R5 the server's own settings: instance, rules, announcements, relays, media limits, the staff's log

A singleton ServerSettings (title, descriptions, contact, thumbnail, privacy policy, terms, rules, relays, media
overrides, PublishActivity), cached by InstanceSettings and read by the instance API, NodeInfo, the instance actor, the
web pages and the mailer; its defaults are the old literals, so nothing changes until an administrator edits.
/clientapi/admin/settings (and /thumbnail), /announcements, /relays for administrators; /clientapi/moderator/log, the
staff's log (AdminAction, written by domain blocks, backups, settings and the CLI; no IP, never a root paired with its
personas). The Mastodon API's rules, extended description, privacy policy, terms of service, domain blocks (Published,
Obfuscate), announcements (dismiss, reactions, streaming) and activity (only when published). Reports carry rule ids.
Media overrides clamped to hard caps. Relays named by the settings reconcile next to the configured ones.

Verified: interop.sh instance accounts relay with mastodon, relay, aoderelay and mailpit, 119 passed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Domain/Media/MediaAudit.cs

@@ -9,7 +9,8 @@ namespace PrivaPub.Domain.Media
 {
 	// What the media directory holds against what the database says holds it, and, with fix, the two made to agree:
 	// - a persona's current avatar or header with no row (they had none before) becomes a row of its own;
-	// - media of a deleted post or of a deleted persona go to the trash;
+	// - media of a deleted post or of a deleted persona go to the trash, and a picture of the server's own (ServerUse) that
+	//   its settings no longer name;
 	// - rows whose files are gone go to the trash;
 	// - files nothing holds (deleted posts' media and replaced pictures, from before media were trashed) get a trashed row
 	//   each.
@@ -59,7 +60,11 @@ namespace PrivaPub.Domain.Media
 			var ownerIds = rows.Select(r => r.OwnerAvatarId).Where(id => id != null).Distinct().ToList();
 			var liveOwners = (await DB.Default.Find<Avatar>().Match(a => ownerIds.Contains(a.ID) && !a.DeletionAt.HasValue).Project(a => a.Include(x => x.ID)).ExecuteAsync(token))
 				.Select(a => a.ID).ToHashSet();
-			var ofDeleted = rows.Where(r => (r.PostId != null && !livePosts.Contains(r.PostId)) || (r.OwnerAvatarId != null && !liveOwners.Contains(r.OwnerAvatarId))).ToList();
+			// (the server's own pictures belong to nobody: they are held while the settings name them)
+			var settings = await DB.Default.Find<Models.ServerSettings>().Match(x => x.ID == Models.ServerSettings.Name).ExecuteFirstAsync(token);
+			var serverHeld = new HashSet<string> { settings?.ThumbnailMediaId };
+			var ofDeleted = rows.Where(r => r.ServerUse != null ? !serverHeld.Contains(r.ID)
+				: (r.PostId != null && !livePosts.Contains(r.PostId)) || (r.OwnerAvatarId != null && !liveOwners.Contains(r.OwnerAvatarId))).ToList();
 			var missing = rows.Except(ofDeleted).Where(r => !string.IsNullOrEmpty(r.FilePath) && !files.Contains(r.FilePath)).ToList();
 			if (fix)
 				foreach (var row in ofDeleted.Concat(missing))

PrivaPub/Domain/Media/MediaProxy.cs

@@ -359,7 +359,8 @@ namespace PrivaPub.Domain.Media
 		}
 
 		// one pass:
-		// - uploads never posted for a day (and not waiting for a scheduled post, nor a profile picture) go to the trash;
+		// - uploads never posted for a day (and not waiting for a scheduled post, nor a profile picture, nor the server's own
+		//   picture) go to the trash;
 		// - trashed files still served (a crash between the mark and the move) are moved out;
 		// - trashed files past their grace are deleted, with their rows, unless a backup or a restore is running (one may be
 		//   reading the trash);
@@ -367,8 +368,8 @@ namespace PrivaPub.Domain.Media
 		public async Task Sweep(CancellationToken token)
 		{
 			var cutoff = DateTime.UtcNow - UnattachedLifetime;
-			var unattached = await _media.Trash(m => m.PostId == null && m.ScheduledStatusId == null && m.ProfileOfAvatarId == null && m.CreatedAt < cutoff,
-				"never posted", token);
+			var unattached = await _media.Trash(m => m.PostId == null && m.ScheduledStatusId == null && m.ProfileOfAvatarId == null && m.ServerUse == null
+				&& m.CreatedAt < cutoff, "never posted", token);
 
 			var trashed = await DB.Default.Find<MediaAttachment>().Match(m => m.TrashedAt != null).Limit(2000).ExecuteAsync(token);
 			var purgeBefore = DateTime.UtcNow - TrashGrace;

PrivaPub/Domain/Media/MediaService.cs

@@ -46,6 +46,9 @@ namespace PrivaPub.Domain.Media
 		Task<bool> ProcessPending(MediaAttachment pending, CancellationToken token);
 		/// <summary>A persona's new avatar or header ("avatar" or "header"), cropped to its size, as a row of its own.</summary>
 		Task<MediaOutcome> ProfileImage(string avatarId, string kind, IFormFile file, int width, int height, CancellationToken token);
+		/// <summary>A picture of the server's own (its thumbnail, "thumbnail"), fitted within 1200×630, as a row nobody owns,
+		/// held by its <see cref="MediaAttachment.ServerUse"/>.</summary>
+		Task<MediaOutcome> ServerImage(string use, IFormFile file, CancellationToken token);
 		/// <summary>Trashes the media <paramref name="which"/> matches (and that isn't trashed yet): each row is marked in one
 		/// conditional update, so a row attached meanwhile is left alone, and its files stop being served at once.</summary>
 		Task<long> Trash(System.Linq.Expressions.Expression<Func<MediaAttachment, bool>> which, string reason, CancellationToken token);
@@ -245,6 +248,57 @@ namespace PrivaPub.Domain.Media
 			return new MediaOutcome(attachment);
 		}
 
+		public const int ServerImageWidth = 1200;
+		public const int ServerImageHeight = 630;
+
+		// as safe as a profile picture: checked before it is decoded, decoded by the loaders allowed alone, written without its
+		// metadata; fitted (not cropped) within the size link previews use
+		public async Task<MediaOutcome> ServerImage(string use, IFormFile file, CancellationToken token)
+		{
+			var contentType = file?.ContentType?.Split(';')[0].Trim().ToLowerInvariant();
+			if (file == default || file.Length == 0)
+				return MediaOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: File can't be blank");
+			if (!ImageTypes.Contains(contentType))
+				return MediaOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: File type is not supported");
+			if (file.Length > _options.CurrentValue.MaxImageBytes)
+				return MediaOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: File is too big");
+			var input = await Read(file, token);
+			if (Refusal(input, _options.CurrentValue) is { } refused)
+				return refused;
+			byte[] bytes;
+			int outWidth, outHeight;
+			await _processing.WaitAsync(token);
+			try
+			{
+				using var image = Image.ThumbnailBuffer(input, ServerImageWidth, height: ServerImageHeight, size: Enums.Size.Down);
+				using var flat = Flatten(image);
+				bytes = flat.WriteToBuffer(".jpg[Q=85,keep=none]");
+				(outWidth, outHeight) = (flat.Width, flat.Height);
+			}
+			catch (VipsException ex)
+			{
+				_logger.LogInformation("Refused a server picture: {Error}", ex.Message);
+				return MediaOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: The file is not a readable image");
+			}
+			finally
+			{
+				_processing.Release();
+			}
+			var attachment = new MediaAttachment
+			{
+				Kind = "image",
+				ServerUse = use,
+				ContentType = "image/jpeg",
+				FilePath = await Save(bytes, "jpg", token),
+				Size = bytes.Length,
+				Width = outWidth,
+				Height = outHeight,
+				AttachedAt = DateTime.UtcNow
+			};
+			await DB.Default.SaveAsync(attachment, token);
+			return new MediaOutcome(attachment);
+		}
+
 		// a login over its quota (Media:QuotaBytesPerRoot; none when 0) uploads nothing more
 		async Task<MediaOutcome> OverQuota(string avatarId, long incoming, CancellationToken token)
 		{