RustProxy OPNsense packaging repository

Docker-only build pipeline for RustProxy on Debian. No FreeBSD VM is required.

RustProxy itself is not stored here. Every scheduled run fetches it independently from:

https://git.linuxiarz.pl/gru/RustProxy

Flow

rustproxy-opnsense-repo             RustProxy upstream
          |                              |
          +--------------+---------------+
                         v
                  Debian cron hourly
                         |
                         v
              Docker cross-build image
       Rust 1.88 + clang/lld + FreeBSD 15.1 sysroot
                         |
                         v
             x86_64-unknown-freebsd binary
                         |
                         v
              Linux-side .pkg assembly
                         |
                         v
        dist/os-rustproxy-latest.pkg
                         |
                         v
              pkg add -f on OPNsense

The Docker container does not emulate FreeBSD. It runs on the Linux kernel and uses the FreeBSD 15.1 headers/libraries only as a cross-compilation sysroot.

Repository contents

• opnsense-plugin/www/rustproxy/ - OPNsense plugin source.
• builder/docker/Dockerfile - Rust/Clang FreeBSD 15.1 cross toolchain.
• builder/debian/hourly-build.sh - fetch/change detection scheduler.
• builder/debian/build-docker-release.sh - Docker build orchestration.
• builder/debian/package-freebsd.sh - creates a FreeBSD .pkg archive on Linux.
• ci/build-release.sh - build/publish/test-deploy entrypoint.
• deploy/opnsense/install-direct.sh - direct package installer for OPNsense.
• docs/FIRST_RUN.md - exact first-run commands.

Build trigger

A build starts when either:

• this packaging repository changes, or
• the fetched RustProxy commit changes.

APP_REPO_REF=HEAD follows the current default branch. A tag or branch can be pinned in /etc/rustproxy-opnsense-builder.env.

Output

After a successful run:

dist/
├── BUILD-INFO.txt
├── SHA256
├── os-rustproxy-latest.pkg
├── docker-build/rust-proxy
└── packages/26.7/amd64/os-rustproxy-<version>_<revision>.pkg

This version intentionally produces an installable .pkg, not a full pkg repo catalogue. Installation/update is currently done with pkg add -f.

The Linux-side package builder validates the FreeBSD package payload before publishing it: payload paths must be absolute (/usr/local/...), no undeclared directory entries are archived, and every payload file must have an identical entry in +MANIFEST.

OPNsense UI

The OPNsense page Services -> RustProxy exposes enable/disable plus HTTP, HTTPS/TLS and administration listener settings. RustProxy runs as the unprivileged rustproxy user.

Validation

./scripts/check.sh

See docs/FIRST_RUN.md for Debian setup.

OPNsense listener settings

The OPNsense page Services -> RustProxy exposes the runtime listeners used by the rc.d service:

• HTTP listen: 0.0.0.0:8080
• HTTPS/TLS listen: 0.0.0.0:8181 (toggleable)
• Admin listen: 127.0.0.1:9090
• Allow remote admin: off by default; enable it when binding admin to a non-loopback address such as 0.0.0.0:9090

The service runs as the unprivileged rustproxy user and keeps /var/db/rustproxy mode 0700, as required by RustProxy. Package installation restarts configd so configctl rustproxy ... actions are immediately available even after direct pkg add.