############# begin setup mastodon ##############

    # main doc is Docker-Guide.md in docs repo

    # I'd like to try gnu social just cuz of gnu, but it's not being
    # well maintained, for example, simple pull requests
    # languishing:
    # https://git.gnu.io/gnu/gnu-social/merge_requests/143
    # and I submitted my own bugs, basic docs are broken
    # https://git.gnu.io/gnu/gnu-social/issues/269

    # note, docker required, but we installed it earlier

    # i subscrubed to https://github.com/docker/compose/releases.atom
    # to see release notes.
    # i had some problems upgrading. blew things away with
    # docker-compose down
    # docker rmi $(docker images -q)
    # s reboot now
    # when running docker-compose run, kernel stack traces are printed to the journal.
    # things seem to succeed, google says nothing, so ignoring them.
    curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-$(uname -s)-$(uname -m) | s dd of=/usr/local/bin/docker-compose
    s chmod +x /usr/local/bin/docker-compose


    cd ~
    s rm -rf mastodon
    i clone https://github.com/tootsuite/mastodon
    cd mastodon
    # subbed to atom feed to deal with updates
    git checkout $(git tag | grep -v rc | tail -n1)

    # per instructions, uncomment redis/postgres persistence in docker-compose.yml
    sed -i 's/^#//' docker-compose.yml

    cat >.env.production <<'EOF'
REDIS_HOST=redis
REDIS_PORT=6379
DB_HOST=db
DB_USER=postgres
DB_NAME=postgres
DB_PASS=
DB_PORT=5432

LOCAL_DOMAIN=mast.iankelling.org
LOCAL_HTTPS=true

SINGLE_USER_MODE=true

SMTP_SERVER=mail.iankelling.org
SMTP_PORT=25
SMTP_LOGIN=li
SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
SMTP_DOMAIN=mast.iankelling.org
SMTP_DELIVERY_METHOD=smtp
EOF

    for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
      # 1 minute 7 seconds to run this docker command
      # to generate a secret, and it has ^M chars at the end. wtf. really dumb
      printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
    done
    found=false
    while read -r domain _ pass; do
      if [[ $domain == mail.iankelling.org ]]; then
        found=true
        # remove the username part
        pass="${pass#*:}"
        printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
        break
      fi
    done < <(s cat /etc/mailpass)
    if ! $found; then
      echo "$0: error, failed to find mailpass domain for mastadon"
      exit 1
    fi

    # docker compose makes an interface named like br-8f3e208558f2. we need mail to
    # get routed to us.
    if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
      s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
    fi

    docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
    logq docker-compose run --rm web rake db:migrate
    docker-compose run --rm web rails assets:precompile

    # avatar failed to upload, did
    # docker logs mastodon_web_1
    # google lead me to this
    s chown -R 991:991 public/system

    # docker daemon takes care of starting on boot.
    docker-compose up -d

    s a2enmod proxy_wstunnel headers
    web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
   ProxyPreserveHost On
   RequestHeader set X-Forwarded-Proto "https"
   ProxyPass /500.html !
   ProxyPass /oops.png !
   ProxyPass /api/v1/streaming/ ws://localhost:4000/
   ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
   ErrorDocument 500 /500.html
   ErrorDocument 501 /500.html
   ErrorDocument 502 /500.html
   ErrorDocument 503 /500.html
   ErrorDocument 504 /500.html
EOF


    ############### !!!!!!!!!!!!!!!!!
    ############### manual steps:

    # only following a few people atm, so not bothering to figure out backups
    # when mastodon has not documented it at all.
    #
    # fsf@status.fsf.org
    # cwebber@toot.cat
    # dbd@status.fsf.org
    # johns@status.fsf.org

    # sign in page is at https://mast.iankelling.org/auth/sign_in
    # register as iank, then
    # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
    # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank

    ############# end setup mastodon ##############