neiam /oh-my-ex-oh-ircd

[Unit]
Description=oh_my_ex_oh_ircd (standalone, ACME in-process)
Requires=ircd-network.service ircd-postgres.service ircd-site-encrypt-volume.service
After=ircd-network.service ircd-postgres.service ircd-site-encrypt-volume.service

[Container]
Image=registry.example.com/oh_my_ex_oh_ircd:standalone-master
ContainerName=ircd
Network=ircd.network
# `:Z` relabels the volume for SELinux on Fedora/RHEL hosts; harmless elsewhere.
Volume=ircd-site-encrypt.volume:/var/lib/oh_my_ex_oh_ircd/site_encrypt:Z

# Port 80 is required for the ACME HTTP-01 challenge; 6667 is plain IRC,
# 6697 is IRC-over-TLS. Quadlet's PublishPort uses the same syntax as
# `podman run -p`.
PublishPort=80:4000
PublishPort=6667:6667
PublishPort=6697:6697

# Pull secrets from ~/ircd/ircd.env (chmod 600 + owned by the unit's user).
EnvironmentFile=%h/ircd/ircd.env

Environment=PHX_SERVER=true
Environment=PORT=4000
Environment=IRC_PORT=6667
Environment=IRC_ALLOW_ANONYMOUS=false
Environment=IRC_TLS_ENABLED=true
Environment=IRC_TLS_PORT=6697
Environment=WEBIRC_ENABLED=false
Environment=ACME_DIRECTORY_URL=https://acme-v02.api.letsencrypt.org/directory
Environment=ACME_DB_FOLDER=/var/lib/oh_my_ex_oh_ircd/site_encrypt

# DATABASE_URL is computed from the secret password but the rest of the
# DSN is fixed; assemble it inline so the env file stays minimal.
Environment=DATABASE_URL=ecto://ircd:${POSTGRES_PASSWORD}@ircd-postgres:5432/ircd

[Service]
Restart=on-failure
RestartSec=10
# Wait for postgres' healthcheck to pass before starting the BEAM.
ExecStartPre=/usr/bin/podman wait --condition healthy ircd-postgres

[Install]
WantedBy=multi-user.target default.target