dockerize + document SSL setup

document server-side SSL setup

Update AIM6.md

docker compose all the things

Update docker-compose.yaml

Update docker-compose.yaml

Update Makefile

update docs

add a blerb about domain resolving

add docker internal host to stunnel runner

Dockerfile

@@ -1,21 +1,20 @@
-# Specifies a parent image
-FROM golang:alpine
+FROM golang:alpine AS builder
 
-# Creates an app directory to hold your app’s source code
 WORKDIR /app
 
-# Copies everything from your root directory into /app
-COPY . .
-COPY config/settings.env config/settings.env
-
-# Installs Go dependencies
+COPY go.mod go.sum ./
 RUN go mod download
 
-# Builds your app with optional configuration
+COPY . .
+
 RUN go build -o retro_aim_server ./cmd/server
 
-# Tells Docker which network port your container listens on
+FROM alpine:latest
+
+WORKDIR /app
+
+COPY --from=builder /app/retro_aim_server /app/
+
 EXPOSE 8080 5190 5191 5192 5193 5194 5195 5196 5197
 
-# Specifies the executable command that runs when the container starts
-CMD ["/app/retro_aim_server", "-config", "config/settings.env"]
+CMD ["/app/retro_aim_server"]

Makefile

@@ -10,6 +10,7 @@ DOCKER_RUN_GO_RELEASER := @docker run \
 	--volume `pwd`:/go/src/retro-aim-server \
 	--workdir /go/src/retro-aim-server \
 	$(DOCKER_IMAGE_TAG_GO_RELEASER)
+OSCAR_HOST ?= ras.dev
 
 .PHONY: config
 config: ## Generate config file template from Config struct
@@ -23,45 +24,37 @@ release: ## Run a clean, full GoReleaser run (publish + validate)
 release-dry-run: ## GoReleaser dry-run (skips validate & publish)
 	$(DOCKER_RUN_GO_RELEASER) --clean --skip=validate --skip=publish
 
-################################################################################
-# SSL Helpers
-################################################################################
+.PHONY: docker-image-ras
+docker-image-ras: ## Build Retro AIM Server image
+	docker build -t ras:latest -f Dockerfile .
 
-CERT_DIR       ?= certs
-CERT_GEN_IMAGE ?= cert-nss
-CERT_NAME      ?= ras.dev
-CERT_NSSDB_DIR := $(CERT_DIR)/nssdb
-CERT_PEM       := $(CERT_DIR)/$(CERT_NAME).pem
+.PHONY: docker-image-stunnel
+docker-image-stunnel: ## Build stunnel image pinned to v5.75 / OpenSSL 1.0.2u
+	docker build -t ras-stunnel:5.75-openssl-1.0.2u -f Dockerfile.stunnel .
 
-.PHONY: stunnel-image
-stunnel-image: ## Build stunnel image pinned to v5.75 / OpenSSL 1.0.2u
-	docker build -t stunnel:5.75-openssl-1.0.2u -f Dockerfile.stunnel .
+.PHONY: docker-image-certgen
+docker-image-certgen: ## Build minimal helper image with openssl & nss tools
+	docker build -t ras-certgen:latest -f Dockerfile.certgen .
 
-.PHONY: cert-gen-image
-cert-gen-image: ## Build minimal helper image with openssl & nss tools
-	docker build -t $(CERT_GEN_IMAGE) -f Dockerfile.certgen .
+.PHONY: docker-images
+docker-images: docker-image-ras docker-image-stunnel docker-image-certgen
 
-.PHONY: certs
-certs: clean-certs cert-gen-image ## Create SSL certificates for AIM 6.0+ clients
-	mkdir -p $(CERT_DIR)
+.PHONY: docker-run
+docker-run:
+	OSCAR_HOST=$(OSCAR_HOST) docker compose up retro-aim-server stunnel
 
- 	# create SSL certificate
-	docker run --rm -v "$$PWD":/work -w /work/$(CERT_DIR) $(CERT_GEN_IMAGE) \
-		openssl req -x509 -newkey rsa:1024 \
-			-keyout "key.pem" \
-			-out "cert.pem" \
-			-sha256 -days 365 -nodes \
-			-subj "/CN=$(CERT_NAME)"
-	cat $(CERT_DIR)/cert.pem $(CERT_DIR)/key.pem > $(CERT_PEM)
-	rm $(CERT_DIR)/cert.pem $(CERT_DIR)/key.pem
+################################################################################
+# SSL Helpers
+################################################################################
 
- 	# build NSS DB
-	mkdir -p $(CERT_NSSDB_DIR)
-	docker run -it --rm -v "$$PWD":/work -w /work $(CERT_GEN_IMAGE) \
-		sh -c "certutil -N -d $(CERT_NSSDB_DIR) --empty-password && \
-		       certutil -A -n 'RAS' -t 'CT,,C' -i $(CERT_PEM) -d $(CERT_NSSDB_DIR)"
+.PHONY: docker-cert
+docker-cert: clean-certs ## Create SSL certificates for server
+	OSCAR_HOST=$(OSCAR_HOST) docker compose run --rm cert-gen
 
-	@echo "Successfully created certificates in '$(CERT_DIR)/'"
+.PHONY: docker-nss
+docker-nss: ## Create NSS certificate database for AIM 6.x clients
+	OSCAR_HOST=$(OSCAR_HOST) docker compose run --rm nss-gen
 
+.PHONY: clean-certs
 clean-certs: ## Remove all generated certificates & NSS DB
-	rm -rf $(CERT_DIR)
+	rm -rf certs/*

README.md

@@ -21,7 +21,7 @@ The following features are supported:
 
 **AIM**
 
-- [x] Windows AIM Clients: v1.x, v2.x, v3.x, v4.x, [v5.x](./docs/CLIENT.md), [v6.0-v6.1](./docs/AIM6.md)
+- [x] Windows AIM Clients: v1.x, v2.x, v3.x, v4.x, [v5.x](./docs/CLIENT.md), [v6.0-v6.5.3.12](./docs/AIM6.md)
 - [x] Away Messages
 - [x] Buddy Icons (v4.x, v5.x)
 - [x] Buddy List

config/ssl/stunnel.conf

@@ -7,5 +7,5 @@ options = NO_SSLv3
 options = NO_TLSv1_1
 ciphers = ALL
 accept = 443
-connect = host.docker.internal:1088
+connect = retro-aim-server:1088
 cert = /etc/stunnel/certs/server.pem

docker-compose.example.yaml

@@ -1,19 +0,0 @@
-version: '3.8'
-
-services:
-  retro-aim-server:
-    build: .
-    ports:
-      - "5190:5190"
-      - "5191:5191"
-      - "5192:5192"
-      - "5193:5193"
-      - "5194:5194"
-      - "5195:5195"
-      - "5196:5196"
-      - "5197:5197"
-      - "8080:8080"
-    volumes:
-      - ./config/settings.env:/app/config/settings.env
-    environment:
-      - OSCAR_HOST=0.0.0.0

docker-compose.yaml

@@ -0,0 +1,60 @@
+services:
+  cert-gen:
+    image: ras-certgen:latest
+    volumes:
+      - ./certs:/work/certs
+    working_dir: /work/certs
+    entrypoint: [ "/bin/sh", "-c" ]
+    environment:
+      - OSCAR_HOST=${OSCAR_HOST}
+    command: >
+      '
+      openssl req -x509 -newkey rsa:1024 \
+        -keyout key.pem \
+        -out cert.pem \
+        -sha256 -days 365 -nodes \
+        -subj "/CN=${OSCAR_HOST}" &&
+      cat cert.pem key.pem > server.pem &&
+      rm cert.pem key.pem
+      '
+
+  nss-gen:
+    image: ras-certgen:latest
+    volumes:
+      - ./certs:/work/certs
+    working_dir: /work/certs
+    entrypoint: [ "/bin/sh", "-c" ]
+    environment:
+      - OSCAR_HOST=${OSCAR_HOST}
+    command: >
+      '
+      mkdir -p nss &&
+      certutil -N -d nss --empty-password &&
+      certutil -A -n "RAS" -t "CT,,C" -i server.pem -d nss
+      '
+
+  retro-aim-server:
+    image: ras:latest
+    ports:
+      - "5190:5190"
+      - "5191:5191"
+      - "5192:5192"
+      - "5193:5193"
+      - "5194:5194"
+      - "5195:5195"
+      - "5196:5196"
+      - "5197:5197"
+      - "8080:8080"
+    env_file:
+      - ./config/settings.env
+    environment:
+      - OSCAR_HOST=${OSCAR_HOST}
+
+  stunnel:
+    image: ras-stunnel:5.75-openssl-1.0.2u
+    ports:
+      - "443:443"
+    volumes:
+      - ./config/ssl/stunnel.conf:/etc/stunnel/stunnel.conf:ro
+      - ./certs:/etc/stunnel/certs:ro
+    command: stunnel.conf

docs/ADDITIONAL_SETUP.md

@@ -2,6 +2,9 @@
 
 This guide covers some optional configuration steps to get the best experience from Retro AIM Server.
 
+- [Configure User Directory Keywords](#configure-user-directory-keywords)
+- [Configure SSL for Connecting AIM 6.2+](#configure-ssl-for-connecting-aim-62)
+
 ## Configure User Directory Keywords
 
 AIM users can make themselves searchable by interest in the user directory by configuring up to 5 interest keywords.

docs/AIM6.md

@@ -1,20 +1,27 @@
 # Windows AIM 6.x Client Setup
 
-This guide explains how to install and configure **AIM (versions 6.0–6.1)** for use with **Retro AIM Server**.
+This guide explains how to install and configure **AIM 6.x** for use with **Retro AIM Server**.
 
 <p align="center">
    <img alt="screenshot of AIM sign-on screen" src="https://github.com/user-attachments/assets/057c72fe-3d60-4dad-a602-8ff95c4fcbe1">
 </p>
 
-## Installation
+Installation guides are available for the following versions:
+
+- [AIM 6.0-6.1](#aim-60-61-setup) (BUCP auth)
+- [AIM 6.2-6.5](#aim-6265312-setup) (Kerberos auth)
+
+## AIM 6.0-6.1 Setup
+
+### Installation
 
 1. Download AIM 6.x (recommended **AIM 6.1.46.1**) from
    the [NINA wiki](https://wiki.nina.chat/wiki/Clients/AOL_Instant_Messenger#Windows).
 2. Run the installer and complete the installation.
 3. Close the AIM application.
-4. Open **Task Manager** and end the **AIM (32 bit)** process if it’s still running.
+4. Open **Task Manager** and end the **AIM (32 bit)** process if it's still running.
 
-## Configure Authentication Mode
+### Configure Authentication Mode
 
 AIM 6.x does not expose server settings via the UI. You'll need to edit configuration files manually.
 
@@ -40,7 +47,7 @@ To switch from the default Kerberos-based auth (AAM/AAMUAS) to BUCP:
 
 7. Save the file.
 
-## Configure Server Hostname
+### Configure Server Hostname
 
 To point the client to your Retro AIM Server:
 
@@ -61,6 +68,37 @@ To point the client to your Retro AIM Server:
 
 6. Save the file.
 
+## AIM 6.2–6.5.3.12 Setup
+
+### Installation
+
+1. Download an AIM 6.2–6.5 client (recommended **AIM 6.5.3.12**) from the  
+   [NINA wiki](https://wiki.nina.chat/wiki/Clients/AOL_Instant_Messenger#Windows).
+2. Run the installer and complete the installation.
+3. Close the AIM application.
+4. Open **Task Manager** and end the **AIM (32 bit)** process if it's still running.
+
+### Install SSL Certificate Database
+
+Install your server's SSL certificate database generated from the [server setup guide](DOCKER.md) or provided by the
+server operator.
+
+Copy the following files to `%APPDATA%\acccore\nss`. Note that the `nss` directory must be created if it does not exist.
+
+- `cert8.db`
+- `key3.db`
+- `secmod.db`
+
+### Configure Server Hostname
+
+Tell AIM where to connect:
+
+1. Start AIM.
+2. Open **Settings**, then go to the **Connection** tab.
+3. In the **Host** field, enter the domain name that matches the certificate's Common Name (CN).
+4. In the **Port** field, enter `443`.
+5. Click **Save**, then sign in!
+
 ## Enable Legacy JavaScript Engine (Windows 11 24H2+ Only)
 
 AIM 6.x's frontend breaks under the new JavaScript engine introduced in Windows 11 24H2. A workaround described by
@@ -79,4 +117,4 @@ Windows Registry Editor Version 5.00
 
 [HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main]
 "JScriptReplacement"=dword:00000000
-```
+```

docs/DOCKER.md

@@ -1,37 +1,89 @@
-# Retro AIM Server Docker Compose Setup
+# Retro AIM Server Docker Setup
+
+This guide explains how to set up an SSL-enabled instance of Retro AIM Server using Docker.
 
 ## Prerequisites
 
-- Docker
-- Docker Compose
-- Project source code
+- Git
+- [Docker Desktop](https://docs.docker.com/get-started/get-docker/)
+- Unix-like terminal with Makefile installed (use WSL2 for Windows)
+
+## Getting Started
+
+### 1. Clone the Repository
+
+```bash
+git clone https://github.com/mk6i/retro-aim-server.git
+cd retro-aim-server
+```
 
-## Configuration
+### 2. Build Docker Images
 
-1. Ensure your `config/settings.env` file is properly configured.
-2. Modify environment variables in `docker-compose.yml` as needed.
+This builds Docker images for:
 
-## Running the Server
+- Certificate generation
+- SSL termination
+- The Retro AIM Server runtime
 
-### Start the Server
 ```bash
-docker-compose up --build
+make docker-images
 ```
 
-### Stop the Server
+### 3. Configure SSL Certificate
+
+#### Option A: Generate a Self-Signed Certificate
+
+If you don't have an SSL certificate, you can generate a self-signed certificate. The following creates a certificate
+under `certs/server.pem`.
+
 ```bash
-docker-compose down
+make docker-cert OSCAR_HOST=ras.dev
 ```
 
-## Authentication Notes
+Replace `ras.dev` with the hostname clients will use to connect.
+
+#### Option B: Use an Existing Certificate
+
+If you already have an SSL certificate, place the PEM-encoded file at:
+
+```
+certs/server.pem
+```
 
-- `DISABLE_AUTH=true` (default) allows any username/password at login
-- This is a development convenience for quickly creating accounts
-- To enforce authentication, set `DISABLE_AUTH=false` in `settings.env`
-- When disabled, use the Management API to create and manage user accounts
+### 4. Generate NSS Certificate Database
 
-## Customization
+This creates the [NSS certificate database](https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS) in
+`certs/nss/`, which must be installed on each AIM 6.2+ client.
 
-- Adjust port mappings in `docker-compose.yml`
-- Add volume mounts for persistent configurations
-- Modify environment variables as required
+```bash
+make docker-nss
+```
+
+### 5. Start the Server
+
+```bash
+make docker-run OSCAR_HOST=ras.dev
+```
+
+Replace `ras.dev` with the hostname clients will use to connect.
+
+### 6. Client Configuration
+
+#### Certificate Database
+
+Follow the [AIM 6.x client setup instructions](AIM6.md#aim-6265312-setup) to install the `certs/nss/` database on each
+client.
+
+#### Resolving Hostname
+
+If `OSCAR_HOST` (e.g., `ras.dev`) is not a real domain with DNS configured, you'll need to add it to each client's hosts
+file so clients can resolve it.
+
+- Linux/macOS: `/etc/hosts`
+- Windows: `C:\Windows\System32\drivers\etc\hosts`
+
+Add a line like this, replacing the IP with your server's IP address:
+
+```
+127.0.0.1 ras.dev
+```