refactor: toml config

docs/install-containers.md

@@ -18,10 +18,10 @@ This guide covers deploying Tranquil PDS using containers with podman.
 If you just want to get running quickly:
 
 ```sh
-cp .env.example .env
+cp example.toml config.toml
 ```
 
-Edit `.env` with your values. Generate secrets with `openssl rand -base64 48`.
+Edit `config.toml` with your values. Generate secrets with `openssl rand -base64 48`.
 
 Build and start:
 ```sh
@@ -59,7 +59,7 @@ Run the backend with host networking (so it can access postgres on localhost) an
 ```sh
 podman run -d --name tranquil-pds \
   --network=host \
-  --env-file /etc/tranquil-pds/tranquil-pds.env \
+  -v /etc/tranquil-pds/config.toml:/etc/tranquil-pds/config.toml:ro,Z \
   -v /var/lib/tranquil:/var/lib/tranquil:Z \
   tranquil-pds:latest
 ```
@@ -113,18 +113,22 @@ mkdir -p /etc/containers/systemd
 mkdir -p /srv/tranquil-pds/{postgres,blobs,backups,certs,acme,config}
 ```
 
-## Create an environment file
+## Create a configuration file
 
 ```bash
-cp /opt/tranquil-pds/.env.example /srv/tranquil-pds/config/tranquil-pds.env
-chmod 600 /srv/tranquil-pds/config/tranquil-pds.env
+cp /opt/tranquil-pds/example.toml /srv/tranquil-pds/config/config.toml
+chmod 600 /srv/tranquil-pds/config/config.toml
 ```
 
-Edit `/srv/tranquil-pds/config/tranquil-pds.env` and fill in your values. Generate secrets with:
+Edit `/srv/tranquil-pds/config/config.toml` and fill in your values. Generate secrets with:
 ```bash
 openssl rand -base64 48
 ```
 
+> **Note:** Every config option can also be set via environment variables
+> (see comments in `example.toml`). Environment variables always take
+> precedence over the config file.
+
 ## Install quadlet definitions
 
 Copy the quadlet files from the repository:
@@ -157,7 +161,6 @@ podman build -t tranquil-pds-frontend:latest ./frontend
 ## Create podman secrets
 
 ```bash
-source /srv/tranquil-pds/config/tranquil-pds.env
 echo "$DB_PASSWORD" | podman secret create tranquil-pds-db-password -
 ```
 
@@ -264,18 +267,22 @@ podman build -t tranquil-pds:latest .
 podman build -t tranquil-pds-frontend:latest ./frontend
 ```
 
-## Create an environment file
+## Create a configuration file
 
 ```sh
-cp /opt/tranquil-pds/.env.example /srv/tranquil-pds/config/tranquil-pds.env
-chmod 600 /srv/tranquil-pds/config/tranquil-pds.env
+cp /opt/tranquil-pds/example.toml /srv/tranquil-pds/config/config.toml
+chmod 600 /srv/tranquil-pds/config/config.toml
 ```
 
-Edit `/srv/tranquil-pds/config/tranquil-pds.env` and fill in your values. Generate secrets with:
+Edit `/srv/tranquil-pds/config/config.toml` and fill in your values. Generate secrets with:
 ```sh
 openssl rand -base64 48
 ```
 
+> **Note:** Every config option can also be set via environment variables
+> (see comments in `example.toml`). Environment variables always take
+> precedence over the config file.
+
 ## Set up compose and nginx
 
 Copy the production compose and nginx configs:
@@ -308,16 +315,11 @@ depend() {
     after firewall
 }
 start_pre() {
-    set -a
-    . /srv/tranquil-pds/config/tranquil-pds.env
-    set +a
+    checkpath -d /srv/tranquil-pds
 }
 stop() {
     ebegin "Stopping ${name}"
     cd /srv/tranquil-pds
-    set -a
-    . /srv/tranquil-pds/config/tranquil-pds.env
-    set +a
     podman-compose -f /srv/tranquil-pds/docker-compose.yml down
     eend $?
 }

docs/install-debian.md

@@ -73,15 +73,25 @@ cargo build --release
 
 ```bash
 mkdir -p /etc/tranquil-pds
-cp /opt/tranquil-pds/.env.example /etc/tranquil-pds/tranquil-pds.env
-chmod 600 /etc/tranquil-pds/tranquil-pds.env
+cp /opt/tranquil-pds/example.toml /etc/tranquil-pds/config.toml
+chmod 600 /etc/tranquil-pds/config.toml
 ```
 
-Edit `/etc/tranquil-pds/tranquil-pds.env` and fill in your values. Generate secrets with:
+Edit `/etc/tranquil-pds/config.toml` and fill in your values. Generate secrets with:
 ```bash
 openssl rand -base64 48
 ```
 
+> **Note:** Every config option can also be set via environment variables
+> (see comments in `example.toml`). Environment variables always take
+> precedence over the config file. You can also pass the config file path
+> via the `TRANQUIL_PDS_CONFIG` env var instead of `--config`.
+
+You can validate your configuration before starting the service:
+```bash
+/usr/local/bin/tranquil-pds --config /etc/tranquil-pds/config.toml validate
+```
+
 ## Install frontend files
 
 ```bash
@@ -105,8 +115,7 @@ After=network.target postgresql.service
 Type=simple
 User=tranquil-pds
 Group=tranquil-pds
-EnvironmentFile=/etc/tranquil-pds/tranquil-pds.env
-ExecStart=/usr/local/bin/tranquil-pds
+ExecStart=/usr/local/bin/tranquil-pds --config /etc/tranquil-pds/config.toml
 Restart=always
 RestartSec=5
 ProtectSystem=strict

docs/install-kubernetes.md

@@ -9,13 +9,16 @@ If you're reaching for kubernetes for this app, you're experienced enough to kno
 You'll need a wildcard TLS certificate for `*.your-pds-hostname.example.com`. User handles are served as subdomains.
 
 The container image expects:
+- A TOML config file mounted at `/etc/tranquil-pds/config.toml` (or passed via `--config`)
 - `DATABASE_URL` - postgres connection string
 - `BLOB_STORAGE_PATH` - path to blob storage (mount a PV here)
 - `BACKUP_STORAGE_PATH` - path for repo backups (optional but recommended)
 - `PDS_HOSTNAME` - your PDS hostname (without protocol)
 - `JWT_SECRET`, `DPOP_SECRET`, `MASTER_KEY` - generate with `openssl rand -base64 48`
 - `CRAWLERS` - typically `https://bsky.network`
-and more, check the .env.example.
+
+and more, check the example.toml for all options. Environment variables can override any TOML value.
+You can also point to a config file via the `TRANQUIL_PDS_CONFIG` env var.
 
 Health check: `GET /xrpc/_health`