diff --git a/fogcutter/docker/.gitignore b/fogcutter/docker/.gitignore
index 7becd36..e4d588e 100644
--- a/fogcutter/docker/.gitignore
+++ b/fogcutter/docker/.gitignore
@@ -1 +1,2 @@
 firefly.env
+mastodon.env
diff --git a/fogcutter/docker/caddy.sh b/fogcutter/docker/caddy.sh
index e1870a2..c4aa404 100755
--- a/fogcutter/docker/caddy.sh
+++ b/fogcutter/docker/caddy.sh
@@ -19,7 +19,7 @@ up () {
     --publish 443:443 \
     --publish 443:443/udp \
     --network pew-net \
-    docker.io/caddy:2.6.1
+    docker.io/caddy:2.6.2
 }
 
 down () {
diff --git a/fogcutter/docker/mastodon.sh b/fogcutter/docker/mastodon.sh
new file mode 100755
index 0000000..db4daa7
--- /dev/null
+++ b/fogcutter/docker/mastodon.sh
@@ -0,0 +1,106 @@
+#!/bin/bash
+
+set -e
+
+LOCAL_DOMAIN=social.bigcavemaps.com
+REDIS_HOST=mastodon-redis
+REDIS_PORT=6379
+DB_HOST=mastodon-pg
+DB_USER=mastodon
+DB_NAME=mastodon_production
+DB_PASS=mastodon
+DB_PORT=5432
+
+up () {
+  docker network create pew-net || true
+
+  docker run \
+    --detach \
+    --name mastodon-web \
+    --restart unless-stopped \
+    --env-file mastodon.env \
+    --env LOCAL_DOMAIN=$LOCAL_DOMAIN \
+    --env REDIS_HOST=$REDIS_HOST \
+    --env REDIS_PORT=$PORT \
+    --env DB_HOST=$DB_HOST \
+    --env DB_USER=$DB_USER \
+    --env DB_NAME=$DB_NAME \
+    --env DB_PASS=$DB_PASS \
+    --env DB_PORT=$DB_PORT \
+    --volume /bigdata/k8s-config/mastodon/public/system:/mastodon/public/system:rw \
+    --network pew-net \
+    docker.io/tootsuite/mastodon:v4.0.2 bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"
+
+  docker run \
+    --detach \
+    --name mastodon-streaming \
+    --restart unless-stopped \
+    --env-file mastodon.env \
+    --env LOCAL_DOMAIN=$LOCAL_DOMAIN \
+    --env REDIS_HOST=$REDIS_HOST \
+    --env REDIS_PORT=$PORT \
+    --env DB_HOST=$DB_HOST \
+    --env DB_USER=$DB_USER \
+    --env DB_NAME=$DB_NAME \
+    --env DB_PASS=$DB_PASS \
+    --env DB_PORT=$DB_PORT \
+    --network pew-net \
+    docker.io/tootsuite/mastodon:v4.0.2 node ./streaming
+
+  docker run \
+    --detach \
+    --name mastodon-sidekiq \
+    --restart unless-stopped \
+    --env-file mastodon.env \
+    --env LOCAL_DOMAIN=$LOCAL_DOMAIN \
+    --env REDIS_HOST=$REDIS_HOST \
+    --env REDIS_PORT=$PORT \
+    --env DB_HOST=$DB_HOST \
+    --env DB_USER=$DB_USER \
+    --env DB_NAME=$DB_NAME \
+    --env DB_PASS=$DB_PASS \
+    --env DB_PORT=$DB_PORT \
+    --volume /bigdata/k8s-config/mastodon/public/system:/mastodon/public/system:rw \
+    --network pew-net \
+    docker.io/tootsuite/mastodon:v4.0.2 bundle exec sidekiq
+
+  # may have to run db:migrate if things don't work right away
+  docker run \
+    --detach \
+    --name mastodon-pg \
+    --restart unless-stopped \
+    --env POSTGRES_HOST_AUTH_METHOD=trust \
+    --env POSTGRES_USER=$DB_USER \
+    --env POSTGRES_DB=$DB_NAME \
+    --env POSTGRES_PASSWORD=$DB_PASS \
+    --volume /bigdata/k8s-config/mastodon/postgres/data:/var/lib/postgresql/data:rw \
+    --network pew-net \
+    docker.io/postgres:14-alpine
+
+  docker run \
+    --detach \
+    --name mastodon-redis \
+    --restart unless-stopped \
+    --volume /bigdata/k8s-config/mastodon/redis/data:/data:rw \
+    --network pew-net \
+    docker.io/redis:7-alpine
+}
+
+down () {
+  docker stop mastodon-web || true
+  docker rm mastodon-web || true
+  docker stop mastodon-streaming || true
+  docker rm mastodon-streaming || true
+  docker stop mastodon-sidekiq || true
+  docker rm mastodon-sidekiq || true
+  docker stop mastodon-pg || true
+  docker rm mastodon-pg || true
+  docker stop mastodon-redis || true
+  docker rm mastodon-redis || true
+}
+
+logs () {
+  docker logs --follow mastodon
+}
+
+$@