mrambossekandClaude Opus 5
8a80026d49
Pure stdlib. Implements the spec's core: enrollment (single-use tokens), profile (SPKI pin, only real capabilities advertised), sessions with the §2.4 HKDF-SHA256 key schedule; UDP data plane with the 32-byte ELT1 header, 4-byte HMAC gate, 1024-wide anti-replay window, ECHO_RESP with observation block, TIMESYNC, and the §3.4 anti-amplification cap. Wire format has tests (roundtrip + silent-drop cases); enroll→profile→session smoke-tested live. Modes: container (autodetect /.dockerenv|/run/.containerenv|cgroup, or --docker/ECHOLOT_DOCKER=1; config via ECHOLOT_* env; distroless image; network_mode host required — Docker NAT would falsify observed sources) and native (--install-systemd/--uninstall-systemd with a hardened unit, opt-in --self-update from Gitea releases; refused in containers). CI: tests on any server/ push; server-v* tags build+push the image to the Gitea registry and attach linux amd64/arm64 binaries + SHA256SUMS to a release — the artifact self-update consumes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
26 lines
970 B
Docker
26 lines
970 B
Docker
# SPDX-FileCopyrightText: 2026 Echolot contributors
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
# syntax=docker/dockerfile:1
|
|
|
|
FROM golang:1.26-alpine AS build
|
|
WORKDIR /src
|
|
COPY go.mod ./
|
|
RUN go mod download
|
|
COPY . .
|
|
ARG VERSION=dev
|
|
RUN CGO_ENABLED=0 go build -trimpath \
|
|
-ldflags "-s -w -X main.Version=${VERSION}" \
|
|
-o /out/echolot-server ./cmd/echolot-server
|
|
|
|
# Distroless static: no shell, no package manager; the server is pure Go.
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
COPY --from=build /out/echolot-server /echolot-server
|
|
# State (device store + generated TLS) must persist across container restarts.
|
|
ENV ECHOLOT_STATE_DIR=/state
|
|
VOLUME ["/state"]
|
|
# Ports are documentation only — run with network_mode: host (see compose.yaml):
|
|
# the data plane must see real client source addresses/TTLs, and Docker's
|
|
# userland NAT would falsify exactly what this server exists to observe.
|
|
EXPOSE 8441/tcp 8442/udp 8443/tcp
|
|
ENTRYPOINT ["/echolot-server"]
|