mirum - Unnamed repository; edit this file 'description' to name the repository.

diff options


context:
space:
mode:

Diffstat

-rw-r--r--	.github/workflows/build.yml	1	+1 −0
-rw-r--r--	README.md	23	+23 −0
-rw-r--r--	Taskfile.yml	21	+18 −3
-rw-r--r--	nfpm.yaml	53	+43 −10
-rw-r--r--	packaging/mirum-server.initd	24	+24 −0
-rw-r--r--	packaging/mirum-worker.initd	35	+35 −0
-rw-r--r--	packaging/scripts/preinstall.sh	20	+16 −4
-rw-r--r--	packaging/scripts/preremove.sh	12	+12 −0

8 files changed, 172 insertions, 17 deletions

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 55a4e72..a8310bb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml

@@ -42,6 +42,7 @@ jobs:

env:

GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

+ APK_PRIVATE_KEY: ${{ secrets.APK_PRIVATE_KEY }}

- name: Lint

run: task lint

diff --git a/README.md b/README.md
index 56684af..d5e15aa 100644
--- a/README.md
+++ b/README.md

@@ -171,6 +171,29 @@ sudo systemctl enable --now mirum-server

sudo systemctl enable --now mirum-worker@default

```

+**Alpine:**

+No repository yet — grab the signing key and the signed `.apk` from the nightly

+release:

+```sh

+sudo wget -O /etc/apk/keys/mirum.rsa.pub https://dl.mirum.dev/mirum.rsa.pub

+# Download the .apk for your arch from

+# https://github.com/dimidiumlabs/mirum/releases/tag/nightly

+sudo apk add ./mirum_<version>_<arch>.apk

+# Start the server

+sudo rc-update add mirum-server default

+sudo rc-service mirum-server start

+# Start a worker (optional, can run on a different host).

+# mirum-worker is a templated service — symlink it per instance name:

+sudo ln -s mirum-worker /etc/init.d/mirum-worker.default

+sudo rc-update add mirum-worker.default default

+sudo rc-service mirum-worker.default start

+```

## Contributing

We welcome your contributions, including code, bug reports, ideas, and success stories.

diff --git a/Taskfile.yml b/Taskfile.yml
index d81ad36..4ba97ed 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml

@@ -173,7 +173,7 @@ tasks:

VERSION: "{{.VERSION}}"

cmds:

- |

- cleanup() { rm -rf "$GNUPGHOME" /tmp/mirum-signing.asc 2>/dev/null; }

+ cleanup() { rm -rf "$GNUPGHOME" /tmp/mirum-signing.asc /tmp/mirum-apk.rsa 2>/dev/null; }

trap cleanup EXIT

if [ -n "${GPG_PRIVATE_KEY:-}" ]; then

@@ -187,6 +187,13 @@ tasks:

export NFPM_PASSPHRASE="$GPG_PASSPHRASE"

+ if [ -n "${APK_PRIVATE_KEY:-}" ]; then

+ printf '%s' "$APK_PRIVATE_KEY" > /tmp/mirum-apk.rsa

+ chmod 600 /tmp/mirum-apk.rsa

+ export APK_SIGNING_KEY="/tmp/mirum-apk.rsa"

+ openssl rsa -in /tmp/mirum-apk.rsa -pubout -out "{{.DIST_DIR}}/mirum.rsa.pub"

+ fi

for arch in {{.LINUX_PKG_TARGETS}}; do

mkdir -p {{.BUILD_DIR}}/tmp

for cmd in cmd/*/; do

@@ -195,6 +202,10 @@ tasks:

done

ARCH=$arch nfpm package --packager deb --target {{.DIST_DIR}}/

ARCH=$arch nfpm package --packager rpm --target {{.DIST_DIR}}/

+ # Alpine does not build for loong64

+ if [ "$arch" != "loong64" ]; then

+ ARCH=$arch nfpm package --packager apk --target {{.DIST_DIR}}/

+ fi

rm -rf {{.BUILD_DIR}}/tmp

done

@@ -242,6 +253,10 @@ tasks:

rclone copyto "$GNUPGHOME/public.gpg" "s3:{{.S3_BUCKET}}/public.gpg"

rclone copy packaging/dl/ "s3:{{.S3_BUCKET}}/"

+ if [ -f "{{.DIST_DIR}}/mirum.rsa.pub" ]; then

+ rclone copyto "{{.DIST_DIR}}/mirum.rsa.pub" "s3:{{.S3_BUCKET}}/mirum.rsa.pub"

+ fi

# APT repository

CHANNEL={{.CHANNEL}}

mkdir -p /tmp/apt-cache apt-repo

@@ -306,11 +321,11 @@ tasks:

done

- gh release create "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS \

+ gh release create "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.apk {{.DIST_DIR}}/*.rsa.pub {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS \

--title "$NAME" \

$( [ "{{.CHANNEL}}" = "nightly" ] && echo "--prerelease" ) \

--notes "**Version**: {{.VERSION}}" \

- || gh release upload "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS --clobber

+ || gh release upload "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.apk {{.DIST_DIR}}/*.rsa.pub {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS --clobber

# Local dev env

devenv:config:

diff --git a/nfpm.yaml b/nfpm.yaml
index c776bf7..3ade60c 100644
--- a/nfpm.yaml
+++ b/nfpm.yaml

@@ -49,16 +49,6 @@ contents:

owner: root

group: mirum-worker

- - src: packaging/mirum-server.service

- dst: /usr/lib/systemd/system/mirum-server.service

- file_info:

- mode: 0644

- - src: packaging/mirum-worker@.service

- dst: /usr/lib/systemd/system/mirum-worker@.service

- file_info:

- mode: 0644

- dst: /var/lib/mirum-server

type: dir

file_info:

@@ -73,6 +63,42 @@ contents:

owner: mirum-worker

group: mirum-worker

+ # nfpm's `packager` field is a single value, so systemd units get listed

+ # twice (once per non-apk packager) to scope them away from Alpine.

+ - src: packaging/mirum-server.service

+ dst: /usr/lib/systemd/system/mirum-server.service

+ packager: deb

+ file_info:

+ mode: 0644

+ - src: packaging/mirum-server.service

+ dst: /usr/lib/systemd/system/mirum-server.service

+ packager: rpm

+ file_info:

+ mode: 0644

+ - src: packaging/mirum-worker@.service

+ dst: /usr/lib/systemd/system/mirum-worker@.service

+ packager: deb

+ file_info:

+ mode: 0644

+ - src: packaging/mirum-worker@.service

+ dst: /usr/lib/systemd/system/mirum-worker@.service

+ packager: rpm

+ file_info:

+ mode: 0644

+ - src: packaging/mirum-server.initd

+ dst: /etc/init.d/mirum-server

+ packager: apk

+ file_info:

+ mode: 0755

+ - src: packaging/mirum-worker.initd

+ dst: /etc/init.d/mirum-worker

+ packager: apk

+ file_info:

+ mode: 0755

scripts:

preinstall: packaging/scripts/preinstall.sh

@@ -90,3 +116,10 @@ rpm:

signature:

key_id: ${GPG_KEY_ID}

key_file: ${SIGNING_PRIVATE_KEY}

+apk:

+ signature:

+ key_file: ${APK_SIGNING_KEY}

+ # nfpm appends ".rsa.pub" to this value when embedding the signature;

+ # clients must install the public key as /etc/apk/keys/mirum.rsa.pub.

+ key_name: mirum

diff --git a/packaging/mirum-server.initd b/packaging/mirum-server.initd
new file mode 100644
--- /dev/null
+++ b/packaging/mirum-server.initd

@@ -0,0 +1,24 @@

+#!/sbin/openrc-run

+# SPDX-License-Identifier: AGPL-3.0-or-later

+description="Mirum daemon (modern CI platform)"

+command="/usr/local/bin/mirum-server"

+command_args="daemon --config=/etc/mirum/server/config.yaml"

+command_user="mirum-server:mirum-server"

+supervisor="supervise-daemon"

+respawn_delay=30

+output_log="/var/log/mirum-server/out.log"

+error_log="/var/log/mirum-server/err.log"

+depend() {

+ need net

+ after firewall postgresql

+start_pre() {

+ checkpath -d -o mirum-server:mirum-server -m 0750 /var/log/mirum-server

+ checkpath -d -o mirum-server:mirum-server -m 0750 /run/mirum-server

diff --git a/packaging/mirum-worker.initd b/packaging/mirum-worker.initd
new file mode 100644
--- /dev/null
+++ b/packaging/mirum-worker.initd

@@ -0,0 +1,35 @@

+#!/sbin/openrc-run

+# SPDX-License-Identifier: AGPL-3.0-or-later

+# Templated service. To run a worker named "default":

+# ln -s mirum-worker /etc/init.d/mirum-worker.default

+# rc-service mirum-worker.default start

+# rc-update add mirum-worker.default default

+# The config file is /etc/mirum/worker/<instance>.yaml.

+case "$RC_SVCNAME" in

+ mirum-worker) instance=default ;;

+ mirum-worker.*) instance="${RC_SVCNAME#mirum-worker.}" ;;

+esac

+description="Mirum worker (${instance})"

+command="/usr/local/bin/mirum-worker"

+command_args="--config=/etc/mirum/worker/${instance}.yaml"

+command_user="mirum-worker:mirum-worker"

+supervisor="supervise-daemon"

+respawn_delay=30

+output_log="/var/log/mirum-worker/${instance}.out.log"

+error_log="/var/log/mirum-worker/${instance}.err.log"

+depend() {

+ need net

+ after firewall

+start_pre() {

+ checkpath -d -o mirum-worker:mirum-worker -m 0750 /var/log/mirum-worker

+ checkpath -d -o mirum-worker:mirum-worker -m 0750 /run/mirum-worker

diff --git a/packaging/scripts/preinstall.sh b/packaging/scripts/preinstall.sh
index 15f9f40..160d0be 100644
--- a/packaging/scripts/preinstall.sh
+++ b/packaging/scripts/preinstall.sh

@@ -4,11 +4,23 @@

set -e

+nologin=/usr/sbin/nologin

+[ -x "$nologin" ] || nologin=/sbin/nologin

+[ -x "$nologin" ] || nologin=/bin/false

for svc in mirum-server mirum-worker; do

- if ! getent group $svc >/dev/null; then

- groupadd --system $svc

+ if ! getent group "$svc" >/dev/null; then

+ if command -v groupadd >/dev/null; then

+ groupadd --system "$svc"

+ else

+ addgroup -S "$svc"

+ fi

- if ! getent passwd $svc >/dev/null; then

- useradd --system --gid $svc --no-create-home --shell /usr/sbin/nologin $svc

+ if ! getent passwd "$svc" >/dev/null; then

+ if command -v useradd >/dev/null; then

+ useradd --system --gid "$svc" --no-create-home --shell "$nologin" "$svc"

+ else

+ adduser -S -H -G "$svc" -s "$nologin" "$svc"

+ fi

done

diff --git a/packaging/scripts/preremove.sh b/packaging/scripts/preremove.sh
index 1c92a81..8d6c6ab 100644
--- a/packaging/scripts/preremove.sh
+++ b/packaging/scripts/preremove.sh

@@ -11,3 +11,15 @@ if [ -x "/bin/systemctl" ] && [ -d /run/systemd/system ]; then

/bin/systemctl stop 'mirum-worker@*' || true

/bin/systemctl disable mirum-worker@.service || true

+if command -v rc-service >/dev/null; then

+ rc-service mirum-server stop || true

+ rc-update del mirum-server || true

+ for link in /etc/init.d/mirum-worker.*; do

+ [ -e "$link" ] || continue

+ svc=$(basename "$link")

+ rc-service "$svc" stop || true

+ rc-update del "$svc" || true

+ done

+fi