From de6c3312ceca9d0f9c0d2041c16a46d6b538b2a6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20K=C3=B6sters?= <timo@koesters.xyz>
Date: Sat, 12 Feb 2022 10:29:04 +0100
Subject: [PATCH 1/6] docs: make all configs match

---
 DEPLOY.md                         | 27 +++++++++++-----------
 Dockerfile                        | 15 +++++++++---
 conduit-example.toml              | 18 +++------------
 debian/postinst                   | 38 ++++++++++++++++---------------
 docker-compose.yml                | 31 ++++++++++++-------------
 docker/README.md                  |  2 +-
 docker/docker-compose.traefik.yml | 31 ++++++++++---------------
 7 files changed, 76 insertions(+), 86 deletions(-)

diff --git a/DEPLOY.md b/DEPLOY.md
index eecf5136..0657c0c0 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -93,24 +93,30 @@ to read it. You need to change at least the server name.**
 
 ```toml
 [global]
-# The server_name is the name of this server. It is used as a suffix for user
+# The server_name is the pretty name of this server. It is used as a suffix for user
 # and room ids. Examples: matrix.org, conduit.rs
-# The Conduit server needs to be reachable at https://your.server.name/ on port
-# 443 (client-server) and 8448 (federation) OR you can create /.well-known
-# files to redirect requests. See
+
+# The Conduit server needs all /_matrix/ requests to be reachable at
+# https://your.server.name/ on port 443 (client-server) and 8448 (federation).
+
+# If that's not possible for you, you can create /.well-known files to redirect
+# requests. See
 # https://matrix.org/docs/spec/client_server/latest#get-well-known-matrix-client
-# and https://matrix.org/docs/spec/server_server/r0.1.4#get-well-known-matrix-server
+# and
+# https://matrix.org/docs/spec/server_server/r0.1.4#get-well-known-matrix-server
 # for more information
 
 # YOU NEED TO EDIT THIS
 #server_name = "your.server.name"
 
 # This is the only directory where Conduit will save its data
-database_path = "/var/lib/matrix-conduit/conduit_db"
+database_path = "/var/lib/matrix-conduit/"
+database_backend = "rocksdb"
 
 # The port Conduit will be running on. You need to set up a reverse proxy in
 # your web server (e.g. apache or nginx), so all requests to /_matrix on port
 # 443 and 8448 will be forwarded to the Conduit instance running on this port
+# Docker users: Don't change this, you'll need to map an external port to this.
 port = 6167
 
 # Max size for uploads
@@ -119,20 +125,15 @@ max_request_size = 20_000_000 # in bytes
 # Enables registration. If set to false, no users can register on this server.
 allow_registration = true
 
-# Disable encryption, so no new encrypted rooms can be created
-# Note: existing rooms will continue to work
-allow_encryption = true
 allow_federation = true
 
 trusted_servers = ["matrix.org"]
 
 #max_concurrent_requests = 100 # How many requests Conduit sends to other servers at the same time
-#workers = 4 # default: cpu core count * 2
+#log = "info,state_res=warn,rocket=off,_=off,sled=off"
 
 address = "127.0.0.1" # This makes sure Conduit can only be reached using the reverse proxy
-
-# The total amount of memory that the database will use.
-#db_cache_capacity_mb = 200
+#address = "0.0.0.0" # If Conduit is running in a container, make sure the reverse proxy (ie. Traefik) can reach it.
 ```
 
 ## Setting the correct file permissions
diff --git a/Dockerfile b/Dockerfile
index b631f297..34a07665 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -35,9 +35,18 @@ FROM docker.io/debian:bullseye-slim AS runner
 # You still need to map the port when using the docker command or docker-compose.
 EXPOSE 6167
 
-# Note from @jfowl: I would like to remove the config file in the future and just have the Docker version be configured with envs.
-ENV CONDUIT_CONFIG="/srv/conduit/conduit.toml" \
-    CONDUIT_PORT=6167
+ENV CONDUIT_SERVER_NAME=your.server.name # EDIT THIS
+ENV CONDUIT_DATABASE_PATH=/var/lib/matrix-conduit
+ENV CONDUIT_DATABASE_BACKEND=rocksdb
+ENV CONDUIT_PORT=6167
+ENV CONDUIT_MAX_REQUEST_SIZE=20_000_000  # in bytes, ~20 MB
+ENV CONDUIT_ALLOW_REGISTRATION=true
+ENV CONDUIT_ALLOW_FEDERATION=true
+ENV CONDUIT_TRUSTED_SERVERS=["matrix.org"]
+#ENV CONDUIT_MAX_CONCURRENT_REQUESTS=100
+#ENV CONDUIT_LOG=info,rocket=off,_=off,sled=off
+ENV CONDUIT_ADDRESS=0.0.0.0
+ENV CONDUIT_CONFIG=''  # Ignore this
 
 # Conduit needs:
 #   ca-certificates: for https
diff --git a/conduit-example.toml b/conduit-example.toml
index c22c8622..23c18446 100644
--- a/conduit-example.toml
+++ b/conduit-example.toml
@@ -16,7 +16,7 @@
 #server_name = "your.server.name"
 
 # This is the only directory where Conduit will save its data
-database_path = "/var/lib/conduit/"
+database_path = "/var/lib/matrix-conduit/"
 database_backend = "rocksdb"
 
 # The port Conduit will be running on. You need to set up a reverse proxy in
@@ -31,24 +31,12 @@ max_request_size = 20_000_000 # in bytes
 # Enables registration. If set to false, no users can register on this server.
 allow_registration = true
 
-# Disable encryption, so no new encrypted rooms can be created
-# Note: existing rooms will continue to work
-#allow_encryption = false
-#allow_federation = false
-
-# Enable jaeger to support monitoring and troubleshooting through jaeger
-#allow_jaeger = false
+allow_federation = true
 
 trusted_servers = ["matrix.org"]
 
 #max_concurrent_requests = 100 # How many requests Conduit sends to other servers at the same time
-#log = "info,state_res=warn,_=off,sled=off"
-#workers = 4 # default: cpu core count * 2
+#log = "info,state_res=warn,rocket=off,_=off,sled=off"
 
 address = "127.0.0.1" # This makes sure Conduit can only be reached using the reverse proxy
 #address = "0.0.0.0" # If Conduit is running in a container, make sure the reverse proxy (ie. Traefik) can reach it.
-
-proxy = "none" # more examples can be found at src/database/proxy.rs:6
-
-# The total amount of memory that the database will use.
-#db_cache_capacity_mb = 200
diff --git a/debian/postinst b/debian/postinst
index 29a93676..10d5561c 100644
--- a/debian/postinst
+++ b/debian/postinst
@@ -36,18 +36,24 @@ case "$1" in
       mkdir -p "$CONDUIT_CONFIG_PATH"
       cat > "$CONDUIT_CONFIG_FILE" << EOF
 [global]
-# The server_name is the name of this server. It is used as a suffix for user
-# and room ids. Examples: matrix.org, conduit.rs
-# The Conduit server needs to be reachable at https://your.server.name/ on port
-# 443 (client-server) and 8448 (federation) OR you can create /.well-known
-# files to redirect requests. See
+# The server_name is the pretty name of this server. It is used as a suffix for
+# user and room ids. Examples: matrix.org, conduit.rs
+
+# The Conduit server needs all /_matrix/ requests to be reachable at
+# https://your.server.name/ on port 443 (client-server) and 8448 (federation).
+
+# If that's not possible for you, you can create /.well-known files to redirect
+# requests. See
 # https://matrix.org/docs/spec/client_server/latest#get-well-known-matrix-client
-# and https://matrix.org/docs/spec/server_server/r0.1.4#get-well-known-matrix-server
-# for more information.
+# and
+# https://matrix.org/docs/spec/server_server/r0.1.4#get-well-known-matrix-server
+# for more information
+
 server_name = "${CONDUIT_SERVER_NAME}"
 
 # This is the only directory where Conduit will save its data.
 database_path = "${CONDUIT_DATABASE_PATH}"
+database_backend = "rocksdb"
 
 # The address Conduit will be listening on.
 # By default the server listens on address 0.0.0.0. Change this to 127.0.0.1 to
@@ -56,7 +62,8 @@ address = "${CONDUIT_ADDRESS}"
 
 # The port Conduit will be running on. You need to set up a reverse proxy in
 # your web server (e.g. apache or nginx), so all requests to /_matrix on port
-# 443 and 8448 will be forwarded to the Conduit instance running on this port.
+# 443 and 8448 will be forwarded to the Conduit instance running on this port
+# Docker users: Don't change this, you'll need to map an external port to this.
 port = ${CONDUIT_PORT}
 
 # Max size for uploads
@@ -65,20 +72,15 @@ max_request_size = 20_000_000 # in bytes
 # Enables registration. If set to false, no users can register on this server.
 allow_registration = true
 
-# Disable encryption, so no new encrypted rooms can be created.
-# Note: Existing rooms will continue to work.
-#allow_encryption = false
-#allow_federation = false
+allow_federation = true
 
-# Enable jaeger to support monitoring and troubleshooting through jaeger.
-#allow_jaeger = false
+trusted_servers = ["matrix.org"]
 
 #max_concurrent_requests = 100 # How many requests Conduit sends to other servers at the same time
-#log = "info,state_res=warn,_=off,sled=off"
-#workers = 4 # default: cpu core count * 2
+#log = "info,state_res=warn,rocket=off,_=off,sled=off"
 
-# The total amount of memory that the database will use.
-#db_cache_capacity_mb = 200
+address = "127.0.0.1" # This makes sure Conduit can only be reached using the reverse proxy
+#address = "0.0.0.0" # If Conduit is running in a container, make sure the reverse proxy (ie. Traefik) can reach it.
 EOF
     fi
     ;;
diff --git a/docker-compose.yml b/docker-compose.yml
index 88d5c3f6..5a17a8d2 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,27 +20,24 @@ services:
         ports:
             - 8448:6167
         volumes:
-            - db:/srv/conduit/.local/share/conduit
+            - db:/var/lib/matrix-conduit/
             ### Uncomment if you want to use conduit.toml to configure Conduit
             ### Note: Set env vars will override conduit.toml values
             # - ./conduit.toml:/srv/conduit/conduit.toml
         environment:
-            CONDUIT_SERVER_NAME: localhost:6167  # replace with your own name
-            CONDUIT_TRUSTED_SERVERS: '["matrix.org"]'
+            CONDUIT_SERVER_NAME: your.server.name # EDIT THIS
+            CONDUIT_DATABASE_PATH: /var/lib/matrix-conduit/
+            CONDUIT_DATABASE_BACKEND: rocksdb
+            CONDUIT_PORT: 6167
+            CONDUIT_MAX_REQUEST_SIZE: 20_000_000 # in bytes, ~20 MB
             CONDUIT_ALLOW_REGISTRATION: 'true'
-            ### Uncomment and change values as desired
-            # CONDUIT_ADDRESS: 0.0.0.0
-            # CONDUIT_PORT: 6167
-            # CONDUIT_CONFIG: '/srv/conduit/conduit.toml'  # if you want to configure purely by env vars, set this to an empty string ''
-            # Available levels are: error, warn, info, debug, trace - more info at: https://docs.rs/env_logger/*/env_logger/#enabling-logging
-            # CONDUIT_LOG: info  # default is: "info,_=off,sled=off"
-            # CONDUIT_ALLOW_JAEGER: 'false'
-            # CONDUIT_ALLOW_ENCRYPTION: 'false'
-            # CONDUIT_ALLOW_FEDERATION: 'false'
-            # CONDUIT_DATABASE_PATH: /srv/conduit/.local/share/conduit
-            # CONDUIT_WORKERS: 10
-            # CONDUIT_MAX_REQUEST_SIZE: 20_000_000  # in bytes, ~20 MB
-
+            CONDUIT_ALLOW_FEDERATION: 'true'
+            CONDUIT_TRUSTED_SERVERS: '["matrix.org"]'
+            #CONDUIT_MAX_CONCURRENT_REQUESTS: 100
+            #CONDUIT_LOG: info,rocket=off,_=off,sled=off
+            CONDUIT_ADDRESS: 0.0.0.0
+            CONDUIT_CONFIG: '' # Ignore this
+    #
     ### Uncomment if you want to use your own Element-Web App.
     ### Note: You need to provide a config.json for Element and you also need a second
     ###       Domain or Subdomain for the communication between Element and Conduit
@@ -56,4 +53,4 @@ services:
     #         - homeserver
 
 volumes:
-  db:
+    db:
diff --git a/docker/README.md b/docker/README.md
index d8867385..14758fd7 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -112,4 +112,4 @@ So...step by step:
      ```
 
 6. Run `docker-compose up -d`
-7. Connect to your homeserver with your preferred client and create a user. You should do this immediatly after starting Conduit, because the first created user is the admin.
+7. Connect to your homeserver with your preferred client and create a user. You should do this immediately after starting Conduit, because the first created user is the admin.
diff --git a/docker/docker-compose.traefik.yml b/docker/docker-compose.traefik.yml
index f625080a..ca560b89 100644
--- a/docker/docker-compose.traefik.yml
+++ b/docker/docker-compose.traefik.yml
@@ -18,28 +18,22 @@ services:
         #         GIT_REF: origin/master
         restart: unless-stopped
         volumes:
-            - db:/srv/conduit/.local/share/conduit
-            ### Uncomment if you want to use conduit.toml to configure Conduit
-            ### Note: Set env vars will override conduit.toml values
-            # - ./conduit.toml:/srv/conduit/conduit.toml
+            - db:/var/lib/matrix-conduit/
         networks:
             - proxy
         environment:
-            CONDUIT_SERVER_NAME: localhost:6167  # replace with your own name
+            CONDUIT_SERVER_NAME: your.server.name # EDIT THIS
+            CONDUIT_DATABASE_PATH: /var/lib/matrix-conduit/
+            CONDUIT_DATABASE_BACKEND: rocksdb
+            CONDUIT_PORT: 6167
+            CONDUIT_MAX_REQUEST_SIZE: 20_000_000 # in bytes, ~20 MB
+            CONDUIT_ALLOW_REGISTRATION: 'true'
+            CONDUIT_ALLOW_FEDERATION: 'true'
             CONDUIT_TRUSTED_SERVERS: '["matrix.org"]'
-            CONDUIT_ALLOW_REGISTRATION : 'true'
-            ### Uncomment and change values as desired
-            # CONDUIT_ADDRESS: 0.0.0.0
-            # CONDUIT_PORT: 6167
-            # CONDUIT_CONFIG: '/srv/conduit/conduit.toml'  # if you want to configure purely by env vars, set this to an empty string ''
-            # Available levels are: error, warn, info, debug, trace - more info at: https://docs.rs/env_logger/*/env_logger/#enabling-logging
-            # CONDUIT_LOG: info  # default is: "info,_=off,sled=off"
-            # CONDUIT_ALLOW_JAEGER: 'false'
-            # CONDUIT_ALLOW_ENCRYPTION: 'false'
-            # CONDUIT_ALLOW_FEDERATION: 'false'
-            # CONDUIT_DATABASE_PATH: /srv/conduit/.local/share/conduit
-            # CONDUIT_WORKERS: 10
-            # CONDUIT_MAX_REQUEST_SIZE: 20_000_000  # in bytes, ~20 MB
+            #CONDUIT_MAX_CONCURRENT_REQUESTS: 100
+            #CONDUIT_LOG: info,rocket=off,_=off,sled=off
+            CONDUIT_ADDRESS: 0.0.0.0
+            CONDUIT_CONFIG: '' # Ignore this
 
     # We need some way to server the client and server .well-known json. The simplest way is to use a nginx container
     # to serve those two as static files. If you want to use a different way, delete or comment the below service, here
@@ -50,7 +44,6 @@ services:
         volumes:
             - ./nginx/matrix.conf:/etc/nginx/conf.d/matrix.conf # the config to serve the .well-known/matrix files
             - ./nginx/www:/var/www/ # location of the client and server .well-known-files
-
     ### Uncomment if you want to use your own Element-Web App.
     ### Note: You need to provide a config.json for Element and you also need a second
     ###       Domain or Subdomain for the communication between Element and Conduit

From c4353405a5c457b8301de123c646e748a07f8a22 Mon Sep 17 00:00:00 2001
From: Jonas Zohren <git-pbkyr@jzohren.de>
Date: Sun, 13 Feb 2022 12:15:40 +0000
Subject: [PATCH 2/6] Suggestions from Jonas Zohren

---
 DEPLOY.md          | 4 ++--
 debian/postinst    | 2 +-
 docker-compose.yml | 3 ---
 docker/README.md   | 2 +-
 4 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/DEPLOY.md b/DEPLOY.md
index 0657c0c0..a28218d7 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -148,8 +148,8 @@ sudo chown -R conduit:nogroup /etc/matrix-conduit
 If you use the default database path you also need to run this:
 
 ```bash
-sudo mkdir -p /var/lib/matrix-conduit/conduit_db
-sudo chown -R conduit:nogroup /var/lib/matrix-conduit/conduit_db
+sudo mkdir -p /var/lib/matrix-conduit/
+sudo chown -R conduit:nogroup /var/lib/matrix-conduit/
 ```
 
 ## Setting up the Reverse Proxy
diff --git a/debian/postinst b/debian/postinst
index 10d5561c..378f99ed 100644
--- a/debian/postinst
+++ b/debian/postinst
@@ -5,7 +5,7 @@ set -e
 
 CONDUIT_CONFIG_PATH=/etc/matrix-conduit
 CONDUIT_CONFIG_FILE="${CONDUIT_CONFIG_PATH}/conduit.toml"
-CONDUIT_DATABASE_PATH=/var/lib/matrix-conduit/conduit_db
+CONDUIT_DATABASE_PATH=/var/lib/matrix-conduit/
 
 case "$1" in
   configure)
diff --git a/docker-compose.yml b/docker-compose.yml
index 5a17a8d2..0a9d8f4d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -21,9 +21,6 @@ services:
             - 8448:6167
         volumes:
             - db:/var/lib/matrix-conduit/
-            ### Uncomment if you want to use conduit.toml to configure Conduit
-            ### Note: Set env vars will override conduit.toml values
-            # - ./conduit.toml:/srv/conduit/conduit.toml
         environment:
             CONDUIT_SERVER_NAME: your.server.name # EDIT THIS
             CONDUIT_DATABASE_PATH: /var/lib/matrix-conduit/
diff --git a/docker/README.md b/docker/README.md
index 14758fd7..28ad06f3 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -24,7 +24,7 @@ which also will tag the resulting image as `matrixconduit/matrix-conduit:latest`
 After building the image you can simply run it with
 
 ```bash
-docker run -d -p 8448:6167 -v ~/conduit.toml:/srv/conduit/conduit.toml -v db:/srv/conduit/.local/share/conduit matrixconduit/matrix-conduit:latest
+docker run -d -p 8448:6167 -v ~/conduit.toml:/srv/conduit/conduit.toml -v db:/var/lib/matrix-conduit/ matrixconduit/matrix-conduit:latest
 ```
 
 or you can skip the build step and pull the image from one of the following registries:

From 97507d28806e7a10cb4ffc9ab4cc64b902b267ef Mon Sep 17 00:00:00 2001
From: Jonas Zohren <git-pbkyr@jzohren.de>
Date: Sun, 13 Feb 2022 12:25:19 +0000
Subject: [PATCH 3/6] Remove most env vars from Dockerfile

---
 Dockerfile | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 34a07665..82ee9516 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -35,18 +35,9 @@ FROM docker.io/debian:bullseye-slim AS runner
 # You still need to map the port when using the docker command or docker-compose.
 EXPOSE 6167
 
-ENV CONDUIT_SERVER_NAME=your.server.name # EDIT THIS
-ENV CONDUIT_DATABASE_PATH=/var/lib/matrix-conduit
-ENV CONDUIT_DATABASE_BACKEND=rocksdb
-ENV CONDUIT_PORT=6167
-ENV CONDUIT_MAX_REQUEST_SIZE=20_000_000  # in bytes, ~20 MB
-ENV CONDUIT_ALLOW_REGISTRATION=true
-ENV CONDUIT_ALLOW_FEDERATION=true
-ENV CONDUIT_TRUSTED_SERVERS=["matrix.org"]
-#ENV CONDUIT_MAX_CONCURRENT_REQUESTS=100
-#ENV CONDUIT_LOG=info,rocket=off,_=off,sled=off
-ENV CONDUIT_ADDRESS=0.0.0.0
-ENV CONDUIT_CONFIG=''  # Ignore this
+ENV CONDUIT_PORT=6167 \
+    CONDUIT_DATABASE_PATH=/var/lib/matrix-conduit \
+    CONDUIT_CONFIG=''  # Set no config file to do all configuration with env vars
 
 # Conduit needs:
 #   ca-certificates: for https

From 0be8500c4fec53d2442da7f3cb98ecc6cbe198da Mon Sep 17 00:00:00 2001
From: Jonas Zohren <git-pbkyr@jzohren.de>
Date: Sun, 13 Feb 2022 12:38:13 +0000
Subject: [PATCH 4/6] Set all env vars in docker README

---
 Dockerfile       |  1 +
 docker/README.md | 12 +++++++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 82ee9516..e6cdaf57 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -36,6 +36,7 @@ FROM docker.io/debian:bullseye-slim AS runner
 EXPOSE 6167
 
 ENV CONDUIT_PORT=6167 \
+    CONDUIT_ADDRESS="0.0.0.0" \
     CONDUIT_DATABASE_PATH=/var/lib/matrix-conduit \
     CONDUIT_CONFIG=''  # Set no config file to do all configuration with env vars
 
diff --git a/docker/README.md b/docker/README.md
index 28ad06f3..f9d94ab2 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -24,7 +24,17 @@ which also will tag the resulting image as `matrixconduit/matrix-conduit:latest`
 After building the image you can simply run it with
 
 ```bash
-docker run -d -p 8448:6167 -v ~/conduit.toml:/srv/conduit/conduit.toml -v db:/var/lib/matrix-conduit/ matrixconduit/matrix-conduit:latest
+docker run -d -p 8448:6167 \
+  -v db:/var/lib/matrix-conduit/ \
+  -e CONDUIT_SERVER_NAME="your.server.name" \
+  -e CONDUIT_DATABASE_BACKEND="rocksdb" \
+  -e CONDUIT_ALLOW_REGISTRATION=true \
+  -e CONDUIT_ALLOW_FEDERATION=true \
+  -e CONDUIT_MAX_REQUEST_SIZE="20_000_000" \
+  -e CONDUIT_TRUSTED_SERVERS="[\"matrix.org\"]" \
+  -e CONDUIT_MAX_CONCURRENT_REQUESTS="100" \
+  -e CONDUIT_LOG="info,rocket=off,_=off,sled=off" \
+  --name conduit matrixconduit/matrix-conduit:latest
 ```
 
 or you can skip the build step and pull the image from one of the following registries:

From 98b67da649c602574b4c4b304b3c52fdd0450641 Mon Sep 17 00:00:00 2001
From: Jonas Zohren <git-pbkyr@jzohren.de>
Date: Wed, 16 Feb 2022 13:04:45 +0000
Subject: [PATCH 5/6] fix: Docker syntax

---
 Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index e6cdaf57..49c32244 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -38,7 +38,8 @@ EXPOSE 6167
 ENV CONDUIT_PORT=6167 \
     CONDUIT_ADDRESS="0.0.0.0" \
     CONDUIT_DATABASE_PATH=/var/lib/matrix-conduit \
-    CONDUIT_CONFIG=''  # Set no config file to do all configuration with env vars
+    CONDUIT_CONFIG=''
+#    └─> Set no config file to do all configuration with env vars
 
 # Conduit needs:
 #   ca-certificates: for https

From b4225cb0fca88636e0a4d6213cfcea30c800ec1e Mon Sep 17 00:00:00 2001
From: Jonas Zohren <git-pbkyr@jzohren.de>
Date: Wed, 16 Feb 2022 15:04:32 +0100
Subject: [PATCH 6/6] fix(docker): use user 1000 and standard db path

---
 Dockerfile                              | 15 ++++----
 docker/ci-binaries-packaging.Dockerfile | 48 +++++++++++++------------
 2 files changed, 34 insertions(+), 29 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 49c32244..76d10ea9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,8 @@ FROM docker.io/rust:1.58-bullseye AS builder
 WORKDIR /usr/src/conduit
 
 # Install required packages to build Conduit and it's dependencies
-RUN apt update && apt -y install libclang-dev
+RUN apt-get update && \
+    apt-get -y --no-install-recommends install libclang-dev=1:11.0-51+nmu5
 
 # == Build dependencies without our own code separately for caching ==
 #
@@ -44,7 +45,7 @@ ENV CONDUIT_PORT=6167 \
 # Conduit needs:
 #   ca-certificates: for https
 #   iproute2 & wget: for the healthcheck script
-RUN apt update && apt -y install \
+RUN apt-get update && apt-get -y --no-install-recommends install \
     ca-certificates \
     iproute2 \
     wget \
@@ -61,12 +62,12 @@ HEALTHCHECK --start-period=5s --interval=5s CMD ./healthcheck.sh
 COPY --from=builder /usr/src/conduit/target/release/conduit /srv/conduit/conduit
 
 # Improve security: Don't run stuff as root, that does not need to run as root
-# Add 'conduit' user and group (100:82). The UID:GID choice is to be compatible
-# with previous, Alpine-based containers, where the user and group were both
-# named 'www-data'.
+# Most distros also use 1000:1000 for the first real user, so this should resolve volume mounting problems.
+ARG USER_ID=1000
+ARG GROUP_ID=1000
 RUN set -x ; \
-    groupadd -r -g 82 conduit ; \
-    useradd -r -M -d /srv/conduit -o -u 100 -g conduit conduit && exit 0 ; exit 1
+    groupadd -r -g ${GROUP_ID} conduit ; \
+    useradd -l -r -M -d /srv/conduit -o -u ${USER_ID} -g conduit conduit && exit 0 ; exit 1
 
 # Change ownership of Conduit files to conduit user and group and make the healthcheck executable:
 RUN chown -cR conduit:conduit /srv/conduit && \
diff --git a/docker/ci-binaries-packaging.Dockerfile b/docker/ci-binaries-packaging.Dockerfile
index 3731bac1..ee1ca4ca 100644
--- a/docker/ci-binaries-packaging.Dockerfile
+++ b/docker/ci-binaries-packaging.Dockerfile
@@ -14,9 +14,14 @@ FROM docker.io/alpine:3.15.0 AS runner
 # You still need to map the port when using the docker command or docker-compose.
 EXPOSE 6167
 
-# Note from @jfowl: I would like to remove the config file in the future and just have the Docker version be configured with envs. 
-ENV CONDUIT_CONFIG="/srv/conduit/conduit.toml" \
-    CONDUIT_PORT=6167
+# Users are expected to mount a volume to this directory:
+ARG DEFAULT_DB_PATH=/var/lib/matrix-conduit
+
+ENV CONDUIT_PORT=6167 \
+    CONDUIT_ADDRESS="0.0.0.0" \
+    CONDUIT_DATABASE_PATH=${DEFAULT_DB_PATH} \
+    CONDUIT_CONFIG=''
+#    └─> Set no config file to do all configuration with env vars
 
 # Conduit needs:
 #   ca-certificates: for https
@@ -25,7 +30,6 @@ RUN apk add --no-cache \
     ca-certificates \
     iproute2
 
-
 ARG CREATED
 ARG VERSION
 ARG GIT_REF
@@ -45,36 +49,36 @@ LABEL org.opencontainers.image.created=${CREATED} \
     org.opencontainers.image.ref.name=""
 
 # Created directory for the database and media files
-RUN mkdir -p /srv/conduit/.local/share/conduit
+RUN mkdir -p ${DEFAULT_DB_PATH}
 
 # Test if Conduit is still alive, uses the same endpoint as Element
 COPY ./docker/healthcheck.sh /srv/conduit/healthcheck.sh
 HEALTHCHECK --start-period=5s --interval=5s CMD ./healthcheck.sh
 
-
-# Depending on the target platform (e.g. "linux/arm/v7", "linux/arm64/v8", or "linux/amd64")
-# copy the matching binary into this docker image
-ARG TARGETPLATFORM
-COPY ./$TARGETPLATFORM /srv/conduit/conduit
-
-
 # Improve security: Don't run stuff as root, that does not need to run as root:
-# Add www-data user and group with UID 82, as used by alpine
-# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install
+# Most distros also use 1000:1000 for the first real user, so this should resolve volume mounting problems.
+ARG USER_ID=1000
+ARG GROUP_ID=1000
 RUN set -x ; \
-    addgroup -Sg 82 www-data 2>/dev/null ; \
-    adduser -S -D -H -h /srv/conduit -G www-data -g www-data www-data 2>/dev/null ; \
-    addgroup www-data www-data 2>/dev/null && exit 0 ; exit 1
+    deluser --remove-home www-data ; \
+    addgroup -S -g ${GROUP_ID} conduit 2>/dev/null ; \
+    adduser -S -u ${USER_ID} -D -H -h /srv/conduit -G conduit -g conduit conduit 2>/dev/null ; \
+    addgroup conduit conduit 2>/dev/null && exit 0 ; exit 1
 
-# Change ownership of Conduit files to www-data user and group
-RUN chown -cR www-data:www-data /srv/conduit
-RUN chmod +x /srv/conduit/healthcheck.sh
+# Change ownership of Conduit files to conduit user and group
+RUN chown -cR conduit:conduit /srv/conduit && \
+    chmod +x /srv/conduit/healthcheck.sh
 
-# Change user to www-data
-USER www-data
+# Change user to conduit
+USER conduit
 # Set container home directory
 WORKDIR /srv/conduit
 
 # Run Conduit and print backtraces on panics
 ENV RUST_BACKTRACE=1
 ENTRYPOINT [ "/srv/conduit/conduit" ]
+
+# Depending on the target platform (e.g. "linux/arm/v7", "linux/arm64/v8", or "linux/amd64")
+# copy the matching binary into this docker image
+ARG TARGETPLATFORM
+COPY --chown=conduit:conduit ./$TARGETPLATFORM /srv/conduit/conduit