first commit

builder/debian/build-freebsd-cross.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SOURCE_DIR="${RUSTPROXY_SOURCE_DIR:-$ROOT/app}"
+TARGET="x86_64-unknown-freebsd"
+
+if [[ ! -f "$SOURCE_DIR/Cargo.toml" ]]; then
+    echo "RustProxy source not found. Set RUSTPROXY_SOURCE_DIR to the dynamically fetched checkout." >&2
+    exit 1
+fi
+if ! command -v docker >/dev/null 2>&1; then
+    echo "Docker is required for cross mode." >&2
+    exit 1
+fi
+if ! command -v cross >/dev/null 2>&1; then
+    echo "cross is not installed. Install it with: cargo install cross --locked" >&2
+    exit 1
+fi
+
+cd "$SOURCE_DIR"
+cross build --locked --release --target "$TARGET"
+mkdir -p "$ROOT/dist/cross/$TARGET"
+cp "target/$TARGET/release/rust-proxy" "$ROOT/dist/cross/$TARGET/rust-proxy"
+
+echo "Cross-built binary: $ROOT/dist/cross/$TARGET/rust-proxy"
+echo "Do not publish this as the production OPNsense package without validation on the target FreeBSD ABI."

builder/debian/hourly-build.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+set -euo pipefail
+
+CONFIG_FILE="${RUSTPROXY_BUILDER_CONFIG:-/etc/rustproxy-opnsense-builder.env}"
+if [[ ! -r "$CONFIG_FILE" ]]; then
+    echo "Missing builder config: $CONFIG_FILE" >&2
+    exit 1
+fi
+# shellcheck disable=SC1090
+source "$CONFIG_FILE"
+
+: "${PACKAGING_REPO_URL:?PACKAGING_REPO_URL is required}"
+: "${PACKAGING_REPO_REF:=main}"
+: "${PACKAGING_WORKDIR:=/srv/rustproxy-opnsense/packaging}"
+: "${APP_REPO_URL:=https://git.linuxiarz.pl/gru/RustProxy}"
+: "${APP_REPO_REF:=HEAD}"
+: "${APP_WORKDIR:=/srv/rustproxy-opnsense/source/RustProxy}"
+: "${STATE_DIR:=/var/lib/rustproxy-opnsense-builder}"
+
+mkdir -p "$STATE_DIR" "$(dirname "$PACKAGING_WORKDIR")" "$(dirname "$APP_WORKDIR")"
+exec 9>"$STATE_DIR/build.lock"
+if ! flock -n 9; then
+    echo "Another build is running; exiting."
+    exit 0
+fi
+
+SYNC_COMMIT=""
+sync_checkout()
+{
+    local dir="$1"
+    local url="$2"
+    local ref="$3"
+
+    if [[ ! -d "$dir/.git" ]]; then
+        rm -rf "$dir"
+        mkdir -p "$dir"
+        git -C "$dir" init
+        git -C "$dir" remote add origin "$url"
+    else
+        git -C "$dir" remote set-url origin "$url"
+    fi
+
+    echo "Fetching $url ($ref)" >&2
+    git -C "$dir" fetch --prune --tags origin "$ref" >&2
+    SYNC_COMMIT="$(git -C "$dir" rev-parse FETCH_HEAD)"
+    git -C "$dir" checkout --detach -f "$SYNC_COMMIT" >&2
+    git -C "$dir" reset --hard "$SYNC_COMMIT" >&2
+    git -C "$dir" clean -ffd >&2
+}
+
+# Refresh the packaging repository first so the newest build logic is used.
+sync_checkout "$PACKAGING_WORKDIR" "$PACKAGING_REPO_URL" "$PACKAGING_REPO_REF"
+packaging_commit="$SYNC_COMMIT"
+
+# RustProxy is intentionally NOT vendored in the packaging repository.
+# Fetch the application directly from its upstream repository every run.
+sync_checkout "$APP_WORKDIR" "$APP_REPO_URL" "$APP_REPO_REF"
+app_commit="$SYNC_COMMIT"
+app_revision="$(git -C "$APP_WORKDIR" rev-list --count "$app_commit")"
+
+if [[ ! -f "$APP_WORKDIR/Cargo.toml" ]]; then
+    echo "Upstream checkout does not contain Cargo.toml: $APP_WORKDIR" >&2
+    exit 1
+fi
+
+state_file="$STATE_DIR/last-successful-build"
+current_state="packaging=$packaging_commit app=$app_commit"
+last_state="$(cat "$state_file" 2>/dev/null || true)"
+
+if [[ "$current_state" == "$last_state" ]]; then
+    echo "No changes. packaging=$packaging_commit app=$app_commit"
+    exit 0
+fi
+
+echo "Building RustProxy commit $app_commit (revision $app_revision)"
+echo "Using packaging commit $packaging_commit"
+
+RUSTPROXY_SOURCE_DIR="$APP_WORKDIR" \
+RUSTPROXY_SOURCE_URL="$APP_REPO_URL" \
+RUSTPROXY_SOURCE_REF="$APP_REPO_REF" \
+RUSTPROXY_SOURCE_COMMIT="$app_commit" \
+RUSTPROXY_SOURCE_REVISION="$app_revision" \
+    "$PACKAGING_WORKDIR/ci/build-release.sh"
+
+printf '%s\n' "$current_state" > "$state_file"
+echo "Build completed: $current_state"

builder/debian/install-cross.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+set -euo pipefail
+
+if [[ ${EUID} -ne 0 ]]; then
+    echo "Run as root" >&2
+    exit 1
+fi
+
+apt-get update
+DEBIAN_FRONTEND=noninteractive apt-get install -y docker.io rustup build-essential pkg-config
+systemctl enable --now docker
+
+TARGET_USER="${SUDO_USER:-root}"
+if [[ "$TARGET_USER" == "root" ]]; then
+    rustup default stable
+    cargo install cross --locked
+else
+    sudo -u "$TARGET_USER" -H sh -c 'rustup default stable && cargo install cross --locked'
+fi
+
+echo "Docker + rustup + cross installed for $TARGET_USER."
+echo "Use BUILD_MODE=cross-binary only for development validation."

builder/debian/install.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -euo pipefail
+
+if [[ ${EUID} -ne 0 ]]; then
+    echo "Run as root" >&2
+    exit 1
+fi
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+apt-get update
+DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    ca-certificates cron git openssh-client rsync util-linux curl jq
+
+install -d -m 0755 /srv/rustproxy-opnsense
+install -d -m 0755 /var/lib/rustproxy-opnsense-builder
+install -m 0755 "$REPO_ROOT/builder/debian/hourly-build.sh" /usr/local/sbin/rustproxy-opnsense-hourly
+install -m 0644 "$REPO_ROOT/builder/debian/rustproxy-opnsense.cron" /etc/cron.d/rustproxy-opnsense
+
+if [[ ! -e /etc/rustproxy-opnsense-builder.env ]]; then
+    install -m 0600 "$REPO_ROOT/builder.env.example" /etc/rustproxy-opnsense-builder.env
+    echo "Created /etc/rustproxy-opnsense-builder.env. Edit it before the first cron run."
+fi
+
+touch /var/log/rustproxy-opnsense-builder.log
+chmod 0640 /var/log/rustproxy-opnsense-builder.log
+systemctl enable --now cron
+
+echo "Debian scheduler installed."

builder/debian/rustproxy-opnsense.cron

@@ -0,0 +1,3 @@
+SHELL=/bin/bash
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+17 * * * * root /usr/local/sbin/rustproxy-opnsense-hourly >> /var/log/rustproxy-opnsense-builder.log 2>&1

builder/freebsd/bootstrap.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+set -eu
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Run as root" >&2
+    exit 1
+fi
+
+BUILDER_USER="${1:-builder}"
+BUILDER_GROUP="$BUILDER_USER"
+
+ASSUME_ALWAYS_YES=yes pkg bootstrap -f
+pkg update
+pkg install -y git rust python3 pkgconf cmake gmake perl5 rsync
+
+if ! pw groupshow "$BUILDER_GROUP" >/dev/null 2>&1; then
+    pw groupadd "$BUILDER_GROUP"
+fi
+if ! pw usershow "$BUILDER_USER" >/dev/null 2>&1; then
+    pw useradd "$BUILDER_USER" -g "$BUILDER_GROUP" -m -s /bin/sh -c "RustProxy package builder"
+fi
+
+install -d -o "$BUILDER_USER" -g "$BUILDER_GROUP" -m 0755 /usr/local/rustproxy-build
+install -d -o "$BUILDER_USER" -g "$BUILDER_GROUP" -m 0700 /usr/local/rustproxy-build/keys
+
+echo "FreeBSD builder dependencies installed."
+echo "Builder account: $BUILDER_USER"
+echo "Add its SSH public key to /home/$BUILDER_USER/.ssh/authorized_keys."
+echo "Then log in as $BUILDER_USER and create the repository signing key."
+rust_version="$(rustc --version | awk '{print $2}')"
+if [ "$(pkg version -t "$rust_version" 1.88)" = "<" ]; then
+    echo "RustProxy requires Rust >= 1.88, found $rust_version" >&2
+    exit 1
+fi
+echo "Rust version OK: $rust_version"

builder/freebsd/build-release.sh

@@ -0,0 +1,108 @@
+#!/bin/sh
+set -eu
+
+ROOT="${1:-$(pwd)}"
+APP_DIR="$ROOT/app"
+PLUGIN_SOURCE="$ROOT/opnsense-plugin/www/rustproxy"
+DIST_DIR="$ROOT/dist"
+CACHE_DIR="${RUSTPROXY_BUILD_CACHE:-$HOME/.cache/rustproxy-opnsense}"
+PLUGINS_DIR="$CACHE_DIR/opnsense-plugins"
+OPNSENSE_PLUGINS_REF="${OPNSENSE_PLUGINS_REF:-stable/26.7}"
+OPNSENSE_ABI="${OPNSENSE_ABI:-26.7}"
+SOURCE_REVISION="${SOURCE_REVISION:-0}"
+SOURCE_COMMIT="${RUSTPROXY_SOURCE_COMMIT:-unknown}"
+SOURCE_URL="${RUSTPROXY_SOURCE_URL:-https://git.linuxiarz.pl/gru/RustProxy}"
+SOURCE_REF="${RUSTPROXY_SOURCE_REF:-HEAD}"
+RUN_TESTS="${RUN_TESTS:-1}"
+
+if [ "$(uname -s)" != "FreeBSD" ]; then
+    echo "This release builder must run on FreeBSD." >&2
+    exit 1
+fi
+case "$(uname -m)" in
+    amd64|x86_64) ;;
+    *) echo "Only amd64/x86_64 is supported by this pipeline." >&2; exit 1 ;;
+esac
+
+for tool in cargo git make pkg rsync; do
+    command -v "$tool" >/dev/null 2>&1 || { echo "Missing tool: $tool" >&2; exit 1; }
+done
+
+rust_version="$(rustc --version | awk '{print $2}')"
+echo "Using rustc $rust_version on $(freebsd-version -ku | tr '\n' ' ')"
+
+app_version="$(awk -F '"' '/^version = "/ {print $2; exit}' "$APP_DIR/Cargo.toml")"
+if [ -z "$app_version" ]; then
+    echo "Cannot read app version from Cargo.toml" >&2
+    exit 1
+fi
+
+mkdir -p "$CACHE_DIR"
+if [ ! -d "$PLUGINS_DIR/.git" ]; then
+    git clone https://github.com/opnsense/plugins.git "$PLUGINS_DIR"
+fi
+git -C "$PLUGINS_DIR" fetch --prune origin "$OPNSENSE_PLUGINS_REF"
+git -C "$PLUGINS_DIR" checkout -f -B rustproxy-build FETCH_HEAD
+git -C "$PLUGINS_DIR" clean -ffd
+
+cd "$APP_DIR"
+if [ "$RUN_TESTS" = "1" ]; then
+    cargo test --locked --release
+fi
+cargo build --locked --release
+
+plugin_dir="$PLUGINS_DIR/www/rustproxy"
+rm -rf "$plugin_dir"
+cp -R "$PLUGIN_SOURCE" "$plugin_dir"
+mkdir -p "$plugin_dir/src/sbin"
+install -m 0555 "$APP_DIR/target/release/rust-proxy" "$plugin_dir/src/sbin/rust-proxy"
+
+cd "$plugin_dir"
+make PLUGIN_VERSION="$app_version" PLUGIN_REVISION="$SOURCE_REVISION" PLUGIN_ABI="$OPNSENSE_ABI" package
+
+package_file="$(find "$plugin_dir/work/pkg" -maxdepth 1 -type f -name 'os-rustproxy-*.pkg' | sort | tail -n 1)"
+if [ -z "$package_file" ] || [ ! -f "$package_file" ]; then
+    echo "Package was not produced." >&2
+    exit 1
+fi
+
+repo_dir="$DIST_DIR/repository/$OPNSENSE_ABI/amd64"
+rm -rf "$DIST_DIR"
+mkdir -p "$repo_dir"
+cp "$package_file" "$repo_dir/"
+
+if [ -n "${PKG_REPO_SIGN_KEY:-}" ]; then
+    if [ ! -r "$PKG_REPO_SIGN_KEY" ]; then
+        echo "Repository signing key is not readable: $PKG_REPO_SIGN_KEY" >&2
+        exit 1
+    fi
+    pkg repo "$repo_dir" "$PKG_REPO_SIGN_KEY"
+else
+    echo "WARNING: creating unsigned development repository" >&2
+    pkg repo "$repo_dir"
+fi
+
+if [ -n "${PKG_REPO_PUBLIC_KEY:-}" ]; then
+    if [ ! -r "$PKG_REPO_PUBLIC_KEY" ]; then
+        echo "Repository public key is not readable: $PKG_REPO_PUBLIC_KEY" >&2
+        exit 1
+    fi
+    cp "$PKG_REPO_PUBLIC_KEY" "$DIST_DIR/rustproxy-repo.pub"
+fi
+
+cat > "$DIST_DIR/BUILD-INFO.txt" <<INFO
+app_version=$app_version
+plugin_revision=$SOURCE_REVISION
+source_url=$SOURCE_URL
+source_ref=$SOURCE_REF
+source_commit=$SOURCE_COMMIT
+opnsense_plugins_ref=$OPNSENSE_PLUGINS_REF
+opnsense_abi=$OPNSENSE_ABI
+freebsd_kernel=$(freebsd-version -k)
+freebsd_userland=$(freebsd-version -u)
+rustc=$rust_version
+package=$(basename "$package_file")
+INFO
+
+sha256 "$repo_dir/$(basename "$package_file")" > "$DIST_DIR/SHA256"
+echo "Release artifacts created in $DIST_DIR"

builder/freebsd/create-repo-key.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+set -eu
+
+KEY_DIR="${1:-/usr/local/rustproxy-build/keys}"
+KEY="$KEY_DIR/rustproxy-repo.key"
+PUB="$KEY_DIR/rustproxy-repo.pub"
+
+umask 077
+mkdir -p "$KEY_DIR"
+if [ -e "$KEY" ] || [ -e "$PUB" ]; then
+    echo "Key already exists in $KEY_DIR" >&2
+    exit 1
+fi
+
+openssl genrsa -out "$KEY" 2048
+chmod 0400 "$KEY"
+openssl rsa -in "$KEY" -out "$PUB" -pubout
+chmod 0444 "$PUB"
+
+echo "Private key: $KEY"
+echo "Public key:  $PUB"