From 56bc3c184efcf490b872d44050a032379b0148cc Mon Sep 17 00:00:00 2001 From: timedout Date: Mon, 22 Dec 2025 22:31:06 +0000 Subject: [PATCH] feat: Enable running complement manually --- bin/complement | 40 +++-------------- complement/complement-entrypoint.sh | 67 +++++++++++++++++++++++++++++ complement/complement.config.toml | 53 +++++++++++++++++++++++ docker/complement.Dockerfile | 11 +++++ 4 files changed, 137 insertions(+), 34 deletions(-) create mode 100644 complement/complement-entrypoint.sh create mode 100644 complement/complement.config.toml create mode 100644 docker/complement.Dockerfile diff --git a/bin/complement b/bin/complement index c437503e..a04b1e14 100755 --- a/bin/complement +++ b/bin/complement @@ -2,11 +2,7 @@ set -euo pipefail -# Path to Complement's source code -# -# The `COMPLEMENT_SRC` environment variable is set in the Nix dev shell, which -# points to a store path containing the Complement source code. It's likely you -# want to just pass that as the first argument to use it here. +# The root path where complement is available. COMPLEMENT_SRC="${COMPLEMENT_SRC:-$1}" # A `.jsonl` file to write test logs to @@ -15,7 +11,10 @@ LOG_FILE="${2:-complement_test_logs.jsonl}" # A `.jsonl` file to write test results to RESULTS_FILE="${3:-complement_test_results.jsonl}" -COMPLEMENT_BASE_IMAGE="${COMPLEMENT_BASE_IMAGE:-complement-conduwuit:main}" +# The base docker image to use for complement tests +# You can build the default with `docker build -t continuwuity:complement -f ./docker/complement.Dockerfile .` +# after running `cargo build`. Only the debug binary is used. +COMPLEMENT_BASE_IMAGE="${COMPLEMENT_BASE_IMAGE:-continuwuity:complement}" # Complement tests that are skipped due to flakiness/reliability issues or we don't implement such features and won't for a long time SKIPPED_COMPLEMENT_TESTS='TestPartialStateJoin.*|TestRoomDeleteAlias/Parallel/Regular_users_can_add_and_delete_aliases_when_m.*|TestRoomDeleteAlias/Parallel/Can_delete_canonical_alias|TestUnbanViaInvite.*|TestRoomState/Parallel/GET_/publicRooms_lists.*"|TestRoomDeleteAlias/Parallel/Users_with_sufficient_power-level_can_delete_other.*' @@ -34,25 +33,6 @@ toplevel="$(git rev-parse --show-toplevel)" pushd "$toplevel" > /dev/null -if [ ! -f "complement_oci_image.tar.gz" ]; then - echo "building complement conduwuit image" - - # if using macOS, use linux-complement - #bin/nix-build-and-cache just .#linux-complement - bin/nix-build-and-cache just .#complement - #nix build -L .#complement - - echo "complement conduwuit image tar.gz built at \"result\"" - - echo "loading into docker" - docker load < result - popd > /dev/null -else - echo "skipping building a complement conduwuit image as complement_oci_image.tar.gz was already found, loading this" - - docker load < complement_oci_image.tar.gz - popd > /dev/null -fi echo "" echo "running go test with:" @@ -72,24 +52,16 @@ env \ set -o pipefail # Post-process the results into an easy-to-compare format, sorted by Test name for reproducible results -cat "$LOG_FILE" | jq -s -c 'sort_by(.Test)[]' | jq -c ' +jq -s -c 'sort_by(.Test)[]' < "$LOG_FILE" | jq -c ' select( (.Action == "pass" or .Action == "fail" or .Action == "skip") and .Test != null ) | {Action: .Action, Test: .Test} ' > "$RESULTS_FILE" -#if command -v gotestfmt &> /dev/null; then -# echo "using gotestfmt on $LOG_FILE" -# grep '{"Time":' "$LOG_FILE" | gotestfmt > "complement_test_logs_gotestfmt.log" -#fi - echo "" echo "" echo "complement logs saved at $LOG_FILE" echo "complement results saved at $RESULTS_FILE" -#if command -v gotestfmt &> /dev/null; then -# echo "complement logs in gotestfmt pretty format outputted at complement_test_logs_gotestfmt.log (use an editor/terminal/pager that interprets ANSI colours and UTF-8 emojis)" -#fi echo "" echo "" diff --git a/complement/complement-entrypoint.sh b/complement/complement-entrypoint.sh new file mode 100644 index 00000000..276e4032 --- /dev/null +++ b/complement/complement-entrypoint.sh @@ -0,0 +1,67 @@ +#!/usr/bin/env bash +set -xe +# If we have no $SERVER_NAME set, abort +if [ -z "$SERVER_NAME" ]; then + echo "SERVER_NAME is not set, aborting" + exit 1 +fi + +# If /complement/ca/ca.crt or /complement/ca/ca.key are missing, abort +if [ ! -f /complement/ca/ca.crt ] || [ ! -f /complement/ca/ca.key ]; then + echo "/complement/ca/ca.crt or /complement/ca/ca.key is missing, aborting" + exit 1 +fi + +# Add the root cert to the local trust store +echo 'Installing Complement CA certificate to local trust store' +cp /complement/ca/ca.crt /usr/local/share/ca-certificates/complement-ca.crt +update-ca-certificates + +# Sign a certificate for our $SERVER_NAME +echo "Generating and signing certificate for $SERVER_NAME" +openssl genrsa -out "/$SERVER_NAME.key" 2048 + +echo "Generating CSR for $SERVER_NAME" +openssl req -new -sha256 \ + -key "/$SERVER_NAME.key" \ + -out "/$SERVER_NAME.csr" \ + -subj "/C=US/ST=CA/O=Continuwuity, Inc./CN=$SERVER_NAME"\ + -addext "subjectAltName=DNS:$SERVER_NAME" +openssl req -in "$SERVER_NAME.csr" -noout -text + +echo "Signing certificate for $SERVER_NAME with Complement CA" +cat < ./cert.ext +authorityKeyIdentifier=keyid,issuer +basicConstraints = CA:FALSE +keyUsage = digitalSignature, keyEncipherment, dataEncipherment, nonRepudiation +extendedKeyUsage = serverAuth +subjectAltName = @alt_names +[alt_names] +DNS.1 = *.docker.internal +DNS.2 = hs1 +DNS.3 = hs2 +DNS.4 = hs3 +DNS.5 = hs4 +DNS.6 = $SERVER_NAME +IP.1 = 127.0.0.1 +EOF +openssl x509 \ + -req \ + -in "/$SERVER_NAME.csr" \ + -CA /complement/ca/ca.crt \ + -CAkey /complement/ca/ca.key \ + -CAcreateserial \ + -out "/$SERVER_NAME.crt" \ + -days 1 \ + -sha256 \ + -extfile ./cert.ext + +# Tell continuwuity where to find the certs +export CONTINUWUITY_TLS__KEY="/$SERVER_NAME.key" +export CONTINUWUITY_TLS__CERTS="/$SERVER_NAME.crt" +# And who it is +export CONTINUWUITY_SERVER_NAME="$SERVER_NAME" + +echo "Starting Continuwuity with SERVER_NAME=$SERVER_NAME" +# Start continuwuity +/usr/local/bin/conduwuit --config /etc/continuwuity/config.toml diff --git a/complement/complement.config.toml b/complement/complement.config.toml new file mode 100644 index 00000000..4c98f8d1 --- /dev/null +++ b/complement/complement.config.toml @@ -0,0 +1,53 @@ +# ============================================= # +# Complement pre-filled configuration file # +# +# DANGER: THIS FILE FORCES INSECURE VALUES. # +# DO NOT USE OUTSIDE THE TEST SUITE ENV! # +# ============================================= # +[global] +address = "0.0.0.0" +allow_device_name_federation = true +allow_guest_registration = true +allow_public_room_directory_over_federation = true +allow_public_room_directory_without_auth = true +allow_registration = true +database_path = "/database" +log = "trace,h2=debug,hyper=debug" +port = [8008, 8448] +trusted_servers = [] +only_query_trusted_key_servers = false +query_trusted_key_servers_first = false +query_trusted_key_servers_first_on_join = false +yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = true +ip_range_denylist = [] +url_preview_domain_contains_allowlist = ["*"] +url_preview_domain_explicit_denylist = ["*"] +media_compat_file_link = false +media_startup_check = true +prune_missing_media = true +log_colors = true +admin_room_notices = false +allow_check_for_updates = false +intentionally_unknown_config_option_for_testing = true +rocksdb_log_level = "info" +rocksdb_max_log_files = 1 +rocksdb_recovery_mode = 0 +rocksdb_paranoid_file_checks = true +log_guest_registrations = false +allow_legacy_media = true +startup_netburst = true +startup_netburst_keep = -1 +allow_invalid_tls_certificates_yes_i_know_what_the_fuck_i_am_doing_with_this_and_i_know_this_is_insecure = true +dns_timeout = 60 +dns_attempts = 20 +request_conn_timeout = 60 +request_timeout = 120 +well_known_conn_timeout = 60 +well_known_timeout = 60 +federation_idle_timeout = 300 +sender_timeout = 300 +sender_idle_timeout = 300 +sender_retry_backoff_limit = 300 + +[global.tls] +dual_protocol = true diff --git a/docker/complement.Dockerfile b/docker/complement.Dockerfile new file mode 100644 index 00000000..cde5b40e --- /dev/null +++ b/docker/complement.Dockerfile @@ -0,0 +1,11 @@ +FROM ubuntu:latest +EXPOSE 8008 +EXPOSE 8448 +RUN apt-get update && apt-get install -y ca-certificates liburing2 && rm -rf /var/lib/apt/lists/* +RUN mkdir -p /etc/continuwuity /var/lib/continuwuity +COPY docker/complement-entrypoint.sh /usr/local/bin/complement-entrypoint.sh +COPY docker/complement.config.toml /etc/continuwuity/config.toml +COPY target/debug/conduwuit /usr/local/bin/conduwuit +RUN chmod +x /usr/local/bin/conduwuit /usr/local/bin/complement-entrypoint.sh +#HEALTHCHECK --interval=30s --timeout=5s CMD curl --fail http://localhost:8008/_continuwuity/server_version || exit 1 +ENTRYPOINT ["/usr/local/bin/complement-entrypoint.sh"]