61 lines
2.0 KiB
Markdown
61 lines
2.0 KiB
Markdown
# Debian packaging
|
|
|
|
This directory builds the `rustproxy` binary package for RustProxy 0.26.7.
|
|
The package installs:
|
|
|
|
- `/usr/bin/rust-proxy`
|
|
- `/etc/rustproxy/environment` (conffile)
|
|
- `rustproxy.service`
|
|
- logrotate policy for `/var/log/rustproxy`
|
|
- Grafana dashboard under `/usr/share/rustproxy/grafana/`
|
|
|
|
The service runs as the unprivileged `rustproxy` system user. `CAP_NET_BIND_SERVICE`
|
|
is the only ambient/bounding capability, allowing ports 80/443 without root. The
|
|
administration listener is loopback-only by default. systemd and `postinst` both
|
|
ensure `/var/lib/rustproxy` and `/var/log/rustproxy` exist with mode `0750`.
|
|
|
|
## Build the `.deb`
|
|
|
|
Install build prerequisites (including Rust 1.88+), then from the source tree:
|
|
|
|
```bash
|
|
./debian/build-package.sh
|
|
```
|
|
|
|
The script uses the committed `Cargo.lock`, runs `cargo fetch --locked`, invokes
|
|
`dpkg-buildpackage -us -uc -b`, and copies generated package artifacts to `dist/`.
|
|
If dependencies are pre-fetched/vendored, set `CARGO_NET_OFFLINE=true` for an
|
|
offline Cargo build.
|
|
|
|
## Repository for rustproxy.linuxiarz.pl
|
|
|
|
Install repository tooling:
|
|
|
|
```bash
|
|
apt install dpkg-dev apt-utils gzip gnupg
|
|
```
|
|
|
|
Build the repository:
|
|
|
|
```bash
|
|
RUSTPROXY_REPO_GPG_KEY='<fingerprint-or-key-id>' ./debian/build-repository.sh
|
|
```
|
|
|
|
Publish the generated `repository/` directory at the web root of
|
|
`https://rustproxy.linuxiarz.pl/`. Export the public repository key separately and
|
|
install it on clients as `/usr/share/keyrings/rustproxy.gpg`, then use:
|
|
|
|
```text
|
|
deb [signed-by=/usr/share/keyrings/rustproxy.gpg] https://rustproxy.linuxiarz.pl stable main
|
|
```
|
|
|
|
The repository script emits `Packages`, maximum-gzip `Packages.gz`, `Release`, and,
|
|
when a GPG key is configured, `Release.gpg` plus `InRelease`.
|
|
|
|
## Logs
|
|
|
|
Structured file logging defaults to `/var/log/rustproxy/access.jsonl` when enabled
|
|
in RustProxy. Logrotate runs daily, keeps at most three days, compresses immediately
|
|
with `gzip -9`, and uses `copytruncate` because RustProxy owns the open log file.
|
|
Systemd journal output remains independent of this JSONL rotation.
|