mkdir -p /opt/quzuo-tuwunel && cd /opt/quzuo-tuwunel

name: tuwunel-1-9-3-stack
services:
  tuwunel:
    image: ghcr.io/matrix-construct/tuwunel:v1.9.3
    container_name: tuwunel-1-9-3
    restart: unless-stopped
    ports:
      - "8008:8008"
      - "8448:8448"
    environment:
      # === 必需：服务器名（一经选定不可修改，数据库绑定） ===
      - TUWUNEL_SERVER_NAME=chat.example.com
      # === 必需：数据目录 ===
      - TUWUNEL_DATABASE_PATH=/var/lib/tuwunel
      # === 必需：监听 0.0.0.0 才能被宿主机访问 ===
      - TUWUNEL_ADDRESS=0.0.0.0
      - TUWUNEL_PORT=8008
      # === 可选：启用开放注册（生产环境建议改用 token 模式） ===
      - TUWUNEL_ALLOW_REGISTRATION=true
      - TUWUNEL_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE=true
      # === 可选：日志级别 ===
      - TUWUNEL_LOG_LEVELS=info
      # === 可选：管理注册共享密钥（启用 _synapse/admin/v1/register） ===
      - TUWUNEL_REGISTRATION_SHARED_SECRET=please-change-this-to-a-long-random-string
    volumes:
      - tuwunel-data:/var/lib/tuwunel
    networks:
      - tuwunel-net

volumes:
  tuwunel-data:

networks:
  tuwunel-net:
    driver: bridge

docker compose up -d

[+] Pulling image "ghcr.io/matrix-construct/tuwunel:v1.9.3"
ghcr.io/matrix-construct/tuwunel:v1.9.3 Pulled
[+] Running 3/3
 ✔ Network tuwunel-net      Created
 ✔ Volume tuwunel-data      Created
 ✔ Container tuwunel-1-9-3  Started

docker logs tuwunel-1-9-3 --tail 30

2026-10-27T06:50:33.286372Z  INFO tuwunel::server: 1.9.3 server_name=chat.example.com database_path="/var/lib/tuwunel" log_levels=info
2026-10-27T06:50:33.397724Z  INFO main: start: open: tuwunel_database::engine::open: Opened database. columns=135 sequence=0 time=88.176649ms
2026-10-27T06:50:33.401960Z  WARN main: start: tuwunel_service::migrations: Created new RocksDB database with version 17
2026-10-27T06:50:33.404991Z  INFO tuwunel_router::serve: Listening on ["tcp:0.0.0.0:8008"]

curl -s http://localhost:8008/_matrix/client/versions | python3 -m json.tool | head -15

{
    "versions": [
        "r0.0.1", "r0.1.0", "r0.2.0", "r0.3.0", "r0.4.0", "r0.5.0", "r0.6.0",
        "r0.6.1", "v1.1", "v1.2", "v1.3", "v1.4", "v1.5", "v1.6", "v1.7",
        "v1.8", "v1.9", "v1.10", "v1.11", "v1.12", "v1.13", "v1.14",
        "v1.15", "v1.16", "v1.17", "v1.18", "v1.19"
    ],
    "unstable_features": {
        "org.matrix.msc2732": true,
        "org.matrix.msc3715": true,
        "org.matrix.msc3882": true,
        "org.matrix.msc3575": true
    }
}

curl -s http://localhost:8008/_matrix/client/v3/login | python3 -m json.tool

{
    "flows": [
        {"type": "m.login.application_service"},
        {"type": "m.login.token", "get_login_token": true},
        {"type": "m.login.password"}
    ]
}

# Step 1: 发起注册，获取 session
RESP=$(curl -s -X POST http://localhost:8008/_matrix/client/v3/register \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"q1w2e3r4","initial_device_display_name":"CLI"}')
SESSION=$(echo "$RESP" | python3 -c "import sys,json; print(json.load(sys.stdin)['session'])")
echo "Session: $SESSION"

# Step 2: 完成 dummy auth stage
curl -s -X POST http://localhost:8008/_matrix/client/v3/register \
  -H 'Content-Type: application/json' \
  -d "{\"username\":\"admin\",\"password\":\"q1w2e3r4\",\"initial_device_display_name\":\"CLI\",\"auth\":{\"type\":\"m.login.dummy\",\"session\":\"$SESSION\"}}" | python3 -m json.tool

{
    "access_token": "XrAr9IHjxOaSBdQoz7GsWaqhJAzoRlec",
    "user_id": "@admin:chat.example.com",
    "device_id": "z34EjhmALZ",
    "home_server": "chat.example.com"
}

TOKEN="XrAr9IHjxOaSBdQoz7GsWaqhJAzoRlec"
ROOM_ID=$(curl -s -X POST http://localhost:8008/_matrix/client/v3/createRoom \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"room_alias_name":"test-room","name":"Test Room","visibility":"public"}' | python3 -c "import sys,json; print(json.load(sys.stdin)['room_id'])")
echo "Room ID: $ROOM_ID"

# 发送消息
curl -s -X PUT "http://localhost:8008/_matrix/client/v3/rooms/$ROOM_ID/send/m.room.message/1" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"msgtype":"m.text","body":"Hello from Tuwunel!"}' | python3 -m json.tool

{
    "event_id": "$2edlN78wEgstO30UelVlHhIezG4J6hGchPctZlOYhpI"
}

# 停止容器
docker compose stop tuwunel
# 备份 volume（方式 1：直接用 volume 名称）
docker run --rm -v tuwunel-data:/data -v $(pwd):/backup alpine tar czf /backup/tuwunel-backup-$(date +%F).tar.gz -C /data .
# 方式 2：Tuwunel 在线备份（需配置 database_backup_path）
docker exec tuwunel-1-9-3 tuwunel --help | grep -i backup

services:
  tuwunel:
    volumes:
      - tuwunel-data:/var/lib/tuwunel
      - ./config/tuwunel.toml:/etc/tuwunel/tuwunel.toml:ro
    command: ["tuwunel", "-c", "/etc/tuwunel/tuwunel.toml"]

docker run -d \
  --name tuwunel-1-9-3 \
  --restart unless-stopped \
  -p 8008:8008 -p 8448:8448 \
  -e TUWUNEL_SERVER_NAME=chat.example.com \
  -e TUWUNEL_DATABASE_PATH=/var/lib/tuwunel \
  -e TUWUNEL_ADDRESS=0.0.0.0 \
  -e TUWUNEL_PORT=8008 \
  -e TUWUNEL_ALLOW_REGISTRATION=true \
  -e TUWUNEL_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE=true \
  -v tuwunel-data:/var/lib/tuwunel \
  ghcr.io/matrix-construct/tuwunel:v1.9.3

# 查看容器状态
docker ps --filter name=tuwunel-1-9-3 --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

# 实时日志
docker logs -f tuwunel-1-9-3

# 进入容器
docker exec -it tuwunel-1-9-3 sh

# Tuwunel 健康检查
docker exec tuwunel-1-9-3 tuwunel --health-check

# 数据库在线备份（需先配 database_backup_path）
docker exec tuwunel-1-9-3 tuwunel --maintenance

# 停机维护（拒绝新连接但保持运行）
docker exec tuwunel-1-9-3 tuwunel --read-only

# 重启
docker compose restart tuwunel

# 停止（保留数据）
docker compose down

# 停止+删除数据（⚠️ 清空数据库，不可恢复）
docker compose down -v

# 添加 OCI 仓库（Helm 3.8+ 支持 OCI）
helm pull oci://ghcr.io/spnngl/charts/tuwunel --version 0.1.1

# 或直接安装
helm install tuwunel oci://ghcr.io/spnngl/charts/tuwunel \
  --namespace tuwunel --create-namespace \
  --set serverName=chat.example.com \
  --set image.tag=1.9.4

# --- 核心必填 ---
serverName: example.com          # 服务器名，数据库首次启动后不可改

# --- 镜像 ---
image:
  repository: ghcr.io/spnngl/images/tuwunel
  tag: ""                        # 空则取 chart 注解，或指定如 "1.9.4"
  pullPolicy: IfNotPresent
imagePullSecrets: []

# --- Tuwunel TOML 配置覆盖（schema 校验）---
# 注意：只能设 TOML key（不能设 server_name, database_path, address, port 这四个由 chart 固定）
settings:
  # 注册
  allow_registration: true
  registration_token: ""
  yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse: false
  # 缓存调优
  cache_capacity_modifier: 1.0
  # Federation
  allow_federation: true
  # 日志
  log_levels: info

# --- 部署拓扑 ---
# Tuwunel 是单 writer 的 StatefulSet；replicas 固定 1（chart 不允许多副本）
replicaCount: 1

# --- 存储 ---
storage: true
dataStorageSize: 10Gi
# dataStorageClass: ""          # 指定 StorageClass

# --- Service ---
service:
  type: ClusterIP
  port: 8008

# --- Ingress ---
ingress:
  enabled: true
  className: ""
  annotations: {}
  hosts:
    - host: chat.example.com
      paths:
        - path: /
          pathType: Prefix

# --- well-known 委托 ---
# Matrix Federation 需要 _matrix._tcp SRV 或 /.well-known/matrix/server
ingress.wellKnown:
  enabled: true

# --- 可选组件 ---
cinny:
  enabled: true                 # 启用 Cinny Web 客户端（端口 80）
livekit:
  enabled: true                 # 启用 LiveKit RTC 后端
lkjwtService:
  enabled: true                 # 启用 LiveKit JWT 签发服务

# --- 资源 ---
resources:
  requests:
    cpu: 100m
    memory: 256Mi
  limits:
    cpu: 1000m
    memory: 512Mi

# --- 现有 Secret 挂载 ---
existingSecret:
  name: ""                      # 如指定，则挂载到 /etc/tuwunel/secrets
                                # 用于 registration_token_file, smtp_password_file 等