chore: switch to distroless Docker runtime images

fix: match Debian releases for build

closes #297

Co-authored-by: MaticPoh <85814976+MaticPoh@users.noreply.github.com>

.github/workflows/rust.yaml

@@ -41,7 +41,7 @@ jobs:
 
       - name: Run services in background
         run: |
-          docker-compose -f docker-compose.db.yml up -d
+          docker compose -f docker-compose.db.yml up -d
 
       - name: Copy .env.example
         run: |

Cargo.toml

@@ -1,6 +1,12 @@
 [workspace]
 resolver = "2"
-members = ["crates/delta", "crates/bonfire", "crates/core/*"]
+members = [
+    "crates/delta",
+    "crates/bonfire",
+    "crates/core/*",
+    "crates/services/*",
+    "crates/bindings/*",
+]
 
 [patch.crates-io]
 # mobc-redis = { git = "https://github.com/insertish/mobc", rev = "8b880bb59f2ba80b4c7bc40c649c113d8857a186" }

Dockerfile

@@ -1,5 +1,5 @@
 # Build Stage
-FROM --platform="${BUILDPLATFORM}" rust:1.70.0-slim
+FROM --platform="${BUILDPLATFORM}" rust:1.80.1-slim-bookworm
 USER 0:0
 WORKDIR /home/rust/src
 
@@ -17,14 +17,17 @@ RUN sh /tmp/build-image-layer.sh tools
 
 # Build all dependencies
 COPY Cargo.toml Cargo.lock ./
+COPY crates/bindings/node/Cargo.toml ./crates/bindings/node/
 COPY crates/bonfire/Cargo.toml ./crates/bonfire/
 COPY crates/delta/Cargo.toml ./crates/delta/
 COPY crates/core/config/Cargo.toml ./crates/core/config/
 COPY crates/core/database/Cargo.toml ./crates/core/database/
+COPY crates/core/files/Cargo.toml ./crates/core/files/
 COPY crates/core/models/Cargo.toml ./crates/core/models/
 COPY crates/core/permissions/Cargo.toml ./crates/core/permissions/
 COPY crates/core/presence/Cargo.toml ./crates/core/presence/
 COPY crates/core/result/Cargo.toml ./crates/core/result/
+COPY crates/services/autumn/Cargo.toml ./crates/services/autumn/
 RUN sh /tmp/build-image-layer.sh deps
 
 # Build all apps

Dockerfile.useCurrentArch

@@ -1,5 +1,5 @@
 # Build Stage
-FROM rust:1.70.0-slim
+FROM rust:1.80.1-slim-bookworm
 USER 0:0
 WORKDIR /home/rust/src
 
@@ -13,14 +13,17 @@ COPY scripts/build-image-layer.sh /tmp/
 
 # Build all dependencies
 COPY Cargo.toml Cargo.lock ./
+COPY crates/bindings/node/Cargo.toml ./crates/bindings/node/
 COPY crates/bonfire/Cargo.toml ./crates/bonfire/
 COPY crates/delta/Cargo.toml ./crates/delta/
 COPY crates/core/config/Cargo.toml ./crates/core/config/
 COPY crates/core/database/Cargo.toml ./crates/core/database/
+COPY crates/core/files/Cargo.toml ./crates/core/files/
 COPY crates/core/models/Cargo.toml ./crates/core/models/
 COPY crates/core/permissions/Cargo.toml ./crates/core/permissions/
 COPY crates/core/presence/Cargo.toml ./crates/core/presence/
 COPY crates/core/result/Cargo.toml ./crates/core/result/
+COPY crates/services/autumn/Cargo.toml ./crates/services/autumn/
 RUN sh /tmp/build-image-layer.sh deps
 
 # Build all apps

crates/bindings/node/.gitignore

@@ -0,0 +1,7 @@
+target
+index.node
+**/node_modules
+**/.DS_Store
+npm-debug.log*
+cargo.log
+cross.log

crates/bindings/node/Cargo.toml

@@ -0,0 +1,24 @@
+[package]
+name = "revolt-nodejs-bindings"
+version = "0.7.16"
+description = "Node.js bindings for the Revolt software"
+authors = ["Paul Makles <me@insrt.uk>"]
+license = "MIT"
+edition = "2021"
+exclude = ["index.node"]
+
+[lib]
+crate-type = ["cdylib"]
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+neon = "1.0.0"
+neon-serde4 = "1.0.0"
+
+serde = { version = "1", features = ["derive"] }
+
+async-std = "1.12.0"
+
+revolt-result = { version = "0.7.16", path = "../../core/result" }
+revolt-database = { version = "0.7.16", path = "../../core/database" }

crates/bindings/node/README.md

@@ -0,0 +1,92 @@
+# revolt.node
+
+**revolt.node:** Node.js bindings for the Revolt software
+
+This project was bootstrapped by [create-neon](https://www.npmjs.com/package/create-neon).
+
+## Building revolt.node
+
+Building revolt.node requires a [supported version of Node and Rust](https://github.com/neon-bindings/neon#platform-support).
+
+To run the build, run:
+
+```sh
+$ npm run build
+```
+
+This command uses the [@neon-rs/cli](https://www.npmjs.com/package/@neon-rs/cli) utility to assemble the binary Node addon from the output of `cargo`.
+
+## Exploring revolt.node
+
+After building revolt.node, you can explore its exports at the Node console:
+
+```sh
+$ npm i
+$ npm run build
+$ node
+> require('.').hello()
+'hello node'
+```
+
+## Available Scripts
+
+In the project directory, you can run:
+
+#### `npm install`
+
+Installs the project, including running `npm run build`.
+
+#### `npm run build`
+
+Builds the Node addon (`index.node`) from source, generating a release build with `cargo --release`.
+
+Additional [`cargo build`](https://doc.rust-lang.org/cargo/commands/cargo-build.html) arguments may be passed to `npm run build` and similar commands. For example, to enable a [cargo feature](https://doc.rust-lang.org/cargo/reference/features.html):
+
+```
+npm run build -- --feature=beetle
+```
+
+#### `npm run debug`
+
+Similar to `npm run build` but generates a debug build with `cargo`.
+
+#### `npm run cross`
+
+Similar to `npm run build` but uses [cross-rs](https://github.com/cross-rs/cross) to cross-compile for another platform. Use the [`CARGO_BUILD_TARGET`](https://doc.rust-lang.org/cargo/reference/config.html#buildtarget) environment variable to select the build target.
+
+#### `npm test`
+
+Runs the unit tests by calling `cargo test`. You can learn more about [adding tests to your Rust code](https://doc.rust-lang.org/book/ch11-01-writing-tests.html) from the [Rust book](https://doc.rust-lang.org/book/).
+
+## Project Layout
+
+The directory structure of this project is:
+
+```
+revolt.node/
+├── Cargo.toml
+├── README.md
+├── src/
+|   └── lib.rs
+├── index.node
+├── package.json
+└── target/
+```
+
+| Entry          | Purpose                                                                                                                                  |
+|----------------|------------------------------------------------------------------------------------------------------------------------------------------|
+| `Cargo.toml`   | The Cargo [manifest file](https://doc.rust-lang.org/cargo/reference/manifest.html), which informs the `cargo` command.                   |
+| `README.md`    | This file.                                                                                                                               |
+| `src/`         | The directory tree containing the Rust source code for the project.                                                                      |
+| `lib.rs`       | Entry point for the Rust source code.                                                                                                          |
+| `index.node`   | The main module, a [Node addon](https://nodejs.org/api/addons.html) generated by the build and pointed to by `"main"` in `package.json`. |
+| `package.json` | The npm [manifest file](https://docs.npmjs.com/cli/v7/configuring-npm/package-json), which informs the `npm` command.                    |
+| `target/`      | Binary artifacts generated by the Rust build.                                                                                            |
+
+## Learn More
+
+Learn more about:
+
+- [Neon](https://neon-bindings.com).
+- [Rust](https://www.rust-lang.org).
+- [Node](https://nodejs.org).

crates/bindings/node/index.d.ts

@@ -0,0 +1,66 @@
+import { Channel, User } from "revolt-api";
+
+/**
+ * Opaque type for Revolt database
+ */
+export declare interface Database {}
+
+/**
+ * Opaque type for Revolt database
+ */
+export declare interface OpaqueUser {}
+
+/**
+ * Error type from Revolt backend
+ */
+export declare interface Err {
+  type: string;
+  location: string;
+}
+
+/**
+ * Gets a new handle to the Revolt database
+ * @returns {Database} Handle
+ */
+export declare function database(): Database;
+
+/**
+ * Fetch user from database
+ * @param {string} userId User's ID
+ * @this {Database}
+ */
+export declare function database_fetch_user(userId: string): OpaqueUser;
+
+/**
+ * Fetch user from database
+ * @param {string} username Username
+ * @param {string} discriminator Discriminator
+ * @this {Database}
+ */
+export declare function database_fetch_user_by_username(
+  username: string,
+  discriminator: string
+): OpaqueUser;
+
+/**
+ * Gets model data as JSON
+ * @this {OpaqueUser}
+ */
+export declare function model_data(): User;
+
+/**
+ * Gets error if the model failed to fetch
+ * @this {OpaqueUser}
+ */
+export declare function model_error(): Err;
+
+/**
+ * Open a direct message channel between two users
+ * @param {string} userA User A ID
+ * @param {string} userB User B ID
+ * @returns Existing or newly created channel
+ */
+export declare function proc_channels_create_dm(
+  userA: string,
+  userB: string
+): Promise<Channel & { error: Err }>;

crates/bindings/node/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "revolt-nodejs-bindings",
+  "version": "0.7.15",
+  "description": "Node.js bindings for the Revolt software",
+  "main": "index.node",
+  "scripts": {
+    "test": "cargo test",
+    "cargo-build": "cargo build --message-format=json > cargo.log",
+    "cross-build": "cross build --message-format=json > cross.log",
+    "postcargo-build": "neon dist < cargo.log",
+    "postcross-build": "neon dist -m /target < cross.log",
+    "debug": "npm run cargo-build --",
+    "build": "npm run cargo-build -- --release",
+    "cross": "npm run cross-build -- --release"
+  },
+  "author": "Paul Makles",
+  "license": "AGPL-3.0",
+  "devDependencies": {
+    "@neon-rs/cli": "0.1.73"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/revoltchat/backend"
+  },
+  "keywords": [
+    "revolt",
+    "chat"
+  ],
+  "bugs": {
+    "url": "https://github.com/revoltchat/backend/issues"
+  },
+  "homepage": "https://github.com/revoltchat/backend#readme",
+  "dependencies": {
+    "revolt-api": "^0.7.15"
+  }
+}

crates/bindings/node/pnpm-lock.yaml

@@ -0,0 +1,117 @@
+lockfileVersion: '6.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+dependencies:
+  revolt-api:
+    specifier: ^0.7.15
+    version: 0.7.15
+
+devDependencies:
+  '@neon-rs/cli':
+    specifier: 0.1.73
+    version: 0.1.73
+
+packages:
+
+  /@cargo-messages/android-arm-eabi@0.1.72:
+    resolution: {integrity: sha512-gGZxIM1mj+Y5x+ULND6ZCNr7f70OJi9wDlycSK8hGONy9wrChN6JAIHryddC5cqcwlYAoQ6IDcDFElnhAYbybA==}
+    cpu: [arm]
+    os: [android]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@cargo-messages/darwin-arm64@0.1.72:
+    resolution: {integrity: sha512-EAzN5MLaXPljZKZDO5qR+aBs44eSq2ZbEnS7AI/FziE3MzeXbrGOS3fLba5+7yWPFXJyZolXzePm8N1EBv8ovg==}
+    cpu: [arm64]
+    os: [darwin]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@cargo-messages/darwin-x64@0.1.72:
+    resolution: {integrity: sha512-RLo6j8s3nYbjdd1LDct4wamfChyRit7zokUuxtIYCu9XOlltkN5vnj1vwnrPvoqCMZ/7CbbuHFwSTn9A71de/w==}
+    cpu: [x64]
+    os: [darwin]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@cargo-messages/linux-arm-gnueabihf@0.1.72:
+    resolution: {integrity: sha512-tHsRshuzfjrX6SDW3jg6al8vMNLTMgczGnVYl5RuBZf/yrAUuwe30KxA9ge6w6mW6Ox797DyBchzAc9OLgTgmQ==}
+    cpu: [arm]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@cargo-messages/linux-x64-gnu@0.1.72:
+    resolution: {integrity: sha512-VGtL6CCnUbhsP4aYuBNT5kfrAL7o0qjrxw97a+ax13t+nJd26tVEEIKHMu5drvvS/Nm/hn7sLT8zMnnCv0pvHg==}
+    cpu: [x64]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@cargo-messages/win32-arm64-msvc@0.1.72:
+    resolution: {integrity: sha512-V93Cgz39K+yqa3MveNbhh29pYCp8izK5uEavjPoxlNxAbsMCWH+s0verGDdUcfGxjR1H2V7oZ4FszPqR2SqMRQ==}
+    cpu: [arm64]
+    os: [win32]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@cargo-messages/win32-x64-msvc@0.1.72:
+    resolution: {integrity: sha512-knz3uSrO0OSbq3U5VWfCY8FB4NsM43BOWLZ7x4sfaMOC1XWv+IyvDdkLe6DhJx8KUw46KIAimYs9YROrp6l46Q==}
+    cpu: [x64]
+    os: [win32]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@neon-rs/cli@0.1.73:
+    resolution: {integrity: sha512-1kv8S/feB6UQWQQwsnGfkSkEBOtlFDNExnioL81E2BwvUWgjQPaseHgpi2EpWVgsPUgur5eBm4QowmlpWkD4/w==}
+    hasBin: true
+    optionalDependencies:
+      '@cargo-messages/android-arm-eabi': 0.1.72
+      '@cargo-messages/darwin-arm64': 0.1.72
+      '@cargo-messages/darwin-x64': 0.1.72
+      '@cargo-messages/linux-arm-gnueabihf': 0.1.72
+      '@cargo-messages/linux-x64-gnu': 0.1.72
+      '@cargo-messages/win32-arm64-msvc': 0.1.72
+      '@cargo-messages/win32-x64-msvc': 0.1.72
+    dev: true
+
+  /axios@0.26.1:
+    resolution: {integrity: sha512-fPwcX4EvnSHuInCMItEhAGnaSEXRBjtzh9fOtsE6E1G6p7vl7edEeZe11QHf18+6+9gR5PbKV/sGKNaD8YaMeA==}
+    dependencies:
+      follow-redirects: 1.15.6
+    transitivePeerDependencies:
+      - debug
+    dev: false
+
+  /follow-redirects@1.15.6:
+    resolution: {integrity: sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==}
+    engines: {node: '>=4.0'}
+    peerDependencies:
+      debug: '*'
+    peerDependenciesMeta:
+      debug:
+        optional: true
+    dev: false
+
+  /lodash.defaultsdeep@4.6.1:
+    resolution: {integrity: sha512-3j8wdDzYuWO3lM3Reg03MuQR957t287Rpcxp1njpEa8oDrikb+FwGdW3n+FELh/A6qib6yPit0j/pv9G/yeAqA==}
+    dev: false
+
+  /revolt-api@0.7.15:
+    resolution: {integrity: sha512-rWRnjBFvoXt/RHRxHg9KuP+x1Jk61KdsOpKOczVJg5tIqGDmqp/6QZHw5rJTtG+wCH3Ah3YKwY+MM5NHfg1W3Q==}
+    dependencies:
+      axios: 0.26.1
+      lodash.defaultsdeep: 4.6.1
+    transitivePeerDependencies:
+      - debug
+    dev: false

crates/bindings/node/src/lib.rs

@@ -0,0 +1,190 @@
+#[macro_use]
+extern crate serde;
+
+use neon::prelude::*;
+use revolt_database::{Database, DatabaseInfo};
+
+struct DatabaseBinding(Database, Channel);
+impl Finalize for DatabaseBinding {}
+impl DatabaseBinding {
+    fn take(&self) -> (Database, Channel) {
+        (self.0.clone(), self.1.clone())
+    }
+}
+
+fn js_database(mut cx: FunctionContext) -> JsResult<JsBox<DatabaseBinding>> {
+    let db = async_std::task::block_on(DatabaseInfo::Auto.connect())
+        .or_else(|err| cx.throw_error(err))?;
+
+    let channel = cx.channel();
+    Ok(cx.boxed(DatabaseBinding(db, channel)))
+}
+
+// Implementations for models
+#[derive(Clone)]
+#[allow(clippy::large_enum_variant)]
+enum Model {
+    User(revolt_database::User),
+    Error(revolt_result::Error),
+}
+
+impl Model {
+    fn give(&self) -> Model {
+        self.clone()
+    }
+}
+
+impl Finalize for Model {}
+
+macro_rules! shim_boxed {
+    ($cx: ident, $name: ident, $model: ident, $( $variable: ident $type: ident $id: expr )+, $cmd: ident, $( $arg: expr, )+) => {
+        fn $name(mut cx: FunctionContext) -> JsResult<JsPromise> {
+            $(
+                let $variable = cx.argument::<$type>($id)?.value(&mut cx);
+            )+
+
+            let (db, channel) = cx.this::<JsBox<DatabaseBinding>>()?.take();
+            let (deferred, promise) = cx.promise();
+
+            async_std::task::spawn(async move {
+                let result = db.$cmd($($arg,)+).await;
+                deferred.settle_with(&channel, move |mut cx| {
+                    Ok(cx.boxed(match result {
+                        Ok(value) => Model::$model(value),
+                        Err(error) => Model::Error(error)
+                    }))
+                })
+            });
+
+            Ok(promise)
+        }
+
+        $cx.export_function(stringify!($name), $name)?;
+    };
+}
+
+fn js_data(mut cx: FunctionContext) -> JsResult<JsValue> {
+    match cx.this::<JsBox<Model>>()?.give() {
+        Model::Error(_) => neon_serde4::to_value(&mut cx, &None::<()>),
+        Model::User(user) => neon_serde4::to_value(&mut cx, &user),
+    }
+    .or_else(|e| cx.throw_error(e.to_string()))
+}
+
+fn js_error(mut cx: FunctionContext) -> JsResult<JsValue> {
+    let value = match cx.this::<JsBox<Model>>()?.give() {
+        Model::Error(err) => Some(err),
+        _ => None,
+    };
+
+    neon_serde4::to_value(&mut cx, &value).or_else(|e| cx.throw_error(e.to_string()))
+}
+
+// Basic data implementation
+#[derive(Serialize, Deserialize)]
+struct ResultBinding<T> {
+    #[serde(flatten)]
+    value: Option<T>,
+    error: Option<revolt_result::Error>,
+}
+
+macro_rules! shim {
+    ($cx: ident, $name: ident, $( $variable: ident $type: ident $id: expr )*, $( $model: ident $modelType: ident $modelId: expr )*, | $db: ident | $closure: expr, $( $arg: expr, )+) => {
+        fn $name(mut cx: FunctionContext) -> JsResult<JsPromise> {
+            $(
+                let $variable = cx.argument::<$type>($id)?.value(&mut cx);
+            )*
+
+            $(
+                let mut $model = if let Model::$modelType(value) = cx.argument::<JsBox<Model>>($modelId)?.give() {
+                    value
+                } else {
+                    unreachable!()
+                };
+            )*
+
+            let (db, channel) = cx.this::<JsBox<DatabaseBinding>>()?.take();
+            let (deferred, promise) = cx.promise();
+
+            async_std::task::spawn(async move {
+                #[allow(clippy::redundant_closure_call)]
+                let result = (|$db: $crate::Database| $closure)(db.clone()).await;
+                deferred.settle_with(&channel, move |mut cx| {
+                    neon_serde4::to_value(
+                        &mut cx,
+                        &match result {
+                            Ok(value) => ResultBinding {
+                                value: Some(value),
+                                error: None,
+                            },
+                            Err(error) => ResultBinding {
+                                value: None,
+                                error: Some(error),
+                            },
+                        },
+                    )
+                    .or_else(|e| cx.throw_error(e.to_string()))
+                })
+            });
+
+            Ok(promise)
+        }
+
+        $cx.export_function(stringify!($name), $name)?;
+    };
+}
+
+#[neon::main]
+fn main(mut cx: ModuleContext) -> NeonResult<()> {
+    // database & model stuff
+    cx.export_function("database", js_database)?;
+    cx.export_function("model_data", js_data)?;
+    cx.export_function("model_error", js_error)?;
+
+    shim_boxed!(
+        cx,
+        database_fetch_user,
+        User,
+        user_id JsString 0,
+        fetch_user,
+        &user_id,
+    );
+
+    shim_boxed!(
+        cx,
+        database_fetch_user_by_username,
+        User,
+        username JsString 0
+        discriminator JsString 1,
+        fetch_user_by_username,
+        &username, &discriminator,
+    );
+
+    // procedure calls
+    shim!(
+        cx,
+        proc_channels_create_dm,
+        user_a JsString 0
+        user_b JsString 1,
+        ,
+        |db| async move {
+            let user_a = db.fetch_user(&user_a).await?;
+            let user_b = db.fetch_user(&user_b).await?;
+            revolt_database::Channel::create_dm(&db, &user_a, &user_b).await
+        },
+        &userA, &userB,
+    );
+
+    shim!(
+        cx,
+        proc_users_suspend,
+        ,
+        user User 0,
+        |db| async move {
+            user.suspend(&db).await
+        },
+        &user,
+    );
+
+    Ok(())
+}

crates/bindings/node/test.js

@@ -0,0 +1,53 @@
+const Internal = require(".");
+
+// playing around with class wrapper, not practical
+class Model {
+  constructor(model) {
+    this.model = model;
+  }
+
+  data() {
+    return Internal.model_data.bind(this.model)();
+  }
+
+  error() {
+    return Internal.model_error.bind(this.model)();
+  }
+}
+
+class User extends Model {
+  constructor(db, user) {
+    super(user);
+    this.db = db;
+  }
+}
+
+class Database {
+  constructor() {
+    this.db = Internal.database();
+  }
+
+  async fetchUser(userId) {
+    return new User(
+      this,
+      await Internal.database_fetch_user.bind(this.db)(userId)
+    );
+  }
+
+  async fetchUserByUsername(username, discriminator) {
+    return new User(
+      this,
+      await Internal.database_fetch_user_by_username.bind(this.db)(
+        username,
+        discriminator
+      )
+    );
+  }
+}
+
+const db = new Database();
+db.fetchUserByUsername("dos", "7624").then((user) => console.info(user.data()));
+db.fetchUserByUsername("dos", "1111").then((user) => console.info(user.data()));
+db.fetchUserByUsername("dos", "1111").then((user) =>
+  console.info(user.error())
+);

crates/bindings/package-lock.json

@@ -0,0 +1,6 @@
+{
+  "name": "bindings",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {}
+}

crates/bonfire/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-bonfire"
-version = "0.7.15"
+version = "0.7.16"
 license = "AGPL-3.0-or-later"
 edition = "2021"
 
@@ -41,7 +41,7 @@ revolt-result = { path = "../core/result" }
 revolt-models = { path = "../core/models" }
 revolt-config = { path = "../core/config" }
 revolt-database = { path = "../core/database" }
-revolt-permissions = { version = "0.7.15", path = "../core/permissions" }
+revolt-permissions = { version = "0.7.16", path = "../core/permissions" }
 revolt-presence = { path = "../core/presence", features = ["redis-is-patched"] }
 
 # redis

crates/bonfire/Dockerfile

@@ -2,10 +2,9 @@
 FROM ghcr.io/revoltchat/base:latest AS builder
 
 # Bundle Stage
-FROM debian:bullseye-slim
-RUN apt-get update && \
-    apt-get install -y ca-certificates && \
-    apt-get clean
+FROM gcr.io/distroless/cc-debian12:nonroot
 COPY --from=builder /home/rust/src/target/release/revolt-bonfire ./
+
 EXPOSE 9000
+USER nonroot
 CMD ["./revolt-bonfire"]

crates/core/config/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-config"
-version = "0.7.15"
+version = "0.7.16"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]

crates/core/config/Revolt.toml

@@ -1,8 +1,17 @@
 [database]
+# MongoDB connection URL
+# Defaults to the container name specified in self-hosted
 mongodb = "mongodb://database"
+# Redis connection URL
+# Defaults to the container name specified in self-hosted
 redis = "redis://redis/"
 
 [hosts]
+# Web locations of various services
+# Defaults assume all services are reverse-proxied
+# See https://github.com/revoltchat/self-hosted/blob/master/Caddyfile
+#
+# Remember to change these to https/wss where appropriate in production!
 app = "http://local.revolt.chat"
 api = "http://local.revolt.chat/api"
 events = "ws://local.revolt.chat/ws"
@@ -14,43 +23,113 @@ voso_legacy_ws = ""
 [api]
 
 [api.registration]
+# Whether an invite should be required for registration
+# See https://github.com/revoltchat/self-hosted#making-your-instance-invite-only
 invite_only = false
 
 [api.smtp]
+# Email server configuration for verification
+# Defaults to no email verification (host field is empty)
 host = ""
 username = ""
 password = ""
-from_address = ""
-# reply_to = ""
-# port = 587
-# use_tls = true
+from_address = "noreply@example.com"
+reply_to = "noreply@example.com"
+port = 587
+use_tls = true
 
 [api.vapid]
+# Generate your own keys:
+# 1. Run `openssl ecparam -name prime256v1 -genkey -noout -out vapid_private.pem`
+# 2. Find `private_key` using `base64 vapid_private.pem`
+# 3. Find `public_key` using `openssl ec -in vapid_private.pem -outform DER|tail -c 65|base64|tr '/+' '_-'|tr -d '\n'`
 private_key = "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUJSUWpyTWxLRnBiVWhsUHpUbERvcEliYk1yeVNrNXpKYzVYVzIxSjJDS3hvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWnkrQkg2TGJQZ2hEa3pEempXOG0rUXVPM3pCajRXT1phdkR6ZU00c0pqbmFwd1psTFE0WAp1ZDh2TzVodU94QWhMQlU3WWRldVovWHlBdFpWZmNyQi9BPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo"
 public_key = "BGcvgR-i2z4IQ5Mw841vJvkLjt8wY-FjmWrw83jOLCY52qcGZS0OF7nfLzuYbjsQISwVO2HXrmf18gLWVX3Kwfw="
 
 [api.fcm]
-api_key = ""
+# Google Firebase Cloud Messaging Service Account Key
+# Obtained from the cloud messaging console
+key_type = ""
+project_id = ""
+private_key_id = ""
+private_key = ""
+client_email = ""
+client_id = ""
+auth_uri = ""
+token_uri = ""
+auth_provider_x509_cert_url = ""
+client_x509_cert_url = ""
 
 [api.apn]
+# Apple Push Notifications keys for sending notifications
 sandbox = false
 pkcs8 = ""
 key_id = ""
 team_id = ""
 
 [api.security]
+# Authifier Shield API key
 authifier_shield_key = ""
+# Legacy voice server management token
 voso_legacy_token = ""
+# Whether services are behind the Cloudflare network
 trust_cloudflare = false
 
 [api.security.captcha]
+# hCaptcha configuration
 hcaptcha_key = ""
 hcaptcha_sitekey = ""
 
 [api.workers]
+# Maximum concurrent connections (to proxy server)
 max_concurrent_connections = 50
 
+[files]
+# Encryption key for stored files
+# Generate your own key using `openssl rand -base64 32`
+encryption_key = "qcuMA+ssxhMyKaNAKBGFfryfFtUH8NDlamQyDwGW6fU="
+
+[files.limit]
+# Minimum image resolution
+min_resolution = [1, 1]
+# Maximum MP of images
+max_mega_pixels = 40
+# Maximum pixel side of an image
+max_pixel_side = 10_000
+
+[files.preview]
+# Maximum image resolution
+attachments = [1280, 1280]
+avatars = [128, 128]
+backgrounds = [1280, 720]
+icons = [128, 128]
+banners = [480, 480]
+emojis = [128, 128]
+
+[files.s3]
+# Configuration for S3
+# Defaults included for MinIO + self-hosted setup
+#
+# Backblaze B2:
+# - endpoint is listed on the "Buckets" page
+# - region is `eu-central-003` string from endpoint URL
+# - access_key_id is keyID generated on the "Application Keys" page
+# - secret_access_key is token generated on the "Application Keys" page
+# - default_bucket matches the name of the bucket you've created
+
+# S3 protocol endpoint
+endpoint = ""
+# S3 region name
+region = ""
+# S3 protocol key ID
+access_key_id = ""
+# S3 protocol access key
+secret_access_key = ""
+# Bucket to upload to by default
+default_bucket = "revolt-uploads"
+
 [features]
+# Feature gate options
 webhooks_enabled = false
 
 [features.limits]
@@ -64,8 +143,13 @@ server_emoji = 100
 server_roles = 200
 server_channels = 200
 
+# How many days since creation a user is considered new
 new_user_days = 3
 
+# Maximum permissible body size in bytes for uploads
+# (should be greater than any one file upload limit)
+body_limit_size = 20_000_000
+
 [features.limits.new_user]
 outgoing_friend_requests = 5
 
@@ -74,12 +158,12 @@ message_length = 2000
 message_attachments = 5
 servers = 100
 
-attachment_size = 20000000
-avatar_size = 4000000
-background_size = 6000000
-icon_size = 2500000
-banner_size = 6000000
-emoji_size = 500000
+attachment_size = 20_000_000
+avatar_size = 4_000_000
+background_size = 6_000_000
+icon_size = 2_500_000
+banner_size = 6_000_000
+emoji_size = 500_000
 
 [features.limits.default]
 outgoing_friend_requests = 10
@@ -89,13 +173,14 @@ message_length = 2000
 message_attachments = 5
 servers = 100
 
-attachment_size = 20000000
-avatar_size = 4000000
-background_size = 6000000
-icon_size = 2500000
-banner_size = 6000000
-emoji_size = 500000
+attachment_size = 20_000_000
+avatar_size = 4_000_000
+background_size = 6_000_000
+icon_size = 2_500_000
+banner_size = 6_000_000
+emoji_size = 500_000
 
 [sentry]
+# Configuration for Sentry error reporting
 api = ""
 events = ""

crates/core/config/src/lib.rs

@@ -25,6 +25,8 @@ static CONFIG_BUILDER: Lazy<RwLock<Config>> = Lazy::new(|| {
             ));
         } else if std::path::Path::new("Revolt.toml").exists() {
             builder = builder.add_source(File::new("Revolt.toml", FileFormat::Toml));
+        } else if std::path::Path::new("/Revolt.toml").exists() {
+            builder = builder.add_source(File::new("/Revolt.toml", FileFormat::Toml));
         }
 
         builder.build().unwrap()
@@ -74,7 +76,16 @@ pub struct ApiVapid {
 
 #[derive(Deserialize, Debug, Clone)]
 pub struct ApiFcm {
-    pub api_key: String,
+    pub key_type: String,
+    pub project_id: String,
+    pub private_key_id: String,
+    pub private_key: String,
+    pub client_email: String,
+    pub client_id: String,
+    pub auth_uri: String,
+    pub token_uri: String,
+    pub auth_provider_x509_cert_url: String,
+    pub client_x509_cert_url: String,
 }
 
 #[derive(Deserialize, Debug, Clone)]
@@ -126,6 +137,8 @@ pub struct GlobalLimits {
     pub server_channels: usize,
 
     pub new_user_days: usize,
+
+    pub body_limit_size: usize,
 }
 
 #[derive(Deserialize, Debug, Clone)]

crates/core/database/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-database"
-version = "0.7.15"
+version = "0.7.16"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -23,13 +23,13 @@ default = ["mongodb", "async-std-runtime", "tasks"]
 
 [dependencies]
 # Core
-revolt-config = { version = "0.7.15", path = "../config" }
-revolt-result = { version = "0.7.15", path = "../result" }
-revolt-models = { version = "0.7.15", path = "../models", features = [
+revolt-config = { version = "0.7.16", path = "../config" }
+revolt-result = { version = "0.7.16", path = "../result" }
+revolt-models = { version = "0.7.16", path = "../models", features = [
     "validator",
 ] }
-revolt-presence = { version = "0.7.15", path = "../presence" }
-revolt-permissions = { version = "0.7.15", path = "../permissions", features = [
+revolt-presence = { version = "0.7.16", path = "../presence" }
+revolt-permissions = { version = "0.7.16", path = "../permissions", features = [
     "serde",
     "bson",
 ] }
@@ -85,11 +85,9 @@ revolt_okapi = { version = "0.9.1", optional = true }
 revolt_rocket_okapi = { version = "0.9.1", optional = true }
 
 # Notifications
-fcm = "0.9.2"
+fcm_v1 = "0.3.0"
 web-push = "0.10.0"
-revolt_a2 = { version = "0.10", default-features = false, features = [
-    "ring",
-] }
+revolt_a2 = { version = "0.10", default-features = false, features = ["ring"] }
 
 # Authifier
 authifier = { version = "1.0.8" }

crates/core/database/src/models/servers/ops/mongodb.rs

@@ -214,14 +214,21 @@ impl MongoDb {
 
         // Delete all emoji.
         self.col::<Document>("emojis")
-            .delete_many(
+            .update_many(
                 doc! {
                     "parent.id": &server_id
                 },
+                doc! {
+                    "$set": {
+                        "parent": {
+                            "type": "Detached"
+                        }
+                    }
+                },
                 None,
             )
             .await
-            .map_err(|_| create_database_error!("delete_many", "emojis"))?;
+            .map_err(|_| create_database_error!("update_many", "emojis"))?;
 
         // Delete all channels.
         self.col::<Document>("channels")

crates/core/database/src/models/users/model.rs

@@ -662,6 +662,14 @@ impl User {
         }
     }
 
+    /// Suspend the user
+    pub async fn suspend(&mut self, db: &Database) -> Result<()> {
+        // Remove sessions (logout all)
+        // Mark user as suspended
+        // Disable account
+        Ok(())
+    }
+
     /// Mark as deleted
     pub async fn mark_deleted(&mut self, db: &Database) -> Result<()> {
         self.update(

crates/core/database/src/tasks/web_push.rs

@@ -1,4 +1,7 @@
-use std::collections::HashSet;
+use std::{
+    collections::{HashMap, HashSet},
+    time::Duration,
+};
 
 use authifier::Database;
 use base64::{
@@ -6,6 +9,7 @@ use base64::{
     Engine as _,
 };
 use deadqueue::limited::Queue;
+use fcm_v1::auth::{Authenticator, ServiceAccountKey};
 use once_cell::sync::Lazy;
 use revolt_config::config;
 use revolt_models::v0::PushNotification;
@@ -54,10 +58,28 @@ pub async fn worker(db: Database) {
     let config = config().await;
 
     let web_push_client = IsahcWebPushClient::new().unwrap();
-    let fcm_client = if config.api.fcm.api_key.is_empty() {
+    let fcm_client = if config.api.fcm.key_type.is_empty() {
         None
     } else {
-        Some(fcm::Client::new())
+        Some(fcm_v1::Client::new(
+            Authenticator::service_account::<&str>(ServiceAccountKey {
+                key_type: Some(config.api.fcm.key_type),
+                project_id: Some(config.api.fcm.project_id.clone()),
+                private_key_id: Some(config.api.fcm.private_key_id),
+                private_key: config.api.fcm.private_key,
+                client_email: config.api.fcm.client_email,
+                client_id: Some(config.api.fcm.client_id),
+                auth_uri: Some(config.api.fcm.auth_uri),
+                token_uri: config.api.fcm.token_uri,
+                auth_provider_x509_cert_url: Some(config.api.fcm.auth_provider_x509_cert_url),
+                client_x509_cert_url: Some(config.api.fcm.client_x509_cert_url),
+            })
+            .await
+            .unwrap(),
+            config.api.fcm.project_id,
+            false,
+            Duration::from_secs(5),
+        ))
     };
 
     let web_push_private_key = engine::general_purpose::URL_SAFE_NO_PAD
@@ -76,27 +98,38 @@ pub async fn worker(db: Database) {
                             let PushNotification {
                                 author,
                                 icon,
-                                image: _,
+                                image,
                                 body,
-                                tag,
-                                timestamp: _,
+                                tag: _,
+                                timestamp,
                                 url: _,
-                                message: _,
+                                message,
                             } = &task.payload;
 
-                            let mut notification = fcm::NotificationBuilder::new();
-                            notification.title(author);
-                            notification.icon(icon);
-                            notification.body(body);
-                            notification.tag(tag);
-                            // TODO: expand support for fields
-                            let notification = notification.finalize();
+                            let message = fcm_v1::message::Message {
+                                token: Some(sub.auth),
+                                data: Some(HashMap::from([
+                                    (
+                                        "author".to_owned(),
+                                        serde_json::Value::String(author.clone()),
+                                    ),
+                                    ("icon".to_owned(), serde_json::Value::String(icon.clone())),
+                                    (
+                                        "image".to_owned(),
+                                        if let Some(image) = image {
+                                            serde_json::Value::String(image.clone())
+                                        } else {
+                                            serde_json::Value::Null
+                                        },
+                                    ),
+                                    ("body".to_owned(), serde_json::Value::String(body.clone())),
+                                    ("timestamp".to_owned(), json!(timestamp)),
+                                    ("message".to_owned(), json!(&message)),
+                                ])),
+                                ..Default::default()
+                            };
 
-                            let mut message_builder =
-                                fcm::MessageBuilder::new(&config.api.fcm.api_key, &sub.auth);
-                            message_builder.notification(notification);
-
-                            if let Err(err) = client.send(message_builder.finalize()).await {
+                            if let Err(err) = client.send(&message).await {
                                 error!("Failed to send FCM notification! {:?}", err);
                             } else {
                                 info!("Sent FCM notification to {:?}.", session.id);

crates/core/files/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "revolt-files"
+version = "0.7.16"
+edition = "2021"
+license = "AGPL-3.0-or-later"
+authors = ["Paul Makles <me@insrt.uk>"]
+description = "Revolt Backend: S3 and encryption subroutines"
+
+[dependencies]
+aes-gcm = "0.10.3"
+
+aws-config = "1.5.5"
+aws-sdk-s3 = { version = "1.46.0", features = ["behavior-version-latest"] }

crates/core/files/src/lib.rs

@@ -0,0 +1,3 @@
+// pub fn
+
+pub fn decrypt(data: &mut [u8]) {}

crates/core/models/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-models"
-version = "0.7.15"
+version = "0.7.16"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -19,8 +19,8 @@ default = ["serde", "partials", "rocket"]
 
 [dependencies]
 # Core
-revolt-config = { version = "0.7.15", path = "../config" }
-revolt-permissions = { version = "0.7.15", path = "../permissions" }
+revolt-config = { version = "0.7.16", path = "../config" }
+revolt-permissions = { version = "0.7.16", path = "../permissions" }
 
 # Utility
 regex = "1"

crates/core/permissions/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-permissions"
-version = "0.7.15"
+version = "0.7.16"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -21,7 +21,7 @@ async-std = { version = "1.8.0", features = ["attributes"] }
 
 [dependencies]
 # Core
-revolt-result = { version = "0.7.15", path = "../result" }
+revolt-result = { version = "0.7.16", path = "../result" }
 
 # Utility
 auto_ops = "0.3.0"

crates/core/presence/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-presence"
-version = "0.7.15"
+version = "0.7.16"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <me@insrt.uk>"]

crates/core/result/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-result"
-version = "0.7.15"
+version = "0.7.16"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]

crates/delta/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-delta"
-version = "0.7.15"
+version = "0.7.16"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <paulmakles@gmail.com>"]
 edition = "2018"

crates/delta/Dockerfile

@@ -2,13 +2,11 @@
 FROM ghcr.io/revoltchat/base:latest AS builder
 
 # Bundle Stage
-FROM debian:bullseye-slim
-RUN apt-get update && \
-    apt-get install -y ca-certificates && \
-    apt-get clean
+FROM gcr.io/distroless/cc-debian12:nonroot
 COPY --from=builder /home/rust/src/target/release/revolt-delta ./
 
 EXPOSE 8000
 ENV ROCKET_ADDRESS 0.0.0.0
 ENV ROCKET_PORT 8000
+USER nonroot
 CMD ["./revolt-delta"]

crates/services/autumn/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "revolt-autumn"
+version = "0.7.14"
+edition = "2021"
+
+[dependencies]
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0.68"
+
+tokio = { version = "1.0", features = ["full"] }
+
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+
+revolt-config = { version = "0.7.16", path = "../../core/config" }
+
+tempfile = "3.12.0"
+axum_typed_multipart = "0.12.1"
+axum = { version = "0.7.5", features = ["multipart"] }
+
+utoipa-scalar = { version = "0.1.0", features = ["axum"] }
+utoipa = { version = "4.2.3", features = ["axum_extras", "ulid"] }

crates/services/autumn/src/api.rs

@@ -0,0 +1,160 @@
+use axum::{
+    extract::{DefaultBodyLimit, Multipart, Path},
+    http::StatusCode,
+    response::{IntoResponse, Response},
+    routing::{get, post},
+    Json, Router,
+};
+use axum_typed_multipart::{FieldData, TryFromMultipart, TypedMultipart};
+use revolt_config::config;
+use serde::{Deserialize, Serialize};
+use utoipa::ToSchema;
+
+use tempfile::NamedTempFile;
+
+pub async fn router() -> Router {
+    let config = config().await;
+
+    Router::new().route("/", get(root)).route(
+        "/:tag",
+        post(upload_file).layer(DefaultBodyLimit::max(
+            config.features.limits.global.body_limit_size,
+        )),
+    )
+}
+
+/// Successful root response
+#[derive(Serialize, Debug, ToSchema)]
+pub struct RootResponse {
+    autumn: &'static str,
+    version: &'static str,
+}
+
+/// Capture crate version from Cargo
+static CRATE_VERSION: &str = env!("CARGO_PKG_VERSION");
+
+/// Root response from service
+#[utoipa::path(
+    get,
+    path = "/",
+    responses(
+        (status = 200, description = "Echo response", body = RootResponse)
+    )
+)]
+async fn root() -> Json<RootResponse> {
+    Json(RootResponse {
+        autumn: "Hello, I am a file server!",
+        version: CRATE_VERSION,
+    })
+}
+
+/// Available tags to upload to
+#[derive(Deserialize, Debug, ToSchema)]
+#[allow(non_camel_case_types)]
+pub enum Tag {
+    attachments,
+    avatars,
+    backgrounds,
+    icons,
+    banners,
+    emojis,
+}
+
+/// Request body for upload
+#[derive(ToSchema, TryFromMultipart)]
+pub struct UploadPayload {
+    #[schema(format = Binary)]
+    #[allow(dead_code)]
+    #[form_data(limit = "unlimited")] // handled by axum
+    file: FieldData<NamedTempFile>,
+}
+
+/// Successful upload response
+#[derive(Serialize, Debug, ToSchema)]
+pub struct UploadResponse {
+    /// ID to attach uploaded file to object
+    id: &'static str,
+}
+
+/// Upload a file
+///
+/// Available tags and restrictions:
+///
+/// | Tag | Size | Resolution | Type |
+/// | :-: | --: | :-- | :-: |
+/// | attachments | 20 MB | - | Any |
+/// | avatars | 4 MB | 40 MP or 10,000px | Image |
+/// | backgrounds | 6 MB | 40 MP or 10,000px | Image |
+/// | icons | 2.5 MB | 40 MP or 10,000px | Image |
+/// | banners | 6 MB | 40 MP or 10,000px | Image |
+/// | emojis | 500 KB | 40 MP or 10,000px | Image |
+#[utoipa::path(
+    post,
+    path = "/{tag}",
+    responses(
+        (status = 200, description = "Upload was successful", body = UploadResponse)
+    ),
+    params(
+        ("tag" = Tag, Path, description = "Tag to upload to (e.g. attachments, icons, ...)")
+    ),
+    request_body(content_type = "multipart/form-data", content = UploadPayload),
+)]
+async fn upload_file(
+    Path(tag): Path<Tag>,
+    TypedMultipart(UploadPayload { file }): TypedMultipart<UploadPayload>,
+) -> axum::response::Result<Json<UploadResponse>> {
+    Ok(Json(UploadResponse { id: "aaa" }))
+}
+
+/// Fetch preview of file
+///
+/// Depending on the given tag, the file will be re-processed to fit the criteria:
+///
+/// | Tag | Image Resolution <sup>†</sup> |
+/// | :-: | --- |
+/// | attachments | Up to 1280px on any axis |
+/// | avatars | Up to 128px on any axis |
+/// | backgrounds | Up to 1280x720px |
+/// | icons | Up to 128px on any axis |
+/// | banners | Up to 480px on any axis |
+/// | emojis | Up to 128px on any axis |
+///
+/// <sup>†</sup> aspect ratio will always be preserved
+#[utoipa::path(
+    get,
+    path = "/{tag}/{file_id}",
+    responses(
+        (status = 200, description = "Generated preview", body = Vec<u8>)
+    ),
+    params(
+        ("tag" = Tag, Path, description = "Tag to fetch from (e.g. attachments, icons, ...)"),
+        ("file_id" = String, Path, description = "File identifier")
+    ),
+)]
+async fn fetch_preview(
+    Path(tag): Path<Tag>,
+    Path(file_id): Path<String>,
+) -> axum::response::Result<Response> {
+    todo!()
+}
+
+/// Fetch original file
+#[utoipa::path(
+    get,
+    path = "/{tag}/{file_id}/{file_name}",
+    responses(
+        (status = 200, description = "Generated preview", body = Vec<u8>)
+    ),
+    params(
+        ("tag" = Tag, Path, description = "Tag to fetch from (e.g. attachments, icons, ...)"),
+        ("file_id" = String, Path, description = "File identifier"),
+        ("file_name" = String, Path, description = "File name")
+    ),
+)]
+async fn fetch_file(
+    Path(tag): Path<Tag>,
+    Path(file_id): Path<String>,
+    Path(file_name): Path<String>,
+) -> axum::response::Result<Response> {
+    todo!()
+}

crates/services/autumn/src/main.rs

@@ -0,0 +1,65 @@
+use std::net::{Ipv4Addr, SocketAddr};
+
+use axum::Router;
+
+use tokio::net::TcpListener;
+use utoipa::{
+    openapi::security::{ApiKey, ApiKeyValue, SecurityScheme},
+    Modify, OpenApi,
+};
+use utoipa_scalar::{Scalar, Servable as ScalarServable};
+
+mod api;
+
+#[tokio::main]
+async fn main() -> Result<(), std::io::Error> {
+    // Configure logging and environment
+    revolt_config::configure!(api);
+
+    // Configure API schema
+    #[derive(OpenApi)]
+    #[openapi(
+        modifiers(&SecurityAddon),
+        paths(
+            api::root,
+            api::upload_file,
+            api::fetch_preview,
+            api::fetch_file
+        ),
+        components(
+            schemas(
+                api::RootResponse,
+                api::Tag,
+                api::UploadPayload,
+                api::UploadResponse
+            )
+        ),
+        tags(
+            // (name = "Files", description = "File uploads API")
+        )
+    )]
+    struct ApiDoc;
+
+    struct SecurityAddon;
+
+    impl Modify for SecurityAddon {
+        fn modify(&self, openapi: &mut utoipa::openapi::OpenApi) {
+            if let Some(components) = openapi.components.as_mut() {
+                components.add_security_scheme(
+                    "api_key",
+                    SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::new("todo_apikey"))),
+                )
+            }
+        }
+    }
+
+    // Configure Axum and router
+    let app = Router::new()
+        .merge(Scalar::with_url("/scalar", ApiDoc::openapi()))
+        .nest("/", api::router().await);
+
+    // Configure TCP listener and bind
+    let address = SocketAddr::from((Ipv4Addr::UNSPECIFIED, 3000));
+    let listener = TcpListener::bind(&address).await?;
+    axum::serve(listener, app.into_make_service()).await
+}

justfile

@@ -1,6 +1,7 @@
 publish:
     cargo publish --package revolt-config
     cargo publish --package revolt-result
+    cargo publish --package revolt-files
     cargo publish --package revolt-permissions
     cargo publish --package revolt-models
     cargo publish --package revolt-presence

scripts/build-image-layer.sh

@@ -22,20 +22,26 @@ tools() {
 
 deps() {
   mkdir -p \
+    crates/bindings/node/src \
     crates/bonfire/src \
     crates/delta/src \
     crates/core/config/src \
     crates/core/database/src \
+    crates/core/files/src \
     crates/core/models/src \
     crates/core/permissions/src \
     crates/core/presence/src \
-    crates/core/result/src
+    crates/core/result/src \
+    crates/services/autumn/src
   echo 'fn main() { panic!("stub"); }' |
     tee crates/bonfire/src/main.rs |
-    tee crates/delta/src/main.rs
+    tee crates/delta/src/main.rs |
+    tee crates/services/autumn/src/main.rs
   echo '' |
+    tee crates/bindings/node/src/lib.rs |
     tee crates/core/config/src/lib.rs |
     tee crates/core/database/src/lib.rs |
+    tee crates/core/files/src/lib.rs |
     tee crates/core/models/src/lib.rs |
     tee crates/core/permissions/src/lib.rs |
     tee crates/core/presence/src/lib.rs |