Merge branch 'main' into main

.github/workflows/docker.yml

@@ -21,7 +21,10 @@ jobs:
       contents: read
       packages: write
       security-events: write # To upload Trivy sarif files
+      id-token: write # needed for signing the images with GitHub OIDC Token
     steps:
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3.3.0
       - name: Checkout
         uses: actions/checkout@v3
       - name: Set up QEMU
@@ -62,6 +65,18 @@ jobs:
             ghcr.io/${{ env.GHCR_NAMESPACE }}/sliding-sync:latest
             ghcr.io/${{ env.GHCR_NAMESPACE }}/sliding-sync:${{ github.ref_name }}
 
+      - name: Sign the images with GitHub OIDC Token
+        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
+        env:
+          DIGEST: ${{ steps.docker_build_sliding_sync_release.outputs.digest }}
+          TAGS: ghcr.io/${{ env.GHCR_NAMESPACE }}/sliding-sync:${{ github.ref_name }}
+        run: |
+          images=""
+          for tag in ${TAGS}; do
+            images+="${tag}@${DIGEST} "
+          done
+          cosign sign --yes ${images}
+
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@master
         with:

README.md

@@ -83,7 +83,7 @@ location /.well-known/matrix/client {
 ```
 
 ### Running
-There are two ways to run the proxy:
+There are three ways to run the proxy:
 - Compiling from source:
 ```
 $ CGO_ENABLED=0 go build ./cmd/syncv3
@@ -95,6 +95,12 @@ $ SYNCV3_SECRET=$(cat .secret) SYNCV3_SERVER="https://matrix-client.matrix.org"
 docker run --rm -e "SYNCV3_SERVER=https://matrix-client.matrix.org" -e "SYNCV3_SECRET=$(cat .secret)" -e "SYNCV3_BINDADDR=:8008" -e "SYNCV3_DB=user=$(whoami) dbname=syncv3 sslmode=disable host=host.docker.internal password='DATABASE_PASSWORD_HERE'" -p 8008:8008 ghcr.io/matrix-org/sliding-sync:latest
 ```
 
+- Precompiled binaries:
+
+Download the binary for your architcture (eg. `syncv3_linux_amd64` for 64-bit AMD/Intel) from https://github.com/matrix-org/sliding-sync/releases/latest
+```
+$ SYNCV3_SECRET=$(cat .secret) SYNCV3_SERVER="https://matrix-client.matrix.org" SYNCV3_DB="user=$(whoami) dbname=syncv3 sslmode=disable password='DATABASE_PASSWORD_HERE'" SYNCV3_BINDADDR=0.0.0.0:8008 ./syncv3_linux_amd64 
+```
 
 Optionally also set `SYNCV3_TLS_CERT=path/to/cert.pem` and `SYNCV3_TLS_KEY=path/to/key.pem` to listen on HTTPS instead of HTTP.
 Make sure to tweak the `SYNCV3_DB` environment variable if the Postgres database isn't running on the host.

cmd/syncv3/main.go

@@ -27,7 +27,7 @@ import (
 
 var GitCommit string
 
-const version = "0.99.15"
+const version = "0.99.18"
 
 var (
 	flags = flag.NewFlagSet("goose", flag.ExitOnError)
@@ -241,6 +241,7 @@ func main() {
 	})
 
 	go h2.StartV2Pollers()
+	go h2.Store.Cleaner(time.Hour)
 	if args[EnvOTLP] != "" {
 		h3 = otelhttp.NewHandler(h3, "Sync")
 	}

grafana/README.md

@@ -0,0 +1,18 @@
+# Using the Sliding Sync Grafana dashboard
+
+**Set up Prometheus and Grafana.** Out of scope for this readme. Useful documentation about using Grafana with Prometheus: http://docs.grafana.org/features/datasources/prometheus/
+
+**Configure the bind address** for prometheus metrics in sliding sync. For example: `SYNCV3_PROM=:2112`. Metrics will be accessible at `/metrics` at this address.
+
+**Configure a new job in Prometheus** to scrape the sliding sync endpoint.
+
+For example by adding the following job to `prometheus.yml`, if your sliding sync is running locally not in docker and you have `SYNCV3_PROM` configured to port 2112:
+
+```
+# Sliding Sync
+  - job_name: "Sliding Sync"
+    static_configs:
+      - targets: ["localhost:2112"]
+```
+
+**Import the sliding sync dashboard into Grafana.** Download `sliding-sync.json`. Import it to Grafana and select the correct Prometheus datasource. http://docs.grafana.org/reference/export_import/