malice

public

Star0

Fork 0

Watch0

97 commits 2 branches 0 tags 0 releases4.4 MiB

Commit `54e1929170a7`

tarball

atagen <boss@atagen.co>2026-10-26 03:48 UTC

6 files changed+133-25

server: never answer 304 for the shell and serve precompressed assets

ServeDir stamped every nix store file with an epoch Last-Modified, so conditional requests for /, /index.html and /sw.js always got 304 and Helium stayed on a service worker from 10-23 that predates the avatar cache. Hashed assets are now immutable for a year and brotli or gzip copies are emitted at build time, which shrinks the worker wasm transfer from 18.6MB to 3.6MB.

Modified file: Cargo.lock+48 additions−11 deletions@@ -51,6 +51,21 @@ dependencies = [
 ]
 
 [[package]]
+name = "alloc-no-stdlib"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
+
+[[package]]
+name = "alloc-stdlib"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e76a019e91224d279006ff972f1e984179a6e9feb050adba6ce8274aef23195"
+dependencies = [
+ "alloc-no-stdlib",
+]
+
+[[package]]
 name = "allocator-api2"
 version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -439,6 +454,27 @@ dependencies = [
 ]
 
 [[package]]
+name = "brotli"
+version = "8.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cc91aac060a7a1e25823bdccbfb6af1875b88f17c6daac97894eed8207166b3"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+ "brotli-decompressor",
+]
+
+[[package]]
+name = "brotli-decompressor"
+version = "5.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a32acac15fe1967bc3986b2a6347dffc965602354ea6f450ad07e8bfd253583"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+]
+
+[[package]]
 name = "bs58"
 version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -619,6 +655,7 @@ version = "0.4.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bef16c47ba2797aa6a909cc37d39911f3a6743811fe7408ac0b0cc0276b656e9"
 dependencies = [
+ "brotli",
  "compression-core",
  "flate2",
  "memchr",
@@ -2212,7 +2249,7 @@ checksum = "7ef0d4ed8669f8f8826eb00dc878084aa8f253506c4fd5e8f58f5bce72ddb97e"
 [[package]]
 name = "macltok"
 version = "0.1.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/macltok?rev=038cc6faeb1429501e5cd06596b831bbd2044b92#038cc6faeb1429501e5cd06596b831bbd2044b92"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/macltok?rev=417da9e719bcfbb8b60e4ff4f1a09f3d6b0d0160#417da9e719bcfbb8b60e4ff4f1a09f3d6b0d0160"
 dependencies = [
  "futures-util",
  "getrandom 0.2.17",
@@ -2447,7 +2484,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd#5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=ec026bc9ea2393fd0cce6212b950d91ab6d36097#ec026bc9ea2393fd0cce6212b950d91ab6d36097"
 dependencies = [
  "anymap2",
  "aquamarine",
@@ -2510,7 +2547,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-base"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd#5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=ec026bc9ea2393fd0cce6212b950d91ab6d36097#ec026bc9ea2393fd0cce6212b950d91ab6d36097"
 dependencies = [
  "as_variant",
  "assert_matches",
@@ -2540,7 +2577,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-common"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd#5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=ec026bc9ea2393fd0cce6212b950d91ab6d36097#ec026bc9ea2393fd0cce6212b950d91ab6d36097"
 dependencies = [
  "eyeball-im",
  "futures-core",
@@ -2563,7 +2600,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-crypto"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd#5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=ec026bc9ea2393fd0cce6212b950d91ab6d36097#ec026bc9ea2393fd0cce6212b950d91ab6d36097"
 dependencies = [
  "aes",
  "aquamarine",
@@ -2604,7 +2641,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-indexeddb"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd#5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=ec026bc9ea2393fd0cce6212b950d91ab6d36097#ec026bc9ea2393fd0cce6212b950d91ab6d36097"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -2635,7 +2672,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-sqlite"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd#5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=ec026bc9ea2393fd0cce6212b950d91ab6d36097#ec026bc9ea2393fd0cce6212b950d91ab6d36097"
 dependencies = [
  "as_variant",
  "async-trait",
@@ -2662,7 +2699,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-store-encryption"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd#5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=ec026bc9ea2393fd0cce6212b950d91ab6d36097#ec026bc9ea2393fd0cce6212b950d91ab6d36097"
 dependencies = [
  "base64 0.22.1",
  "blake3",
@@ -2683,7 +2720,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-test"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd#5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=ec026bc9ea2393fd0cce6212b950d91ab6d36097#ec026bc9ea2393fd0cce6212b950d91ab6d36097"
 dependencies = [
  "as_variant",
  "ctor",
@@ -2706,7 +2743,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-test-macros"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd#5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=ec026bc9ea2393fd0cce6212b950d91ab6d36097#ec026bc9ea2393fd0cce6212b950d91ab6d36097"
 dependencies = [
  "quote",
  "syn 2.0.119",
@@ -2715,7 +2752,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-ui"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd#5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=ec026bc9ea2393fd0cce6212b950d91ab6d36097#ec026bc9ea2393fd0cce6212b950d91ab6d36097"
 dependencies = [
  "as_variant",
  "async-rx",

Modified file: crates/malice-server/Cargo.toml+2 additions−2 deletions@@ -24,14 +24,14 @@ serde = { workspace = true }
 serde_json = { workspace = true }
 sha2 = "0.10"
 tokio = { workspace = true, features = ["full"] }
-tower-http = { version = "0.6", features = ["fs", "trace"] }
+tower-http = { version = "0.6", features = ["compression-br", "compression-gzip", "fs", "trace"] }
 tracing = { workspace = true }
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
 [dev-dependencies]
 http-body-util = "0.1"
 tower = { version = "0.5", features = ["util"] }
-matrix-sdk = { git = "ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk", rev = "5ec7600f0a5f648c6e2a34b5be0a1494a4e2eafd", default-features = false, features = ["testing"] }
+matrix-sdk = { git = "ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk", rev = "ec026bc9ea2393fd0cce6212b950d91ab6d36097", default-features = false, features = ["testing"] }
 reqwest = { version = "0.13", default-features = false, features = ["json", "query", "rustls"] }
 tempfile = "3"
 wiremock = "0.6"

Modified file: crates/malice-server/src/routes.rs+18 additions−4 deletions@@ -17,6 +17,10 @@ use malice_core::{
 };
 use serde::{Deserialize, Serialize};
 use tower_http::{
+    compression::{
+        CompressionLayer,
+        predicate::{DefaultPredicate, NotForContentType, Predicate},
+    },
     services::{ServeDir, ServeFile},
     trace::TraceLayer,
 };
@@ -1145,15 +1149,25 @@ pub fn router(state: AppState, web_dir: Option<String>) -> Router {
         .route("/encryption/recover", post(recover_encryption))
         .route("/encryption/start", post(start_verification))
         .route("/encryption/verify", post(verify_encryption));
+    let compression = CompressionLayer::new().compress_when(
+        DefaultPredicate::new()
+            .and(NotForContentType::const_new("video/"))
+            .and(NotForContentType::const_new("audio/"))
+            .and(NotForContentType::const_new("application/octet-stream")),
+    );
     let api = Router::new()
-        .nest("/api", api)
+        .nest("/api", api.layer(compression))
         .layer(middleware::from_fn(csrf_guard));
     let router = api.with_state(state).layer(TraceLayer::new_for_http());
     match web_dir {
         Some(dir) => {
-            let files =
-                ServeDir::new(&dir).not_found_service(ServeFile::new(format!("{dir}/index.html")));
-            router.fallback_service(files)
+            let files = ServeDir::new(&dir)
+                .precompressed_br()
+                .precompressed_gzip()
+                .not_found_service(ServeFile::new(format!("{dir}/index.html")));
+            router
+                .fallback_service(files)
+                .layer(middleware::from_fn(malice_static::static_headers))
         }
         None => router.fallback(static_shell),
     }

Modified file: crates/malice-static/src/lib.rs+26 additions−6 deletions@@ -105,15 +105,33 @@ fn is_no_cache_path(path: &str) -> bool {
     matches!(path, "/" | "/index.html" | "/sw.js")
 }
 
+fn is_immutable_path(path: &str) -> bool {
+    path.starts_with("/assets/") || path.starts_with("/twemoji/")
+}
+
 /// index.html and sw.js must never be cached, or a stale service worker or
-/// app shell survives a rebuild; the rest of the bundle is hashed and can be
-/// cached freely.
-async fn static_headers(request: axum::extract::Request, next: Next) -> Response {
+/// app shell survives a rebuild. Content-hashed assets are cached forever.
+pub async fn static_headers(request: axum::extract::Request, next: Next) -> Response {
     let no_cache = is_no_cache_path(request.uri().path());
+    let immutable = is_immutable_path(request.uri().path());
+    let mut request = request;
+    if no_cache {
+        let headers = request.headers_mut();
+        headers.remove(header::IF_MODIFIED_SINCE);
+        headers.remove(header::IF_NONE_MATCH);
+    }
     let mut response = next.run(request).await;
+    response.headers_mut().remove(header::LAST_MODIFIED);
+    if immutable && response.status().is_success() {
+        response.headers_mut().insert(
+            header::CACHE_CONTROL,
+            HeaderValue::from_static("public, max-age=31536000, immutable"),
+        );
+    }
     if no_cache {
         let headers = response.headers_mut();
-        headers.insert(header::CACHE_CONTROL, HeaderValue::from_static("no-cache"));
+        headers.remove(header::ETAG);
+        headers.insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
         headers.insert(
             HeaderName::from_static("service-worker-allowed"),
             HeaderValue::from_static("/"),
@@ -131,8 +149,10 @@ pub fn static_router(web_dir: Option<String>) -> Router {
         .layer(TraceLayer::new_for_http());
     match web_dir {
         Some(dir) => {
-            let files =
-                ServeDir::new(&dir).not_found_service(ServeFile::new(format!("{dir}/index.html")));
+            let files = ServeDir::new(&dir)
+                .precompressed_br()
+                .precompressed_gzip()
+                .not_found_service(ServeFile::new(format!("{dir}/index.html")));
             router
                 .fallback_service(files)
                 .layer(middleware::from_fn(static_headers))

Modified file: crates/malice-static/tests/static_only.rs+36 additions−2 deletions@@ -77,6 +77,9 @@ async fn static_only_serves_the_bundle_and_exits_when_idle() {
         .expect("write index.html");
     std::fs::write(web_dir.path().join("sw.js"), "// service worker").expect("write sw.js");
     std::fs::write(web_dir.path().join("style.css"), "body {}").expect("write style.css");
+    std::fs::create_dir(web_dir.path().join("assets")).expect("create assets");
+    std::fs::write(web_dir.path().join("assets/app-abc.wasm"), "wasm").expect("write wasm");
+    std::fs::write(web_dir.path().join("assets/app-abc.wasm.br"), "brotli").expect("write br");
 
     let client = Client::new();
     let port = unused_port();
@@ -87,15 +90,28 @@ async fn static_only_serves_the_bundle_and_exits_when_idle() {
     assert_eq!(index.status(), StatusCode::OK);
     assert_eq!(
         index.headers().get(header::CACHE_CONTROL).unwrap(),
-        "no-cache"
+        "no-store"
     );
     assert_eq!(index.headers().get("service-worker-allowed").unwrap(), "/");
     assert_eq!(index.text().await.unwrap(), "<html>malice</html>");
 
     let sw = client.get(format!("{base}/sw.js")).send().await.unwrap();
     assert_eq!(sw.status(), StatusCode::OK);
-    assert_eq!(sw.headers().get(header::CACHE_CONTROL).unwrap(), "no-cache");
+    assert_eq!(sw.headers().get(header::CACHE_CONTROL).unwrap(), "no-store");
     assert_eq!(sw.headers().get("service-worker-allowed").unwrap(), "/");
+    assert!(sw.headers().get(header::LAST_MODIFIED).is_none());
+    assert!(sw.headers().get(header::ETAG).is_none());
+
+    for path in ["/", "/sw.js"] {
+        let conditional = client
+            .get(format!("{base}{path}"))
+            .header(header::IF_MODIFIED_SINCE, "Thu, 01 Jan 1970 00:00:01 GMT")
+            .send()
+            .await
+            .unwrap();
+        assert_eq!(conditional.status(), StatusCode::OK, "{path}");
+        assert!(!conditional.text().await.unwrap().is_empty(), "{path}");
+    }
 
     let asset = client
         .get(format!("{base}/style.css"))
@@ -105,6 +121,24 @@ async fn static_only_serves_the_bundle_and_exits_when_idle() {
     assert_eq!(asset.status(), StatusCode::OK);
     assert!(asset.headers().get(header::CACHE_CONTROL).is_none());
 
+    let wasm = client
+        .get(format!("{base}/assets/app-abc.wasm"))
+        .header(header::ACCEPT_ENCODING, "br, gzip")
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(wasm.status(), StatusCode::OK);
+    assert_eq!(
+        wasm.headers().get(header::CACHE_CONTROL).unwrap(),
+        "public, max-age=31536000, immutable"
+    );
+    assert_eq!(wasm.headers().get(header::CONTENT_ENCODING).unwrap(), "br");
+    assert_eq!(
+        wasm.headers().get(header::CONTENT_TYPE).unwrap(),
+        "application/wasm"
+    );
+    assert_eq!(wasm.bytes().await.unwrap().as_ref(), b"brotli");
+
     assert_eq!(
         client
             .get(format!("{base}/api/rooms"))

Modified file: flake.nix+3 additions@@ -94,6 +94,7 @@
           nativeBuildInputs = [
             pkgs.nodejs_22
             pkgs.importNpmLock.hooks.linkNodeModulesHook
+            pkgs.brotli
           ];
           buildPhase = ''
             runHook preBuild
@@ -105,6 +106,8 @@
             runHook preInstall
             mkdir -p $out/share/malice
             cp -R ${outDir}/. $out/share/malice/
+            find $out/share/malice -type f \( -name '*.wasm' -o -name '*.js' -o -name '*.css' -o -name '*.html' -o -name '*.svg' -o -name '*.json' -o -name '*.webmanifest' \) -size +1k \
+              -exec brotli --best --keep {} \; -exec gzip -9 --keep {} \;
             runHook postInstall
           '';
         };

malice

Commit 54e1929170a7

Commit `54e1929170a7`