Chris Nennemann
db46b72f58
- Create quicproquo-ffi crate with 7 extern "C" functions: connect, login, send, receive, disconnect, last_error, free_string (produces libquicproquo_ffi.so and .a) - Feature-gate quicproquo-core for WASM: identity, hybrid_kem, safety_numbers, sealed_sender, app_message, padding, transcript all compile to wasm32-unknown-unknown - Add Python ctypes example (examples/python/qpq_client.py) with QpqClient wrapper class and CLI - Add SDK documentation: FFI reference, WASM guide, qpq-gen generators - Update Dockerfile for quicproquo-ffi workspace member
110 lines
4.7 KiB
Docker
110 lines
4.7 KiB
Docker
# ── Stage 1: Builder ──────────────────────────────────────────────────────────
|
|
#
|
|
# Uses the official Rust image on Debian Bookworm.
|
|
# capnproto is installed here because build.rs invokes `capnp` at compile time.
|
|
FROM rust:bookworm AS builder
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends capnproto \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /build
|
|
|
|
# Copy manifests first so dependency layers are cached independently of source.
|
|
COPY Cargo.toml Cargo.lock ./
|
|
COPY crates/quicproquo-core/Cargo.toml crates/quicproquo-core/Cargo.toml
|
|
COPY crates/quicproquo-proto/Cargo.toml crates/quicproquo-proto/Cargo.toml
|
|
COPY crates/quicproquo-server/Cargo.toml crates/quicproquo-server/Cargo.toml
|
|
COPY crates/quicproquo-client/Cargo.toml crates/quicproquo-client/Cargo.toml
|
|
COPY crates/quicproquo-p2p/Cargo.toml crates/quicproquo-p2p/Cargo.toml
|
|
COPY crates/quicproquo-bot/Cargo.toml crates/quicproquo-bot/Cargo.toml
|
|
COPY crates/quicproquo-gen/Cargo.toml crates/quicproquo-gen/Cargo.toml
|
|
COPY crates/quicproquo-kt/Cargo.toml crates/quicproquo-kt/Cargo.toml
|
|
COPY crates/quicproquo-plugin-api/Cargo.toml crates/quicproquo-plugin-api/Cargo.toml
|
|
COPY crates/quicproquo-gui/Cargo.toml crates/quicproquo-gui/Cargo.toml
|
|
COPY crates/quicproquo-mobile/Cargo.toml crates/quicproquo-mobile/Cargo.toml
|
|
COPY crates/quicproquo-ffi/Cargo.toml crates/quicproquo-ffi/Cargo.toml
|
|
|
|
# Create dummy source files so `cargo build` can resolve the dependency graph
|
|
# and cache the compiled dependencies before copying real source.
|
|
RUN mkdir -p \
|
|
crates/quicproquo-core/src \
|
|
crates/quicproquo-proto/src \
|
|
crates/quicproquo-server/src \
|
|
crates/quicproquo-client/src \
|
|
crates/quicproquo-p2p/src \
|
|
crates/quicproquo-bot/src \
|
|
crates/quicproquo-gen/src \
|
|
crates/quicproquo-kt/src \
|
|
crates/quicproquo-plugin-api/src \
|
|
crates/quicproquo-gui/src \
|
|
crates/quicproquo-mobile/src \
|
|
crates/quicproquo-ffi/src \
|
|
&& echo 'fn main() {}' > crates/quicproquo-server/src/main.rs \
|
|
&& echo 'fn main() {}' > crates/quicproquo-client/src/main.rs \
|
|
&& echo 'fn main() {}' > crates/quicproquo-gen/src/main.rs \
|
|
&& echo 'fn main() {}' > crates/quicproquo-bot/src/main.rs \
|
|
&& touch crates/quicproquo-core/src/lib.rs \
|
|
&& touch crates/quicproquo-proto/src/lib.rs \
|
|
&& touch crates/quicproquo-p2p/src/lib.rs \
|
|
&& touch crates/quicproquo-kt/src/lib.rs \
|
|
&& touch crates/quicproquo-plugin-api/src/lib.rs \
|
|
&& touch crates/quicproquo-gui/src/lib.rs \
|
|
&& touch crates/quicproquo-mobile/src/lib.rs \
|
|
&& touch crates/quicproquo-ffi/src/lib.rs
|
|
|
|
# Schemas must exist before the proto crate's build.rs runs.
|
|
COPY schemas/ schemas/
|
|
|
|
# Build dependencies only (source stubs mean this layer is cache-friendly).
|
|
RUN cargo build --release --bin qpq-server 2>/dev/null || true
|
|
|
|
# Copy real source and build for real.
|
|
COPY crates/ crates/
|
|
|
|
# Touch source to force re-compilation after copying real crates.
|
|
RUN touch \
|
|
crates/quicproquo-core/src/lib.rs \
|
|
crates/quicproquo-proto/src/lib.rs \
|
|
crates/quicproquo-p2p/src/lib.rs \
|
|
crates/quicproquo-kt/src/lib.rs \
|
|
crates/quicproquo-plugin-api/src/lib.rs \
|
|
crates/quicproquo-server/src/main.rs \
|
|
crates/quicproquo-client/src/main.rs
|
|
|
|
RUN cargo build --release --bin qpq-server
|
|
|
|
# ── Stage 2: Runtime ──────────────────────────────────────────────────────────
|
|
#
|
|
# Minimal Debian Bookworm image — no Rust toolchain, no capnp compiler.
|
|
FROM debian:bookworm-slim AS runtime
|
|
|
|
# ca-certificates is included so future HTTPS calls (e.g. from M6 key sync)
|
|
# work without further changes to this stage.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=builder /build/target/release/qpq-server /usr/local/bin/qpq-server
|
|
|
|
# Create a dedicated non-root user with a writable data directory.
|
|
RUN groupadd --system qpq \
|
|
&& useradd --system --gid qpq --no-create-home --shell /usr/sbin/nologin qpq \
|
|
&& mkdir -p /var/lib/quicproquo \
|
|
&& chown qpq:qpq /var/lib/quicproquo
|
|
|
|
EXPOSE 7000
|
|
|
|
ENV RUST_LOG=info \
|
|
QPQ_LISTEN=0.0.0.0:7000 \
|
|
QPQ_DATA_DIR=/var/lib/quicproquo \
|
|
QPQ_TLS_CERT=/var/lib/quicproquo/server-cert.der \
|
|
QPQ_TLS_KEY=/var/lib/quicproquo/server-key.der
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
|
CMD test -f /var/lib/quicproquo/server-cert.der || exit 1
|
|
|
|
USER qpq
|
|
|
|
CMD ["qpq-server"]
|