Julius Joska
8b452a5593
- stop counting ACK and Pong frames toward the per-connection frame window; draining a large queue used to trip the 429 limit, disconnect the client and, after eight rounds, drop the remaining envelopes - deliver to online recipients with try_send: a recipient that stops reading its socket no longer pins the sender's task and memory - throttle call wake-ups per recipient (1 per 10 s, 6 per 10 min) and ordinary wake-ups (1 per 5 s); collapse ids for APNs and FCM - POST /v1/register accepts X-Sepot-Identity-Proof and lets a new device take over an existing identity (restore from the recovery phrase) - POST /v1/keys uploads one-time prekeys and rotates signed/Kyber prekeys; PrekeysLow is sent after AUTH when fewer than 20 remain - GET /v1/keys hands out at most 30 one-time prekeys per address per hour - reqwest errors are logged without the URL; UnifiedPush POSTs pin the addresses the SSRF guard resolved; NAT64/6to4 embedded addresses are checked - absolute AUTH deadline, at most 3 AUTH attempts, length limits on push endpoints and VoIP tokens - TURN credentials live 12 h and are reissued per connection every 10 min - global attachment storage cap (SEPOT_ATTACHMENTS_TOTAL_BYTES), nosniff and attachment disposition on downloads - SEPOT_MAX_CONNS_PER_IP, /v1/ready backed by the database, graceful shutdown, RLIMIT_NOFILE raised to the hard limit, server-info reports source and revision - Dockerfile: rust 1.99, GIT_SHA build arg for the image label and SEPOT_REVISION; Tor image on alpine 3.24
44 lines
1.9 KiB
Docker
44 lines
1.9 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# sepot-relay — multi-stage build (kontext = kořen monorepa, viz compose)
|
|
#
|
|
# Build stage potřebuje: protoc (prost-build generuje z proto/sepot.proto),
|
|
# git (libsignal-protocol je git dependency s [patch.crates-io] zrcadlem).
|
|
|
|
FROM rust:1.99-slim AS build
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
protobuf-compiler git pkg-config build-essential cmake \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
WORKDIR /src
|
|
COPY proto/ proto/
|
|
COPY rust/ rust/
|
|
WORKDIR /src/rust
|
|
# Cache mounty: rebuild po změně zdrojáků nekompiluje závislosti znovu.
|
|
# Binárka se musí zkopírovat VEN z cache mountu (po RUN kroku zmizí).
|
|
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/usr/local/cargo/git \
|
|
--mount=type=cache,target=/src/rust/target \
|
|
cargo build --release -p sepot-relay \
|
|
&& cp target/release/sepot-relay /sepot-relay
|
|
|
|
FROM debian:bookworm-slim
|
|
# Revize zdroje: label pro `docker inspect` a env pro /v1/server-info
|
|
# (AGPL §13 — uživatel relaye má vědět, který commit běží).
|
|
ARG GIT_SHA=dev
|
|
LABEL org.opencontainers.image.revision=$GIT_SHA \
|
|
org.opencontainers.image.source="https://github.com/juliusjoska/sepot"
|
|
ENV SEPOT_REVISION=$GIT_SHA
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates curl \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& useradd -r -s /usr/sbin/nologin sepot \
|
|
# předvytvořit s právy sepot — named volume zdědí ownership z image
|
|
&& mkdir -p /var/lib/sepot/attachments \
|
|
&& chown -R sepot /var/lib/sepot
|
|
COPY --from=build /sepot-relay /usr/local/bin/sepot-relay
|
|
USER sepot
|
|
EXPOSE 8470
|
|
# Migrace (sqlx::migrate!) jsou zakompilované v binárce, běží při startu
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s \
|
|
CMD curl -fsS http://127.0.0.1:8470/v1/health || exit 1
|
|
CMD ["sepot-relay"]
|