aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.github/workflows/build.yml67+64 −3
-rw-r--r--.gitignore1+1 −0
-rw-r--r--nfpm.yaml43+43 −0
-rw-r--r--pkg/scripts/postinstall.sh15+15 −0
-rw-r--r--pkg/scripts/preremove.sh8+8 −0
-rw-r--r--pkg/zorian.service46+46 −0
-rw-r--r--pkg/zorian.toml3+3 −0
7 files changed, 180 insertions, 3 deletions
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 26eaea2..28ea39b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -3,6 +3,7 @@ name: Build
on:
push:
branches: [main]
+ tags: ["v*"]
pull_request:
branches: [main]
@@ -32,17 +33,77 @@ jobs:
run: cargo clippy --all-targets --all-features -- -D warnings
build:
- name: Build (${{ matrix.os }})
- runs-on: ${{ matrix.os }}
+ name: Build (${{ matrix.arch }})
+ runs-on: ${{ matrix.runner }}
needs: [lint]
strategy:
fail-fast: false
matrix:
- os: [ubuntu-latest, macos-latest, windows-latest]
+ include:
+ - runner: ubuntu-24.04
+ arch: amd64
+ - runner: ubuntu-24.04-arm
+ arch: arm64
steps:
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
- uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
- uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+ - run: cargo build --release
- run: cargo test --all-features --release --locked
+
+ - name: Install nfpm
+ run: |
+ echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list
+ sudo apt update && sudo apt install nfpm
+
+ - name: Build packages
+ run: |
+ export ARCH=${{ matrix.arch }}
+ export VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version')
+
+ mkdir -p dist/
+ for pkg in deb rpm archlinux; do
+ nfpm package --packager $pkg --target dist/
+ done
+
+ - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+ with:
+ name: packages-${{ matrix.arch }}
+ path: dist/*
+
+ release:
+ name: Update nightly tag
+ runs-on: ubuntu-latest
+ needs: [build]
+ if: github.ref == 'refs/heads/main'
+ permissions:
+ contents: write
+ steps:
+ - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+ - name: Update 'nightly' tag
+ run: |
+ git config user.name "github-actions[bot]"
+ git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+ git tag -f nightly
+ git push origin --force tag nightly
+
+ - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+ with:
+ pattern: packages-*
+ path: dist
+ merge-multiple: true
+
+ - name: Create GitHub Release
+ uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+ with:
+ name: nightly
+ tag_name: nightly
+ files: dist/*
+ body: |
+ **Release checks**: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+ env:
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitignore b/.gitignore
index ea8c4bf..4f96631 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
/target
+/dist
diff --git a/nfpm.yaml b/nfpm.yaml
new file mode 100644
--- /dev/null
+++ b/nfpm.yaml
@@ -0,0 +1,43 @@
+# SPDX-FileCopyrightText: 2026 Nikolay Govorov <me@govorov.online>
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+# yaml-language-server: $schema=https://nfpm.goreleaser.com/schema.json
+# vim: set ts=2 sw=2 tw=0 fo=cnqoj
+
+name: zorian
+arch: ${ARCH}
+version: ${VERSION}
+license: AGPL-3.0-or-later
+platform: linux
+maintainer: Nikolay Govorov <me@govorov.online>
+description: Tiny packages caching proxy
+
+contents:
+ - src: ./LICENSE
+ dst: /usr/share/doc/zorian/LICENSE
+ - src: ./README.md
+ dst: /usr/share/doc/zorian/README.md
+
+ - src: target/release/zorian
+ dst: /usr/local/bin/zorian
+ file_info:
+ mode: 0755
+
+ - src: pkg/zorian.toml
+ dst: /etc/zorian.toml
+ type: config|noreplace
+ file_info:
+ mode: 0644
+ owner: zorian
+
+ - src: pkg/zorian.service
+ dst: /usr/lib/systemd/system/zorian.service
+ file_info:
+ mode: 0644
+
+scripts:
+ postinstall: pkg/scripts/postinstall.sh
+ preremove: pkg/scripts/preremove.sh
+
+rpm:
+ group: System Environment/Daemons
diff --git a/pkg/scripts/postinstall.sh b/pkg/scripts/postinstall.sh
new file mode 100644
--- /dev/null
+++ b/pkg/scripts/postinstall.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+# SPDX-FileCopyrightText: 2026 Nikolay Govorov <me@govorov.online>
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -e
+
+if ! getent group zorian >/dev/null; then
+ groupadd --system zorian
+fi
+
+if ! getent passwd zorian >/dev/null; then
+ useradd --system --gid zorian --no-create-home --shell /usr/sbin/nologin zorian
+fi
+
+systemctl daemon-reload
diff --git a/pkg/scripts/preremove.sh b/pkg/scripts/preremove.sh
new file mode 100644
--- /dev/null
+++ b/pkg/scripts/preremove.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+# SPDX-FileCopyrightText: 2026 Nikolay Govorov <me@govorov.online>
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -e
+
+systemctl stop zorian.service || true
+systemctl disable zorian.service || true
diff --git a/pkg/zorian.service b/pkg/zorian.service
new file mode 100644
--- /dev/null
+++ b/pkg/zorian.service
@@ -0,0 +1,46 @@
+# SPDX-FileCopyrightText: 2026 Nikolay Govorov <me@govorov.online>
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+[Unit]
+Description=Zorian server (tiny packages caching proxy)
+Requires=network-online.target
+Wants=time-sync.target
+After=time-sync.target network-online.target remote-fs.target nss-lookup.target
+
+[Service]
+Type=exec
+User=zorian
+Group=zorian
+ExecPaths=/usr/local/bin/zorian /usr/lib
+ExecStart=/usr/local/bin/zorian --config=/etc/zorian.toml --pid-file=%t/%p/%p.pid
+LimitCORE=infinity
+LimitNOFILE=500000
+Restart=always
+RestartSec=30
+# %p is resolved to the systemd unit name
+RuntimeDirectory=%p
+
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoExecPaths=/
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateTmp=true
+ProcSubset=pid
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProtectSystem=strict
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+RestrictSUIDSGID=yes
+UMask=0077
+
+[Install]
+# service should not start from the rescue shell (rescue.target).
+WantedBy=multi-user.target
diff --git a/pkg/zorian.toml b/pkg/zorian.toml
new file mode 100644
--- /dev/null
+++ b/pkg/zorian.toml
@@ -0,0 +1,3 @@
+# SPDX-FileCopyrightText: 2026 Nikolay Govorov <me@govorov.online>
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
generated by Gilti