movim-rs/README.md

Movim (Rust edition)

A rewrite of the Movim XMPP web client backend in Rust, keeping Movim's frontend (CSS/JS/theme, in frontend/). The PHP daemon, widgets and templates were replaced by a single Rust server (tokio, axum, tokio-xmpp, sqlx/SQLite, minijinja). Scope: a Conversations-like chat client.

Features

1:1 chat, group chats (MUC, bookmarks, invitations, moderation, configuration), MAM history, carbons, receipts and chat markers, typing states, corrections, retractions, reactions, replies, link previews (OpenGraph cards, picture links shown inline), HTTP file upload, avatars and vCards, OMEMO (in-browser libsignal), 1:1 audio/video calls (Jingle + JMI), group audio/video calls in group chats (Muji, XEP-0272: a mesh of Jingle sessions), blocking, contact requests, search, account registration (XEP-0077), settings, Web Push, last seen (XEP-0319 idle), Client State Indication when no tab is open, and automatic XMPP reconnection (backoff up to 60s, rooms rejoined).

Run

cargo build --release
MOVIM_BIND=0.0.0.0:8080 MOVIM_DOMAIN=example.org ./target/release/movim

Put it behind a TLS reverse proxy (WebSocket on /ws/, same host).

Link previews are fetched by the server (only public addresses, every redirect checked) and cached for 30 days. Group calls are a mesh: every participant sends its streams to every other one, fine for a handful of people. They need a non-anonymous room (the default for group chats created by Movim).

Environment: MOVIM_BIND, MOVIM_ROOT, MOVIM_DATA_DIR, MOVIM_DATABASE_URL, MOVIM_DOMAIN, MOVIM_XMPP_WHITELIST, MOVIM_MAX_SESSIONS, MOVIM_DISABLE_REGISTRATION, MOVIM_LOCALE, MOVIM_SESSION_TIMEOUT_HOURS, dev only: MOVIM_XMPP_PLAINTEXT=host:port, MOVIM_ALLOW_PRIVATE_URLS=1, MOVIM_DEBUG_XMPP=1.

Tests

cargo test runs the unit tests. tests/e2e/ holds end-to-end scripts that drive the server (and the real frontend in headless Chromium) against a local Prosody; see tests/e2e/README.md.

Frontend patches (vs upstream Movim)

• widgets/Notif/notif.js: guard missing service worker registration.
• widgets/ChatOmemo/chatomemo_storage.js: blind trust before verification (upstream trust check crashes: libsignal.util is undefined).
• scripts/movim_jingles.js: the signaling of each call session runs through a promise queue (a content-add could arrive before the remote description was applied, early ICE candidates were dropped).

Not implemented

Movim social features (blogs, communities, stories), SFU conference calls (Movim's own extension; Muji group calls work), sticker packs/GIFs, ad-hoc commands, XEP-0198 stream resumption. Web Push has only been tested without a real HTTPS push service; Dictaphone/Snap/Draw go through the upload path but are untested.

License: AGPL-3.0 (same as Movim).