first commit

2026-09-29 13:37:57 +02:00
commit 093e6a7c14
@@ -0,0 +1,27 @@
+#!/bin/bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SOURCE_DIR="${RUSTPROXY_SOURCE_DIR:-$ROOT/app}"
+TARGET="x86_64-unknown-freebsd"
+
+if [[ ! -f "$SOURCE_DIR/Cargo.toml" ]]; then
+    echo "RustProxy source not found. Set RUSTPROXY_SOURCE_DIR to the dynamically fetched checkout." >&2
+    exit 1
+fi
+if ! command -v docker >/dev/null 2>&1; then
+    echo "Docker is required for cross mode." >&2
+    exit 1
+fi
+if ! command -v cross >/dev/null 2>&1; then
+    echo "cross is not installed. Install it with: cargo install cross --locked" >&2
+    exit 1
+fi
+
+cd "$SOURCE_DIR"
+cross build --locked --release --target "$TARGET"
+mkdir -p "$ROOT/dist/cross/$TARGET"
+cp "target/$TARGET/release/rust-proxy" "$ROOT/dist/cross/$TARGET/rust-proxy"
+
+echo "Cross-built binary: $ROOT/dist/cross/$TARGET/rust-proxy"
+echo "Do not publish this as the production OPNsense package without validation on the target FreeBSD ABI."
@@ -0,0 +1,86 @@
+#!/bin/bash
+set -euo pipefail
+
+CONFIG_FILE="${RUSTPROXY_BUILDER_CONFIG:-/etc/rustproxy-opnsense-builder.env}"
+if [[ ! -r "$CONFIG_FILE" ]]; then
+    echo "Missing builder config: $CONFIG_FILE" >&2
+    exit 1
+fi
+# shellcheck disable=SC1090
+source "$CONFIG_FILE"
+
+: "${PACKAGING_REPO_URL:?PACKAGING_REPO_URL is required}"
+: "${PACKAGING_REPO_REF:=main}"
+: "${PACKAGING_WORKDIR:=/srv/rustproxy-opnsense/packaging}"
+: "${APP_REPO_URL:=https://git.linuxiarz.pl/gru/RustProxy}"
+: "${APP_REPO_REF:=HEAD}"
+: "${APP_WORKDIR:=/srv/rustproxy-opnsense/source/RustProxy}"
+: "${STATE_DIR:=/var/lib/rustproxy-opnsense-builder}"
+
+mkdir -p "$STATE_DIR" "$(dirname "$PACKAGING_WORKDIR")" "$(dirname "$APP_WORKDIR")"
+exec 9>"$STATE_DIR/build.lock"
+if ! flock -n 9; then
+    echo "Another build is running; exiting."
+    exit 0
+fi
+
+SYNC_COMMIT=""
+sync_checkout()
+{
+    local dir="$1"
+    local url="$2"
+    local ref="$3"
+
+    if [[ ! -d "$dir/.git" ]]; then
+        rm -rf "$dir"
+        mkdir -p "$dir"
+        git -C "$dir" init
+        git -C "$dir" remote add origin "$url"
+    else
+        git -C "$dir" remote set-url origin "$url"
+    fi
+
+    echo "Fetching $url ($ref)" >&2
+    git -C "$dir" fetch --prune --tags origin "$ref" >&2
+    SYNC_COMMIT="$(git -C "$dir" rev-parse FETCH_HEAD)"
+    git -C "$dir" checkout --detach -f "$SYNC_COMMIT" >&2
+    git -C "$dir" reset --hard "$SYNC_COMMIT" >&2
+    git -C "$dir" clean -ffd >&2
+}
+
+# Refresh the packaging repository first so the newest build logic is used.
+sync_checkout "$PACKAGING_WORKDIR" "$PACKAGING_REPO_URL" "$PACKAGING_REPO_REF"
+packaging_commit="$SYNC_COMMIT"
+
+# RustProxy is intentionally NOT vendored in the packaging repository.
+# Fetch the application directly from its upstream repository every run.
+sync_checkout "$APP_WORKDIR" "$APP_REPO_URL" "$APP_REPO_REF"
+app_commit="$SYNC_COMMIT"
+app_revision="$(git -C "$APP_WORKDIR" rev-list --count "$app_commit")"
+
+if [[ ! -f "$APP_WORKDIR/Cargo.toml" ]]; then
+    echo "Upstream checkout does not contain Cargo.toml: $APP_WORKDIR" >&2
+    exit 1
+fi
+
+state_file="$STATE_DIR/last-successful-build"
+current_state="packaging=$packaging_commit app=$app_commit"
+last_state="$(cat "$state_file" 2>/dev/null || true)"
+
+if [[ "$current_state" == "$last_state" ]]; then
+    echo "No changes. packaging=$packaging_commit app=$app_commit"
+    exit 0
+fi
+
+echo "Building RustProxy commit $app_commit (revision $app_revision)"
+echo "Using packaging commit $packaging_commit"
+
+RUSTPROXY_SOURCE_DIR="$APP_WORKDIR" \
+RUSTPROXY_SOURCE_URL="$APP_REPO_URL" \
+RUSTPROXY_SOURCE_REF="$APP_REPO_REF" \
+RUSTPROXY_SOURCE_COMMIT="$app_commit" \
+RUSTPROXY_SOURCE_REVISION="$app_revision" \
+    "$PACKAGING_WORKDIR/ci/build-release.sh"
+
+printf '%s\n' "$current_state" > "$state_file"
+echo "Build completed: $current_state"
@@ -0,0 +1,22 @@
+#!/bin/bash
+set -euo pipefail
+
+if [[ ${EUID} -ne 0 ]]; then
+    echo "Run as root" >&2
+    exit 1
+fi
+
+apt-get update
+DEBIAN_FRONTEND=noninteractive apt-get install -y docker.io rustup build-essential pkg-config
+systemctl enable --now docker
+
+TARGET_USER="${SUDO_USER:-root}"
+if [[ "$TARGET_USER" == "root" ]]; then
+    rustup default stable
+    cargo install cross --locked
+else
+    sudo -u "$TARGET_USER" -H sh -c 'rustup default stable && cargo install cross --locked'
+fi
+
+echo "Docker + rustup + cross installed for $TARGET_USER."
+echo "Use BUILD_MODE=cross-binary only for development validation."
@@ -0,0 +1,29 @@
+#!/bin/bash
+set -euo pipefail
+
+if [[ ${EUID} -ne 0 ]]; then
+    echo "Run as root" >&2
+    exit 1
+fi
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+apt-get update
+DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    ca-certificates cron git openssh-client rsync util-linux curl jq
+
+install -d -m 0755 /srv/rustproxy-opnsense
+install -d -m 0755 /var/lib/rustproxy-opnsense-builder
+install -m 0755 "$REPO_ROOT/builder/debian/hourly-build.sh" /usr/local/sbin/rustproxy-opnsense-hourly
+install -m 0644 "$REPO_ROOT/builder/debian/rustproxy-opnsense.cron" /etc/cron.d/rustproxy-opnsense
+
+if [[ ! -e /etc/rustproxy-opnsense-builder.env ]]; then
+    install -m 0600 "$REPO_ROOT/builder.env.example" /etc/rustproxy-opnsense-builder.env
+    echo "Created /etc/rustproxy-opnsense-builder.env. Edit it before the first cron run."
+fi
+
+touch /var/log/rustproxy-opnsense-builder.log
+chmod 0640 /var/log/rustproxy-opnsense-builder.log
+systemctl enable --now cron
+
+echo "Debian scheduler installed."
@@ -0,0 +1,3 @@
+SHELL=/bin/bash
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+17 * * * * root /usr/local/sbin/rustproxy-opnsense-hourly >> /var/log/rustproxy-opnsense-builder.log 2>&1