4.3 KiB
First run on Debian
Everything below assumes the working root is /opt/opn-rustproxy.
1. Checkout
sudo mkdir -p /opt/opn-rustproxy
sudo chown -R "$USER:$USER" /opt/opn-rustproxy
cd /opt/opn-rustproxy
git clone https://git.linuxiarz.pl/gru/rustproxy-opnsense-repo packaging
cd packaging
RustProxy is intentionally not cloned manually. The scheduler fetches it to /opt/opn-rustproxy/source/RustProxy.
2. Install Debian dependencies
sudo bash builder/debian/install.sh
This installs Docker, cron, Git, zstd and the scheduler, then starts docker and cron.
3. Configure
sudo editor /etc/rustproxy-opnsense-builder.env
For the basic local build, use:
PACKAGING_REPO_URL=https://git.linuxiarz.pl/gru/rustproxy-opnsense-repo
PACKAGING_REPO_REF=HEAD
PACKAGING_WORKDIR=/opt/opn-rustproxy/packaging
APP_REPO_URL=https://git.linuxiarz.pl/gru/RustProxy
APP_REPO_REF=HEAD
APP_WORKDIR=/opt/opn-rustproxy/source/RustProxy
STATE_DIR=/var/lib/rustproxy-opnsense-builder
DOCKER_CACHE_DIR=/opt/opn-rustproxy/cache
BUILD_MODE=docker-freebsd
FREEBSD_RELEASE=15.1-RELEASE
FREEBSD_ABI=FreeBSD:15:amd64
FREEBSD_ARCH=freebsd:15:x86:64
OPNSENSE_ABI=26.7
DOCKER_IMAGE=rustproxy-freebsd15-builder:15.1-rust1.88
RUN_LINUX_TESTS=1
PUBLISH_TARGET=
PUBLISH_SSH_KEY=
AUTO_DEPLOY_HOSTS=
AUTO_DEPLOY_SSH_KEY=
4. Validate repository scripts
cd /opt/opn-rustproxy/packaging
./scripts/check.sh
5. First build
sudo /usr/local/sbin/rustproxy-opnsense-hourly 2>&1 | sudo tee -a /var/log/rustproxy-opnsense-builder.log
The first run downloads the RustProxy Git checkout and the FreeBSD 15.1 sysroot, then builds the Docker image. Later runs reuse Docker/Cargo caches. RustProxy's build also downloads crates and pinned Swagger UI assets, so the builder needs outbound HTTPS access.
Follow the log with:
sudo tail -f /var/log/rustproxy-opnsense-builder.log
6. Verify output
cd /opt/opn-rustproxy/packaging
cat dist/BUILD-INFO.txt
cat dist/SHA256
file dist/docker-build/rust-proxy
zstd -dc dist/os-rustproxy-latest.pkg | tar -tf - | head -50
The package payload should contain files such as /usr/local/sbin/rust-proxy and must not contain directory entries such as /usr/ or /usr/local/. The build fails automatically when payload paths differ from +MANIFEST.
The binary should identify as an x86-64 FreeBSD ELF executable, not a Linux executable.
7. Install on a test OPNsense
Copy the package and installer:
scp dist/os-rustproxy-latest.pkg root@OPNSENSE_IP:/tmp/
scp deploy/opnsense/install-direct.sh root@OPNSENSE_IP:/tmp/
Then:
ssh root@OPNSENSE_IP
sh /tmp/install-direct.sh /tmp/os-rustproxy-latest.pkg
Open Services -> RustProxy, enable it and click Apply.
Useful checks on OPNsense:
pkg info os-rustproxy
file /usr/local/sbin/rust-proxy
service rustproxy status
tail -f /var/log/rustproxy/rustproxy.log
8. Hourly scheduler
/etc/cron.d/rustproxy-opnsense runs at minute 17 each hour:
17 * * * * root /usr/local/sbin/rustproxy-opnsense-hourly >> /var/log/rustproxy-opnsense-builder.log 2>&1
No rebuild occurs when both Git SHAs are unchanged. A failed build does not advance the successful-state marker and will be retried later.
9. Optional test-firewall auto deploy
Only for explicitly named test firewalls:
AUTO_DEPLOY_HOSTS="root@10.0.0.10"
AUTO_DEPLOY_SSH_KEY=/root/.ssh/opnsense_test
Leave both empty for manual deployment.
OPNsense runtime settings
After installation open Services -> RustProxy. Defaults are:
- HTTP listen:
0.0.0.0:8080 - HTTPS/TLS enabled: yes
- HTTPS/TLS listen:
0.0.0.0:8181 - Admin listen:
127.0.0.1:9090 - Allow remote admin: no
If you want the RustProxy administration UI reachable from another host, set the admin listener to an address such as 0.0.0.0:9090 and enable Allow remote admin. Apply restarts/reloads the service with the corresponding RustProxy CLI flags.
Direct pkg add is supported: the package post-install script restarts OPNsense configd, flushes the plugin cache and renders /usr/local/etc/rustproxy/opnsense.conf so configctl rustproxy status/start/stop is available immediately.
RustProxy requires its data directory to be private. The plugin enforces owner rustproxy:rustproxy and mode 0700 on /var/db/rustproxy before every start.