ci: GitLab-Pipeline - build_embedded + manueller npm-Publish nach rohana (threadnet-call#1)

Registry-Entscheidung evidenzbasiert: das Package ist pnpm-Dependency von
ThreadNet-Webs apps/web, der Lockfile pinnt die Tarball-URL auf rohana -
Registry bleibt dort. Publish-Auth ueber CI-Variable GITEA_NPM_TOKEN statt
lokaler Klartext-.npmrc.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

config/config.devenv.json

@@ -0,0 +1,19 @@
+{
+  "default_server_config": {
+    "m.homeserver": {
+      "base_url": "https://synapse.m.localhost",
+      "server_name": "synapse.m.localhost"
+    }
+  },
+  "features": {
+    "feature_use_device_session_member_events": true
+  },
+  "ssla": "https://static.element.io/legal/element-software-and-services-license-agreement-uk-1.pdf",
+  "matrix_rtc_session": {
+    "wait_for_key_rotation_ms": 3000,
+    "membership_event_expiry_ms": 180000000,
+    "delayed_leave_event_delay_ms": 18000,
+    "delayed_leave_event_restart_ms": 4000,
+    "network_error_retry_ms": 100
+  }
+}

config/config.sample.json

@@ -0,0 +1,23 @@
+{
+  "default_server_config": {
+    "m.homeserver": {
+      "base_url": "https://mydomain.com",
+      "server_name": "mydomain.com"
+    }
+  },
+  "livekit": {
+    "livekit_service_url": "https://livekit-jwt.mydomain.com"
+  },
+  "features": {
+    "feature_use_device_session_member_events": true
+  },
+  "ssla": "https://static.element.io/legal/element-software-and-services-license-agreement-uk-1.pdf",
+  "matrix_rtc_mode": "legacy",
+  "matrix_rtc_session": {
+    "wait_for_key_rotation_ms": 3000,
+    "membership_event_expiry_ms": 180000000,
+    "delayed_leave_event_delay_ms": 18000,
+    "delayed_leave_event_restart_ms": 4000,
+    "network_error_retry_ms": 100
+  }
+}

config/config_netlify_preview.json

@@ -0,0 +1,27 @@
+{
+  "default_server_config": {
+    "m.homeserver": {
+      "base_url": "https://call-unstable.ems.host",
+      "server_name": "call-unstable.ems.host"
+    }
+  },
+  "ssla": "https://static.element.io/legal/element-software-and-services-license-agreement-uk-1.pdf",
+  "matrix_rtc_session": {
+    "wait_for_key_rotation_ms": 3000,
+    "membership_event_expiry_ms": 180000000,
+    "delayed_leave_event_delay_ms": 18000,
+    "delayed_leave_event_restart_ms": 4000,
+    "network_error_retry_ms": 100
+  },
+  "posthog": {
+    "api_key": "phc_rXGHx9vDmyEvyRxPziYtdVIv0ahEv8A9uLWFcCi1WcU",
+    "api_host": "https://posthog-element-call.element.io"
+  },
+  "rageshake": {
+    "submit_url": "https://rageshakes.element.io/api/submit"
+  },
+  "sentry": {
+    "environment": "netlify-pr-preview",
+    "DSN": "https://b1e328d49be3402ba96101338989fb35@sentry.tools.element.io/41"
+  }
+}

config/config_netlify_preview_sdk.json

@@ -0,0 +1,16 @@
+{
+  "default_server_config": {
+    "m.homeserver": {
+      "base_url": "https://call-unstable.ems.host",
+      "server_name": "call-unstable.ems.host"
+    }
+  },
+  "ssla": "https://static.element.io/legal/element-software-and-services-license-agreement-uk-1.pdf",
+  "matrix_rtc_session": {
+    "wait_for_key_rotation_ms": 3000,
+    "membership_event_expiry_ms": 180000000,
+    "delayed_leave_event_delay_ms": 18000,
+    "delayed_leave_event_restart_ms": 4000,
+    "network_error_retry_ms": 100
+  }
+}

config/httpd.conf

@@ -0,0 +1,30 @@
+<VirtualHost *:8080>
+    ServerName localhost
+
+    DocumentRoot "/app"
+
+    <Location "/">
+        # disable cache entriely by default (apart from Etag which is accurate enough)
+        Header add Cache-Control "private, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0"
+        CacheDisable on
+        ExpiresActive off
+
+        # also turn off last-modified since they are just the timestamps of the file in the docker image
+        # and may or may not bear any resemblance to when the resource changed
+        Header add Last-Modified ""
+
+        DirectoryIndex index.html
+    </Location>
+
+    # assets can be cached because they have hashed filenames
+    <Location "/assets">
+        ExpiresActive on
+        ExpiresDefault "access plus 1 week"
+        Header add Cache-Control "public, no-transform"
+    </Location>
+
+    <Location "/apple-app-site-association">
+        ForceType application/json
+    </Location>
+</VirtualHost>
+

config/netlify_redirects

@@ -0,0 +1,4 @@
+# This file is copied to the netlify deploy dir in the upload stage
+
+# Redirect any unknown path to index.html
+/*  /index.html 200

config/nginx.conf

@@ -0,0 +1,23 @@
+server {
+    listen       8080;
+    server_name  localhost;
+
+    root   /app;
+    gzip_static on;
+    gzip_vary on;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+        add_header Cache-Control "public, max-age=30, stale-while-revalidate=30";
+    }
+
+    # assets can be cached because they have hashed filenames
+    location /assets {
+        add_header Cache-Control "public, immutable, max-age=31536000";
+    }
+
+    location /apple-app-site-association {
+        default_type application/json;
+    }
+}
+

config/otel_dev/README.md

@@ -0,0 +1,25 @@
+# OpenTelemetry Collector for development
+
+## Edit:
+
+Open telemetry has been removed in: https://github.com/element-hq/element-call/pull/3586
+Check this PR to get back the implementation or to use it as reference to add it back.
+
+---
+
+This directory contains a docker compose file that starts a jaeger all-in-one instance
+with an in-memory database, along with a standalone OpenTelemetry collector that forwards
+traces into the jaeger. Jaeger has a built-in OpenTelemetry collector, but it can't be
+configured to send CORS headers so can't be used from a browser. This sets the config on
+the collector to send CORS headers.
+
+This also adds an nginx to add CORS headers to the jaeger query endpoint, such that it can
+be used from webapps like stalk (https://deniz.co/stalk/). The CORS enabled endpoint is
+exposed on port 16687. To use stalk, you should simply be able to navigate to it and add
+http://127.0.0.1:16687/api as a data source.
+
+(Yes, we could enable the OTLP collector in jaeger all-in-one and passed this through
+the nginx to enable CORS too, rather than running a separate collector. There's no reason
+it's done this way other than that I'd already set up the separate collector.)
+
+Running `docker compose up` in this directory should be all you need.

config/otel_dev/collector-gateway.yaml

@@ -0,0 +1,41 @@
+receivers:
+  otlp:
+    protocols:
+      http:
+        endpoint: 0.0.0.0:4318
+        cors:
+          allowed_origins:
+            # This can't be '*' because opentelemetry-js uses sendBeacon which always operates
+            # in 'withCredentials' mode, which browsers don't allow with an allow-origin of '*'
+            #- "https://pr976--element-call.netlify.app"
+            - "http://*"
+          allowed_headers:
+            - "*"
+processors:
+  batch:
+    timeout: 1s
+  resource:
+    attributes:
+      - key: test.key
+        value: "test-value"
+        action: insert
+exporters:
+  logging:
+    loglevel: info
+  jaeger:
+    endpoint: jaeger-all-in-one:14250
+    tls:
+      insecure: true
+extensions:
+  health_check:
+  pprof:
+    endpoint: :1888
+  zpages:
+    endpoint: :55679
+service:
+  extensions: [pprof, zpages, health_check]
+  pipelines:
+    traces:
+      receivers: [otlp]
+      processors: [batch, resource]
+      exporters: [logging, jaeger]

config/otel_dev/docker-compose.yaml

@@ -0,0 +1,29 @@
+version: "2"
+services:
+  # Jaeger
+  jaeger-all-in-one:
+    image: jaegertracing/all-in-one:latest
+    ports:
+      - "16686:16686"
+      - "14268"
+      - "14250"
+  # Collector
+  collector-gateway:
+    image: otel/opentelemetry-collector:latest
+    volumes:
+      - ./collector-gateway.yaml:/etc/collector-gateway.yaml
+    command: ["--config=/etc/collector-gateway.yaml"]
+    ports:
+      - "1888:1888" # pprof extension
+      - "13133:13133" # health_check extension
+      - "4317:4317" # OTLP gRPC receiver
+      - "4318:4318" # OTLP HTTP receiver
+      - "55670:55679" # zpages extension
+    depends_on:
+      - jaeger-all-in-one
+  nginx:
+    image: nginxinc/nginx-unprivileged:latest
+    volumes:
+      - ./nginx_otel.conf:/etc/nginx/conf.d/default.conf:ro
+    ports:
+      - "16687:8080"

config/otel_dev/nginx_otel.conf

@@ -0,0 +1,16 @@
+server {
+    listen       8080;
+    server_name  localhost;
+
+    location / {
+            proxy_pass  http://jaeger-all-in-one:16686/;
+            add_header Access-Control-Allow-Origin *;
+
+            if ($request_method = OPTIONS) {
+                add_header Access-Control-Allow-Origin *;
+                add_header Content-Type text/plain;
+                add_header Content-Length 0;
+                return 204;
+            }
+    }
+}