7 files changed, 115 insertions, 50 deletions
diff --git a/infra/Caddyfile b/infra/Caddyfile
index 424e129..7975f68 100644
--- a/infra/Caddyfile
+++ b/infra/Caddyfile
@@ -96,3 +96,13 @@ https://www.{{WKD_HOST}}:{{HTTPS_PORT}} {
     import https_security
     redir {{WKD_ORIGIN}}{uri} permanent
 }
+
+https://{{CHAT_HOST}}:{{HTTPS_PORT}} {
+    import https_security
+    reverse_proxy {{CHAT_UPSTREAM}}
+}
+
+https://www.{{CHAT_HOST}}:{{HTTPS_PORT}} {
+    import https_security
+    redir {{CHAT_PUBLIC_ORIGIN}}{uri} permanent
+}
diff --git a/infra/Caddyfile.local b/infra/Caddyfile.local
index 6e3508c..6f81a0a 100644
--- a/infra/Caddyfile.local
+++ b/infra/Caddyfile.local
@@ -34,3 +34,7 @@
         file_server
     }
 }
+
+http://{{CHAT_LOCAL_HOST}}:80 {
+    reverse_proxy {{CHAT_UPSTREAM}}
+}
diff --git a/infra/chat/build-native.sh b/infra/chat/build-native.sh
new file mode 100644
index 0000000..f882fef
--- /dev/null
+++ b/infra/chat/build-native.sh
@@ -0,0 +1,63 @@
+#!/bin/sh
+# Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+set -eu
+ROOT="$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)"
+TOOLS="$ROOT/.tools"
+SOURCE="$TOOLS/openssl-native-source"
+PREFIX="$TOOLS/openssl-musl"
+HEADERS="$TOOLS/alpine/usr/include"
+KERNEL="$TOOLS/kernel-headers"
+mkdir -p "$SOURCE" "$TOOLS/wasi-source" "$TOOLS/alpine" "$KERNEL"
+fetch() {
+    file="$1"
+    digest="$2"
+    url="$3"
+    if ! test -f "$file"; then
+        curl --fail --location --retry 2 "$url" --output "$file.download"
+        printf '%s  %s\n' "$digest" "$file.download" | sha256sum --check --status
+        mv "$file.download" "$file"
+    fi
+    printf '%s  %s\n' "$digest" "$file" | sha256sum --check
+}
+fetch "$TOOLS/wasi-source/openssl.tar.gz" a2157c2830efdec3788939b00c9b0638306d3f0bbb76dc4832ee503bb397df98 https://github.com/openssl/openssl/releases/download/openssl-3.6.5/openssl-3.6.5.tar.gz
+fetch "$TOOLS/musl-dev.apk" 310b51cff12e1d5ce5f135c558a82e2550427da5465bbd16c9ff9b05e63ee3d9 https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/musl-dev-1.2.6-r3.apk
+if ! test -f "$HEADERS/stdio.h"; then tar -xzf "$TOOLS/musl-dev.apk" -C "$TOOLS/alpine" usr/include; fi
+if ! test -f "$SOURCE/openssl-3.6.5/Configure"; then tar -xzf "$TOOLS/wasi-source/openssl.tar.gz" -C "$SOURCE"; fi
+GCC_INCLUDE="$(cc -print-file-name=include)"
+KERNEL_ASM=/usr/include/asm
+if ! test -d "$KERNEL_ASM"; then KERNEL_ASM="/usr/include/$(cc -dumpmachine)/asm"; fi
+test -f /usr/include/linux/mman.h
+test -d "$KERNEL_ASM"
+ln -sfn /usr/include/linux "$KERNEL/linux"
+ln -sfn "$KERNEL_ASM" "$KERNEL/asm"
+ln -sfn /usr/include/asm-generic "$KERNEL/asm-generic"
+MUSL_CC="cc -nostdinc -isystem $HEADERS -isystem $GCC_INCLUDE -idirafter $KERNEL"
+STAMP="$(sha256sum "$ROOT/infra/chat/build-native.sh" | cut -d' ' -f1)"
+if ! test -f "$PREFIX/.stack-build" || ! test "$(cat "$PREFIX/.stack-build")" = "$STAMP"; then
+    cd "$SOURCE/openssl-3.6.5"
+    env CC="$MUSL_CC" ./Configure linux-x86_64 no-shared no-module no-dso no-tests no-autoload-config --with-rand-seed=getrandom --prefix="$PREFIX" --libdir=lib
+    make -j"${CHAT_BUILD_JOBS:-8}" build_libs
+    make install_dev
+    printf '%s\n' "$STAMP" > "$PREFIX/.stack-build"
+fi
+cd "$ROOT"
+rustup target add x86_64-unknown-linux-musl
+env OPENSSL_DIR="$PREFIX" OPENSSL_STATIC=1 CC_x86_64_unknown_linux_musl="$MUSL_CC" \
+    BINDGEN_EXTRA_CLANG_ARGS_x86_64_unknown_linux_musl="-nostdinc -isystem $HEADERS -isystem $GCC_INCLUDE -idirafter $KERNEL" \
+    cargo build --locked --release --target x86_64-unknown-linux-musl -p stack -p stack-chat-server -p stack-chat-crypto
+"$ROOT/target/x86_64-unknown-linux-musl/release/stack-chat-crypto"
+file "$ROOT/target/x86_64-unknown-linux-musl/release/stack-chat-server"
diff --git a/infra/containers/cgit/cgitrc b/infra/containers/cgit/cgitrc
index 0dacb99..fb9cae8 100644
--- a/infra/containers/cgit/cgitrc
+++ b/infra/containers/cgit/cgitrc
@@ -24,6 +24,4 @@ defbranch=main
 cache-root=/var/cache/cgit
 cache-size=1000
 cache-scanrc-ttl=1
-readme=:web/THIRD-PARTY-LICENSES.html
-about-filter=lua:/etc/cgit-license.lua
 scan-path=/srv/git
diff --git a/infra/containers/cgit/license.lua b/infra/containers/cgit/license.lua
deleted file mode 100644
index ff5685f..0000000
--- a/infra/containers/cgit/license.lua
+++ /dev/null
@@ -1,47 +0,0 @@
--- Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
---
--- This program is free software: you can redistribute it and/or modify
--- it under the terms of the GNU Affero General Public License as
--- published by the Free Software Foundation, either version 3 of the
--- License, or (at your option) any later version.
---
--- This program is distributed in the hope that it will be useful,
--- but WITHOUT ANY WARRANTY; without even the implied warranty of
--- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
--- GNU Affero General Public License for more details.
---
--- You should have received a copy of the GNU Affero General Public License
--- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-local chunks = {}
-local rendered = false
-
-function filter_open(filename)
-    chunks = {}
-    rendered = filename == "web/THIRD-PARTY-LICENSES.html"
-end
-
-function filter_write(buffer)
-    if rendered then
-        chunks[#chunks + 1] = buffer
-    else
-        html_txt(buffer)
-    end
-end
-
-function filter_close()
-    if rendered then
-        local query = os.getenv("QUERY_STRING") or ""
-        local suffix = query ~= "" and ("?" .. query) or ""
-        html('<nav aria-label="License views"><strong>Rendered</strong> | <a href="')
-        html_attr("../tree/web/THIRD-PARTY-LICENSES.html" .. suffix)
-        html('">Source</a> | <a href="')
-        html_attr("../plain/web/THIRD-PARTY-LICENSES.html" .. suffix)
-        html('">Raw</a></nav>')
-        html('<iframe title="Third-party licenses" sandbox="" referrerpolicy="no-referrer" style="width:100%;height:80vh;border:0" srcdoc="')
-        html_attr([[<!doctype html><meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'">]])
-        html_attr(table.concat(chunks))
-        html('"></iframe>')
-    end
-    return 0
-end
diff --git a/infra/containers/chat/Containerfile b/infra/containers/chat/Containerfile
new file mode 100644
index 0000000..a63683e
--- /dev/null
+++ b/infra/containers/chat/Containerfile
@@ -0,0 +1,27 @@
+# Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+FROM scratch
+COPY server /app/bin/server
+COPY crypto.wasm /app/bin/chat/crypto.wasm
+COPY SOURCE.tar.gz /app/bin/chat/SOURCE.tar.gz
+COPY web /app/crates/chat-server/web
+COPY wasi.mjs /app/crates/chat-crypto/browser/wasi.mjs
+COPY CHAT-APPLICATION.txt /app/docs/CHAT-APPLICATION.txt
+COPY CHAT-PRODUCTION.txt /app/docs/CHAT-PRODUCTION.txt
+COPY LICENSE /app/LICENSE
+WORKDIR /app
+EXPOSE 8080
+ENTRYPOINT ["/app/bin/server", "--root", "/app", "--proxy"]
diff --git a/infra/services.toml b/infra/services.toml
index f352d68..7fea853 100644
--- a/infra/services.toml
+++ b/infra/services.toml
@@ -33,7 +33,6 @@ health = ["curl", "--fail", "--silent", "--max-time", "3", "http://127.0.0.1:808
 mounts = [
     { source = "var/data/repos", target = "/srv/git", read_only = true },
     { source = "@cgit", target = "/etc/cgitrc", read_only = true },
-    { source = "infra/containers/cgit/license.lua", target = "/etc/cgit-license.lua", read_only = true },
 ]
 tmpfs = ["/run", "/var/cache/cgit"]
 
@@ -46,3 +45,14 @@ mounts = [
     { source = "var/data/searxng", target = "/etc/searxng" },
 ]
 tmpfs = ["/var/cache/searxng:mode=1777"]
+
+[services.chat]
+image = "localhost/stack-chat:0.1.0"
+build = "bin/chat"
+drop_capabilities = true
+read_only = true
+health = ["/app/bin/server", "--root", "/app", "--proxy", "--healthcheck"]
+environment = ["CHAT_SETUP_TOKEN"]
+mounts = [
+    { source = "@chat", target = "/app/var/data/chat" },
+]