feat(remote): durable realtime sessions and cross-platform runtime tools

Cargo.toml

@@ -55,6 +55,7 @@ members = [
 
 exclude = [
     "OpenBitFun-Installer/src-tauri",
+    "third_party/eioc",
 ]
 
 resolver = "2"
@@ -269,6 +270,7 @@ qrcode = { version = "0.14", default-features = false }
 
 # WebSocket client
 tokio-tungstenite = "0.29"
+sioc = { version = "0.5.0", default-features = false }
 
 # Local speech recognition
 sherpa-onnx = "1.13.4"
@@ -294,6 +296,8 @@ ssh_config = "0.1"
 rustls = { version = "0.23", default-features = false }
 
 [patch.crates-io]
+# Keep Socket.IO on the product-owned ring provider; see the patch note.
+eioc = { path = "third_party/eioc" }
 # Tauri 2.11 loses keyboard focus for child webviews after Windows reactivates
 # an `unstable` multi-webview window. Use the upstream fix until released;
 # this revision also adopts tao 0.36, which includes the Windows input deadlock fix.

deploy/miniapp-market/nginx-auth.openbitfun.com.conf

@@ -49,6 +49,17 @@ server {
         access_log /var/log/nginx/relay-v1-auth-access.log relay_v1_json;
     }
 
+    location ~ ^/v/1\.0\.1/api/(page-auth/(sign-in|login|client\.js)|auth/github/(start|poll))$ {
+        rewrite ^/v/1\.0\.1/(.*)$ /$1 break;
+        proxy_pass http://127.0.0.1:19701;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        limit_req zone=relay_v101_client_requests burst=20 nodelay;
+        limit_req_status 429;
+        access_log /var/log/nginx/relay-v1.0.1-auth-access.log relay_v1_json;
+    }
+
     location = /sign-in {
         proxy_pass http://127.0.0.1:9710/miniapp/api/v1/auth/github/start;
     }

deploy/relay-v1/README.md

@@ -1,30 +1,31 @@
 # Official Relay v1 deployment
 
 The owner guide is [Relay Server](../../src/apps/relay-server/README.md).
-Use this independent Compose project for `/v/1.0.0/`. Keep the older Relay
+Use this independent Compose project for `/v/1.0.1/`. Keep `/v/1.0.0/` and the older Relay
 container, paths, image, database, and `/relay` proxy location intact.
 
-Deploy from a committed checkout at `/srv/openbitfun-relay-v1/app`. Set
+Deploy from a committed checkout at `/srv/openbitfun-relay-v1.0.1/app`. Set
 `RELAY_GIT_COMMIT` to that checkout's verified full commit. Build mobile web
 from the same checkout with `pnpm run build:mobile-web` and stage its `dist`
-contents into `/srv/openbitfun-relay-v1/static`. Create `data` and `assets`
+contents into `/srv/openbitfun-relay-v1.0.1/static`. Create `data` and `assets`
 under that root owned by UID/GID 10001 before starting Compose.
 
-The Linux host network plus explicit `127.0.0.1:19700` listener lets the service
+The Linux host network plus explicit `127.0.0.1:19701` listener lets the service
 verify the immediate proxy peer before trusting its overwritten forwarded IP.
-Do not publish this listener on a public interface. Install `nginx-http.conf` in the Nginx http context and include
-`nginx-location.conf` in the existing remote server after the container passes
-its health check. The new location accepts the existing explicit WAF origin
+Do not publish this listener on a public interface. Install `nginx-http.conf` as `/etc/nginx/conf.d/relay-v1.0.1.conf` and include
+`nginx-location.conf` as `/etc/nginx/relay-v1.0.1-location.conf` in the existing remote server after the container passes
+its health check. Keep the existing v1.0.0 includes. The new version uses independent admission zones.
+The new location accepts the existing explicit WAF origin
 ranges and loopback; direct origin requests from other peers receive 403.
 Forwarded client IPs are recursively resolved only for those trusted WAF
 peers. Keep the range list synchronized with the WAF control plane. Raise
 `worker_connections` to 8192 and retain a file descriptor limit of at least
 16384; validate with `nginx -t` before a graceful reload.
 
 Published Pages use the existing official Relay address:
-`https://remote.openbitfun.com/v/1.0.0/p/{github_username}/{slug}`.
+`https://remote.openbitfun.com/v/1.0.1/p/{github_username}/{slug}`.
 Compose sets this public base URL and the separate sign-in base URL
-`https://auth.openbitfun.com/v/1.0.0`. Users do not configure domains.
+`https://auth.openbitfun.com/v/1.0.1`. Users do not configure domains.
 Install the versioned Pages sign-in locations from
 [`nginx-auth.openbitfun.com.conf`](../miniapp-market/nginx-auth.openbitfun.com.conf)
 in the existing auth server as well. Keep its marketplace sign-in routes intact.

deploy/relay-v1/compose.yml

@@ -1,14 +1,14 @@
-name: openbitfun-relay-v1
+name: openbitfun-relay-v1.0.1
 services:
   relay-v1:
-    image: openbitfun-relay-v1:${RELAY_GIT_COMMIT:?Set the verified source commit}
+    image: openbitfun-relay-v1.0.1:${RELAY_GIT_COMMIT:?Set the verified source commit}
     build:
       context: ../..
       dockerfile: src/apps/relay-server/Dockerfile
       args:
         RELAY_GIT_COMMIT: ${RELAY_GIT_COMMIT:?Set the verified source commit}
         CARGO_BUILD_JOBS: "4"
-    container_name: openbitfun-relay-v1
+    container_name: openbitfun-relay-v1.0.1
     network_mode: host
     user: "10001:10001"
     read_only: true
@@ -23,29 +23,30 @@ services:
         soft: 16384
         hard: 16384
     tmpfs:
-      - /tmp:size=64m,mode=1777
+      # The encrypted payload owner admits 512 MiB, plus temporary-file overhead.
+      - /tmp:size=640m,mode=1777
     environment:
-      RELAY_PORT: "19700"
-      RELAY_LISTEN_ADDR: 127.0.0.1:19700
+      RELAY_PORT: "19701"
+      RELAY_LISTEN_ADDR: 127.0.0.1:19701
       RELAY_STATIC_DIR: /app/static
       RELAY_DB_PATH: /app/data/relay.db
       RELAY_ROOM_WEB_DIR: /app/room-web
       RELAY_ASSET_STORE_MAX_BYTES: "1073741824"
       RELAY_CORS_ALLOW_ORIGINS: https://remote.openbitfun.com,https://auth.openbitfun.com
-      RELAY_PAGE_PUBLIC_BASE_URL: https://remote.openbitfun.com/v/1.0.0
-      RELAY_PAGE_AUTH_BASE_URL: https://auth.openbitfun.com/v/1.0.0
+      RELAY_PAGE_PUBLIC_BASE_URL: https://remote.openbitfun.com/v/1.0.1
+      RELAY_PAGE_AUTH_BASE_URL: https://auth.openbitfun.com/v/1.0.1
       RUST_LOG: info
     volumes:
-      - /srv/openbitfun-relay-v1/data:/app/data
-      - /srv/openbitfun-relay-v1/assets:/app/room-web
-      - /srv/openbitfun-relay-v1/static:/app/static:ro
+      - /srv/openbitfun-relay-v1.0.1/data:/app/data
+      - /srv/openbitfun-relay-v1.0.1/assets:/app/room-web
+      - /srv/openbitfun-relay-v1.0.1/static:/app/static:ro
     logging:
       driver: json-file
       options:
         max-size: 10m
         max-file: "3"
     healthcheck:
-      test: [CMD, curl, -fsS, http://127.0.0.1:19700/health]
+      test: [CMD, curl, -fsS, http://127.0.0.1:19701/health]
       interval: 15s
       timeout: 5s
       retries: 5

deploy/relay-v1/nginx-http.conf

@@ -1,11 +1,11 @@
-# Install in /etc/nginx/conf.d/relay-v1.conf (http context).
-map $http_upgrade $relay_v1_connection_upgrade {
+# Install in /etc/nginx/conf.d/relay-v1.0.1.conf (http context).
+map $http_upgrade $relay_v101_connection_upgrade {
     default upgrade;
     '' close;
 }
 # Same explicit Huawei WAF origin ranges as the existing market deployment.
 # Refresh from the WAF control plane when its origin source ranges change.
-geo $realip_remote_addr $relay_v1_trusted_origin_peer {
+geo $realip_remote_addr $relay_v101_trusted_origin_peer {
     default 0;
     127.0.0.1 1;
     ::1 1;
@@ -14,10 +14,10 @@ geo $realip_remote_addr $relay_v1_trusted_origin_peer {
     101.44.169.0/24 1;
     2405:f080:110::/120 1;
 }
-limit_conn_zone $binary_remote_addr zone=relay_v1_client_connections:10m;
-limit_conn_zone $server_name zone=relay_v1_global_connections:1m;
-limit_req_zone $binary_remote_addr zone=relay_v1_client_requests:10m rate=100r/s;
-limit_req_zone $server_name zone=relay_v1_global_requests:1m rate=2000r/s;
-log_format relay_v1_json escape=json
+limit_conn_zone $binary_remote_addr zone=relay_v101_client_connections:10m;
+limit_conn_zone $server_name zone=relay_v101_global_connections:1m;
+limit_req_zone $binary_remote_addr zone=relay_v101_client_requests:10m rate=100r/s;
+limit_req_zone $server_name zone=relay_v101_global_requests:1m rate=2000r/s;
+log_format relay_v101_json escape=json
     '{"time":"$time_iso8601","method":"$request_method","path":"$uri",'
     '"status":$status,"bytes":$body_bytes_sent,"requestTime":$request_time}';

deploy/relay-v1/nginx-location.conf

@@ -1,8 +1,8 @@
 # Include inside the existing remote.openbitfun.com server block.
-location = /v/1.0.0 {
-    return 308 /v/1.0.0/;
+location = /v/1.0.1 {
+    return 308 /v/1.0.1/;
 }
-location ^~ /v/1.0.0/ {
+location ^~ /v/1.0.1/ {
     # Trust forwarded addresses only from the existing explicit WAF peers.
     # Recursive extraction selects the last non-trusted address, not a spoofed
     # client-supplied leftmost XFF entry. Relay receives one overwritten value.
@@ -12,28 +12,28 @@ location ^~ /v/1.0.0/ {
     set_real_ip_from 2405:f080:110::/120;
     real_ip_header X-Forwarded-For;
     real_ip_recursive on;
-    if ($relay_v1_trusted_origin_peer = 0) { return 403; }
+    if ($relay_v101_trusted_origin_peer = 0) { return 403; }
 
-    limit_conn relay_v1_client_connections 256;
-    limit_conn relay_v1_global_connections 6144;
+    limit_conn relay_v101_client_connections 256;
+    limit_conn relay_v101_global_connections 6144;
     limit_conn_status 429;
-    limit_req zone=relay_v1_client_requests burst=200 nodelay;
-    limit_req zone=relay_v1_global_requests burst=1000 nodelay;
+    limit_req zone=relay_v101_client_requests burst=200 nodelay;
+    limit_req zone=relay_v101_global_requests burst=1000 nodelay;
     limit_req_status 429;
 
-    proxy_pass http://127.0.0.1:19700/;
+    proxy_pass http://127.0.0.1:19701/;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-For $remote_addr;
     proxy_set_header X-Forwarded-Proto $scheme;
     proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection $relay_v1_connection_upgrade;
+    proxy_set_header Connection $relay_v101_connection_upgrade;
     proxy_buffering off;
     proxy_request_buffering off;
-    client_max_body_size 49m;
+    client_max_body_size 65m;
     client_body_timeout 15s;
     proxy_connect_timeout 5s;
     proxy_read_timeout 140s;
     proxy_send_timeout 30s;
-    access_log /var/log/nginx/relay-v1-access.log relay_v1_json;
+    access_log /var/log/nginx/relay-v1.0.1-access.log relay_v101_json;
 }