# Zyphon — Unified Messaging Gateway

Self-hosted Email / SMS / WhatsApp gateway with **no database**. State = YAML config + encrypted vault + daily log files.

```
Your apps ──► :8080 Public API ──► Zyphon router ──► Providers
Operators ──► :3002 Dashboard  ──► :8081 Admin API (server-side only)
```

---

## Docs

| Document | What it covers |
|----------|----------------|
| **[`docs/DEPLOY.md`](docs/DEPLOY.md)** | **Where is what, tech stack, ports, config, VM Docker deploy, start/stop** |
| [`docs/RULES.md`](docs/RULES.md) | Non-negotiable architecture & security rules |
| [`docs/openapi.json`](docs/openapi.json) | Public + admin API schema |
| [`AGENTS.md`](AGENTS.md) | Guidance for AI agents / contributors |

---

## Quick start (Docker — recommended)

**Prerequisites:** Docker Engine + Compose plugin.

```bash
git clone <repo> zyphon && cd zyphon

# Production: generate a real 32-byte master key (64 hex chars)
mkdir -p secrets data/logs data/state
openssl rand -hex 32 > secrets/master_key
chmod 600 secrets/master_key
# Point docker-compose.yml → secrets.zyphon_master_key.file: ./secrets/master_key
# Set a strong ZYPHON_ADMIN_PASSWORD in docker-compose.yml

docker compose up -d --build
```

| URL | Port |
|-----|------|
| Dashboard | [http://localhost:3002](http://localhost:3002) |
| Public API | `http://localhost:8080` |
| Admin API | `http://localhost:8081` (private; used by dashboard) |

Sign in with `ZYPHON_ADMIN_PASSWORD` (Compose default for local only: `zyphon-admin-secure` — change it on any real VM).

**Start / stop:** see [docs/DEPLOY.md §6](docs/DEPLOY.md#6-start--stop--inspect-docker-is-enough).

```bash
docker compose up -d --build   # start
docker compose logs -f         # follow logs
docker compose stop            # stop
docker compose down            # stop & remove containers
```

---

## Local Node (optional)

```bash
corepack enable && pnpm install
export ZYPHON_MASTER_KEY="$(openssl rand -hex 32)"
export ZYPHON_ADMIN_PASSWORD='choose-a-strong-password'
pnpm --filter @zyphon/gateway build && node apps/gateway/dist/index.js
pnpm --filter @zyphon/dashboard exec next dev -p 3002
```

---

## Architecture in one line

Zero-database routing gateway: apps call one API; Zyphon applies channel ACL, quotas, DLT (India SMS), failover, and provider adapters — credentials stay in an AES-256-GCM vault, never in YAML or API responses.