Initial commit: EifelDC - Discord-like Matrix chat platform

Includes server (Rust/Axum API proxy with voice management), Tauri desktop client with Svelte UI, bot-sdk, Docker infra (Synapse, PostgreSQL, Coturn, Nginx), and CI/CD pipeline.
2026-04-28 08:23:23 +02:00
commit 0978d0c2e9
82 changed files with 12417 additions and 0 deletions
--- a/infra/scripts/backup.sh
+++ b/infra/scripts/backup.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(dirname "$SCRIPT_DIR")"
+BACKUP_DIR="${INFRA_DIR}/backups"
+TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+BACKUP_PATH="${BACKUP_DIR}/${TIMESTAMP}"
+
+mkdir -p "${BACKUP_PATH}"
+
+echo "=== EifelDC Backup ==="
+echo "Backup directory: ${BACKUP_PATH}"
+echo ""
+
+if command -v docker &>/dev/null && docker compose -f "${INFRA_DIR}/docker-compose.yml" ps &>/dev/null 2>&1; then
+    echo "[Docker Mode]"
+
+    echo "[1/4] Backing up PostgreSQL..."
+    docker compose -f "${INFRA_DIR}/docker-compose.yml" exec -T postgres \
+        pg_dump -U synapse synapse > "${BACKUP_PATH}/synapse_db.sql"
+
+    echo "[2/4] Backing up Synapse media..."
+    docker cp eifeldc-synapse:/data/media_store "${BACKUP_PATH}/media_store" 2>/dev/null || true
+
+    echo "[3/4] Backing up Synapse config..."
+    docker cp eifeldc-synapse:/data/homeserver.yaml "${BACKUP_PATH}/homeserver.yaml" 2>/dev/null || true
+    docker cp eifeldc-synapse:/data/signing.key "${BACKUP_PATH}/signing.key" 2>/dev/null || true
+
+    echo "[4/4] Backing up environment config..."
+    cp "${INFRA_DIR}/.env" "${BACKUP_PATH}/.env" 2>/dev/null || true
+else
+    echo "[Native Mode]"
+
+    echo "[1/3] Backing up PostgreSQL..."
+    sudo -u postgres pg_dump synapse > "${BACKUP_PATH}/synapse_db.sql" 2>/dev/null || echo "Warning: Could not dump database"
+
+    echo "[2/3] Backing up Synapse data..."
+    SYNAPSE_DIR="${SYNAPSE_DIR:-/opt/eifeldc/synapse-data}"
+    cp -r "${SYNAPSE_DIR}/homeserver.yaml" "${BACKUP_PATH}/" 2>/dev/null || true
+    cp -r "${SYNAPSE_DIR}/signing.key" "${BACKUP_PATH}/" 2>/dev/null || true
+    cp -r "${SYNAPSE_DIR}/media_store" "${BACKUP_PATH}/" 2>/dev/null || true
+
+    echo "[3/3] Backing up environment config..."
+    cp "${INFRA_DIR}/.env" "${BACKUP_PATH}/.env" 2>/dev/null || true
+fi
+
+COMPRESSED="${BACKUP_DIR}/eifeldc_backup_${TIMESTAMP}.tar.gz"
+tar -czf "${COMPRESSED}" -C "${BACKUP_DIR}" "${TIMESTAMP}"
+rm -rf "${BACKUP_PATH}"
+
+echo ""
+echo "Backup saved: ${COMPRESSED}"
+echo ""
+
+KEEP_COUNT=7
+ls -t "${BACKUP_DIR}"/eifeldc_backup_*.tar.gz 2>/dev/null | tail -n +$((KEEP_COUNT + 1)) | xargs -r rm --
+echo "Old backups cleaned (keeping latest ${KEEP_COUNT})"
+echo "Done!"
--- a/infra/scripts/generate-certs.sh
+++ b/infra/scripts/generate-certs.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(dirname "$SCRIPT_DIR")"
+CERT_DIR="${INFRA_DIR}/certs"
+DOMAIN="${1:-eifeldc.local}"
+
+echo "=== Generating self-signed SSL certificate for ${DOMAIN} ==="
+
+rm -rf "${CERT_DIR}"
+mkdir -p "${CERT_DIR}/live/${DOMAIN}"
+mkdir -p "${CERT_DIR}/archive"
+
+openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+    -keyout "${CERT_DIR}/live/${DOMAIN}/privkey.pem" \
+    -out "${CERT_DIR}/live/${DOMAIN}/fullchain.pem" \
+    -subj "/CN=${DOMAIN}" \
+    -addext "subjectAltName=DNS:${DOMAIN},DNS:localhost,IP:127.0.0.1"
+
+cp "${CERT_DIR}/live/${DOMAIN}/fullchain.pem" "${CERT_DIR}/live/${DOMAIN}/cert.pem"
+
+cp "${CERT_DIR}/live/${DOMAIN}/fullchain.pem" "${CERT_DIR}/archive/${DOMAIN}-fullchain.pem"
+cp "${CERT_DIR}/live/${DOMAIN}/privkey.pem" "${CERT_DIR}/archive/${DOMAIN}-privkey.pem"
+
+echo ""
+echo "Certificates generated:"
+echo "  Cert: ${CERT_DIR}/live/${DOMAIN}/fullchain.pem"
+echo "  Key:  ${CERT_DIR}/live/${DOMAIN}/privkey.pem"
+echo ""
+echo "For Docker deployment, copy certs to the nginx-certs volume:"
+echo "  docker volume inspect infra_nginx-certs"
+echo "  sudo cp -r ${CERT_DIR}/live/${DOMAIN}/* <volume_mountpoint>/live/${DOMAIN}/"
+echo ""
+echo "Or for local dev, update nginx config to point to ${CERT_DIR}/live/${DOMAIN}/"
--- a/infra/scripts/healthcheck.sh
+++ b/infra/scripts/healthcheck.sh
@@ -0,0 +1,76 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(dirname "$SCRIPT_DIR")"
+
+echo "=== EifelDC Health Check ==="
+echo ""
+
+OK=true
+
+check_service() {
+    local name=$1
+    local url=$2
+    local expected_status=${3:-200}
+
+    if curl -sf -o /dev/null -w "%{http_code}" "${url}" 2>/dev/null | grep -q "${expected_status}"; then
+        echo "  [OK] ${name}"
+    else
+        echo "  [FAIL] ${name} - ${url}"
+        OK=false
+    fi
+}
+
+if command -v docker &>/dev/null && [ -f "${INFRA_DIR}/docker-compose.yml" ]; then
+    echo "[Docker Mode]"
+    echo ""
+
+    echo "Container Status:"
+    cd "${INFRA_DIR}"
+    docker compose ps
+    echo ""
+
+    echo "Service Health:"
+    check_service "EifelDC Server" "http://localhost:3000/api/current-user" "401"
+    check_service "Synapse" "http://localhost:8008/_matrix/client/versions"
+    check_service "PostgreSQL" "localhost:5432"
+
+    echo ""
+    echo "Container Logs (last 5 lines):"
+    for svc in eifeldc synapse postgres nginx; do
+        if docker compose ps --services --filter "status=running" | grep -q "${svc}"; then
+            echo "--- ${svc} ---"
+            docker compose logs --tail=5 "${svc}" 2>/dev/null || true
+        fi
+    done
+else
+    echo "[Native Mode]"
+    echo ""
+
+    echo "Service Health:"
+    check_service "EifelDC Server" "http://localhost:3000/api/current-user" "401"
+    check_service "Synapse" "http://localhost:8008/_matrix/client/versions"
+    check_service "Nginx" "http://localhost:80/"
+
+    echo ""
+    echo "Systemd Status:"
+    for svc in eifeldc-synapse eifeldc-server coturn nginx; do
+        status=$(systemctl is-active "${svc}" 2>/dev/null || echo "unknown")
+        if [ "$status" = "active" ]; then
+            echo "  [OK] ${svc}: ${status}"
+        else
+            echo "  [FAIL] ${svc}: ${status}"
+            OK=false
+        fi
+    done
+fi
+
+echo ""
+if [ "$OK" = true ]; then
+    echo "=== All services healthy! ==="
+    exit 0
+else
+    echo "=== Some services are not healthy! ==="
+    exit 1
+fi
--- a/infra/scripts/setup.sh
+++ b/infra/scripts/setup.sh
@@ -0,0 +1,281 @@
+#!/bin/bash
+set -euo pipefail
+
+DOMAIN="${1:-eifeldc.local}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(dirname "$SCRIPT_DIR")"
+
+echo "=== EifelDC Infrastructure Setup ==="
+echo "Domain: ${DOMAIN}"
+echo ""
+
+read -p "Use Docker? (y/N): " USE_DOCKER
+if [[ "${USE_DOCKER,,}" == "y" ]]; then
+    echo ""
+    echo "[Docker Mode]"
+
+    echo "[1/5] Generating secrets..."
+    TURN_SECRET=$(openssl rand -hex 16)
+    MACAROON_SECRET=$(openssl rand -hex 32)
+    FORM_SECRET=$(openssl rand -hex 32)
+    POSTGRES_PASSWORD=$(openssl rand -hex 16)
+
+    echo "[2/5] Writing .env file..."
+    cat > "${INFRA_DIR}/.env" <<EOF
+DOMAIN=${DOMAIN}
+POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+TURN_SECRET=${TURN_SECRET}
+MACAROON_SECRET=${MACAROON_SECRET}
+FORM_SECRET=${FORM_SECRET}
+EOF
+
+    echo "[3/5] Generating Synapse config..."
+    if [ ! -d "${INFRA_DIR}/synapse-data" ]; then
+        mkdir -p "${INFRA_DIR}/synapse-data"
+        docker run -it --rm \
+            -v "$(pwd)/synapse-data:/data" \
+            -e SYNAPSE_SERVER_NAME="${DOMAIN}" \
+            -e SYNAPSE_REPORT_STATS=no \
+            matrixdotorg/synapse:latest generate
+    fi
+
+    echo "[4/5] Patching Synapse config with secrets..."
+    if [ -f "${INFRA_DIR}/synapse-data/homeserver.yaml" ]; then
+        sed -i "s/synapse_password/${POSTGRES_PASSWORD}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+        sed -i "s/CHANGE_ME_GENERATE_A_RANDOM_STRING/${MACAROON_SECRET}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+        sed -i "s/CHANGE_ME_GENERATE_ANOTHER_RANDOM_STRING/${FORM_SECRET}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+        sed -i "s/CHANGE_ME_MATCH_COTURN_SECRET/${TURN_SECRET}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+        sed -i "s/eifeldc.local/${DOMAIN}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+    fi
+
+    sed -i "s/CHANGE_ME_GENERATE_A_SECRET/${TURN_SECRET}/g" "${INFRA_DIR}/coturn/turnserver.conf" 2>/dev/null || true
+    sed -i "s/eifeldc.local/${DOMAIN}/g" "${INFRA_DIR}/coturn/turnserver.conf" 2>/dev/null || true
+    sed -i "s/eifeldc.local/${DOMAIN}/g" "${INFRA_DIR}/nginx/eifeldc.conf" 2>/dev/null || true
+
+    echo "[5/5] Generating self-signed certs and starting containers..."
+    "${SCRIPT_DIR}/generate-certs.sh" "${DOMAIN}"
+    cd "${INFRA_DIR}"
+    docker compose up -d
+
+    echo ""
+    echo "Waiting for Synapse..."
+    for i in $(seq 1 30); do
+        if curl -sf "http://localhost:8008/_matrix/client/versions" > /dev/null 2>&1; then
+            echo "Synapse is ready!"
+            break
+        fi
+        sleep 2
+    done
+
+    echo ""
+    echo "=== Docker Setup Complete! ==="
+else
+    echo ""
+    echo "[Native Mode]"
+    SYNAPSE_DIR="/opt/eifeldc/synapse-data"
+    NGINX_CONF="/etc/nginx/sites-available/eifeldc"
+    COTURN_CONF="/etc/turnserver.conf"
+
+    echo "[1/6] Generating secrets..."
+    TURN_SECRET=$(openssl rand -hex 16)
+    MACAROON_SECRET=$(openssl rand -hex 32)
+    FORM_SECRET=$(openssl rand -hex 32)
+    POSTGRES_PASSWORD=$(openssl rand -hex 16)
+
+    echo "[2/6] Writing .env file..."
+    cat > "${INFRA_DIR}/.env" <<EOF
+DOMAIN=${DOMAIN}
+POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+TURN_SECRET=${TURN_SECRET}
+MACAROON_SECRET=${MACAROON_SECRET}
+FORM_SECRET=${FORM_SECRET}
+EOF
+
+    echo "[3/6] Installing system dependencies..."
+    sudo apt-get update
+    sudo apt-get install -y \
+        python3-pip python3-venv nginx coturn certbot \
+        libffi-dev libssl-dev libjpeg-dev libxml2-dev libxslt1-dev \
+        postgresql postgresql-contrib curl
+
+    echo "[4/6] Setting up PostgreSQL..."
+    sudo -u postgres psql -c "CREATE USER synapse WITH PASSWORD '${POSTGRES_PASSWORD}';" 2>/dev/null || true
+    sudo -u postgres psql -c "CREATE DATABASE synapse ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' TEMPLATE template0 OWNER synapse;" 2>/dev/null || true
+    sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE synapse TO synapse;" 2>/dev/null || true
+
+    echo "[5/6] Installing and configuring Synapse..."
+    mkdir -p "${SYNAPSE_DIR}"
+    if [ ! -d "${SYNAPSE_DIR}/venv" ]; then
+        python3 -m venv "${SYNAPSE_DIR}/venv"
+        "${SYNAPSE_DIR}/venv/bin/pip" install --upgrade pip
+        "${SYNAPSE_DIR}/venv/bin/pip" install matrix-synapse
+    fi
+
+    if [ ! -f "${SYNAPSE_DIR}/homeserver.yaml" ]; then
+        "${SYNAPSE_DIR}/venv/bin/python" -m synapse.app.homeserver \
+            --server-name "${DOMAIN}" \
+            --config-path "${SYNAPSE_DIR}/homeserver.yaml" \
+            --generate-config \
+            --report-stats=no
+    fi
+
+    sed -i "s/synapse_password/${POSTGRES_PASSWORD}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
+    sed -i "s/CHANGE_ME_GENERATE_A_RANDOM_STRING/${MACAROON_SECRET}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
+    sed -i "s/CHANGE_ME_GENERATE_ANOTHER_RANDOM_STRING/${FORM_SECRET}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
+    sed -i "s/CHANGE_ME_MATCH_COTURN_SECRET/${TURN_SECRET}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
+
+    echo "[6/6] Configuring services..."
+
+    sudo tee "${COTURN_CONF}" > /dev/null <<EOF
+listening-port=3478
+tls-listening-port=5349
+realm=${DOMAIN}
+server-name=${DOMAIN}
+fingerprint
+lt-cred-mech
+use-auth-secret
+static-auth-secret=${TURN_SECRET}
+total-quota=100
+stale-nonce=600
+cert=/etc/letsencrypt/live/${DOMAIN}/cert.pem
+pkey=/etc/letsencrypt/live/${DOMAIN}/privkey.pem
+no-multicast-peers
+no-cli
+log-file=/var/log/turnserver/turnserver.log
+simple-log
+EOF
+
+    sudo sed -i 's/#TURNSERVER_ENABLED=1/TURNSERVER_ENABLED=1/' /etc/default/coturn 2>/dev/null || true
+
+    sudo tee "${NGINX_CONF}" > /dev/null <<'NGINXEOF'
+server {
+    listen 80;
+    server_name DOMAIN_PLACEHOLDER;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name DOMAIN_PLACEHOLDER;
+
+    ssl_certificate /etc/letsencrypt/live/DOMAIN_PLACEHOLDER/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/DOMAIN_PLACEHOLDER/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    client_max_body_size 50M;
+
+    add_header X-Frame-Options SAMEORIGIN;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    location /.well-known/matrix/server {
+        default_type application/json;
+        return 200 '{"m.server": "DOMAIN_PLACEHOLDER:443"}';
+    }
+
+    location /.well-known/matrix/client {
+        default_type application/json;
+        return 200 '{"m.homeserver": {"base_url": "https://DOMAIN_PLACEHOLDER"}}';
+    }
+
+    location ~ ^/_matrix/(client|media|federation|key|v2) {
+        proxy_pass http://127.0.0.1:8008;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 600s;
+        proxy_send_timeout 600s;
+    }
+
+    location /_synapse {
+        proxy_pass http://127.0.0.1:8008;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+    }
+}
+NGINXEOF
+
+    sudo sed -i "s/DOMAIN_PLACEHOLDER/${DOMAIN}/g" "${NGINX_CONF}"
+    sudo ln -sf "${NGINX_CONF}" /etc/nginx/sites-enabled/eifeldc 2>/dev/null || true
+    sudo nginx -t && sudo systemctl reload nginx || true
+
+    sudo tee /etc/systemd/system/eifeldc-synapse.service > /dev/null <<EOF
+[Unit]
+Description=EifelDC Synapse Homeserver
+After=network.target postgresql.service
+
+[Service]
+Type=simple
+User=synapse
+Group=synapse
+WorkingDirectory=${SYNAPSE_DIR}
+ExecStart=${SYNAPSE_DIR}/venv/bin/python -m synapse.app.homeserver --config-path ${SYNAPSE_DIR}/homeserver.yaml
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    sudo tee /etc/systemd/system/eifeldc-server.service > /dev/null <<EOF
+[Unit]
+Description=EifelDC Web Server
+After=network.target eifeldc-synapse.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/eifeldc
+Environment=EIFELDC_STATIC_DIR=/opt/eifeldc/client/src-ui/dist
+Environment=RUST_LOG=eifeldc_server=info,tower_http=info
+ExecStart=/opt/eifeldc/target/release/eifeldc-server
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    sudo systemctl daemon-reload
+    sudo systemctl enable eifeldc-synapse eifeldc-server coturn
+
+    echo ""
+    echo "=== Native Setup Complete! ==="
+fi
+
+echo ""
+echo "Next steps:"
+echo "  1. Get SSL certs:"
+echo "     Docker:  ${SCRIPT_DIR}/generate-certs.sh ${DOMAIN}"
+echo "     Native:   sudo certbot certonly --nginx -d ${DOMAIN}"
+echo "  2. Start services:"
+echo "     Docker:  ${SCRIPT_DIR}/start.sh"
+echo "     Native:   sudo systemctl start eifeldc-synapse coturn nginx eifeldc-server"
+echo "  3. Build EifelDC server:  cd /opt/eifeldc && cargo build --release -p eifeldc-server"
+echo "  4. Build EifelDC UI:     cd /opt/eifeldc/client/src-ui && npm ci && npm run build"
+echo "  5. Register first user via the EifelDC client"
+echo ""
--- a/infra/scripts/start.sh
+++ b/infra/scripts/start.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(dirname "$SCRIPT_DIR")"
+
+if command -v docker &>/dev/null && [ -f "${INFRA_DIR}/docker-compose.yml" ]; then
+    echo "=== Starting EifelDC Infrastructure (Docker) ==="
+    cd "${INFRA_DIR}"
+    docker compose up -d
+
+    echo ""
+    echo "Waiting for services..."
+    sleep 5
+
+    echo ""
+    echo "Container status:"
+    docker compose ps
+
+    echo ""
+    echo "Running health check..."
+    "${SCRIPT_DIR}/healthcheck.sh" || true
+else
+    echo "=== Starting EifelDC Infrastructure (Native) ==="
+    sudo systemctl start postgresql
+    sudo systemctl start eifeldc-synapse
+    sudo systemctl start coturn
+    sudo systemctl start nginx
+    sudo systemctl start eifeldc-server
+
+    echo "All services started."
+    echo ""
+    "${SCRIPT_DIR}/healthcheck.sh" || true
+fi
--- a/infra/scripts/stop.sh
+++ b/infra/scripts/stop.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(dirname "$SCRIPT_DIR")"
+
+if command -v docker &>/dev/null && [ -f "${INFRA_DIR}/docker-compose.yml" ]; then
+    echo "=== Stopping EifelDC Infrastructure (Docker) ==="
+    cd "${INFRA_DIR}"
+    docker compose down
+    echo "All containers stopped."
+else
+    echo "=== Stopping EifelDC Infrastructure (Native) ==="
+    sudo systemctl stop eifeldc-server 2>/dev/null || true
+    sudo systemctl stop eifeldc-synapse 2>/dev/null || true
+    sudo systemctl stop coturn 2>/dev/null || true
+    sudo systemctl stop nginx 2>/dev/null || true
+    echo "All services stopped."
+fi