mirror of
https://github.com/block/buzz.git
synced 2026-10-27 04:30:52 +00:00
7e96f91229
Development-signed iOS apps cannot enroll with the current gateway because their Apple App Attest AAGUID is rejected. Add an explicit personal development build feature and environment setting so a development gateway can use a developer's own application identity and sandbox APNs credentials. Ordinary gateway builds remain production-only. Special builds also default to production, enforce exactly the selected signed AAGUID, and retain certificate-chain, pinned-root, nonce, app-ID, key, credential-ID, and counter verification. Document the matching mobile signing configuration and expose the feature through an optional Docker build argument. ### Validation The development image deployed successfully to a personal Railway stack; private readiness, enrollment challenges, authenticated relay access, and APNs sandbox TLS/HTTP2 connectivity passed. Signed-off-by: Tom Brow <tomb@block.xyz>
39 lines
1.6 KiB
Docker
39 lines
1.6 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
ARG RUST_VERSION=1.95
|
|
ARG DEBIAN_VERSION=bookworm
|
|
|
|
FROM rust:${RUST_VERSION}-${DEBIAN_VERSION} AS chef
|
|
RUN cargo install cargo-chef --locked --version 0.1.71
|
|
WORKDIR /build
|
|
|
|
FROM chef AS planner
|
|
COPY . .
|
|
RUN cargo chef prepare --recipe-path recipe.json
|
|
|
|
FROM chef AS builder
|
|
ARG BUZZ_PUSH_CARGO_FEATURES=""
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends build-essential pkg-config libssl-dev ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
COPY --from=planner /build/recipe.json recipe.json
|
|
RUN cargo chef cook --release --recipe-path recipe.json --features "$BUZZ_PUSH_CARGO_FEATURES"
|
|
COPY . .
|
|
RUN cargo build --release --locked -p buzz-push-gateway --bin buzz-push-gateway --features "$BUZZ_PUSH_CARGO_FEATURES" \
|
|
&& strip target/release/buzz-push-gateway
|
|
|
|
FROM debian:${DEBIAN_VERSION}-slim AS runtime
|
|
LABEL org.opencontainers.image.title="Buzz Push Gateway" \
|
|
org.opencontainers.image.description="Capability-gated APNs last hop for Buzz" \
|
|
org.opencontainers.image.source="https://github.com/block/buzz" \
|
|
org.opencontainers.image.licenses="Apache-2.0"
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd --system --gid 1000 buzz \
|
|
&& useradd --system --uid 1000 --gid 1000 --home-dir /var/lib/buzz --create-home --shell /usr/sbin/nologin buzz
|
|
COPY --from=builder /build/target/release/buzz-push-gateway /usr/local/bin/buzz-push-gateway
|
|
EXPOSE 8080 8081
|
|
USER buzz:buzz
|
|
WORKDIR /var/lib/buzz
|
|
ENTRYPOINT ["/usr/local/bin/buzz-push-gateway"]
|