1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
PROJECT CONVENTIONS
License: GNU Affero General Public License, version 3 or later.
SPDX identifier: AGPL-3.0-or-later.
Copyright holder: Doan Luu Duc Tai <doan@luuduct.ai>, 2026.
Every nontrivial first-party source, configuration, template, and prose
file carries the AGPL copyright and permission header. LICENSE is the
unmodified license text. Binary public keys and empty WKD policy files
retain their protocol format. Generated Cargo.lock retains Cargo's own
metadata as well as the project notice.
Do not add explanatory source comments. Express intent through structure
and names. Legal headers are the required exception. Use .txt for prose
documentation. The generated HTML license page is an explicit exception.
Rust documentation attributes provide crate metadata without comments.
Keep configured secrets only in the root .env. Never commit .env or var/.
.env.example lists required keys with placeholders. Public hostnames,
public GPG keys, paths, configuration, and source belong in Git.
TLS account/certificate private keys, databases, and other generated
private state are persistent data in var/data, not .env configuration.
The GPG secret key and revocation certificate remain outside this project.
STRICTNESS
Preserve the requested Rust and Clippy deny groups, including pedantic
and nursery. The one additional exception is redundant_pub_crate: its
advice to make internal binary items public conflicts with unreachable_pub,
which remains denied. Internal interfaces remain explicitly crate-private.
No unsafe code, unwrap, expect, todo, debug output, arithmetic shortcuts,
or broad warning suppression is introduced.
cargo-deny rejects duplicate crate versions, wildcard requirements, unknown
registries, unknown Git sources, and yanked versions. There are no duplicate
version skip exceptions. Its AGPL allowance is scoped to this package.
The dependency allowlist retains the requested permissive licenses and
Zlib; an unused allowance may produce an informational audit warning.
Human license names follow https://www.gnu.org/licenses/license-list.html.
In particular, display Expat License for SPDX MIT. Do not alter original
copyright notices, legal texts, crate metadata, or machine SPDX identifiers.
cargo-about covers Rust dependencies. Supporting container applications
and their operating-system packages carry additional upstream licenses.
PORTABILITY
All first-party project files and state live below stack/. Standard host
integration consists of packages, subordinate UID/GID allocations, one
low-port sysctl setting, user linger, and a systemd user-service link.
Host SSH keys, firewall policy, accounts, and disks are host administration,
not application export contents.
Releases currently contain a static x86_64 Linux command and native
linux/amd64 container images. They are portable across compatible x86_64
Linux machines. An ARM machine needs a native release build; the command
rejects mismatched production images. Development mode may fetch/build
native images on an architecture mismatch. Container source and Rust
source are public so new targets can be added without restoring an OS.
|
