96 lines
3.5 KiB
Markdown
96 lines
3.5 KiB
Markdown
# RustProxy OPNsense packaging repository
|
|
|
|
Docker-only build pipeline for RustProxy on Debian. No FreeBSD VM is required.
|
|
|
|
RustProxy itself is not stored here. Every scheduled run fetches it independently from:
|
|
|
|
`https://git.linuxiarz.pl/gru/RustProxy`
|
|
|
|
## Flow
|
|
|
|
```text
|
|
rustproxy-opnsense-repo RustProxy upstream
|
|
| |
|
|
+--------------+---------------+
|
|
v
|
|
Debian cron hourly
|
|
|
|
|
v
|
|
Docker cross-build image
|
|
Rust 1.88 + clang/lld + FreeBSD 15.1 sysroot
|
|
|
|
|
v
|
|
x86_64-unknown-freebsd binary
|
|
|
|
|
v
|
|
Linux-side .pkg assembly
|
|
|
|
|
v
|
|
dist/os-rustproxy-latest.pkg
|
|
|
|
|
v
|
|
pkg add -f on OPNsense
|
|
```
|
|
|
|
The Docker container does not emulate FreeBSD. It runs on the Linux kernel and uses the FreeBSD 15.1 headers/libraries only as a cross-compilation sysroot.
|
|
|
|
## Repository contents
|
|
|
|
- `opnsense-plugin/www/rustproxy/` - OPNsense plugin source.
|
|
- `builder/docker/Dockerfile` - Rust/Clang FreeBSD 15.1 cross toolchain.
|
|
- `builder/debian/hourly-build.sh` - fetch/change detection scheduler.
|
|
- `builder/debian/build-docker-release.sh` - Docker build orchestration.
|
|
- `builder/debian/package-freebsd.sh` - creates a FreeBSD `.pkg` archive on Linux.
|
|
- `ci/build-release.sh` - build/publish/test-deploy entrypoint.
|
|
- `deploy/opnsense/install-direct.sh` - direct package installer for OPNsense.
|
|
- `docs/FIRST_RUN.md` - exact first-run commands.
|
|
|
|
## Build trigger
|
|
|
|
A build starts when either:
|
|
|
|
- this packaging repository changes, or
|
|
- the fetched RustProxy commit changes.
|
|
|
|
`APP_REPO_REF=HEAD` follows the current default branch. A tag or branch can be pinned in `/etc/rustproxy-opnsense-builder.env`.
|
|
|
|
## Output
|
|
|
|
After a successful run:
|
|
|
|
```text
|
|
dist/
|
|
├── BUILD-INFO.txt
|
|
├── SHA256
|
|
├── os-rustproxy-latest.pkg
|
|
├── docker-build/rust-proxy
|
|
└── packages/26.7/amd64/os-rustproxy-<version>_<revision>.pkg
|
|
```
|
|
|
|
This version intentionally produces an installable `.pkg`, not a full `pkg repo` catalogue. Installation/update is currently done with `pkg add -f`.
|
|
|
|
The Linux-side package builder validates the FreeBSD package payload before publishing it: payload paths must be absolute (`/usr/local/...`), no undeclared directory entries are archived, and every payload file must have an identical entry in `+MANIFEST`.
|
|
|
|
## OPNsense UI
|
|
|
|
The OPNsense page **Services -> RustProxy** exposes enable/disable plus HTTP, HTTPS/TLS and administration listener settings. RustProxy runs as the unprivileged `rustproxy` user.
|
|
|
|
## Validation
|
|
|
|
```sh
|
|
./scripts/check.sh
|
|
```
|
|
|
|
See `docs/FIRST_RUN.md` for Debian setup.
|
|
|
|
## OPNsense listener settings
|
|
|
|
The OPNsense page **Services -> RustProxy** exposes the runtime listeners used by the rc.d service:
|
|
|
|
- HTTP listen: `0.0.0.0:8080`
|
|
- HTTPS/TLS listen: `0.0.0.0:8181` (toggleable)
|
|
- Admin listen: `0.0.0.0:9090`
|
|
- Allow remote admin: on by default so the RustProxy panel can be reached from other hosts; OPNsense firewall rules still decide which networks can connect
|
|
|
|
The service runs as the unprivileged `rustproxy` user and keeps `/var/db/rustproxy` mode `0700`, as required by RustProxy. Package installation restarts `configd` so `configctl rustproxy ...` actions are immediately available even after direct `pkg add`.
|