Šepot — end-to-end encrypted messenger

Initial public release. Anonymous on-device identity (no phone number,
e-mail, or password), Signal-protocol cryptography (X3DH + PQXDH, Double
Ratchet, sealed sender) via libsignal, a metadata-minimizing relay,
group chats, disappearing messages, encrypted local storage, optional
Tor transport, and a UI localized into Czech, English, German, Russian,
and Italian.

Monorepo: Flutter client (app/), Rust relay + wire types (rust/),
protobuf definitions (proto/), self-host deploy (deploy/).

Licensed under AGPL-3.0 with an app-store distribution exception (§7).

deploy/relay/Dockerfile

@@ -0,0 +1,37 @@
+# syntax=docker/dockerfile:1
+# sepot-relay — multi-stage build (kontext = kořen monorepa, viz compose)
+#
+# Build stage potřebuje: protoc (prost-build generuje z proto/sepot.proto),
+# git (libsignal-protocol je git dependency s [patch.crates-io] zrcadlem).
+
+FROM rust:1.96-slim AS build
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      protobuf-compiler git pkg-config build-essential cmake \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
+COPY proto/ proto/
+COPY rust/ rust/
+WORKDIR /src/rust
+# Cache mounty: rebuild po změně zdrojáků nekompiluje závislosti znovu.
+# Binárka se musí zkopírovat VEN z cache mountu (po RUN kroku zmizí).
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/src/rust/target \
+    cargo build --release -p sepot-relay \
+    && cp target/release/sepot-relay /sepot-relay
+
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates curl \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd -r -s /usr/sbin/nologin sepot \
+    # předvytvořit s právy sepot — named volume zdědí ownership z image
+    && mkdir -p /var/lib/sepot/attachments \
+    && chown -R sepot /var/lib/sepot
+COPY --from=build /sepot-relay /usr/local/bin/sepot-relay
+USER sepot
+EXPOSE 8470
+# Migrace (sqlx::migrate!) jsou zakompilované v binárce, běží při startu
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s \
+  CMD curl -fsS http://127.0.0.1:8470/v1/health || exit 1
+CMD ["sepot-relay"]