push

ci/build-release.sh

@@ -8,35 +8,24 @@ if [[ -r "$CONFIG_FILE" ]]; then
     source "$CONFIG_FILE"
 fi
 
-: "${BUILD_MODE:=native-freebsd}"
-: "${STATE_DIR:=/var/lib/rustproxy-opnsense-builder}"
-: "${OPNSENSE_PLUGINS_REF:=stable/26.7}"
+: "${BUILD_MODE:=docker-freebsd}"
 : "${OPNSENSE_ABI:=26.7}"
+: "${FREEBSD_RELEASE:=15.1-RELEASE}"
+: "${FREEBSD_ABI:=FreeBSD:15:amd64}"
+: "${FREEBSD_ARCH:=freebsd:15:x86:64}"
 : "${RUSTPROXY_SOURCE_DIR:?RUSTPROXY_SOURCE_DIR must point to a checked-out RustProxy repository}"
 : "${RUSTPROXY_SOURCE_URL:=https://git.linuxiarz.pl/gru/RustProxy}"
 : "${RUSTPROXY_SOURCE_REF:=HEAD}"
 : "${RUSTPROXY_SOURCE_COMMIT:=$(git -C "$RUSTPROXY_SOURCE_DIR" rev-parse HEAD)}"
 : "${RUSTPROXY_SOURCE_REVISION:=$(git -C "$RUSTPROXY_SOURCE_DIR" rev-list --count "$RUSTPROXY_SOURCE_COMMIT")}"
 
-if [[ ! -f "$RUSTPROXY_SOURCE_DIR/Cargo.toml" ]]; then
-    echo "RustProxy source directory is invalid: $RUSTPROXY_SOURCE_DIR" >&2
-    exit 1
-fi
-
-revision="$RUSTPROXY_SOURCE_REVISION"
-
-safe_value()
-{
-    [[ "$1" =~ ^[A-Za-z0-9_./:@+-]*$ ]]
-}
-
 publish_dist()
 {
     if [[ -z "${PUBLISH_TARGET:-}" ]]; then
         echo "PUBLISH_TARGET is empty; artifacts remain in $ROOT/dist"
         return 0
     fi
-    local ssh_cmd=(ssh)
+    local ssh_cmd=(ssh -o BatchMode=yes)
     if [[ -n "${PUBLISH_SSH_KEY:-}" ]]; then
         ssh_cmd+=( -i "$PUBLISH_SSH_KEY" )
     fi
@@ -46,72 +35,36 @@ publish_dist()
 auto_deploy_tests()
 {
     [[ -n "${AUTO_DEPLOY_HOSTS:-}" ]] || return 0
+    local package="$ROOT/dist/os-rustproxy-latest.pkg"
+    [[ -f "$package" ]] || { echo "Missing package for deployment: $package" >&2; exit 1; }
+
     for host in $AUTO_DEPLOY_HOSTS; do
-        echo "Upgrading RustProxy on test firewall: $host"
-        ssh_args=( -o BatchMode=yes )
+        echo "Deploying RustProxy to test firewall: $host"
+        local ssh_args=( -o BatchMode=yes )
         if [[ -n "${AUTO_DEPLOY_SSH_KEY:-}" ]]; then
             ssh_args+=( -i "$AUTO_DEPLOY_SSH_KEY" )
         fi
-        ssh "${ssh_args[@]}" "$host" \
-            'pkg update -f -r RustProxy && pkg install -y -r RustProxy os-rustproxy'
+        scp "${ssh_args[@]}" "$package" "$host:/tmp/os-rustproxy-latest.pkg"
+        ssh "${ssh_args[@]}" "$host" '
+            set -e
+            pkg add -f /tmp/os-rustproxy-latest.pkg
+            rm -f /tmp/os-rustproxy-latest.pkg
+            service configd restart
+            /usr/local/sbin/pluginctl -cq cache_flush >/dev/null 2>&1 || true
+            /usr/local/sbin/configctl template reload OPNsense/RustProxy >/dev/null 2>&1 || true
+        '
     done
 }
 
 case "$BUILD_MODE" in
-    native-freebsd)
-        : "${FREEBSD_HOST:?FREEBSD_HOST is required}"
-        : "${FREEBSD_USER:?FREEBSD_USER is required}"
-        : "${FREEBSD_REMOTE_DIR:?FREEBSD_REMOTE_DIR is required}"
-        for value in "$FREEBSD_HOST" "$FREEBSD_USER" "$FREEBSD_REMOTE_DIR" \
-                     "$OPNSENSE_PLUGINS_REF" "$OPNSENSE_ABI" \
-                     "${PKG_REPO_SIGN_KEY:-}" "${PKG_REPO_PUBLIC_KEY:-}" \
-                     "$RUSTPROXY_SOURCE_URL" "$RUSTPROXY_SOURCE_REF" \
-                     "$RUSTPROXY_SOURCE_COMMIT" "$revision"; do
-            if ! safe_value "$value"; then
-                echo "Unsafe character in builder configuration value: $value" >&2
-                exit 1
-            fi
-        done
-
-        ssh_args=( -o BatchMode=yes )
-        if [[ -n "${FREEBSD_SSH_KEY:-}" ]]; then
-            ssh_args+=( -i "$FREEBSD_SSH_KEY" )
-        fi
-        remote="${FREEBSD_USER}@${FREEBSD_HOST}"
-        ssh "${ssh_args[@]}" "$remote" "mkdir -p '$FREEBSD_REMOTE_DIR' '$FREEBSD_REMOTE_DIR/app'"
-
-        # Send packaging/plugin sources separately from the application source.
-        rsync -az --delete \
-            --exclude .git/ --exclude app/ --exclude dist/ --exclude .cache/ \
-            -e "ssh ${ssh_args[*]}" \
-            "$ROOT/" "$remote:$FREEBSD_REMOTE_DIR/"
-
-        rsync -az --delete \
-            --exclude .git/ --exclude target/ \
-            -e "ssh ${ssh_args[*]}" \
-            "$RUSTPROXY_SOURCE_DIR/" "$remote:$FREEBSD_REMOTE_DIR/app/"
-
-        remote_command="OPNSENSE_PLUGINS_REF=$OPNSENSE_PLUGINS_REF OPNSENSE_ABI=$OPNSENSE_ABI RUSTPROXY_SOURCE_URL=$RUSTPROXY_SOURCE_URL RUSTPROXY_SOURCE_REF=$RUSTPROXY_SOURCE_REF RUSTPROXY_SOURCE_COMMIT=$RUSTPROXY_SOURCE_COMMIT SOURCE_REVISION=$revision"
-        if [[ -n "${PKG_REPO_SIGN_KEY:-}" ]]; then
-            remote_command+=" PKG_REPO_SIGN_KEY=$PKG_REPO_SIGN_KEY"
-        fi
-        if [[ -n "${PKG_REPO_PUBLIC_KEY:-}" ]]; then
-            remote_command+=" PKG_REPO_PUBLIC_KEY=$PKG_REPO_PUBLIC_KEY"
-        fi
-        remote_command+=" sh '$FREEBSD_REMOTE_DIR/builder/freebsd/build-release.sh' '$FREEBSD_REMOTE_DIR'"
-        ssh "${ssh_args[@]}" "$remote" "$remote_command"
-
-        rm -rf "$ROOT/dist"
-        mkdir -p "$ROOT/dist"
-        rsync -az -e "ssh ${ssh_args[*]}" "$remote:$FREEBSD_REMOTE_DIR/dist/" "$ROOT/dist/"
-        ;;
-    cross-binary)
-        RUSTPROXY_SOURCE_DIR="$RUSTPROXY_SOURCE_DIR" "$ROOT/builder/debian/build-freebsd-cross.sh"
-        echo "Cross mode builds a binary only and is not accepted as a release package pipeline."
-        exit 0
+    docker-freebsd)
+        export OPNSENSE_ABI FREEBSD_RELEASE FREEBSD_ABI FREEBSD_ARCH
+        export RUSTPROXY_SOURCE_DIR RUSTPROXY_SOURCE_URL RUSTPROXY_SOURCE_REF
+        export RUSTPROXY_SOURCE_COMMIT RUSTPROXY_SOURCE_REVISION
+        "$ROOT/builder/debian/build-docker-release.sh"
         ;;
     *)
-        echo "Unknown BUILD_MODE: $BUILD_MODE" >&2
+        echo "Unsupported BUILD_MODE: $BUILD_MODE. Use docker-freebsd." >&2
         exit 1
         ;;
 esac