111b23b94b
First runnable kez-chat-server binary plus its docker-compose deploy
recipe. Implements steps 2-3 of the document.md sequenced plan; the
rust-lib refactor (step 1) is deferred — chat-server path-deps on
rust/crates/kez-core for now, which works and matches what
rust-sig-server already does.
What's in this commit:
kez-core (1-line change)
- New public `verify_envelope<T>(payload, signature)` helper that
dispatches Schnorr / Ed25519 / future suites by signature.alg.
Used by chat-server's registration verifier; downstream value
beyond chat-server too.
kez-chat-server (new crate)
- src/main.rs: tokio + axum + tracing entry; clap config; graceful
Ctrl-C shutdown.
- src/lib.rs: re-exports so tests can drive the same router.
- src/config.rs: env/flag config (bind, db, server, sig_server_url,
web_dir) with defaults sane for both dev and prod.
- src/error.rs: typed ApiError → structured JSON responses with
stable error codes.
- src/store.rs: SQLite-backed handle registry, UNIQUE on both
(handle) and (primary_id); race-safe via SQL primary key.
- src/handles.rs: username validation (length, charset, reserved
list, must start with letter/digit).
- src/registration.rs: SignedRegistration envelope sharing KEZ's
JCS canonical-bytes pattern; signature verification via the new
kez-core helper; replay protection via ±5-minute clock skew check.
- src/api.rs: all six routes in one file —
GET /v1/healthz
GET /v1/u/:handle
POST /v1/register
GET /.well-known/webfinger
POST /internal/nats/auth (501 stub for v0.1; wired up in v0.2)
GET / (placeholder HTML; ServeDir when web/dist exists)
tests/http.rs — 13 integration tests
- Stands up the real router on a random port; uses reqwest.
- Coverage: healthz, lookup-404, full register→lookup round-trip,
duplicate-handle conflict, wrong-server rejection, reserved-name
rejection, tampered-signature rejection, stale-timestamp rejection,
WebFinger success + wrong-server-404, placeholder SPA renders,
NATS callout 501, JCS determinism sanity.
deploy/
- Dockerfile: multi-stage build (rust:1.86-slim → debian:bookworm-slim).
Build context is repo root so the path dep on kez-core resolves.
Runtime image ~50 MB; runs as non-root uid 10001.
- Dockerfile.sig-server: same pattern for the existing
rust-sig-server, so the stack builds from one git pull.
- docker-compose.yml: three services (chat-server + nats + sig-server)
with named volumes for persistence. Ports: 6969 (chat HTTP),
4222/8443/8222 (NATS native/ws/monitoring), 7878 (sig-server).
- nats.conf: WebSocket on 8443 for the browser SPA, JetStream
enabled, auth_callout pointing at chat-server's
/internal/nats/auth endpoint (issuer nkey is a placeholder — must
be replaced with a real one before going live).
README.md
- Documents all endpoints with example bodies.
- Quick-start for both local dev and full Docker compose.
- Honest list of what's in v0.1 vs what's still stubbed.
Smoke-tested running on 127.0.0.1:6969:
GET /v1/healthz → {"server":"kez.lat","status":"ok","version":"0.1.0"}
GET / → placeholder HTML rendering
GET /v1/u/ghost → 404
POST /internal/nats/auth → 501 with "wired up in v0.2"
cargo test → 13 passed.
cargo build --release → 19.6s, clean.
67 lines
1.9 KiB
YAML
67 lines
1.9 KiB
YAML
# kez-chat home server stack.
|
|
#
|
|
# Three services:
|
|
# - nats dumb broker, JetStream enabled, WebSocket on 8443
|
|
# - chat-server handle registry + NATS auth callout + serves the SPA
|
|
# - sig-server sigchain HTTP store (existing rust-sig-server)
|
|
#
|
|
# Run from this dir: docker compose up -d --build
|
|
# Build context for the Rust services is `..` (the repo root) so they
|
|
# can pull in `rust/crates/kez-core` as a path dep.
|
|
#
|
|
# In production you'll terminate TLS at a reverse proxy (Caddy, nginx,
|
|
# or a Cloudflare tunnel) in front of port 6969 (HTTP) and the NATS
|
|
# listeners. The compose file itself binds to plain HTTP for simplicity.
|
|
|
|
services:
|
|
nats:
|
|
image: nats:latest
|
|
command:
|
|
- "-c"
|
|
- "/etc/nats/nats.conf"
|
|
- "--jetstream"
|
|
volumes:
|
|
- ./nats.conf:/etc/nats/nats.conf:ro
|
|
- nats-data:/data
|
|
ports:
|
|
- "4222:4222" # native NATS (CLI clients)
|
|
- "8443:8443" # WebSocket (browser SPA)
|
|
- "8222:8222" # monitoring
|
|
restart: unless-stopped
|
|
|
|
chat-server:
|
|
build:
|
|
context: .. # repo root, so Dockerfile sees rust/ and kez-chat/
|
|
dockerfile: kez-chat/deploy/Dockerfile
|
|
environment:
|
|
KEZ_CHAT_BIND: 0.0.0.0:6969
|
|
KEZ_CHAT_DB: /data/kez-chat.db
|
|
KEZ_CHAT_SERVER: kez.lat
|
|
KEZ_CHAT_SIG_SERVER_URL: http://sig-server:7878
|
|
RUST_LOG: info
|
|
volumes:
|
|
- chat-data:/data
|
|
ports:
|
|
- "6969:6969" # HTTP API + SPA (Cloudflare tunnel terminates here)
|
|
depends_on: [sig-server]
|
|
restart: unless-stopped
|
|
|
|
sig-server:
|
|
build:
|
|
context: ..
|
|
dockerfile: kez-chat/deploy/Dockerfile.sig-server
|
|
environment:
|
|
KEZ_BIND: 0.0.0.0:7878
|
|
KEZ_DB: /data/sigchains.db
|
|
RUST_LOG: info
|
|
volumes:
|
|
- sig-data:/data
|
|
ports:
|
|
- "7878:7878" # exposed for direct client fetches of sigchains
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
nats-data:
|
|
chat-data:
|
|
sig-data:
|