Start working on dedicated docs, WIP

Fixes for !225

See merge request famedly/conduit!226

.dockerignore

@@ -14,6 +14,8 @@ docker-compose*
 # Git folder
 .git
 .gitea
+.gitlab
+.github
 
 # Dot files
 .env

.gitignore

@@ -60,6 +60,7 @@ $RECYCLE.BIN/
 Rocket.toml
 conduit.toml
 conduit.db
+public/
 
 # Etc.
 **/*.rs.bk

.gitlab-ci.yml

@@ -9,7 +9,6 @@ variables:
   FF_USE_FASTZIP: 1
   CACHE_COMPRESSION_LEVEL: fastest
 
-
 # --------------------------------------------------------------------- #
 #  Cargo: Compiling for different architectures                         #
 # --------------------------------------------------------------------- #
@@ -20,48 +19,46 @@ variables:
   rules:
     - if: '$CI_COMMIT_BRANCH == "master"'
     - if: '$CI_COMMIT_BRANCH == "next"'
-    # TODO: Remove this after debugging
+    - if: "$CI_COMMIT_TAG"
-    - if: '$CI_COMMIT_BRANCH == "multiarch-docker-support"'
-    - if: '$CI_COMMIT_TAG'
   interruptible: true
-  image: "rust:1.56.0"
+  image: "rust:latest"
   tags: ["docker"]
   cache:
     paths:
       - cargohome
       - target/
-    key: "build_cache-$TARGET-release"
+    key: "build_cache--$TARGET--$CI_COMMIT_BRANCH--release"
   variables:
-    CARGO_PROFILE_RELEASE_LTO: "off" # TODO: change to true again
+    CARGO_PROFILE_RELEASE_LTO: "true"
-    CARGO_PROFILE_RELEASE_CODEGEN_UNITS: "256" # TODO: Change to 1 again
+    CARGO_PROFILE_RELEASE_CODEGEN_UNITS: "1"
-    RUSTUP_HOME: "/root/.rustup"
   before_script:
-    - echo $USER
-    - export PATH="root/.cargo/bin:$PATH"
     - 'echo "Building for target $TARGET"'
     - 'mkdir -p cargohome && CARGOHOME="cargohome"'
-    - "cat /etc/*-release && rustc --version && cargo --version"  # Print version info for debugging
+    - "rustc --version && cargo --version && rustup show" # Print version info for debugging
-    - 'time rustup target add "$TARGET"'
+    - "rustup target add $TARGET"
   script:
     - time cargo build --target $TARGET --release
-    - 'mv "target/$TARGET/release/conduit" "conduit-$TARGET"'
+    - 'cp "target/$TARGET/release/conduit" "conduit-$TARGET"'
   artifacts:
     expire_in: never
 
-
+build:release:cargo:x86_64-unknown-linux-musl-with-debug:
-build:release:cargo:x86_64-unknown-linux-gnu:
   extends: .build-cargo-shared-settings
+  image: messense/rust-musl-cross:x86_64-musl
   variables:
-    TARGET: "x86_64-unknown-linux-gnu"
+    CARGO_PROFILE_RELEASE_DEBUG: 2 # Enable debug info for flamegraph profiling
+    TARGET: "x86_64-unknown-linux-musl"
+  after_script:
+    - "mv ./conduit-x86_64-unknown-linux-musl ./conduit-x86_64-unknown-linux-musl-with-debug"
   artifacts:
-    name: "conduit-x86_64-unknown-linux-gnu"
+    name: "conduit-x86_64-unknown-linux-musl-with-debug"
     paths:
-      - "conduit-x86_64-unknown-linux-gnu"
+      - "conduit-x86_64-unknown-linux-musl-with-debug"
-    expose_as: "Conduit for x86_64-unknown-linux-gnu"
+    expose_as: "Conduit for x86_64-unknown-linux-musl-with-debug"
 
 build:release:cargo:x86_64-unknown-linux-musl:
-  image: registry.gitlab.fachschaften.org/jfowl/cargo-cross-for-ci/cargo-cross-builder:rust1.56.0-x86_64-unknown-linux-musl
   extends: .build-cargo-shared-settings
+  image: messense/rust-musl-cross:x86_64-musl
   variables:
     TARGET: "x86_64-unknown-linux-musl"
   artifacts:
@@ -70,23 +67,20 @@ build:release:cargo:x86_64-unknown-linux-musl:
       - "conduit-x86_64-unknown-linux-musl"
     expose_as: "Conduit for x86_64-unknown-linux-musl"
 
-
+build:release:cargo:arm-unknown-linux-musleabihf:
-build:release:cargo:armv7-unknown-linux-gnueabihf:
   extends: .build-cargo-shared-settings
-  image:
+  image: messense/rust-musl-cross:arm-musleabihf
-    name: registry.gitlab.fachschaften.org/jfowl/cargo-cross-for-ci/cargo-cross-builder:rust1.56.0-armv7-unknown-linux-gnueabihf
   variables:
-    TARGET: "armv7-unknown-linux-gnueabihf"
+    TARGET: "arm-unknown-linux-musleabihf"
   artifacts:
-    name: "conduit-armv7-unknown-linux-gnueabihf"
+    name: "conduit-arm-unknown-linux-musleabihf"
     paths:
-      - "conduit-armv7-unknown-linux-gnueabihf"
+      - "conduit-arm-unknown-linux-musleabihf"
-    expose_as: "Conduit for armv7-unknown-linux-gnueabihf"
+    expose_as: "Conduit for arm-unknown-linux-musleabihf"
 
 build:release:cargo:armv7-unknown-linux-musleabihf:
   extends: .build-cargo-shared-settings
-  image:
+  image: messense/rust-musl-cross:armv7-musleabihf
-    name: registry.gitlab.fachschaften.org/jfowl/cargo-cross-for-ci/cargo-cross-builder:rust1.56.0-armv7-unknown-linux-musleabihf
   variables:
     TARGET: "armv7-unknown-linux-musleabihf"
   artifacts:
@@ -95,21 +89,9 @@ build:release:cargo:armv7-unknown-linux-musleabihf:
       - "conduit-armv7-unknown-linux-musleabihf"
     expose_as: "Conduit for armv7-unknown-linux-musleabihf"
 
-
-build:release:cargo:aarch64-unknown-linux-gnu:
-  image: registry.gitlab.fachschaften.org/jfowl/cargo-cross-for-ci/cargo-cross-builder:rust1.56.0-aarch64-unknown-linux-gnu
-  extends: .build-cargo-shared-settings
-  variables:
-    TARGET: "aarch64-unknown-linux-gnu"
-  artifacts:
-    name: "conduit-aarch64-unknown-linux-gnu"
-    paths:
-      - "conduit-aarch64-unknown-linux-gnu"
-    expose_as: "Conduit for aarch64-unknown-linux-gnu"
-
 build:release:cargo:aarch64-unknown-linux-musl:
-  image: registry.gitlab.fachschaften.org/jfowl/cargo-cross-for-ci/cargo-cross-builder:rust1.56.0-aarch64-unknown-linux-musl
   extends: .build-cargo-shared-settings
+  image: messense/rust-musl-cross:aarch64-musl
   variables:
     TARGET: "aarch64-unknown-linux-musl"
   artifacts:
@@ -118,182 +100,34 @@ build:release:cargo:aarch64-unknown-linux-musl:
       - "conduit-aarch64-unknown-linux-musl"
     expose_as: "Conduit for aarch64-unknown-linux-musl"
 
-
-
 .cargo-debug-shared-settings:
   extends: ".build-cargo-shared-settings"
   rules:
-    - if: '$CI_COMMIT_BRANCH'
+    - if: '$CI_COMMIT_BRANCH != "master"'
-    - if: '$CI_COMMIT_TAG'
   cache:
-    key: "build_cache-$TARGET-debug"
+    key: "build_cache--$TARGET--$CI_COMMIT_BRANCH--debug"
   script:
     - "time cargo build --target $TARGET"
     - 'mv "target/$TARGET/debug/conduit" "conduit-debug-$TARGET"'
   artifacts:
     expire_in: 4 weeks
 
-build:debug:cargo:x86_64-unknown-linux-gnu:
-  extends: ".cargo-debug-shared-settings"
-  variables:
-    TARGET: "x86_64-unknown-linux-gnu"
-  artifacts:
-    name: "conduit-debug-x86_64-unknown-linux-gnu"
-    paths:
-      - "conduit-debug-x86_64-unknown-linux-gnu"
-    expose_as: "Conduit DEBUG for x86_64-unknown-linux-gnu"
-
 build:debug:cargo:x86_64-unknown-linux-musl:
   extends: ".cargo-debug-shared-settings"
-  image: "rust:alpine"
+  image: messense/rust-musl-cross:x86_64-musl
   variables:
     TARGET: "x86_64-unknown-linux-musl"
-  before_script:
-    - 'echo "Building for target $TARGET"'
-    - 'mkdir -p cargohome && CARGOHOME="cargohome"'
-    - "cat /etc/*-release && rustc --version && cargo --version"  # Print version info for debugging
-    - "rustup target add $TARGET"
-    - "apk add libc-dev"
   artifacts:
     name: "conduit-debug-x86_64-unknown-linux-musl"
     paths:
       - "conduit-debug-x86_64-unknown-linux-musl"
     expose_as: "Conduit DEBUG for x86_64-unknown-linux-musl"
 
-
-
-# --------------------------------------------------------------------- #
-#  Cargo: Compiling deb packages for different architectures            #
-# --------------------------------------------------------------------- #
-
-
-.build-cargo-deb-shared-settings:
-  stage: "build"
-  needs: [ ]
-  rules:
-    - if: '$CI_COMMIT_BRANCH == "master"'
-    - if: '$CI_COMMIT_BRANCH == "next"'
-    - if: '$CI_COMMIT_TAG'
-  interruptible: true
-  image: "rust:latest"
-  tags: ["docker"]
-  cache:
-    paths:
-      - cargohome
-      - target/
-    key: "build_cache-deb-$TARGET"
-  before_script:
-    - 'echo "Building debian package for target $TARGET"'
-    - 'mkdir -p cargohome && CARGOHOME="cargohome"'
-    - "cat /etc/*-release && rustc --version && cargo --version"  # Print version info for debugging
-    - 'apt-get update -yqq'
-    - 'echo "Installing packages: $NEEDED_PACKAGES"'
-    - "apt-get install -yqq --no-install-recommends $NEEDED_PACKAGES"
-    - "rustup target add $TARGET"
-    - "cargo install cargo-deb"
-  script:
-    - time cargo deb --target $TARGET
-    - 'mv target/$TARGET/debian/*.deb "conduit-$TARGET.deb"'
-
-build:cargo-deb:x86_64-unknown-linux-gnu:
-  extends: .build-cargo-deb-shared-settings
-  variables:
-    TARGET: "x86_64-unknown-linux-gnu"
-    NEEDED_PACKAGES: ""
-  artifacts:
-    name: "conduit-x86_64-unknown-linux-gnu.deb"
-    paths:
-      - "conduit-x86_64-unknown-linux-gnu.deb"
-    expose_as: "Debian Package x86_64"
-
-
 # --------------------------------------------------------------------- #
 #  Create and publish docker image                                      #
 # --------------------------------------------------------------------- #
 
-# Build a docker image by packaging up the x86_64-unknown-linux-musl binary into an alpine image
 .docker-shared-settings:
-  stage: "build docker image"
-  needs: []
-  interruptible: true
-  image:
-    name: "gcr.io/kaniko-project/executor:debug"
-    entrypoint: [""]
-  tags: ["docker"]
-  variables:
-    # Configure Kaniko Caching: https://cloud.google.com/build/docs/kaniko-cache
-    KANIKO_CACHE_ARGS: "--cache=true --cache-copy-layers=true --cache-ttl=120h --cache-repo $CI_REGISTRY_IMAGE/kaniko-ci-cache"
-  before_script:
-    - "mkdir -p /kaniko/.docker"
-    - 'echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"},\"$DOCKER_HUB\":{\"username\":\"$DOCKER_HUB_USER\",\"password\":\"$DOCKER_HUB_PASSWORD\"}}}" > /kaniko/.docker/config.json'
-
-build:docker:next:
-  extends: .docker-shared-settings
-  needs:
-    - "build:release:cargo:x86_64-unknown-linux-musl"
-  script:
-    - >
-      /kaniko/executor
-      $KANIKO_CACHE_ARGS
-      --force
-      --context $CI_PROJECT_DIR
-      --build-arg CREATED=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
-      --build-arg VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml)
-      --build-arg "GIT_REF=$CI_COMMIT_SHORT_SHA"
-      --dockerfile "$CI_PROJECT_DIR/docker/ci-binaries-packaging.Dockerfile"
-      --destination "$CI_REGISTRY_IMAGE/conduit:next"
-      --destination "$CI_REGISTRY_IMAGE/conduit:next-alpine"
-      --destination "$CI_REGISTRY_IMAGE/conduit:commit-$CI_COMMIT_SHORT_SHA"
-      --destination "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:next"
-      --destination "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:next-alpine"
-      --destination "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:commit-$CI_COMMIT_SHORT_SHA"
-  rules:
-    - if: '$CI_COMMIT_BRANCH == "next"'
-
-
-build:docker:master:
-  extends: .docker-shared-settings
-  needs:
-    - "build:release:cargo:x86_64-unknown-linux-musl"
-  script:
-    - >
-      /kaniko/executor
-      $KANIKO_CACHE_ARGS
-      --context $CI_PROJECT_DIR
-      --build-arg CREATED=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
-      --build-arg VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml)
-      --build-arg "GIT_REF=$CI_COMMIT_SHORT_SHA"
-      --dockerfile "$CI_PROJECT_DIR/docker/ci-binaries-packaging.Dockerfile"
-      --destination "$CI_REGISTRY_IMAGE/conduit:latest"
-      --destination "$CI_REGISTRY_IMAGE/conduit:latest-alpine"
-      --destination "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:latest"
-      --destination "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:latest-alpine"
-  rules:
-    - if: '$CI_COMMIT_BRANCH == "master"'
-
-
-build:docker:tags:
-  extends: .docker-shared-settings
-  needs:
-    - "build:release:cargo:x86_64-unknown-linux-musl"
-  script:
-    - >
-      /kaniko/executor
-      $KANIKO_CACHE_ARGS
-      --context $CI_PROJECT_DIR
-      --build-arg CREATED=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
-      --build-arg VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml)
-      --build-arg "GIT_REF=$CI_COMMIT_SHORT_SHA"
-      --dockerfile "$CI_PROJECT_DIR/docker/ci-binaries-packaging.Dockerfile"
-      --destination "$CI_REGISTRY_IMAGE/conduit:$CI_COMMIT_TAG"
-      --destination "$CI_REGISTRY_IMAGE/conduit:$CI_COMMIT_TAG-alpine"
-      --destination "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:$CI_COMMIT_TAG"
-      --destination "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:$CI_COMMIT_TAG-alpine"
-  rules:
-    - if: '$CI_COMMIT_TAG'
-
-
-build:docker:new-way-of-building:
   stage: "build docker image"
   image: jdrouet/docker-with-buildx:stable
   tags: ["docker"]
@@ -301,32 +135,76 @@ build:docker:new-way-of-building:
     - docker:dind
   needs:
     - "build:release:cargo:x86_64-unknown-linux-musl"
-  rules:
+    - "build:release:cargo:arm-unknown-linux-musleabihf"
-    - if: '$CI_COMMIT_BRANCH == "master"'
+    - "build:release:cargo:armv7-unknown-linux-musleabihf"
-    - if: '$CI_COMMIT_BRANCH == "next"'
+    - "build:release:cargo:aarch64-unknown-linux-musl"
-    # TODO: Remove this after debugging
-    - if: '$CI_COMMIT_BRANCH == "multiarch-docker-support"'
   variables:
     DOCKER_HOST: tcp://docker:2375/
     DOCKER_TLS_CERTDIR: ""
     DOCKER_DRIVER: overlay2
-    # PLATFORMS: "linux/arm/v7,linux/arm64/v8,linux/amd64"
+    PLATFORMS: "linux/arm/v6,linux/arm/v7,linux/arm64,linux/amd64"
-    PLATFORMS: "linux/amd64"
-    IMAGE_TAG: "$CI_REGISTRY_IMAGE/debug-conduit:multiarch-test-dont-use-yet"
     DOCKER_FILE: "docker/ci-binaries-packaging.Dockerfile"
+  cache:
+    paths:
+      - docker_cache
+    key: "$CI_JOB_NAME"
   before_script:
     - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
+    # Only log in to Dockerhub if the credentials are given:
+    - if [ -n "${DOCKER_HUB}" ]; then docker login -u "$DOCKER_HUB_USER" -p "$DOCKER_HUB_PASSWORD" "$DOCKER_HUB"; fi
   script:
     # Prepare buildx to build multiarch stuff:
     - docker context create 'ci-context'
     - docker buildx create --name 'multiarch-builder' --use 'ci-context'
     # Copy binaries to their docker arch path
     - mkdir -p linux/ && mv ./conduit-x86_64-unknown-linux-musl linux/amd64
-    # Actually build multiarch image:
+    - mkdir -p linux/arm/ && mv ./conduit-arm-unknown-linux-musleabihf linux/arm/v6
-    - docker buildx build --push --platform $PLATFORMS --tag $IMAGE_TAG --file $DOCKER_FILE .
+    - mkdir -p linux/arm/ && mv ./conduit-armv7-unknown-linux-musleabihf linux/arm/v7
+    - mv ./conduit-aarch64-unknown-linux-musl linux/arm64
+    - 'export CREATED=$(date -u +''%Y-%m-%dT%H:%M:%SZ'') && echo "Docker image creation date: $CREATED"'
+    # Build and push image:
+    - >
+      docker buildx build
+      --pull
+      --push
+      --cache-from=type=local,src=$CI_PROJECT_DIR/docker_cache
+      --cache-to=type=local,dest=$CI_PROJECT_DIR/docker_cache
+      --build-arg CREATED=$CREATED
+      --build-arg VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml)
+      --build-arg "GIT_REF=$CI_COMMIT_SHORT_SHA"
+      --platform "$PLATFORMS"
+      --tag "$TAG"
+      --tag "$TAG-alpine"
+      --tag "$TAG-commit-$CI_COMMIT_SHORT_SHA"
+      --file "$DOCKER_FILE" .
 
+docker:next:gitlab:
+  extends: .docker-shared-settings
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "next"'
+  variables:
+    TAG: "$CI_REGISTRY_IMAGE/matrix-conduit:next"
 
+docker:next:dockerhub:
+  extends: .docker-shared-settings
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "next" && $DOCKER_HUB'
+  variables:
+    TAG: "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:next"
 
+docker:master:gitlab:
+  extends: .docker-shared-settings
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "master"'
+  variables:
+    TAG: "$CI_REGISTRY_IMAGE/matrix-conduit:latest"
+
+docker:master:dockerhub:
+  extends: .docker-shared-settings
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "master" && $DOCKER_HUB'
+  variables:
+    TAG: "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:latest"
 
 # --------------------------------------------------------------------- #
 #  Run tests                                                            #
@@ -348,13 +226,20 @@ test:cargo:
   before_script:
     - mkdir -p $CARGO_HOME && echo "using $CARGO_HOME to cache cargo deps"
     - apt-get update -yqq
-    - apt-get install -yqq --no-install-recommends build-essential libssl-dev pkg-config
+    - apt-get install -yqq --no-install-recommends build-essential libssl-dev pkg-config wget
     - rustup component add clippy rustfmt
+    - wget "https://faulty-storage.de/gitlab-report"
+    - chmod +x ./gitlab-report
   script:
     - rustc --version && cargo --version # Print version info for debugging
     - cargo fmt --all -- --check
-    - cargo test --workspace --verbose --locked
+    - "cargo test --color always --workspace --verbose --locked --no-fail-fast -- -Z unstable-options --format json | ./gitlab-report -p test > $CI_PROJECT_DIR/report.xml"
-    - cargo clippy
+    - "cargo clippy --color always --verbose --message-format=json | ./gitlab-report -p clippy > $CI_PROJECT_DIR/gl-code-quality-report.json"
+  artifacts:
+    when: always
+    reports:
+      junit: report.xml
+      codequality: gl-code-quality-report.json
 
 test:sytest:
   stage: "test"
@@ -377,7 +262,7 @@ test:sytest:
   script:
     - "SYTEST_EXIT_CODE=0"
     - "/bootstrap.sh conduit || SYTEST_EXIT_CODE=1"
-    - "perl /sytest/tap-to-junit-xml.pl --puretap --input /logs/results.tap --output $CI_PROJECT_DIR/sytest.xml \"Sytest\" && cp /logs/results.tap $CI_PROJECT_DIR/results.tap"
+    - 'perl /sytest/tap-to-junit-xml.pl --puretap --input /logs/results.tap --output $CI_PROJECT_DIR/sytest.xml "Sytest" && cp /logs/results.tap $CI_PROJECT_DIR/results.tap'
     - "exit $SYTEST_EXIT_CODE"
   artifacts:
     when: always
@@ -387,7 +272,6 @@ test:sytest:
     reports:
       junit: "$CI_PROJECT_DIR/sytest.xml"
 
-
 # --------------------------------------------------------------------- #
 #  Store binaries as package so they have download urls                 #
 # --------------------------------------------------------------------- #
@@ -395,25 +279,50 @@ test:sytest:
 publish:package:
   stage: "upload artifacts"
   needs:
-    - "build:release:cargo:x86_64-unknown-linux-gnu"
-    - "build:release:cargo:armv7-unknown-linux-gnueabihf"
-    - "build:release:cargo:aarch64-unknown-linux-gnu"
     - "build:release:cargo:x86_64-unknown-linux-musl"
-    - "build:cargo-deb:x86_64-unknown-linux-gnu"
+    - "build:release:cargo:arm-unknown-linux-musleabihf"
+    - "build:release:cargo:armv7-unknown-linux-musleabihf"
+    - "build:release:cargo:aarch64-unknown-linux-musl"
+  #    - "build:cargo-deb:x86_64-unknown-linux-gnu"
   rules:
     - if: '$CI_COMMIT_BRANCH == "master"'
     - if: '$CI_COMMIT_BRANCH == "next"'
-    - if: '$CI_COMMIT_TAG'
+    - if: "$CI_COMMIT_TAG"
   image: curlimages/curl:latest
   tags: ["docker"]
   variables:
     GIT_STRATEGY: "none" # Don't need a clean copy of the code, we just operate on artifacts
   script:
     - 'BASE_URL="${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/conduit-${CI_COMMIT_REF_SLUG}/build-${CI_PIPELINE_ID}"'
-    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-x86_64-unknown-linux-gnu "${BASE_URL}/conduit-x86_64-unknown-linux-gnu"'
-    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-armv7-unknown-linux-gnueabihf "${BASE_URL}/conduit-armv7-unknown-linux-gnueabihf"'
-    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-aarch64-unknown-linux-gnu "${BASE_URL}/conduit-aarch64-unknown-linux-gnu"'
     - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-x86_64-unknown-linux-musl "${BASE_URL}/conduit-x86_64-unknown-linux-musl"'
-    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-x86_64-unknown-linux-gnu.deb "${BASE_URL}/conduit-x86_64-unknown-linux-gnu.deb"'
+    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-arm-unknown-linux-musleabihf "${BASE_URL}/conduit-arm-unknown-linux-musleabihf"'
+    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-armv7-unknown-linux-musleabihf "${BASE_URL}/conduit-armv7-unknown-linux-musleabihf"'
+    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-aarch64-unknown-linux-musl "${BASE_URL}/conduit-aarch64-unknown-linux-musl"'
 
+pages:
+  stage: deploy
+  image: rust
+  variables:
+    CARGO_HOME: $CI_PROJECT_DIR/cargo
+  before_script:
+    - export PATH="$PATH:$CARGO_HOME/bin"
+    - mdbook --version || cargo install mdbook
+  script:
+    - mdbook build -d public
+  rules:
+    - if: '$CI_COMMIT_REF_NAME == "master"'
+  artifacts:
+    paths:
+      - public
+  cache:
+    paths:
+      - $CARGO_HOME/bin
 
+# Avoid duplicate pipelines
+# See: https://docs.gitlab.com/ee/ci/yaml/workflow.html#switch-between-branch-pipelines-and-merge-request-pipelines
+workflow:
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: "$CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS"
+      when: never
+    - if: "$CI_COMMIT_BRANCH"

Cargo.lock

@@ -245,6 +245,7 @@ dependencies = [
  "crossbeam",
  "directories",
  "heed",
+ "hmac",
  "http",
  "image",
  "jsonwebtoken",
@@ -266,6 +267,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yaml",
+ "sha-1",
  "sled",
  "thiserror",
  "thread_local",
@@ -428,6 +430,16 @@ dependencies = [
  "lazy_static",
 ]
 
+[[package]]
+name = "crypto-mac"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1d1a86f49236c215f271d40892d5fc950490551400b02ef360692c29815c714"
+dependencies = [
+ "generic-array",
+ "subtle",
+]
+
 [[package]]
 name = "curve25519-dalek"
 version = "3.2.0"
@@ -897,6 +909,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "hmac"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a2a2320eb7ec0ebe8da8f744d7812d9fc4cb4d09344ac01898dbcb6a20ae69b"
+dependencies = [
+ "crypto-mac",
+ "digest",
+]
+
 [[package]]
 name = "hostname"
 version = "0.3.1"
@@ -1968,7 +1990,7 @@ dependencies = [
 [[package]]
 name = "ruma"
 version = "0.4.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "assign",
  "js_int",
@@ -1989,7 +2011,7 @@ dependencies = [
 [[package]]
 name = "ruma-api"
 version = "0.18.5"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "bytes",
  "http",
@@ -2005,7 +2027,7 @@ dependencies = [
 [[package]]
 name = "ruma-api-macros"
 version = "0.18.5"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2016,7 +2038,7 @@ dependencies = [
 [[package]]
 name = "ruma-appservice-api"
 version = "0.4.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "ruma-api",
  "ruma-common",
@@ -2030,7 +2052,7 @@ dependencies = [
 [[package]]
 name = "ruma-client-api"
 version = "0.12.3"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "assign",
  "bytes",
@@ -2050,7 +2072,7 @@ dependencies = [
 [[package]]
 name = "ruma-common"
 version = "0.6.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "indexmap",
  "js_int",
@@ -2065,7 +2087,7 @@ dependencies = [
 [[package]]
 name = "ruma-events"
 version = "0.24.6"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "indoc",
  "js_int",
@@ -2081,7 +2103,7 @@ dependencies = [
 [[package]]
 name = "ruma-events-macros"
 version = "0.24.6"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2092,7 +2114,7 @@ dependencies = [
 [[package]]
 name = "ruma-federation-api"
 version = "0.3.1"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "js_int",
  "ruma-api",
@@ -2107,7 +2129,7 @@ dependencies = [
 [[package]]
 name = "ruma-identifiers"
 version = "0.20.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "paste",
  "percent-encoding",
@@ -2122,7 +2144,7 @@ dependencies = [
 [[package]]
 name = "ruma-identifiers-macros"
 version = "0.20.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "quote",
  "ruma-identifiers-validation",
@@ -2132,7 +2154,7 @@ dependencies = [
 [[package]]
 name = "ruma-identifiers-validation"
 version = "0.5.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "thiserror",
 ]
@@ -2140,7 +2162,7 @@ dependencies = [
 [[package]]
 name = "ruma-identity-service-api"
 version = "0.3.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "js_int",
  "ruma-api",
@@ -2153,7 +2175,7 @@ dependencies = [
 [[package]]
 name = "ruma-push-gateway-api"
 version = "0.3.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "js_int",
  "ruma-api",
@@ -2168,7 +2190,7 @@ dependencies = [
 [[package]]
 name = "ruma-serde"
 version = "0.5.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "bytes",
  "form_urlencoded",
@@ -2182,7 +2204,7 @@ dependencies = [
 [[package]]
 name = "ruma-serde-macros"
 version = "0.5.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2193,7 +2215,7 @@ dependencies = [
 [[package]]
 name = "ruma-signatures"
 version = "0.9.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "base64 0.13.0",
  "ed25519-dalek",
@@ -2210,7 +2232,7 @@ dependencies = [
 [[package]]
 name = "ruma-state-res"
 version = "0.4.1"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "itertools 0.10.1",
  "js_int",
@@ -2422,6 +2444,19 @@ dependencies = [
  "yaml-rust",
 ]
 
+[[package]]
+name = "sha-1"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99cd6713db3cf16b6c84e06321e049a9b9f699826e16096d23bbcc44d15d51a6"
+dependencies = [
+ "block-buffer",
+ "cfg-if 1.0.0",
+ "cpufeatures",
+ "digest",
+ "opaque-debug",
+]
+
 [[package]]
 name = "sha1"
 version = "0.6.0"

Cargo.toml

@@ -19,7 +19,7 @@ rocket = { version = "0.5.0-rc.1", features = ["tls"] } # Used to handle request
 
 # Used for matrix spec type definitions and helpers
 #ruma = { version = "0.4.0", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-pre-spec", "unstable-exhaustive-types"] }
-ruma = { git = "https://github.com/ruma/ruma", rev = "58cdcae1f9a8f4824bcbec1de1bb13e659c66804", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-pre-spec", "unstable-exhaustive-types"] }
+ruma = { git = "https://github.com/ruma/ruma", rev = "e7f01ca55a1eff437bad754bf0554cc09f44ec2a", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-pre-spec", "unstable-exhaustive-types"] }
 #ruma = { git = "https://github.com/timokoesters/ruma", rev = "50c1db7e0a3a21fc794b0cce3b64285a4c750c71", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-pre-spec", "unstable-exhaustive-types"] }
 #ruma = { path = "../ruma/crates/ruma", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-pre-spec", "unstable-exhaustive-types"] }
 
@@ -79,6 +79,9 @@ num_cpus = "1.13.0"
 threadpool = "1.8.1"
 heed = { git = "https://github.com/timokoesters/heed.git", rev = "f6f825da7fb2c758867e05ad973ef800a6fe1d5d", optional = true }
 thread_local = "1.1.3"
+# used for TURN server authentication
+hmac = "0.11.0"
+sha-1 = "0.9.8"
 
 [features]
 default = ["conduit_bin", "backend_sqlite"]
@@ -120,13 +123,12 @@ maintainer-scripts = "debian/"
 systemd-units = { unit-name = "matrix-conduit" }
 
 [profile.dev]
-lto = 'thin'
+lto = 'off'
 incremental = true
 
 [profile.release]
 lto = 'thin'
 incremental = true
-
 codegen-units=32
 # If you want to make flamegraphs, enable debug info:
 # debug = true

DEPLOY.md

@@ -2,25 +2,27 @@
 
 ## Getting help
 
-If you run into any problems while setting up Conduit, write an email to `timo@koesters.xyz`, ask us in `#conduit:matrix.org` or [open an issue on GitLab](https://gitlab.com/famedly/conduit/-/issues/new).
+If you run into any problems while setting up Conduit, write an email to `timo@koesters.xyz`, ask us
+in `#conduit:matrix.org` or [open an issue on GitLab](https://gitlab.com/famedly/conduit/-/issues/new).
 
 ## Installing Conduit
 
+Although you might be able to compile Conduit for Windows, we do recommend running it on a linux server. We therefore
+only offer Linux binaries.
+
 You may simply download the binary that fits your machine. Run `uname -m` to see what you need. Now copy the right url:
 
-| CPU Architecture     | GNU (Ubuntu, Debian, ArchLinux, ...)  | MUSL (Alpine, ... )     |
+| CPU Architecture                            | Download stable version        |
-| -------------------- | ------------------------------------- | ----------------------- |
+| ------------------------------------------- | ------------------------------ |
-| x84_64 / amd64       | [Download][x84_64-gnu]                | [Download][x84_64-musl] |
+| x84_64 / amd64 (Most servers and computers) | [Download][x84_64-musl-master] |
-| armv7 (Raspberry Pi) | [Download][armv7-gnu]                 | -                       |
+| armv6                                       | [Download][armv6-musl-master]  |
-| armv8 / aarch64      | [Download][armv8-gnu]                 | -                       |
+| armv7 (e.g. Raspberry Pi by default)        | [Download][armv7-musl-master]  |
+| armv8 / aarch64                             | [Download][armv8-musl-master]  |
 
-[x84_64-gnu]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-x86_64-unknown-linux-gnu?job=build:release:cargo:x86_64-unknown-linux-gnu
+[x84_64-musl-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-x86_64-unknown-linux-musl?job=build:release:cargo:x86_64-unknown-linux-musl
-
+[armv6-musl-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-arm-unknown-linux-musleabihf?job=build:release:cargo:arm-unknown-linux-musleabihf
-[x84_64-musl]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-x86_64-unknown-linux-musl?job=build:release:cargo:x86_64-unknown-linux-musl
+[armv7-musl-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-armv7-unknown-linux-musleabihf?job=build:release:cargo:armv7-unknown-linux-musleabihf
-
+[armv8-musl-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-aarch64-unknown-linux-musl?job=build:release:cargo:aarch64-unknown-linux-musl
-[armv7-gnu]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-armv7-unknown-linux-gnueabihf?job=build:release:cargo:armv7-unknown-linux-gnueabihf
-
-[armv8-gnu]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-aarch64-unknown-linux-gnu?job=build:release:cargo:aarch64-unknown-linux-gnu
 
 ```bash
 $ sudo wget -O /usr/local/bin/matrix-conduit <url>
@@ -32,15 +34,15 @@ Alternatively, you may compile the binary yourself using
 ```bash
 $ cargo build --release
 ```
+
 Note that this currently requires Rust 1.50.
 
 If you want to cross compile Conduit to another architecture, read the [Cross-Compile Guide](CROSS_COMPILE.md).
 
-
 ## Adding a Conduit user
 
-While Conduit can run as any user it is usually better to use dedicated users for different services.
+While Conduit can run as any user it is usually better to use dedicated users for different services. This also allows
-This also allows you to make sure that the file permissions are correctly set up.
+you to make sure that the file permissions are correctly set up.
 
 In Debian you can use this command to create a Conduit user:
 
@@ -50,9 +52,8 @@ sudo adduser --system conduit --no-create-home
 
 ## Setting up a systemd service
 
-Now we'll set up a systemd service for Conduit, so it's easy to start/stop
+Now we'll set up a systemd service for Conduit, so it's easy to start/stop Conduit and set it to autostart when your
-Conduit and set it to autostart when your server reboots. Simply paste the
+server reboots. Simply paste the default systemd service you can find below into
-default systemd service you can find below into
 `/etc/systemd/system/conduit.service`.
 
 ```systemd
@@ -77,10 +78,10 @@ Finally, run
 $ sudo systemctl daemon-reload
 ```
 
-
 ## Creating the Conduit configuration file
 
-Now we need to create the Conduit's config file in `/etc/matrix-conduit/conduit.toml`. Paste this in **and take a moment to read it. You need to change at least the server name.**
+Now we need to create the Conduit's config file in `/etc/matrix-conduit/conduit.toml`. Paste this in **and take a moment
+to read it. You need to change at least the server name.**
 
 ```toml
 [global]
@@ -128,8 +129,8 @@ address = "127.0.0.1" # This makes sure Conduit can only be reached using the re
 
 ## Setting the correct file permissions
 
-As we are using a Conduit specific user we need to allow it to read the config.
+As we are using a Conduit specific user we need to allow it to read the config. To do that you can run this command on
-To do that you can run this command on Debian:
+Debian:
 
 ```bash
 sudo chown -R conduit:nogroup /etc/matrix-conduit
@@ -142,7 +143,6 @@ sudo mkdir -p /var/lib/matrix-conduit/conduit_db
 sudo chown -R conduit:nogroup /var/lib/matrix-conduit/conduit_db
 ```
 
-
 ## Setting up the Reverse Proxy
 
 This depends on whether you use Apache, Nginx or another web server.
@@ -171,11 +171,9 @@ ProxyPassReverse /_matrix/ http://127.0.0.1:6167/_matrix/
 $ sudo systemctl reload apache2
 ```
 
-
 ### Nginx
 
-If you use Nginx and not Apache, add the following server section inside the
+If you use Nginx and not Apache, add the following server section inside the http section of `/etc/nginx/nginx.conf`
-http section of `/etc/nginx/nginx.conf`
 
 ```nginx
 server {
@@ -198,13 +196,13 @@ server {
     include /etc/letsencrypt/options-ssl-nginx.conf;
 }
 ```
+
 **You need to make some edits again.** When you are done, run
 
 ```bash
 $ sudo systemctl reload nginx
 ```
 
-
 ## SSL Certificate
 
 The easiest way to get an SSL certificate, if you don't have one already, is to install `certbot` and run this:
@@ -213,7 +211,6 @@ The easiest way to get an SSL certificate, if you don't have one already, is to
 $ sudo certbot -d your.server.name
 ```
 
-
 ## You're done!
 
 Now you can start Conduit with:

Dockerfile

@@ -1,7 +1,10 @@
 # syntax=docker/dockerfile:1
-FROM rust:1.53-alpine as builder
+FROM docker.io/rust:1.53-alpine AS builder
 WORKDIR /usr/src/conduit
 
+# Install required packages to build Conduit and it's dependencies
+RUN apk add musl-dev
+
 # == Build dependencies without our own code separately for caching ==
 #
 # Need a fake main.rs since Cargo refuses to build anything otherwise.
@@ -9,44 +12,71 @@ WORKDIR /usr/src/conduit
 # See https://github.com/rust-lang/cargo/issues/2644 for a Cargo feature
 # request that would allow just dependencies to be compiled, presumably
 # regardless of whether source files are available.
-RUN mkdir src && echo 'fn main() {}' > src/main.rs
+RUN mkdir src && touch src/lib.rs && echo 'fn main() {}' > src/main.rs
 COPY Cargo.toml Cargo.lock ./
-RUN cargo build
+RUN cargo build --release && rm -r src
-# TODO: RUN cargo build --release
 
-# == Actual build ==
+# Copy over actual Conduit sources
-RUN rm -r src
 COPY src src
-# main.rs has to have its timestamp updated for this to work correctly since
+
+# main.rs and lib.rs need their timestamp updated for this to work correctly since
 # otherwise the build with the fake main.rs from above is newer than the
 # source files (COPY preserves timestamps).
-RUN touch src/main.rs
+#
-
+# Builds conduit and places the binary at /usr/src/conduit/target/release/conduit
-RUN cargo install --path .
+RUN touch src/main.rs && touch src/lib.rs && cargo build --release
-# TODO: RUN cargo install --release --path . 
 
 
-# This build stage is going to be run later
-FROM alpine:3.14
 
-# Install packages needed to run Conduit
+
+# ---------------------------------------------------------------------------------------------------------------
+# Stuff below this line actually ends up in the resulting docker image
+# ---------------------------------------------------------------------------------------------------------------
+FROM docker.io/alpine:3.14 AS runner
+
+# Standard port on which Conduit launches.
+# You still need to map the port when using the docker command or docker-compose.
+EXPOSE 6167
+
+# Note from @jfowl: I would like to remove this in the future and just have the Docker version be configured with envs. 
+ENV CONDUIT_CONFIG="/srv/conduit/conduit.toml"
+
+# Conduit needs:
+#   ca-certificates: for https
+#   libgcc: Apparently this is needed, even if I (@jfowl) don't know exactly why. But whatever, it's not that big.
 RUN apk add --no-cache \
         ca-certificates \
         curl \
         libgcc
 
-# Prepare path for database and media files
+
+# Created directory for the database and media files
 RUN mkdir -p /srv/conduit/.local/share/conduit
 
-# TODO: Change ? or maybe leave it like that
+# Test if Conduit is still alive, uses the same endpoint as Element
-RUN mkdir -p /srv/conduit/.local/share/conduit
+COPY ./docker/healthcheck.sh /srv/conduit/healthcheck.sh
-COPY --from=builder /usr/local/cargo/bin/conduit /srv/conduit/
+HEALTHCHECK --start-period=5s --interval=5s CMD ./healthcheck.sh
 
-# TODO: Check if we don't want to just use ENVs for running condit in docker
+# Copy over the actual Conduit binary from the builder stage
-ENV CONDUIT_CONFIG="/srv/conduit/conduit.toml"
+COPY --from=builder /usr/src/conduit/target/release/conduit /srv/conduit/conduit
 
-# TODO: not needed, but documents it?
+# Improve security: Don't run stuff as root, that does not need to run as root:
-EXPOSE 6167
+# Add www-data user and group with UID 82, as used by alpine
+# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install
+RUN set -x ; \
+    addgroup -Sg 82 www-data 2>/dev/null ; \
+    adduser -S -D -H -h /srv/conduit -G www-data -g www-data www-data 2>/dev/null ; \
+    addgroup www-data www-data 2>/dev/null && exit 0 ; exit 1
 
+# Change ownership of Conduit files to www-data user and group
+RUN chown -cR www-data:www-data /srv/conduit
+RUN chmod +x /srv/conduit/healthcheck.sh
+
+# Change user to www-data
+USER www-data
+# Set container home directory
 WORKDIR /srv/conduit
+
+# Run Conduit and print backtraces on panics
+ENV RUST_BACKTRACE=1
 ENTRYPOINT [ "/srv/conduit/conduit" ]

book.toml

@@ -0,0 +1,16 @@
+[book]
+title = "Conduit Docs"
+author = "The Conduit contributors"
+description = "Conduit is a simple, fast and reliable chat server for the Matrix protocol"
+language = "en"
+src = "docs"
+
+[rust]
+edition = "2018"
+
+[build]
+build-dir = "public"
+create-missing = true
+
+[output.html.search]
+limit-results = 15

docker/README.md

@@ -2,38 +2,22 @@
 
 > **Note:** To run and use Conduit you should probably use it with a Domain or Subdomain behind a reverse proxy (like Nginx, Traefik, Apache, ...) with a Lets Encrypt certificate.
 
-
 ## Docker
 
 ### Build & Dockerfile
 
 The Dockerfile provided by Conduit has two stages, each of which creates an image.
+
 1. **Builder:** Builds the binary from local context or by cloning a git revision from the official repository.
-2. **Runtime:** Copies the built binary from **Builder** and sets up the runtime environment, like creating a volume to persist the database and applying the correct permissions.
+2. **Runner:** Copies the built binary from **Builder** and sets up the runtime environment, like creating a volume to persist the database and applying the correct permissions.
-
-The Dockerfile includes a few build arguments that should be supplied when building it.
-
-``` Dockerfile
-ARG LOCAL=false
-ARG CREATED
-ARG VERSION
-ARG GIT_REF=origin/master
-```
-
-- **CREATED:** Date and time as string (date-time as defined by RFC 3339). Will be used to create the Open Container Initiative compliant label `org.opencontainers.image.created`. Supply by it like this `$(date -u +'%Y-%m-%dT%H:%M:%SZ')`
-- **VERSION:** The SemVer version of Conduit, which is in the image. Will be used to create the Open Container Initiative compliant label `org.opencontainers.image.version`. If you have a `Cargo.toml` in your build context, you can get it with `$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml)`
-- **LOCAL:** *(Optional)* A boolean value, specifies if the local build context should be used, or if the official repository will be cloned. If not supplied with the build command, it will default to `false`.
-- **GIT_REF:** *(Optional)* A git ref, like `HEAD` or a commit ID. The supplied ref will be used to create the Open Container Initiative compliant label `org.opencontainers.image.revision` and will be the ref that is cloned from the repository when not building from the local context. If not supplied with the build command, it will default to `origin/master`.
 
 To build the image you can use the following command
 
 ```bash
-docker build . -t matrixconduit/matrix-conduit:latest --build-arg CREATED=$(date -u +'%Y-%m-%dT%H:%M:%SZ') --build-arg VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml)
+docker build --tag matrixconduit/matrix-conduit:latest .
 ```
 
 which also will tag the resulting image as `matrixconduit/matrix-conduit:latest`.
-**Note:** it ommits the two optional `build-arg`s.
-
 
 ### Run
 
@@ -46,9 +30,13 @@ docker run -d -p 8448:6167 -v ~/conduit.toml:/srv/conduit/conduit.toml -v db:/sr
 or you can skip the build step and pull the image from one of the following registries:
 
 | Registry        | Image                                                           | Size                  |
-| --------------- | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
+| --------------- | --------------------------------------------------------------- | --------------------- |
-| Docker Hub      | [matrixconduit/matrix-conduit:latest](https://hub.docker.com/r/matrixconduit/matrix-conduit)                        | ![Image Size](https://img.shields.io/docker/image-size/matrixconduit/matrix-conduit/latest) |
+| Docker Hub      | [matrixconduit/matrix-conduit:latest][dh]                       | ![Image Size][shield] |
-| GitLab Registry | [registry.gitlab.com/famedly/conduit/conduit:latest](https://gitlab.com/famedly/conduit/container_registry/2134341) | ![Image Size](https://img.shields.io/docker/image-size/matrixconduit/matrix-conduit/latest) |
+| GitLab Registry | [registry.gitlab.com/famedly/conduit/matrix-conduit:latest][gl] | ![Image Size][shield] |
+
+[dh]: https://hub.docker.com/r/matrixconduit/matrix-conduit
+[gl]: https://gitlab.com/famedly/conduit/container_registry/
+[shield]: https://img.shields.io/docker/image-size/matrixconduit/matrix-conduit/latest
 
 The `-d` flag lets the container run in detached mode. You now need to supply a `conduit.toml` config file, an example can be found [here](../conduit-example.toml).
 You can pass in different env vars to change config values on the fly. You can even configure Conduit completely by using env vars, but for that you need
@@ -56,23 +44,20 @@ to pass `-e CONDUIT_CONFIG=""` into your container. For an overview of possible
 
 If you just want to test Conduit for a short time, you can use the `--rm` flag, which will clean up everything related to your container after you stop it.
 
-
 ## Docker-compose
 
 If the docker command is not for you or your setup, you can also use one of the provided `docker-compose` files. Depending on your proxy setup, use the [`docker-compose.traefik.yml`](docker-compose.traefik.yml) and [`docker-compose.override.traefik.yml`](docker-compose.override.traefik.yml) for Traefik (don't forget to remove `.traefik` from the filenames) or the normal [`docker-compose.yml`](../docker-compose.yml) for every other reverse proxy. Additional info about deploying
 Conduit can be found [here](../DEPLOY.md).
 
-
 ### Build
 
 To build the Conduit image with docker-compose, you first need to open and modify the `docker-compose.yml` file. There you need to comment the `image:` option and uncomment the `build:` option. Then call docker-compose with:
 
 ```bash
-CREATED=$(date -u +'%Y-%m-%dT%H:%M:%SZ') VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml) docker-compose up
+docker-compose up
 ```
 
-This will also start the container right afterwards, so if want it to run in detached mode, you also should use the `-d` flag. For possible `build-args`, please take a look at the above `Build & Dockerfile` section.
+This will also start the container right afterwards, so if want it to run in detached mode, you also should use the `-d` flag.
-
 
 ### Run
 
@@ -101,7 +86,9 @@ So...step by step:
 3. Create the `conduit.toml` config file, an example can be found [here](../conduit-example.toml), or set `CONDUIT_CONFIG=""` and configure Conduit per env vars.
 4. Uncomment the `element-web` service if you want to host your own Element Web Client and create a `element_config.json`.
 5. Create the files needed by the `well-known` service.
+
    - `./nginx/matrix.conf` (relative to the compose file, you can change this, but then also need to change the volume mapping)
+
      ```nginx
      server {
          server_name <SUBDOMAIN>.<DOMAIN>;
@@ -114,6 +101,7 @@ So...step by step:
          }
      }
      ```
+
    - `./nginx/www/.well-known/matrix/client` (relative to the compose file, you can change this, but then also need to change the volume mapping)
      ```json
      {
@@ -128,5 +116,6 @@ So...step by step:
        "m.server": "<SUBDOMAIN>.<DOMAIN>:443"
      }
      ```
+
 6. Run `docker-compose up -d`
 7. Connect to your homeserver with your preferred client and create a user. You should do this immediatly after starting Conduit, because the first created user is the admin.

docker/ci-binaries-packaging.Dockerfile

@@ -8,20 +8,26 @@
 # Credit's for the original Dockerfile: Weasy666.
 # ---------------------------------------------------------------------------------------------------------
 
-FROM alpine:3.14
+FROM docker.io/alpine:3.14 AS runner
 
-# Install packages needed to run Conduit
+# Standard port on which Conduit launches.
+# You still need to map the port when using the docker command or docker-compose.
+EXPOSE 6167
+
+# Note from @jfowl: I would like to remove this in the future and just have the Docker version be configured with envs. 
+ENV CONDUIT_CONFIG="/srv/conduit/conduit.toml"
+
+# Conduit needs:
+#   ca-certificates: for https
+#   libgcc: Apparently this is needed, even if I (@jfowl) don't know exactly why. But whatever, it's not that big.
 RUN apk add --no-cache \
         ca-certificates \
-        curl \
         libgcc
 
+
 ARG CREATED
 ARG VERSION
 ARG GIT_REF
-
-ENV CONDUIT_CONFIG="/srv/conduit/conduit.toml"
-
 # Labels according to https://github.com/opencontainers/image-spec/blob/master/annotations.md
 # including a custom label specifying the build command
 LABEL org.opencontainers.image.created=${CREATED} \
@@ -37,23 +43,21 @@ LABEL org.opencontainers.image.created=${CREATED} \
       org.opencontainers.image.documentation="https://gitlab.com/famedly/conduit" \
       org.opencontainers.image.ref.name=""
 
-# Standard port on which Conduit launches. You still need to map the port when using the docker command or docker-compose.
+# Created directory for the database and media files
-EXPOSE 6167
-
-# create data folder for database
 RUN mkdir -p /srv/conduit/.local/share/conduit
 
 # Test if Conduit is still alive, uses the same endpoint as Element
-COPY ./docker/healthcheck.sh /srv/conduit/
+COPY ./docker/healthcheck.sh /srv/conduit/healthcheck.sh
-HEALTHCHECK --start-period=5s --interval=60s CMD ./healthcheck.sh
+HEALTHCHECK --start-period=5s --interval=5s CMD ./healthcheck.sh
 
-# Copy the Conduit binary into the image at the latest possible moment to maximise caching:
 
-# depending on the target platform (e.g. "linux/arm/v7", "linux/arm64/v8", or "linux/amd64")
+# Depending on the target platform (e.g. "linux/arm/v7", "linux/arm64/v8", or "linux/amd64")
 # copy the matching binary into this docker image
 ARG TARGETPLATFORM
 COPY ./$TARGETPLATFORM /srv/conduit/conduit
 
+
+# Improve security: Don't run stuff as root, that does not need to run as root:
 # Add www-data user and group with UID 82, as used by alpine
 # https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install
 RUN set -x ; \
@@ -65,9 +69,11 @@ RUN set -x ; \
 RUN chown -cR www-data:www-data /srv/conduit
 RUN chmod +x /srv/conduit/healthcheck.sh
 
-# Set user to www-data
+# Change user to www-data
 USER www-data
 # Set container home directory
 WORKDIR /srv/conduit
-# Run Conduit
+
+# Run Conduit and print backtraces on panics
+ENV RUST_BACKTRACE=1
 ENTRYPOINT [ "/srv/conduit/conduit" ]

docker/healthcheck.sh

@@ -7,7 +7,7 @@ fi
 
 # The actual health check.
 # We try to first get a response on HTTP and when that fails on HTTPS and when that fails, we exit with code 1.
-# TODO: Change this to a single curl call. Do we have a config value that we can check for that?
+# TODO: Change this to a single wget call. Do we have a config value that we can check for that?
-curl --fail -s "http://localhost:${CONDUIT_PORT}/_matrix/client/versions" || \
+wget --no-verbose --tries=1 --spider "http://localhost:${CONDUIT_PORT}/_matrix/client/versions" || \
-    curl -k --fail -s "https://localhost:${CONDUIT_PORT}/_matrix/client/versions" || \
+    wget --no-verbose --tries=1 --spider "https://localhost:${CONDUIT_PORT}/_matrix/client/versions" || \
     exit 1

docs/SUMMARY.md

@@ -0,0 +1,10 @@
+# Conduit Matrix Server
+
+[Introduction](index.md)
+
+- [Setup](setup.md)
+  - [Domain](setup/domain.md)
+  - [Installation](installation.md)
+    - [Binary](setup/installation/binary.md)
+    - [Docker](setup/installation/docker.md)
+  - [Configuration](setup/configuration-options.md)

docs/index.md

@@ -0,0 +1,29 @@
+## What is Conduit?
+
+**Conduit** is an efficient Matrix homeserver written in [Rust](https://rust-lang.org), that's easy to set up and just works.
+You can install it on a mini-computer like the Raspberry Pi to host Matrix for your family, friends or company.
+
+## Setup your own Conduit
+
+1. [Choose your domain](setup/domain.md)
+2. Choose your deployment type
+   - Binary
+   - Docker
+3. Configuration your Conduit
+   - Environment variables
+   - Config file
+
+## Donate
+
+- Liberapay: <https://liberapay.com/timokoesters/>\
+- Bitcoin: `bc1qnnykf986tw49ur7wx9rpw2tevpsztvar5x8w4n`
+
+## Contribute
+
+See [the git repository](https://gitlab.com/famedly/conduit/) for more info on how to work on Conduit's code.
+
+## Licenses
+
+Conduit's code and documentation is licensed under the [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0).
+
+The [lightning bolt logo](https://github.com/mozilla/fxemoji/blob/gh-pages/svgs/nature/u26A1-bolt.svg) is licensed under [Creative Commons Attribution 4.0 International (CC BY 4.0)](https://github.com/mozilla/fxemoji/blob/gh-pages/LICENSE.md)

docs/installation.md

@@ -0,0 +1 @@
+# Installation

docs/setup.md

@@ -0,0 +1 @@
+# Setup

docs/setup/configuration-options.md

@@ -0,0 +1,226 @@
+# Configuring Conduit
+
+Conduit can be configured via a config file (conventionally called Conduit.toml) or environment variables.
+If a config option is set in both the config file and as an environment variable, the environment variable takes precedence.
+
+You absolutely need to set the environment variable `CONDUIT_CONFIG_FILE` to either point to a config file (
+e.g. `CONDUIT_CONFIG_FILE=/etc/conduit/Conduit.toml`) or to an empty string (`CONDUIT_CONFIG_FILE=''`) if you want to
+configure Conduit with just environment variables.
+
+---
+
+## Mandatory config options
+
+Mandatory variables must be configured in order for Conduit to run properly.
+
+### Server Name
+
+- Config file key: `server_name`
+- Envirnoment variable: `CONDUIT_SERVER_NAME`
+- Default value: _None, you will need to choose your own._
+
+The server_name is the name of this server. It is used as a suffix for user and room ids. Example: If you set it
+to `conduit.rs`, your usernames will look like `@somebody:conduit.rs`.
+
+The Conduit server needs to be reachable at https://your.server.name/ on port 443 (client-server) and 8448 (
+server-server) OR you can create /.well-known files to redirect requests. See
+the [Client-Server specs](https://matrix.org/docs/spec/client_server/latest#get-well-known-matrix-client) and
+the [Server-Server specs](https://matrix.org/docs/spec/server_server/r0.1.4#get-well-known-matrix-server) for more
+information.
+
+### Database Path
+
+- Config file key: `database_path`
+- Envirnoment variable: `CONDUIT_DATABASE_PATH`
+- Default value: _None, but many people like to use `/var/lib/conduit/`_.
+
+A **directory** where Conduit stores its database and media files. This directory must exist, have enough free space and
+be readable and writable by the user Conduit is running as.
+
+What does _enough free space_ mean? It heavily on the amount of messages your Conduit server will see and the amount and
+size of media files users on your Conduit server send. As a rule of thumb, you should have at least 10 GB of free space
+left. You should be comfortable for quite some time with 50 GB.
+
+### Port
+
+- Config file key: `port`
+- Environment variable: `CONDUIT_PORT`
+- Default value: _None, but many people like to use `6167`_.
+
+The TCP port Conduit will listen on for connections. The port needs to be free (no other program is listeing on it).
+
+Conduit does currently (2021-12) not offer HTTPS by itself. Only unencrypted HTTP requests will be accepted on this
+port. Unless you know what you are doing, this port should not be exposed to the internet. Instead, use a reverse proxy
+capable of doing TLS to offer your Conduit server to the internet via HTTPS.
+
+---
+
+## Optional configuration options
+
+These config options come with defaults and don't need to be configured for Conduit to run. That said, you should still
+check them to make sure that your Conduit server behaves like you want it to do.
+
+### Maximum request size
+
+- Config file key: `max_request_size`
+- Environment variable: `CONDUIT_MAX_REQUEST_SIZE`
+- Default value: `20_000_000` (~= 20 MB)
+
+The maximum size in bytes for incoming requests to Conduit. You can use underscores to improve readability.
+
+This will effectively limit the size for images, videos and other files users on your Conduit server can send.
+
+### Allow Registration?
+
+- Config file key: `allow_registration`
+- Environment variable: `CONDUIT_ALLOW_REGISTRATION`
+- Default value: `true`
+- Possible values: `true`, `false`
+
+It this is set to `false`, no new users can register accounts on your Conduit server. Already registered users will not
+be affected from this setting and can continue to user your server.
+
+The first user to ever register on your Conduit server will be considered the admin account and is automatically invited
+into the admin room.
+
+### Allow Encryption?
+
+- Config file key: `allow_encryption`
+- Environment variable: `CONDUIT_ALLOW_ENCRYPTION`
+- Default value: `true`
+- Possible values: `true`, `false`
+
+If this is set to `false`, Conduit disables the ability for users to create encrypted chats. Existing encrypted chats
+may continue to work.
+
+### Allow federation?
+
+- Config file key: `allow_federation`
+- Environment variable: `CONDUIT_ALLOW_FEDERATION`
+- Default value: `false`
+- Possible values: `true`, `false`
+
+Federation means that users from different Matrix servers can chat with each other. E.g. `@mathew:matrix.org` can chat
+with `@timo:conduit.rs`.
+
+If this option is set to `false`, users on your Conduit server can only talk with other users on your Conduit server.
+
+Federation with other servers needs to happen over HTTPS, so make sure you have set up a reverse proxy.
+
+You can use the [Federation Tester](https://federationtester.matrix.org/) to test your federation ability.
+
+### Jaeger Tracing
+
+- Config file key: `allow_jaeger`
+- Environment variable: `CONDUIT_ALLOW_JAEGER`
+- Default value: `false`
+- Possible values: `true`, `false`
+
+Enable Jaeger to support monitoring and troubleshooting through Jaeger.
+
+If you don't know what Jaeger is, you can safely leave this set to `false`.
+
+### Trusted servers
+
+- Config file key: `trusted_servers`
+- Environment variable: `CONDUIT_TRUSTED_SERVERS`
+- Default value: `[]`
+- Possible values: JSON-Array of server domains, e.g. `["matrix.org"]` or `["matrix.org", "conduit.rs"]`.
+
+Matrix servers have so-called "server keys", which authenticate messages from their users. Because your Conduit server
+might not know the server keys from every server it encounters, it can ask a _trusted server_ for them. This speeds
+things up for rooms with people from a lot of different servers.
+
+You should only set this to include trustworthy servers. Most people consider `["matrix.org"]` to bea good default.
+
+Only relevant if you have federation enabled.
+
+### Limit amount of concurrent requests
+
+- Config file key: `max_concurrent_requests`
+- Environment variable: `CONDUIT_MAX_CONCURRENT_REQUESTS`
+- Default value: `100`
+- Suggested values: `1` - `1000` (u16)
+
+How many requests Conduit can make at the same time. This affects federation with other Matrix servers, push
+notifications and app_services.
+
+// TODO Timo: When does it make sense to change this?
+
+### Configure logging
+
+- Config file key: `log`
+- Environment variable: `CONDUIT_LOG`
+- Default value: `info,state_res=warn,rocket=off,_=off,sled=off`
+
+Configures which kind of messages Conduit logs.
+
+> // TODO: Better and more thorough explanation
+
+### Worker threads
+
+- Config file key: `workers`
+- Environment variable: `CONDUIT_WORKERS`
+- Default value: cpu core count \* 2
+- Possible values: // TODO
+
+> // TODO: Which thing exactly threads? What not?
+
+### Listening address
+
+- Config file key: `address`
+- Environment variable: `CONDUIT_ADDRESS`
+- Default value: `127.0.0.1`
+- Possible values: Valid IP addresses.
+
+Which IP address conduit is listening on. 127.0.0.1 means that Conduit can only be accessed from the same server or
+through a reverse proxy on that server. If you want it to be accessible from any network interface (which you should
+not, because other matrix servers should talk to your Conduit via a reverse proxy and not directly), you can set it
+to `0.0.0.0`.
+
+### Database cache capacity
+
+- Config file key: `db_cache_capacity_mb`
+- Environment variable: `CONDUIT_DB_CACHE_CAPACITY_MB`
+- Default value: `200`
+- Possible values: `true`, `false`
+
+The total amount of memory (RAM) that the database cache will be able to use.
+
+> // TODO: this needs clearification: In RAM or on disk and for what exactly?
+
+### PDU cache capacity
+
+- Config file key: `pdu_cache_capacity`
+- Environment variable: `CONDUIT_PDU_CACHE_CAPACITY`
+- Default value: `100_000`
+- Suggested values: `1_000` - `1_000_000` (u32)
+
+The total capacity (read: number of items) the pdu cache can hold in memory. Setting this to a lower number may slow
+Conduit down, as it must fetch more data from the database. Increasing it will mean that Conduit will start to use more
+memory as the cache slowly fills up.
+
+### SQLite WAL clean interval
+
+- Config file key: `sqlite_wal_clean_second_interval`
+- Environment variable: `CONDUIT_SQLITE_WAL_CLEAN_SECOND_INTERVAL`
+- Default value: `60` (every 60 seconds)
+- Suggested values: `1` - `3600` (u32)
+
+How often the WAL file should be cleaned up. The WAL file will be written to until cleaned up, after which it restarts
+writing from the beginning.
+
+The file's size will correspond to how long it could write to it in one go. (e.g. if conduit writes 100MB of data to the
+database inbetween that period, the file will grow to 100MB). You can read more about that in
+the [SQLite Docs](https://www.sqlite.org/draft/wal.html).
+
+Reducing this down too much can offset the benefits of using a WAL at all. However, having this too high can result in a
+large WAL file.
+
+Only relevant when using SQLite as the database.
+
+### Still undocumented config options
+
+- `tracing_flame`
+- `proxy`
+- `jwt_secret`

docs/setup/domain.md

@@ -0,0 +1,82 @@
+# Domains?
+
+## How Matrix (commonly) works
+
+If you think about the way Matrix works, you will probably have this rough idea in your head:
+
+![Sketch of two users, "@alice:a.com" and "@bob:b.com", each connected via an arrow to one server, "a.com" and "b.com". There is a connection arrow between those servers.](../matrix-rough-overview.svg)
+
+So as @alice:a.com you are connected to your Matrix Homeserver which is a.com and if you chat with @bob:b.com, your Homeserver talks with Bob's Homeserver, b.com.
+
+But how does your Matrix App know how to talk with your Homeserver, and how does your Homeserver know how to talk with other Homeservers?
+
+## How your Matrix Client finds your Homeserver
+
+1. You open your Matrix Client for the first time and type in your homeserver url: `example.com`.
+2. Your Matrix client sends an http(s) request to `example.com/.well-known/matrix/client`.
+3. The Webserver answers with a file like this:
+
+```json
+{
+  "m.homeserver": {
+    "base_url": "https://matrix.example.com"
+  }
+}
+```
+
+4. Your Matrix client connects to `https://matrix.example.com` and checks if it is a Matrix home server.
+5. You can register and log in as `@alice:example.com`
+
+So the actual homeserver can have a different url (`matrix.example.com`) than the domain in your username (`example.com`). So the sketch from above get's a bit more complicated:
+
+![Sketch of a user which as a first arrow going to a box labeled "Webserver A a.com" and a second arrow going to another box labeled "Homeserver A matrix.a.com"](../matrix-client-connection.svg)
+
+## How your Homeserver finds other Homeservers
+
+Now you want to message `@bob:b.com`. How does your Homeserver know how to talk to bob?
+
+1. You send a message in a chat with `@bob:b.com`.
+2. Your Homeserver sends an HTTP request to `b.com/.well-known/matrix/server`.
+3. The webserver of `b.com` answers with a file like this:
+
+```json
+{
+  "m.server": "matrix.b.com:443"
+}
+```
+
+4. Your homeserver connects to `https://matrix.b.com` on port 443 (the default port for HTTPS) and delivers your message to `@bob:b.com`.
+
+Our diagram got even more complicated:
+
+![](../matrix-with-homeserver-discovery.svg)
+
+## Does this need to be this complicated?
+
+The Matrix protocol is rather flexible to allow for big Homeservers with millions of users. This split between your domain (`a.com`) and the actual Homeserver url (`matrix.a.com`) allows to run a Website for `a.com` on one physical server and the Matrix Homeserver on another physical server and other fancy, but complicated magic.
+
+## How to choose a setup for your own Homeserver
+
+So what to do?
+
+You will probably have a fancy domain, let's call it `example.com`.
+Your users shall have names like `@chris:example.com` or `@danielle:example.com`.
+
+In our guides, we assume you control the DNS settings for your domain and are able to setup a subdomain.
+We also assume that you have a Linux server with a public IP address with ports 443 (and maybe 80) opened up in your firewall and some free disk space.
+
+You should setup a reverse-proxying webserver like nginx, apache, traefik or caddy to
+
+- Serve `https://example.com/.well-known/matrix/client`
+- Serve `https://example.com/.well-known/matrix/server`
+- Proxy `https://matrix.example.com/` to Conduit
+
+(Again: Substitute example.com with your own, even better domain.)
+
+## Alright, let's get started!
+
+We documented a few routes to get to a working Conduit server. Choose which one you like:
+
+- The manual way (best tested)
+- Docker compose
+- Docker + Reverse proxy

docs/setup/installation/binary.md

@@ -0,0 +1,232 @@
+## Installing Conduit
+
+Although you might be able to compile Conduit for Windows, we do recommend running it on a linux server. We therefore
+only offer Linux binaries.
+
+You may simply download the binary that fits your machine. Run `uname -m` to see what you need. Now copy the right url:
+
+| CPU Architecture                            | Download stable version        |
+| ------------------------------------------- | ------------------------------ |
+| x84_64 / amd64 (Most servers and computers) | [Download][x84_64-musl-master] |
+| armv6                                       | [Download][armv6-musl-master]  |
+| armv7 (e.g. Raspberry Pi by default)        | [Download][armv7-musl-master]  |
+| armv8 / aarch64                             | [Download][armv8-musl-master]  |
+
+[x84_64-musl-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-x86_64-unknown-linux-musl?job=build:release:cargo:x86_64-unknown-linux-musl
+[armv6-musl-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-arm-unknown-linux-musleabihf?job=build:release:cargo:arm-unknown-linux-musleabihf
+[armv7-musl-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-armv7-unknown-linux-musleabihf?job=build:release:cargo:armv7-unknown-linux-musleabihf
+[armv8-musl-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-aarch64-unknown-linux-musl?job=build:release:cargo:aarch64-unknown-linux-musl
+
+```bash
+$ sudo wget -O /usr/local/bin/matrix-conduit <url>
+$ sudo chmod +x /usr/local/bin/matrix-conduit
+```
+
+Alternatively, you may compile the binary yourself using
+
+```bash
+$ cargo build --release
+```
+
+Note that this currently requires Rust 1.50.
+
+If you want to cross compile Conduit to another architecture, read the [Cross-Compile Guide](CROSS_COMPILE.md).
+
+## Adding a Conduit user
+
+While Conduit can run as any user it is usually better to use dedicated users for different services. This also allows
+you to make sure that the file permissions are correctly set up.
+
+In Debian you can use this command to create a Conduit user:
+
+```bash
+sudo adduser --system conduit --no-create-home
+```
+
+## Setting up a systemd service
+
+Now we'll set up a systemd service for Conduit, so it's easy to start/stop Conduit and set it to autostart when your
+server reboots. Simply paste the default systemd service you can find below into
+`/etc/systemd/system/conduit.service`.
+
+```systemd
+[Unit]
+Description=Conduit Matrix Server
+After=network.target
+
+[Service]
+Environment="CONDUIT_CONFIG=/etc/matrix-conduit/conduit.toml"
+User=conduit
+Group=nogroup
+Restart=always
+ExecStart=/usr/local/bin/matrix-conduit
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Finally, run
+
+```bash
+$ sudo systemctl daemon-reload
+```
+
+## Creating the Conduit configuration file
+
+Now we need to create the Conduit's config file in `/etc/matrix-conduit/conduit.toml`. Paste this in **and take a moment
+to read it. You need to change at least the server name.**
+
+```toml
+[global]
+# The server_name is the name of this server. It is used as a suffix for user
+# and room ids. Examples: matrix.org, conduit.rs
+# The Conduit server needs to be reachable at https://your.server.name/ on port
+# 443 (client-server) and 8448 (federation) OR you can create /.well-known
+# files to redirect requests. See
+# https://matrix.org/docs/spec/client_server/latest#get-well-known-matrix-client
+# and https://matrix.org/docs/spec/server_server/r0.1.4#get-well-known-matrix-server
+# for more information
+
+# YOU NEED TO EDIT THIS
+#server_name = "your.server.name"
+
+# This is the only directory where Conduit will save its data
+database_path = "/var/lib/matrix-conduit/conduit_db"
+
+# The port Conduit will be running on. You need to set up a reverse proxy in
+# your web server (e.g. apache or nginx), so all requests to /_matrix on port
+# 443 and 8448 will be forwarded to the Conduit instance running on this port
+port = 6167
+
+# Max size for uploads
+max_request_size = 20_000_000 # in bytes
+
+# Enables registration. If set to false, no users can register on this server.
+allow_registration = true
+
+# Disable encryption, so no new encrypted rooms can be created
+# Note: existing rooms will continue to work
+allow_encryption = true
+allow_federation = true
+
+trusted_servers = ["matrix.org"]
+
+#max_concurrent_requests = 100 # How many requests Conduit sends to other servers at the same time
+#workers = 4 # default: cpu core count * 2
+
+address = "127.0.0.1" # This makes sure Conduit can only be reached using the reverse proxy
+
+# The total amount of memory that the database will use.
+#db_cache_capacity_mb = 200
+```
+
+## Setting the correct file permissions
+
+As we are using a Conduit specific user we need to allow it to read the config. To do that you can run this command on
+Debian:
+
+```bash
+sudo chown -R conduit:nogroup /etc/matrix-conduit
+```
+
+If you use the default database path you also need to run this:
+
+```bash
+sudo mkdir -p /var/lib/matrix-conduit/conduit_db
+sudo chown -R conduit:nogroup /var/lib/matrix-conduit/conduit_db
+```
+
+## Setting up the Reverse Proxy
+
+This depends on whether you use Apache, Nginx or another web server.
+
+### Apache
+
+Create `/etc/apache2/sites-enabled/050-conduit.conf` and copy-and-paste this:
+
+```apache
+Listen 8448
+
+<VirtualHost *:443 *:8448>
+
+ServerName your.server.name # EDIT THIS
+
+AllowEncodedSlashes NoDecode
+ProxyPass /_matrix/ http://127.0.0.1:6167/_matrix/ nocanon
+ProxyPassReverse /_matrix/ http://127.0.0.1:6167/_matrix/
+
+</VirtualHost>
+```
+
+**You need to make some edits again.** When you are done, run
+
+```bash
+$ sudo systemctl reload apache2
+```
+
+### Nginx
+
+If you use Nginx and not Apache, add the following server section inside the http section of `/etc/nginx/nginx.conf`
+
+```nginx
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    listen 8448 ssl http2;
+    listen [::]:8448 ssl http2;
+    server_name your.server.name; # EDIT THIS
+    merge_slashes off;
+
+    location /_matrix/ {
+        proxy_pass http://127.0.0.1:6167$request_uri;
+        proxy_set_header Host $http_host;
+        proxy_buffering off;
+    }
+
+    ssl_certificate /etc/letsencrypt/live/your.server.name/fullchain.pem; # EDIT THIS
+    ssl_certificate_key /etc/letsencrypt/live/your.server.name/privkey.pem; # EDIT THIS
+    ssl_trusted_certificate /etc/letsencrypt/live/your.server.name/chain.pem; # EDIT THIS
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+}
+```
+
+**You need to make some edits again.** When you are done, run
+
+```bash
+$ sudo systemctl reload nginx
+```
+
+## SSL Certificate
+
+The easiest way to get an SSL certificate, if you don't have one already, is to install `certbot` and run this:
+
+```bash
+$ sudo certbot -d your.server.name
+```
+
+## You're done!
+
+Now you can start Conduit with:
+
+```bash
+$ sudo systemctl start conduit
+```
+
+Set it to start automatically when your system boots with:
+
+```bash
+$ sudo systemctl enable conduit
+```
+
+## How do I know it works?
+
+You can open <https://app.element.io>, enter your homeserver and try to register.
+
+You can also use these commands as a quick health check.
+
+```bash
+$ curl https://your.server.name/_matrix/client/versions
+$ curl https://your.server.name:8448/_matrix/client/versions
+```
+
+If you want to set up an appservice, take a look at the [Appservice Guide](APPSERVICES.md).

docs/setup/installation/docker.md

@@ -0,0 +1,121 @@
+# Deploy using Docker
+
+> **Note:** To run and use Conduit you should probably use it with a Domain or Subdomain behind a reverse proxy (like Nginx, Traefik, Apache, ...) with a Lets Encrypt certificate.
+>
+> See the [Domain section](../domain.md) for more about this.
+
+## Standalone Docker image
+
+A typical way to start Conduit with Docker looks like this:
+
+```bash
+docker run \
+  --name "conduit" \
+  --detach \
+  --restart "unless-stopped" \
+  --env CONDUIT_CONFIG="" \
+  --env CONDUIT_SERVER_NAME="domain.tld" \
+  --env CONDUIT_ADDRESS="0.0.0.0" \
+  --env CONDUIT_ALLOW_REGISTRATION="true" \
+  --env CONDUIT_ALLOW_FEDERATION="true" \
+  --env CONDUIT_DATABASE_PATH="/srv/conduit/.local/share/conduit" \
+  --volume "/var/lib/conduit/:/srv/conduit/.local/share/conduit" \
+  --publish 6167:6167
+  matrixconduit/matrix-conduit:latest
+```
+
+<details>
+<summary>Explanation of the above command</summary>
+
+- `--name "conduit"` Create a container named "conduit"
+- `--detach` Detach from current terminal and run in the background
+- `--restart=unless-stopped` Restart if Conduit crashes or after reboots
+- `--env CONDUIT_CONFIG=""` Tell Conduit to only use environment variables (instead of a config file)
+- `--env CONDUIT_ADDRESS="0.0.0.0" ` Answer to requests from outside of the container...
+- `--publish 6167:6167` ... on port 6167
+
+</details>
+
+After a few seconds, your Conduit should be listening on port 6167.
+If you have Element Desktop installed on the same machine, try creating an account on the server `localhost:6167`.
+
+To check how your Conduit container is doing, you can use the commands `docker ps` and `docker logs conduit`.
+
+### Next steps
+
+For a functioning Matrix server which you can connect to from your phone and which federates with other Matrix servers, you still need to configure a reverse proxy to:
+
+- Forward https traffic as http to the Conduit container on port 6167
+- Serve .well-known files (see the [Domain section](../domain.md)) to tell Servers and clients where to find your Conduit
+- Optionally serve a Matrix Web Client like Element Web or FluffyChat Web.
+
+## Docker Compose
+
+We also provide a `docker-compose.yaml` file, which includes everything you need to run a complete Matrix Homeserver:
+
+- Conduit
+- The reverse proxy
+- Matrix Web Client
+
+To get started:
+
+1. Copy the `docker-compose.yaml` file to a new directory on your server.
+
+2. Edit it and adjust your configuration.
+
+3. Start it with
+
+```bash
+docker-compose up .d
+```
+
+### Use Traefik as Proxy
+
+As a container user, you probably know about Traefik. It is a easy to use reverse proxy for making containerized app and services available through the web. With the
+two provided files, [`docker-compose.traefik.yml`](docker-compose.traefik.yml) and [`docker-compose.override.traefik.yml`](docker-compose.override.traefik.yml), it is
+equally easy to deploy and use Conduit, with a little caveat. If you already took a look at the files, then you should have seen the `well-known` service, and that is
+the little caveat. Traefik is simply a proxy and loadbalancer and is not able to serve any kind of content, but for Conduit to federate, we need to either expose ports
+`443` and `8448` or serve two endpoints `.well-known/matrix/client` and `.well-known/matrix/server`.
+
+With the service `well-known` we use a single `nginx` container that will serve those two files.
+
+So...step by step:
+
+1. Copy [`docker-compose.traefik.yml`](docker-compose.traefik.yml) and [`docker-compose.override.traefik.yml`](docker-compose.override.traefik.yml) from the repository and remove `.traefik` from the filenames.
+2. Open both files and modify/adjust them to your needs. Meaning, change the `CONDUIT_SERVER_NAME` and the volume host mappings according to your needs.
+3. Create the `conduit.toml` config file, an example can be found [here](../conduit-example.toml), or set `CONDUIT_CONFIG=""` and configure Conduit per env vars.
+4. Uncomment the `element-web` service if you want to host your own Element Web Client and create a `element_config.json`.
+5. Create the files needed by the `well-known` service.
+
+   - `./nginx/matrix.conf` (relative to the compose file, you can change this, but then also need to change the volume mapping)
+
+     ```nginx
+     server {
+         server_name <SUBDOMAIN>.<DOMAIN>;
+         listen      80 default_server;
+
+         location /.well-known/matrix/ {
+             root /var/www;
+             default_type application/json;
+             add_header Access-Control-Allow-Origin *;
+         }
+     }
+     ```
+
+   - `./nginx/www/.well-known/matrix/client` (relative to the compose file, you can change this, but then also need to change the volume mapping)
+     ```json
+     {
+       "m.homeserver": {
+         "base_url": "https://<SUBDOMAIN>.<DOMAIN>"
+       }
+     }
+     ```
+   - `./nginx/www/.well-known/matrix/server` (relative to the compose file, you can change this, but then also need to change the volume mapping)
+     ```json
+     {
+       "m.server": "<SUBDOMAIN>.<DOMAIN>:443"
+     }
+     ```
+
+6. Run `docker-compose up -d`
+7. Connect to your homeserver with your preferred client and create a user. You should do this immediatly after starting Conduit, because the first created user is the admin.

src/client_server/membership.rs

@@ -934,7 +934,7 @@ pub(crate) async fn invite_helper<'a>(
                 unsigned.insert("prev_content".to_owned(), prev_pdu.content.clone());
                 unsigned.insert(
                     "prev_sender".to_owned(),
-                    serde_json::from_str(prev_pdu.sender.as_str()).expect("UserId is valid string"),
+                    to_raw_value(&prev_pdu.sender).expect("UserId is valid"),
                 );
             }
 

src/client_server/mod.rs

@@ -16,6 +16,7 @@ mod profile;
 mod push;
 mod read_marker;
 mod redact;
+mod report;
 mod room;
 mod search;
 mod session;
@@ -47,6 +48,7 @@ pub use profile::*;
 pub use push::*;
 pub use read_marker::*;
 pub use redact::*;
+pub use report::*;
 pub use room::*;
 pub use search::*;
 pub use session::*;

src/client_server/report.rs

@@ -0,0 +1,83 @@
+use crate::{database::admin::AdminCommand, database::DatabaseGuard, ConduitResult, Error, Ruma};
+use ruma::{
+    api::client::{error::ErrorKind, r0::room::report_content},
+    events::room::message,
+    Int,
+};
+
+#[cfg(feature = "conduit_bin")]
+use rocket::{http::RawStr, post};
+
+/// # `POST /_matrix/client/r0/rooms/{roomId}/report/{eventId}`
+///
+/// Reports an inappropriate event to homeserver admins
+///
+#[cfg_attr(
+    feature = "conduit_bin",
+    post("/_matrix/client/r0/rooms/<_>/report/<_>", data = "<body>")
+)]
+#[tracing::instrument(skip(db, body))]
+pub async fn report_event_route(
+    db: DatabaseGuard,
+    body: Ruma<report_content::Request<'_>>,
+) -> ConduitResult<report_content::Response> {
+    let sender_user = body.sender_user.as_ref().expect("user is authenticated");
+
+    let pdu = match db.rooms.get_pdu(&body.event_id)? {
+        Some(pdu) => pdu,
+        _ => {
+            return Err(Error::BadRequest(
+                ErrorKind::InvalidParam,
+                "Invalid Event ID",
+            ))
+        }
+    };
+
+    if body.score > Int::from(0) || body.score < Int::from(-100) {
+        return Err(Error::BadRequest(
+            ErrorKind::InvalidParam,
+            "Invalid score, must be within 0 to -100",
+        ));
+    };
+
+    if body.reason.chars().count() > 250 {
+        return Err(Error::BadRequest(
+            ErrorKind::InvalidParam,
+            "Reason too long, should be 250 characters or fewer",
+        ));
+    };
+
+    db.admin.send(AdminCommand::SendMessage(
+        message::RoomMessageEventContent::text_html(
+            format!(
+                "Report received from: {}\n\n\
+                Event ID: {}\n\
+                Room ID: {}\n\
+                Sent By: {}\n\n\
+                Report Score: {}\n\
+                Report Reason: {}",
+                sender_user, pdu.event_id, pdu.room_id, pdu.sender, body.score, body.reason
+            )
+            .to_owned(),
+            format!(
+                "<details><summary>Report received from: <a href=\"https://matrix.to/#/{0}\">{0}\
+                </a></summary><ul><li>Event Info<ul><li>Event ID: <code>{1}</code>\
+                <a href=\"https://matrix.to/#/{2}/{1}\">🔗</a></li><li>Room ID: <code>{2}</code>\
+                </li><li>Sent By: <a href=\"https://matrix.to/#/{3}\">{3}</a></li></ul></li><li>\
+                Report Info<ul><li>Report Score: {4}</li><li>Report Reason: {5}</li></ul></li>\
+                </ul></details>",
+                sender_user,
+                pdu.event_id,
+                pdu.room_id,
+                pdu.sender,
+                body.score,
+                RawStr::new(&body.reason).html_escape()
+            )
+            .to_owned(),
+        ),
+    ));
+
+    db.flush()?;
+
+    Ok(report_content::Response {}.into())
+}

src/client_server/room.rs

@@ -22,11 +22,16 @@ use ruma::{
         },
         EventType,
     },
-    serde::JsonObject,
+    serde::{CanonicalJsonObject, JsonObject},
     RoomAliasId, RoomId, RoomVersionId,
 };
-use serde_json::value::to_raw_value;
+use serde_json::{json, value::to_raw_value};
-use std::{cmp::max, collections::BTreeMap, convert::TryFrom, sync::Arc};
+use std::{
+    cmp::max,
+    collections::BTreeMap,
+    convert::{TryFrom, TryInto},
+    sync::Arc,
+};
 use tracing::{info, warn};
 
 #[cfg(feature = "conduit_bin")]
@@ -102,10 +107,7 @@ pub async fn create_room_route(
                 }
             })?;
 
-    let mut content = RoomCreateEventContent::new(sender_user.clone());
+    let room_version = match body.room_version.clone() {
-    content.federate = body.creation_content.federate;
-    content.predecessor = body.creation_content.predecessor.clone();
-    content.room_version = match body.room_version.clone() {
         Some(room_version) => {
             if room_version == RoomVersionId::Version5 || room_version == RoomVersionId::Version6 {
                 room_version
@@ -119,6 +121,56 @@ pub async fn create_room_route(
         None => RoomVersionId::Version6,
     };
 
+    let content = match &body.creation_content {
+        Some(content) => {
+            let mut content = content
+                .deserialize_as::<CanonicalJsonObject>()
+                .expect("Invalid creation content");
+            content.insert(
+                "creator".into(),
+                json!(&sender_user).try_into().map_err(|_| {
+                    Error::BadRequest(ErrorKind::BadJson, "Invalid creation content")
+                })?,
+            );
+            content.insert(
+                "room_version".into(),
+                json!(room_version.as_str()).try_into().map_err(|_| {
+                    Error::BadRequest(ErrorKind::BadJson, "Invalid creation content")
+                })?,
+            );
+            content
+        }
+        None => {
+            let mut content = serde_json::from_str::<CanonicalJsonObject>(
+                to_raw_value(&RoomCreateEventContent::new(sender_user.clone()))
+                    .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "Invalid creation content"))?
+                    .get(),
+            )
+            .unwrap();
+            content.insert(
+                "room_version".into(),
+                json!(room_version.as_str()).try_into().map_err(|_| {
+                    Error::BadRequest(ErrorKind::BadJson, "Invalid creation content")
+                })?,
+            );
+            content
+        }
+    };
+
+    // Validate creation content
+    let de_result = serde_json::from_str::<CanonicalJsonObject>(
+        to_raw_value(&content)
+            .expect("Invalid creation content")
+            .get(),
+    );
+
+    if let Err(_) = de_result {
+        return Err(Error::BadRequest(
+            ErrorKind::BadJson,
+            "Invalid creation content",
+        ));
+    }
+
     // 1. The room create event
     db.rooms.build_and_append_pdu(
         PduBuilder {
@@ -432,7 +484,7 @@ pub async fn get_room_aliases_route(
     .into())
 }
 
-/// # `GET /_matrix/client/r0/rooms/{roomId}/upgrade`
+/// # `POST /_matrix/client/r0/rooms/{roomId}/upgrade`
 ///
 /// Upgrades the room.
 ///
@@ -510,16 +562,15 @@ pub async fn upgrade_room_route(
     );
     let state_lock = mutex_state.lock().await;
 
-    // Get the old room federations status
+    // Get the old room creation event
-    let federate = serde_json::from_str::<RoomCreateEventContent>(
+    let mut create_event_content = serde_json::from_str::<CanonicalJsonObject>(
         db.rooms
             .room_state_get(&body.room_id, &EventType::RoomCreate, "")?
             .ok_or_else(|| Error::bad_database("Found room without m.room.create event."))?
             .content
             .get(),
     )
-    .map_err(|_| Error::bad_database("Invalid room event in database."))?
+    .map_err(|_| Error::bad_database("Invalid room event in database."))?;
-    .federate;
 
     // Use the m.room.tombstone event as the predecessor
     let predecessor = Some(ruma::events::room::create::PreviousRoom::new(
@@ -528,10 +579,38 @@ pub async fn upgrade_room_route(
     ));
 
     // Send a m.room.create event containing a predecessor field and the applicable room_version
-    let mut create_event_content = RoomCreateEventContent::new(sender_user.clone());
+    create_event_content.insert(
-    create_event_content.federate = federate;
+        "creator".into(),
-    create_event_content.room_version = body.new_version.clone();
+        json!(&sender_user)
-    create_event_content.predecessor = predecessor;
+            .try_into()
+            .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "Error forming creation event"))?,
+    );
+    create_event_content.insert(
+        "room_version".into(),
+        json!(&body.new_version)
+            .try_into()
+            .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "Error forming creation event"))?,
+    );
+    create_event_content.insert(
+        "predecessor".into(),
+        json!(predecessor)
+            .try_into()
+            .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "Error forming creation event"))?,
+    );
+
+    // Validate creation event content
+    let de_result = serde_json::from_str::<CanonicalJsonObject>(
+        to_raw_value(&create_event_content)
+            .expect("Error forming creation event")
+            .get(),
+    );
+
+    if let Err(_) = de_result {
+        return Err(Error::BadRequest(
+            ErrorKind::BadJson,
+            "Error forming creation event",
+        ));
+    }
 
     db.rooms.build_and_append_pdu(
         PduBuilder {

src/client_server/voip.rs

@@ -1,6 +1,11 @@
-use crate::ConduitResult;
+use crate::{database::DatabaseGuard, ConduitResult, Ruma};
+use hmac::{Hmac, Mac, NewMac};
 use ruma::api::client::r0::voip::get_turn_server_info;
-use std::time::Duration;
+use ruma::SecondsSinceUnixEpoch;
+use sha1::Sha1;
+use std::time::{Duration, SystemTime};
+
+type HmacSha1 = Hmac<Sha1>;
 
 #[cfg(feature = "conduit_bin")]
 use rocket::get;
@@ -8,14 +13,46 @@ use rocket::get;
 /// # `GET /_matrix/client/r0/voip/turnServer`
 ///
 /// TODO: Returns information about the recommended turn server.
-#[cfg_attr(feature = "conduit_bin", get("/_matrix/client/r0/voip/turnServer"))]
+#[cfg_attr(
-#[tracing::instrument]
+    feature = "conduit_bin",
-pub async fn turn_server_route() -> ConduitResult<get_turn_server_info::Response> {
+    get("/_matrix/client/r0/voip/turnServer", data = "<body>")
+)]
+#[tracing::instrument(skip(body, db))]
+pub async fn turn_server_route(
+    body: Ruma<get_turn_server_info::Request>,
+    db: DatabaseGuard,
+) -> ConduitResult<get_turn_server_info::Response> {
+    let sender_user = body.sender_user.as_ref().expect("user is authenticated");
+
+    let turn_secret = db.globals.turn_secret();
+
+    let (username, password) = if turn_secret != "" {
+        let expiry = SecondsSinceUnixEpoch::from_system_time(
+            SystemTime::now() + Duration::from_secs(db.globals.turn_ttl()),
+        )
+        .expect("time is valid");
+
+        let username: String = format!("{}:{}", expiry.get(), sender_user);
+
+        let mut mac = HmacSha1::new_from_slice(turn_secret.as_bytes())
+            .expect("HMAC can take key of any size");
+        mac.update(username.as_bytes());
+
+        let password: String = base64::encode_config(mac.finalize().into_bytes(), base64::STANDARD);
+
+        (username, password)
+    } else {
+        (
+            db.globals.turn_username().clone(),
+            db.globals.turn_password().clone(),
+        )
+    };
+
     Ok(get_turn_server_info::Response {
-        username: "".to_owned(),
+        username: username,
-        password: "".to_owned(),
+        password: password,
-        uris: Vec::new(),
+        uris: db.globals.turn_uris().to_vec(),
-        ttl: Duration::from_secs(60 * 60 * 24),
+        ttl: Duration::from_secs(db.globals.turn_ttl()),
     }
     .into())
 }

src/database.rs

@@ -74,6 +74,16 @@ pub struct Config {
     trusted_servers: Vec<Box<ServerName>>,
     #[serde(default = "default_log")]
     pub log: String,
+    #[serde(default)]
+    turn_username: String,
+    #[serde(default)]
+    turn_password: String,
+    #[serde(default = "Vec::new")]
+    turn_uris: Vec<String>,
+    #[serde(default)]
+    turn_secret: String,
+    #[serde(default = "default_turn_ttl")]
+    turn_ttl: u64,
 
     #[serde(flatten)]
     catchall: BTreeMap<String, IgnoredAny>,
@@ -131,6 +141,10 @@ fn default_log() -> String {
     "info,state_res=warn,rocket=off,_=off,sled=off".to_owned()
 }
 
+fn default_turn_ttl() -> u64 {
+    60 * 60 * 24
+}
+
 #[cfg(feature = "sled")]
 pub type Engine = abstraction::sled::Engine;
 

src/database/globals.rs

@@ -226,6 +226,26 @@ impl Globals {
         self.jwt_decoding_key.as_ref()
     }
 
+    pub fn turn_password(&self) -> &String {
+        &self.config.turn_password
+    }
+
+    pub fn turn_ttl(&self) -> u64 {
+        self.config.turn_ttl
+    }
+
+    pub fn turn_uris(&self) -> &[String] {
+        &self.config.turn_uris
+    }
+
+    pub fn turn_username(&self) -> &String {
+        &self.config.turn_username
+    }
+
+    pub fn turn_secret(&self) -> &String {
+        &self.config.turn_secret
+    }
+
     /// TODO: the key valid until timestamp is only honored in room version > 4
     /// Remove the outdated keys and insert the new ones.
     ///

src/main.rs

@@ -101,6 +101,7 @@ fn setup_rocket(config: Figment, data: Arc<RwLock<Database>>) -> rocket::Rocket<
                 client_server::create_typing_event_route,
                 client_server::create_room_route,
                 client_server::redact_event_route,
+                client_server::report_event_route,
                 client_server::create_alias_route,
                 client_server::delete_alias_route,
                 client_server::get_alias_route,

src/server_server.rs

@@ -2721,7 +2721,7 @@ pub fn create_join_event_template_route(
         unsigned.insert("prev_content".to_owned(), prev_pdu.content.clone());
         unsigned.insert(
             "prev_sender".to_owned(),
-            serde_json::from_str(prev_pdu.sender.as_str()).expect("UserId is valid string"),
+            to_raw_value(&prev_pdu.sender).expect("UserId is valid"),
         );
     }