server: Go skeleton — control plane, UDP data plane, Docker + systemd modes

Pure stdlib. Implements the spec's core: enrollment (single-use tokens), profile (SPKI pin, only real capabilities advertised), sessions with the §2.4 HKDF-SHA256 key schedule; UDP data plane with the 32-byte ELT1 header, 4-byte HMAC gate, 1024-wide anti-replay window, ECHO_RESP with observation block, TIMESYNC, and the §3.4 anti-amplification cap. Wire format has tests (roundtrip + silent-drop cases); enroll→profile→session smoke-tested live. Modes: container (autodetect /.dockerenv|/run/.containerenv|cgroup, or --docker/ECHOLOT_DOCKER=1; config via ECHOLOT_* env; distroless image; network_mode host required — Docker NAT would falsify observed sources) and native (--install-systemd/--uninstall-systemd with a hardened unit, opt-in --self-update from Gitea releases; refused in containers). CI: tests on any server/ push; server-v* tags build+push the image to the Gitea registry and attach linux amd64/arm64 binaries + SHA256SUMS to a release — the artifact self-update consumes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-30 13:09:08 +02:00
parent ee66648e3c
commit 8a80026d49
15 changed files with 1502 additions and 0 deletions
@@ -0,0 +1,76 @@
+# Server CI: tests on every push touching server/; on server-v* tags builds
+# and pushes the container image to the Gitea registry AND attaches static
+# binaries to a Gitea release (the artifact --self-update consumes).
+#
+# Tags are namespaced (server-v1.2.3) so app releases (v*) and server
+# releases don't trigger each other's pipelines.
+#
+# Required secrets: none beyond the built-in GITHUB_TOKEN — it can push to
+# the registry of its own repo and create releases.
+
+name: server
+on:
+  push:
+    paths: ["server/**", ".gitea/workflows/build-server.yml"]
+    tags: ["server-v*.*.*"]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    defaults: { run: { working-directory: server } }
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with: { go-version: "1.26", cache-dependency-path: server/go.mod }
+      - run: go vet ./...
+      - run: go test ./...
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/server-v')
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with: { go-version: "1.26", cache-dependency-path: server/go.mod }
+
+      - name: Derive version + registry coords
+        id: meta
+        run: |
+          echo "version=${GITHUB_REF_NAME#server-}" >> "$GITHUB_OUTPUT"
+          HOST="${GITHUB_SERVER_URL#https://}"
+          echo "image=$HOST/${GITHUB_REPOSITORY,,}-server" >> "$GITHUB_OUTPUT"
+
+      - name: Build static binaries (linux amd64+arm64)
+        working-directory: server
+        run: |
+          for arch in amd64 arm64; do
+            CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build -trimpath \
+              -ldflags "-s -w -X main.Version=${{ steps.meta.outputs.version }}" \
+              -o "../dist/echolot-server_linux_${arch}" ./cmd/echolot-server
+          done
+          (cd ../dist && sha256sum * > SHA256SUMS)
+
+      - name: Build + push image
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login "${GITHUB_SERVER_URL#https://}" -u "$GITHUB_ACTOR" --password-stdin
+          docker build server \
+            --build-arg VERSION=${{ steps.meta.outputs.version }} \
+            -t "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}" \
+            -t "${{ steps.meta.outputs.image }}:latest"
+          docker push "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}"
+          docker push "${{ steps.meta.outputs.image }}:latest"
+
+      - name: Create release + attach binaries
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+        run: |
+          REL=$(curl -sf -X POST "$API/releases" \
+            -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"$GITHUB_REF_NAME\",\"name\":\"$GITHUB_REF_NAME\"}")
+          ID=$(echo "$REL" | jq -r .id)
+          for f in dist/*; do
+            curl -sf -X POST "$API/releases/$ID/assets?name=$(basename "$f")" \
+              -H "Authorization: token $TOKEN" -F "attachment=@$f"
+          done