mirum - Unnamed repository; edit this file 'description' to name the repository.

diff options


context:
space:
mode:

Diffstat

-rw-r--r--	.dockerignore	15	+0 −15
-rw-r--r--	.github/workflows/build.yml	154	+22 −132
-rw-r--r--	.gitignore	1	+0 −1
-rw-r--r--	README.md	24	+14 −10
-rw-r--r--	REUSE.toml	2	+0 −2
-rw-r--r--	Taskfile.yml	72	+23 −49
-rw-r--r--	charts/mirum/Chart.yaml	10	+0 −10
-rw-r--r--	charts/mirum/templates/_helpers.tpl	40	+0 −40
-rw-r--r--	charts/mirum/templates/server-deployment.yaml	142	+0 −142
-rw-r--r--	charts/mirum/templates/server-httproute.yaml	26	+0 −26
-rw-r--r--	charts/mirum/templates/server-service.yaml	23	+0 −23
-rw-r--r--	charts/mirum/templates/server-tcproute.yaml	22	+0 −22
-rw-r--r--	charts/mirum/templates/worker-deployment.yaml	87	+0 −87
-rw-r--r--	charts/mirum/values.yaml	75	+0 −75
-rw-r--r--	cmd/mirum-server/Dockerfile	20	+0 −20
-rw-r--r--	cmd/mirum-worker/Dockerfile	26	+0 −26
-rw-r--r--	mise.lock	26	+5 −21
-rw-r--r--	mise.toml	8	+2 −6
-rw-r--r--	nfpm.yaml	8	+5 −3

19 files changed, 71 insertions, 710 deletions

diff --git a/.dockerignore b/.dockerignore
deleted file mode 100644
--- a/.dockerignore
+++ /dev/null

@@ -1,15 +0,0 @@

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-.git

-.github

-.task

-build

-cmd/mirum-agent/.zig-cache

-cmd/mirum-agent/zig-out

-cmd/mirum-agent/zig-pkg

-cmd/mirum-server/apipb

-cmd/mirum-server/static

-cmd/mirum-server/web/gen

-cmd/mirum-server/web/node_modules

-internal/protocol/wirepb

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7e1bd0e..f646a7e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml

@@ -16,13 +16,8 @@ on:

jobs:

build:

- name: Build and publish Nightly

+ name: Build and publish

runs-on: ubuntu-latest

- concurrency:

- group: >-

- package-publish-mirum-${{ github.ref == 'refs/heads/main' && 'nightly'

- || startsWith(github.ref, 'refs/tags/v') && 'stable' || github.ref }}

- cancel-in-progress: false

permissions:

contents: write

steps:

@@ -39,13 +34,22 @@ jobs:

- name: Install dependencies

run: mise bootstrap --locked --yes --update

+ - name: Build

+ if: github.event_name == 'pull_request'

+ run: task cross

- name: Build and package

- run: task package GIT_REF=${{ github.ref }} GPG_KEY_ID=${{ vars.GPG_KEY_ID }}

+ if: github.event_name == 'push'

+ run: >-

+ task package

+ GIT_REF=${{ github.ref }}

+ RELEASE_SEQUENCE=${{ github.run_number }}

+ RELEASE_COMMIT=${{ github.sha }}

env:

+ GPG_KEY_ID: ${{ vars.GPG_KEY_ID }}

GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

APK_PRIVATE_KEY: ${{ secrets.APK_PRIVATE_KEY }}

- PACKAGE_KEY_VERSION: ${{ vars.PACKAGE_KEY_VERSION }}

- name: Lint

run: task lint

@@ -53,141 +57,27 @@ jobs:

- name: Tests

run: task test

- - name: Upload container binaries

- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0

- with:

- name: container-binaries

- path: |

- build/mirum-server-linux-amd64

- build/mirum-server-linux-arm64

- build/mirum-worker-linux-amd64

- build/mirum-worker-linux-arm64

- if-no-files-found: error

- name: Publish

if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')

run: |

git config user.name "github-actions[bot]"

git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

. build/dist/build.env

- task publish:release CHANNEL=$CHANNEL VERSION=$VERSION

mise run publish -- \

- --service mirum \

- --channel "$CHANNEL" \

+ --name mirum \

+ --repository "${{ github.server_url }}/${{ github.repository }}" \

+ --version "$VERSION" \

--input build/dist \

- deb rpm apk

+ --s3-bucket "${{ vars.S3_BUCKET }}" \

+ --s3-public-url "${{ vars.S3_PUBLIC_URL }}" \

+ --s3-provider "${{ vars.S3_PROVIDER || 'Other' }}" \

+ --s3-region "${{ vars.S3_REGION }}" \

+ --s3-endpoint "${{ vars.S3_ENDPOINT }}" \

+ --github-release

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

+ GPG_KEY_ID: ${{ vars.GPG_KEY_ID }}

GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

- GPG_KEY_ID: ${{ vars.GPG_KEY_ID }}

- APK_PRIVATE_KEY: ${{ secrets.APK_PRIVATE_KEY }}

- PACKAGE_KEY_VERSION: ${{ vars.PACKAGE_KEY_VERSION }}

- S3_BUCKET: ${{ vars.S3_BUCKET }}

- S3_ENDPOINT: ${{ vars.S3_ENDPOINT }}

- S3_PUBLIC_URL: ${{ vars.S3_PUBLIC_URL }}

S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}

S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

- oci:

- name: OCI artifacts

- needs: [build]

- runs-on: ubuntu-latest

- permissions:

- contents: read

- packages: write

- steps:

- - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

- - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3

- with:

- version: 2026.7.5

- experimental: true

- install: false

- - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0

- with:

- name: container-binaries

- path: .container

- - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3

- - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

- - name: Determine artifact version

- id: artifact

- shell: bash

- run: |

- base_version=$(cat VERSION)

- if [[ "$GITHUB_REF" == refs/heads/main ]]; then

- version="$base_version-nightly.$(git log -1 --format=%ct)"

- elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then

- version="${GITHUB_REF_NAME#v}"

- if [[ "$version" != "$base_version" ]]; then

- echo "Tag version $version does not match VERSION $base_version" >&2

- exit 1

- fi

- else

- version="$base_version-pr.$GITHUB_RUN_NUMBER"

- fi

- echo "version=$version" >> "$GITHUB_OUTPUT"

- - name: Log in to GHCR

- if: github.event_name != 'pull_request'

- uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4

- with:

- registry: ghcr.io

- username: ${{ github.actor }}

- password: ${{ secrets.GITHUB_TOKEN }}

- - name: Log Helm in to GHCR

- if: github.event_name != 'pull_request'

- env:

- GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- run: |

- printf '%s' "$GHCR_TOKEN" | mise x helm@4.1.1 -- \

- helm registry login ghcr.io --username "$GITHUB_ACTOR" --password-stdin

- - name: Build and publish OCI artifacts

- shell: bash

- run: |

- version="${{ steps.artifact.outputs.version }}"

- image_output=()

- chart_output=()

- if [[ "${{ github.event_name }}" != pull_request ]]; then

- image_output+=(--push)

- chart_output+=(--push "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/charts")

- fi

- for service in server worker; do

- image="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/mirum-$service"

- tags=(

- --tag "$image:sha-$GITHUB_SHA"

- --tag "$image:$version"

- )

- labels=(

- --label "org.opencontainers.image.revision=$GITHUB_SHA"

- --label "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY"

- --label "org.opencontainers.image.version=$version"

- )

- if [[ "$GITHUB_REF" == refs/heads/main ]]; then

- tags+=(--tag "$image:nightly")

- elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then

- tags+=(--tag "$image:latest")

- fi

- mise run container -- \

- --context . \

- --file "cmd/mirum-$service/Dockerfile" \

- --platform linux/amd64,linux/arm64 \

- --cache-scope "mirum-$service" \

- "${tags[@]}" "${labels[@]}" "${image_output[@]}"

- done

- mise run chart -- \

- --chart charts/mirum \

- --version "$version" \

- --app-version "$version" \

- "${chart_output[@]}"

diff --git a/.gitignore b/.gitignore
index 437dc77..149195c 100644
--- a/.gitignore
+++ b/.gitignore

@@ -3,7 +3,6 @@

/dev

/build

-/.container

/.task

mise.local.toml

mise.*.local.toml

diff --git a/README.md b/README.md
index a9f4640..8cb272c 100644
--- a/README.md
+++ b/README.md

@@ -139,8 +139,8 @@ Please note that the project is in its infancy and is **not** intended for produ

```bash

sudo apt install curl gnupg

-curl -fsSL https://pkg.dimidiumlabs.io/packages.gpg | sudo gpg --dearmor -o /usr/share/keyrings/dimidiumlabs.gpg

-echo "deb [signed-by=/usr/share/keyrings/dimidiumlabs.gpg] https://pkg.dimidiumlabs.io/mirum/apt/ nightly main" | sudo tee /etc/apt/sources.list.d/mirum.list

+curl -fsSL https://dl.mirum.dev/public.gpg | sudo gpg --dearmor -o /usr/share/keyrings/mirum.gpg

+echo "deb [signed-by=/usr/share/keyrings/mirum.gpg] https://dl.mirum.dev/apt/ nightly main" | sudo tee /etc/apt/sources.list.d/mirum.list

sudo apt update && sudo apt install mirum

# Start the server

@@ -154,10 +154,10 @@ sudo systemctl enable --now mirum-worker@default

```bash

# DNF5 (Fedora 41+, RHEL 10+)

-sudo dnf config-manager addrepo --from-repofile=https://pkg.dimidiumlabs.io/mirum/rpm/nightly/mirum-nightly.repo

+sudo dnf config-manager addrepo --from-repofile=https://dl.mirum.dev/rpm/nightly/mirum-nightly.repo

# DNF4 (Fedora 40 and older, RHEL 8/9)

-sudo curl -o /etc/yum.repos.d/mirum-nightly.repo https://pkg.dimidiumlabs.io/mirum/rpm/nightly/mirum-nightly.repo

+sudo curl -o /etc/yum.repos.d/mirum-nightly.repo https://dl.mirum.dev/rpm/nightly/mirum-nightly.repo

sudo dnf install mirum

@@ -171,8 +171,8 @@ sudo systemctl enable --now mirum-worker@default

**openSUSE:**

```bash

-sudo rpm --import https://pkg.dimidiumlabs.io/packages.gpg

-sudo zypper addrepo https://pkg.dimidiumlabs.io/mirum/rpm/nightly/ mirum-nightly

+sudo rpm --import https://dl.mirum.dev/public.gpg

+sudo zypper addrepo https://dl.mirum.dev/rpm/nightly/ mirum-nightly

sudo zypper refresh

sudo zypper install mirum

@@ -185,11 +185,15 @@ sudo systemctl enable --now mirum-worker@default

**Alpine:**

+No repository yet — grab the signing key and the signed `.apk` from the nightly

+release:

```sh

-sudo wget -O /etc/apk/keys/packages.0001.rsa.pub https://pkg.dimidiumlabs.io/keys/packages.0001.rsa.pub

-echo "https://pkg.dimidiumlabs.io/mirum/apk/nightly" | sudo tee -a /etc/apk/repositories

-sudo apk update

-sudo apk add mirum

+sudo wget -O /etc/apk/keys/mirum.rsa.pub https://dl.mirum.dev/mirum.rsa.pub

+# Download the .apk for your arch from

+# https://github.com/dimidiumlabs/mirum/releases/tag/nightly

+sudo apk add ./mirum_<version>_<arch>.apk

# Start the server

sudo rc-update add mirum-server default

diff --git a/REUSE.toml b/REUSE.toml
index 708bc13..850dd72 100644
--- a/REUSE.toml
+++ b/REUSE.toml

@@ -14,7 +14,6 @@ path = [

"mise.lock",

"packaging/dl/*",

"packaging/logo.svg",

- "charts/mirum/templates/*",

"buf.*",

]

SPDX-FileCopyrightText = "2026 Nikolay Govorov"

@@ -30,7 +29,6 @@ SPDX-License-Identifier = "CC-BY-3.0"

[[annotations]]

path = [

"README.md",

- "charts/mirum/README.md",

"docs/**.md",

]

SPDX-FileCopyrightText = "2026 Nikolay Govorov"

diff --git a/Taskfile.yml b/Taskfile.yml
index 8e9b060..e4c5b80 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml

@@ -201,36 +201,36 @@ tasks:

done

cp -r "{{.BUILD_DIR}}/agent" "$staging/agent"

- format=tar.gz

- [ "$os" = "windows" ] && format=zip

- mise run package -- \

- --output "{{.DIST_DIR}}" \

- --archive-root "$staging" \

- --archive-name "mirum-${target}" \

- "$format"

+ if [ "$os" = "windows" ]; then

+ (cd "$staging" && zip -qr "$OLDPWD/{{.DIST_DIR}}/mirum-${target}.zip" .)

+ else

+ tar -czf "{{.DIST_DIR}}/mirum-${target}.tar.gz" -C "$staging" .

+ fi

rm -rf "$staging"

- cd {{.DIST_DIR}} && sha256sum *.tar.gz *.zip > SHA256SUMS

package:

- desc: Cross-compile all platforms and build deb/rpm packages for Linux

+ desc: Cross-compile all platforms and build signed Linux packages

deps: [cross]

vars:

VERSION:

sh: |

ref="${GIT_REF:-$(git describe --tags --exact-match 2>/dev/null || echo "")}"

- if [[ "$ref" == refs/tags/v* ]]; then

- echo "${ref#refs/tags/v}"

- elif [[ "$ref" == v* ]]; then

- echo "${ref#v}"

- else

- echo "$(cat VERSION)~nightly.$(git log -1 --format=%ct)"

- fi

- CHANNEL:

- sh: |

- ref="${GIT_REF:-$(git describe --tags --exact-match 2>/dev/null || echo "")}"

- if [[ "$ref" == refs/tags/v* || "$ref" == v* ]]; then echo stable; else echo nightly; fi

- env:

- VERSION: "{{.VERSION}}"

+ case "$ref" in

+ refs/tags/v*) version="${ref#refs/tags/v}" ;;

+ v*) version="${ref#v}" ;;

+ *)

+ sequence="${RELEASE_SEQUENCE:-$(git log -1 --format=%ct)}"

+ commit="${RELEASE_COMMIT:-$(git rev-parse HEAD)}"

+ printf '%s-nightly.%s.g%.12s\n' "$(cat VERSION)" "$sequence" "$commit"

+ exit

+ ;;

+ esac

+ [ "$version" = "$(cat VERSION)" ] || {

+ echo "tag version $version does not match VERSION" >&2

+ exit 1

+ }

+ echo "$version"

cmds:

- |

for arch in {{.LINUX_PKG_TARGETS}}; do

@@ -242,11 +242,10 @@ tasks:

done

formats="deb rpm"

- # Alpine does not build for loong64

if [ "$arch" != "loong64" ]; then

formats="$formats apk"

- GPG_KEY_ID="{{.GPG_KEY_ID}}" mise run package -- \

+ mise run package -- \

--version "{{.VERSION}}" \

--arch "$arch" \

--output "{{.DIST_DIR}}" \

@@ -254,32 +253,7 @@ tasks:

rm -rf {{.BUILD_DIR}}/tmp

done

- printf 'VERSION={{.VERSION}}\nCHANNEL={{.CHANNEL}}\n' > {{.DIST_DIR}}/build.env

- publish:release:

- desc: Create or update a GitHub Release

- requires:

- vars: [CHANNEL, VERSION]

- cmds:

- - |

- if [ "{{.CHANNEL}}" = "stable" ]; then

- TAG="v{{.VERSION}}"

- NAME="{{.VERSION}}"

- else

- TAG="nightly"

- NAME="nightly"

- git tag -f nightly

- git push origin --force tag nightly

- for asset in $(gh release view nightly --json assets --jq '.assets[].name' 2>/dev/null || true); do

- gh release delete-asset nightly "$asset" --yes

- done

- fi

- gh release create "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.apk {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS \

- --title "$NAME" \

- $( [ "{{.CHANNEL}}" = "nightly" ] && echo "--prerelease" ) \

- --notes "**Version**: {{.VERSION}}" \

- || gh release upload "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.apk {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS --clobber

+ printf 'VERSION={{.VERSION}}\n' > {{.DIST_DIR}}/build.env

# Local dev env

devenv:config:

diff --git a/charts/mirum/Chart.yaml b/charts/mirum/Chart.yaml
deleted file mode 100644
--- a/charts/mirum/Chart.yaml
+++ /dev/null

@@ -1,10 +0,0 @@

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-apiVersion: v2

-type: application

-version: 0.1.0

-name: mirum

-home: https://github.com/dimidiumlabs/mirum

-description: Mirum CI server and workers

diff --git a/charts/mirum/templates/_helpers.tpl b/charts/mirum/templates/_helpers.tpl
deleted file mode 100644
--- a/charts/mirum/templates/_helpers.tpl
+++ /dev/null

@@ -1,40 +0,0 @@

-{{/* SPDX-License-Identifier: AGPL-3.0-or-later */}}

-{{/* vim: set filetype=helm: */}}

-{{- define "mirum.name" -}}

-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}

-{{- end -}}

-{{- define "mirum.fullname" -}}

-{{- if .Values.fullnameOverride -}}

-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}

-{{- else -}}

-{{- printf "%s-%s" .Release.Name (include "mirum.name" .) | trunc 63 | trimSuffix "-" -}}

-{{- end -}}

-{{- define "mirum.labels" -}}

-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }}

-app.kubernetes.io/name: {{ include "mirum.name" . }}

-app.kubernetes.io/instance: {{ .Release.Name }}

-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}

-app.kubernetes.io/managed-by: {{ .Release.Service }}

-{{- end -}}

-{{- define "mirum.componentLabels" -}}

-{{ include "mirum.labels" .root }}

-app.kubernetes.io/component: {{ .component }}

-{{- end -}}

-{{- define "mirum.selectorLabels" -}}

-app.kubernetes.io/name: {{ include "mirum.name" .root }}

-app.kubernetes.io/instance: {{ .root.Release.Name }}

-app.kubernetes.io/component: {{ .component }}

-{{- end -}}

-{{- define "mirum.image" -}}

-{{- if .image.digest -}}

-{{- printf "%s@%s" .image.repository .image.digest -}}

-{{- else -}}

-{{- printf "%s:%s" .image.repository (default .root.Chart.AppVersion .image.tag) -}}

-{{- end -}}

diff --git a/charts/mirum/templates/server-deployment.yaml b/charts/mirum/templates/server-deployment.yaml
deleted file mode 100644
--- a/charts/mirum/templates/server-deployment.yaml
+++ /dev/null

@@ -1,142 +0,0 @@

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-{{- if and .Values.server.enabled (ne (int .Values.server.replicaCount) 1) }}

-{{- fail "mirum: server.replicaCount must be 1 while the task queue is process-local" }}

-{{- end }}

-{{- if and .Values.server.enabled .Values.server.postgresqlMtls.enabled (not .Values.server.serviceAccountName) }}

-{{- fail "mirum: server.serviceAccountName is required when server.postgresqlMtls.enabled=true" }}

-{{- end }}

-{{- if .Values.server.enabled }}

-apiVersion: apps/v1

-kind: Deployment

-metadata:

- name: {{ include "mirum.fullname" . }}-server

- labels:

- {{- include "mirum.componentLabels" (dict "root" . "component" "server") | nindent 4 }}

-spec:

- replicas: {{ .Values.server.replicaCount }}

- strategy:

- type: Recreate

- selector:

- matchLabels:

- {{- include "mirum.selectorLabels" (dict "root" . "component" "server") | nindent 6 }}

- template:

- metadata:

- annotations:

- {{- with .Values.server.podAnnotations }}

- {{- toYaml . | nindent 8 }}

- {{- end }}

- labels:

- {{- include "mirum.selectorLabels" (dict "root" . "component" "server") | nindent 8 }}

- {{- with .Values.server.podLabels }}

- {{- toYaml . | nindent 8 }}

- {{- end }}

- spec:

- automountServiceAccountToken: false

- {{- with .Values.server.serviceAccountName }}

- serviceAccountName: {{ . | quote }}

- {{- end }}

- terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}

- securityContext:

- runAsNonRoot: true

- runAsUser: 10000

- runAsGroup: 10000

- fsGroup: 10000

- fsGroupChangePolicy: OnRootMismatch

- {{- with .Values.imagePullSecrets }}

- imagePullSecrets:

- {{- toYaml . | nindent 8 }}

- {{- end }}

- containers:

- - name: server

- image: {{ include "mirum.image" (dict "root" . "image" .Values.server.image) | quote }}

- imagePullPolicy: {{ .Values.server.image.pullPolicy }}

- args: ["daemon", "--config=/etc/mirum/secret/config.yaml"]

- securityContext:

- allowPrivilegeEscalation: false

- capabilities:

- drop: [ALL]

- readOnlyRootFilesystem: true

- ports:

- - name: web

- containerPort: {{ .Values.server.webPort }}

- - name: grpc

- containerPort: {{ .Values.server.grpcPort }}

- {{- with .Values.server.extraEnv }}

- env:

- {{- toYaml . | nindent 12 }}

- {{- end }}

- startupProbe:

- tcpSocket: { port: web }

- failureThreshold: 30

- periodSeconds: 2

- readinessProbe:

- tcpSocket: { port: web }

- livenessProbe:

- tcpSocket: { port: web }

- periodSeconds: 20

- resources:

- {{- toYaml .Values.server.resources | nindent 12 }}

- volumeMounts:

- - name: config

- mountPath: /etc/mirum/secret

- readOnly: true

- {{- with .Values.server.grpcTls.existingSecret }}

- - name: grpc-tls

- mountPath: /etc/mirum/grpc-tls

- readOnly: true

- {{- end }}

- {{- if .Values.server.postgresqlMtls.enabled }}

- - name: postgresql-tls

- mountPath: {{ .Values.server.postgresqlMtls.mountPath }}

- readOnly: true

- {{- end }}

- - name: run

- mountPath: /run/mirum-server

- volumes:

- - name: config

- secret:

- secretName: {{ .Values.server.existingSecret }}

- defaultMode: 0440

- {{- with .Values.server.grpcTls.existingSecret }}

- - name: grpc-tls

- secret:

- secretName: {{ . }}

- defaultMode: 0440

- {{- end }}

- {{- if .Values.server.postgresqlMtls.enabled }}

- - name: postgresql-tls

- csi:

- driver: csi.cert-manager.io

- readOnly: true

- volumeAttributes:

- csi.cert-manager.io/issuer-name: {{ required "mirum: server.postgresqlMtls.issuerName is required" .Values.server.postgresqlMtls.issuerName | quote }}

- csi.cert-manager.io/issuer-kind: {{ .Values.server.postgresqlMtls.issuerKind | quote }}

- csi.cert-manager.io/common-name: {{ required "mirum: server.postgresqlMtls.commonName is required" .Values.server.postgresqlMtls.commonName | quote }}

- csi.cert-manager.io/uri-sans: {{ .Values.server.postgresqlMtls.uriSan | quote }}

- csi.cert-manager.io/key-algorithm: "ECDSA"

- csi.cert-manager.io/key-size: "256"

- csi.cert-manager.io/key-encoding: "PKCS8"

- csi.cert-manager.io/key-usages: "digital signature,client auth"

- csi.cert-manager.io/duration: {{ .Values.server.postgresqlMtls.duration | quote }}

- csi.cert-manager.io/renew-before: {{ .Values.server.postgresqlMtls.renewBefore | quote }}

- csi.cert-manager.io/fs-group: {{ .Values.server.postgresqlMtls.fsGroup | quote }}

- {{- end }}

- - name: run

- emptyDir: {}

- {{- with .Values.server.nodeSelector }}

- nodeSelector:

- {{- toYaml . | nindent 8 }}

- {{- end }}

- {{- with .Values.server.affinity }}

- affinity:

- {{- toYaml . | nindent 8 }}

- {{- end }}

- {{- with .Values.server.tolerations }}

- tolerations:

- {{- toYaml . | nindent 8 }}

- {{- end }}

-{{- end }}

-# vim: set filetype=helm:

diff --git a/charts/mirum/templates/server-httproute.yaml b/charts/mirum/templates/server-httproute.yaml
deleted file mode 100644
--- a/charts/mirum/templates/server-httproute.yaml
+++ /dev/null

@@ -1,26 +0,0 @@

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-{{- if and .Values.server.enabled .Values.server.route.enabled }}

-apiVersion: gateway.networking.k8s.io/v1

-kind: HTTPRoute

-metadata:

- name: {{ include "mirum.fullname" . }}

- labels:

- {{- include "mirum.componentLabels" (dict "root" . "component" "server") | nindent 4 }}

-spec:

- {{- with .Values.server.route.parentRefs }}

- parentRefs:

- {{- toYaml . | nindent 4 }}

- {{- end }}

- {{- with .Values.server.route.hostnames }}

- hostnames:

- {{- toYaml . | nindent 4 }}

- {{- end }}

- rules:

- - backendRefs:

- - name: {{ include "mirum.fullname" . }}

- port: {{ .Values.server.webPort }}

-{{- end }}

-# vim: set filetype=helm:

diff --git a/charts/mirum/templates/server-service.yaml b/charts/mirum/templates/server-service.yaml
deleted file mode 100644
--- a/charts/mirum/templates/server-service.yaml
+++ /dev/null

@@ -1,23 +0,0 @@

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-{{- if .Values.server.enabled }}

-apiVersion: v1

-kind: Service

-metadata:

- name: {{ include "mirum.fullname" . }}

- labels:

- {{- include "mirum.componentLabels" (dict "root" . "component" "server") | nindent 4 }}

-spec:

- selector:

- {{- include "mirum.selectorLabels" (dict "root" . "component" "server") | nindent 4 }}

- ports:

- - name: web

- port: {{ .Values.server.webPort }}

- targetPort: web

- - name: grpc

- port: {{ .Values.server.grpcPort }}

- targetPort: grpc

-{{- end }}

-# vim: set filetype=helm:

diff --git a/charts/mirum/templates/server-tcproute.yaml b/charts/mirum/templates/server-tcproute.yaml
deleted file mode 100644
--- a/charts/mirum/templates/server-tcproute.yaml
+++ /dev/null

@@ -1,22 +0,0 @@

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-{{- if and .Values.server.enabled .Values.server.grpcRoute.enabled }}

-apiVersion: gateway.networking.k8s.io/v1

-kind: TCPRoute

-metadata:

- name: {{ include "mirum.fullname" . }}-grpc

- labels:

- {{- include "mirum.componentLabels" (dict "root" . "component" "server") | nindent 4 }}

-spec:

- {{- with .Values.server.grpcRoute.parentRefs }}

- parentRefs:

- {{- toYaml . | nindent 4 }}

- {{- end }}

- rules:

- - backendRefs:

- - name: {{ include "mirum.fullname" . }}

- port: {{ .Values.server.grpcPort }}

-{{- end }}

-# vim: set filetype=helm:

diff --git a/charts/mirum/templates/worker-deployment.yaml b/charts/mirum/templates/worker-deployment.yaml
deleted file mode 100644
--- a/charts/mirum/templates/worker-deployment.yaml
+++ /dev/null

@@ -1,87 +0,0 @@

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-{{- if .Values.worker.enabled }}

-apiVersion: apps/v1

-kind: Deployment

-metadata:

- name: {{ include "mirum.fullname" . }}-worker

- labels:

- {{- include "mirum.componentLabels" (dict "root" . "component" "worker") | nindent 4 }}

-spec:

- replicas: {{ .Values.worker.replicaCount }}

- selector:

- matchLabels:

- {{- include "mirum.selectorLabels" (dict "root" . "component" "worker") | nindent 6 }}

- template:

- metadata:

- annotations:

- {{- with .Values.worker.podAnnotations }}

- {{- toYaml . | nindent 8 }}

- {{- end }}

- labels:

- {{- include "mirum.selectorLabels" (dict "root" . "component" "worker") | nindent 8 }}

- {{- with .Values.worker.podLabels }}

- {{- toYaml . | nindent 8 }}

- {{- end }}

- spec:

- automountServiceAccountToken: false

- terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}

- securityContext:

- runAsNonRoot: true

- runAsUser: 10000

- runAsGroup: 10000

- fsGroup: 10000

- fsGroupChangePolicy: OnRootMismatch

- {{- with .Values.imagePullSecrets }}

- imagePullSecrets:

- {{- toYaml . | nindent 8 }}

- {{- end }}

- containers:

- - name: worker

- image: {{ include "mirum.image" (dict "root" . "image" .Values.worker.image) | quote }}

- imagePullPolicy: {{ .Values.worker.image.pullPolicy }}

- args: ["--config=/etc/mirum/secret/config.yaml"]

- securityContext:

- allowPrivilegeEscalation: false

- capabilities:

- drop: [ALL]

- readOnlyRootFilesystem: true

- {{- with .Values.worker.extraEnv }}

- env:

- {{- toYaml . | nindent 12 }}

- {{- end }}

- resources:

- {{- toYaml .Values.worker.resources | nindent 12 }}

- volumeMounts:

- - name: config

- mountPath: /etc/mirum/secret

- readOnly: true

- - name: workspace

- mountPath: /var/lib/mirum-worker

- - name: tmp

- mountPath: /tmp

- volumes:

- - name: config

- secret:

- secretName: {{ .Values.worker.existingSecret }}

- defaultMode: 0440

- - name: workspace

- emptyDir: {}

- - name: tmp

- emptyDir: {}

- {{- with .Values.worker.nodeSelector }}

- nodeSelector:

- {{- toYaml . | nindent 8 }}

- {{- end }}

- {{- with .Values.worker.affinity }}

- affinity:

- {{- toYaml . | nindent 8 }}

- {{- end }}

- {{- with .Values.worker.tolerations }}

- tolerations:

- {{- toYaml . | nindent 8 }}

- {{- end }}

-{{- end }}

-# vim: set filetype=helm:

diff --git a/charts/mirum/values.yaml b/charts/mirum/values.yaml
deleted file mode 100644
--- a/charts/mirum/values.yaml
+++ /dev/null

@@ -1,75 +0,0 @@

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-imagePullSecrets: []

-nameOverride: ""

-fullnameOverride: ""

-server:

- enabled: true

- replicaCount: 1

- image:

- repository: ghcr.io/dimidiumlabs/mirum-server

- tag: ""

- digest: ""

- pullPolicy: IfNotPresent

- # Must contain config.yaml and any private files other than the gRPC

- # certificate. Keep database_uri, pepper, token, and webhook_secret in this

- # Secret rather than Helm values.

- existingSecret: mirum-server

- # Optional existing ServiceAccount used by the server. The default empty

- # value preserves the current Deployment and external database path.

- serviceAccountName: ""

- postgresqlMtls:

- # Opt-in client-certificate mount for passwordless PostgreSQL mTLS. Disabled

- # by default; no CSI resources or volume mounts are rendered unless enabled.

- enabled: false

- mountPath: /etc/mirum/postgresql-tls

- issuerName: ""

- issuerKind: ClusterIssuer

- commonName: ""

- uriSan: "spiffe://ddlabs.internal/ns/${POD_NAMESPACE}/sa/${SERVICE_ACCOUNT_NAME}/pod/${POD_UID}"

- duration: 2160h

- renewBefore: 360h

- fsGroup: 10000

- grpcTls:

- # Optional cert-manager-style Secret containing tls.crt and tls.key. The

- # files are mounted at /etc/mirum/grpc-tls/ for config.yaml to reference.

- existingSecret: ""

- webPort: 3000

- grpcPort: 2000

- route:

- enabled: false

- hostnames: []

- parentRefs: []

- grpcRoute:

- enabled: false

- parentRefs: []

- resources: {}

- extraEnv: []

- podAnnotations: {}

- podLabels: {}

- nodeSelector: {}

- tolerations: []

- affinity: {}

-worker:

- enabled: false

- replicaCount: 1

- image:

- repository: ghcr.io/dimidiumlabs/mirum-worker

- tag: ""

- digest: ""

- pullPolicy: IfNotPresent

- # Must contain config.yaml, the Ed25519 key referenced by key_file, and an

- # optional CA file referenced by tls_ca.

- existingSecret: mirum-worker

- resources: {}

- extraEnv: []

- podAnnotations: {}

- podLabels: {}

- nodeSelector: {}

- tolerations: []

- affinity: {}

-terminationGracePeriodSeconds: 40

diff --git a/cmd/mirum-server/Dockerfile b/cmd/mirum-server/Dockerfile
deleted file mode 100644
--- a/cmd/mirum-server/Dockerfile
+++ /dev/null

@@ -1,20 +0,0 @@

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-FROM gcr.io/distroless/static-debian13:nonroot@sha256:1c2c046bc09ed40fad370b599a0b1ae7987f55b01e247cf27a7c27cd97e5bbc7

-ARG TARGETARCH

-LABEL org.opencontainers.image.source="https://github.com/dimidiumlabs/mirum" \

- org.opencontainers.image.licenses="AGPL-3.0-or-later" \

- org.opencontainers.image.title="mirum-server"

-COPY --chown=root:root --chmod=0755 .container/mirum-server-linux-${TARGETARCH} /usr/local/bin/mirum-server

-COPY LICENSE README.md /usr/share/doc/mirum/

-USER 10000:10000

-EXPOSE 3000 2000

-ENTRYPOINT ["/usr/local/bin/mirum-server"]

-CMD ["daemon", "--config=/etc/mirum/config.yaml"]

-# syntax=docker/dockerfile:

diff --git a/cmd/mirum-worker/Dockerfile b/cmd/mirum-worker/Dockerfile
deleted file mode 100644
--- a/cmd/mirum-worker/Dockerfile
+++ /dev/null

@@ -1,26 +0,0 @@

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-FROM docker.io/library/alpine:3.23.5@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40

-ARG TARGETARCH

-LABEL org.opencontainers.image.source="https://github.com/dimidiumlabs/mirum" \

- org.opencontainers.image.licenses="AGPL-3.0-or-later" \

- org.opencontainers.image.title="mirum-worker"

-RUN apk add --no-cache bash ca-certificates git && \

- addgroup -g 10000 mirum-worker && \

- adduser -D -H -u 10000 -G mirum-worker -h /var/lib/mirum-worker \

- -s /sbin/nologin mirum-worker && \

- install -d -o mirum-worker -g mirum-worker -m 0750 /var/lib/mirum-worker

-COPY --chown=root:root --chmod=0755 .container/mirum-worker-linux-${TARGETARCH} /usr/local/bin/mirum-worker

-COPY LICENSE README.md /usr/share/doc/mirum/

-USER 10000:10000

-WORKDIR /var/lib/mirum-worker

-ENTRYPOINT ["/usr/local/bin/mirum-worker"]

-CMD ["--config=/etc/mirum/config.yaml"]

-# syntax=docker/dockerfile:

diff --git a/mise.lock b/mise.lock
index c1cad8c..1244c79 100644
--- a/mise.lock
+++ b/mise.lock

@@ -16,33 +16,17 @@ url = "https://github.com/bufbuild/buf/releases/download/v1.67.0/buf-Linux-x86_6

url_api = "https://api.github.com/repos/bufbuild/buf/releases/assets/386413039"

provenance = "minisign"

-[[tools.gh]]

-version = "2.96.0"

-backend = "aqua:cli/cli"

-[tools.gh."platforms.linux-arm64"]

-checksum = "sha256:06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909"

-url = "https://github.com/cli/cli/releases/download/v2.96.0/gh_2.96.0_linux_arm64.tar.gz"

-url_api = "https://api.github.com/repos/cli/cli/releases/assets/464728549"

-provenance = "github-attestations"

-[tools.gh."platforms.linux-x64"]

-checksum = "sha256:83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60"

-url = "https://github.com/cli/cli/releases/download/v2.96.0/gh_2.96.0_linux_amd64.tar.gz"

-url_api = "https://api.github.com/repos/cli/cli/releases/assets/464728543"

-provenance = "github-attestations"

[[tools.go]]

-version = "1.26.6"

+version = "1.26.5"

backend = "core:go"

[tools.go."platforms.linux-arm64"]

-checksum = "sha256:d0507e9e9d7fe012aae570108cbd76c15de879e17130ab8cb90d4d7445cb1f2e"

-url = "https://dl.google.com/go/go1.26.6.linux-arm64.tar.gz"

+checksum = "sha256:fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49"

+url = "https://dl.google.com/go/go1.26.5.linux-arm64.tar.gz"

[tools.go."platforms.linux-x64"]

-checksum = "sha256:708effb774be8237570d0add163225abbdfaf4fca28b2611df167beba4feef89"

-url = "https://dl.google.com/go/go1.26.6.linux-amd64.tar.gz"

+checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"

+url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"

[[tools.node]]

version = "24.18.0"

diff --git a/mise.toml b/mise.toml
index 9170cef..c57b549 100644
--- a/mise.toml
+++ b/mise.toml

@@ -8,8 +8,7 @@ experimental = true

[tools]

buf = "1.67.0"

-gh = "2.96.0"

-go = "1.26.6"

+go = "1.26.5"

node = "24.18.0"

task = "3.52.0" # Removed after Taskfile.yml is migrated to mise tasks.

zig = "0.16.0"

@@ -18,21 +17,18 @@ zig = "0.16.0"

# APT

"apt:apt-utils" = "latest"

"apt:createrepo-c" = "latest"

-"apt:debsigs" = "latest"

"apt:gnupg" = "latest"

"apt:openssl" = "latest"

-"apt:rpm" = "latest"

"apt:zip" = "latest"

# DNF

"dnf:createrepo_c" = "latest"

"dnf:gnupg2" = "latest"

"dnf:openssl" = "latest"

-"dnf:rpm" = "latest"

"dnf:zip" = "latest"

[task_config]

dir = "{{cwd}}"

includes = [

- "git::https://github.com/dimidiumlabs/platform.git//tasks?ref=8bc35fe8be889c50db2d1fb4425cc1b4097dc6b8",

+ "git::https://github.com/dimidiumlabs/infra.git//tasks?ref=1934f5fb264ab046031d5d1b61227de2e1f8dde9",

]

diff --git a/nfpm.yaml b/nfpm.yaml
index a0fc6ad..ec28380 100644
--- a/nfpm.yaml
+++ b/nfpm.yaml

@@ -7,6 +7,8 @@

name: mirum

arch: ${ARCH}

version: ${VERSION}

+release: ${RELEASE}

+version_schema: none

license: AGPL-3.0-or-later

platform: linux

maintainer: Nikolay Govorov <me@govorov.online>

@@ -127,6 +129,6 @@ rpm:

apk:

signature:

key_file: ${APK_SIGNING_KEY}

- # nFPM appends ".rsa.pub"; the versioned basename lets clients retain

- # historical package keys during rotation.

- key_name: packages.${PACKAGE_KEY_VERSION}

+ # nfpm appends ".rsa.pub" to this value when embedding the signature;

+ # clients must install the public key as /etc/apk/keys/mirum.rsa.pub.

+ key_name: mirum