refactor: remove unused server scaffolding

.dockerignore

@@ -0,0 +1,12 @@
+.git
+.github
+target
+**/target
+**/fuzz/artifacts
+**/fuzz/corpus
+.env
+.env.*
+.current_token
+config/dev.toml
+data
+*.log

.github/workflows/ci.yml

@@ -2,78 +2,73 @@ name: CI
 
 on:
   push:
-    branches: ["**"]
+    branches: [main]
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
-  RUSTFLAGS: "-D warnings"
   RUST_BACKTRACE: 1
+  RUSTFLAGS: "-Dwarnings -Funsafe_code"
 
 jobs:
-
-  fmt:
-    name: Format
+  quality:
+    name: Quality gate
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
-        with: { components: rustfmt }
-      - run: cargo fmt --all -- --check
-
-  clippy:
-    name: Clippy
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with: { components: clippy }
+        with:
+          components: clippy, rustfmt
       - uses: Swatinem/rust-cache@v2
-      - run: cargo clippy --all-targets --all-features
+      - uses: taiki-e/install-action@cargo-deny
+      - run: ./scripts/check.sh --ci
 
-  test:
-    name: Tests
+  sqlx:
+    name: Migrations and SQLx metadata
     runs-on: ubuntu-latest
     services:
       postgres:
-        image: postgres:16
+        image: postgres:16-alpine
         env:
           POSTGRES_USER: vauxl
           POSTGRES_PASSWORD: vauxl
           POSTGRES_DB: vauxl
-          POSTGRES_HOST_AUTH_METHOD: trust
-        ports: ["5432:5432"]
+        ports:
+          - 5432:5432
         options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
+          --health-cmd "pg_isready -U vauxl -d vauxl"
+          --health-interval 5s
           --health-timeout 5s
-          --health-retries 5
-      redis:
-        image: redis:7-alpine
-        ports: ["6379:6379"]
+          --health-retries 10
     env:
-      DATABASE_URL: postgres://vauxl:vauxl@localhost/vauxl?sslmode=disable
-      REDIS_URL: redis://localhost:6379
-      SQLX_OFFLINE: true
+      DATABASE_URL: postgres://vauxl:vauxl@localhost:5432/vauxl?sslmode=disable
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-      - name: Install psql client
-        run: sudo apt-get install -y postgresql-client
-      - name: Run migrations
-        run: |
-          PGPASSWORD=vauxl psql -h localhost -U vauxl -d vauxl \
-            -f migrations/001_initial_schema.sql
-      - name: Run tests
-        run: cargo test --all
+      - name: Install SQLx CLI
+        run: cargo install sqlx-cli --version 0.8.6 --locked --no-default-features --features rustls,postgres
+      - name: Apply all migrations
+        run: cargo sqlx migrate run --source migrations
+      - name: Verify concurrent transaction retries
+        run: cargo test --locked -p vauxl-matrix concurrent_message_transaction_creates_one_event -- --ignored
+      - name: Verify SQLx metadata online
+        run: cargo sqlx prepare --workspace --check -- --locked --all-targets --all-features
 
-  deny:
-    name: Security & Licenses (cargo-deny)
+  production-image:
+    name: Production image
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: EmbarkStudios/cargo-deny-action@v2
-        with:
-          command: check advisories licenses bans sources
+      - name: Validate production Compose file
+        env:
+          DB_USER: vauxl
+          DB_PASSWORD: ci_only
+          DB_NAME: vauxl
+        run: docker compose -f docker/compose.prod.yml config --quiet
+      - name: Build production image
+        run: docker build --file docker/Dockerfile --tag vauxl-server:ci .

.github/workflows/nightly.yml

@@ -2,65 +2,37 @@ name: Nightly Security Checks
 
 on:
   schedule:
-    - cron: "0 2 * * *"  # 02:00 UTC täglich
-  workflow_dispatch:      # Manuell auslösbar
+    - cron: "0 2 * * *"
+  workflow_dispatch:
 
-jobs:
+permissions:
+  contents: read
 
+jobs:
   audit:
-    name: Daily CVE Audit
+    name: Daily dependency audit
     runs-on: ubuntu-latest
-    permissions:
-      issues: write
     steps:
       - uses: actions/checkout@v4
-      - name: Run cargo-deny
-        uses: EmbarkStudios/cargo-deny-action@v2
-        with:
-          command: check advisories bans licenses
-
-
-#  deny:
-#    name: Security & Licenses (cargo-deny)
-#    runs-on: ubuntu-latest
-#    steps:
-#      - uses: actions/checkout@v4
-#      - uses: EmbarkStudios/cargo-deny-action@v2
-#      with:
-#       command: check advisories licenses bans sources
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: taiki-e/install-action@cargo-deny
+      - run: cargo deny --locked --all-features check advisories licenses bans sources
+      - run: cargo deny --manifest-path crates/vauxl-crypto/fuzz/Cargo.toml --locked --all-features check advisories licenses bans sources
 
   fuzz-kem:
-    name: Fuzz vauxl-crypto KEM
+    name: Fuzz KEM decapsulation
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@nightly
-      - uses: Swatinem/rust-cache@v2
-      - name: Install cargo-fuzz
-        run: cargo install cargo-fuzz
-      - name: Create fuzz target if missing
-        run: |
-          if [ ! -d "crates/vauxl-crypto/fuzz" ]; then
-            cd crates/vauxl-crypto
-            cargo fuzz init
-            cat > fuzz/fuzz_targets/fuzz_kem.rs << 'FUZZ'
-          #![no_main]
-          use libfuzzer_sys::fuzz_target;
-
-          fuzz_target!(|data: &[u8]| {
-              // Placeholder: sobald decapsulate() implementiert ist,
-              // wird das mit echten Inputs gefüttert
-              let _ = data;
-          });
-          FUZZ
-          fi
-      - name: Run fuzzer (60 seconds)
-        run: |
-          cd crates/vauxl-crypto
-          cargo +nightly fuzz run fuzz_kem -- -max_total_time=60 2>&1 || true
+      - uses: taiki-e/install-action@cargo-fuzz
+      - name: Run KEM fuzzer
+        working-directory: crates/vauxl-crypto
+        run: cargo +nightly fuzz run kem_decapsulate -- -max_total_time=60
       - name: Upload corpus
         uses: actions/upload-artifact@v4
         if: always()
         with:
           name: fuzz-corpus
           path: crates/vauxl-crypto/fuzz/corpus/
+          if-no-files-found: ignore

.github/workflows/sytest.yml

@@ -1,20 +1,65 @@
-name: Matrix Spec Compliance
+name: Matrix API Complement
+
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
-  sytest:
+  complement:
+    name: Complement ${{ matrix.test }}
     runs-on: ubuntu-latest
-    continue-on-error: true  # don't block PRs until baseline established
+    strategy:
+      fail-fast: false
+      matrix:
+        test:
+          - TestVersionStructure
+          - TestLogin
+          - TestTyping
+          - TestRoomReceipts
+          - TestSendMessageWithTxn
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: vauxl
+          POSTGRES_PASSWORD: vauxl
+          POSTGRES_DB: vauxl
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U vauxl -d vauxl"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+      redis:
+        image: redis:7-alpine
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
     steps:
       - uses: actions/checkout@v4
-      - name: Build server
-        run: cargo build --release -p vauxl-server
-      - name: Run Sytest
-        uses: matrix-org/sytest-action@v0
+      - name: Build Complement image
+        run: docker build --file docker/Dockerfile.complement --tag vauxl-complement .
+      - uses: actions/checkout@v4
         with:
-          server-binary: target/release/vauxl-server
-      - name: Upload results
-        uses: actions/upload-artifact@v4
+          repository: matrix-org/complement
+          ref: c466460957697faa4ec36ce1b37921cef238fb91
+          path: complement
+      - uses: actions/setup-go@v5
         with:
-          name: sytest-results
-          path: sytest-results.xml
+          go-version-file: complement/go.mod
+      - name: Run isolated Complement test
+        working-directory: complement
+        env:
+          COMPLEMENT_BASE_IMAGE: vauxl-complement
+          COMPLEMENT_SHARE_ENV_PREFIX: PASS_
+          COMPLEMENT_ALWAYS_PRINT_SERVER_LOGS: "1"
+          PASS_VAUXL_DATABASE__URL: postgres://vauxl:vauxl@host.docker.internal:5432/vauxl?sslmode=disable
+          PASS_VAUXL_REDIS__URL: redis://host.docker.internal:6379
+          COMPLEMENT_TEST: ${{ matrix.test }}
+        run: go test -v -count=1 -timeout 6m -run "^${COMPLEMENT_TEST}$" ./tests/csapi

.gitignore

@@ -37,3 +37,4 @@ Thumbs.db
 # Generated at runtime
 data/
 config/dev.toml
+.current_token

.sqlx/README.md

@@ -1,7 +1,7 @@
-# sqlx offline query cache
+# SQLx offline query cache
 
-Dieses Verzeichnis enthält gecachte Query-Metadaten für `sqlx` im offline-Modus.
-Wird automatisch generiert durch: `cargo sqlx prepare --workspace`
+This directory contains generated query metadata for offline builds.
 
-Voraussetzung: lokale Postgres-DB muss laufen (via Docker im Container).
-Zum Aktualisieren: `docker exec docker-db-1 ...` (siehe CONTRIBUTING.md)
+Use the online mode of `scripts/check.sh` after changing a SQLx query. The
+script applies every migration to a disposable PostgreSQL database and checks
+the committed cache against that schema.