encryption.enabled / WARP_ENCRYPTION_ENABLED (default true) joins the
runtime switches, with allow_runtime_toggle. Off, the homeserver refuses
m.room.encryption from its users, in createRoom's initial_state or sent
as state, and tells clients not to offer it: io.warp.e2ee in
/capabilities and Element's io.element.e2ee in the client well-known,
now cached for five minutes. Rooms already encrypted stay so.
The admin panel gets an Encryption page, a dashboard badge and the audit
action; the web and mobile apps stop encrypting new rooms while the
server says no. Every .env example, warp.yaml.example and the docs
describe it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every compose file gets livekit and livekit-jwt in a calls profile,
started with COMPOSE_PROFILES=calls, and every .env example a calls
section: LIVEKIT_PUBLIC_URL, LIVEKIT_KEY and LIVEKIT_SECRET, the ports and
the images. The READMEs say what the proxy and the router need, including
serving /.well-known/matrix/server while federation is off.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A host directory in WARP_DATA_VOLUME is created owned by root, so the
homeserver could not write its signing key and crash-looped. A one-shot
warp-init service chowns /data first; a failed generate-keys now stops
startup instead of falling through to warp serve.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The homeserver reaches the gateway over the compose network (or inside
the AIO container), so publishing 8333 on the host only made a second
SeaweedFS stack fail with "port is already allocated". Drop the binding
and SEAWEED_S3_BIND/SEAWEED_S3_PORT.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
warp create-account gets --if-not-exists, which makes an account that is
already there a success that changes nothing. Every compose stack and the
AIO entrypoint use it: with WARP_ADMIN_USERNAME and WARP_ADMIN_PASSWORD
set, the first start creates that account as a server administrator,
passing the password on standard input, and later starts leave it as it
is. A username with no password stops the container instead of creating
an account nobody can log in to.
The .env examples, the compose headers, the READMEs and
docs/deployment.md describe the two variables; deploy/compose passes them
through from the shell or .env.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The SeaweedFS compose files read the region from .env, defaulting to
us-east-1 as before, and their .env examples list it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The pocketbase driver no longer embeds PocketBase: Warp keeps its data as
PocketBase collections on a server of its own and reaches it only through
the REST API, the way the postgres driver reaches PostgreSQL.
database.connection_string is the server's URL, and Warp signs in as the
superuser in WARP_PB_SUPERUSER_EMAIL / WARP_PB_SUPERUSER_PASSWORD (or a
WARP_PB_SUPERUSER_FILE of the two).
Every SQL table is a superuser-only collection of the same name and
columns, created by warp migrate. Reads go through PocketBase's SQL
endpoint with the SQL drivers' queries, via a read-only database/sql
driver that inlines arguments, moves long ones into warp_params and pages
past 1000 rows. Writes are record operations in batch requests under one
write lock in the Warp process. Media is a protected file field in
warp_media, local or in the S3 bucket Warp writes into PocketBase's
settings. Search matches word prefixes with LIKE. The storage tests run
against an in-process PocketBase and pass as on SQLite.
Docker: the PocketBase stacks get a pocketbase service running
tajniak81/pocketbase-docker-root (WARP_PB_IMAGE), with a pb-data volume
and its admin UI on loopback; the AIO images run that PocketBase binary
as a process beside the homeserver, making up a superuser when none is
set. The .env examples, READMEs, docs and warp.yaml.example follow.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Images now default to the registry 10.2.1.10:5500/admin instead of
ghcr.io/dariuszjaniak, in the compose files, the .env examples and the
READMEs.
Each data volume's source comes from .env: WARP_DATA_VOLUME,
WARP_POSTGRES_VOLUME, SEAWEED_DATA_VOLUME and SEAWEED_ADMIN_VOLUME.
Empty keeps the named volume; a host path bind-mounts that directory,
which must be writable by UID 10001 where the homeserver or the AIO
container uses it. Each .env example lists the ones its compose file
mounts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replace each folder's shared .env.example with one example per compose
file, named after it (docker-compose.<name>.yml takes
.env.<name>.example), as DriverVault does. Each lists only the settings
its compose file uses, names the required ones in its header, and the
prod examples start from a public server name. Every variable a compose
file substitutes is defined in its example.
The compose headers point at their own example. The SeaweedFS files now
fix WARP_PB_S3_REGION at us-east-1 instead of reading it from .env,
since SeaweedFS ignores the region.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Six compose files for the separate-container setup, a build and a prod
file for each, modelled on DriverVault's Docker folder:
- pocketbase.s3: media in an existing bucket elsewhere; the endpoint
and key pair are required, host.docker.internal is mapped, and the
homeserver waits up to 30 seconds for the endpoint before starting.
- pocketbase.seaweedfs: SeaweedFS as one `weed server -s3` container
whose only identity is the homeserver's key pair, plus a one-shot
init that creates the bucket.
- pocketbase.seaweedfs.split: master, volume, filer, S3 gateway and
admin UI as separate containers; the init seeds the bucket and the
homeserver's identity into the filer's IAM store, and the gateway
waits for it.
Only the S3 gateway and admin UI are published, on loopback. Both
SeaweedFS files share one project and data layout, so switching needs
no migration. .env.example gains the SEAWEED_* settings and leaves
WARP_PB_S3_FORCE_PATH_STYLE empty so the S3 file's default applies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
