new_version

scripts/build-freebsd-release.sh

@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+source /opt/rust-package-builder/scripts/lib.sh
+
+: "${SHA:?SHA required}"
+: "${SRC:?SRC required}"
+: "${OUT:?OUT required}"
+: "${VERSION:?VERSION required}"
+: "${SOURCE_REVISION:?SOURCE_REVISION required}"
+
+REPOSITORY="$DATA_DIR/repository"
+BRANCH_RELEASE_ID="$(date -u '+%Y%m%dT%H%M%SZ')-${SHORT_SHA}-freebsd"
+RELEASE_DIR="$REPOSITORY/releases/$BRANCH_RELEASE_ID"
+PUBLISHED=0
+cleanup_freebsd_release() {
+    if [[ "$PUBLISHED" != "1" && -d "$RELEASE_DIR" ]]; then
+        rm -rf "$RELEASE_DIR"
+    fi
+}
+trap cleanup_freebsd_release EXIT
+
+FREEBSD_BINARY="$OUT/rust-proxy-freebsd"
+if [[ ! -x "$FREEBSD_BINARY" ]]; then
+    # Reuse the same FreeBSD cross-build as OPNsense if it succeeded first.
+    /opt/rust-package-builder/scripts/build-opnsense.sh "$SRC" "$FREEBSD_BINARY" "$BINARY_NAME" "$WORK"
+fi
+
+FREEBSD_PACKAGE_REVISION=$SOURCE_REVISION
+LAST_FREEBSD_PACKAGE_VERSION=""
+if [[ -r "$DATA_DIR/state/last_freebsd_package_version" ]]; then
+    LAST_FREEBSD_PACKAGE_VERSION=$(cat "$DATA_DIR/state/last_freebsd_package_version")
+elif [[ -r "$REPOSITORY/current/freebsd/BUILD-INFO.txt" ]]; then
+    LAST_FREEBSD_PACKAGE_VERSION=$(sed -n 's/^package_version=//p' "$REPOSITORY/current/freebsd/BUILD-INFO.txt" | head -n1)
+fi
+if [[ "$LAST_FREEBSD_PACKAGE_VERSION" == "${VERSION}_"* ]]; then
+    LAST_FREEBSD_REVISION=${LAST_FREEBSD_PACKAGE_VERSION#"${VERSION}_"}
+    if [[ "$LAST_FREEBSD_REVISION" =~ ^[0-9]+$ ]] && (( LAST_FREEBSD_REVISION >= FREEBSD_PACKAGE_REVISION )); then
+        FREEBSD_PACKAGE_REVISION=$((LAST_FREEBSD_REVISION + 1))
+    fi
+fi
+if (( FREEBSD_PACKAGE_REVISION == 0 )); then
+    FREEBSD_PACKAGE_REVISION=1
+fi
+FREEBSD_PACKAGE_VERSION="${VERSION}_${FREEBSD_PACKAGE_REVISION}"
+FREEBSD_PACKAGE_FILE="$OUT/rustproxy-${FREEBSD_PACKAGE_VERSION}.pkg"
+/opt/rust-package-builder/scripts/package-freebsd.sh \
+    "$SRC" "$FREEBSD_BINARY" "$FREEBSD_PACKAGE_FILE" "$FREEBSD_PACKAGE_VERSION"
+
+mkdir -p "$RELEASE_DIR/apt" "$RELEASE_DIR/rpm/x86_64" "$RELEASE_DIR/opnsense" "$RELEASE_DIR/freebsd"
+CURRENT_TARGET=""
+if [[ -L "$REPOSITORY/current" ]]; then
+    CURRENT_LINK=$(readlink "$REPOSITORY/current")
+    CURRENT_TARGET="$REPOSITORY/$CURRENT_LINK"
+fi
+
+log 'staging native FreeBSD repository snapshot'
+if [[ -n "$CURRENT_TARGET" ]]; then
+    for component in apt rpm opnsense freebsd; do
+        if [[ -d "$CURRENT_TARGET/$component" ]]; then
+            rsync -a --delete --link-dest="$CURRENT_TARGET/$component"/ "$CURRENT_TARGET/$component"/ "$RELEASE_DIR/$component"/
+        fi
+    done
+    for copied in repo-key.gpg index.html LINUX-BUILD-INFO.txt; do
+        if [[ -f "$CURRENT_TARGET/$copied" ]]; then
+            cp -a "$CURRENT_TARGET/$copied" "$RELEASE_DIR/$copied"
+        fi
+    done
+fi
+
+FREEBSD_PACKAGE_DIR="$RELEASE_DIR/freebsd/$FREEBSD_ABI"
+mkdir -p "$FREEBSD_PACKAGE_DIR"
+cp -f "$FREEBSD_PACKAGE_FILE" "$FREEBSD_PACKAGE_DIR/"
+/opt/rust-package-builder/scripts/generate-opnsense-repo.py "$RELEASE_DIR/freebsd" --retention "$FREEBSD_NATIVE_RETENTION"
+NATIVE_URL="${OPNSENSE_REPOSITORY_URL%/}/freebsd"
+cat > "$RELEASE_DIR/freebsd/RustProxy-FreeBSD.conf" <<CONF
+RustProxyNative: {
+  url: "${NATIVE_URL}",
+  enabled: yes,
+  mirror_type: "none",
+  signature_type: "none"
+}
+CONF
+cp -f "$FREEBSD_PACKAGE_FILE" "$RELEASE_DIR/freebsd/rustproxy-latest.pkg"
+(cd "$RELEASE_DIR/freebsd" && sha256sum "$FREEBSD_ABI/$(basename "$FREEBSD_PACKAGE_FILE")") > "$RELEASE_DIR/freebsd/SHA256"
+cat > "$RELEASE_DIR/freebsd/BUILD-INFO.txt" <<INFO
+app_version=$VERSION
+package_version=$FREEBSD_PACKAGE_VERSION
+source_url=$SOURCE_REPO
+source_ref=$SOURCE_BRANCH
+source_commit=$SHA
+build_reason=$BUILD_REASON
+source_revision=$SOURCE_REVISION
+packaging_revision=$FREEBSD_NATIVE_PACKAGING_REVISION
+freebsd_release=$FREEBSD_RELEASE
+freebsd_abi=$FREEBSD_ABI
+freebsd_arch=$FREEBSD_ARCH
+package=$FREEBSD_ABI/$(basename "$FREEBSD_PACKAGE_FILE")
+INFO
+/opt/rust-package-builder/scripts/generate-freebsd-index.sh "$RELEASE_DIR/freebsd/index.html"
+
+[[ -s "$RELEASE_DIR/freebsd/index.html" ]]
+[[ -s "$RELEASE_DIR/freebsd/meta.conf" ]]
+[[ -s "$RELEASE_DIR/freebsd/packagesite.pkg" ]]
+[[ -s "$RELEASE_DIR/freebsd/data.pkg" ]]
+[[ -s "$RELEASE_DIR/freebsd/rustproxy-latest.pkg" ]]
+bsdtar -tf "$RELEASE_DIR/freebsd/packagesite.pkg" | grep -Fx 'packagesite.yaml' >/dev/null || fatal 'invalid FreeBSD packagesite.pkg'
+bsdtar -xOf "$FREEBSD_PACKAGE_DIR/$(basename "$FREEBSD_PACKAGE_FILE")" +COMPACT_MANIFEST >/dev/null || fatal 'invalid FreeBSD package manifest'
+
+log 'publishing native FreeBSD repository branch'
+rm -f "$REPOSITORY/current.new"
+ln -s "releases/$BRANCH_RELEASE_ID" "$REPOSITORY/current.new"
+mv -Tf "$REPOSITORY/current.new" "$REPOSITORY/current"
+PUBLISHED=1
+printf '%s\n' "$SHA" | atomic_write "$DATA_DIR/state/last_freebsd_commit"
+printf '%s\n' "$FREEBSD_PACKAGE_VERSION" | atomic_write "$DATA_DIR/state/last_freebsd_package_version"
+printf '%s\n' "$BRANCH_RELEASE_ID" | atomic_write "$DATA_DIR/state/last_freebsd_release"
+printf '%s\n' "$BRANCH_RELEASE_ID" | atomic_write "$DATA_DIR/state/last_release"
+log "FreeBSD native publication completed: package=$FREEBSD_PACKAGE_VERSION commit=$SHA"

scripts/build-linux-release.sh

@@ -144,7 +144,7 @@ APT_PUBLIC="$DATA_DIR/aptly/public"
 gpg --batch --verify "$APT_PUBLIC/dists/$REPO_DISTRIBUTION/Release.gpg" "$APT_PUBLIC/dists/$REPO_DISTRIBUTION/Release" >/dev/null 2>&1 \
     || fatal "APT Release signature verification failed"
 
-mkdir -p "$RELEASE_DIR/apt" "$RELEASE_DIR/rpm/x86_64" "$RELEASE_DIR/opnsense"
+mkdir -p "$RELEASE_DIR/apt" "$RELEASE_DIR/rpm/x86_64" "$RELEASE_DIR/opnsense" "$RELEASE_DIR/freebsd"
 CURRENT_TARGET=""
 if [[ -L "$REPOSITORY/current" ]]; then
     CURRENT_LINK=$(readlink "$REPOSITORY/current")
@@ -152,8 +152,12 @@ if [[ -L "$REPOSITORY/current" ]]; then
 fi
 
 log "staging Linux repository snapshot"
-if [[ -n "$CURRENT_TARGET" && -d "$CURRENT_TARGET/opnsense" ]]; then
-    rsync -a --delete --link-dest="$CURRENT_TARGET/opnsense"/ "$CURRENT_TARGET/opnsense"/ "$RELEASE_DIR/opnsense"/
+if [[ -n "$CURRENT_TARGET" ]]; then
+    for component in opnsense freebsd; do
+        if [[ -d "$CURRENT_TARGET/$component" ]]; then
+            rsync -a --delete --link-dest="$CURRENT_TARGET/$component"/ "$CURRENT_TARGET/$component"/ "$RELEASE_DIR/$component"/
+        fi
+    done
 fi
 
 rsync -a --delete "$APT_PUBLIC"/ "$RELEASE_DIR/apt"/

scripts/build-opnsense-release.sh

@@ -50,7 +50,7 @@ OPNSENSE_PACKAGE_FILE="$OUT/os-rustproxy-${OPNSENSE_PACKAGE_VERSION}.pkg"
 /opt/rust-package-builder/scripts/package-opnsense.sh \
     "$SRC" "$FREEBSD_BINARY" "$OPNSENSE_PACKAGE_FILE" "$OPNSENSE_PACKAGE_VERSION"
 
-mkdir -p "$RELEASE_DIR/apt" "$RELEASE_DIR/rpm/x86_64" "$RELEASE_DIR/opnsense"
+mkdir -p "$RELEASE_DIR/apt" "$RELEASE_DIR/rpm/x86_64" "$RELEASE_DIR/opnsense" "$RELEASE_DIR/freebsd"
 CURRENT_TARGET=""
 if [[ -L "$REPOSITORY/current" ]]; then
     CURRENT_LINK=$(readlink "$REPOSITORY/current")
@@ -59,7 +59,7 @@ fi
 
 log "staging OPNsense repository snapshot"
 if [[ -n "$CURRENT_TARGET" ]]; then
-    for component in apt rpm opnsense; do
+    for component in apt rpm opnsense freebsd; do
         if [[ -d "$CURRENT_TARGET/$component" ]]; then
             rsync -a --delete --link-dest="$CURRENT_TARGET/$component"/ "$CURRENT_TARGET/$component"/ "$RELEASE_DIR/$component"/
         fi

scripts/build-release.sh

@@ -6,10 +6,12 @@ SHA=${1:?commit SHA required}
 BUILD_REASON=${2:-new-commit}
 BUILD_LINUX=${3:-1}
 BUILD_OPNSENSE=${4:-1}
+BUILD_FREEBSD=${5:-0}
 
 [[ "$BUILD_LINUX" =~ ^[01]$ ]] || fatal "BUILD_LINUX must be 0 or 1"
 [[ "$BUILD_OPNSENSE" =~ ^[01]$ ]] || fatal "BUILD_OPNSENSE must be 0 or 1"
-(( BUILD_LINUX == 1 || BUILD_OPNSENSE == 1 )) || { log "nothing to build for $SHA"; exit 0; }
+[[ "$BUILD_FREEBSD" =~ ^[01]$ ]] || fatal "BUILD_FREEBSD must be 0 or 1"
+(( BUILD_LINUX == 1 || BUILD_OPNSENSE == 1 || BUILD_FREEBSD == 1 )) || { log "nothing to build for $SHA"; exit 0; }
 
 SHORT_SHA=${SHA:0:12}
 BUILD_ID="$(date -u '+%Y%m%dT%H%M%SZ')-${SHORT_SHA}"
@@ -102,10 +104,11 @@ HOMEPAGE=${PACKAGE_HOMEPAGE:-${CARGO_HOMEPAGE:-${CARGO_REPOSITORY:-${CONTROL_HOM
 export SHA SHORT_SHA BUILD_ID BUILD_REASON SOURCE_REVISION WORK SRC PKG OUT
 export PACKAGE_NAME VERSION BINARY_NAME DESCRIPTION LICENSE HOMEPAGE MAINTAINER
 
-log "build plan: commit=$SHA linux=$BUILD_LINUX opnsense=$BUILD_OPNSENSE version=$VERSION"
+log "build plan: commit=$SHA linux=$BUILD_LINUX opnsense=$BUILD_OPNSENSE freebsd=$BUILD_FREEBSD version=$VERSION"
 
 LINUX_OK=1
 OPNSENSE_OK=1
+FREEBSD_OK=1
 
 if [[ "$BUILD_LINUX" == "1" ]]; then
     if /opt/rust-package-builder/scripts/build-linux-release.sh; then
@@ -127,15 +130,27 @@ if [[ "$BUILD_OPNSENSE" == "1" ]]; then
     fi
 fi
 
+if [[ "$BUILD_FREEBSD" == "1" ]]; then
+    if /opt/rust-package-builder/scripts/build-freebsd-release.sh; then
+        log "FreeBSD native branch completed for $SHA"
+        cleanup_cargo_target
+    else
+        FREEBSD_OK=0
+        log "ERROR: FreeBSD native branch failed for $SHA"
+    fi
+fi
+
 LINUX_STATE=""
 OPNSENSE_STATE=""
+FREEBSD_STATE=""
 [[ -r "$DATA_DIR/state/last_linux_commit" ]] && LINUX_STATE=$(cat "$DATA_DIR/state/last_linux_commit")
 [[ -r "$DATA_DIR/state/last_opnsense_commit" ]] && OPNSENSE_STATE=$(cat "$DATA_DIR/state/last_opnsense_commit")
-if [[ "$LINUX_STATE" == "$SHA" && "$OPNSENSE_STATE" == "$SHA" ]]; then
+[[ -r "$DATA_DIR/state/last_freebsd_commit" ]] && FREEBSD_STATE=$(cat "$DATA_DIR/state/last_freebsd_commit")
+if [[ "$LINUX_STATE" == "$SHA" && "$OPNSENSE_STATE" == "$SHA" && ( "${FREEBSD_NATIVE_ENABLED:-0}" != "1" || "$FREEBSD_STATE" == "$SHA" ) ]]; then
     printf '%s\n' "$SHA" | atomic_write "$DATA_DIR/state/last_commit"
     log "all branches complete for $SHA"
 fi
 
-if [[ "$LINUX_OK" != "1" || "$OPNSENSE_OK" != "1" ]]; then
+if [[ "$LINUX_OK" != "1" || "$OPNSENSE_OK" != "1" || "$FREEBSD_OK" != "1" ]]; then
     exit 1
 fi

scripts/check-and-build.sh

@@ -50,12 +50,28 @@ opnsense_release_complete_for_commit() {
     return 0
 }
 
+freebsd_release_complete_for_commit() {
+    local sha=$1
+    local repo="$CURRENT/freebsd"
+    [[ -d "$CURRENT" ]] || return 1
+    for file in meta.conf packagesite.pkg data.pkg RustProxy-FreeBSD.conf BUILD-INFO.txt rustproxy-latest.pkg; do
+        [[ -s "$repo/$file" ]] || return 1
+    done
+    grep -Fqx "source_commit=$sha" "$repo/BUILD-INFO.txt" || return 1
+    grep -Fqx "packaging_revision=$FREEBSD_NATIVE_PACKAGING_REVISION" "$repo/BUILD-INFO.txt" || return 1
+    grep -Fqx "freebsd_abi=$FREEBSD_ABI" "$repo/BUILD-INFO.txt" || return 1
+    [[ -d "$repo/$FREEBSD_ABI" ]] || return 1
+    find "$repo/$FREEBSD_ABI" -maxdepth 1 -type f -name 'rustproxy-*.pkg' -print -quit | grep -q . || return 1
+    return 0
+}
+
 log "checking repository"
 REMOTE_SHA=$(git ls-remote "$SOURCE_REPO" "refs/heads/$SOURCE_BRANCH" | awk 'NR == 1 {print $1}')
 [[ "$REMOTE_SHA" =~ ^[0-9a-fA-F]{40}$ ]] || fatal "cannot resolve branch $SOURCE_BRANCH from $SOURCE_REPO"
 
 BUILD_LINUX=1
 BUILD_OPNSENSE=1
+BUILD_FREEBSD=0
 if linux_release_complete_for_commit "$REMOTE_SHA"; then
     BUILD_LINUX=0
     # Persist migrated per-branch state when an older installation already has
@@ -67,19 +83,20 @@ if opnsense_release_complete_for_commit "$REMOTE_SHA"; then
     printf '%s\n' "$REMOTE_SHA" | atomic_write "$DATA_DIR/state/last_opnsense_commit"
 fi
 
-if [[ "$BUILD_LINUX" == "0" && "$BUILD_OPNSENSE" == "0" ]]; then
+if [[ "${FREEBSD_NATIVE_ENABLED:-0}" == "1" ]]; then
+    BUILD_FREEBSD=1
+    if freebsd_release_complete_for_commit "$REMOTE_SHA"; then
+        BUILD_FREEBSD=0
+        printf '%s\n' "$REMOTE_SHA" | atomic_write "$DATA_DIR/state/last_freebsd_commit"
+    fi
+fi
+
+if [[ "$BUILD_LINUX" == "0" && "$BUILD_OPNSENSE" == "0" && "$BUILD_FREEBSD" == "0" ]]; then
     printf '%s\n' "$REMOTE_SHA" | atomic_write "$DATA_DIR/state/last_commit"
-    log "no changes: Linux and OPNsense are complete for $REMOTE_SHA"
+    log "no changes: all enabled repositories are complete for $REMOTE_SHA"
     exit 0
 fi
 
-if [[ "$BUILD_LINUX" == "1" && "$BUILD_OPNSENSE" == "1" ]]; then
-    REASON="new-or-missing-both"
-elif [[ "$BUILD_LINUX" == "1" ]]; then
-    REASON="repair-linux"
-else
-    REASON="repair-opnsense"
-fi
-
-log "build required: commit=$REMOTE_SHA linux=$BUILD_LINUX opnsense=$BUILD_OPNSENSE reason=$REASON"
-/opt/rust-package-builder/scripts/build-release.sh "$REMOTE_SHA" "$REASON" "$BUILD_LINUX" "$BUILD_OPNSENSE"
+REASON="missing-or-outdated-channel"
+log "build required: commit=$REMOTE_SHA linux=$BUILD_LINUX opnsense=$BUILD_OPNSENSE freebsd=$BUILD_FREEBSD reason=$REASON"
+/opt/rust-package-builder/scripts/build-release.sh "$REMOTE_SHA" "$REASON" "$BUILD_LINUX" "$BUILD_OPNSENSE" "$BUILD_FREEBSD"

scripts/entrypoint.sh

@@ -16,6 +16,8 @@ FREEBSD_ARCH=${FREEBSD_ARCH:-freebsd:15:x86:64}
 FREEBSD_RUST_TOOLCHAIN=${FREEBSD_RUST_TOOLCHAIN:-1.88.0}
 APPLY_FREEBSD_PATCHES=${APPLY_FREEBSD_PATCHES:-1}
 RUN_LINUX_TESTS=${RUN_LINUX_TESTS:-1}
+FREEBSD_NATIVE_ENABLED=${FREEBSD_NATIVE_ENABLED:-0}
+FREEBSD_NATIVE_RETENTION=${FREEBSD_NATIVE_RETENTION:-10}
 
 [[ "$POLL_INTERVAL" =~ ^[0-9]+$ ]] || fatal "POLL_INTERVAL must be an integer"
 (( POLL_INTERVAL >= 1 )) || fatal "POLL_INTERVAL must be >= 1"
@@ -23,6 +25,8 @@ RUN_LINUX_TESTS=${RUN_LINUX_TESTS:-1}
 [[ "$OPNSENSE_RETENTION" =~ ^[0-9]+$ ]] || fatal "OPNSENSE_RETENTION must be >= 0"
 [[ "$APPLY_FREEBSD_PATCHES" =~ ^[01]$ ]] || fatal "APPLY_FREEBSD_PATCHES must be 0 or 1"
 [[ "$RUN_LINUX_TESTS" =~ ^[01]$ ]] || fatal "RUN_LINUX_TESTS must be 0 or 1"
+[[ "$FREEBSD_NATIVE_ENABLED" =~ ^[01]$ ]] || fatal "FREEBSD_NATIVE_ENABLED must be 0 or 1"
+[[ "$FREEBSD_NATIVE_RETENTION" =~ ^[0-9]+$ ]] || fatal "FREEBSD_NATIVE_RETENTION must be a nonnegative integer"
 
 export DATA_DIR=${DATA_DIR:-/var/lib/package-builder}
 export SOURCE_REPO SOURCE_BRANCH REPOSITORY_URL OPNSENSE_REPOSITORY_URL POLL_INTERVAL
@@ -31,7 +35,7 @@ export REPO_COMPONENT=${REPO_COMPONENT:-main}
 export PACKAGE_RELEASE
 export OPNSENSE_ABI OPNSENSE_RETENTION
 export FREEBSD_RELEASE FREEBSD_ABI FREEBSD_ARCH FREEBSD_RUST_TOOLCHAIN
-export APPLY_FREEBSD_PATCHES RUN_LINUX_TESTS
+export APPLY_FREEBSD_PATCHES RUN_LINUX_TESTS FREEBSD_NATIVE_ENABLED FREEBSD_NATIVE_RETENTION
 export MAX_GLIBC_VERSION=${MAX_GLIBC_VERSION:-2.34}
 export GPG_PRIVATE_KEY_FILE=${GPG_PRIVATE_KEY_FILE:-/run/secrets/gpg/private-key.asc}
 export GPG_PASSPHRASE_FILE=${GPG_PASSPHRASE_FILE:-/run/secrets/gpg/passphrase}
@@ -77,7 +81,7 @@ fi
 
 /opt/rust-package-builder/scripts/init-storage.sh
 
-log "builder started: branch=$SOURCE_BRANCH interval=${POLL_INTERVAL}s opnsense=$OPNSENSE_ABI freebsd=$FREEBSD_RELEASE"
+log "builder started: branch=$SOURCE_BRANCH interval=${POLL_INTERVAL}s opnsense=$OPNSENSE_ABI freebsd=$FREEBSD_RELEASE native_freebsd=$FREEBSD_NATIVE_ENABLED"
 while true; do
     if ! /opt/rust-package-builder/scripts/check-and-build.sh; then
         log "ERROR: one or more build branches failed; any successful branch was published independently"

scripts/generate-freebsd-index.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+source /opt/rust-package-builder/scripts/lib.sh
+OUT=${1:?output file required}
+URL="${OPNSENSE_REPOSITORY_URL%/}/freebsd"
+export OUT URL FREEBSD_ABI
+python3 <<'PY'
+import html, os
+h=html.escape
+url=h(os.environ['URL']); abi=h(os.environ['FREEBSD_ABI'])
+page=f'''<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>RustProxy - native FreeBSD pkg</title>
+<style>body{{font:16px/1.55 system-ui,sans-serif;max-width:860px;margin:40px auto;padding:0 20px}}pre{{overflow:auto;background:#171717;color:#eee;padding:18px;border-radius:8px}}</style></head>
+<body><h1>RustProxy for native FreeBSD</h1>
+<p>This repository contains the <code>rustproxy</code> package and an rc.d service, without OPNsense plugin files. ABI: <code>{abi}</code>.</p>
+<p><strong>Development repository: unsigned pkg catalog.</strong> Use only in an environment where you trust the source and transport. Configure signing before production.</p>
+<pre><code>mkdir -p /usr/local/etc/pkg/repos
+fetch -o /usr/local/etc/pkg/repos/RustProxy-FreeBSD.conf {url}/RustProxy-FreeBSD.conf
+pkg update -f
+pkg install rustproxy
+sysrc rustproxy_enable=YES
+service rustproxy start
+service rustproxy reload</code></pre>
+<p>To use an external JSON configuration, set <code>rustproxy_config="/usr/local/etc/rustproxy/config.json"</code> in <code>/etc/rc.conf</code>. The file and parent directory must be writable by the service account.</p>
+<ul><li><a href="{url}/meta.conf">meta.conf</a></li><li><a href="{url}/packagesite.pkg">packagesite.pkg</a></li><li><a href="{url}/RustProxy-FreeBSD.conf">RustProxy-FreeBSD.conf</a></li><li><a href="{url}/rustproxy-latest.pkg">latest package</a></li></ul>
+</body></html>'''
+with open(os.environ['OUT'],'w',encoding='utf-8') as f:
+    f.write(page)
+PY

scripts/generate-index.sh

@@ -72,6 +72,7 @@ sudo dnf install {h(package)}</code></pre>
 <h2>OPNsense / FreeBSD pkg</h2>
 <p>The OPNsense plugin is published separately because it uses the FreeBSD pkg format.</p>
 <p><a href="{h(opn_url)}/">{h(opn_url)}/</a></p>
+<p>Native FreeBSD pkg (if enabled): <a href="{h(opn_url)}/freebsd/">{h(opn_url)}/freebsd/</a>.</p>
 </div>
 
 <div class="card">

scripts/generate-opnsense-index.sh

@@ -39,6 +39,10 @@ code{{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}}
 <p><strong>OPNsense series:</strong> {h(series)} &nbsp; <strong>ABI:</strong> {h(abi)}</p>
 </div>
 <div class="card">
+<h2>Native FreeBSD (without OPNsense)</h2>
+<p>The separate optional native FreeBSD pkg repository is available at <a href="{h(url)}/freebsd/">{h(url)}/freebsd/</a> when FREEBSD_NATIVE_ENABLED=1.</p>
+</div>
+<div class="card">
 <h2>pkg repository configuration</h2>
 <pre><code>mkdir -p /usr/local/etc/pkg/repos
 cat &gt; /usr/local/etc/pkg/repos/RustProxy.conf &lt;&lt;'REPO'

scripts/generate-opnsense-repo.py

@@ -11,7 +11,7 @@ from collections import defaultdict
 from pathlib import Path
 
 CATALOG_FILES = {"data.pkg", "packagesite.pkg"}
-LATEST_NAMES = {"latest.pkg", "os-rustproxy-latest.pkg"}
+LATEST_NAMES = {"latest.pkg", "os-rustproxy-latest.pkg", "rustproxy-latest.pkg"}
 
 
 def sha256(path: Path) -> str:

scripts/init-storage.sh

@@ -34,7 +34,7 @@ if ! aptly -config="$APTLY_CONF" repo list -raw | grep -Fx package-builder >/dev
         package-builder >/dev/null
 fi
 
-for item in apt rpm opnsense repo-key.gpg index.html LINUX-BUILD-INFO.txt; do
+for item in apt rpm opnsense freebsd repo-key.gpg index.html LINUX-BUILD-INFO.txt; do
     if [[ -e "$REPOSITORY/$item" && ! -L "$REPOSITORY/$item" ]]; then
         fatal "$REPOSITORY/$item exists and is not a symlink; refusing to overwrite"
     fi
@@ -43,6 +43,7 @@ done
 ln -sfn current/apt "$REPOSITORY/apt"
 ln -sfn current/rpm "$REPOSITORY/rpm"
 ln -sfn current/opnsense "$REPOSITORY/opnsense"
+ln -sfn current/freebsd "$REPOSITORY/freebsd"
 ln -sfn current/repo-key.gpg "$REPOSITORY/repo-key.gpg"
 ln -sfn current/index.html "$REPOSITORY/index.html"
 ln -sfn current/LINUX-BUILD-INFO.txt "$REPOSITORY/LINUX-BUILD-INFO.txt"

scripts/lib.sh

@@ -2,8 +2,9 @@
 set -Eeuo pipefail
 
 # Increment when package payload/installation semantics change without a source commit.
-PACKAGING_REVISION=2
-OPNSENSE_PACKAGING_REVISION=3
+PACKAGING_REVISION=3
+OPNSENSE_PACKAGING_REVISION=4
+FREEBSD_NATIVE_PACKAGING_REVISION=1
 
 log() {
     printf '%s %s\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" "$*"

scripts/package-freebsd.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+BUILDER_ROOT=${BUILDER_ROOT:-/opt/rust-package-builder}
+source "$BUILDER_ROOT/scripts/lib.sh"
+
+SOURCE_DIR=${1:?source path required}
+BINARY=${2:?FreeBSD binary required}
+PACKAGE_FILE=${3:?output package file required}
+PACKAGE_VERSION=${4:?FreeBSD package version required}
+FREEBSD_ABI=${FREEBSD_ABI:-FreeBSD:15:amd64}
+FREEBSD_ARCH=${FREEBSD_ARCH:-freebsd:15:x86:64}
+PACKAGING="$BUILDER_ROOT/packaging/freebsd"
+
+for tool in python3 sha256sum tar zstd file; do
+    require_cmd "$tool"
+done
+[[ -f "$SOURCE_DIR/Cargo.toml" ]] || fatal "missing Cargo.toml: $SOURCE_DIR"
+[[ -f "$BINARY" ]] || fatal "missing FreeBSD binary: $BINARY"
+[[ "$(file -b "$BINARY")" == *FreeBSD* ]] || fatal "refusing non-FreeBSD native package: $BINARY"
+
+WORK=$(mktemp -d "${PACKAGE_FILE}.work.XXXXXX")
+trap 'rm -rf "$WORK"' EXIT
+STAGE="$WORK/stage"
+META="$WORK/meta"
+ARCHIVE="$WORK/rustproxy.tar"
+mkdir -p "$META" "$(dirname "$PACKAGE_FILE")"
+install -D -m 0555 "$BINARY" "$STAGE/usr/local/sbin/rust-proxy"
+install -D -m 0555 "$PACKAGING/rustproxy.rc" "$STAGE/usr/local/etc/rc.d/rustproxy"
+install -D -m 0644 "$PACKAGING/rustproxy.newsyslog" "$STAGE/usr/local/etc/newsyslog.conf.d/rustproxy.conf"
+
+python3 - "$STAGE" "$META" "$PACKAGE_VERSION" "$FREEBSD_ABI" "$FREEBSD_ARCH" \
+    "$PACKAGING/+POST_INSTALL" "$PACKAGING/+PRE_DEINSTALL" <<'PY'
+import hashlib
+import json
+from pathlib import Path
+import sys
+
+stage, meta = map(Path, sys.argv[1:3])
+version, abi, arch = sys.argv[3:6]
+post_install = Path(sys.argv[6]).read_text(encoding='utf-8')
+pre_deinstall = Path(sys.argv[7]).read_text(encoding='utf-8')
+
+files = {}
+flatsize = 0
+for path in sorted(stage.rglob('*')):
+    if path.is_symlink():
+        files['/' + path.relative_to(stage).as_posix()] = '-'
+    elif path.is_file():
+        files['/' + path.relative_to(stage).as_posix()] = hashlib.sha256(path.read_bytes()).hexdigest()
+        flatsize += path.stat().st_size
+common = {
+    'name': 'rustproxy',
+    'version': version,
+    'origin': 'www/rustproxy',
+    'comment': 'RustProxy reverse proxy for native FreeBSD',
+    'desc': 'RustProxy daemon and rc.d service for FreeBSD (no OPNsense plugin or dependency).',
+    'maintainer': 'local@localhost',
+    'www': 'https://git.linuxiarz.pl/gru/RustProxy',
+    'prefix': '/usr/local',
+    'abi': abi,
+    'arch': arch,
+    'flatsize': flatsize,
+    'licenselogic': 'single',
+    'licenses': ['UNKNOWN'],
+    'categories': ['www'],
+    'deps': {},
+    'options': {},
+}
+manifest = dict(common)
+manifest['files'] = files
+manifest['scripts'] = {'post-install': post_install, 'pre-deinstall': pre_deinstall}
+(meta / '+COMPACT_MANIFEST').write_text(json.dumps(common, separators=(',', ':')) + '\n')
+(meta / '+MANIFEST').write_text(json.dumps(manifest, separators=(',', ':')) + '\n')
+PY
+
+(
+    cd "$STAGE"
+    find . \( -type f -o -type l \) -print | LC_ALL=C sort | sed 's#^\./##' > "$WORK/payload.list"
+)
+[[ -s "$WORK/payload.list" ]] || fatal 'FreeBSD package payload is empty'
+tar --format=ustar --owner=0 --group=0 --numeric-owner \
+    -cf "$ARCHIVE" -C "$META" +COMPACT_MANIFEST +MANIFEST
+tar -P --format=ustar --owner=0 --group=0 --numeric-owner --no-recursion \
+    --transform='s,^,/,S' \
+    -rf "$ARCHIVE" -C "$STAGE" -T "$WORK/payload.list"
+python3 - "$ARCHIVE" "$META/+MANIFEST" <<'PY'
+from pathlib import Path
+import json
+import sys
+import tarfile
+pkg = Path(sys.argv[1])
+manifest = json.loads(Path(sys.argv[2]).read_text())
+with tarfile.open(pkg) as tf:
+    members = tf.getmembers()
+assert [m.name for m in members[:2]] == ['+COMPACT_MANIFEST', '+MANIFEST']
+assert all(not m.isdir() for m in members[2:]), 'package contains directory records'
+actual = {m.name for m in members[2:] if m.isfile() or m.issym() or m.islnk()}
+assert actual == set(manifest['files']), 'payload differs from +MANIFEST'
+assert all(name.startswith('/') for name in actual), 'non-absolute native FreeBSD payload path'
+PY
+zstd -q -f -19 -T0 "$ARCHIVE" -o "$PACKAGE_FILE"
+zstd -dc "$PACKAGE_FILE" | tar -tf - >/dev/null
+log "created native FreeBSD package: $PACKAGE_FILE"

scripts/prepare-package.sh

@@ -69,6 +69,37 @@ WantedBy=multi-user.target
 UNIT
 fi
 
+# Match the 0.34.x CLI. Avoid changing upstream units that already provide
+# their own ExecReload. Linux package revision forces rebuilding old binaries.
+python3 - "$PKG/payload/usr/lib/systemd/system/${PACKAGE_NAME}.service" "$BINARY_NAME" <<'PY_UNIT'
+from pathlib import Path
+import re
+import sys
+path = Path(sys.argv[1])
+name = sys.argv[2]
+text = path.read_text()
+if not re.search(r'^ExecReload=', text, re.M):
+    if not re.search(r'^ExecStart=', text, re.M):
+        raise SystemExit('unit has no ExecStart; cannot attach reload')
+    text = re.sub(
+        r'^(ExecStart=[^\n]*\n)',
+        lambda m: m.group(1) +
+        f'ExecReload=/usr/bin/{name} --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload\n',
+        text,
+        count=1,
+        flags=re.M,
+    )
+if re.search(r'^ProtectSystem=strict\s*$', text, re.M) and not re.search(
+    r'^ReadWritePaths=.*(?:^|[ \t])-?/etc/rustproxy(?:[ \t]|$)', text, re.M
+):
+    text = re.sub(
+        r'^(ProtectSystem=strict\s*\n)',
+        lambda m: m.group(1) + 'ReadWritePaths=-/etc/rustproxy\n',
+        text, count=1, flags=re.M,
+    )
+path.write_text(text)
+PY_UNIT
+
 if [[ -r "$ENV_SRC" ]]; then
     install -D -m 0640 "$ENV_SRC" "$PKG/payload/etc/${PACKAGE_NAME}/environment"
 fi
@@ -104,7 +135,7 @@ if ! getent passwd "$PACKAGE_NAME" >/dev/null 2>&1; then
     adduser --system --ingroup "$PACKAGE_NAME" --home "/var/lib/$PACKAGE_NAME" --no-create-home \\
         --disabled-password --shell /usr/sbin/nologin "$PACKAGE_NAME" >/dev/null
 fi
-install -d -o "$PACKAGE_NAME" -g "$PACKAGE_NAME" -m 0700 "/var/lib/$PACKAGE_NAME" "/var/log/$PACKAGE_NAME"
+install -d -o "$PACKAGE_NAME" -g "$PACKAGE_NAME" -m 0700 "/var/lib/$PACKAGE_NAME" "/var/log/$PACKAGE_NAME" "/etc/$PACKAGE_NAME"
 SCRIPT
 fi
 cat >> "$PKG/scripts/deb-postinstall.sh" <<SCRIPT
@@ -139,7 +170,7 @@ fi
 if ! getent passwd "$PACKAGE_NAME" >/dev/null 2>&1; then
     useradd --system --gid "$PACKAGE_NAME" --home-dir "/var/lib/$PACKAGE_NAME" --no-create-home --shell /sbin/nologin "$PACKAGE_NAME"
 fi
-install -d -o "$PACKAGE_NAME" -g "$PACKAGE_NAME" -m 0700 "/var/lib/$PACKAGE_NAME" "/var/log/$PACKAGE_NAME"
+install -d -o "$PACKAGE_NAME" -g "$PACKAGE_NAME" -m 0700 "/var/lib/$PACKAGE_NAME" "/var/log/$PACKAGE_NAME" "/etc/$PACKAGE_NAME"
 systemd-tmpfiles --create "/usr/lib/tmpfiles.d/${PACKAGE_NAME}.conf" >/dev/null 2>&1 || true
 systemctl daemon-reload >/dev/null 2>&1 || true
 systemctl enable "${PACKAGE_NAME}.service" >/dev/null 2>&1 || true