initial

2026-04-18 23:11:35 +02:00
commit f7cfd2a86e
196 changed files with 35538 additions and 0 deletions
@@ -0,0 +1,40 @@
+# LiveKit — local dev
+
+Self-hosted SFU for voice + video. Runs in Docker on host-network mode so
+WebRTC UDP ports work natively.
+
+## Start / Stop
+
+```bash
+# from repo root
+docker compose -f infra/livekit/docker-compose.yml up -d
+docker compose -f infra/livekit/docker-compose.yml logs -f livekit
+docker compose -f infra/livekit/docker-compose.yml down
+```
+
+## Endpoints
+
+| Purpose       | URL / Port            |
+|---------------|-----------------------|
+| Signaling WS  | `ws://localhost:7880` |
+| TCP fallback  | `tcp://localhost:7881`|
+| UDP RTC       | `50000-50100/udp`     |
+| coturn        | `3478/udp+tcp`        |
+
+## Dev keys
+
+Baked into `livekit.yaml`:
+
+- `LIVEKIT_API_KEY=devkey`
+- `LIVEKIT_API_SECRET=devsecret-at-least-32-bytes-long-please`
+- `LIVEKIT_URL=ws://localhost:7880`
+
+Same values go into `apps/desktop/.env` (via `VITE_LIVEKIT_URL`) and into the
+edge function's `supabase/functions/.env`.
+
+## Prod (later)
+
+Same image on the Hetzner VPS. Caddy terminates TLS at
+`wss://livekit.netralax.cloud`. coturn exposed on `turn.netralax.cloud:5349`
+(TURNS). Secrets generated via `openssl rand -hex 32` and stored in the server
+env + Supabase edge secrets.
@@ -0,0 +1,40 @@
+# Local LiveKit SFU for M2 dev.
+#
+# macOS + Docker Desktop: `network_mode: host` is NOT supported — falls back
+# to explicit port mapping. WebRTC UDP ports are ranged small for dev.
+#
+# Start:   docker compose -f infra/livekit/docker-compose.yml up -d
+# Stop:    docker compose -f infra/livekit/docker-compose.yml down
+# Logs:    docker compose -f infra/livekit/docker-compose.yml logs -f livekit
+
+services:
+  livekit:
+    image: livekit/livekit-server:latest
+    restart: unless-stopped
+    command: ["--config", "/etc/livekit.yaml"]
+    ports:
+      - "7880:7880/tcp" # signaling WS
+      - "7881:7881/tcp" # RTC TCP fallback
+      - "50000-50100:50000-50100/udp" # RTC UDP range
+    volumes:
+      - ./livekit.yaml:/etc/livekit.yaml:ro
+
+  turn:
+    image: coturn/coturn:4.6
+    restart: unless-stopped
+    ports:
+      - "3478:3478/udp"
+      - "3478:3478/tcp"
+      - "50200-50300:50200-50300/udp"
+    command: >
+      -n
+      --log-file=stdout
+      --min-port=50200
+      --max-port=50300
+      --no-cli
+      --no-tls
+      --no-dtls
+      --realm=local.chatapp
+      --lt-cred-mech
+      --user=dev:devpassword
+      --no-multicast-peers
@@ -0,0 +1,24 @@
+# LiveKit dev config. Keys must match what the `mint-livekit-token` edge
+# function signs. NEVER reuse these in prod — they're shared publicly here
+# only because this is a dev container on localhost.
+
+port: 7880
+log_level: info
+
+rtc:
+  tcp_port: 7881
+  port_range_start: 50000
+  port_range_end: 50100
+  use_external_ip: false
+  # For dev on macOS + Docker Desktop the host-networking mode maps UDP
+  # directly, so announce 127.0.0.1 so the client connects back to the
+  # loopback interface instead of the container IP.
+  node_ip: 127.0.0.1
+
+# Dev credentials.
+keys:
+  devkey: devsecret-at-least-32-bytes-long-please
+
+# Built-in STUN. We run coturn alongside anyway for the realistic flow.
+turn:
+  enabled: false
@@ -0,0 +1,12 @@
+# Client-side env vars that apps consume (copied into apps/mobile/.env and apps/desktop/.env).
+# Server-side vars (POSTGRES_PASSWORD, JWT_SECRET, SERVICE_ROLE_KEY, SMTP_*, etc.) live in
+# the Supabase compose .env on the VPS — do NOT mix them with client vars.
+
+# Public URL of the self-hosted Supabase gateway (served by Caddy).
+SUPABASE_URL=https://supabase.example.com
+
+# Anon public key (safe to ship to clients).
+SUPABASE_ANON_KEY=replace_me
+
+# Deep-link scheme used for magic-link redirects.
+AUTH_REDIRECT_URL=chatapp://auth/callback
@@ -0,0 +1,42 @@
+# Supabase Self-Hosting
+
+We do NOT vendor the Supabase docker-compose here — we track the official repo instead.
+
+## Bootstrap on a fresh Hetzner VPS (Debian/Ubuntu)
+
+```bash
+# 1. Install Docker + Compose plugin
+curl -fsSL https://get.docker.com | sh
+sudo usermod -aG docker $USER
+
+# 2. Clone Supabase's official self-host setup
+git clone --depth 1 https://github.com/supabase/supabase.git
+cd supabase/docker
+
+# 3. Seed env
+cp .env.example .env
+# Edit .env: set POSTGRES_PASSWORD, JWT_SECRET, ANON_KEY, SERVICE_ROLE_KEY, SMTP creds,
+# SITE_URL, API_EXTERNAL_URL, STUDIO_DEFAULT_ORGANIZATION etc.
+
+# 4. Pull + run
+docker compose pull
+docker compose up -d
+```
+
+## Our repo owns
+
+- `migrations/` — SQL migrations applied via Supabase CLI (`supabase db push`) to the self-hosted DB.
+- `.env.example` — the subset of Supabase env vars our client code depends on.
+- This README.
+
+## Reverse proxy
+
+Caddy setup lives in a separate directory (not part of this milestone). The public edge
+terminates TLS and routes `/auth/*`, `/rest/*`, `/realtime/*`, `/storage/*`, `/functions/*`
+to the compose stack, and `/` to Supabase Studio (ACL-restricted).
+
+## Security notes
+
+- Rotate JWT_SECRET at first boot; never reuse the example.
+- SERVICE_ROLE_KEY never ships to any client — only edge functions / admin scripts.
+- Enable RLS on every user-facing table. Invite-only enforced via `invites` table + policy.
@@ -0,0 +1,9 @@
+# Placeholder.
+#
+# We do NOT vendor Supabase's compose file — it changes often and shipping a fork
+# means tracking upstream manually. Instead, follow the setup in ./README.md:
+# clone https://github.com/supabase/supabase and run `docker compose up -d` in
+# `supabase/docker`. SQL migrations from ./migrations apply on top.
+#
+# If we ever need compose overrides (extra services, custom volumes), add a
+# `docker-compose.override.yml` next to this file and document it in README.