CI: Use curl instead of wget

The rust docker image already comes with curl, no need to install wget.

.dockerignore

@@ -14,6 +14,8 @@ docker-compose*
 # Git folder
 .git
 .gitea
+.gitlab
+.github
 
 # Dot files
 .env

.gitlab-ci.yml

@@ -9,7 +9,6 @@ variables:
   FF_USE_FASTZIP: 1
   CACHE_COMPRESSION_LEVEL: fastest
 
-
 # --------------------------------------------------------------------- #
 #  Cargo: Compiling for different architectures                         #
 # --------------------------------------------------------------------- #
@@ -20,266 +19,195 @@ variables:
   rules:
     - if: '$CI_COMMIT_BRANCH == "master"'
     - if: '$CI_COMMIT_BRANCH == "next"'
-    - if: '$CI_COMMIT_TAG'
+    - if: "$CI_COMMIT_TAG"
   interruptible: true
   image: "rust:latest"
   tags: ["docker"]
   cache:
     paths:
       - cargohome
-      - target/
+    key: "build_cache--$TARGET--$CI_COMMIT_BRANCH"
-    key: "build_cache-$TARGET-release"
   variables:
-    CARGO_PROFILE_RELEASE_LTO=true
+    CARGO_PROFILE_RELEASE_LTO: "true"
-    CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1
+    CARGO_PROFILE_RELEASE_CODEGEN_UNITS: "1"
+    CARGO_INCREMENTAL: "false" # https://matklad.github.io/2021/09/04/fast-rust-builds.html#ci-workflow
+    CARGO_HOME: $CI_PROJECT_DIR/cargohome
   before_script:
     - 'echo "Building for target $TARGET"'
-    - 'mkdir -p cargohome && CARGOHOME="cargohome"'
+    - "mkdir -p $CARGO_HOME"
-    - "cat /etc/*-release && rustc --version && cargo --version"  # Print version info for debugging
+    - "rustc --version && cargo --version && rustup show" # Print version info for debugging
-    - 'apt-get update -yqq'
-    - 'echo "Installing packages: $NEEDED_PACKAGES"'
-    - "apt-get install -yqq --no-install-recommends $NEEDED_PACKAGES"
     - "rustup target add $TARGET"
+    # If provided, bring in caching through sccache, which uses an external S3 endpoint to store compilation results:
+    - if [ -n "${SCCACHE_BIN_URL}" ]; then curl $SCCACHE_BIN_URL --output /sccache && chmod +x /sccache && export RUSTC_WRAPPER=/sccache; fi
   script:
     - time cargo build --target $TARGET --release
-    - 'mv "target/$TARGET/release/conduit" "conduit-$TARGET"'
+    - 'cp "target/$TARGET/release/conduit" "conduit-$TARGET"'
   artifacts:
     expire_in: never
 
-
+build:release:cargo:x86_64-unknown-linux-musl-with-debug:
-build:release:cargo:x86_64-unknown-linux-gnu:
   extends: .build-cargo-shared-settings
+  image: messense/rust-musl-cross:x86_64-musl
   variables:
-    TARGET: "x86_64-unknown-linux-gnu"
+    CARGO_PROFILE_RELEASE_DEBUG: 2 # Enable debug info for flamegraph profiling
+    TARGET: "x86_64-unknown-linux-musl"
+  after_script:
+    - "mv ./conduit-x86_64-unknown-linux-musl ./conduit-x86_64-unknown-linux-musl-with-debug"
   artifacts:
-    name: "conduit-x86_64-unknown-linux-gnu"
+    name: "conduit-x86_64-unknown-linux-musl-with-debug"
     paths:
-      - "conduit-x86_64-unknown-linux-gnu"
+      - "conduit-x86_64-unknown-linux-musl-with-debug"
-    expose_as: "Conduit for x86_64-unknown-linux-gnu"
+    expose_as: "Conduit for x86_64-unknown-linux-musl-with-debug"
-
-build:release:cargo:armv7-unknown-linux-gnueabihf:
-  extends: .build-cargo-shared-settings
-  variables:
-    TARGET: "armv7-unknown-linux-gnueabihf"
-    NEEDED_PACKAGES: "build-essential gcc-arm-linux-gnueabihf g++-arm-linux-gnueabihf libc6-dev-armhf-cross"
-    CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_LINKER: arm-linux-gnueabihf-gcc
-    CC_armv7_unknown_linux_gnueabihf: arm-linux-gnueabihf-gcc
-    CXX_armv7_unknown_linux_gnueabihf: arm-linux-gnueabihf-g++
-  artifacts:
-    name: "conduit-armv7-unknown-linux-gnueabihf"
-    paths:
-      - "conduit-armv7-unknown-linux-gnueabihf"
-    expose_as: "Conduit for armv7-unknown-linux-gnueabihf"
-
-build:release:cargo:aarch64-unknown-linux-gnu:
-  extends: .build-cargo-shared-settings
-  variables:
-    TARGET: "aarch64-unknown-linux-gnu"
-    NEEDED_PACKAGES: "build-essential gcc-10-aarch64-linux-gnu g++-aarch64-linux-gnu libc6-dev-arm64-cross"
-    CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
-    CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
-    CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
-    TARGET_CC: "/usr/bin/aarch64-linux-gnu-gcc-10"
-    TARGET_AR: "/usr/bin/aarch64-linux-gnu-gcc-ar-10"
-  artifacts:
-    name: "conduit-aarch64-unknown-linux-gnu"
-    paths:
-      - "conduit-aarch64-unknown-linux-gnu"
-    expose_as: "Conduit for aarch64-unknown-linux-gnu"
 
 build:release:cargo:x86_64-unknown-linux-musl:
   extends: .build-cargo-shared-settings
-  image: "rust:alpine"
+  image: messense/rust-musl-cross:x86_64-musl
   variables:
     TARGET: "x86_64-unknown-linux-musl"
-  before_script:
-    - 'echo "Building for target $TARGET"'
-    - 'mkdir -p cargohome && CARGOHOME="cargohome"'
-    - "cat /etc/*-release && rustc --version && cargo --version"  # Print version info for debugging
-    - "rustup target add $TARGET"
-    - "apk add libc-dev"
   artifacts:
     name: "conduit-x86_64-unknown-linux-musl"
     paths:
       - "conduit-x86_64-unknown-linux-musl"
     expose_as: "Conduit for x86_64-unknown-linux-musl"
 
+build:release:cargo:arm-unknown-linux-musleabihf:
+  extends: .build-cargo-shared-settings
+  image: messense/rust-musl-cross:arm-musleabihf
+  variables:
+    TARGET: "arm-unknown-linux-musleabihf"
+  artifacts:
+    name: "conduit-arm-unknown-linux-musleabihf"
+    paths:
+      - "conduit-arm-unknown-linux-musleabihf"
+    expose_as: "Conduit for arm-unknown-linux-musleabihf"
 
+build:release:cargo:armv7-unknown-linux-musleabihf:
+  extends: .build-cargo-shared-settings
+  image: messense/rust-musl-cross:armv7-musleabihf
+  variables:
+    TARGET: "armv7-unknown-linux-musleabihf"
+  artifacts:
+    name: "conduit-armv7-unknown-linux-musleabihf"
+    paths:
+      - "conduit-armv7-unknown-linux-musleabihf"
+    expose_as: "Conduit for armv7-unknown-linux-musleabihf"
+
+build:release:cargo:aarch64-unknown-linux-musl:
+  extends: .build-cargo-shared-settings
+  image: messense/rust-musl-cross:aarch64-musl
+  variables:
+    TARGET: "aarch64-unknown-linux-musl"
+  artifacts:
+    name: "conduit-aarch64-unknown-linux-musl"
+    paths:
+      - "conduit-aarch64-unknown-linux-musl"
+    expose_as: "Conduit for aarch64-unknown-linux-musl"
 
 .cargo-debug-shared-settings:
   extends: ".build-cargo-shared-settings"
   rules:
-    - if: '$CI_COMMIT_BRANCH'
+    - if: '$CI_COMMIT_BRANCH != "master"'
-    - if: '$CI_COMMIT_TAG'
   cache:
-    key: "build_cache-$TARGET-debug"
+    key: "build_cache--$TARGET--$CI_COMMIT_BRANCH--debug"
   script:
     - "time cargo build --target $TARGET"
     - 'mv "target/$TARGET/debug/conduit" "conduit-debug-$TARGET"'
   artifacts:
     expire_in: 4 weeks
 
-build:debug:cargo:x86_64-unknown-linux-gnu:
-  extends: ".cargo-debug-shared-settings"
-  variables:
-    TARGET: "x86_64-unknown-linux-gnu"
-  artifacts:
-    name: "conduit-debug-x86_64-unknown-linux-gnu"
-    paths:
-      - "conduit-debug-x86_64-unknown-linux-gnu"
-    expose_as: "Conduit DEBUG for x86_64-unknown-linux-gnu"
-
 build:debug:cargo:x86_64-unknown-linux-musl:
   extends: ".cargo-debug-shared-settings"
-  image: "rust:alpine"
+  image: messense/rust-musl-cross:x86_64-musl
   variables:
     TARGET: "x86_64-unknown-linux-musl"
-  before_script:
-    - 'echo "Building for target $TARGET"'
-    - 'mkdir -p cargohome && CARGOHOME="cargohome"'
-    - "cat /etc/*-release && rustc --version && cargo --version"  # Print version info for debugging
-    - "rustup target add $TARGET"
-    - "apk add libc-dev"
   artifacts:
     name: "conduit-debug-x86_64-unknown-linux-musl"
     paths:
       - "conduit-debug-x86_64-unknown-linux-musl"
     expose_as: "Conduit DEBUG for x86_64-unknown-linux-musl"
 
-
-
-# --------------------------------------------------------------------- #
-#  Cargo: Compiling deb packages for different architectures            #
-# --------------------------------------------------------------------- #
-
-
-.build-cargo-deb-shared-settings:
-  stage: "build"
-  needs: [ ]
-  rules:
-    - if: '$CI_COMMIT_BRANCH == "master"'
-    - if: '$CI_COMMIT_BRANCH == "next"'
-    - if: '$CI_COMMIT_TAG'
-  interruptible: true
-  image: "rust:latest"
-  tags: ["docker"]
-  cache:
-    paths:
-      - cargohome
-      - target/
-    key: "build_cache-deb-$TARGET"
-  before_script:
-    - 'echo "Building debian package for target $TARGET"'
-    - 'mkdir -p cargohome && CARGOHOME="cargohome"'
-    - "cat /etc/*-release && rustc --version && cargo --version"  # Print version info for debugging
-    - 'apt-get update -yqq'
-    - 'echo "Installing packages: $NEEDED_PACKAGES"'
-    - "apt-get install -yqq --no-install-recommends $NEEDED_PACKAGES"
-    - "rustup target add $TARGET"
-    - "cargo install cargo-deb"
-  script:
-    - time cargo deb --target $TARGET
-    - 'mv target/$TARGET/debian/*.deb "conduit-$TARGET.deb"'
-
-build:cargo-deb:x86_64-unknown-linux-gnu:
-  extends: .build-cargo-deb-shared-settings
-  variables:
-    TARGET: "x86_64-unknown-linux-gnu"
-    NEEDED_PACKAGES: ""
-  artifacts:
-    name: "conduit-x86_64-unknown-linux-gnu.deb"
-    paths:
-      - "conduit-x86_64-unknown-linux-gnu.deb"
-    expose_as: "Debian Package x86_64"
-
-
 # --------------------------------------------------------------------- #
 #  Create and publish docker image                                      #
 # --------------------------------------------------------------------- #
 
-# Build a docker image by packaging up the x86_64-unknown-linux-musl binary into an alpine image
 .docker-shared-settings:
   stage: "build docker image"
-  needs: []
+  image: jdrouet/docker-with-buildx:stable
-  interruptible: true
-  image:
-    name: "gcr.io/kaniko-project/executor:debug"
-    entrypoint: [""]
   tags: ["docker"]
-  variables:
+  services:
-    # Configure Kaniko Caching: https://cloud.google.com/build/docs/kaniko-cache
+    - docker:dind
-    KANIKO_CACHE_ARGS: "--cache=true --cache-copy-layers=true --cache-ttl=120h --cache-repo $CI_REGISTRY_IMAGE/kaniko-ci-cache"
-  before_script:
-    - "mkdir -p /kaniko/.docker"
-    - 'echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"},\"$DOCKER_HUB\":{\"username\":\"$DOCKER_HUB_USER\",\"password\":\"$DOCKER_HUB_PASSWORD\"}}}" > /kaniko/.docker/config.json'
-
-
-build:docker:next:
-  extends: .docker-shared-settings
   needs:
     - "build:release:cargo:x86_64-unknown-linux-musl"
+    - "build:release:cargo:arm-unknown-linux-musleabihf"
+    - "build:release:cargo:armv7-unknown-linux-musleabihf"
+    - "build:release:cargo:aarch64-unknown-linux-musl"
+  variables:
+    DOCKER_HOST: tcp://docker:2375/
+    DOCKER_TLS_CERTDIR: ""
+    DOCKER_DRIVER: overlay2
+    PLATFORMS: "linux/arm/v6,linux/arm/v7,linux/arm64,linux/amd64"
+    DOCKER_FILE: "docker/ci-binaries-packaging.Dockerfile"
+  cache:
+    paths:
+      - docker_cache
+    key: "$CI_JOB_NAME"
+  before_script:
+    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
+    # Only log in to Dockerhub if the credentials are given:
+    - if [ -n "${DOCKER_HUB}" ]; then docker login -u "$DOCKER_HUB_USER" -p "$DOCKER_HUB_PASSWORD" "$DOCKER_HUB"; fi
   script:
+    # Prepare buildx to build multiarch stuff:
+    - docker context create 'ci-context'
+    - docker buildx create --name 'multiarch-builder' --use 'ci-context'
+    # Copy binaries to their docker arch path
+    - mkdir -p linux/ && mv ./conduit-x86_64-unknown-linux-musl linux/amd64
+    - mkdir -p linux/arm/ && mv ./conduit-arm-unknown-linux-musleabihf linux/arm/v6
+    - mkdir -p linux/arm/ && mv ./conduit-armv7-unknown-linux-musleabihf linux/arm/v7
+    - mv ./conduit-aarch64-unknown-linux-musl linux/arm64
+    - 'export CREATED=$(date -u +''%Y-%m-%dT%H:%M:%SZ'') && echo "Docker image creation date: $CREATED"'
+    # Build and push image:
     - >
-      /kaniko/executor
+      docker buildx build
-      $KANIKO_CACHE_ARGS
+      --pull
-      --force
+      --push
-      --context $CI_PROJECT_DIR
+      --cache-from=type=local,src=$CI_PROJECT_DIR/docker_cache
-      --build-arg CREATED=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
+      --cache-to=type=local,dest=$CI_PROJECT_DIR/docker_cache
+      --build-arg CREATED=$CREATED
       --build-arg VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml)
       --build-arg "GIT_REF=$CI_COMMIT_SHORT_SHA"
-      --dockerfile "$CI_PROJECT_DIR/docker/ci-binaries-packaging.Dockerfile"
+      --platform "$PLATFORMS"
-      --destination "$CI_REGISTRY_IMAGE/conduit:next"
+      --tag "$TAG"
-      --destination "$CI_REGISTRY_IMAGE/conduit:next-alpine"
+      --tag "$TAG-alpine"
-      --destination "$CI_REGISTRY_IMAGE/conduit:commit-$CI_COMMIT_SHORT_SHA"
+      --tag "$TAG-commit-$CI_COMMIT_SHORT_SHA"
-      --destination "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:next"
+      --file "$DOCKER_FILE" .
-      --destination "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:next-alpine"
+
-      --destination "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:commit-$CI_COMMIT_SHORT_SHA"
+docker:next:gitlab:
+  extends: .docker-shared-settings
   rules:
     - if: '$CI_COMMIT_BRANCH == "next"'
+  variables:
+    TAG: "$CI_REGISTRY_IMAGE/matrix-conduit:next"
 
+docker:next:dockerhub:
+  extends: .docker-shared-settings
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "next" && $DOCKER_HUB'
+  variables:
+    TAG: "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:next"
 
-build:docker:master:
+docker:master:gitlab:
   extends: .docker-shared-settings
-  needs:
-    - "build:release:cargo:x86_64-unknown-linux-musl"
-  script:
-    - >
-      /kaniko/executor
-      $KANIKO_CACHE_ARGS
-      --context $CI_PROJECT_DIR
-      --build-arg CREATED=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
-      --build-arg VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml)
-      --build-arg "GIT_REF=$CI_COMMIT_SHORT_SHA"
-      --dockerfile "$CI_PROJECT_DIR/docker/ci-binaries-packaging.Dockerfile"
-      --destination "$CI_REGISTRY_IMAGE/conduit:latest"
-      --destination "$CI_REGISTRY_IMAGE/conduit:latest-alpine"
-      --destination "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:latest"
-      --destination "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:latest-alpine"
   rules:
     - if: '$CI_COMMIT_BRANCH == "master"'
+  variables:
+    TAG: "$CI_REGISTRY_IMAGE/matrix-conduit:latest"
 
-
+docker:master:dockerhub:
-build:docker:tags:
   extends: .docker-shared-settings
-  needs:
-    - "build:release:cargo:x86_64-unknown-linux-musl"
-  script:
-    - >
-      /kaniko/executor
-      $KANIKO_CACHE_ARGS
-      --context $CI_PROJECT_DIR
-      --build-arg CREATED=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
-      --build-arg VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml)
-      --build-arg "GIT_REF=$CI_COMMIT_SHORT_SHA"
-      --dockerfile "$CI_PROJECT_DIR/docker/ci-binaries-packaging.Dockerfile"
-      --destination "$CI_REGISTRY_IMAGE/conduit:$CI_COMMIT_TAG"
-      --destination "$CI_REGISTRY_IMAGE/conduit:$CI_COMMIT_TAG-alpine"
-      --destination "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:$CI_COMMIT_TAG"
-      --destination "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:$CI_COMMIT_TAG-alpine"
   rules:
-    - if: '$CI_COMMIT_TAG'
+    - if: '$CI_COMMIT_BRANCH == "master" && $DOCKER_HUB'
-
+  variables:
-
+    TAG: "$DOCKER_HUB_IMAGE/matrixconduit/matrix-conduit:latest"
 
 # --------------------------------------------------------------------- #
 #  Run tests                                                            #
@@ -291,23 +219,31 @@ test:cargo:
   image: "rust:latest"
   tags: ["docker"]
   variables:
-    CARGO_HOME: "cargohome"
+    CARGO_HOME: "$CI_PROJECT_DIR/cargohome"
+    CARGO_INCREMENTAL: "false" # https://matklad.github.io/2021/09/04/fast-rust-builds.html#ci-workflow
   cache:
     paths:
-      - target
       - cargohome
-    key: test_cache
+    key: "test_cache--$CI_COMMIT_BRANCH"
   interruptible: true
   before_script:
-    - mkdir -p $CARGO_HOME && echo "using $CARGO_HOME to cache cargo deps"
+    - mkdir -p $CARGO_HOME
     - apt-get update -yqq
     - apt-get install -yqq --no-install-recommends build-essential libssl-dev pkg-config
     - rustup component add clippy rustfmt
+    - curl "https://faulty-storage.de/gitlab-report" --output ./gitlab-report && chmod +x ./gitlab-report
+    # If provided, bring in caching through sccache, which uses an external S3 endpoint to store compilation results:
+    - if [ -n "${SCCACHE_BIN_URL}" ]; then curl $SCCACHE_BIN_URL --output /sccache && chmod +x /sccache && export RUSTC_WRAPPER=/sccache; fi
   script:
     - rustc --version && cargo --version # Print version info for debugging
     - cargo fmt --all -- --check
-    - cargo test --workspace --verbose --locked
+    - "cargo test --color always --workspace --verbose --locked --no-fail-fast -- -Z unstable-options --format json | ./gitlab-report -p test > $CI_PROJECT_DIR/report.xml"
-    - cargo clippy
+    - "cargo clippy --color always --verbose --message-format=json | ./gitlab-report -p clippy > $CI_PROJECT_DIR/gl-code-quality-report.json"
+  artifacts:
+    when: always
+    reports:
+      junit: report.xml
+      codequality: gl-code-quality-report.json
 
 test:sytest:
   stage: "test"
@@ -330,7 +266,7 @@ test:sytest:
   script:
     - "SYTEST_EXIT_CODE=0"
     - "/bootstrap.sh conduit || SYTEST_EXIT_CODE=1"
-    - "perl /sytest/tap-to-junit-xml.pl --puretap --input /logs/results.tap --output $CI_PROJECT_DIR/sytest.xml \"Sytest\" && cp /logs/results.tap $CI_PROJECT_DIR/results.tap"
+    - 'perl /sytest/tap-to-junit-xml.pl --puretap --input /logs/results.tap --output $CI_PROJECT_DIR/sytest.xml "Sytest" && cp /logs/results.tap $CI_PROJECT_DIR/results.tap'
     - "exit $SYTEST_EXIT_CODE"
   artifacts:
     when: always
@@ -340,7 +276,6 @@ test:sytest:
     reports:
       junit: "$CI_PROJECT_DIR/sytest.xml"
 
-
 # --------------------------------------------------------------------- #
 #  Store binaries as package so they have download urls                 #
 # --------------------------------------------------------------------- #
@@ -348,25 +283,31 @@ test:sytest:
 publish:package:
   stage: "upload artifacts"
   needs:
-    - "build:release:cargo:x86_64-unknown-linux-gnu"
-    - "build:release:cargo:armv7-unknown-linux-gnueabihf"
-    - "build:release:cargo:aarch64-unknown-linux-gnu"
     - "build:release:cargo:x86_64-unknown-linux-musl"
-    - "build:cargo-deb:x86_64-unknown-linux-gnu"
+    - "build:release:cargo:arm-unknown-linux-musleabihf"
+    - "build:release:cargo:armv7-unknown-linux-musleabihf"
+    - "build:release:cargo:aarch64-unknown-linux-musl"
+  #    - "build:cargo-deb:x86_64-unknown-linux-gnu"
   rules:
     - if: '$CI_COMMIT_BRANCH == "master"'
     - if: '$CI_COMMIT_BRANCH == "next"'
-    - if: '$CI_COMMIT_TAG'
+    - if: "$CI_COMMIT_TAG"
   image: curlimages/curl:latest
   tags: ["docker"]
   variables:
     GIT_STRATEGY: "none" # Don't need a clean copy of the code, we just operate on artifacts
   script:
     - 'BASE_URL="${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/conduit-${CI_COMMIT_REF_SLUG}/build-${CI_PIPELINE_ID}"'
-    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-x86_64-unknown-linux-gnu "${BASE_URL}/conduit-x86_64-unknown-linux-gnu"'
-    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-armv7-unknown-linux-gnueabihf "${BASE_URL}/conduit-armv7-unknown-linux-gnueabihf"'
-    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-aarch64-unknown-linux-gnu "${BASE_URL}/conduit-aarch64-unknown-linux-gnu"'
     - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-x86_64-unknown-linux-musl "${BASE_URL}/conduit-x86_64-unknown-linux-musl"'
-    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-x86_64-unknown-linux-gnu.deb "${BASE_URL}/conduit-x86_64-unknown-linux-gnu.deb"'
+    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-arm-unknown-linux-musleabihf "${BASE_URL}/conduit-arm-unknown-linux-musleabihf"'
-
+    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-armv7-unknown-linux-musleabihf "${BASE_URL}/conduit-armv7-unknown-linux-musleabihf"'
+    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file conduit-aarch64-unknown-linux-musl "${BASE_URL}/conduit-aarch64-unknown-linux-musl"'
 
+# Avoid duplicate pipelines
+# See: https://docs.gitlab.com/ee/ci/yaml/workflow.html#switch-between-branch-pipelines-and-merge-request-pipelines
+workflow:
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: "$CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS"
+      when: never
+    - if: "$CI_COMMIT_BRANCH"

Cargo.lock

@@ -245,6 +245,7 @@ dependencies = [
  "crossbeam",
  "directories",
  "heed",
+ "hmac",
  "http",
  "image",
  "jsonwebtoken",
@@ -266,6 +267,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yaml",
+ "sha-1",
  "sled",
  "thiserror",
  "thread_local",
@@ -428,6 +430,16 @@ dependencies = [
  "lazy_static",
 ]
 
+[[package]]
+name = "crypto-mac"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1d1a86f49236c215f271d40892d5fc950490551400b02ef360692c29815c714"
+dependencies = [
+ "generic-array",
+ "subtle",
+]
+
 [[package]]
 name = "curve25519-dalek"
 version = "3.2.0"
@@ -897,6 +909,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "hmac"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a2a2320eb7ec0ebe8da8f744d7812d9fc4cb4d09344ac01898dbcb6a20ae69b"
+dependencies = [
+ "crypto-mac",
+ "digest",
+]
+
 [[package]]
 name = "hostname"
 version = "0.3.1"
@@ -1968,7 +1990,7 @@ dependencies = [
 [[package]]
 name = "ruma"
 version = "0.4.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "assign",
  "js_int",
@@ -1989,7 +2011,7 @@ dependencies = [
 [[package]]
 name = "ruma-api"
 version = "0.18.5"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "bytes",
  "http",
@@ -2005,7 +2027,7 @@ dependencies = [
 [[package]]
 name = "ruma-api-macros"
 version = "0.18.5"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2016,7 +2038,7 @@ dependencies = [
 [[package]]
 name = "ruma-appservice-api"
 version = "0.4.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "ruma-api",
  "ruma-common",
@@ -2030,7 +2052,7 @@ dependencies = [
 [[package]]
 name = "ruma-client-api"
 version = "0.12.3"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "assign",
  "bytes",
@@ -2050,7 +2072,7 @@ dependencies = [
 [[package]]
 name = "ruma-common"
 version = "0.6.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "indexmap",
  "js_int",
@@ -2065,7 +2087,7 @@ dependencies = [
 [[package]]
 name = "ruma-events"
 version = "0.24.6"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "indoc",
  "js_int",
@@ -2081,7 +2103,7 @@ dependencies = [
 [[package]]
 name = "ruma-events-macros"
 version = "0.24.6"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2092,7 +2114,7 @@ dependencies = [
 [[package]]
 name = "ruma-federation-api"
 version = "0.3.1"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "js_int",
  "ruma-api",
@@ -2107,7 +2129,7 @@ dependencies = [
 [[package]]
 name = "ruma-identifiers"
 version = "0.20.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "paste",
  "percent-encoding",
@@ -2122,7 +2144,7 @@ dependencies = [
 [[package]]
 name = "ruma-identifiers-macros"
 version = "0.20.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "quote",
  "ruma-identifiers-validation",
@@ -2132,7 +2154,7 @@ dependencies = [
 [[package]]
 name = "ruma-identifiers-validation"
 version = "0.5.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "thiserror",
 ]
@@ -2140,7 +2162,7 @@ dependencies = [
 [[package]]
 name = "ruma-identity-service-api"
 version = "0.3.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "js_int",
  "ruma-api",
@@ -2153,7 +2175,7 @@ dependencies = [
 [[package]]
 name = "ruma-push-gateway-api"
 version = "0.3.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "js_int",
  "ruma-api",
@@ -2168,7 +2190,7 @@ dependencies = [
 [[package]]
 name = "ruma-serde"
 version = "0.5.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "bytes",
  "form_urlencoded",
@@ -2182,7 +2204,7 @@ dependencies = [
 [[package]]
 name = "ruma-serde-macros"
 version = "0.5.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -2193,7 +2215,7 @@ dependencies = [
 [[package]]
 name = "ruma-signatures"
 version = "0.9.0"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "base64 0.13.0",
  "ed25519-dalek",
@@ -2210,7 +2232,7 @@ dependencies = [
 [[package]]
 name = "ruma-state-res"
 version = "0.4.1"
-source = "git+https://github.com/ruma/ruma?rev=44cfd0adbc83303c19aef590ad0d71647e19f197#44cfd0adbc83303c19aef590ad0d71647e19f197"
+source = "git+https://github.com/ruma/ruma?rev=e7f01ca55a1eff437bad754bf0554cc09f44ec2a#e7f01ca55a1eff437bad754bf0554cc09f44ec2a"
 dependencies = [
  "itertools 0.10.1",
  "js_int",
@@ -2422,6 +2444,19 @@ dependencies = [
  "yaml-rust",
 ]
 
+[[package]]
+name = "sha-1"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99cd6713db3cf16b6c84e06321e049a9b9f699826e16096d23bbcc44d15d51a6"
+dependencies = [
+ "block-buffer",
+ "cfg-if 1.0.0",
+ "cpufeatures",
+ "digest",
+ "opaque-debug",
+]
+
 [[package]]
 name = "sha1"
 version = "0.6.0"

Cargo.toml

@@ -19,7 +19,7 @@ rocket = { version = "0.5.0-rc.1", features = ["tls"] } # Used to handle request
 
 # Used for matrix spec type definitions and helpers
 #ruma = { version = "0.4.0", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-pre-spec", "unstable-exhaustive-types"] }
-ruma = { git = "https://github.com/ruma/ruma", rev = "58cdcae1f9a8f4824bcbec1de1bb13e659c66804", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-pre-spec", "unstable-exhaustive-types"] }
+ruma = { git = "https://github.com/ruma/ruma", rev = "e7f01ca55a1eff437bad754bf0554cc09f44ec2a", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-pre-spec", "unstable-exhaustive-types"] }
 #ruma = { git = "https://github.com/timokoesters/ruma", rev = "50c1db7e0a3a21fc794b0cce3b64285a4c750c71", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-pre-spec", "unstable-exhaustive-types"] }
 #ruma = { path = "../ruma/crates/ruma", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-pre-spec", "unstable-exhaustive-types"] }
 
@@ -79,6 +79,9 @@ num_cpus = "1.13.0"
 threadpool = "1.8.1"
 heed = { git = "https://github.com/timokoesters/heed.git", rev = "f6f825da7fb2c758867e05ad973ef800a6fe1d5d", optional = true }
 thread_local = "1.1.3"
+# used for TURN server authentication
+hmac = "0.11.0"
+sha-1 = "0.9.8"
 
 [features]
 default = ["conduit_bin", "backend_sqlite"]
@@ -120,13 +123,12 @@ maintainer-scripts = "debian/"
 systemd-units = { unit-name = "matrix-conduit" }
 
 [profile.dev]
-lto = 'thin'
+lto = 'off'
 incremental = true
 
 [profile.release]
 lto = 'thin'
 incremental = true
-
 codegen-units=32
 # If you want to make flamegraphs, enable debug info:
 # debug = true

DEPLOY.md

@@ -2,25 +2,27 @@
 
 ## Getting help
 
-If you run into any problems while setting up Conduit, write an email to `timo@koesters.xyz`, ask us in `#conduit:matrix.org` or [open an issue on GitLab](https://gitlab.com/famedly/conduit/-/issues/new).
+If you run into any problems while setting up Conduit, write an email to `timo@koesters.xyz`, ask us
+in `#conduit:matrix.org` or [open an issue on GitLab](https://gitlab.com/famedly/conduit/-/issues/new).
 
 ## Installing Conduit
 
+Although you might be able to compile Conduit for Windows, we do recommend running it on a linux server. We therefore
+only offer Linux binaries.
+
 You may simply download the binary that fits your machine. Run `uname -m` to see what you need. Now copy the right url:
 
-| CPU Architecture     | GNU (Ubuntu, Debian, ArchLinux, ...)  | MUSL (Alpine, ... )     |
+| CPU Architecture                            | Download stable version        |
-| -------------------- | ------------------------------------- | ----------------------- |
+| ------------------------------------------- | ------------------------------ |
-| x84_64 / amd64       | [Download][x84_64-gnu]                | [Download][x84_64-musl] |
+| x84_64 / amd64 (Most servers and computers) | [Download][x84_64-musl-master] |
-| armv7 (Raspberry Pi) | [Download][armv7-gnu]                 | -                       |
+| armv6                                       | [Download][armv6-musl-master]  |
-| armv8 / aarch64      | [Download][armv8-gnu]                 | -                       |
+| armv7 (e.g. Raspberry Pi by default)        | [Download][armv7-musl-master]  |
+| armv8 / aarch64                             | [Download][armv8-musl-master]  |
 
-[x84_64-gnu]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-x86_64-unknown-linux-gnu?job=build:release:cargo:x86_64-unknown-linux-gnu
+[x84_64-musl-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-x86_64-unknown-linux-musl?job=build:release:cargo:x86_64-unknown-linux-musl
-
+[armv6-musl-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-arm-unknown-linux-musleabihf?job=build:release:cargo:arm-unknown-linux-musleabihf
-[x84_64-musl]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-x86_64-unknown-linux-musl?job=build:release:cargo:x86_64-unknown-linux-musl
+[armv7-musl-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-armv7-unknown-linux-musleabihf?job=build:release:cargo:armv7-unknown-linux-musleabihf
-
+[armv8-musl-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-aarch64-unknown-linux-musl?job=build:release:cargo:aarch64-unknown-linux-musl
-[armv7-gnu]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-armv7-unknown-linux-gnueabihf?job=build:release:cargo:armv7-unknown-linux-gnueabihf
-
-[armv8-gnu]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/conduit-aarch64-unknown-linux-gnu?job=build:release:cargo:aarch64-unknown-linux-gnu
 
 ```bash
 $ sudo wget -O /usr/local/bin/matrix-conduit <url>
@@ -32,15 +34,15 @@ Alternatively, you may compile the binary yourself using
 ```bash
 $ cargo build --release
 ```
+
 Note that this currently requires Rust 1.50.
 
 If you want to cross compile Conduit to another architecture, read the [Cross-Compile Guide](CROSS_COMPILE.md).
 
-
 ## Adding a Conduit user
 
-While Conduit can run as any user it is usually better to use dedicated users for different services.
+While Conduit can run as any user it is usually better to use dedicated users for different services. This also allows
-This also allows you to make sure that the file permissions are correctly set up.
+you to make sure that the file permissions are correctly set up.
 
 In Debian you can use this command to create a Conduit user:
 
@@ -50,9 +52,8 @@ sudo adduser --system conduit --no-create-home
 
 ## Setting up a systemd service
 
-Now we'll set up a systemd service for Conduit, so it's easy to start/stop
+Now we'll set up a systemd service for Conduit, so it's easy to start/stop Conduit and set it to autostart when your
-Conduit and set it to autostart when your server reboots. Simply paste the
+server reboots. Simply paste the default systemd service you can find below into
-default systemd service you can find below into
 `/etc/systemd/system/conduit.service`.
 
 ```systemd
@@ -77,10 +78,10 @@ Finally, run
 $ sudo systemctl daemon-reload
 ```
 
-
 ## Creating the Conduit configuration file
 
-Now we need to create the Conduit's config file in `/etc/matrix-conduit/conduit.toml`. Paste this in **and take a moment to read it. You need to change at least the server name.**
+Now we need to create the Conduit's config file in `/etc/matrix-conduit/conduit.toml`. Paste this in **and take a moment
+to read it. You need to change at least the server name.**
 
 ```toml
 [global]
@@ -128,8 +129,8 @@ address = "127.0.0.1" # This makes sure Conduit can only be reached using the re
 
 ## Setting the correct file permissions
 
-As we are using a Conduit specific user we need to allow it to read the config.
+As we are using a Conduit specific user we need to allow it to read the config. To do that you can run this command on
-To do that you can run this command on Debian:
+Debian:
 
 ```bash
 sudo chown -R conduit:nogroup /etc/matrix-conduit
@@ -142,7 +143,6 @@ sudo mkdir -p /var/lib/matrix-conduit/conduit_db
 sudo chown -R conduit:nogroup /var/lib/matrix-conduit/conduit_db
 ```
 
-
 ## Setting up the Reverse Proxy
 
 This depends on whether you use Apache, Nginx or another web server.
@@ -171,11 +171,9 @@ ProxyPassReverse /_matrix/ http://127.0.0.1:6167/_matrix/
 $ sudo systemctl reload apache2
 ```
 
-
 ### Nginx
 
-If you use Nginx and not Apache, add the following server section inside the
+If you use Nginx and not Apache, add the following server section inside the http section of `/etc/nginx/nginx.conf`
-http section of `/etc/nginx/nginx.conf`
 
 ```nginx
 server {
@@ -198,13 +196,13 @@ server {
     include /etc/letsencrypt/options-ssl-nginx.conf;
 }
 ```
+
 **You need to make some edits again.** When you are done, run
 
 ```bash
 $ sudo systemctl reload nginx
 ```
 
-
 ## SSL Certificate
 
 The easiest way to get an SSL certificate, if you don't have one already, is to install `certbot` and run this:
@@ -213,7 +211,6 @@ The easiest way to get an SSL certificate, if you don't have one already, is to
 $ sudo certbot -d your.server.name
 ```
 
-
 ## You're done!
 
 Now you can start Conduit with:

Dockerfile

@@ -1,75 +1,66 @@
-# Using multistage build:
+# syntax=docker/dockerfile:1
-# 	https://docs.docker.com/develop/develop-images/multistage-build/
+FROM docker.io/rust:1.53-alpine AS builder
-# 	https://whitfin.io/speeding-up-rust-docker-builds/
+WORKDIR /usr/src/conduit
+
+# Install required packages to build Conduit and it's dependencies
+RUN apk add musl-dev
+
+# == Build dependencies without our own code separately for caching ==
+#
+# Need a fake main.rs since Cargo refuses to build anything otherwise.
+#
+# See https://github.com/rust-lang/cargo/issues/2644 for a Cargo feature
+# request that would allow just dependencies to be compiled, presumably
+# regardless of whether source files are available.
+RUN mkdir src && touch src/lib.rs && echo 'fn main() {}' > src/main.rs
+COPY Cargo.toml Cargo.lock ./
+RUN cargo build --release && rm -r src
+
+# Copy over actual Conduit sources
+COPY src src
+
+# main.rs and lib.rs need their timestamp updated for this to work correctly since
+# otherwise the build with the fake main.rs from above is newer than the
+# source files (COPY preserves timestamps).
+#
+# Builds conduit and places the binary at /usr/src/conduit/target/release/conduit
+RUN touch src/main.rs && touch src/lib.rs && cargo build --release
 
 
-##########################  BUILD IMAGE  ##########################
-# Alpine build image to build Conduit's statically compiled binary
-FROM alpine:3.14 as builder
 
-# Install packages needed for building all crates
-RUN apk add --no-cache \
-        cargo \
-        openssl-dev
 
-# Specifies if the local project is build or if Conduit gets build
+# ---------------------------------------------------------------------------------------------------------------
-# from the official git repository. Defaults to the git repo.
+# Stuff below this line actually ends up in the resulting docker image
-ARG LOCAL=false
+# ---------------------------------------------------------------------------------------------------------------
-# Specifies which revision/commit is build. Defaults to HEAD
+FROM docker.io/alpine:3.14 AS runner
-ARG GIT_REF=origin/master
 
-# Copy project files from current folder
+# Standard port on which Conduit launches.
-COPY . .
+# You still need to map the port when using the docker command or docker-compose.
-# Build it from the copied local files or from the official git repository
-RUN if [[ $LOCAL == "true" ]]; then \
-        mv ./docker/healthcheck.sh . ; \
-        echo "Building from local source..." ; \
-        cargo install --path . ; \
-    else \
-        echo "Building revision '${GIT_REF}' from online source..." ; \
-        cargo install --git "https://gitlab.com/famedly/conduit.git" --rev ${GIT_REF} ; \
-        echo "Loadings healthcheck script from online source..." ; \
-        wget "https://gitlab.com/famedly/conduit/-/raw/${GIT_REF#origin/}/docker/healthcheck.sh" ; \
-    fi
-
-########################## RUNTIME IMAGE ##########################
-# Create new stage with a minimal image for the actual
-# runtime image/container
-FROM alpine:3.14
-
-ARG CREATED
-ARG VERSION
-ARG GIT_REF=origin/master
-
-ENV CONDUIT_CONFIG="/srv/conduit/conduit.toml"
-
-# Labels according to https://github.com/opencontainers/image-spec/blob/master/annotations.md
-# including a custom label specifying the build command
-LABEL org.opencontainers.image.created=${CREATED} \
-      org.opencontainers.image.authors="Conduit Contributors" \
-      org.opencontainers.image.title="Conduit" \
-      org.opencontainers.image.version=${VERSION} \
-      org.opencontainers.image.vendor="Conduit Contributors" \
-      org.opencontainers.image.description="A Matrix homeserver written in Rust" \
-      org.opencontainers.image.url="https://conduit.rs/" \
-      org.opencontainers.image.revision=${GIT_REF} \
-      org.opencontainers.image.source="https://gitlab.com/famedly/conduit.git" \
-      org.opencontainers.image.licenses="Apache-2.0" \
-      org.opencontainers.image.documentation="" \
-      org.opencontainers.image.ref.name="" \
-      org.label-schema.docker.build="docker build . -t matrixconduit/matrix-conduit:latest --build-arg CREATED=$(date -u +'%Y-%m-%dT%H:%M:%SZ') --build-arg VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml)" \
-      maintainer="Weasy666"
-
-# Standard port on which Conduit launches. You still need to map the port when using the docker command or docker-compose.
 EXPOSE 6167
 
-# Copy config files from context and the binary from
+# Note from @jfowl: I would like to remove this in the future and just have the Docker version be configured with envs. 
-# the "builder" stage to the current stage into folder
+ENV CONDUIT_CONFIG="/srv/conduit/conduit.toml"
-# /srv/conduit and create data folder for database
-RUN mkdir -p /srv/conduit/.local/share/conduit
-COPY --from=builder /root/.cargo/bin/conduit /srv/conduit/
-COPY --from=builder ./healthcheck.sh /srv/conduit/
 
+# Conduit needs:
+#   ca-certificates: for https
+#   libgcc: Apparently this is needed, even if I (@jfowl) don't know exactly why. But whatever, it's not that big.
+RUN apk add --no-cache \
+        ca-certificates \
+        curl \
+        libgcc
+
+
+# Created directory for the database and media files
+RUN mkdir -p /srv/conduit/.local/share/conduit
+
+# Test if Conduit is still alive, uses the same endpoint as Element
+COPY ./docker/healthcheck.sh /srv/conduit/healthcheck.sh
+HEALTHCHECK --start-period=5s --interval=5s CMD ./healthcheck.sh
+
+# Copy over the actual Conduit binary from the builder stage
+COPY --from=builder /usr/src/conduit/target/release/conduit /srv/conduit/conduit
+
+# Improve security: Don't run stuff as root, that does not need to run as root:
 # Add www-data user and group with UID 82, as used by alpine
 # https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install
 RUN set -x ; \
@@ -79,19 +70,13 @@ RUN set -x ; \
 
 # Change ownership of Conduit files to www-data user and group
 RUN chown -cR www-data:www-data /srv/conduit
+RUN chmod +x /srv/conduit/healthcheck.sh
 
-# Install packages needed to run Conduit
+# Change user to www-data
-RUN apk add --no-cache \
-        ca-certificates \
-        curl \
-        libgcc
-
-# Test if Conduit is still alive, uses the same endpoint as Element
-HEALTHCHECK --start-period=5s --interval=60s CMD ./healthcheck.sh
-
-# Set user to www-data
 USER www-data
 # Set container home directory
 WORKDIR /srv/conduit
-# Run Conduit
+
+# Run Conduit and print backtraces on panics
+ENV RUST_BACKTRACE=1
 ENTRYPOINT [ "/srv/conduit/conduit" ]

docker/README.md

@@ -2,38 +2,22 @@
 
 > **Note:** To run and use Conduit you should probably use it with a Domain or Subdomain behind a reverse proxy (like Nginx, Traefik, Apache, ...) with a Lets Encrypt certificate.
 
-
 ## Docker
 
 ### Build & Dockerfile
 
 The Dockerfile provided by Conduit has two stages, each of which creates an image.
+
 1. **Builder:** Builds the binary from local context or by cloning a git revision from the official repository.
-2. **Runtime:** Copies the built binary from **Builder** and sets up the runtime environment, like creating a volume to persist the database and applying the correct permissions.
+2. **Runner:** Copies the built binary from **Builder** and sets up the runtime environment, like creating a volume to persist the database and applying the correct permissions.
-
-The Dockerfile includes a few build arguments that should be supplied when building it.
-
-``` Dockerfile
-ARG LOCAL=false
-ARG CREATED
-ARG VERSION
-ARG GIT_REF=origin/master
-```
-
-- **CREATED:** Date and time as string (date-time as defined by RFC 3339). Will be used to create the Open Container Initiative compliant label `org.opencontainers.image.created`. Supply by it like this `$(date -u +'%Y-%m-%dT%H:%M:%SZ')`
-- **VERSION:** The SemVer version of Conduit, which is in the image. Will be used to create the Open Container Initiative compliant label `org.opencontainers.image.version`. If you have a `Cargo.toml` in your build context, you can get it with `$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml)`
-- **LOCAL:** *(Optional)* A boolean value, specifies if the local build context should be used, or if the official repository will be cloned. If not supplied with the build command, it will default to `false`.
-- **GIT_REF:** *(Optional)* A git ref, like `HEAD` or a commit ID. The supplied ref will be used to create the Open Container Initiative compliant label `org.opencontainers.image.revision` and will be the ref that is cloned from the repository when not building from the local context. If not supplied with the build command, it will default to `origin/master`.
 
 To build the image you can use the following command
 
 ```bash
-docker build . -t matrixconduit/matrix-conduit:latest --build-arg CREATED=$(date -u +'%Y-%m-%dT%H:%M:%SZ') --build-arg VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml)
+docker build --tag matrixconduit/matrix-conduit:latest .
 ```
 
 which also will tag the resulting image as `matrixconduit/matrix-conduit:latest`.
-**Note:** it ommits the two optional `build-arg`s.
-
 
 ### Run
 
@@ -46,9 +30,13 @@ docker run -d -p 8448:6167 -v ~/conduit.toml:/srv/conduit/conduit.toml -v db:/sr
 or you can skip the build step and pull the image from one of the following registries:
 
 | Registry        | Image                                                           | Size                  |
-| --------------- | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
+| --------------- | --------------------------------------------------------------- | --------------------- |
-| Docker Hub      | [matrixconduit/matrix-conduit:latest](https://hub.docker.com/r/matrixconduit/matrix-conduit)                        | ![Image Size](https://img.shields.io/docker/image-size/matrixconduit/matrix-conduit/latest) |
+| Docker Hub      | [matrixconduit/matrix-conduit:latest][dh]                       | ![Image Size][shield] |
-| GitLab Registry | [registry.gitlab.com/famedly/conduit/conduit:latest](https://gitlab.com/famedly/conduit/container_registry/2134341) | ![Image Size](https://img.shields.io/docker/image-size/matrixconduit/matrix-conduit/latest) |
+| GitLab Registry | [registry.gitlab.com/famedly/conduit/matrix-conduit:latest][gl] | ![Image Size][shield] |
+
+[dh]: https://hub.docker.com/r/matrixconduit/matrix-conduit
+[gl]: https://gitlab.com/famedly/conduit/container_registry/
+[shield]: https://img.shields.io/docker/image-size/matrixconduit/matrix-conduit/latest
 
 The `-d` flag lets the container run in detached mode. You now need to supply a `conduit.toml` config file, an example can be found [here](../conduit-example.toml).
 You can pass in different env vars to change config values on the fly. You can even configure Conduit completely by using env vars, but for that you need
@@ -56,23 +44,20 @@ to pass `-e CONDUIT_CONFIG=""` into your container. For an overview of possible
 
 If you just want to test Conduit for a short time, you can use the `--rm` flag, which will clean up everything related to your container after you stop it.
 
-
 ## Docker-compose
 
 If the docker command is not for you or your setup, you can also use one of the provided `docker-compose` files. Depending on your proxy setup, use the [`docker-compose.traefik.yml`](docker-compose.traefik.yml) and [`docker-compose.override.traefik.yml`](docker-compose.override.traefik.yml) for Traefik (don't forget to remove `.traefik` from the filenames) or the normal [`docker-compose.yml`](../docker-compose.yml) for every other reverse proxy. Additional info about deploying
 Conduit can be found [here](../DEPLOY.md).
 
-
 ### Build
 
 To build the Conduit image with docker-compose, you first need to open and modify the `docker-compose.yml` file. There you need to comment the `image:` option and uncomment the `build:` option. Then call docker-compose with:
 
 ```bash
-CREATED=$(date -u +'%Y-%m-%dT%H:%M:%SZ') VERSION=$(grep -m1 -o '[0-9].[0-9].[0-9]' Cargo.toml) docker-compose up
+docker-compose up
 ```
 
-This will also start the container right afterwards, so if want it to run in detached mode, you also should use the `-d` flag. For possible `build-args`, please take a look at the above `Build & Dockerfile` section.
+This will also start the container right afterwards, so if want it to run in detached mode, you also should use the `-d` flag.
-
 
 ### Run
 
@@ -101,7 +86,9 @@ So...step by step:
 3. Create the `conduit.toml` config file, an example can be found [here](../conduit-example.toml), or set `CONDUIT_CONFIG=""` and configure Conduit per env vars.
 4. Uncomment the `element-web` service if you want to host your own Element Web Client and create a `element_config.json`.
 5. Create the files needed by the `well-known` service.
+
    - `./nginx/matrix.conf` (relative to the compose file, you can change this, but then also need to change the volume mapping)
+
      ```nginx
      server {
          server_name <SUBDOMAIN>.<DOMAIN>;
@@ -114,6 +101,7 @@ So...step by step:
          }
      }
      ```
+
    - `./nginx/www/.well-known/matrix/client` (relative to the compose file, you can change this, but then also need to change the volume mapping)
      ```json
      {
@@ -128,5 +116,6 @@ So...step by step:
        "m.server": "<SUBDOMAIN>.<DOMAIN>:443"
      }
      ```
+
 6. Run `docker-compose up -d`
 7. Connect to your homeserver with your preferred client and create a user. You should do this immediatly after starting Conduit, because the first created user is the admin.

docker/ci-binaries-packaging.Dockerfile

@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile:1
 # ---------------------------------------------------------------------------------------------------------
 # This Dockerfile is intended to be built as part of Conduit's CI pipeline.
 # It does not build Conduit in Docker, but just copies the matching build artifact from the build job.
@@ -7,20 +8,26 @@
 # Credit's for the original Dockerfile: Weasy666.
 # ---------------------------------------------------------------------------------------------------------
 
-FROM alpine:3.14
+FROM docker.io/alpine:3.14 AS runner
 
-# Install packages needed to run Conduit
+# Standard port on which Conduit launches.
+# You still need to map the port when using the docker command or docker-compose.
+EXPOSE 6167
+
+# Note from @jfowl: I would like to remove this in the future and just have the Docker version be configured with envs. 
+ENV CONDUIT_CONFIG="/srv/conduit/conduit.toml"
+
+# Conduit needs:
+#   ca-certificates: for https
+#   libgcc: Apparently this is needed, even if I (@jfowl) don't know exactly why. But whatever, it's not that big.
 RUN apk add --no-cache \
         ca-certificates \
-        curl \
         libgcc
 
+
 ARG CREATED
 ARG VERSION
 ARG GIT_REF
-
-ENV CONDUIT_CONFIG="/srv/conduit/conduit.toml"
-
 # Labels according to https://github.com/opencontainers/image-spec/blob/master/annotations.md
 # including a custom label specifying the build command
 LABEL org.opencontainers.image.created=${CREATED} \
@@ -33,19 +40,24 @@ LABEL org.opencontainers.image.created=${CREATED} \
       org.opencontainers.image.revision=${GIT_REF} \
       org.opencontainers.image.source="https://gitlab.com/famedly/conduit.git" \
       org.opencontainers.image.licenses="Apache-2.0" \
-      org.opencontainers.image.documentation="" \
+      org.opencontainers.image.documentation="https://gitlab.com/famedly/conduit" \
       org.opencontainers.image.ref.name=""
 
-# Standard port on which Conduit launches. You still need to map the port when using the docker command or docker-compose.
+# Created directory for the database and media files
-EXPOSE 6167
-
-# create data folder for database
 RUN mkdir -p /srv/conduit/.local/share/conduit
 
-# Copy the Conduit binary into the image at the latest possible moment to maximise caching:
+# Test if Conduit is still alive, uses the same endpoint as Element
-COPY ./conduit-x86_64-unknown-linux-musl /srv/conduit/conduit
+COPY ./docker/healthcheck.sh /srv/conduit/healthcheck.sh
-COPY ./docker/healthcheck.sh /srv/conduit/
+HEALTHCHECK --start-period=5s --interval=5s CMD ./healthcheck.sh
 
+
+# Depending on the target platform (e.g. "linux/arm/v7", "linux/arm64/v8", or "linux/amd64")
+# copy the matching binary into this docker image
+ARG TARGETPLATFORM
+COPY ./$TARGETPLATFORM /srv/conduit/conduit
+
+
+# Improve security: Don't run stuff as root, that does not need to run as root:
 # Add www-data user and group with UID 82, as used by alpine
 # https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install
 RUN set -x ; \
@@ -57,13 +69,11 @@ RUN set -x ; \
 RUN chown -cR www-data:www-data /srv/conduit
 RUN chmod +x /srv/conduit/healthcheck.sh
 
-
+# Change user to www-data
-# Test if Conduit is still alive, uses the same endpoint as Element
-HEALTHCHECK --start-period=5s --interval=60s CMD ./healthcheck.sh
-
-# Set user to www-data
 USER www-data
 # Set container home directory
 WORKDIR /srv/conduit
-# Run Conduit
+
+# Run Conduit and print backtraces on panics
+ENV RUST_BACKTRACE=1
 ENTRYPOINT [ "/srv/conduit/conduit" ]

docker/healthcheck.sh

@@ -7,7 +7,7 @@ fi
 
 # The actual health check.
 # We try to first get a response on HTTP and when that fails on HTTPS and when that fails, we exit with code 1.
-# TODO: Change this to a single curl call. Do we have a config value that we can check for that?
+# TODO: Change this to a single wget call. Do we have a config value that we can check for that?
-curl --fail -s "http://localhost:${CONDUIT_PORT}/_matrix/client/versions" || \
+wget --no-verbose --tries=1 --spider "http://localhost:${CONDUIT_PORT}/_matrix/client/versions" || \
-    curl -k --fail -s "https://localhost:${CONDUIT_PORT}/_matrix/client/versions" || \
+    wget --no-verbose --tries=1 --spider "https://localhost:${CONDUIT_PORT}/_matrix/client/versions" || \
     exit 1

src/client_server/membership.rs

@@ -934,7 +934,7 @@ pub(crate) async fn invite_helper<'a>(
                 unsigned.insert("prev_content".to_owned(), prev_pdu.content.clone());
                 unsigned.insert(
                     "prev_sender".to_owned(),
-                    serde_json::from_str(prev_pdu.sender.as_str()).expect("UserId is valid string"),
+                    to_raw_value(&prev_pdu.sender).expect("UserId is valid"),
                 );
             }
 

src/client_server/mod.rs

@@ -16,6 +16,7 @@ mod profile;
 mod push;
 mod read_marker;
 mod redact;
+mod report;
 mod room;
 mod search;
 mod session;
@@ -47,6 +48,7 @@ pub use profile::*;
 pub use push::*;
 pub use read_marker::*;
 pub use redact::*;
+pub use report::*;
 pub use room::*;
 pub use search::*;
 pub use session::*;

src/client_server/report.rs

@@ -0,0 +1,83 @@
+use crate::{database::admin::AdminCommand, database::DatabaseGuard, ConduitResult, Error, Ruma};
+use ruma::{
+    api::client::{error::ErrorKind, r0::room::report_content},
+    events::room::message,
+    Int,
+};
+
+#[cfg(feature = "conduit_bin")]
+use rocket::{http::RawStr, post};
+
+/// # `POST /_matrix/client/r0/rooms/{roomId}/report/{eventId}`
+///
+/// Reports an inappropriate event to homeserver admins
+///
+#[cfg_attr(
+    feature = "conduit_bin",
+    post("/_matrix/client/r0/rooms/<_>/report/<_>", data = "<body>")
+)]
+#[tracing::instrument(skip(db, body))]
+pub async fn report_event_route(
+    db: DatabaseGuard,
+    body: Ruma<report_content::Request<'_>>,
+) -> ConduitResult<report_content::Response> {
+    let sender_user = body.sender_user.as_ref().expect("user is authenticated");
+
+    let pdu = match db.rooms.get_pdu(&body.event_id)? {
+        Some(pdu) => pdu,
+        _ => {
+            return Err(Error::BadRequest(
+                ErrorKind::InvalidParam,
+                "Invalid Event ID",
+            ))
+        }
+    };
+
+    if body.score > Int::from(0) || body.score < Int::from(-100) {
+        return Err(Error::BadRequest(
+            ErrorKind::InvalidParam,
+            "Invalid score, must be within 0 to -100",
+        ));
+    };
+
+    if body.reason.chars().count() > 250 {
+        return Err(Error::BadRequest(
+            ErrorKind::InvalidParam,
+            "Reason too long, should be 250 characters or fewer",
+        ));
+    };
+
+    db.admin.send(AdminCommand::SendMessage(
+        message::RoomMessageEventContent::text_html(
+            format!(
+                "Report received from: {}\n\n\
+                Event ID: {}\n\
+                Room ID: {}\n\
+                Sent By: {}\n\n\
+                Report Score: {}\n\
+                Report Reason: {}",
+                sender_user, pdu.event_id, pdu.room_id, pdu.sender, body.score, body.reason
+            )
+            .to_owned(),
+            format!(
+                "<details><summary>Report received from: <a href=\"https://matrix.to/#/{0}\">{0}\
+                </a></summary><ul><li>Event Info<ul><li>Event ID: <code>{1}</code>\
+                <a href=\"https://matrix.to/#/{2}/{1}\">🔗</a></li><li>Room ID: <code>{2}</code>\
+                </li><li>Sent By: <a href=\"https://matrix.to/#/{3}\">{3}</a></li></ul></li><li>\
+                Report Info<ul><li>Report Score: {4}</li><li>Report Reason: {5}</li></ul></li>\
+                </ul></details>",
+                sender_user,
+                pdu.event_id,
+                pdu.room_id,
+                pdu.sender,
+                body.score,
+                RawStr::new(&body.reason).html_escape()
+            )
+            .to_owned(),
+        ),
+    ));
+
+    db.flush()?;
+
+    Ok(report_content::Response {}.into())
+}

src/client_server/room.rs

@@ -22,11 +22,16 @@ use ruma::{
         },
         EventType,
     },
-    serde::JsonObject,
+    serde::{CanonicalJsonObject, JsonObject},
     RoomAliasId, RoomId, RoomVersionId,
 };
-use serde_json::value::to_raw_value;
+use serde_json::{json, value::to_raw_value};
-use std::{cmp::max, collections::BTreeMap, convert::TryFrom, sync::Arc};
+use std::{
+    cmp::max,
+    collections::BTreeMap,
+    convert::{TryFrom, TryInto},
+    sync::Arc,
+};
 use tracing::{info, warn};
 
 #[cfg(feature = "conduit_bin")]
@@ -102,10 +107,7 @@ pub async fn create_room_route(
                 }
             })?;
 
-    let mut content = RoomCreateEventContent::new(sender_user.clone());
+    let room_version = match body.room_version.clone() {
-    content.federate = body.creation_content.federate;
-    content.predecessor = body.creation_content.predecessor.clone();
-    content.room_version = match body.room_version.clone() {
         Some(room_version) => {
             if room_version == RoomVersionId::Version5 || room_version == RoomVersionId::Version6 {
                 room_version
@@ -119,6 +121,56 @@ pub async fn create_room_route(
         None => RoomVersionId::Version6,
     };
 
+    let content = match &body.creation_content {
+        Some(content) => {
+            let mut content = content
+                .deserialize_as::<CanonicalJsonObject>()
+                .expect("Invalid creation content");
+            content.insert(
+                "creator".into(),
+                json!(&sender_user).try_into().map_err(|_| {
+                    Error::BadRequest(ErrorKind::BadJson, "Invalid creation content")
+                })?,
+            );
+            content.insert(
+                "room_version".into(),
+                json!(room_version.as_str()).try_into().map_err(|_| {
+                    Error::BadRequest(ErrorKind::BadJson, "Invalid creation content")
+                })?,
+            );
+            content
+        }
+        None => {
+            let mut content = serde_json::from_str::<CanonicalJsonObject>(
+                to_raw_value(&RoomCreateEventContent::new(sender_user.clone()))
+                    .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "Invalid creation content"))?
+                    .get(),
+            )
+            .unwrap();
+            content.insert(
+                "room_version".into(),
+                json!(room_version.as_str()).try_into().map_err(|_| {
+                    Error::BadRequest(ErrorKind::BadJson, "Invalid creation content")
+                })?,
+            );
+            content
+        }
+    };
+
+    // Validate creation content
+    let de_result = serde_json::from_str::<CanonicalJsonObject>(
+        to_raw_value(&content)
+            .expect("Invalid creation content")
+            .get(),
+    );
+
+    if let Err(_) = de_result {
+        return Err(Error::BadRequest(
+            ErrorKind::BadJson,
+            "Invalid creation content",
+        ));
+    }
+
     // 1. The room create event
     db.rooms.build_and_append_pdu(
         PduBuilder {
@@ -432,7 +484,7 @@ pub async fn get_room_aliases_route(
     .into())
 }
 
-/// # `GET /_matrix/client/r0/rooms/{roomId}/upgrade`
+/// # `POST /_matrix/client/r0/rooms/{roomId}/upgrade`
 ///
 /// Upgrades the room.
 ///
@@ -510,16 +562,15 @@ pub async fn upgrade_room_route(
     );
     let state_lock = mutex_state.lock().await;
 
-    // Get the old room federations status
+    // Get the old room creation event
-    let federate = serde_json::from_str::<RoomCreateEventContent>(
+    let mut create_event_content = serde_json::from_str::<CanonicalJsonObject>(
         db.rooms
             .room_state_get(&body.room_id, &EventType::RoomCreate, "")?
             .ok_or_else(|| Error::bad_database("Found room without m.room.create event."))?
             .content
             .get(),
     )
-    .map_err(|_| Error::bad_database("Invalid room event in database."))?
+    .map_err(|_| Error::bad_database("Invalid room event in database."))?;
-    .federate;
 
     // Use the m.room.tombstone event as the predecessor
     let predecessor = Some(ruma::events::room::create::PreviousRoom::new(
@@ -528,10 +579,38 @@ pub async fn upgrade_room_route(
     ));
 
     // Send a m.room.create event containing a predecessor field and the applicable room_version
-    let mut create_event_content = RoomCreateEventContent::new(sender_user.clone());
+    create_event_content.insert(
-    create_event_content.federate = federate;
+        "creator".into(),
-    create_event_content.room_version = body.new_version.clone();
+        json!(&sender_user)
-    create_event_content.predecessor = predecessor;
+            .try_into()
+            .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "Error forming creation event"))?,
+    );
+    create_event_content.insert(
+        "room_version".into(),
+        json!(&body.new_version)
+            .try_into()
+            .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "Error forming creation event"))?,
+    );
+    create_event_content.insert(
+        "predecessor".into(),
+        json!(predecessor)
+            .try_into()
+            .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "Error forming creation event"))?,
+    );
+
+    // Validate creation event content
+    let de_result = serde_json::from_str::<CanonicalJsonObject>(
+        to_raw_value(&create_event_content)
+            .expect("Error forming creation event")
+            .get(),
+    );
+
+    if let Err(_) = de_result {
+        return Err(Error::BadRequest(
+            ErrorKind::BadJson,
+            "Error forming creation event",
+        ));
+    }
 
     db.rooms.build_and_append_pdu(
         PduBuilder {

src/client_server/voip.rs

@@ -1,6 +1,11 @@
-use crate::ConduitResult;
+use crate::{database::DatabaseGuard, ConduitResult, Ruma};
+use hmac::{Hmac, Mac, NewMac};
 use ruma::api::client::r0::voip::get_turn_server_info;
-use std::time::Duration;
+use ruma::SecondsSinceUnixEpoch;
+use sha1::Sha1;
+use std::time::{Duration, SystemTime};
+
+type HmacSha1 = Hmac<Sha1>;
 
 #[cfg(feature = "conduit_bin")]
 use rocket::get;
@@ -8,14 +13,46 @@ use rocket::get;
 /// # `GET /_matrix/client/r0/voip/turnServer`
 ///
 /// TODO: Returns information about the recommended turn server.
-#[cfg_attr(feature = "conduit_bin", get("/_matrix/client/r0/voip/turnServer"))]
+#[cfg_attr(
-#[tracing::instrument]
+    feature = "conduit_bin",
-pub async fn turn_server_route() -> ConduitResult<get_turn_server_info::Response> {
+    get("/_matrix/client/r0/voip/turnServer", data = "<body>")
+)]
+#[tracing::instrument(skip(body, db))]
+pub async fn turn_server_route(
+    body: Ruma<get_turn_server_info::Request>,
+    db: DatabaseGuard,
+) -> ConduitResult<get_turn_server_info::Response> {
+    let sender_user = body.sender_user.as_ref().expect("user is authenticated");
+
+    let turn_secret = db.globals.turn_secret();
+
+    let (username, password) = if turn_secret != "" {
+        let expiry = SecondsSinceUnixEpoch::from_system_time(
+            SystemTime::now() + Duration::from_secs(db.globals.turn_ttl()),
+        )
+        .expect("time is valid");
+
+        let username: String = format!("{}:{}", expiry.get(), sender_user);
+
+        let mut mac = HmacSha1::new_from_slice(turn_secret.as_bytes())
+            .expect("HMAC can take key of any size");
+        mac.update(username.as_bytes());
+
+        let password: String = base64::encode_config(mac.finalize().into_bytes(), base64::STANDARD);
+
+        (username, password)
+    } else {
+        (
+            db.globals.turn_username().clone(),
+            db.globals.turn_password().clone(),
+        )
+    };
+
     Ok(get_turn_server_info::Response {
-        username: "".to_owned(),
+        username: username,
-        password: "".to_owned(),
+        password: password,
-        uris: Vec::new(),
+        uris: db.globals.turn_uris().to_vec(),
-        ttl: Duration::from_secs(60 * 60 * 24),
+        ttl: Duration::from_secs(db.globals.turn_ttl()),
     }
     .into())
 }

src/database.rs

@@ -74,11 +74,16 @@ pub struct Config {
     trusted_servers: Vec<Box<ServerName>>,
     #[serde(default = "default_log")]
     pub log: String,
-    /// If enabled, Conduit will serve /.wellknown/matrix files that point to the configured server_name.
+    #[serde(default)]
-    /// This should make it easier, if you only host Conduit on the same domain as the server_name.
+    turn_username: String,
-    /// E.g. setting server_name: "matrix.example.com" -> other servers are directed to "https://matrix.example.com:443"
+    #[serde(default)]
-    #[serde(default = "false_fn")]
+    turn_password: String,
-    pub serve_wellknown: bool,
+    #[serde(default = "Vec::new")]
+    turn_uris: Vec<String>,
+    #[serde(default)]
+    turn_secret: String,
+    #[serde(default = "default_turn_ttl")]
+    turn_ttl: u64,
 
     #[serde(flatten)]
     catchall: BTreeMap<String, IgnoredAny>,
@@ -136,6 +141,10 @@ fn default_log() -> String {
     "info,state_res=warn,rocket=off,_=off,sled=off".to_owned()
 }
 
+fn default_turn_ttl() -> u64 {
+    60 * 60 * 24
+}
+
 #[cfg(feature = "sled")]
 pub type Engine = abstraction::sled::Engine;
 

src/database/globals.rs

@@ -226,8 +226,24 @@ impl Globals {
         self.jwt_decoding_key.as_ref()
     }
 
-    pub fn serve_wellknown(&self) -> bool {
+    pub fn turn_password(&self) -> &String {
-        self.config.serve_wellknown
+        &self.config.turn_password
+    }
+
+    pub fn turn_ttl(&self) -> u64 {
+        self.config.turn_ttl
+    }
+
+    pub fn turn_uris(&self) -> &[String] {
+        &self.config.turn_uris
+    }
+
+    pub fn turn_username(&self) -> &String {
+        &self.config.turn_username
+    }
+
+    pub fn turn_secret(&self) -> &String {
+        &self.config.turn_secret
     }
 
     /// TODO: the key valid until timestamp is only honored in room version > 4

src/main.rs

@@ -10,7 +10,6 @@
 pub mod appservice_server;
 pub mod client_server;
 pub mod server_server;
-pub mod well_known;
 
 mod database;
 mod error;
@@ -41,17 +40,8 @@ use tokio::sync::RwLock;
 use tracing_subscriber::{prelude::*, EnvFilter};
 
 fn setup_rocket(config: Figment, data: Arc<RwLock<Database>>) -> rocket::Rocket<rocket::Build> {
-    let rocket_builder = rocket::custom(config).manage(data);
+    rocket::custom(config)
-
+        .manage(data)
-    // If configured, serve .well-known/matrix files
-    if data.lock().globals.serve_wellknown() {
-        rocket_builder.mount(
-            "/",
-            routes![well_known::well_known_server, well_known::well_known_client,],
-        );
-    }
-
-    rocket_builder
         .mount(
             "/",
             routes![
@@ -111,6 +101,7 @@ fn setup_rocket(config: Figment, data: Arc<RwLock<Database>>) -> rocket::Rocket<
                 client_server::create_typing_event_route,
                 client_server::create_room_route,
                 client_server::redact_event_route,
+                client_server::report_event_route,
                 client_server::create_alias_route,
                 client_server::delete_alias_route,
                 client_server::get_alias_route,

src/server_server.rs

@@ -2721,7 +2721,7 @@ pub fn create_join_event_template_route(
         unsigned.insert("prev_content".to_owned(), prev_pdu.content.clone());
         unsigned.insert(
             "prev_sender".to_owned(),
-            serde_json::from_str(prev_pdu.sender.as_str()).expect("UserId is valid string"),
+            to_raw_value(&prev_pdu.sender).expect("UserId is valid"),
         );
     }
 

src/well_known.rs

@@ -1,27 +0,0 @@
-#[cfg(feature = "conduit_bin")]
-use rocket::get;
-use rocket::response::content;
-use crate::database::DatabaseGuard;
-//use serde::Serialize;
-
-//#[derive(Serialize)]
-//pub struct WellKnownServerInfo {
-//    m_server: String,
-//}
-
-#[cfg_attr(feature = "conduit_bin", get("/.well-known/matrix/server"))]
-#[tracing::instrument(skip(db))]
-pub fn well_known_server(db: DatabaseGuard) -> content::Json<String> {
-    // Pull the server_name from config
-    let server_name = db.globals.server_name().clone();
-    content::Json(format!("{{\"m.server\": \"{}:443\"}}", server_name))
-}
-
-
-#[cfg_attr(feature = "conduit_bin", get("/.well-known/matrix/client"))]
-#[tracing::instrument(skip(db))]
-pub fn well_known_client(db: DatabaseGuard) -> content::Json<String> {
-    // Pull the server_name from config
-    let server_name = db.globals.server_name().clone();
-    content::Json(format!("{{\"m.homeserver\": {{ \"base_url\": \"https://{}\"}}}}", server_name))
-}