add release action

.github/workflows/release.yml

@@ -0,0 +1,42 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    container:
+      image: fedora:latest
+
+    steps:
+      - name: Install dependencies
+        run: dnf install -y butane yq make git tar findutils
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Create minimal local.bu for CI
+        run: |
+          cat > local.bu << 'EOF'
+          variant: fcos
+          version: 1.4.0
+          EOF
+
+      - name: Build packages
+        run: |
+          mkdir -p /tmp/output
+          make -C cookbooks package \
+            PACKAGE_TARGET_DIR="/tmp/output" \
+            PACKAGE_TARGET_FORMAT="ignition archive"
+
+      - name: Upload artifacts to release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: /tmp/output/*
+          fail_on_unmatched_files: true

cookbooks/matrix/Makefile

@@ -10,3 +10,6 @@ PROJECT_GID = 10000
 
 # Include common Makefile
 include ../../scripts/common.mk
+
+$(TARGET_CHROOT)/etc/quadlets/matrix/tuwunel $(TARGET_CHROOT)/etc/quadlets/matrix/element-web:
+	install -d -m 0700 -o $(PROJECT_UID) -g $(PROJECT_GID) -D $@

cookbooks/matrix/config/examples/tuwunel.env

@@ -1,52 +1,16 @@
 ##
 ## Matrix Configuration Environment Variables (Tuwunel)
 ##
-## IMPORTANT: server_name cannot be changed after the first start.
-## Prefer a root domain (e.g. example.com) so users get @user:example.com handles.
-## The server itself can be accessed at a subdomain (e.g. matrix.example.com) via
-## a .well-known delegation.
-##
 
-# Server identity
 TUWUNEL_SERVER_NAME=example.com
-
-# Bind to localhost only - Traefik handles the public-facing TLS
-TUWUNEL_ADDRESS=127.0.0.1
 TUWUNEL_PORT=6167
-
-# Database storage path (inside the container)
-TUWUNEL_DATABASE_PATH=/var/lib/tuwunel/db
-
-# Registration
-# Set a token to restrict who can register.
-TUWUNEL_ALLOW_REGISTRATION=true
 TUWUNEL_REGISTRATION_TOKEN=changeme
 
-# First user to register is automatically granted admin.
-TUWUNEL_GRANT_ADMIN_TO_FIRST_USER=true
-
-# Federation (disabled for a private home server)
-TUWUNEL_ALLOW_FEDERATION=false
-
-# Trusted servers for public key queries (used even without full federation)
-TUWUNEL_TRUSTED_SERVERS=["matrix.org"]
-
-# Tell Tuwunel to trust the X-Forwarded-For header set by Traefik
-TUWUNEL_IP_SOURCE=rightmost_x_forwarded_for
-
-# Log level
-TUWUNEL_LOG=info
-
-# Media Storage path and options
-TUWUNEL_STORAGE_PROVIDER__MEDIA__LOCAL__BASE_PATH=/var/lib/tuwunel/media
-TUWUNEL_STORAGE_PROVIDER__MEDIA__LOCAL__DELETE_EMPTY_DIRECTORIES=true
-TUWUNEL_STORAGE_PROVIDER__MEDIA__LOCAL__STARTUP_CHECK=true
-
 ##
 ## First-run initialization (matrix-init)
 ## These variables are used once by matrix-init to create the admin user and
 ## discover the admin room. The generated credentials are stored in
-## /var/lib/quadlets/matrix/tuwunel-backup.env (never edit that file manually).
+## /var/lib/virtiofs/data/matrix/tuwunel-backup.env (never edit that file manually).
 ##
 
 # Username and password for the initial admin account.
@@ -57,13 +21,9 @@ MATRIX_INIT_ADMIN_PASSWORD=changeme
 ## Backup configuration
 ##
 
-# Path where Tuwunel stores RocksDB online backups (inside the container).
-# Each call to '!admin server backup-database' creates an incremental backup here.
-TUWUNEL_DATABASE_BACKUP_PATH=/var/lib/tuwunel/backup
-
 # Number of dated backup archives to keep on virtiofs (0 = keep all).
 MATRIX_BACKUP_RETENTION=7
 
 # NOTE: MATRIX_BACKUP_ACCESS_TOKEN and MATRIX_BACKUP_ROOM_ID are auto-generated
-# by matrix-init into /var/lib/quadlets/matrix/tuwunel-backup.env. Do not set
+# by matrix-init into /var/lib/virtiofs/data/matrix/tuwunel-backup.env. Do not set
 # them here.

cookbooks/matrix/config/examples/tuwunel/tuwunel.toml

@@ -0,0 +1,29 @@
+[global]
+# Network settings
+address = ["127.0.0.1", "::1"]
+ip_source = "rightmost_x_forwarded_for"
+
+# Paths
+database_path = "/var/lib/tuwunel/db"
+database_backup_path = "/var/lib/tuwunel/backup"
+
+# Registration
+allow_registration = true
+grant_admin_to_first_user = true
+
+# Login
+login_via_existing_session = true
+login_via_token = true
+
+# Federation
+allow_federation = false
+
+# Logging
+log = "info"
+log_colors = false
+
+# Media Storage
+[global.storage_provider.media.local]
+base_path = "/var/lib/tuwunel/media"
+delete_empty_directories = true
+startup_check = true

cookbooks/matrix/config/init.sh

@@ -31,7 +31,7 @@ LOGIN_RESPONSE=$(curl -s -X POST \
 ACCESS_TOKEN=$(echo "$LOGIN_RESPONSE" | jq -r '.access_token // empty')
 
 if [ -z "$ACCESS_TOKEN" ]; then
-    echo "Login failed; registering ${ADMIN_USER} (TUWUNEL_GRANT_ADMIN_TO_FIRST_USER=true)..."
+    echo "Login failed; registering ${ADMIN_USER}..."
 
     # Step 1: get the UIAA session ID (server returns 401 with session in body)
     UIAA_RESPONSE=$(curl -s -X POST \

cookbooks/matrix/matrix-homeserver.container

@@ -7,6 +7,7 @@ Before=matrix.target
 
 # Only run if the homeserver has been configured
 ConditionPathExists=/etc/quadlets/matrix/tuwunel.env
+ConditionPathExists=/etc/quadlets/matrix/tuwunel/tuwunel.toml
 
 PartOf=matrix.target
 
@@ -30,6 +31,10 @@ Volume=/var/lib/quadlets/matrix/tuwunel/db:/var/lib/tuwunel/db:z
 Volume=/var/lib/virtiofs/data/matrix/tuwunel/media:/var/lib/tuwunel/media:z
 Volume=/var/lib/quadlets/matrix/tuwunel/backup-staging:/var/lib/tuwunel/backup:z
 
+# Configuration file (must exist before starting)
+Volume=/etc/quadlets/matrix/tuwunel:/etc/tuwunel:z,ro
+Exec=--config /etc/tuwunel/tuwunel.toml
+
 [Service]
 Restart=always
 RestartSec=10