Initial commit: EifelDC - Discord-like Matrix chat platform

Includes server (Rust/Axum API proxy with voice management), Tauri desktop client with Svelte UI, bot-sdk, Docker infra (Synapse, PostgreSQL, Coturn, Nginx), and CI/CD pipeline.
2026-04-28 08:23:23 +02:00
commit 0978d0c2e9
82 changed files with 12417 additions and 0 deletions
--- a/infra/scripts/setup.sh
+++ b/infra/scripts/setup.sh
@@ -0,0 +1,281 @@
+#!/bin/bash
+set -euo pipefail
+
+DOMAIN="${1:-eifeldc.local}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(dirname "$SCRIPT_DIR")"
+
+echo "=== EifelDC Infrastructure Setup ==="
+echo "Domain: ${DOMAIN}"
+echo ""
+
+read -p "Use Docker? (y/N): " USE_DOCKER
+if [[ "${USE_DOCKER,,}" == "y" ]]; then
+    echo ""
+    echo "[Docker Mode]"
+
+    echo "[1/5] Generating secrets..."
+    TURN_SECRET=$(openssl rand -hex 16)
+    MACAROON_SECRET=$(openssl rand -hex 32)
+    FORM_SECRET=$(openssl rand -hex 32)
+    POSTGRES_PASSWORD=$(openssl rand -hex 16)
+
+    echo "[2/5] Writing .env file..."
+    cat > "${INFRA_DIR}/.env" <<EOF
+DOMAIN=${DOMAIN}
+POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+TURN_SECRET=${TURN_SECRET}
+MACAROON_SECRET=${MACAROON_SECRET}
+FORM_SECRET=${FORM_SECRET}
+EOF
+
+    echo "[3/5] Generating Synapse config..."
+    if [ ! -d "${INFRA_DIR}/synapse-data" ]; then
+        mkdir -p "${INFRA_DIR}/synapse-data"
+        docker run -it --rm \
+            -v "$(pwd)/synapse-data:/data" \
+            -e SYNAPSE_SERVER_NAME="${DOMAIN}" \
+            -e SYNAPSE_REPORT_STATS=no \
+            matrixdotorg/synapse:latest generate
+    fi
+
+    echo "[4/5] Patching Synapse config with secrets..."
+    if [ -f "${INFRA_DIR}/synapse-data/homeserver.yaml" ]; then
+        sed -i "s/synapse_password/${POSTGRES_PASSWORD}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+        sed -i "s/CHANGE_ME_GENERATE_A_RANDOM_STRING/${MACAROON_SECRET}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+        sed -i "s/CHANGE_ME_GENERATE_ANOTHER_RANDOM_STRING/${FORM_SECRET}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+        sed -i "s/CHANGE_ME_MATCH_COTURN_SECRET/${TURN_SECRET}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+        sed -i "s/eifeldc.local/${DOMAIN}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
+    fi
+
+    sed -i "s/CHANGE_ME_GENERATE_A_SECRET/${TURN_SECRET}/g" "${INFRA_DIR}/coturn/turnserver.conf" 2>/dev/null || true
+    sed -i "s/eifeldc.local/${DOMAIN}/g" "${INFRA_DIR}/coturn/turnserver.conf" 2>/dev/null || true
+    sed -i "s/eifeldc.local/${DOMAIN}/g" "${INFRA_DIR}/nginx/eifeldc.conf" 2>/dev/null || true
+
+    echo "[5/5] Generating self-signed certs and starting containers..."
+    "${SCRIPT_DIR}/generate-certs.sh" "${DOMAIN}"
+    cd "${INFRA_DIR}"
+    docker compose up -d
+
+    echo ""
+    echo "Waiting for Synapse..."
+    for i in $(seq 1 30); do
+        if curl -sf "http://localhost:8008/_matrix/client/versions" > /dev/null 2>&1; then
+            echo "Synapse is ready!"
+            break
+        fi
+        sleep 2
+    done
+
+    echo ""
+    echo "=== Docker Setup Complete! ==="
+else
+    echo ""
+    echo "[Native Mode]"
+    SYNAPSE_DIR="/opt/eifeldc/synapse-data"
+    NGINX_CONF="/etc/nginx/sites-available/eifeldc"
+    COTURN_CONF="/etc/turnserver.conf"
+
+    echo "[1/6] Generating secrets..."
+    TURN_SECRET=$(openssl rand -hex 16)
+    MACAROON_SECRET=$(openssl rand -hex 32)
+    FORM_SECRET=$(openssl rand -hex 32)
+    POSTGRES_PASSWORD=$(openssl rand -hex 16)
+
+    echo "[2/6] Writing .env file..."
+    cat > "${INFRA_DIR}/.env" <<EOF
+DOMAIN=${DOMAIN}
+POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+TURN_SECRET=${TURN_SECRET}
+MACAROON_SECRET=${MACAROON_SECRET}
+FORM_SECRET=${FORM_SECRET}
+EOF
+
+    echo "[3/6] Installing system dependencies..."
+    sudo apt-get update
+    sudo apt-get install -y \
+        python3-pip python3-venv nginx coturn certbot \
+        libffi-dev libssl-dev libjpeg-dev libxml2-dev libxslt1-dev \
+        postgresql postgresql-contrib curl
+
+    echo "[4/6] Setting up PostgreSQL..."
+    sudo -u postgres psql -c "CREATE USER synapse WITH PASSWORD '${POSTGRES_PASSWORD}';" 2>/dev/null || true
+    sudo -u postgres psql -c "CREATE DATABASE synapse ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' TEMPLATE template0 OWNER synapse;" 2>/dev/null || true
+    sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE synapse TO synapse;" 2>/dev/null || true
+
+    echo "[5/6] Installing and configuring Synapse..."
+    mkdir -p "${SYNAPSE_DIR}"
+    if [ ! -d "${SYNAPSE_DIR}/venv" ]; then
+        python3 -m venv "${SYNAPSE_DIR}/venv"
+        "${SYNAPSE_DIR}/venv/bin/pip" install --upgrade pip
+        "${SYNAPSE_DIR}/venv/bin/pip" install matrix-synapse
+    fi
+
+    if [ ! -f "${SYNAPSE_DIR}/homeserver.yaml" ]; then
+        "${SYNAPSE_DIR}/venv/bin/python" -m synapse.app.homeserver \
+            --server-name "${DOMAIN}" \
+            --config-path "${SYNAPSE_DIR}/homeserver.yaml" \
+            --generate-config \
+            --report-stats=no
+    fi
+
+    sed -i "s/synapse_password/${POSTGRES_PASSWORD}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
+    sed -i "s/CHANGE_ME_GENERATE_A_RANDOM_STRING/${MACAROON_SECRET}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
+    sed -i "s/CHANGE_ME_GENERATE_ANOTHER_RANDOM_STRING/${FORM_SECRET}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
+    sed -i "s/CHANGE_ME_MATCH_COTURN_SECRET/${TURN_SECRET}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
+
+    echo "[6/6] Configuring services..."
+
+    sudo tee "${COTURN_CONF}" > /dev/null <<EOF
+listening-port=3478
+tls-listening-port=5349
+realm=${DOMAIN}
+server-name=${DOMAIN}
+fingerprint
+lt-cred-mech
+use-auth-secret
+static-auth-secret=${TURN_SECRET}
+total-quota=100
+stale-nonce=600
+cert=/etc/letsencrypt/live/${DOMAIN}/cert.pem
+pkey=/etc/letsencrypt/live/${DOMAIN}/privkey.pem
+no-multicast-peers
+no-cli
+log-file=/var/log/turnserver/turnserver.log
+simple-log
+EOF
+
+    sudo sed -i 's/#TURNSERVER_ENABLED=1/TURNSERVER_ENABLED=1/' /etc/default/coturn 2>/dev/null || true
+
+    sudo tee "${NGINX_CONF}" > /dev/null <<'NGINXEOF'
+server {
+    listen 80;
+    server_name DOMAIN_PLACEHOLDER;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name DOMAIN_PLACEHOLDER;
+
+    ssl_certificate /etc/letsencrypt/live/DOMAIN_PLACEHOLDER/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/DOMAIN_PLACEHOLDER/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    client_max_body_size 50M;
+
+    add_header X-Frame-Options SAMEORIGIN;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    location /.well-known/matrix/server {
+        default_type application/json;
+        return 200 '{"m.server": "DOMAIN_PLACEHOLDER:443"}';
+    }
+
+    location /.well-known/matrix/client {
+        default_type application/json;
+        return 200 '{"m.homeserver": {"base_url": "https://DOMAIN_PLACEHOLDER"}}';
+    }
+
+    location ~ ^/_matrix/(client|media|federation|key|v2) {
+        proxy_pass http://127.0.0.1:8008;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 600s;
+        proxy_send_timeout 600s;
+    }
+
+    location /_synapse {
+        proxy_pass http://127.0.0.1:8008;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+    }
+}
+NGINXEOF
+
+    sudo sed -i "s/DOMAIN_PLACEHOLDER/${DOMAIN}/g" "${NGINX_CONF}"
+    sudo ln -sf "${NGINX_CONF}" /etc/nginx/sites-enabled/eifeldc 2>/dev/null || true
+    sudo nginx -t && sudo systemctl reload nginx || true
+
+    sudo tee /etc/systemd/system/eifeldc-synapse.service > /dev/null <<EOF
+[Unit]
+Description=EifelDC Synapse Homeserver
+After=network.target postgresql.service
+
+[Service]
+Type=simple
+User=synapse
+Group=synapse
+WorkingDirectory=${SYNAPSE_DIR}
+ExecStart=${SYNAPSE_DIR}/venv/bin/python -m synapse.app.homeserver --config-path ${SYNAPSE_DIR}/homeserver.yaml
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    sudo tee /etc/systemd/system/eifeldc-server.service > /dev/null <<EOF
+[Unit]
+Description=EifelDC Web Server
+After=network.target eifeldc-synapse.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/eifeldc
+Environment=EIFELDC_STATIC_DIR=/opt/eifeldc/client/src-ui/dist
+Environment=RUST_LOG=eifeldc_server=info,tower_http=info
+ExecStart=/opt/eifeldc/target/release/eifeldc-server
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    sudo systemctl daemon-reload
+    sudo systemctl enable eifeldc-synapse eifeldc-server coturn
+
+    echo ""
+    echo "=== Native Setup Complete! ==="
+fi
+
+echo ""
+echo "Next steps:"
+echo "  1. Get SSL certs:"
+echo "     Docker:  ${SCRIPT_DIR}/generate-certs.sh ${DOMAIN}"
+echo "     Native:   sudo certbot certonly --nginx -d ${DOMAIN}"
+echo "  2. Start services:"
+echo "     Docker:  ${SCRIPT_DIR}/start.sh"
+echo "     Native:   sudo systemctl start eifeldc-synapse coturn nginx eifeldc-server"
+echo "  3. Build EifelDC server:  cd /opt/eifeldc && cargo build --release -p eifeldc-server"
+echo "  4. Build EifelDC UI:     cd /opt/eifeldc/client/src-ui && npm ci && npm run build"
+echo "  5. Register first user via the EifelDC client"
+echo ""