jcoffey-dev
e11fdae372
Dockerfile.relay builds inbuxa-relay alone, as a static musl binary, into a FROM-scratch image of about 12 MB: the binary, the CA roots and a state directory, run as uid 2001 with cap_net_bind_service only, and INBUXA_RELAY_CONTAINER set so the relay doesn't upgrade itself. A release tag builds it on whichever forge builds, under the server's tags, after checking that the image prints this version and holds no server binary (RL-T24). The release gets the two binaries, taken out of the image, in SHA256SUMS with the server's. Gitea's relay-sign job then signs them with the RELAY_RELEASE_KEY secret and attaches the .sig files; without the secret it warns and signs nothing. tools/release/new-relay-keys.sh makes the CI key and an offline backup key and prints only their public halves. resources/systemd has the unit for a host install: binary in /opt/inbuxa-relay/bin, owned by the relay's user so upgrades can replace it, Restart=always, sandboxed.