Initial commit: EifelDC - Discord-like Matrix chat platform

Includes server (Rust/Axum API proxy with voice management), Tauri desktop client with Svelte UI, bot-sdk, Docker infra (Synapse, PostgreSQL, Coturn, Nginx), and CI/CD pipeline.
2026-04-28 08:23:23 +02:00
commit 0978d0c2e9
82 changed files with 12417 additions and 0 deletions
--- a/infra/.env.example
+++ b/infra/.env.example
@@ -0,0 +1,5 @@
+DOMAIN=eifeldc.local
+POSTGRES_PASSWORD=changeme_postgres_password
+TURN_SECRET=changeme_turn_secret
+MACAROON_SECRET=changeme_macaroon_secret
+FORM_SECRET=changeme_form_secret
--- a/infra/coturn/turnserver.conf
+++ b/infra/coturn/turnserver.conf
@@ -0,0 +1,17 @@
+listening-port=3478
+tls-listening-port=5349
+realm=eifeldc.local
+server-name=eifeldc.local
+fingerprint
+lt-cred-mech
+use-auth-secret
+static-auth-secret=CHANGE_ME_GENERATE_A_SECRET
+total-quota=100
+bps-capacity=0
+stale-nonce=600
+cert=/etc/letsencrypt/live/eifeldc.local/cert.pem
+pkey=/etc/letsencrypt/live/eifeldc.local/privkey.pem
+no-multicast-peers
+no-cli
+log-file=/var/log/turnserver/turnserver.log
+simple-log
--- a/infra/docker-compose.yml
+++ b/infra/docker-compose.yml
@@ -0,0 +1,134 @@
+version: "3.8"
+
+services:
+  eifeldc:
+    build:
+      context: ..
+      dockerfile: Dockerfile
+    container_name: eifeldc-server
+    restart: unless-stopped
+    ports:
+      - "3000:3000"
+    environment:
+      - EIFELDC_STATIC_DIR=/usr/share/eifeldc/client
+      - RUST_LOG=eifeldc_server=info,tower_http=info
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3000/api/current-user"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    networks:
+      - eifeldc
+
+  synapse:
+    image: matrixdotorg/synapse:latest
+    container_name: eifeldc-synapse
+    restart: unless-stopped
+    volumes:
+      - synapse-data:/data
+      - ./synapse/log.config:/data/log.config:ro
+    environment:
+      - SYNAPSE_SERVER_NAME=${DOMAIN:-eifeldc.local}
+      - SYNAPSE_REPORT_STATS=no
+    ports:
+      - "8008:8008"
+      - "8448:8448"
+    depends_on:
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8008/_matrix/client/versions"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    networks:
+      - eifeldc
+
+  postgres:
+    image: postgres:16-alpine
+    container_name: eifeldc-postgres
+    restart: unless-stopped
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    environment:
+      POSTGRES_USER: synapse
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme_postgres_password}
+      POSTGRES_DB: synapse
+      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --lc-collate=C --lc-ctype=C"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U synapse"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    networks:
+      - eifeldc
+
+  coturn:
+    image: coturn/coturn:latest
+    container_name: eifeldc-coturn
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - ./coturn/turnserver.conf:/etc/turnserver.conf:ro
+      - turn-certs:/etc/letsencrypt
+    command: ["-c", "/etc/turnserver.conf"]
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  nginx:
+    image: nginx:alpine
+    container_name: eifeldc-nginx
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./nginx/eifeldc.conf:/etc/nginx/conf.d/eifeldc.conf:ro
+      - nginx-certs:/etc/letsencrypt:ro
+    depends_on:
+      eifeldc:
+        condition: service_healthy
+      synapse:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:80/"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    networks:
+      - eifeldc
+
+volumes:
+  postgres-data:
+  turn-certs:
+  nginx-certs:
+  synapse-data:
+
+networks:
+  eifeldc:
+    driver: bridge
--- a/infra/nginx/eifeldc.conf
+++ b/infra/nginx/eifeldc.conf
@@ -0,0 +1,79 @@
+upstream eifeldc_server {
+    server eifeldc:3000;
+}
+
+upstream synapse_server {
+    server synapse:8008;
+}
+
+server {
+    listen 80;
+    server_name eifeldc.local;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name eifeldc.local;
+
+    ssl_certificate /etc/letsencrypt/live/eifeldc.local/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/eifeldc.local/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    client_max_body_size 50M;
+
+    add_header X-Frame-Options SAMEORIGIN;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+    add_header Referrer-Policy strict-origin-when-cross-origin;
+
+    location /.well-known/matrix/server {
+        default_type application/json;
+        return 200 '{"m.server": "eifeldc.local:443"}';
+    }
+
+    location /.well-known/matrix/client {
+        default_type application/json;
+        return 200 '{"m.homeserver": {"base_url": "https://eifeldc.local"}}';
+    }
+
+    location ~ ^/_matrix/(client|media|federation|key|v2) {
+        proxy_pass http://synapse_server;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 600s;
+        proxy_send_timeout 600s;
+    }
+
+    location /_synapse {
+        proxy_pass http://synapse_server;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /api/ {
+        proxy_pass http://eifeldc_server;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    location / {
+        proxy_pass http://eifeldc_server;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
--- a/infra/scripts/backup.sh
+++ b/infra/scripts/backup.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(dirname "$SCRIPT_DIR")"
+BACKUP_DIR="${INFRA_DIR}/backups"
+TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+BACKUP_PATH="${BACKUP_DIR}/${TIMESTAMP}"
+
+mkdir -p "${BACKUP_PATH}"
+
+echo "=== EifelDC Backup ==="
+echo "Backup directory: ${BACKUP_PATH}"
+echo ""
+
+if command -v docker &>/dev/null && docker compose -f "${INFRA_DIR}/docker-compose.yml" ps &>/dev/null 2>&1; then
+    echo "[Docker Mode]"
+
+    echo "[1/4] Backing up PostgreSQL..."
+    docker compose -f "${INFRA_DIR}/docker-compose.yml" exec -T postgres \
+        pg_dump -U synapse synapse > "${BACKUP_PATH}/synapse_db.sql"
+
+    echo "[2/4] Backing up Synapse media..."
+    docker cp eifeldc-synapse:/data/media_store "${BACKUP_PATH}/media_store" 2>/dev/null || true
+
+    echo "[3/4] Backing up Synapse config..."
+    docker cp eifeldc-synapse:/data/homeserver.yaml "${BACKUP_PATH}/homeserver.yaml" 2>/dev/null || true
+    docker cp eifeldc-synapse:/data/signing.key "${BACKUP_PATH}/signing.key" 2>/dev/null || true
+
+    echo "[4/4] Backing up environment config..."
+    cp "${INFRA_DIR}/.env" "${BACKUP_PATH}/.env" 2>/dev/null || true
+else
+    echo "[Native Mode]"
+
+    echo "[1/3] Backing up PostgreSQL..."
+    sudo -u postgres pg_dump synapse > "${BACKUP_PATH}/synapse_db.sql" 2>/dev/null || echo "Warning: Could not dump database"
+
+    echo "[2/3] Backing up Synapse data..."
+    SYNAPSE_DIR="${SYNAPSE_DIR:-/opt/eifeldc/synapse-data}"
+    cp -r "${SYNAPSE_DIR}/homeserver.yaml" "${BACKUP_PATH}/" 2>/dev/null || true
+    cp -r "${SYNAPSE_DIR}/signing.key" "${BACKUP_PATH}/" 2>/dev/null || true
+    cp -r "${SYNAPSE_DIR}/media_store" "${BACKUP_PATH}/" 2>/dev/null || true
+
+    echo "[3/3] Backing up environment config..."
+    cp "${INFRA_DIR}/.env" "${BACKUP_PATH}/.env" 2>/dev/null || true
+fi
+
+COMPRESSED="${BACKUP_DIR}/eifeldc_backup_${TIMESTAMP}.tar.gz"
+tar -czf "${COMPRESSED}" -C "${BACKUP_DIR}" "${TIMESTAMP}"
+rm -rf "${BACKUP_PATH}"
+
+echo ""
+echo "Backup saved: ${COMPRESSED}"
+echo ""
+
+KEEP_COUNT=7
+ls -t "${BACKUP_DIR}"/eifeldc_backup_*.tar.gz 2>/dev/null | tail -n +$((KEEP_COUNT + 1)) | xargs -r rm --
+echo "Old backups cleaned (keeping latest ${KEEP_COUNT})"
+echo "Done!"
--- a/infra/scripts/generate-certs.sh
+++ b/infra/scripts/generate-certs.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(dirname "$SCRIPT_DIR")"
+CERT_DIR="${INFRA_DIR}/certs"
+DOMAIN="${1:-eifeldc.local}"
+
+echo "=== Generating self-signed SSL certificate for ${DOMAIN} ==="
+
+rm -rf "${CERT_DIR}"
+mkdir -p "${CERT_DIR}/live/${DOMAIN}"
+mkdir -p "${CERT_DIR}/archive"
+
+openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+    -keyout "${CERT_DIR}/live/${DOMAIN}/privkey.pem" \
+    -out "${CERT_DIR}/live/${DOMAIN}/fullchain.pem" \
+    -subj "/CN=${DOMAIN}" \
+    -addext "subjectAltName=DNS:${DOMAIN},DNS:localhost,IP:127.0.0.1"
+
+cp "${CERT_DIR}/live/${DOMAIN}/fullchain.pem" "${CERT_DIR}/live/${DOMAIN}/cert.pem"
+
+cp "${CERT_DIR}/live/${DOMAIN}/fullchain.pem" "${CERT_DIR}/archive/${DOMAIN}-fullchain.pem"
+cp "${CERT_DIR}/live/${DOMAIN}/privkey.pem" "${CERT_DIR}/archive/${DOMAIN}-privkey.pem"
+
+echo ""
+echo "Certificates generated:"
+echo "  Cert: ${CERT_DIR}/live/${DOMAIN}/fullchain.pem"
+echo "  Key:  ${CERT_DIR}/live/${DOMAIN}/privkey.pem"
+echo ""
+echo "For Docker deployment, copy certs to the nginx-certs volume:"
+echo "  docker volume inspect infra_nginx-certs"
+echo "  sudo cp -r ${CERT_DIR}/live/${DOMAIN}/* <volume_mountpoint>/live/${DOMAIN}/"
+echo ""
+echo "Or for local dev, update nginx config to point to ${CERT_DIR}/live/${DOMAIN}/"
--- a/infra/scripts/healthcheck.sh
+++ b/infra/scripts/healthcheck.sh
@@ -0,0 +1,76 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(dirname "$SCRIPT_DIR")"
+
+echo "=== EifelDC Health Check ==="
+echo ""
+
+OK=true
+
+check_service() {
+    local name=$1
+    local url=$2
+    local expected_status=${3:-200}
+
+    if curl -sf -o /dev/null -w "%{http_code}" "${url}" 2>/dev/null | grep -q "${expected_status}"; then
+        echo "  [OK] ${name}"
+    else
+        echo "  [FAIL] ${name} - ${url}"
+        OK=false
+    fi
+}
+
+if command -v docker &>/dev/null && [ -f "${INFRA_DIR}/docker-compose.yml" ]; then
+    echo "[Docker Mode]"
+    echo ""
+
+    echo "Container Status:"
+    cd "${INFRA_DIR}"
+    docker compose ps
+    echo ""
+
+    echo "Service Health:"
+    check_service "EifelDC Server" "http://localhost:3000/api/current-user" "401"
+    check_service "Synapse" "http://localhost:8008/_matrix/client/versions"
+    check_service "PostgreSQL" "localhost:5432"
+
+    echo ""
+    echo "Container Logs (last 5 lines):"
+    for svc in eifeldc synapse postgres nginx; do
+        if docker compose ps --services --filter "status=running" | grep -q "${svc}"; then
+            echo "--- ${svc} ---"
+            docker compose logs --tail=5 "${svc}" 2>/dev/null || true
+        fi
+    done
+else
+    echo "[Native Mode]"
+    echo ""
+
+    echo "Service Health:"
+    check_service "EifelDC Server" "http://localhost:3000/api/current-user" "401"
+    check_service "Synapse" "http://localhost:8008/_matrix/client/versions"
+    check_service "Nginx" "http://localhost:80/"
+
+    echo ""
+    echo "Systemd Status:"
+    for svc in eifeldc-synapse eifeldc-server coturn nginx; do
+        status=$(systemctl is-active "${svc}" 2>/dev/null || echo "unknown")
+        if [ "$status" = "active" ]; then
+            echo "  [OK] ${svc}: ${status}"
+        else
+            echo "  [FAIL] ${svc}: ${status}"
+            OK=false
+        fi
+    done
+fi
+
+echo ""
+if [ "$OK" = true ]; then
+    echo "=== All services healthy! ==="
+    exit 0
+else
+    echo "=== Some services are not healthy! ==="
+    exit 1
+fi
--- a/infra/scripts/setup.sh
+++ b/infra/scripts/setup.sh
@@ -0,0 +1,281 @@
+#!/bin/bash
+set -euo pipefail
+
+DOMAIN="${1:-eifeldc.local}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(dirname "$SCRIPT_DIR")"
+
+echo "=== EifelDC Infrastructure Setup ==="
+echo "Domain: ${DOMAIN}"
+echo ""
+
+read -p "Use Docker? (y/N): " USE_DOCKER
+if [[ "${USE_DOCKER,,}" == "y" ]]; then
+    echo ""
+    echo "[Docker Mode]"
+
+    echo "[1/5] Generating secrets..."
+    TURN_SECRET=$(openssl rand -hex 16)
+    MACAROON_SECRET=$(openssl rand -hex 32)
+    FORM_SECRET=$(openssl rand -hex 32)
+    POSTGRES_PASSWORD=$(openssl rand -hex 16)
+
+    echo "[2/5] Writing .env file..."
+    cat > "${INFRA_DIR}/.env" <<EOF
+DOMAIN=${DOMAIN}
+POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+TURN_SECRET=${TURN_SECRET}
+MACAROON_SECRET=${MACAROON_SECRET}
+FORM_SECRET=${FORM_SECRET}
+EOF
+
+    echo "[3/5] Generating Synapse config..."
+    if [ ! -d "${INFRA_DIR}/synapse-data" ]; then
+        mkdir -p "${INFRA_DIR}/synapse-data"
+        docker run -it --rm \
+            -v "$(pwd)/synapse-data:/data" \
+            -e SYNAPSE_SERVER_NAME="${DOMAIN}" \
+            -e SYNAPSE_REPORT_STATS=no \
+            matrixdotorg/synapse:latest generate
+    fi
+
+    echo "[4/5] Patching Synapse config with secrets..."
+    if [ -f "${INFRA_DIR}/synapse-data/homeserver.yaml" ]; then
+        sed -i "s/synapse_password/${POSTGRES_PASSWORD}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+        sed -i "s/CHANGE_ME_GENERATE_A_RANDOM_STRING/${MACAROON_SECRET}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+        sed -i "s/CHANGE_ME_GENERATE_ANOTHER_RANDOM_STRING/${FORM_SECRET}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+        sed -i "s/CHANGE_ME_MATCH_COTURN_SECRET/${TURN_SECRET}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+        sed -i "s/eifeldc.local/${DOMAIN}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+    fi
+
+    sed -i "s/CHANGE_ME_GENERATE_A_SECRET/${TURN_SECRET}/g" "${INFRA_DIR}/coturn/turnserver.conf" 2>/dev/null || true
+    sed -i "s/eifeldc.local/${DOMAIN}/g" "${INFRA_DIR}/coturn/turnserver.conf" 2>/dev/null || true
+    sed -i "s/eifeldc.local/${DOMAIN}/g" "${INFRA_DIR}/nginx/eifeldc.conf" 2>/dev/null || true
+
+    echo "[5/5] Generating self-signed certs and starting containers..."
+    "${SCRIPT_DIR}/generate-certs.sh" "${DOMAIN}"
+    cd "${INFRA_DIR}"
+    docker compose up -d
+
+    echo ""
+    echo "Waiting for Synapse..."
+    for i in $(seq 1 30); do
+        if curl -sf "http://localhost:8008/_matrix/client/versions" > /dev/null 2>&1; then
+            echo "Synapse is ready!"
+            break
+        fi
+        sleep 2
+    done
+
+    echo ""
+    echo "=== Docker Setup Complete! ==="
+else
+    echo ""
+    echo "[Native Mode]"
+    SYNAPSE_DIR="/opt/eifeldc/synapse-data"
+    NGINX_CONF="/etc/nginx/sites-available/eifeldc"
+    COTURN_CONF="/etc/turnserver.conf"
+
+    echo "[1/6] Generating secrets..."
+    TURN_SECRET=$(openssl rand -hex 16)
+    MACAROON_SECRET=$(openssl rand -hex 32)
+    FORM_SECRET=$(openssl rand -hex 32)
+    POSTGRES_PASSWORD=$(openssl rand -hex 16)
+
+    echo "[2/6] Writing .env file..."
+    cat > "${INFRA_DIR}/.env" <<EOF
+DOMAIN=${DOMAIN}
+POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+TURN_SECRET=${TURN_SECRET}
+MACAROON_SECRET=${MACAROON_SECRET}
+FORM_SECRET=${FORM_SECRET}
+EOF
+
+    echo "[3/6] Installing system dependencies..."
+    sudo apt-get update
+    sudo apt-get install -y \
+        python3-pip python3-venv nginx coturn certbot \
+        libffi-dev libssl-dev libjpeg-dev libxml2-dev libxslt1-dev \
+        postgresql postgresql-contrib curl
+
+    echo "[4/6] Setting up PostgreSQL..."
+    sudo -u postgres psql -c "CREATE USER synapse WITH PASSWORD '${POSTGRES_PASSWORD}';" 2>/dev/null || true
+    sudo -u postgres psql -c "CREATE DATABASE synapse ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' TEMPLATE template0 OWNER synapse;" 2>/dev/null || true
+    sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE synapse TO synapse;" 2>/dev/null || true
+
+    echo "[5/6] Installing and configuring Synapse..."
+    mkdir -p "${SYNAPSE_DIR}"
+    if [ ! -d "${SYNAPSE_DIR}/venv" ]; then
+        python3 -m venv "${SYNAPSE_DIR}/venv"
+        "${SYNAPSE_DIR}/venv/bin/pip" install --upgrade pip
+        "${SYNAPSE_DIR}/venv/bin/pip" install matrix-synapse
+    fi
+
+    if [ ! -f "${SYNAPSE_DIR}/homeserver.yaml" ]; then
+        "${SYNAPSE_DIR}/venv/bin/python" -m synapse.app.homeserver \
+            --server-name "${DOMAIN}" \
+            --config-path "${SYNAPSE_DIR}/homeserver.yaml" \
+            --generate-config \
+            --report-stats=no
+    fi
+
+    sed -i "s/synapse_password/${POSTGRES_PASSWORD}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
+    sed -i "s/CHANGE_ME_GENERATE_A_RANDOM_STRING/${MACAROON_SECRET}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
+    sed -i "s/CHANGE_ME_GENERATE_ANOTHER_RANDOM_STRING/${FORM_SECRET}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
+    sed -i "s/CHANGE_ME_MATCH_COTURN_SECRET/${TURN_SECRET}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
+
+    echo "[6/6] Configuring services..."
+
+    sudo tee "${COTURN_CONF}" > /dev/null <<EOF
+listening-port=3478
+tls-listening-port=5349
+realm=${DOMAIN}
+server-name=${DOMAIN}
+fingerprint
+lt-cred-mech
+use-auth-secret
+static-auth-secret=${TURN_SECRET}
+total-quota=100
+stale-nonce=600
+cert=/etc/letsencrypt/live/${DOMAIN}/cert.pem
+pkey=/etc/letsencrypt/live/${DOMAIN}/privkey.pem
+no-multicast-peers
+no-cli
+log-file=/var/log/turnserver/turnserver.log
+simple-log
+EOF
+
+    sudo sed -i 's/#TURNSERVER_ENABLED=1/TURNSERVER_ENABLED=1/' /etc/default/coturn 2>/dev/null || true
+
+    sudo tee "${NGINX_CONF}" > /dev/null <<'NGINXEOF'
+server {
+    listen 80;
+    server_name DOMAIN_PLACEHOLDER;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name DOMAIN_PLACEHOLDER;
+
+    ssl_certificate /etc/letsencrypt/live/DOMAIN_PLACEHOLDER/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/DOMAIN_PLACEHOLDER/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    client_max_body_size 50M;
+
+    add_header X-Frame-Options SAMEORIGIN;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    location /.well-known/matrix/server {
+        default_type application/json;
+        return 200 '{"m.server": "DOMAIN_PLACEHOLDER:443"}';
+    }
+
+    location /.well-known/matrix/client {
+        default_type application/json;
+        return 200 '{"m.homeserver": {"base_url": "https://DOMAIN_PLACEHOLDER"}}';
+    }
+
+    location ~ ^/_matrix/(client|media|federation|key|v2) {
+        proxy_pass http://127.0.0.1:8008;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 600s;
+        proxy_send_timeout 600s;
+    }
+
+    location /_synapse {
+        proxy_pass http://127.0.0.1:8008;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+    }
+}
+NGINXEOF
+
+    sudo sed -i "s/DOMAIN_PLACEHOLDER/${DOMAIN}/g" "${NGINX_CONF}"
+    sudo ln -sf "${NGINX_CONF}" /etc/nginx/sites-enabled/eifeldc 2>/dev/null || true
+    sudo nginx -t && sudo systemctl reload nginx || true
+
+    sudo tee /etc/systemd/system/eifeldc-synapse.service > /dev/null <<EOF
+[Unit]
+Description=EifelDC Synapse Homeserver
+After=network.target postgresql.service
+
+[Service]
+Type=simple
+User=synapse
+Group=synapse
+WorkingDirectory=${SYNAPSE_DIR}
+ExecStart=${SYNAPSE_DIR}/venv/bin/python -m synapse.app.homeserver --config-path ${SYNAPSE_DIR}/homeserver.yaml
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    sudo tee /etc/systemd/system/eifeldc-server.service > /dev/null <<EOF
+[Unit]
+Description=EifelDC Web Server
+After=network.target eifeldc-synapse.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/eifeldc
+Environment=EIFELDC_STATIC_DIR=/opt/eifeldc/client/src-ui/dist
+Environment=RUST_LOG=eifeldc_server=info,tower_http=info
+ExecStart=/opt/eifeldc/target/release/eifeldc-server
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    sudo systemctl daemon-reload
+    sudo systemctl enable eifeldc-synapse eifeldc-server coturn
+
+    echo ""
+    echo "=== Native Setup Complete! ==="
+fi
+
+echo ""
+echo "Next steps:"
+echo "  1. Get SSL certs:"
+echo "     Docker:  ${SCRIPT_DIR}/generate-certs.sh ${DOMAIN}"
+echo "     Native:   sudo certbot certonly --nginx -d ${DOMAIN}"
+echo "  2. Start services:"
+echo "     Docker:  ${SCRIPT_DIR}/start.sh"
+echo "     Native:   sudo systemctl start eifeldc-synapse coturn nginx eifeldc-server"
+echo "  3. Build EifelDC server:  cd /opt/eifeldc && cargo build --release -p eifeldc-server"
+echo "  4. Build EifelDC UI:     cd /opt/eifeldc/client/src-ui && npm ci && npm run build"
+echo "  5. Register first user via the EifelDC client"
+echo ""
--- a/infra/scripts/start.sh
+++ b/infra/scripts/start.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(dirname "$SCRIPT_DIR")"
+
+if command -v docker &>/dev/null && [ -f "${INFRA_DIR}/docker-compose.yml" ]; then
+    echo "=== Starting EifelDC Infrastructure (Docker) ==="
+    cd "${INFRA_DIR}"
+    docker compose up -d
+
+    echo ""
+    echo "Waiting for services..."
+    sleep 5
+
+    echo ""
+    echo "Container status:"
+    docker compose ps
+
+    echo ""
+    echo "Running health check..."
+    "${SCRIPT_DIR}/healthcheck.sh" || true
+else
+    echo "=== Starting EifelDC Infrastructure (Native) ==="
+    sudo systemctl start postgresql
+    sudo systemctl start eifeldc-synapse
+    sudo systemctl start coturn
+    sudo systemctl start nginx
+    sudo systemctl start eifeldc-server
+
+    echo "All services started."
+    echo ""
+    "${SCRIPT_DIR}/healthcheck.sh" || true
+fi
--- a/infra/scripts/stop.sh
+++ b/infra/scripts/stop.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(dirname "$SCRIPT_DIR")"
+
+if command -v docker &>/dev/null && [ -f "${INFRA_DIR}/docker-compose.yml" ]; then
+    echo "=== Stopping EifelDC Infrastructure (Docker) ==="
+    cd "${INFRA_DIR}"
+    docker compose down
+    echo "All containers stopped."
+else
+    echo "=== Stopping EifelDC Infrastructure (Native) ==="
+    sudo systemctl stop eifeldc-server 2>/dev/null || true
+    sudo systemctl stop eifeldc-synapse 2>/dev/null || true
+    sudo systemctl stop coturn 2>/dev/null || true
+    sudo systemctl stop nginx 2>/dev/null || true
+    echo "All services stopped."
+fi
--- a/infra/synapse/homeserver.yaml
+++ b/infra/synapse/homeserver.yaml
@@ -0,0 +1,88 @@
+server_name: "eifeldc.local"
+
+pid_file: "/data/homeserver.pid"
+
+listeners:
+  - port: 8008
+    type: http
+    tls: false
+    x_forwarded: true
+    bind_addresses: ['0.0.0.0']
+    resources:
+      - names: [client, federation]
+        compress: false
+
+  - port: 8448
+    type: http
+    tls: false
+    x_forwarded: true
+    bind_addresses: ['0.0.0.0']
+    resources:
+      - names: [federation]
+        compress: false
+
+database:
+  name: psycopg2
+  txn_limit: 10000
+  args:
+    user: synapse
+    password: synapse_password
+    database: synapse
+    host: postgres
+    cp_min: 5
+    cp_max: 10
+
+log_config: "/data/log.config"
+
+media_store_path: "/data/media_store"
+uploads_path: "/data/uploads"
+
+registration_enabled: true
+enable_registration: true
+enable_registration_without_verification: true
+
+admin_contact: "admin@eifeldc.local"
+
+macaroon_secret_key: "CHANGE_ME_GENERATE_A_RANDOM_STRING"
+form_secret: "CHANGE_ME_GENERATE_ANOTHER_RANDOM_STRING"
+signing_key_path: "/data/signing.key"
+
+trusted_key_servers:
+  - server_name: "matrix.org"
+
+turn_uris: ["turn:eifeldc.local?transport=udp", "turn:eifeldc.local?transport=tcp"]
+turn_shared_secret: "CHANGE_ME_MATCH_COTURN_SECRET"
+turn_user_lifetime: 86400000
+
+enable_metrics: true
+metrics_port: 9100
+
+rc_message:
+  per_second: 5
+  burst_count: 50
+
+rc_registration:
+  per_second: 0.5
+  burst_count: 3
+
+rc_login:
+  account:
+    per_second: 0.5
+    burst_count: 3
+  address:
+    per_second: 0.5
+    burst_count: 3
+
+rc_joins:
+  local:
+    per_second: 0.1
+    burst_count: 3
+  remote:
+    per_second: 0.01
+    burst_count: 3
+
+app_service_config_files: []
+
+instance_map: {}
+
+stream_writers: {}
--- a/infra/synapse/log.config
+++ b/infra/synapse/log.config
@@ -0,0 +1,39 @@
+version: 1
+
+formatters:
+  precise:
+    format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+    stream: 'ext://sys.stdout'
+
+  file:
+    class: logging.handlers.RotatingFileHandler
+    formatter: precise
+    filename: /data/homeserver.log
+    maxBytes: 10485760
+    backupCount: 3
+    encoding: utf8
+
+loggers:
+  synapse:
+    handlers: [console, file]
+    level: INFO
+    propagate: false
+
+  synapse.storage.SQL:
+    handlers: [console, file]
+    level: WARNING
+    propagate: false
+
+  synapse.federation.transport:
+    handlers: [console, file]
+    level: WARNING
+    propagate: false
+
+root:
+  handlers: [console, file]
+  level: INFO