steve
c275f4ff4c
Lands the bottom three layers of Phase 1: P1-08 internal/api: protocol_version + envelope + every WS message shape from spec.md §6.2 (Hello, Heartbeat, Job*, Schedule*, etc). Wire-format tests pin the JSON shape so a rename here breaks tests instead of silently breaking the agent. P1-02 + P1-03 internal/store: SQLite via modernc.org/sqlite, embed.FS + a tiny version table for hand-rolled migrations. 0001_initial.sql covers every table from spec.md §5 plus enrollment_tokens and host_schedule_version. Typed accessors for users / sessions / enrollment / audit. WAL + foreign_keys + busy_timeout on by default. P1-06 internal/crypto: XChaCha20-Poly1305 AEAD wrapper with per-message random nonce. Key file lifecycle (generate + refuse-to-overwrite, load with size validation). Optional additionalData binds ciphertext to the row that owns it. P1-04 internal/auth (partial — passwords + tokens; sessions middleware lands with the HTTP handlers): argon2id following RFC 9106 (64 MiB / t=3 / p=4 / 32B), constant-time verify. HashToken stores SHA-256 of session/agent/enrollment tokens so a stolen DB doesn't hand over credentials. Build floor moves to Go 1.25 (modernc.org/sqlite v1.50+ requires it); CI + Dockerfile + README updated. Markdown lint diagnostics on tasks.md cleared. All packages tested. ~70 new tests pass in <1s. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
38 lines
1.0 KiB
Docker
38 lines
1.0 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# ---- Build stage --------------------------------------------------------
|
|
FROM golang:1.25-alpine AS build
|
|
|
|
WORKDIR /src
|
|
|
|
# Pure-Go SQLite (modernc.org/sqlite) means we can keep CGO off and build a
|
|
# fully static binary that runs on distroless/static.
|
|
ENV CGO_ENABLED=0 \
|
|
GOOS=linux \
|
|
GOFLAGS="-trimpath"
|
|
|
|
# Cache module downloads in a separate layer.
|
|
COPY go.mod go.sum* ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
ARG VERSION=dev
|
|
RUN go build -ldflags="-s -w -X main.version=${VERSION}" \
|
|
-o /out/restic-manager-server \
|
|
./cmd/server
|
|
|
|
# ---- Runtime stage ------------------------------------------------------
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
|
|
LABEL org.opencontainers.image.source="https://gitea.dcglab.co.uk/steve/restic-manager"
|
|
LABEL org.opencontainers.image.licenses="PolyForm-Noncommercial-1.0.0"
|
|
|
|
USER nonroot:nonroot
|
|
WORKDIR /
|
|
|
|
COPY --from=build /out/restic-manager-server /usr/local/bin/restic-manager-server
|
|
|
|
EXPOSE 8443
|
|
ENTRYPOINT ["/usr/local/bin/restic-manager-server"]
|