From d809d86182ab802472ae7d5e74cab66ba7bfa397 Mon Sep 17 00:00:00 2001 From: Doan Luu Duc Tai Date: Sat, 31 Oct 2026 07:39:18 -0500 Subject: Package private chat for HTTPS and verify portable encrypted recovery --- infra/Caddyfile | 10 ++++++ infra/Caddyfile.local | 4 +++ infra/chat/build-native.sh | 63 +++++++++++++++++++++++++++++++++++++ infra/containers/chat/Containerfile | 28 +++++++++++++++++ infra/services.toml | 11 +++++++ 5 files changed, 116 insertions(+) create mode 100644 infra/chat/build-native.sh create mode 100644 infra/containers/chat/Containerfile (limited to 'infra') diff --git a/infra/Caddyfile b/infra/Caddyfile index 424e129..7975f68 100644 --- a/infra/Caddyfile +++ b/infra/Caddyfile @@ -96,3 +96,13 @@ https://www.{{WKD_HOST}}:{{HTTPS_PORT}} { import https_security redir {{WKD_ORIGIN}}{uri} permanent } + +https://{{CHAT_HOST}}:{{HTTPS_PORT}} { + import https_security + reverse_proxy {{CHAT_UPSTREAM}} +} + +https://www.{{CHAT_HOST}}:{{HTTPS_PORT}} { + import https_security + redir {{CHAT_PUBLIC_ORIGIN}}{uri} permanent +} diff --git a/infra/Caddyfile.local b/infra/Caddyfile.local index 6e3508c..6f81a0a 100644 --- a/infra/Caddyfile.local +++ b/infra/Caddyfile.local @@ -34,3 +34,7 @@ file_server } } + +http://{{CHAT_LOCAL_HOST}}:80 { + reverse_proxy {{CHAT_UPSTREAM}} +} diff --git a/infra/chat/build-native.sh b/infra/chat/build-native.sh new file mode 100644 index 0000000..f882fef --- /dev/null +++ b/infra/chat/build-native.sh @@ -0,0 +1,63 @@ +#!/bin/sh +# Copyright (C) 2026 Doan Luu Duc Tai +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +set -eu +ROOT="$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)" +TOOLS="$ROOT/.tools" +SOURCE="$TOOLS/openssl-native-source" +PREFIX="$TOOLS/openssl-musl" +HEADERS="$TOOLS/alpine/usr/include" +KERNEL="$TOOLS/kernel-headers" +mkdir -p "$SOURCE" "$TOOLS/wasi-source" "$TOOLS/alpine" "$KERNEL" +fetch() { + file="$1" + digest="$2" + url="$3" + if ! test -f "$file"; then + curl --fail --location --retry 2 "$url" --output "$file.download" + printf '%s %s\n' "$digest" "$file.download" | sha256sum --check --status + mv "$file.download" "$file" + fi + printf '%s %s\n' "$digest" "$file" | sha256sum --check +} +fetch "$TOOLS/wasi-source/openssl.tar.gz" a2157c2830efdec3788939b00c9b0638306d3f0bbb76dc4832ee503bb397df98 https://github.com/openssl/openssl/releases/download/openssl-3.6.5/openssl-3.6.5.tar.gz +fetch "$TOOLS/musl-dev.apk" 310b51cff12e1d5ce5f135c558a82e2550427da5465bbd16c9ff9b05e63ee3d9 https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/musl-dev-1.2.6-r3.apk +if ! test -f "$HEADERS/stdio.h"; then tar -xzf "$TOOLS/musl-dev.apk" -C "$TOOLS/alpine" usr/include; fi +if ! test -f "$SOURCE/openssl-3.6.5/Configure"; then tar -xzf "$TOOLS/wasi-source/openssl.tar.gz" -C "$SOURCE"; fi +GCC_INCLUDE="$(cc -print-file-name=include)" +KERNEL_ASM=/usr/include/asm +if ! test -d "$KERNEL_ASM"; then KERNEL_ASM="/usr/include/$(cc -dumpmachine)/asm"; fi +test -f /usr/include/linux/mman.h +test -d "$KERNEL_ASM" +ln -sfn /usr/include/linux "$KERNEL/linux" +ln -sfn "$KERNEL_ASM" "$KERNEL/asm" +ln -sfn /usr/include/asm-generic "$KERNEL/asm-generic" +MUSL_CC="cc -nostdinc -isystem $HEADERS -isystem $GCC_INCLUDE -idirafter $KERNEL" +STAMP="$(sha256sum "$ROOT/infra/chat/build-native.sh" | cut -d' ' -f1)" +if ! test -f "$PREFIX/.stack-build" || ! test "$(cat "$PREFIX/.stack-build")" = "$STAMP"; then + cd "$SOURCE/openssl-3.6.5" + env CC="$MUSL_CC" ./Configure linux-x86_64 no-shared no-module no-dso no-tests no-autoload-config --with-rand-seed=getrandom --prefix="$PREFIX" --libdir=lib + make -j"${CHAT_BUILD_JOBS:-8}" build_libs + make install_dev + printf '%s\n' "$STAMP" > "$PREFIX/.stack-build" +fi +cd "$ROOT" +rustup target add x86_64-unknown-linux-musl +env OPENSSL_DIR="$PREFIX" OPENSSL_STATIC=1 CC_x86_64_unknown_linux_musl="$MUSL_CC" \ + BINDGEN_EXTRA_CLANG_ARGS_x86_64_unknown_linux_musl="-nostdinc -isystem $HEADERS -isystem $GCC_INCLUDE -idirafter $KERNEL" \ + cargo build --locked --release --target x86_64-unknown-linux-musl -p stack -p stack-chat-server -p stack-chat-crypto +"$ROOT/target/x86_64-unknown-linux-musl/release/stack-chat-crypto" +file "$ROOT/target/x86_64-unknown-linux-musl/release/stack-chat-server" diff --git a/infra/containers/chat/Containerfile b/infra/containers/chat/Containerfile new file mode 100644 index 0000000..ff97f05 --- /dev/null +++ b/infra/containers/chat/Containerfile @@ -0,0 +1,28 @@ +# Copyright (C) 2026 Doan Luu Duc Tai +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +FROM scratch +COPY server /app/bin/server +COPY crypto.wasm /app/bin/chat/crypto.wasm +COPY SOURCE.tar.gz /app/bin/chat/SOURCE.tar.gz +COPY web /app/crates/chat-server/web +COPY wasi.mjs /app/crates/chat-crypto/browser/wasi.mjs +COPY THIRD-PARTY-LICENSES.html /app/web/THIRD-PARTY-LICENSES.html +COPY CHAT-APPLICATION.txt /app/docs/CHAT-APPLICATION.txt +COPY CHAT-PRODUCTION.txt /app/docs/CHAT-PRODUCTION.txt +COPY LICENSE /app/LICENSE +WORKDIR /app +EXPOSE 8080 +ENTRYPOINT ["/app/bin/server", "--root", "/app", "--proxy"] diff --git a/infra/services.toml b/infra/services.toml index f352d68..09abfc5 100644 --- a/infra/services.toml +++ b/infra/services.toml @@ -46,3 +46,14 @@ mounts = [ { source = "var/data/searxng", target = "/etc/searxng" }, ] tmpfs = ["/var/cache/searxng:mode=1777"] + +[services.chat] +image = "localhost/stack-chat:0.1.0" +build = "bin/chat" +drop_capabilities = true +read_only = true +health = ["/app/bin/server", "--root", "/app", "--proxy", "--healthcheck"] +environment = ["CHAT_SETUP_TOKEN"] +mounts = [ + { source = "@chat", target = "/app/var/data/chat" }, +] -- cgit v1.2.3