v0.24.5

debian/README.md

@@ -0,0 +1,60 @@
+# Debian packaging
+
+This directory builds the `rustproxy` binary package for RustProxy 0.24.5.
+The package installs:
+
+- `/usr/bin/rust-proxy`
+- `/etc/rustproxy/environment` (conffile)
+- `rustproxy.service`
+- logrotate policy for `/var/log/rustproxy`
+- Grafana dashboard under `/usr/share/rustproxy/grafana/`
+
+The service runs as the unprivileged `rustproxy` system user. `CAP_NET_BIND_SERVICE`
+is the only ambient/bounding capability, allowing ports 80/443 without root. The
+administration listener is loopback-only by default. systemd and `postinst` both
+ensure `/var/lib/rustproxy` and `/var/log/rustproxy` exist with mode `0750`.
+
+## Build the `.deb`
+
+Install build prerequisites (including Rust 1.88+), then from the source tree:
+
+```bash
+./debian/build-package.sh
+```
+
+The script uses the committed `Cargo.lock`, runs `cargo fetch --locked`, invokes
+`dpkg-buildpackage -us -uc -b`, and copies generated package artifacts to `dist/`.
+If dependencies are pre-fetched/vendored, set `CARGO_NET_OFFLINE=true` for an
+offline Cargo build.
+
+## Repository for rustproxy.linuxiarz.pl
+
+Install repository tooling:
+
+```bash
+apt install dpkg-dev apt-utils gzip gnupg
+```
+
+Build the repository:
+
+```bash
+RUSTPROXY_REPO_GPG_KEY='<fingerprint-or-key-id>' ./debian/build-repository.sh
+```
+
+Publish the generated `repository/` directory at the web root of
+`https://rustproxy.linuxiarz.pl/`. Export the public repository key separately and
+install it on clients as `/usr/share/keyrings/rustproxy.gpg`, then use:
+
+```text
+deb [signed-by=/usr/share/keyrings/rustproxy.gpg] https://rustproxy.linuxiarz.pl stable main
+```
+
+The repository script emits `Packages`, maximum-gzip `Packages.gz`, `Release`, and,
+when a GPG key is configured, `Release.gpg` plus `InRelease`.
+
+## Logs
+
+Structured file logging defaults to `/var/log/rustproxy/access.jsonl` when enabled
+in RustProxy. Logrotate runs daily, keeps at most three days, compresses immediately
+with `gzip -9`, and uses `copytruncate` because RustProxy owns the open log file.
+Systemd journal output remains independent of this JSONL rotation.