[pull] canary from toeverything:canary

.docker/selfhost/compose.yml

@@ -18,7 +18,6 @@ services:
     environment:
       - REDIS_SERVER_HOST=redis
       - DATABASE_URL=postgresql://affine@postgres:5432/affine
-      - AFFINE_INDEXER_ENABLED=false
     restart: unless-stopped
 
   affine_migration:
@@ -31,7 +30,6 @@ services:
     environment:
       - REDIS_SERVER_HOST=redis
       - DATABASE_URL=postgresql://affine@postgres:5432/affine
-      - AFFINE_INDEXER_ENABLED=false
     depends_on:
       postgres:
         condition: service_healthy

.docker/selfhost/config.example.json

@@ -2,5 +2,9 @@
   "$schema": "https://github.com/toeverything/affine/releases/latest/download/config.schema.json",
   "server": {
     "name": "AFFiNE Self Hosted Server"
+  },
+  "indexer": {
+    "enabled": true,
+    "provider.type": "embedded"
   }
-}
+}

.docker/selfhost/config.json.example

@@ -10,5 +10,9 @@
       "enabled": true,
       "allowCustomEndpoint": true
     }
+  },
+  "indexer": {
+    "enabled": true,
+    "provider.type": "embedded"
   }
-}
+}

.docker/selfhost/schema.json

@@ -209,6 +209,15 @@
           "description": "Whether request abuse source facts should trust Cloudflare headers from the origin edge.\n@default false",
           "default": false
         },
+        "signInRateLimit": {
+          "type": "object",
+          "description": "Limits for sign-in attempts shared through Redis by source IP and email. ttl is measured in milliseconds.\n@default {\"ttl\":60000,\"ipLimit\":20,\"emailLimit\":5}",
+          "default": {
+            "ttl": 60000,
+            "ipLimit": 20,
+            "emailLimit": 5
+          }
+        },
         "inviteQuotaShadowMode": {
           "type": "boolean",
           "description": "Whether workspace invite quota should record would-block decisions without rejecting requests or executing abuse actions.\n@default false",
@@ -971,17 +980,6 @@
         }
       }
     },
-    "docService": {
-      "type": "object",
-      "description": "Configuration for docService module",
-      "properties": {
-        "endpoint": {
-          "type": "string",
-          "description": "The endpoint of the doc service.\n@default \"\"\n@environment `DOC_SERVICE_ENDPOINT`",
-          "default": ""
-        }
-      }
-    },
     "telemetry": {
       "type": "object",
       "description": "Configuration for telemetry module",
@@ -1495,13 +1493,13 @@
         },
         "provider.type": {
           "type": "string",
-          "description": "Indexer search service provider name\n@default \"manticoresearch\"\n@environment `AFFINE_INDEXER_SEARCH_PROVIDER`",
-          "default": "manticoresearch"
+          "description": "Indexer search provider. Self-hosted uses the embedded provider by default; remote providers require an endpoint.\n@default \"embedded\"\n@environment `AFFINE_INDEXER_SEARCH_PROVIDER`",
+          "default": "embedded"
         },
         "provider.endpoint": {
           "type": "string",
-          "description": "Indexer search service endpoint\n@default \"http://localhost:9308\"\n@environment `AFFINE_INDEXER_SEARCH_ENDPOINT`",
-          "default": "http://localhost:9308"
+          "description": "Remote indexer endpoint. Not used by the embedded provider.\n@default \"\"\n@environment `AFFINE_INDEXER_SEARCH_ENDPOINT`",
+          "default": ""
         },
         "provider.apiKey": {
           "type": "string",

.github/CLA.md

@@ -1,4 +1,4 @@
-<!-- To indicate your agreement, simply edit this file and submit a pull request. -->
+<!-- Do NOT edit this file to sign. To sign the CLA, visit https://cla-assistant.io/toeverything/AFFiNE and sign in with GitHub. -->
 
 # AFFiNE Contributor License Agreement
 
@@ -35,4 +35,6 @@ You accept and agree to the following terms and conditions for your past, presen
 
 ## How To Sign
 
-Visit https://cla-assistant.io/toeverything/AFFiNE and sign it.
+Visit **<https://cla-assistant.io/toeverything/AFFiNE>**, sign in with your GitHub account, and agree.
+
+Once signed, the `license/cla` check on your pull requests passes automatically. If you signed after opening a PR, click the **recheck** link in the CLA bot's comment on the PR (or push a new commit) to refresh the check. Note that every committer on a PR must sign, and each commit's author email must be linked to a GitHub account.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,18 @@
+<!--
+Thank you for contributing to AFFiNE!
+
+The PR title must follow Conventional Commits (enforced by CI):
+  type(scope): description      e.g.  fix(editor): keep selection after paste
+Types: feat fix docs style refactor perf test build ci chore revert
+-->
+
+## Description
+
+<!-- What does this PR do? Link related issues, e.g. "Closes #1234". Screenshots or recordings are welcome for UI changes. -->
+
+## Checklist
+
+- [ ] I have signed the [AFFiNE Contributor License Agreement](https://cla-assistant.io/toeverything/AFFiNE) — required before merge; the `license/cla` check must be green ([how it works](https://github.com/toeverything/AFFiNE/blob/canary/docs/BUILDING.md#sign-the-cla-first))
+- [ ] The PR targets the `canary` branch and its title follows [Conventional Commits](https://www.conventionalcommits.org/)
+- [ ] Tests are added or updated where it makes sense
+- [ ] `yarn lint` and `yarn typecheck` pass locally

.github/actions/server-test-env/action.yml

@@ -1,6 +1,12 @@
 name: 'Prepare Server Test Environment'
 description: 'Prepare Server Test Environment'
 
+inputs:
+  indexer-provider:
+    description: 'Search provider used by the server test runtime'
+    required: false
+    default: embedded
+
 runs:
   using: 'composite'
   steps:
@@ -19,12 +25,30 @@ runs:
         NODE_ENV: test
       run: |
         yarn affine @affine/server prisma generate
+        yarn affine @affine/server data-migration admit-legacy-context-blobs
         yarn affine @affine/server prisma migrate deploy
         yarn affine @affine/server data-migration run
 
     - name: Import config
       shell: bash
-      env:
-        DEFAULT_CONFIG: '{}'
       run: |
-        printf '%s\n' "${SERVER_CONFIG:-$DEFAULT_CONFIG}" > ./packages/backend/server/config.json
+        case '${{ inputs.indexer-provider }}' in
+          embedded)
+            default_indexer='{"enabled":true,"provider":{"type":"embedded","endpoint":""}}'
+            ;;
+          elasticsearch)
+            default_indexer='{"enabled":true,"provider":{"type":"elasticsearch","endpoint":"http://localhost:9200"}}'
+            ;;
+          manticoresearch)
+            default_indexer='{"enabled":true,"provider":{"type":"manticoresearch","endpoint":"http://localhost:9308"}}'
+            ;;
+          *)
+            echo "Unsupported test indexer provider: ${{ inputs.indexer-provider }}" >&2
+            exit 1
+            ;;
+        esac
+        if [[ -n "${SERVER_CONFIG:-}" ]]; then
+          jq --argjson indexer "$default_indexer" '.indexer = $indexer' <<<"$SERVER_CONFIG" > ./packages/backend/server/config.json
+        else
+          jq -n --argjson indexer "$default_indexer" '{indexer: $indexer}' > ./packages/backend/server/config.json
+        fi

.github/helm/affine/charts/front/templates/deployment.yaml

@@ -11,8 +11,9 @@ spec:
       {{- include "front.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with .Values.podAnnotations }}
       annotations:
+        checksum/indexer-config: {{ include "affine.indexerConfig" . | sha256sum }}
+      {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:
@@ -87,15 +88,6 @@ spec:
                   key: redis-password
             - name: REDIS_SERVER_DATABASE
               value: "{{ .Values.global.redis.database }}"
-            - name: AFFINE_INDEXER_SEARCH_PROVIDER
-              value: "{{ .Values.global.indexer.provider }}"
-            - name: AFFINE_INDEXER_SEARCH_ENDPOINT
-              value: "{{ .Values.global.indexer.endpoint }}"
-            - name: AFFINE_INDEXER_SEARCH_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: indexer
-                  key: indexer-apiKey
             - name: AFFINE_SERVER_PORT
               value: "{{ .Values.app.port }}"
             - name: AFFINE_SERVER_SUB_PATH
@@ -128,6 +120,15 @@ spec:
             successThreshold: {{ default .Values.probe.successThreshold .Values.probe.readiness.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: indexer-config
+              mountPath: /app/config.json
+              subPath: config.json
+              readOnly: true
+      volumes:
+        - name: indexer-config
+          secret:
+            secretName: indexer
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

.github/helm/affine/charts/front/values.yaml

@@ -65,10 +65,6 @@ services:
     type: ClusterIP
     port: 8080
     annotations: {}
-  doc:
-    type: ClusterIP
-    annotations: {}
-
 nodeSelector: {}
 tolerations: []
 affinity: {}

.github/helm/affine/charts/graphql/templates/deployment.yaml

@@ -11,8 +11,9 @@ spec:
       {{- include "graphql.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with .Values.podAnnotations }}
       annotations:
+        checksum/indexer-config: {{ include "affine.indexerConfig" . | sha256sum }}
+      {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:
@@ -83,15 +84,6 @@ spec:
                 key: redis-password
           - name: REDIS_SERVER_DATABASE
             value: "{{ .Values.global.redis.database }}"
-          - name: AFFINE_INDEXER_SEARCH_PROVIDER
-            value: "{{ .Values.global.indexer.provider }}"
-          - name: AFFINE_INDEXER_SEARCH_ENDPOINT
-            value: "{{ .Values.global.indexer.endpoint }}"
-          - name: AFFINE_INDEXER_SEARCH_API_KEY
-            valueFrom:
-              secretKeyRef:
-                name: indexer
-                key: indexer-apiKey
           - name: AFFINE_SERVER_PORT
             value: "{{ .Values.service.port }}"
           - name: AFFINE_SERVER_SUB_PATH
@@ -100,8 +92,6 @@ spec:
             value: "{{ .Values.app.host }}"
           - name: AFFINE_SERVER_HTTPS
             value: "{{ .Values.app.https }}"
-          - name: DOC_SERVICE_ENDPOINT
-            value: "http://{{ .Values.global.docService.name }}:{{ .Values.global.docService.port }}"
           ports:
             - name: http
               containerPort: {{ .Values.service.port }}
@@ -126,6 +116,15 @@ spec:
             successThreshold: {{ default .Values.probe.successThreshold .Values.probe.readiness.successThreshold }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: indexer-config
+              mountPath: /app/config.json
+              subPath: config.json
+              readOnly: true
+      volumes:
+        - name: indexer-config
+          secret:
+            secretName: indexer
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

.github/helm/affine/charts/graphql/templates/migration.yaml

@@ -60,18 +60,18 @@ spec:
               secretKeyRef:
                 name: redis
                 key: redis-password
-          - name: AFFINE_INDEXER_SEARCH_PROVIDER
-            value: "{{ .Values.global.indexer.provider }}"
-          - name: AFFINE_INDEXER_SEARCH_ENDPOINT
-            value: "{{ .Values.global.indexer.endpoint }}"
-          - name: AFFINE_INDEXER_SEARCH_API_KEY
-            valueFrom:
-              secretKeyRef:
-                name: indexer
-                key: indexer-apiKey
+        volumeMounts:
+          - name: indexer-config
+            mountPath: /app/config.json
+            subPath: config.json
+            readOnly: true
         resources:
           requests:
             cpu: '100m'
             memory: '200Mi'
+      volumes:
+        - name: indexer-config
+          secret:
+            secretName: indexer
       restartPolicy: Never
   backoffLimit: 1

.github/helm/affine/templates/_helpers.tpl

@@ -60,3 +60,10 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Render the indexer runtime configuration shared by the Secret and Pod checksums.
+*/}}
+{{- define "affine.indexerConfig" -}}
+{{- dict "indexer" (dict "enabled" .Values.global.indexer.enabled "provider" (dict "type" .Values.global.indexer.provider "endpoint" .Values.global.indexer.endpoint "apiKey" .Values.global.indexer.apiKey "username" .Values.global.indexer.username "password" .Values.global.indexer.password)) | toJson -}}
+{{- end }}