broken changes | 8448 -> 443

Author: stevessr

.github/workflows/build-deb-aarch64.yml

@@ -0,0 +1,28 @@
+name: Build aarch64 .deb
+
+on:
+  push:
+    branches: [ main ]
+  workflow_dispatch: {}
+
+jobs:
+  build-deb:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build aarch64 binary and .deb using cross Docker image
+        run: |
+          set -euo pipefail
+          # Use the cross Docker image to build for aarch64
+          docker run --rm -v "${{ github.workspace }}:/work" -w /work cross-rs/cross:latest \
+            sh -lc "cargo install cargo-deb --force && cross build --release --target aarch64-unknown-linux-gnu -p tuwunel && cp target/aarch64-unknown-linux-gnu/release/tuwunel target/release/tuwunel && cargo deb --no-build --target aarch64-unknown-linux-gnu -p tuwunel"
+
+      - name: Find .deb and upload
+        uses: actions/upload-artifact@v4
+        with:
+          name: tuwunel-deb-aarch64
+          path: |
+            target/debian/**/*.deb
+            target/**/*.deb

README.md

@@ -57,7 +57,7 @@ using the configuration and Tuwunel can be deployed without a reverse proxy. Exa
 `/etc/caddy/Caddyfile` configuration with [Element](https://github.com/element-hq/element-web/releases)
 unzipped to `/var/www/element`:
 ```
-tuwunel.me, tuwunel.me:8448 {
+tuwunel.me, tuwunel.me:443 {
     reverse_proxy localhost:8008
 }
 web.tuwunel.me {

docker/Dockerfile.complement

@@ -72,7 +72,7 @@ COPY <<EOF complement.toml
     log_thread_ids = true
     media_compat_file_link = false
     media_startup_check = true
-    port = [8008, 8448]
+    port = [8008, 443]
     prune_missing_media = true
     query_trusted_key_servers_first = false
     query_trusted_key_servers_first_on_join = false

docker/bake.hcl

@@ -790,7 +790,7 @@ target "docker" {
     dockerfile-inline =<<EOF
         FROM scratch AS install
         COPY --from=input . .
-        EXPOSE 8008 8448
+        EXPOSE 8008 443
         ENTRYPOINT ["tuwunel"]
 EOF
 }

docs/build-aarch64-deb.md

@@ -0,0 +1,41 @@
+如何为 aarch64 (arm64) 架构构建 tuwunel 的 Debian (.deb) 包
+
+概述
+ - 本文档说明如何在 x86_64 或任意 Linux 主机上，生成适用于 aarch64-unknown-linux-gnu 的 .deb 包。
+ - 推荐使用 cross（基于 Docker + QEMU），可以避免在宿主机安装交叉编译工具链。
+
+先决条件
+ - Rust（建议使用 rustup 管理 toolchain）
+ - Docker（如果使用 cross）
+ - cross（可选，但推荐）：cargo install cross 或 apt 安装含包
+ - cargo-deb：cargo install cargo-deb
+ - 如果不使用 cross，需要安装目标与交叉链接器：
+   - rustup target add aarch64-unknown-linux-gnu
+   - 在 Debian/Ubuntu 上安装： gcc-aarch64-linux-gnu 或 aarch64-linux-gnu-gcc
+
+使用脚本构建
+
+仓库中提供了脚本： `scripts/build-deb-aarch64.sh`。
+
+用法：
+
+```
+./scripts/build-deb-aarch64.sh
+```
+
+脚本逻辑
+ - 优先使用 `cross build --target aarch64-unknown-linux-gnu --release`。
+ - 若没有 cross，会尝试用 `cargo build --target aarch64-unknown-linux-gnu --release`（需本地交叉工具链）。
+ - 将生成的二进制复制到 `target/release/tuwunel`，然后运行 `cargo deb --no-build` 生成 .deb。
+ - 最终输出放在 `out/` 目录下。
+
+常见问题
+ - 找不到 cross：安装 `cargo install cross`，或在仓库根使用 Docker（需可用的 Docker）。
+ - cargo-deb 未安装： `cargo install cargo-deb`。
+ - 本地交叉构建失败：建议使用 cross；若必须本地构建，请确保交叉链接器已安装并在 PATH 中。
+
+进阶：在 CI 中使用
+ - 在 CI（例如 GitHub Actions）中，可使用官方 cross 镜像并运行脚本，或使用 QEMU + Docker runner。
+
+其他说明
+ - 打包元数据位于 `src/main/Cargo.toml` 的 `[package.metadata.deb]` 部分，包含了 systemd unit、配置文件、维护脚本路径等信息。

docs/deploying/docker-compose.yml

@@ -7,7 +7,7 @@ services:
         image: jevolk/tuwunel:latest
         restart: unless-stopped
         ports:
-            - 8448:6167
+            - 443:6167
         volumes:
             - db:/var/lib/tuwunel
             #- ./tuwunel.toml:/etc/tuwunel.toml

docs/deploying/docker.md

@@ -26,7 +26,7 @@ OCI images for tuwunel are available in the registries listed below.
 When you have the image you can simply run it with
 
 ```bash
-docker run -d -p 8448:6167 \
+docker run -d -p 443:6167 \
     -v db:/var/lib/tuwunel/ \
     -e TUWUNEL_SERVER_NAME="your.server.name" \
     -e TUWUNEL_ALLOW_REGISTRATION=false \
@@ -127,7 +127,7 @@ to deploy and use tuwunel, with a little caveat. If you already took a look at
 the files, then you should have seen the `well-known` service, and that is the
 little caveat. Traefik is simply a proxy and loadbalancer and is not able to
 serve any kind of content, but for tuwunel to federate, we need to either
-expose ports `443` and `8448` or serve two endpoints `.well-known/matrix/client`
+expose ports `443` and `443` or serve two endpoints `.well-known/matrix/client`
 and `.well-known/matrix/server`.
 
 With the service `well-known` we use a single `nginx` container that will serve

docs/deploying/generic.md

@@ -69,7 +69,7 @@ sudo useradd -r --shell /usr/bin/nologin --no-create-home tuwunel
 
 ## Forwarding ports in the firewall or the router
 
-Matrix's default federation port is port 8448, and clients must be using port 443.
+Matrix's default federation port is port 443, and clients must be using port 443.
 If you would like to use only port 443, or a different port, you will need to setup
 delegation. Tuwunel has config options for doing delegation, or you can configure
 your reverse proxy to manually serve the necessary JSON files to do delegation
@@ -207,17 +207,17 @@ You can also use these commands as a quick health check (replace
 ```bash
 curl https://your.server.name/_tuwunel/server_version
 
-# If using port 8448
-curl https://your.server.name:8448/_tuwunel/server_version
+# If using port 443
+curl https://your.server.name:443/_tuwunel/server_version
 
 # If federation is enabled
-curl https://your.server.name:8448/_matrix/federation/v1/version
+curl https://your.server.name:443/_matrix/federation/v1/version
 ```
 
 - To check if your server can talk with other homeservers, you can use the
 [Matrix Federation Tester](https://federationtester.matrix.org/). If you can
 register but cannot join federated rooms check your config again and also check
-if the port 8448 is open and forwarded correctly.
+if the port 443 is open and forwarded correctly.
 
 # What's next?
 

docs/deploying/tuwunel.container

@@ -1,7 +1,7 @@
 [Container]
 Environment=TUWUNEL_SERVER_NAME=your.domain.here TUWUNEL_DATABASE_PATH=/var/lib/tuwunel TUWUNEL_PORT=6167 TUWUNEL_MAX_REQUEST_SIZE=20000000 TUWUNEL_ALLOW_REGISTRATION=true TUWUNEL_REGISTRATION_TOKEN=YOUR_TOKEN TUWUNEL_ALLOW_FEDERATION=true TUWUNEL_TRUSTED_SERVERS=["matrix.org"] TUWUNEL_ADDRESS=0.0.0.0 # Add TUWUNEL_CONFIG: '/etc/tuwunel.toml' if the config is mapped
 Image=docker.io/jevolk/tuwunel:latest
-PublishPort=8448:6167
+PublishPort=443:6167
 Volume=/path/to/db:/var/lib/tuwunel
 #Volume=/path/to/tuwunel.toml:/etc/tuwunel.toml #Uncomment to use the config file
 

nix/pkgs/complement/config.toml

@@ -7,7 +7,7 @@ allow_public_room_directory_without_auth = true
 allow_registration = true
 database_path = "/database"
 log = "trace,h2=debug,hyper=debug"
-port = [8008, 8448]
+port = [8008, 443]
 trusted_servers = []
 only_query_trusted_key_servers = false
 query_trusted_key_servers_first = false