# Debian packaging

This directory builds the `rustproxy` binary package for RustProxy 0.26.1.
The package installs:

- `/usr/bin/rust-proxy`
- `/etc/rustproxy/environment` (conffile)
- `rustproxy.service`
- logrotate policy for `/var/log/rustproxy`
- Grafana dashboard under `/usr/share/rustproxy/grafana/`

The service runs as the unprivileged `rustproxy` system user. `CAP_NET_BIND_SERVICE`
is the only ambient/bounding capability, allowing ports 80/443 without root. The
administration listener is loopback-only by default. systemd and `postinst` both
ensure `/var/lib/rustproxy` and `/var/log/rustproxy` exist with mode `0750`.

## Build the `.deb`

Install build prerequisites (including Rust 1.88+), then from the source tree:

```bash
./debian/build-package.sh
```

The script uses the committed `Cargo.lock`, runs `cargo fetch --locked`, invokes
`dpkg-buildpackage -us -uc -b`, and copies generated package artifacts to `dist/`.
If dependencies are pre-fetched/vendored, set `CARGO_NET_OFFLINE=true` for an
offline Cargo build.

## Repository for rustproxy.linuxiarz.pl

Install repository tooling:

```bash
apt install dpkg-dev apt-utils gzip gnupg
```

Build the repository:

```bash
RUSTPROXY_REPO_GPG_KEY='<fingerprint-or-key-id>' ./debian/build-repository.sh
```

Publish the generated `repository/` directory at the web root of
`https://rustproxy.linuxiarz.pl/`. Export the public repository key separately and
install it on clients as `/usr/share/keyrings/rustproxy.gpg`, then use:

```text
deb [signed-by=/usr/share/keyrings/rustproxy.gpg] https://rustproxy.linuxiarz.pl stable main
```

The repository script emits `Packages`, maximum-gzip `Packages.gz`, `Release`, and,
when a GPG key is configured, `Release.gpg` plus `InRelease`.

## Logs

Structured file logging defaults to `/var/log/rustproxy/access.jsonl` when enabled
in RustProxy. Logrotate runs daily, keeps at most three days, compresses immediately
with `gzip -9`, and uses `copytruncate` because RustProxy owns the open log file.
Systemd journal output remains independent of this JSONL rotation.