5 files changed, 116 insertions, 0 deletions
diff --git a/infra/Caddyfile b/infra/Caddyfile
index 424e129..7975f68 100644
--- a/infra/Caddyfile
+++ b/infra/Caddyfile
@@ -96,3 +96,13 @@ https://www.{{WKD_HOST}}:{{HTTPS_PORT}} {
     import https_security
     redir {{WKD_ORIGIN}}{uri} permanent
 }
+
+https://{{CHAT_HOST}}:{{HTTPS_PORT}} {
+    import https_security
+    reverse_proxy {{CHAT_UPSTREAM}}
+}
+
+https://www.{{CHAT_HOST}}:{{HTTPS_PORT}} {
+    import https_security
+    redir {{CHAT_PUBLIC_ORIGIN}}{uri} permanent
+}
diff --git a/infra/Caddyfile.local b/infra/Caddyfile.local
index 6e3508c..6f81a0a 100644
--- a/infra/Caddyfile.local
+++ b/infra/Caddyfile.local
@@ -34,3 +34,7 @@
         file_server
     }
 }
+
+http://{{CHAT_LOCAL_HOST}}:80 {
+    reverse_proxy {{CHAT_UPSTREAM}}
+}
diff --git a/infra/chat/build-native.sh b/infra/chat/build-native.sh
new file mode 100644
index 0000000..f882fef
--- /dev/null
+++ b/infra/chat/build-native.sh
@@ -0,0 +1,63 @@
+#!/bin/sh
+# Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+set -eu
+ROOT="$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)"
+TOOLS="$ROOT/.tools"
+SOURCE="$TOOLS/openssl-native-source"
+PREFIX="$TOOLS/openssl-musl"
+HEADERS="$TOOLS/alpine/usr/include"
+KERNEL="$TOOLS/kernel-headers"
+mkdir -p "$SOURCE" "$TOOLS/wasi-source" "$TOOLS/alpine" "$KERNEL"
+fetch() {
+    file="$1"
+    digest="$2"
+    url="$3"
+    if ! test -f "$file"; then
+        curl --fail --location --retry 2 "$url" --output "$file.download"
+        printf '%s  %s\n' "$digest" "$file.download" | sha256sum --check --status
+        mv "$file.download" "$file"
+    fi
+    printf '%s  %s\n' "$digest" "$file" | sha256sum --check
+}
+fetch "$TOOLS/wasi-source/openssl.tar.gz" a2157c2830efdec3788939b00c9b0638306d3f0bbb76dc4832ee503bb397df98 https://github.com/openssl/openssl/releases/download/openssl-3.6.5/openssl-3.6.5.tar.gz
+fetch "$TOOLS/musl-dev.apk" 310b51cff12e1d5ce5f135c558a82e2550427da5465bbd16c9ff9b05e63ee3d9 https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/musl-dev-1.2.6-r3.apk
+if ! test -f "$HEADERS/stdio.h"; then tar -xzf "$TOOLS/musl-dev.apk" -C "$TOOLS/alpine" usr/include; fi
+if ! test -f "$SOURCE/openssl-3.6.5/Configure"; then tar -xzf "$TOOLS/wasi-source/openssl.tar.gz" -C "$SOURCE"; fi
+GCC_INCLUDE="$(cc -print-file-name=include)"
+KERNEL_ASM=/usr/include/asm
+if ! test -d "$KERNEL_ASM"; then KERNEL_ASM="/usr/include/$(cc -dumpmachine)/asm"; fi
+test -f /usr/include/linux/mman.h
+test -d "$KERNEL_ASM"
+ln -sfn /usr/include/linux "$KERNEL/linux"
+ln -sfn "$KERNEL_ASM" "$KERNEL/asm"
+ln -sfn /usr/include/asm-generic "$KERNEL/asm-generic"
+MUSL_CC="cc -nostdinc -isystem $HEADERS -isystem $GCC_INCLUDE -idirafter $KERNEL"
+STAMP="$(sha256sum "$ROOT/infra/chat/build-native.sh" | cut -d' ' -f1)"
+if ! test -f "$PREFIX/.stack-build" || ! test "$(cat "$PREFIX/.stack-build")" = "$STAMP"; then
+    cd "$SOURCE/openssl-3.6.5"
+    env CC="$MUSL_CC" ./Configure linux-x86_64 no-shared no-module no-dso no-tests no-autoload-config --with-rand-seed=getrandom --prefix="$PREFIX" --libdir=lib
+    make -j"${CHAT_BUILD_JOBS:-8}" build_libs
+    make install_dev
+    printf '%s\n' "$STAMP" > "$PREFIX/.stack-build"
+fi
+cd "$ROOT"
+rustup target add x86_64-unknown-linux-musl
+env OPENSSL_DIR="$PREFIX" OPENSSL_STATIC=1 CC_x86_64_unknown_linux_musl="$MUSL_CC" \
+    BINDGEN_EXTRA_CLANG_ARGS_x86_64_unknown_linux_musl="-nostdinc -isystem $HEADERS -isystem $GCC_INCLUDE -idirafter $KERNEL" \
+    cargo build --locked --release --target x86_64-unknown-linux-musl -p stack -p stack-chat-server -p stack-chat-crypto
+"$ROOT/target/x86_64-unknown-linux-musl/release/stack-chat-crypto"
+file "$ROOT/target/x86_64-unknown-linux-musl/release/stack-chat-server"
diff --git a/infra/containers/chat/Containerfile b/infra/containers/chat/Containerfile
new file mode 100644
index 0000000..ff97f05
--- /dev/null
+++ b/infra/containers/chat/Containerfile
@@ -0,0 +1,28 @@
+# Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+FROM scratch
+COPY server /app/bin/server
+COPY crypto.wasm /app/bin/chat/crypto.wasm
+COPY SOURCE.tar.gz /app/bin/chat/SOURCE.tar.gz
+COPY web /app/crates/chat-server/web
+COPY wasi.mjs /app/crates/chat-crypto/browser/wasi.mjs
+COPY THIRD-PARTY-LICENSES.html /app/web/THIRD-PARTY-LICENSES.html
+COPY CHAT-APPLICATION.txt /app/docs/CHAT-APPLICATION.txt
+COPY CHAT-PRODUCTION.txt /app/docs/CHAT-PRODUCTION.txt
+COPY LICENSE /app/LICENSE
+WORKDIR /app
+EXPOSE 8080
+ENTRYPOINT ["/app/bin/server", "--root", "/app", "--proxy"]
diff --git a/infra/services.toml b/infra/services.toml
index f352d68..09abfc5 100644
--- a/infra/services.toml
+++ b/infra/services.toml
@@ -46,3 +46,14 @@ mounts = [
     { source = "var/data/searxng", target = "/etc/searxng" },
 ]
 tmpfs = ["/var/cache/searxng:mode=1777"]
+
+[services.chat]
+image = "localhost/stack-chat:0.1.0"
+build = "bin/chat"
+drop_capabilities = true
+read_only = true
+health = ["/app/bin/server", "--root", "/app", "--proxy", "--healthcheck"]
+environment = ["CHAT_SETUP_TOKEN"]
+mounts = [
+    { source = "@chat", target = "/app/var/data/chat" },
+]