feat(infra): deploy Zulip as community chat platform

Summary

Self-host Zulip at chat.us-rse.org as the primary community communication platform, replacing Slack. Zulip's topic-based threading is designed for async-first technical communities and provides free SSO/OIDC integration with our WorkOS auth system.

Infrastructure

Architecture: Zulip app server + managed Postgres + Cloudflare reverse proxy

Component	Spec	Provider	Cost
Zulip app server	4 CPU / 8 GB RAM / 100 GB SSD	Hetzner, DigitalOcean, or Vultr	~$15-48/mo
Postgres database	Managed, 4 GB RAM minimum	Neon (paid) or Supabase	~$25/mo
Cloudflare proxy	DNS, CDN, SSL, DDoS protection	Cloudflare (free plan)	$0
SMTP	Outgoing email for notifications	Resend, Postmark, or SES	~$0-5/mo

Estimated total: ~$50-75/month

Expected scale: 4,000 members, ~200-600 DAU. Zulip recommends 8 GB RAM for the app server at this scale when the database is externally managed.

Disk estimate: ~10 GB per 1M messages + 1 GB per 1,000 users = ~14 GB baseline, growing over time. 100 GB SSD provides years of headroom.

Requirements

Deployment

• Provision VPS (4 CPU / 8 GB RAM / 100 GB SSD)
• Configure chat.us-rse.org subdomain via Cloudflare DNS
• Deploy Zulip (Docker or installer-based)
• Connect to managed Postgres instance
• Configure S3-compatible storage for file uploads
• Set up SMTP for outgoing notifications
• SSL via Cloudflare (origin cert or Let's Encrypt)
• Automated daily backups (database + uploads)
• Monitoring and alerting (uptime, disk, memory)

Authentication

• Integrate Zulip with WorkOS via OIDC — single sign-on across us-rse.org and chat.us-rse.org
• Map WorkOS roles to Zulip roles (member → user, admin → organization admin)
• Disable standalone Zulip registration (all auth through WorkOS)

Slack Migration

• Audit current Slack workspace: channels, member count per channel, active integrations, workflows, canvases
• Export Slack message history (for archival, not necessarily import)
• Create Zulip streams matching existing Slack channels
• Set up Slack-to-Zulip bridge for transition period (both systems active, 1-3 months)
• Migration communication plan (announce timeline to membership)
• Document the switchover process

Channel/Stream Structure

• Working group streams (Code Review, DEI, Education, etc.)
• Affinity group streams
• General/announcements stream
• Board-only private streams
• Social/off-topic stream

Moderation

• Configure moderation policies aligned with Code of Conduct
• Set up moderator roles for WG chairs and board members
• Abuse reporting mechanism
• Message retention policies

Integration with Main Site

• "Community Chat" link in the US-RSE site navigation
• Embed Zulip widget or link on Community pages
• Member profile link to Zulip username

Context

Slack's free tier may become paid ($7.25/user/month = $29,000/month for 4,000 members). Many members at government labs and universities cannot install Slack on institutional devices. Zulip runs as a web app on our domain, removing this barrier.

Zulip is used by the Rust project, LLVM, Lean Prover, and many academic communities — proven at our scale.

Part of the platform ecosystem:

• us-rse.org — Main site (React)
• chat.us-rse.org — Zulip (this issue)
• workflows.us-rse.org — n8n (#10)
• collab.us-rse.org — Collaboration tool (#11, future)

Implementation Notes

• Zulip provides native SSO via OIDC (free in self-hosted edition)
• Zulip's topic model replaces the need for threads — every message belongs to a topic within a stream
• 130+ native integrations + Zapier bridge for additional services
• Consider running the Slack bridge during a 1-3 month transition period
• Zulip has a Slack import tool for message history if desired
• Zulip docs recommend a dedicated machine, but with an external managed DB, 8 GB app server is sufficient

The issue names no repository files, tests, or implementation entry points. Start by reviewing the deployment, authentication, migration, moderation, and site-integration requirements, then define the infrastructure and operational plan; done means the Zulip service, WorkOS SSO, migration process, backups, monitoring, and site links are in place.