5 Commits

Include renames

Author	SHA1	Message	Date
mrambossekandClaude Opus 5	234622549c	ci: image job on the dedicated 'echolot' runner; public registry host default ... compilesau-echolot (repo runner, label echolot) handles the docker image build. Registry host defaults to git.rambossek.at (runner-internal GITHUB_SERVER_URL is http://app:3000). Asset re-uploads on tag re-runs warn instead of failing the completed release. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-30 16:29:27 +02:00
mrambossekandClaude Opus 5	33db502a76	ci: fix release-id extraction (greedy sed grabbed the wrong id) + re-run safety ... The job log showed uploads 404ing: sed's greedy .* matched the LAST "id" in the release JSON (a nested user id), not the release's. First-match grep now. Release creation falls back to GET-by-tag on re-runs, and the image job strips any scheme from the internal server URL (http://app:3000) with an ECHOLOT_REGISTRY_HOST override for the public registry host. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-30 16:15:46 +02:00
mrambossekandClaude Opus 5	8d15a318fb	ci: split server release into independent binaries and image jobs ... First tag run failed as one monolithic job. Binaries + Gitea release now need only Go and curl (jq dropped too) and succeed on any runner; the docker image build is a separate job that can fail without killing the release self-update depends on. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-30 16:00:23 +02:00
mrambossekandClaude Opus 5	0c988df7e8	ci: split server test and release workflows — mixed paths+tags never fired ... A push trigger that declares tags: stops matching branch pushes, and the paths filter doesn't apply to tag pushes — so the combined workflow could effectively never run. test-server.yml now covers branch pushes touching server/; build-server.yml is tags-only (server-v*). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-30 15:41:25 +02:00
mrambossekandClaude Opus 5	8a80026d49	server: Go skeleton — control plane, UDP data plane, Docker + systemd modes ... Pure stdlib. Implements the spec's core: enrollment (single-use tokens), profile (SPKI pin, only real capabilities advertised), sessions with the §2.4 HKDF-SHA256 key schedule; UDP data plane with the 32-byte ELT1 header, 4-byte HMAC gate, 1024-wide anti-replay window, ECHO_RESP with observation block, TIMESYNC, and the §3.4 anti-amplification cap. Wire format has tests (roundtrip + silent-drop cases); enroll→profile→session smoke-tested live. Modes: container (autodetect /.dockerenv|/run/.containerenv|cgroup, or --docker/ECHOLOT_DOCKER=1; config via ECHOLOT_* env; distroless image; network_mode host required — Docker NAT would falsify observed sources) and native (--install-systemd/--uninstall-systemd with a hardened unit, opt-in --self-update from Gitea releases; refused in containers). CI: tests on any server/ push; server-v* tags build+push the image to the Gitea registry and attach linux amd64/arm64 binaries + SHA256SUMS to a release — the artifact self-update consumes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-30 13:09:08 +02:00