Trying to have a chatservice

.gitea/workflows/deploy.yml

@@ -0,0 +1,51 @@
+name: Deploy continuwuity to Nomad
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'continuwuity.hcl'
+      - '.gitea/workflows/deploy.yml'
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    name: nomad job run continuwuity
+    runs-on: debian-host
+
+    env:
+      NOMAD_ADDR: ${{ secrets.NOMAD_ADDR }}
+      NOMAD_TOKEN: ${{ secrets.NOMAD_TOKEN }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check nomad CLI
+        run: |
+          if ! command -v nomad >/dev/null 2>&1; then
+            echo "❌ nomad CLI not found on the runner (debian-host). Install it on the runner host."
+            exit 1
+          fi
+          nomad version
+
+      - name: Validate job
+        run: nomad job validate continuwuity.hcl
+
+      - name: Plan (diff, non-blocking)
+        run: |
+          # plan exit codes: 0 = no changes, 1 = changes will be made, anything else = error
+          set +e
+          nomad job plan continuwuity.hcl
+          code=$?
+          set -e
+          if [ "$code" -gt 1 ]; then
+            echo "❌ nomad job plan failed (exit $code)"
+            exit "$code"
+          fi
+          echo "✅ plan ok (exit $code)"
+
+      - name: Run
+        run: nomad job run continuwuity.hcl
+
+      - name: Status
+        run: nomad job status continuwuity

continuwuity.hcl

@@ -0,0 +1,150 @@
+job "continuwuity" {
+  datacenters = ["dc1"]
+  type        = "service"
+  node_pool   = "default"
+
+  group "continuwuity" {
+    count = 1
+
+    network {
+      port "http" {
+        static = 6167
+      }
+    }
+
+    service {
+      name = "continuwuity"
+      port = "http"
+      tags = [
+        "traefik.enable=true",
+
+        # --- Homeserver (client + federation API) on cn.i80.dk ---
+        "traefik.http.routers.continuwuity.rule=Host(`cn.i80.dk`)",
+        "traefik.http.routers.continuwuity.entrypoints=https",
+        "traefik.http.routers.continuwuity.tls=true",
+        # No certresolver: Traefik serves the *.i80.dk wildcard cert from /certs via SNI.
+
+        # --- Delegation: server_name is i80.dk, so the apex must serve /.well-known/matrix/* ---
+        # MXIDs become @user:i80.dk; federation/clients resolve i80.dk -> cn.i80.dk.
+        "traefik.http.routers.continuwuity-wk.rule=Host(`i80.dk`) && PathPrefix(`/.well-known/matrix`)",
+        "traefik.http.routers.continuwuity-wk.entrypoints=https",
+        "traefik.http.routers.continuwuity-wk.tls=true",
+        # Higher priority so it wins over any bare Host(`i80.dk`) website router.
+        # NOTE: requires the cert to include i80.dk as a SAN (a *.i80.dk wildcard alone does NOT cover the apex).
+        "traefik.http.routers.continuwuity-wk.priority=100",
+
+        # --- http -> https redirect for both routers ---
+        "traefik.http.routers.continuwuity-http.rule=Host(`cn.i80.dk`)",
+        "traefik.http.routers.continuwuity-http.entrypoints=http",
+        "traefik.http.routers.continuwuity-http.middlewares=continuwuity-redirect",
+        "traefik.http.routers.continuwuity-wk-http.rule=Host(`i80.dk`) && PathPrefix(`/.well-known/matrix`)",
+        "traefik.http.routers.continuwuity-wk-http.entrypoints=http",
+        "traefik.http.routers.continuwuity-wk-http.middlewares=continuwuity-redirect",
+        "traefik.http.routers.continuwuity-wk-http.priority=100",
+        "traefik.http.middlewares.continuwuity-redirect.redirectscheme.scheme=https",
+        "traefik.http.middlewares.continuwuity-redirect.redirectscheme.permanent=true",
+      ]
+
+      check {
+        name     = "continuwuity-http"
+        type     = "http"
+        port     = "http"
+        path     = "/_matrix/client/versions"
+        interval = "30s"
+        timeout  = "5s"
+
+        check_restart {
+          limit = 3
+          grace = "60s"
+        }
+      }
+    }
+
+    volume "continuwuity-volume" {
+      type            = "csi"
+      read_only       = false
+      source          = "continuwuity-volume"
+      attachment_mode = "file-system"
+      access_mode     = "single-node-writer"
+      per_alloc       = false
+    }
+
+    volume "continuwuity-media-volume" {
+      type            = "csi"
+      read_only       = false
+      source          = "continuwuity-media-volume"
+      attachment_mode = "file-system"
+      access_mode     = "single-node-writer"
+      per_alloc       = false
+
+      mount_options {
+        mount_flags = []
+      }
+    }
+
+    restart {
+      attempts = 3
+      interval = "10m"
+      delay    = "30s"
+      mode     = "delay"
+    }
+
+    update {
+      max_parallel     = 1
+      health_check     = "checks"
+      min_healthy_time = "30s"
+      healthy_deadline = "5m"
+      auto_revert      = true
+    }
+
+    task "continuwuity" {
+      driver = "docker"
+
+      env {
+        # server_name is PERMANENT — it is the suffix of every user/room ID (@henrik:i80.dk).
+        CONTINUWUITY_SERVER_NAME        = "i80.dk"
+        CONTINUWUITY_TRUSTED_SERVERS    = "[\"matrix.org\"]"
+        CONTINUWUITY_ALLOW_REGISTRATION = false
+        CONTINUWUITY_ADDRESS            = "0.0.0.0"
+        CONTINUWUITY_PORT               = 6167
+        CONTINUWUITY_DATABASE_PATH      = "/var/lib/continuwuity"
+
+        # Delegation: the homeserver lives at cn.i80.dk, advertised via the apex .well-known.
+        # client = base URL (no port); server = host:port for federation.
+        CONTINUWUITY_WELL_KNOWN = <<EOF
+{
+client=https://cn.i80.dk,
+server=cn.i80.dk:443
+}
+EOF
+
+        # --- First-user bootstrap (see notes) ---
+        # To create your account once, temporarily set:
+        #   CONTINUWUITY_ALLOW_REGISTRATION = true
+        #   CONTINUWUITY_REGISTRATION_TOKEN = "<long-random-secret>"
+        # register @henrik:i80.dk with that token, then revert to allow_registration=false and redeploy.
+      }
+
+      config {
+        # TODO: pin to a released tag instead of :latest before going to prod.
+        image = "forgejo.ellis.link/continuwuation/continuwuity:latest"
+        ports = ["http"]
+      }
+
+      resources {
+        cpu    = 500
+        memory = 1024
+      }
+
+      volume_mount {
+        volume      = "continuwuity-volume"
+        destination = "/var/lib/continuwuity"
+      }
+
+      volume_mount {
+        volume      = "continuwuity-media-volume"
+        destination = "/var/lib/continuwuity/media"
+      }
+    }
+  }
+}