time has passed since you got Certbot working a few steps ago, you should get a message for all domains you installed certificates for saying `Cert not yet due for renewal`.
+Assuming not much time has passed since you got certbot working a few steps ago, you should get a message for all domains you installed certificates for saying `Cert not yet due for renewal`.
 
 Now, run crontab as a superuser with `crontab -e` or `sudo crontab -e` as appropriate, and add the following line to your cron:
 
@@ -257,7 +252,7 @@ Now, run crontab as a superuser with `crontab -e` or `sudo crontab -e` as approp
 0 0 1 * * /usr/bin/certbot renew --nginx
 ```
 
-This will run Certbot on the first of the month at midnight. If you'd rather run more frequently, it's not a bad idea, feel free to go for it.
+This will run certbot on the first of the month at midnight. If you'd rather run more frequently, it's not a bad idea, feel free to go for it.
 
 #### Other webserver/proxies
 

docs/docs/installation/migrating_from_source_otp_en.md

@@ -2,10 +2,10 @@
 
 {! installation/otp_vs_from_source.include !}
 
-In this guide, we cover how you can migrate from a from source installation to one using OTP releases.
+In this guide we cover how you can migrate from a from source installation to one using OTP releases.
 
 ## Pre-requisites
-You will be running commands as root. If you aren't root already, please elevate your privileges by executing `sudo su`/`su`.
+You will be running commands as root. If you aren't root already, please elevate your priviledges by executing `sudo su`/`su`.
 
 The system needs to have `curl` and `unzip` installed for downloading and unpacking release builds.
 
@@ -20,7 +20,7 @@ The system needs to have `curl` and `unzip` installed for downloading and unpack
     ```
 
 ## Moving content out of the application directory
-When using OTP releases, the application directory changes with every version, so it would be a bother to keep content there (and also dangerous unless `--no-rm` option is used when updating). Fortunately almost all paths in Akkoma are configurable, so it is possible to move them out of there.
+When using OTP releases the application directory changes with every version so it would be a bother to keep content there (and also dangerous unless `--no-rm` option is used when updating). Fortunately almost all paths in Akkoma are configurable, so it is possible to move them out of there.
 
 Akkoma should be stopped before proceeding.
 
@@ -51,7 +51,7 @@ mkdir /var/lib/akkoma/static/emoji
 ls -d ~akkoma/priv/static/emoji/*/ | xargs -i sh -c 'mv "{}" "/var/lib/akkoma/static/emoji/$(basename {})"'
 ```
 
-But, if for some reason you have custom emojis in the root directory, you should copy the whole directory instead.
+But, if for some reason you have custom emojis in the root directory you should copy the whole directory instead.
 ```sh
 mv ~akkoma/priv/static/emoji /var/lib/akkoma/static/emoji
 ```
@@ -109,10 +109,9 @@ su akkoma -s $SHELL -lc "./bin/pleroma stop"
 ```
 
 ## Setting up a system service
-OTP releases have different service files than from-source installs, so they need to be copied over again.
+OTP releases have different service files than from-source installs so they need to be copied over again.
 
-!!! warning
-    The service files assume Akkoma user's home directory is `/opt/akkoma`, please make sure all paths fit your installation.
+**Warning:** The service files assume akkoma user's home directory is `/opt/akkoma`, please make sure all paths fit your installation.
 
 === "Alpine"
     ```sh

docs/docs/installation/migrating_to_akkoma.md

@@ -2,12 +2,12 @@
 
 ## Why should you migrate?
 
-Aside from actually responsive maintainer(s)? Let's lookie here, we've got:
+aside from actually responsive maintainer(s)? let's lookie here, we've got:
 
 - custom emoji reactions
-- Misskey markdown (MFM) rendering and posting support
-- Elasticsearch support (because pleroma search is GARBAGE)
-- latest develop Pleroma-fe additions
+- misskey markdown (MFM) rendering and posting support
+- elasticsearch support (because pleroma search is GARBAGE)
+- latest develop pleroma-fe additions
 - local-only posting
 - automatic post translation
 - the mastodon frontend back in all its glory
@@ -21,10 +21,37 @@ fork of Akkoma - luckily this isn't very hard.
 You'll need to update the backend, then possibly the frontend, depending
 on your setup.
 
+## Backup diverging features
+
+As time goes on Akkoma and Pleroma added or removed different features
+and reorganised the database in a different way. If you want to be able to
+migrate back to Pleroma without losing any affected data, you’ll want to
+make a backup before starting the migration.  
+If you're not interested in migrating back, skip this section
+*(although it might be a good idea to temporarily keep a full DB backup
+just in case something unexpected happens during migration)*
+
+As of 2024-02 you will want to keep a backup of:
+
+- the entire `chats` and `chat_message_references` tables
+
+The following columns are not deleted by a migration to Akkoma, but a migration
+back to Pleroma or future Akkoma upgrades might affect them, so perhaps back them up as well:
+
+- the `birthday` of users and their `show_birthday` setting
+- the `expires_at` key of in the `user_relationships` table
+    *(used by temporary mutes)*
+
+The way cached instance metadata is stored differs, but since those
+will be refetched and updated anyway, there’s no need for a backup.
+
+Best check all newer migrations unique to Akkoma/Pleroma
+to get an up-to-date picture of what needs to be kept.
+
 ## From Source
 
 If you're running the source Akkoma install, you'll need to set the
-upstream git URL, then just rebuild - that'll be:
+upstream git URL then just rebuild - that'll be:
 
 ```bash
 git remote set-url origin https://akkoma.dev/AkkomaGang/akkoma.git/
@@ -34,34 +61,54 @@ git pull -r
 # to run "git merge stable" instead (or develop if you want)
 ```
 
-### WARNING - Migrating from Pleroma Develop
-If you are on Pleroma develop, and have updated since 2022-08, you may have issues with database migrations.
-
-Please roll back the given migrations:
-
-```bash
-MIX_ENV=prod mix ecto.rollback --migrations-path priv/repo/optional_migrations/pleroma_develop_rollbacks -n3
-```
-
-Then compile, migrate and restart as usual.
+And compile as usual.
 
 ## From OTP
 
-This will just be setting the update URL - find your flavour from the [mapping on the installation guide](../otp_en/#detecting-flavour) first.
+This will just be setting the update URL - find your flavour from the [mapping on the install guide](../otp_en/#detecting-flavour) first.
 
 ```bash
 export FLAVOUR=[the flavour you found above]
 
 ./bin/pleroma_ctl update --zip-url https://akkoma-updates.s3-website.fr-par.scw.cloud/stable/akkoma-$FLAVOUR.zip
-./bin/pleroma_ctl migrate
 ```
 
-Then restart. When updating in the future, you can just use:
+When updating in the future, you can just use
 
 ```bash
 ./bin/pleroma_ctl update --branch stable
 ```
 
+
+## Database Migrations
+### WARNING - Migrating from Pleroma past 2022-08
+If you are on Pleroma stable >= 2.5.0 or Pleroma develop, and
+have updated since 2022-08, you may have issues with database migrations.
+
+Please first roll back the given migrations:
+
+=== "OTP"
+    ```bash
+    ./bin/pleroma_ctl rollback --migrations-path priv/repo/optional_migrations/pleroma_develop_rollbacks -n5
+    ```
+=== "From Source"
+    ```bash
+    MIX_ENV=prod mix ecto.rollback --migrations-path priv/repo/optional_migrations/pleroma_develop_rollbacks -n5
+    ```
+
+### Applying Akkoma Database Migrations
+
+Just run
+
+=== "OTP"
+    ```bash
+    ./bin/pleroma_ctl migrate
+    ```
+=== "From Source"
+    ```bash
+    MIX_ENV=prod mix ecto.migrate
+    ```
+
 ## Frontend changes
 
 Akkoma comes with a few frontend changes as well as backend ones,
@@ -92,7 +139,7 @@ See above for that command.
 ### I compile the JS from source
 
 Your situation will likely be unique - you'll need the changes in the
-[forked Pleroma-fe repository](https://akkoma.dev/AkkomaGang/pleroma-fe),
+[forked pleroma-fe repository](https://akkoma.dev/AkkomaGang/pleroma-fe),
 and either merge or cherry-pick from there depending on how you've got
 things.
 
@@ -102,8 +149,8 @@ things.
 
 This may occur if you are using database configuration.
 
-Sometimes the config in your database will cause Akkoma to still report
-that there's no frontend, even when you've run the installation.
+Sometimes the config in your database will cause akkoma to still report
+that there's no frontend, even when you've run the install.
 
 To fix this, run:
 
@@ -117,7 +164,7 @@ To fix this, run:
     mix pleroma.config delete pleroma frontends
     ```
 
-Which will remove the config from the database. Things should work now.
+which will remove the config from the database. Things should work now.
 
 ## Migrating back to Pleroma
 
@@ -130,3 +177,4 @@ MIX_ENV=prod mix ecto.rollback --to 20210416051708
 ```
 
 Then switch back to Pleroma for updates (similar to how was done to migrate to Akkoma), and remove the front-ends. The front-ends are installed in the `frontends` folder in the [static directory](../configuration/static_dir.md). Once you are back to Pleroma, you will need to run the database migrations again. See the Pleroma documentation for this.
+After this use your previous backups to restore data from diverging features.

docs/docs/installation/migrating_to_docker_en.md

@@ -1,6 +1,6 @@
 # Migrating to a Docker Installation
 
-If you for any reason wish to migrate a source or OTP install to a Docker one,
+If you for any reason wish to migrate a source or OTP install to a docker one,
 this guide is for you. 
 
 You have a few options - your major one will be whether you want to keep your
@@ -10,9 +10,9 @@ You probably should, in the first instance.
 
 ### Prepare the system
 
-* Install Docker and Docker Compose
+* Install docker and docker compose
     * [Docker](https://docs.docker.com/engine/install/)
-    * [Docker Compose](https://docs.docker.com/compose/install/)
+    * [Docker-compose](https://docs.docker.com/compose/install/)
     * This will usually just be a repository installation and a package manager invocation.
 
 === "Source"
@@ -21,7 +21,7 @@ git pull
 ```
 
 === "OTP"
-Clone the `akkoma` repository
+Clone the akkoma repository
 
 ```bash
 git clone https://akkoma.dev/AkkomaGang/akkoma.git -b stable
@@ -39,14 +39,14 @@ pg_dump -d akkoma_prod --format c > akkoma_backup.sql
 ### Getting your static files in the right place
 
 This will vary by every installation. Copy your `instance` directory to `instance/` in
-the Akkoma source directory - this is where the Docker container will look for it.
+the akkoma source directory - this is where the docker container will look for it.
 
 For *most* from-source installs it'll already be there.
 
 And the same with `uploads`, make sure your uploads (if you have them on disk) are
-located at `uploads/` in the Akkoma source directory.
+located at `uploads/` in the akkoma source directory.
 
-If you have them on a different disk, you will need to mount that disk into the Docker Compose file,
+If you have them on a different disk, you will need to mount that disk into the docker compose file,
 with an entry that looks like this:
 
 ```yaml
@@ -66,7 +66,7 @@ echo "DOCKER_USER=$(id -u):$(id -g)" >> .env
 ```
 
 This probably won't need to be changed, it's only there to set basic environment
-variables for the Docker Compose file.
+variables for the docker compose file.
 
 === "From source"
 
@@ -96,7 +96,7 @@ config :pleroma, Pleroma.Repo,
 
 ### Building the container
 
-The container provided is a thin wrapper around Akkoma's dependencies,
+The container provided is a thin wrapper around akkoma's dependencies,
 it does not contain the code itself. This is to allow for easy updates
 and debugging if required.
 
@@ -105,9 +105,9 @@ and debugging if required.
 ```
 
 This will generate a container called `akkoma` which we can use
-in our Compose environment.
+in our compose environment.
 
-### Setting up the Docker resources
+### Setting up the docker resources
 
 ```bash
 # These won't exist if you're migrating from OTP
@@ -133,9 +133,9 @@ docker compose run --rm akkoma pg_restore -v -U akkoma -j $(grep -c ^processor /
 ### Reverse proxies
 
 If you're just reusing your old proxy, you may have to uncomment the line in
-the Docker Compose file under `ports`. You'll find it.
+the docker compose file under `ports`. You'll find it.
 
-Otherwise, you can use the same setup as the [Docker installation guide](./docker_en.md#reverse-proxies).
+Otherwise, you can use the same setup as the [docker installation guide](./docker_en.md#reverse-proxies).
 
 ### Let's go
 
@@ -143,11 +143,11 @@ Otherwise, you can use the same setup as the [Docker installation guide](./docke
 docker compose up -d
 ```
 
-You should now be at the same point as you were before, but with a Docker install.
+You should now be at the same point as you were before, but with a docker install.
 
 {! installation/frontends.include !}
 
-See the [Docker installation guide](./docker_en.md) for more information on how to
+See the [docker installation guide](./docker_en.md) for more information on how to
 update.
 
 #### Further reading

docs/docs/installation/netbsd_en.md

@@ -7,7 +7,7 @@
 pkgin should have been installed by the NetBSD installer if you selected
 the right options. If it isn't installed, install it using pkg_add.
 
-Note that `postgresql11-contrib` is needed for the PostgreSQL extensions
+Note that `postgresql11-contrib` is needed for the Postgres extensions
 Akkoma uses.
 
 The `mksh` shell is needed to run the Elixir `mix` script.
@@ -35,14 +35,14 @@ Copy the rc.d scripts to the right directory:
 # cp /usr/pkg/share/examples/rc.d/nginx /usr/pkg/share/examples/rc.d/pgsql /etc/rc.d
 ```
 
-Add NGINX and PostgreSQL to `/etc/rc.conf`:
+Add nginx and Postgres to `/etc/rc.conf`:
 
 ```
 nginx=YES
 pgsql=YES
 ```
 
-## Configuring PostgreSQL
+## Configuring postgres
 
 First, run `# /etc/rc.d/pgsql start`. Then, `$ sudo -Hu pgsql -g pgsql createdb`.
 
@@ -76,7 +76,7 @@ $ mix deps.get
 $ MIX_ENV=prod mix pleroma.instance gen # You will be asked a few questions here.
 ```
 
-Since PostgreSQL is configured, we can now initialize the database. There should
+Since Postgres is configured, we can now initialize the database. There should
 now be a file in `config/setup_db.psql` that makes this easier. Edit it, and
 *change the password* to a password of your choice. Make sure it is secure, since
 it'll be protecting your database. Now initialize the database:
@@ -85,11 +85,11 @@ it'll be protecting your database. Now initialize the database:
 $ sudo -Hu pgsql -g pgsql psql -f config/setup_db.psql
 ```
 
-PostgreSQL allows connections from all users without a password by default. To
+Postgres allows connections from all users without a password by default. To
 fix this, edit `/usr/pkg/pgsql/data/pg_hba.conf`. Change every `trust` to
 `password`.
 
-Once this is done, restart PostgreSQL with `# /etc/rc.d/pgsql restart`.
+Once this is done, restart Postgres with `# /etc/rc.d/pgsql restart`.
 
 Run the database migrations.
 You will need to do this whenever you update with `git pull`:
@@ -98,14 +98,14 @@ You will need to do this whenever you update with `git pull`:
 $ MIX_ENV=prod mix ecto.migrate
 ```
 
-## Configuring NGINX
+## Configuring nginx
 
 Install the example configuration file
 `/home/akkoma/akkoma/installation/nginx/akkoma.nginx` to
 `/usr/pkg/etc/nginx.conf`.
 
 Note that it will need to be wrapped in a `http {}` block. You should add
-settings for the NGINX daemon outside the HTTP block, for example:
+settings for the nginx daemon outside of the http block, for example:
 
 ```
 user                    nginx  nginx;
@@ -133,7 +133,7 @@ First, get your account fingerprint:
 $ sudo -Hu nginx -g nginx acme.sh --register-account
 ```
 
-You need to add the following to your NGINX configuration for the server
+You need to add the following to your nginx configuration for the server
 running on port 80:
 
 ```
@@ -143,7 +143,7 @@ running on port 80:
   }
 ```
 
-Replace the string after `$1.` with your fingerprint.
+Replace the string after after `$1.` with your fingerprint.
 
 Start nginx:
 
@@ -193,10 +193,10 @@ Run `# /etc/rc.d/akkoma start` to start Akkoma.
 
 ## Conclusion
 
-Restart NGINX with `# /etc/rc.d/nginx restart` and you should be up and running.
+Restart nginx with `# /etc/rc.d/nginx restart` and you should be up and running.
 
 Make sure your time is in sync, or other instances will receive your posts with
-incorrect timestamps. You should have `ntpd` running.
+incorrect timestamps. You should have ntpd running.
 
 ## Instances running NetBSD
 

docs/docs/installation/openbsd_en.md

@@ -1,6 +1,6 @@
 # Installing on OpenBSD
 
-This guide describes the installation and configuration of Akkoma (and the required software to run it) on a single OpenBSD 7.2 server.
+This guide describes the installation and configuration of akkoma (and the required software to run it) on a single OpenBSD 7.2 server.
 
 For any additional information regarding commands and configuration files mentioned here, check the man pages [online](https://man.openbsd.org/) or directly on your server with the man command.
 
@@ -16,12 +16,12 @@ pkg_add elixir gmake git postgresql-server postgresql-contrib cmake ffmpeg erlan
 pkg_add erlang-wx # Choose the latest version as package version when promted
 ```
 
-Akkoma requires a reverse proxy, OpenBSD has relayd in base (and is used in this guide) and packages/ports are available for NGINX (www/nginx) and Apache (www/apache-httpd). Independently of the reverse proxy, [acme-client(1)](https://man.openbsd.org/acme-client) can be used to get a certificate from Let's Encrypt.
+Akkoma requires a reverse proxy, OpenBSD has relayd in base (and is used in this guide) and packages/ports are available for nginx (www/nginx) and apache (www/apache-httpd). Independently of the reverse proxy, [acme-client(1)](https://man.openbsd.org/acme-client) can be used to get a certificate from Let's Encrypt.
 
 #### Optional software
 
 Per [`docs/installation/optional/media_graphics_packages.md`](../installation/optional/media_graphics_packages.md):
-  * imagemagick
+  * ImageMagick
   * ffmpeg
   * exiftool
 
@@ -31,7 +31,7 @@ To install the above:
 pkg_add ffmpeg p5-Image-ExifTool
 ```
 
-#### Creating the Akkoma user
+#### Creating the akkoma user
 Akkoma will be run by a dedicated user, `_akkoma`. Before creating it, insert the following lines in `/etc/login.conf`:
 ```
 akkoma:\
@@ -41,16 +41,16 @@ akkoma:\
 ```
 This creates a `akkoma` login class and sets higher values than default for datasize and openfiles (see [login.conf(5)](https://man.openbsd.org/login.conf)), this is required to avoid having akkoma crash some time after starting.
 
-Create the `_akkoma` user, assign it the Akkoma login class and create its home directory (`/home/_akkoma/`): `useradd -m -L akkoma _akkoma`
+Create the `_akkoma` user, assign it the akkoma login class and create its home directory (`/home/_akkoma/`): `useradd -m -L akkoma _akkoma`
 
-#### Clone Akkoma's directory
+#### Clone akkoma's directory
 Enter a shell as the `_akkoma` user. As root, run `su _akkoma -;cd`. Then clone the repository with `git clone https://akkoma.dev/AkkomaGang/akkoma.git`. Akkoma is now installed in `/home/_akkoma/akkoma/`, it will be configured and started at the end of this guide.
 
 #### PostgreSQL
 Create `_postgresql`'s user directory (it hasn't been created yet): `mdir var/postgresql/data`. To set it as home
 directory for user `_postgresql` run `usermod -d  /var/postgresql/data _postgresql`.
 
-Start a shell as the `_postgresql` user (as root run `su _postgresql -` then run the `initdb` command to initialize PostgreSQL.
+Start a shell as the `_postgresql` user (as root run `su _postgresql -` then run the `initdb` command to initialize postgresql.
 You will need to specify pgdata directory to the default (`/var/postgresql/data`) with the `-D <path>` and set the user to postgres with the `-U <username>` flag. This can be done as follows:
 
 ```
@@ -58,7 +58,7 @@ initdb -D /var/postgresql/data -U postgres
 ```
 If you are not using the default directory, you will have to update the `datadir` variable in the `/etc/rc.d/postgresql` script.
 
-When this is done, enable PostgreSQL so that it starts on boot and start it. As root, run:
+When this is done, enable postgresql so that it starts on boot and start it. As root, run:
 ```
 rcctl enable postgresql
 rcctl start postgresql
@@ -66,11 +66,11 @@ rcctl start postgresql
 To check that it started properly and didn't fail right after starting, you can run `ps aux | grep postgres`, there should be multiple lines of output.
 
 #### httpd
-httpd will have three functions:
+httpd will have three fuctions:
 
-  * Redirect requests trying to reach the instance over HTTP to the HTTPS URL
-  * Serve a robots.txt file
-  * Get Let's Encrypt certificates, with acme-client
+  * redirect requests trying to reach the instance over http to the https URL
+  * serve a robots.txt file
+  * get Let's Encrypt certificates, with acme-client
 
 Insert the following config in `/etc/httpd.conf`:
 ```
@@ -137,8 +137,8 @@ ln -s /etc/ssl/private/<domain name>.key /etc/ssl/private/<IP address>.key
 ```
 This will have to be done for each IPv4 and IPv6 address relayd listens on.
 
-#### Relayd
-Relayd will be used as the reverse proxy sitting in front of Akkoma.
+#### relayd
+relayd will be used as the reverse proxy sitting in front of akkoma.
 Insert the following configuration in `/etc/relayd.conf`:
 ```
 # $OpenBSD: relayd.conf,v 1.4 2018/03/23 09:55:06 claudio Exp $
@@ -225,22 +225,22 @@ Replace *<network interface\>* by your server's network interface name (which yo
 
 Check pf's configuration by running `pfctl -nf /etc/pf.conf`, load it with `pfctl -f /etc/pf.conf` and enable pf at boot with `rcctl enable pf`.
 
-#### Configure and start Akkoma
-Enter a shell as `_akkoma` (as root `su _akkoma -`) and enter Akkoma's installation directory (`cd ~/akkoma/`).
+#### Configure and start akkoma
+Enter a shell as `_akkoma` (as root `su _akkoma -`) and enter akkoma's installation directory (`cd ~/akkoma/`).
 
 Then follow the main installation guide:
 
-  * Run `mix deps.get`
-  * Run `MIX_ENV=prod mix pleroma.instance gen` and enter your instance's information when asked
-  * Copy `config/generated_config.exs` to `config/prod.secret.exs`. The default values should be sufficient, but you should edit it and check that everything seems OK.
-  * Exit your current shell back to a root one and run `psql -U postgres -f /home/_akkoma/akkoma/config/setup_db.psql` to setup the database.
-  * Return to a `_akkoma` shell into Akkoma's installation directory (`su _akkoma -;cd ~/akkoma`) and run `MIX_ENV=prod mix ecto.migrate`
+  * run `mix deps.get`
+  * run `MIX_ENV=prod mix pleroma.instance gen` and enter your instance's information when asked
+  * copy `config/generated_config.exs` to `config/prod.secret.exs`. The default values should be sufficient but you should edit it and check that everything seems OK.
+  * exit your current shell back to a root one and run `psql -U postgres -f /home/_akkoma/akkoma/config/setup_db.psql` to setup the database.
+  * return to a `_akkoma` shell into akkoma's installation directory (`su _akkoma -;cd ~/akkoma`) and run `MIX_ENV=prod mix ecto.migrate`
 
 As `_akkoma` in `/home/_akkoma/akkoma`, you can now run `LC_ALL=en_US.UTF-8 MIX_ENV=prod mix phx.server` to start your instance.
-In another SSH session/tmux window, check that it is working properly by running `ftp -MVo - http://127.0.0.1:4000/api/v1/instance`, you should get JSON output. Double-check that *uri*'s value is your instance's domain name.
+In another SSH session/tmux window, check that it is working properly by running `ftp -MVo - http://127.0.0.1:4000/api/v1/instance`, you should get json output. Double-check that *uri*'s value is your instance's domain name.
 
-##### Starting Akkoma at boot
-An rc script to automatically start Akkoma at boot hasn't been written yet, it can be run in a tmux session (tmux is in base).
+##### Starting akkoma at boot
+An rc script to automatically start akkoma at boot hasn't been written yet, it can be run in a tmux session (tmux is in base).
 
 #### Create administrative user
 

docs/docs/installation/optional/media_graphics_packages.md

@@ -1,26 +1,25 @@
 # Optional software packages needed for specific functionality
 
 For specific Akkoma functionality (which is disabled by default) some or all of the below packages are required:
-  * `imagemagick`
+  * `ImageMagick`
   * `ffmpeg`
   * `exiftool`
   
 Please refer to documentation in `docs/installation` on how to install them on specific OS.
   
-!!! note
-    The packages are not required with the current default settings of Akkoma.
+Note: the packages are not required with the current default settings of Akkoma.
 
-## `imagemagick`
+## `ImageMagick`
 
-`imagemagick` is a set of tools to create, edit, compose, or convert bitmap images.
+`ImageMagick` is a set of tools to create, edit, compose, or convert bitmap images.
 
 It is required for the following Akkoma features:
-  * `Pleroma.Upload.Filters.Mogrify`, `Pleroma.Upload.Filters.Mogrifun` upload filters (related config: `Plaroma.Upload/filters` in `config/config.exs`)
+  * `Pleroma.Upload.Filters.Mogrify`, `Pleroma.Upload.Filters.Mogrifun` upload filters (related config: `Pleroma.Upload/filters` in `config/config.exs`)
   * Media preview proxy for still images (related config: `media_preview_proxy/enabled` in `config/config.exs`)
   
 ## `ffmpeg`
 
-`ffmpeg` is a software to record, convert and stream audio and video.
+`ffmpeg` is software to record, convert and stream audio and video.
 
 It is required for the following Akkoma features:
   * Media preview proxy for videos (related config: `media_preview_proxy/enabled` in `config/config.exs`)
@@ -30,4 +29,5 @@ It is required for the following Akkoma features:
 `exiftool` is media files metadata reader/writer.
 
 It is required for the following Akkoma features:
-  * `Pleroma.Upload.Filters.Exiftool` upload filter (related config: `Plaroma.Upload/filters` in `config/config.exs`)
+  * `Pleroma.Upload.Filters.Exiftool.StripMetadata` upload filter (related config: `Pleroma.Upload/filters` in `config/config.exs`)
+  * `Pleroma.Upload.Filters.Exiftool.ReadDescription` upload filter (related config: `Pleroma.Upload/filters` in `config/config.exs`)

docs/docs/installation/otp_en.md

@@ -5,11 +5,11 @@
 This guide covers a installation using an OTP release. To install Akkoma from source, please check out the corresponding guide for your distro.
 
 ## Pre-requisites
-* A machine running Linux with GNU (e.g. Debian, Ubuntu) or musl (e.g. Alpine) libc and an `x86_64` CPU you have root access to. If you are not sure if it's compatible see [Detecting flavour section](#detecting-flavour) below
-* For installing OTP releases on RedHat-based distros like Fedora and CentOS Stream, please follow [this guide](./otp_redhat_en.md) instead.
+* A machine running Linux with GNU (e.g. Debian, Ubuntu) or musl (e.g. Alpine) libc and an `x86_64` or `arm64` CPU you have root access to. If you are not sure if it's compatible see [Detecting flavour section](#detecting-flavour) below
+* For installing OTP releases on RedHat-based distros like Fedora and Centos Stream, please follow [this guide](./otp_redhat_en.md) instead.
 * A (sub)domain pointed to the machine
 
-You will be running commands as root. If you aren't root already, please elevate your privileges by executing `sudo su`/`su`.
+You will be running commands as root. If you aren't root already, please elevate your priviledges by executing `sudo -i`/`su`.
 
 While in theory OTP releases are possbile to install on any compatible machine, for the sake of simplicity this guide focuses only on Debian/Ubuntu and Alpine.
 
@@ -31,15 +31,15 @@ support.
 
 ### Installing the required packages
 
-Other than things bundled in the OTP release, Akkoma depends on:
+Other than things bundled in the OTP release Akkoma depends on:
 
-* `curl` (to download the release build)
-* `unzip` (needed to unpack release builds)
-* `ncurses` (ERTS won't run without it)
-* `postgresql` (also utilizes extensions in postgresql-contrib)
-* `nginx` (could be swapped with another reverse proxy, but this guide covers only it)
-* `certbot` (for Let's Encrypt certificates, could be swapped with another ACME client, but this guide covers only it)
-* `libmagic`/`file`
+* curl (to download the release build)
+* unzip (needed to unpack release builds)
+* ncurses (ERTS won't run without it)
+* PostgreSQL (also utilizes extensions in postgresql-contrib)
+* nginx (could be swapped with another reverse proxy but this guide covers only it)
+* certbot (for Let's Encrypt certificates, could be swapped with another ACME client, but this guide covers only it)
+* libmagic/file
 
 === "Alpine"
     ```
@@ -56,9 +56,9 @@ Other than things bundled in the OTP release, Akkoma depends on:
 ### Installing optional packages
 
 Per [`docs/installation/optional/media_graphics_packages.md`](optional/media_graphics_packages.md):
-  * `imagemagick`
-  * `ffmpeg`
-  * `exiftool`
+  * ImageMagick
+  * ffmpeg
+  * exiftool
 
 === "Alpine"
     ```
@@ -118,7 +118,7 @@ Restart PostgreSQL to apply configuration changes:
 adduser --system --shell  /bin/false --home /opt/akkoma akkoma
 
 # Set the flavour environment variable to the string you got in Detecting flavour section.
-# For example, if the flavour is `amd64-musl` the command will be
+# For example if the flavour is `amd64-musl` the command will be
 #     export FLAVOUR="amd64-musl"
 export FLAVOUR="<replace-this-with-the-correct-flavour-string>"
 
@@ -155,7 +155,7 @@ chown -R akkoma /etc/akkoma
 # Run the config generator
 su akkoma -s $SHELL -lc "./bin/pleroma_ctl instance gen --output /etc/akkoma/config.exs --output-psql /tmp/setup_db.psql"
 
-# Create the PostgreSQL database
+# Create the postgres database
 su postgres -s $SHELL -lc "psql -f /tmp/setup_db.psql"
 
 # Create the database schema
@@ -174,34 +174,29 @@ sleep 20 && curl http://localhost:4000/api/v1/instance
 su akkoma -s $SHELL -lc "./bin/pleroma stop"
 ```
 
-### Setting up NGINX and getting Let's Encrypt SSL certificates
+### Setting up nginx and getting Let's Encrypt SSL certificaties
 
-#### Get a Let's Encrypt certificate
-```sh
-certbot certonly --standalone --preferred-challenges http -d yourinstance.tld
-```
+#### Copy Akkoma nginx configuration to the nginx folder
 
-#### Copy Akkoma NGINX configuration to the NGINX folder
-
-The location of NGINX configs is dependent on the distro
+The location of nginx configs is dependent on the distro
 
 === "Alpine"
     ```
-    cp /opt/akkoma/installation/nginx/akkoma.nginx /etc/nginx/conf.d/akkoma.conf
+    cp /opt/akkoma/installation/akkoma.nginx /etc/nginx/conf.d/akkoma.conf
     ```
 
 === "Debian/Ubuntu"
     ```
-    cp /opt/akkoma/installation/nginx/akkoma.nginx /etc/nginx/sites-available/akkoma.conf
+    cp /opt/akkoma/installation/akkoma.nginx /etc/nginx/sites-available/akkoma.conf
     ln -s /etc/nginx/sites-available/akkoma.conf /etc/nginx/sites-enabled/akkoma.conf
     ```
 
-If your distro does not have either of those, you can append `include /etc/nginx/akkoma.conf` to the end of the HTTP section in /etc/nginx/nginx.conf and
+If your distro does not have either of those you can append `include /etc/nginx/akkoma.conf` to the end of the http section in /etc/nginx/nginx.conf and
 ```sh
-cp /opt/akkoma/installation/nginx/akkoma.nginx /etc/nginx/akkoma.conf
+cp /opt/akkoma/installation/akkoma.nginx /etc/nginx/akkoma.conf
 ```
 
-#### Edit the NGINX config
+#### Edit the nginx config
 ```sh
 # Replace example.tld with your (sub)domain
 $EDITOR path-to-nginx-config
@@ -209,7 +204,15 @@ $EDITOR path-to-nginx-config
 # Verify that the config is valid
 nginx -t
 ```
-#### Start NGINX
+
+#### Get a Let's Encrypt certificate
+```sh
+certbot --nginx -d yourinstance.tld -d media.yourinstance.tld
+```
+
+If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. A common source of problems are nginx config syntax errors; this can be checked for by running `nginx -t`.
+
+#### Start nginx
 
 === "Alpine"
     ```
@@ -245,39 +248,26 @@ At this point if you open your (sub)domain in a browser you should see a 502 err
     systemctl enable akkoma
     ```
 
-If everything worked, you should see Akkoma-fe when visiting your domain. If that didn't happen, try reviewing the installation steps, starting Akkoma in the foreground and seeing if there are any errors.
+If everything worked, you should see Akkoma-FE when visiting your domain. If that didn't happen, try reviewing the installation steps, starting Akkoma in the foreground and seeing if there are any errrors.
 
 {! support.include !}
 
 ## Post installation
 
 ### Setting up auto-renew of the Let's Encrypt certificate
-```sh
-# Create the directory for webroot challenges
-mkdir -p /var/lib/letsencrypt
-
-# Uncomment the webroot method
-$EDITOR path-to-nginx-config
-
-# Verify that the config is valid
-nginx -t
-```
 
 === "Alpine"
     ```
-    # Restart NGINX
-    rc-service nginx restart
-
     # Start the cron daemon and make it start on boot
     rc-service crond start
     rc-update add crond
 
     # Ensure the webroot menthod and post hook is working
-    certbot renew --cert-name yourinstance.tld --webroot -w /var/lib/letsencrypt/ --dry-run --post-hook 'rc-service nginx reload'
+    certbot renew --cert-name yourinstance.tld --nginx --dry-run
 
     # Add it to the daily cron
     echo '#!/bin/sh
-    certbot renew --cert-name yourinstance.tld --webroot -w /var/lib/letsencrypt/ --post-hook "rc-service nginx reload"
+    certbot renew --cert-name yourinstance.tld --nginx
     ' > /etc/periodic/daily/renew-akkoma-cert
     chmod +x /etc/periodic/daily/renew-akkoma-cert
 
@@ -286,29 +276,14 @@ nginx -t
     ```
 
 === "Debian/Ubuntu"
-    ```
-    # Restart NGINX
-    systemctl restart nginx
-
-    # Ensure the webroot menthod and post hook is working
-    certbot renew --cert-name yourinstance.tld --webroot -w /var/lib/letsencrypt/ --dry-run --post-hook 'systemctl reload nginx'
-
-    # Add it to the daily cron
-    echo '#!/bin/sh
-    certbot renew --cert-name yourinstance.tld --webroot -w /var/lib/letsencrypt/ --post-hook "systemctl reload nginx"
-    ' > /etc/cron.daily/renew-akkoma-cert
-    chmod +x /etc/cron.daily/renew-akkoma-cert
-
-    # If everything worked the output should contain /etc/cron.daily/renew-akkoma-cert
-    run-parts --test /etc/cron.daily
-    ```
+    This should be automatically enabled with the `certbot-renew.timer` systemd unit.
 
 ## Create your first user and set as admin
 ```sh
 cd /opt/akkoma
 su akkoma -s $SHELL -lc "./bin/pleroma_ctl user new joeuser joeuser@sld.tld --admin"
 ```
-This will create an account with the username of 'joeuser' with the email address of joeuser@sld.tld, and set that user's account as an admin. This will result in a link that you can paste into the browser, which logs you in and enables you to set the password.
+This will create an account withe the username of 'joeuser' with the email address of joeuser@sld.tld, and set that user's account as an admin. This will result in a link that you can paste into the browser, which logs you in and enables you to set the password.
 
 {! installation/frontends.include !}
 

docs/docs/installation/otp_redhat_en.md

@@ -1,17 +1,18 @@
-# Installing on Red Hat using OTP releases
+# Installing on RedHat using OTP releases
 
-## OTP releases and Fedora/Red Hat
+## OTP releases and Fedora/RedHat
 
-The current OTP builds available for Linux are unfortunately incompatible with Red Hat Linux distributions, like Fedora and CentOS Stream. This is due to Red Hat maintaining patched versions of certain Erlang libraries, making them incompatible with other Linux distributions.
+The current OTP builds available for Linux are unfortunately incompatible with RedHat Linux distributions, like Fedora and Centos Stream. This is due to RedHat maintaining patched versions of certain Erlang libraries, making them incompatible with other Linux distributions.
 
 However, you may compile your own OTP release from scratch. This is particularly useful if you wish to quickly distribute your OTP build onto multiple systems, without having to worry about compiling code on every system. However, if your goal is to simply set up a single instance for yourself, installing from-source might be a simpler option. To install from-source, please follow [this guide](./fedora_based_en.md).
 
+
 ## Pre-requisites
 
-In order to compile a RedHat-compatible OTP release, you will need to run a Red Hat Linux distribution. This guide will assume you run Fedora 36, though it should also work on older Fedora releases and other Red Hat distributions. It also assumes that you have administrative rights and sufficient knowledge on how to perform common CLI tasks in Linux. If you want to run this guide with root, ignore the `sudo` at the beginning of the lines.
+In order to compile a RedHat-compatible OTP release, you will need to run a RedHat Linux distribution. This guide will assume you run Fedora 36, though it should also work on older Fedora releases and other RedHat distributions. It also assumes that you have administrative rights and sufficient knowledge on how to perform common CLI tasks in Linux. If you want to run this guide with root, ignore the `sudo` at the beginning of the lines.
+
+Important: keep in mind that you must build your OTP release for the specific RedHat distribution you wish to use it on. A build on Fedora will only be compatible with a specific Fedora release version.
 
-!!! important
-    Keep in mind that you must build your OTP release for the specific Red Hat distribution you wish to use it on. A build on Fedora will only be compatible with a specific Fedora release version.
 
 ## Building an OTP release for Fedora 36
 
@@ -29,9 +30,10 @@ sudo dnf upgrade --refresh
 sudo dnf install git gcc g++ erlang elixir erlang-os_mon erlang-eldap erlang-xmerl erlang-erl_interface erlang-syntax_tools make cmake file-devel
 ```
 
+
 ### Preparing the project files
 
-* Git clone the Akkoma-be repository. This can be done anywhere:
+* Git clone the AkkomaBE repository. This can be done anywhere:
 
 ```shell
 cd ~
@@ -44,6 +46,7 @@ git clone https://akkoma.dev/AkkomaGang/akkoma.git -b stable
 cd ./akkoma
 ```
 
+
 ### Building the OTP release
 
 * Run the following commands:
@@ -62,22 +65,25 @@ Note that compiling the OTP release will take some time. Once it completes, you
 
 If all went well, you will have built your very own Fedora-compatible OTP release! You can now pack up the files in the `release` directory and deploy them to your other Fedora servers.
 
+
 ## Installing the OTP release
 
 Installing the OTP release from this point onward will be very similar to the regular OTP release. This guide assumes you will want to install your OTP package on other systems, so additional pre-requisites will be listed below.
 
 Please note that running your own OTP release has some minor caveats that you should be aware of. They will be listed below as well.
 
+
 ### Installing required packages
 
-Other than things bundled in the OTP release, Akkoma depends on:
+Other than things bundled in the OTP release Akkoma depends on:
 
-* `curl` (to download the release build)
-* `ncurses` (ERTS won't run without it)
-* `postgresql` (also utilizes extensions in `postgresql-contrib`)
-* `nginx` (could be swapped with another reverse proxy, but this guide covers only it)
-* `certbot` (for Let's Encrypt certificates, could be swapped with another ACME client, but this guide covers only it)
-* `libmagic`/`file`
+* curl (to download the release build)
+* ncurses (ERTS won't run without it)
+* PostgreSQL (also utilizes extensions in postgresql-contrib)
+* nginx (could be swapped with another reverse proxy but this guide covers only it)
+* certbot (for Let's Encrypt certificates, could be swapped with another ACME client, but this guide covers only it)
+    * If you are using certbot, also install the `python3-certbot-nginx` package for the nginx plugin
+* libmagic/file
 
 First, update your system, if not already done:
 
@@ -91,9 +97,10 @@ Then install the required packages:
 sudo dnf install curl ncurses postgresql postgresql-contrib nginx certbot file-devel
 ```
 
+
 ### Optional packages: [`docs/installation/optional/media_graphics_packages.md`](../installation/optional/media_graphics_packages.md)
 
-* Install FFmpeg (requires setting up the RPM-fusion repositories):
+* Install ffmpeg (requires setting up the RPM-fusion repositories):
 
 ```shell
 sudo dnf -y install https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm
@@ -107,6 +114,7 @@ sudo dnf install ffmpeg
 sudo dnf install Imagemagick perl-Image-ExifTool
 ```
 
+
 ### Configuring PostgreSQL
 #### (Optional) Performance configuration
 It is encouraged to check [Optimizing your PostgreSQL performance](../configuration/postgresql.md) document, for tips on PostgreSQL tuning.
@@ -143,7 +151,7 @@ sudo chown -R akkoma /etc/akkoma
 # Run the config generator
 sudo -Hu akkoma ./bin/pleroma_ctl instance gen --output /etc/akkoma/config.exs --output-psql /tmp/setup_db.psql
 
-# Create the PostgreSQL database
+# Create the postgres database
 sudo -Hu postgres psql -f /tmp/setup_db.psql
 
 # Create the database schema
@@ -159,21 +167,16 @@ sleep 20 && curl http://localhost:4000/api/v1/instance
 sudo -Hu akkoma ./bin/pleroma stop
 ```
 
-### Setting up NGINX and getting Let's Encrypt SSL certificates
 
-#### Get a Let's Encrypt certificate
+### Setting up nginx and getting Let's Encrypt SSL certificaties
+
+#### Copy Akkoma nginx configuration to the nginx folder
 
 ```shell
-certbot certonly --standalone --preferred-challenges http -d yourinstance.tld
+cp /opt/akkoma/installation/akkoma.nginx /etc/nginx/conf.d/akkoma.conf
 ```
 
-#### Copy Akkoma NGINX configuration to the NGINX folder
-
-```shell
-cp /opt/akkoma/installation/nginx/akkoma.nginx /etc/nginx/conf.d/akkoma.conf
-```
-
-#### Edit the NGINX config
+#### Edit the nginx config
 ```shell
 # Replace example.tld with your (sub)domain (replace $EDITOR with your editor of choice)
 sudo $EDITOR /etc/nginx/conf.d/akkoma.conf
@@ -181,13 +184,21 @@ sudo $EDITOR /etc/nginx/conf.d/akkoma.conf
 # Verify that the config is valid
 sudo nginx -t
 ```
-#### Start NGINX
+#### Start nginx
 
 ```shell
 sudo systemctl start nginx
 ```
 
-At this point if you open your (sub)domain in a browser you should see a 502 error, that's because Akkoma is not started yet.
+#### Get a Let's Encrypt certificate
+
+```shell
+sudo certbot --email <your@emailaddress> -d <yourdomain> -d <media_domain> --nginx
+```
+
+If that doesn't work the first time, add `--dry-run` to further attempts to avoid being ratelimited as you identify the issue, and do not remove it until the dry run succeeds. A common source of problems are nginx config syntax errors; this can be checked for by running `nginx -t`.
+
+If you're successful with obtaining the certificates, opening your (sub)domain in a browser will result in a 502 error, since Akkoma hasn't been started yet.
 
 ### Setting up a system service
 
@@ -207,9 +218,9 @@ sudo systemctl start akkoma
 sudo systemctl enable akkoma
 ```
 
-If everything worked, you should see a response from akkoma-be when visiting your domain. You may need to install frontends like akkoma-fe and admin-fe; refer to [this guide](../administration/CLI_tasks/frontend.md) on how to install them.
+If everything worked, you should see a response from Akkoma-BE when visiting your domain. You may need to install frontends like Akkoma-FE and Admin-FE; refer to [this guide](../administration/CLI_tasks/frontend.md) on how to install them.
 
-If that didn't happen, try reviewing the installation steps, starting Akkoma in the foreground and seeing if there are any errors.
+If that didn't happen, try reviewing the installation steps, starting Akkoma in the foreground and seeing if there are any errrors.
 
 {! support.include !}
 
@@ -227,46 +238,40 @@ sudo $EDITOR /etc/nginx/conf.d/akkoma.conf
 # Verify that the config is valid
 sudo nginx -t
 
-# Restart NGINX
+# Restart nginx
 sudo systemctl restart nginx
 
-# Ensure the webroot menthod and post hook is working
-sudo certbot renew --cert-name yourinstance.tld --webroot -w /var/lib/letsencrypt/ --dry-run --post-hook 'systemctl reload nginx'
-
-# Add it to the daily cron
-echo '#!/bin/sh
-certbot renew --cert-name yourinstance.tld --webroot -w /var/lib/letsencrypt/ --post-hook "systemctl reload nginx"
-' > /etc/cron.daily/renew-akkoma-cert
-sudo chmod +x /etc/cron.daily/renew-akkoma-cert
-
-# If everything worked the output should contain /etc/cron.daily/renew-akkoma-cert
-sudo run-parts --test /etc/cron.daily
+# Test that renewals work properly
+sudo certbot renew --cert-name yourinstance.tld --nginx --dry-run
 ```
 
+Assuming the commands were run successfully, certbot should be able to renew your certificates automatically via the `certbot-renew.timer` systemd unit.
+
 ## Create your first user and set as admin
 ```shell
 cd /opt/akkoma
 sudo -Hu akkoma ./bin/pleroma_ctl user new joeuser joeuser@sld.tld --admin
 ```
-This will create an account with the username of 'joeuser' with the email address of joeuser@sld.tld, and set that user's account as an admin. This will result in a link that you can paste into the browser, which logs you in and enables you to set the password.
+This will create an account withe the username of 'joeuser' with the email address of joeuser@sld.tld, and set that user's account as an admin. This will result in a link that you can paste into the browser, which logs you in and enables you to set the password.
 
 ## Further reading
 
 ### Caveats of building your own OTP release
 
-There are some things to take note of when you are running your own OTP builds.
+There are some things to take note of when your are running your own OTP builds.
 
 #### Updating your OTP builds
 
 Using your custom OTP build, you will not be able to update the installation using the `pleroma_ctl update` command. Running this command would overwrite your install with an OTP release from the main Akkoma repository, which will break your install.
 
-Instead, you will have to rebuild your OTP release every time there are updates, then manually move it to where your Akkoma installation is running, overwriting the old OTP release files. Make sure to stop the Akkoma-be server before overwriting any files!
+Instead, you will have to rebuild your OTP release every time there are updates, then manually move it to where your Akkoma installation is running, overwriting the old OTP release files. Make sure to stop the Akkoma-BE server before overwriting any files!
 
 After that, run the `pleroma_ctl migrate` command as usual to perform database migrations.
 
-#### Cross-compatibility between Red Hat distributions
 
-As it currently stands, your OTP build will only be compatible for the specific Red Hat distribution you've built it on. Fedora builds only work on Fedora, Centos builds only on Centos, Red Hat builds only on Red Hat. Secondly, for Fedora, they will also be bound to the specific Fedora release. This is because different releases of Fedora may have significant changes made in some of the required packages and libraries.
+#### Cross-compatibility between RedHat distributions
+
+As it currently stands, your OTP build will only be compatible for the specific RedHat distribution you've built it on. Fedora builds only work on Fedora, Centos builds only on Centos, RedHat builds only on RedHat. Secondly, for Fedora, they will also be bound to the specific Fedora release. This is because different releases of Fedora may have significant changes made in some of the required packages and libraries.
 
 {! installation/frontends.include !}
 

docs/docs/installation/otp_vs_from_source.include

@@ -1,3 +1,3 @@
 ## OTP releases vs from-source installations
 
-There are two ways to install Akkoma. You can use OTP releases or do a from-source installation. OTP releases are as close as you can get to binary releases with Erlang/Elixir. The release is self-contained, and provides everything needed to boot it, it is easily administered via the provided shell script to open up a remote console, start/stop/restart the release, start in the background, send remote commands, and more. With from source installations, you install Akkoma from source, meaning you have to install certain dependencies like Erlang+Elixir and compile Akkoma yourself.
+There are two ways to install Akkoma. You can use OTP releases or do a from-source installation. OTP releases are as close as you can get to binary releases with Erlang/Elixir. The release is self-contained, and provides everything needed to boot it, it is easily administered via the provided shell script to open up a remote console, start/stop/restart the release, start in the background, send remote commands, and more. With from source installations you install Akkoma from source, meaning you have to install certain dependencies like Erlang+Elixir and compile Akkoma yourself.

docs/docs/support.include

@@ -1,5 +1,5 @@
 ## Support
 
-If you encounter any issues or have questions regarding the installation process, feel free to ask at [meta.akkoma.dev](https://meta.akkoma.dev/).
+If you encounter any issues or have questions regarding the install process, feel free to ask at [meta.akkoma.dev](https://meta.akkoma.dev/).
 
 Or message via IRC on #akkoma at irc.akkoma.dev (port 6697, SSL)

elixir_buildpack.config

@@ -1,2 +0,0 @@
-elixir_version=1.14.3
-erlang_version=25.3

installation/akkoma.service

@@ -19,6 +19,9 @@ Environment="MIX_ENV=prod"
 ; Don't listen epmd on 0.0.0.0
 Environment="ERL_EPMD_ADDRESS=127.0.0.1"
 
+; Don't busy wait
+Environment="ERL_AFLAGS=+sbwt none +sbwtdcpu none +sbwtdio none"
+
 ; Make sure that all paths fit your installation.
 ; Path to the home directory of the user running the Akkoma service.
 Environment="HOME=/var/lib/akkoma"

installation/apache/akkoma-apache.conf

@@ -60,7 +60,7 @@ ServerTokens Prod
     Include /etc/letsencrypt/options-ssl-apache.conf
 
     # Uncomment the following to enable MediaProxy caching on disk
-    #CacheRoot /tmp/akkoma-media-cache/
+    #CacheRoot /var/tmp/akkoma-media-cache/
     #CacheDirLevels 1
     #CacheDirLength 2
     #CacheEnable disk /proxy

installation/apache/apache-cache-purge.sh.example

@@ -16,7 +16,7 @@
 SCRIPTNAME=${0##*/}
 
 # mod_disk_cache directory
-CACHE_DIRECTORY="/tmp/akkoma-media-cache"
+CACHE_DIRECTORY="/var/tmp/akkoma-media-cache"
 
 ## Removes an item via the htcacheclean utility
 ## $1 - the filename, can be a pattern .

installation/caddy/Caddyfile

@@ -12,26 +12,22 @@ example.tld  {
     output file /var/log/caddy/akkoma.log
   }
 
-  encode gzip
-
   # this is explicitly IPv4 since Pleroma.Web.Endpoint binds on IPv4 only
   # and `localhost.` resolves to [::0] on some systems: see issue #930
   reverse_proxy 127.0.0.1:4000
 
-  # Uncomment if using a separate media subdomain
-  #@mediaproxy path /media/* /proxy/*
-  #handle @mediaproxy {
-  #  redir https://media.example.tld{uri} permanent
-  #}
+  @mediaproxy path /media/* /proxy/*
+  handle @mediaproxy {
+    redir https://media.example.tld{uri} permanent
+  }
 }
 
-# Uncomment if using a separate media subdomain
-#media.example.tld {
-#  @mediaproxy path /media/* /proxy/*
-#  reverse_proxy @mediaproxy 127.0.0.1:4000 {
-#    transport http {
-#      response_header_timeout 10s
-#      read_timeout 15s
-#    }
-#  }
-#}
+media.example.tld {
+  @mediaproxy path /media/* /proxy/*
+  reverse_proxy @mediaproxy 127.0.0.1:4000 {
+    transport http {
+      response_header_timeout 10s
+      read_timeout 15s
+    }
+  }
+}

installation/init.d/akkoma

@@ -1,23 +1,43 @@
 #!/sbin/openrc-run
 supervisor=supervise-daemon
-command_user=akkoma:akkoma
-command_background=1
-# Ask process to terminate within 30 seconds, otherwise kill it
-retry="SIGTERM/30/SIGKILL/5"
-pidfile="/var/run/akkoma.pid"
-directory=/opt/akkoma
-healthcheck_delay=60
-healthcheck_timer=30
 no_new_privs="yes"
+pidfile="/var/run/akkoma.pid"
 
-: ${akkoma_port:-4000}
+# Ask process first to terminate itself within 60s, otherwise kill it
+retry="SIGTERM/60/SIGKILL/5"
 
-# Needs OpenRC >= 0.42
-#respawn_max=0
-#respawn_delay=5
+# if you really want to use start-stop-daemon instead,
+# also put the following in the config:
+#    command_background=1
+
+# Adjust defaults as needed in /etc/conf.d/akkoma;
+# no need to directly edit the service file
+command_user="${command_user:-akkoma:akkoma}"
+directory="${directory:-/var/lib/akkoma/akkoma}"
+akkoma_port="${akkoma_port:-4000}"
+# whether to allow connecting a remote exlixir shell to the running Akkoma instance
+akkoma_console=${akkoma_console:-NO}
+
+output_log="${output_log:-/var/log/akkoma}"
+error_log="${error_log:-/var/log/akkoma}"
+
+# 0 means unlimited restarts
+respawn_max="${respawn_max:-0}"
+respawn_delay="${respawn_delay:-5}"
+# define respawn period to only count crashes within a
+# sliding time window towards respawn_max, e.g.:
+#   respawn_period=2850
+
+healthcheck_delay="${healthcheck_delay:-60}"
+healthcheck_timer="${healthcheck_timer:-30}"
+
+MIX_ENV=prod
+ERL_EPMD_ADDRESS="${ERL_EPMD_ADDRESS:-127.0.0.1}"
+ERL_AFLAGS="${ERL_AFLAGS:-+sbwt none +sbwtdcpu none +sbwtdio none}"
+supervise_daemon_args="${supervise_daemon_args} --env MIX_ENV=${MIX_ENV}"
+supervise_daemon_args="${supervise_daemon_args} --env ERL_EPMD_ADDRESS=${ERL_EPMD_ADDRESS}"
+supervise_daemon_args="${supervise_daemon_args} --env ERL_AFLAGS='${ERL_AFLAGS}'"
 
-# put akkoma_console=YES in /etc/conf.d/akkoma if you want to be able to
-# connect to akkoma via an elixir console
 if yesno "${akkoma_console}"; then
 	command=elixir
 	command_args="--name akkoma@127.0.0.1 --erl '-kernel inet_dist_listen_min 9001 inet_dist_listen_max 9001 inet_dist_use_interface {127,0,0,1}' -S mix phx.server"
@@ -31,13 +51,24 @@ else
 	command_args="phx.server"
 fi
 
-export MIX_ENV=prod
-export ERL_EPMD_ADDRESS=127.0.0.1
-
 depend() {
 	need nginx postgresql
 }
 
+start_pre() {
+	# Ensure logfile ownership and perms are alright
+	checkpath --file --owner "$command_user" "$output_log" "$error_log" \
+	|| eerror "Logfile(s) not owned by $command_user, or not a file!"
+	checkpath --writable "$output_log" "$error_log" \
+	|| eerror "Logfile(s) not writable!"
+
+	# If a recompile is needed perform it with lowest prio
+	# (delaying the actual start) to avoid hogging too much
+	# CPU from other services
+	cd "$directory"
+	doas -u "${command_user%%:*}" env MIX_ENV="$MIX_ENV" nice -n 19 "$command" compile
+}
+
 healthcheck() {
 	# put akkoma_health=YES in /etc/conf.d/akkoma if you want healthchecking
 	# and make sure you have curl installed

installation/nginx/akkoma.nginx

@@ -1,12 +1,9 @@
 # default nginx site config for Akkoma
 #
-# Simple installation instructions:
-# 1. Install your TLS certificate, possibly using Let's Encrypt.
-# 2. Replace 'example.tld' with your instance's domain wherever it appears.
-# 3. Copy this file to /etc/nginx/sites-available/ and then add a symlink to it
-#    in /etc/nginx/sites-enabled/ and run 'nginx -s reload' or restart nginx.
+# See the documentation at docs.akkoma.dev for your particular distro/OS for
+# installation instructions.
 
-proxy_cache_path /tmp/akkoma-media-cache levels=1:2 keys_zone=akkoma_media_cache:10m max_size=10g
+proxy_cache_path /var/tmp/akkoma-media-cache levels=1:2 keys_zone=akkoma_media_cache:10m max_size=1g
                  inactive=720m use_temp_path=off;
 
 # this is explicitly IPv4 since Pleroma.Web.Endpoint binds on IPv4 only
@@ -15,25 +12,19 @@ upstream phoenix {
     server 127.0.0.1:4000 max_fails=5 fail_timeout=60s;
 }
 
-server {
-    server_name    example.tld;
-
-    listen         80;
-    listen         [::]:80;
-
-    # Uncomment this if you need to use the 'webroot' method with certbot. Make sure
-    # that the directory exists and that it is accessible by the webserver. If you followed
-    # the guide, you already ran 'mkdir -p /var/lib/letsencrypt' to create the folder.
-    # You may need to load this file with the ssl server block commented out, run certbot
-    # to get the certificate, and then uncomment it.
-    #
-    # location ~ /\.well-known/acme-challenge {
-    #     root /var/lib/letsencrypt/;
-    # }
-    location / {
-      return         301 https://$server_name$request_uri;
-    }
-}
+# If you are setting up TLS certificates without certbot, uncomment the
+# following to enable HTTP -> HTTPS redirects. Certbot users don't need to do
+# this as it will automatically do this for you.
+# server {
+#     server_name    example.tld media.example.tld;
+#
+#     listen         80;
+#     listen         [::]:80;
+#
+#     location / {
+#         return         301 https://$server_name$request_uri;
+#     }
+# }
 
 # Enable SSL session caching for improved performance
 ssl_session_cache shared:ssl_session_cache:10m;
@@ -41,22 +32,29 @@ ssl_session_cache shared:ssl_session_cache:10m;
 server {
     server_name example.tld;
 
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
-    ssl_session_timeout 1d;
-    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
-    ssl_session_tickets off;
+    # Once certbot is set up, this will automatically be updated to listen to
+    # port 443 with TLS alongside a redirect from plaintext HTTP.
+    listen 80;
+    listen [::]:80;
 
-    ssl_trusted_certificate   /etc/letsencrypt/live/example.tld/chain.pem;
-    ssl_certificate           /etc/letsencrypt/live/example.tld/fullchain.pem;
-    ssl_certificate_key       /etc/letsencrypt/live/example.tld/privkey.pem;
+    # If you are not using Certbot, comment out the above and uncomment/edit the following
+#     listen 443 ssl http2;
+#     listen [::]:443 ssl http2;
+#     ssl_session_timeout 1d;
+#     ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
+#     ssl_session_tickets off;
+#
+#     ssl_trusted_certificate   /etc/letsencrypt/live/example.tld/chain.pem;
+#     ssl_certificate           /etc/letsencrypt/live/example.tld/fullchain.pem;
+#     ssl_certificate_key       /etc/letsencrypt/live/example.tld/privkey.pem;
+#
+#     ssl_protocols TLSv1.2 TLSv1.3;
+#     ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
+#     ssl_prefer_server_ciphers off;
+#     ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
+#     ssl_stapling on;
+#     ssl_stapling_verify on;
 
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
-    ssl_prefer_server_ciphers off;
-    ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
-    ssl_stapling on;
-    ssl_stapling_verify on;
 
     gzip_vary on;
     gzip_proxied any;
@@ -75,9 +73,43 @@ server {
     proxy_set_header Host $http_host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
+    location ~ ^/(media|proxy) {
+        return 404;
+    }
+
     location / {
         proxy_pass http://phoenix;
     }
+}
+
+# Upload and MediaProxy Subdomain
+# (see main domain setup for more details)
+server {
+    server_name media.example.tld;
+
+    # Same as above, will be updated to HTTPS once certbot is set up.
+    listen 80;
+    listen [::]:80;
+
+    # If you are not using certbot, comment the above and copy all the ssl
+    # stuff from above into here.
+
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_buffers 16 8k;
+    gzip_http_version 1.1;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml;
+
+    # the nginx default is 1m, not enough for large media uploads
+    client_max_body_size 16m;
+    ignore_invalid_headers off;
+
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
     location ~ ^/(media|proxy) {
         proxy_cache        akkoma_media_cache;
@@ -91,4 +123,8 @@ server {
         chunked_transfer_encoding on;
         proxy_pass         http://phoenix;
     }
+
+    location / {
+        return 404;
+    }
 }

installation/nginx/nginx-cache-purge.sh.example

@@ -5,7 +5,7 @@
 SCRIPTNAME=${0##*/}
 
 # NGINX cache directory
-CACHE_DIRECTORY="/tmp/akkoma-media-cache"
+CACHE_DIRECTORY="/var/tmp/akkoma-media-cache"
 
 ## Return the files where the items are cached.
 ## $1 - the filename, can be a pattern .

lib/mix/pleroma.ex

@@ -16,7 +16,7 @@ defmodule Mix.Pleroma do
     :fast_html,
     :oban
   ]
-  @cachex_children ["object", "user", "scrubber", "web_resp"]
+  @cachex_children ["object", "user", "scrubber", "web_resp", "http_backoff"]
   @doc "Common functions to be reused in mix tasks"
   def start_pleroma do
     Pleroma.Config.Holder.save_default()
@@ -112,18 +112,26 @@ def shell_prompt(prompt, defval \\ nil, defname \\ nil) do
     end
   end
 
-  def shell_info(message) do
+  def shell_info(message) when is_binary(message) or is_list(message) do
     if mix_shell?(),
       do: Mix.shell().info(message),
       else: IO.puts(message)
   end
 
-  def shell_error(message) do
+  def shell_info(message) do
+    shell_info("#{inspect(message)}")
+  end
+
+  def shell_error(message) when is_binary(message) or is_list(message) do
     if mix_shell?(),
       do: Mix.shell().error(message),
       else: IO.puts(:stderr, message)
   end
 
+  def shell_error(message) do
+    shell_error("#{inspect(message)}")
+  end
+
   @doc "Performs a safe check whether `Mix.shell/0` is available (does not raise if Mix is not loaded)"
   def mix_shell?, do: :erlang.function_exported(Mix, :shell, 0)