job "continuwuity" {
  region      = "global"
  datacenters = ["dc1"]
  type        = "service"
  node_pool   = "default"

  group "continuwuity" {
    count = 1

    network {
      port "http" {
        static = 6167
      }
    }

    service {
      name = "continuwuity"
      port = "http"
      tags = [
        "traefik.enable=true",

        # Homeserver (client + federation API) on cn.i80.dk.
        # server_name = cn.i80.dk, so continuwuity serves its own /.well-known/matrix/* here —
        # no apex delegation needed, nothing to change in trinity/nginx.
        # NOTE: routing is actually done by trinity's nginx zone-generator (cn.i80.dk.conf),
        # not Traefik; these tags are kept for documentation/compatibility.
        "traefik.http.routers.continuwuity.rule=Host(`cn.i80.dk`)",
        "traefik.http.routers.continuwuity.entrypoints=https",
        "traefik.http.routers.continuwuity.tls=true",

        # http -> https redirect for cn.i80.dk
        "traefik.http.routers.continuwuity-http.rule=Host(`cn.i80.dk`)",
        "traefik.http.routers.continuwuity-http.entrypoints=http",
        "traefik.http.routers.continuwuity-http.middlewares=continuwuity-redirect",
        "traefik.http.middlewares.continuwuity-redirect.redirectscheme.scheme=https",
        "traefik.http.middlewares.continuwuity-redirect.redirectscheme.permanent=true",
      ]

      check {
        name     = "continuwuity-http"
        type     = "http"
        port     = "http"
        path     = "/_matrix/client/versions"
        interval = "30s"
        timeout  = "5s"

        check_restart {
          limit = 3
          grace = "60s"
        }
      }
    }

    volume "continuwuity-volume" {
      type            = "csi"
      read_only       = false
      source          = "continuwuity-volume"
      attachment_mode = "file-system"
      access_mode     = "single-node-writer"
      per_alloc       = false
    }

    volume "continuwuity-media-volume" {
      type            = "csi"
      read_only       = false
      source          = "continuwuity-media-volume"
      attachment_mode = "file-system"
      access_mode     = "single-node-writer"
      per_alloc       = false

      mount_options {
        mount_flags = []
      }
    }

    restart {
      attempts = 3
      interval = "10m"
      delay    = "30s"
      mode     = "delay"
    }

    update {
      max_parallel     = 1
      health_check     = "checks"
      min_healthy_time = "30s"
      healthy_deadline = "5m"
      auto_revert      = true
    }

    task "continuwuity" {
      driver = "docker"

      env {
        # server_name is PERMANENT — it is the suffix of every user/room ID (@henrik:cn.i80.dk).
        # Self-contained on cn.i80.dk: continuwuity serves its own well-known, no apex delegation.
        CONTINUWUITY_SERVER_NAME        = "cn.i80.dk"
        CONTINUWUITY_TRUSTED_SERVERS    = "[\"matrix.org\"]"
        CONTINUWUITY_ALLOW_REGISTRATION = false
        CONTINUWUITY_ADDRESS            = "0.0.0.0"
        CONTINUWUITY_PORT               = 6167
        CONTINUWUITY_DATABASE_PATH      = "/var/lib/continuwuity"

        # well-known served by continuwuity itself on cn.i80.dk (proxied through trinity's nginx).
        # client = base URL (no port); server = host:port for federation.
        CONTINUWUITY_WELL_KNOWN = <<EOF
{
client=https://cn.i80.dk,
server=cn.i80.dk:443
}
EOF

        # --- First-user bootstrap (see notes) ---
        # To create your account once, temporarily set:
        #   CONTINUWUITY_ALLOW_REGISTRATION = true
        #   CONTINUWUITY_REGISTRATION_TOKEN = "<long-random-secret>"
        # register @henrik:cn.i80.dk with that token, then revert to allow_registration=false and redeploy.
      }

      config {
        # Upstream image. TODO: mirror into registry.i80.dk once the namespace + push creds
        # are sorted (the deploy workflow's mirror step needs REGISTRY_USER/PASSWORD and a valid
        # path, e.g. registry.i80.dk/gitea/continuwuity — bare registry.i80.dk/continuwuity returns 400).
        image      = "forgejo.ellis.link/continuwuation/continuwuity:latest"
        ports      = ["http"]
        force_pull = true # :latest — re-pull on redeploy
      }

      resources {
        cpu    = 500
        memory = 1024
      }

      volume_mount {
        volume      = "continuwuity-volume"
        destination = "/var/lib/continuwuity"
      }

      volume_mount {
        volume      = "continuwuity-media-volume"
        destination = "/var/lib/continuwuity/media"
      }
    }
  }
}