alee/rutster
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

deploy slice B + F: deploy/ artifacts + image-build + container smoke CI + tag-push publish #26

Merged
alee merged 11 commits from deploy-b/packaging-ci into docs/deployment-topology-spec 2026-07-06 19:53:33 +00:00
Conversation 0 Commits 11 Files Changed 25 +1656
alee commented 2026-07-06 19:47:52 +00:00
Owner
Copy Link

What lands

  • deploy/Dockerfile (multi-stage, four named --target stages: rutster-engine/brain/edge/allinone)
  • deploy/compose.yaml (T2 reference; stop_grace_period 660s; brain network_mode: "service:engine")
  • deploy/Caddyfile (tuned timeouts, honest X-Forwarded, stream_close_delay 24h)
  • deploy/.env.example (all RUTSTER_* vars documented)
  • deploy/smoke/{allinone_smoke.py,compose_smoke.sh,reload_during_call.py}
  • .github/workflows/ci.yml extended with image-build + smoke + smoke-compose + smoke-reload jobs
  • .github/workflows/publish-images.yml (slice F tag-push image publish)
  • Plan A assertions (ASSERT_ENGINE_REPLY + ASSERT_ZERO_DROPS) flipped True — Plan A merged in 7e2ae6d

Dependencies

Plan A (PR #24) is the dependency root — TCP_NODELAY + WS pings + the trunk config fixes that the smoke harness's assertions gate on. Plan A is merged into docs/deployment-topology-spec at commit 838ecdf.

Reviews

  • Spec: docs/superpowers/specs/2026-07-05-deployment-topology-design.md §2.1, §2.2, §3.2, §6, §9, §11
  • TLS brief: docs/superpowers/specs/2026-07-05-tls-edge-decision-brief.md §3(a) + §5 risk 1
  • Slice-C TODO hook in deploy/smoke/compose_smoke.sh — the ValkeyEventSink smoke assertion was the named slice-C concern; PR #25 (dev-c) landed it. The hook is now active.

Merge instructions (if non-default)

Default squash-merge. The deploy-b/packaging-ci branch is standalone (no stacked branches depend on its commit SHAs), so squash keeps main linear.

## What lands - deploy/Dockerfile (multi-stage, four named --target stages: rutster-engine/brain/edge/allinone) - deploy/compose.yaml (T2 reference; stop_grace_period 660s; brain network_mode: "service:engine") - deploy/Caddyfile (tuned timeouts, honest X-Forwarded, stream_close_delay 24h) - deploy/.env.example (all RUTSTER_* vars documented) - deploy/smoke/{allinone_smoke.py,compose_smoke.sh,reload_during_call.py} - .github/workflows/ci.yml extended with image-build + smoke + smoke-compose + smoke-reload jobs - .github/workflows/publish-images.yml (slice F tag-push image publish) - Plan A assertions (ASSERT_ENGINE_REPLY + ASSERT_ZERO_DROPS) flipped True — Plan A merged in 7e2ae6d ## Dependencies Plan A (PR #24) is the dependency root — TCP_NODELAY + WS pings + the trunk config fixes that the smoke harness's assertions gate on. Plan A is merged into docs/deployment-topology-spec at commit 838ecdf. ## Reviews - Spec: docs/superpowers/specs/2026-07-05-deployment-topology-design.md §2.1, §2.2, §3.2, §6, §9, §11 - TLS brief: docs/superpowers/specs/2026-07-05-tls-edge-decision-brief.md §3(a) + §5 risk 1 - Slice-C TODO hook in deploy/smoke/compose_smoke.sh — the ValkeyEventSink smoke assertion was the named slice-C concern; PR #25 (dev-c) landed it. The hook is now active. ## Merge instructions (if non-default) Default squash-merge. The deploy-b/packaging-ci branch is standalone (no stacked branches depend on its commit SHAs), so squash keeps main linear.
alee added 11 commits 2026-07-06 19:47:52 +00:00
feat(deploy): multi-stage Dockerfile producing four first-party images (deploy-B §6.1) c612a0d305 
One Dockerfile, four named --target stages: rutster-engine (FOB),
rutster-brain (brain), rutster-edge (custom xcaddy + curated DNS plugins
cloudflare/route53/porkbun/hetzner/desec, duckdns excluded per spec §3.2),
rutster-allinone (s6-overlay v3 supervising caddy + FOB + brain +
valkey-server).

Builder pins rust:1.85-slim-bookworm (matches rust-toolchain.toml).
libopus-dev in builder, libopus0 in runtime (matches dev — spec §6.1
distro-over-static-bundled). Brain image gets libopus0 too: although the
brain never calls an opus symbol, the linker records NEEDED:libopus.so.0
because rutster-brain-realtime depends on rutster-media (spec ambiguity
resolved in this slice's plan README).

All-in-one vendors s6-overlay v3.2.0.0 (ISC) + uses upstream valkey/valkey
binary (COPY --from pattern, BSD-3). Bundled-binary licenses
aggregation-clean vs GPL-3 (Caddy Apache-2.0). No Rust crates touched;
cargo-deny unaffected.

s6-rc service definitions land in this commit (caddy/engine/brain/
valkey-database run scripts + dependency edges). The Caddyfile lands in
Task 3 (same PR); the image-build CI job (Task 7) runs after both.

Signed-off-by: Aaron D. Lee <himself@adlee.work>
chore(deploy): .dockerignore — prune build context (deploy-B §6.1) 1688612b8c 
Signed-off-by: Aaron D. Lee <himself@adlee.work>
feat(deploy): Caddyfile — tuned timeouts, honest X-Forwarded, stream_close_delay 24h (deploy-B §3.2) 7bab5f5561 
The shared edge config for rutster-edge (T2 modular) and rutster-allinone
(T1 solo). ~6-line site block + global options per spec §3.2 / TLS brief
§3(a):

* read_body 30s / read_header 30s — Twilio webhook budget (15s cap by
  invariant 6 + slack).
* write 0 — 20ms media frames self-flush; never write-timeout.
* idle 24h / stream_close_delay 24h — above max call duration (invariant
  3); the universal 60s-class default kills quiet mid-call WS.
* reverse_proxy + header_up — Caddy sets honest X-Forwarded-Proto/Host/For
  for the engine's reconstruct_public_url (plan-A Task 5); engine-side
  RUTSTER_TRUSTED_PROXIES is the trust gate (fail-closed default).

CI override via RUTSTER_LOCAL_CERTS=true uses Caddy's internal CA (no
ACME in CI per spec §9). The reload-during-live-call smoke (Task 9)
regresses the stream_close_delay mitigation against caddy #6420/#7222.

Signed-off-by: Aaron D. Lee <himself@adlee.work>
docs(deploy): .env.example — all RUTSTER_* vars documented (deploy-B §6.2) 1d007d99c6 
The operator documentation surface. Lists every RUTSTER_* var with its
default + the slice that introduced it + the fail-fast behavior. Includes:

* Artifact-level (this slice): RUTSTER_DOMAIN, RUTSTER_ACME_EMAIL,
  RUTSTER_LOCAL_CERTS (CI override).
* FOB engine (slice-5 + plan-A): RUTSTER_HTTP_BIND,
  RUTSTER_DRAIN_DEADLINE_SECS=600 (paired with compose stop_grace_period
  660s per spec §2.2 — grace exceeds drain), RUTSTER_MAX_SESSIONS,
  RUTSTER_MEDIA_BIND_IP/ADVERTISED_IP/PORT_RANGE, RUTSTER_WS_PING_SECS,
  RUTSTER_TRUSTED_PROXIES.
* Trunk (slice-5): the four RUTSTER_TWILIO_* (all-or-none — config.rs
  twilio_credentials rejects partial).
* Brain (slice-2/3): RUTSTER_TAP_URL (loopback-only until step 6).
* Future var stubs: RUTSTER_TLS_CERT/KEY (slice C), RUTSTER_METRICS_BIND
  (slice D), RUTSTER_VALKEY_URL (slice E) — commented out with a pointer
  to the sibling plan.

Bundled-binary licenses noted in the header comment (Caddy Apache-2.0,
valkey BSD-3, s6-overlay ISC, libopus0 BSD-3 — aggregation-clean vs
GPL-3 per ADR-0004); seeds the future cargo-deny-adjacent image license
scan (spec §6.1, out of scope for this slice).

Registry namespace git.adlee.work/alee/rutster-* + the 'if your Gitea
registry uses a different owner segment, replace alee throughout' note.

Signed-off-by: Aaron D. Lee <himself@adlee.work>
feat(deploy): compose.yaml — T2 reference deployment (deploy-B §2.2) 4714ca4da7 
Four services per spec §2.2:

* caddy    — image rutster-edge; ports 80/443; volume caddy-data:/data
             (Caddy ACME state — loss risks LE 5/week duplicate-cert lockout
             per TLS brief §5 risk 5; mounts ./Caddyfile for edit-without-
             rebuild).
* engine   — image rutster-engine; ports 8080 + 49152-49407/udp (media
             UDP direct, never proxied — spec §2.1); stop_grace_period 660s
             paired with RUTSTER_DRAIN_DEADLINE_SECS=600 (grace exceeds drain
             invariant, spec §2.2/§8).
* brain    — image rutster-brain; network_mode: "service:engine" so the
             loopback-only tap posture survives unchanged (resolve_tap_url
             rejects non-loopback until step 6 per spec §2.2). Quoted in
             YAML — `service:engine` would parse as a mapping otherwise.
* valkey   — upstream valkey/valkey:8.0 (BSD-3); volume valkey-data:/data;
             dark on day one except slice-E ValkeyEventSink consumer.

Bring-your-own-proxy: comment out the caddy service; the engine keeps
plaintext :8080; tuned-timeout snippets land in slice-G reverse-proxies.md.
Signed-off-by: Aaron D. Lee <himself@adlee.work>
feat(deploy/smoke): all-in-one + compose + reload-during-call smoke harness (deploy-B §9) abb7e1428d 
Three Python-stdlib-only smoke scripts (no pip install required in CI;
the runner image ships Python 3 + ssl/socket/json/base64/time):

* allinone_smoke.py — boots rutster-allinone with RUTSTER_LOCAL_CERTS=true
  (Caddy internal CA, no ACME per spec §9), extracts the root cert from
  /data, opens wss:// WS to /twilio/media-stream, sends Twilio's
  connected+start handshake (the same JSON sequence the in-tree
  ws_ping.rs/nodelay.rs tests use), streams 200 PCM frames at 20ms cadence,
  asserts the engine echoes/replies at least one text frame. Reuses the
  T8 stub's handshake pattern (crates/rutster/tests/trunk_sim_e2e.rs TODO
  body) against a real containerized binary rather than an in-process
  MockTwilioMediaStreamsServer.
* compose_smoke.sh — T2 four-service boots + health checks via Caddy TLS.
  The # TODO slice-C: assert lifecycle event in Valkey stream named hook
  documents the contract slice C will assert; the valkey service is dark
  on day one (no consumers) so the stream length is always 0 today.
* reload_during_call.py — holds a live WS streaming frames at 20ms while a
  concurrent `caddy reload` fires mid-call; asserts zero frames dropped
  + WS survives across the reload. Regresses the stream_close_delay 24h
  mitigation against caddy #6420/#7222 (TLS brief §5 risk 1; spec §9
  reload-during-call smoke).

WS frame encode/decode is hand-rolled (RFC 6455 §5 — ten lines on top of
socket+ssl) so the smoke needs no websocket-client/websockets pip
dependency + no network round-trip in CI.

Signed-off-by: Aaron D. Lee <himself@adlee.work>
ci: image-build job — builds the four first-party Docker images (deploy-B §6.1) 219df74466 
Extends .github/workflows/ci.yml with an image-build job, gated on the
existing fmt/clippy/test/deny/sim-bench matrix
(needs: [fmt, clippy, test, deny, sim-bench]). Builds all four images via
docker buildx against deploy/Dockerfile's named --targets, with type=gha
caching scoped per image so warm caches take image-build from ~6min to
~90s.

Tags the freshly-built :ci-<sha> images as :smoke too, for the
downstream smoke job to consume. Runs `caddy validate` inside the
freshly-built rutster-edge as a cheap Caddyfile-syntax regression.

No changes to the existing fmt/clippy/test/deny/sim-bench/twilio-live
jobs — those stay the cargo-side source of truth.

Signed-off-by: Aaron D. Lee <himself@adlee.work>
ci: smoke job — all-in-one TLS sim call through real edge->FOB WS path (deploy-B §9) 142933c067 
Adds the smoke job to .github/workflows/ci.yml, gated on image-build.
Runs deploy/smoke/allinone_smoke.py against the freshly-built
rutster-allinone:smoke image:

* Boots the all-in-one container with RUTSTER_LOCAL_CERTS=true (Caddy
  internal CA, no ACME in CI per spec §9).
* Extracts Caddy's internal-CA root cert from /data/caddy/pki/
  authorities/local/root.crt via docker cp.
* Opens wss:// WS to /twilio/media-stream using the extracted root
  (Python stdlib ssl + socket — no pip install required, CI runner-
  image ships Python 3 + ssl).
* Sends Twilio's connected+start handshake frames (the same JSON
  sequence crates/rutster-trunk/tests/ws_ping.rs uses).
* Streams 200 PCM-zeroed frames at 20ms cadence as Twilio Media events.
* Asserts the engine replies with at least one text frame — proving
  the real edge->FOB WS path works end-to-end through TLS.

The compose smoke + reload-during-call smoke (Task 9) gate on this job.

Signed-off-by: Aaron D. Lee <himself@adlee.work>
ci: smoke-compose + smoke-reload jobs — T2 four-service boot + caddy reload-during-call (deploy-B §9) 6be53af5f3 
smoke-compose (gated on image-build):
* Rebuilds rutster-edge/engine/brain:smoke from warm GHA cache.
* Runs deploy/smoke/compose_smoke.sh — `docker compose up -d --wait`,
  asserts all four services State=running, curls /healthz + /readyz
  through Caddy TLS (internal CA). Lighter than the all-in-one smoke
  (which already proved the WS path) — its job is the orchestrator
  shape + the network_mode: "service:engine" brain->engine tap posture.

smoke-reload (gated on smoke):
* Reuses rutster-allinone:smoke + the allinone_smoke.py WS helpers.
* Runs deploy/smoke/reload_during_call.py — holds a live WS streaming
  frames at 20ms while a concurrent `caddy reload` fires mid-call;
  asserts zero frames dropped + WS survives across the reload.
  Regresses the stream_close_delay 24h mitigation against caddy #6420/
  #7222 (TLS brief §5 risk 1; spec §9 reload-during-call smoke).

Both jobs run on ubuntu-latest — separate runners for clearer failure
attribution + parallelism (the smoke gate is the failing CI signal,
not a single serial run).

Signed-off-by: Aaron D. Lee <himself@adlee.work>
ci: publish-images.yml — slice F tag-push image publish (deploy-F §6.3) 3aa9fa4e29 
Tag-push workflow (`on: push: tags: ['v*']`) that publishes all four
first-party images to git.adlee.work/alee/rutster-* (REGISTRY_NAMESPACE
matches the `alee` tea login per AGENTS.md Git workflow + the root
Cargo.toml's repository field). linux/amd64 only (spec §1.2 — arm64 is a
named deferral per ADR-0011).

Gating: re-runs fmt/clippy/test/deny/sim-bench as a `needs:` chain so a
tag's published image is byte-identical to the one tested by the routine
CI matrix. The fmt/clippy/test/deny re-runs are cheap on a green repo
(cache hits, fast checks), and they make a critical guarantee: the
version under a `v*` tag has ALL the repo's quality gates green at
that exact commit. Without this `needs:` chain, a tag could be pushed
at a commit where the matrix failed but image-build happened to succeed
on a flake.

Two tags per image: the version tag (github.ref_name, e.g. v0.1.0) +
`latest` (the convenience tag operators pin to).

Docker login via GITEA_REGISTRY_USERNAME + GITEA_REGISTRY_PASSWORD
secrets, set by the maintainer. If your Gitea registry uses a different
owner segment, replace `alee` throughout (REGISTRY_NAMESPACE + the
namespace/git.adlee.work/alee/ strings in .env.example + compose.yaml).

Signed-off-by: Aaron D. Lee <himself@adlee.work>
fix(smoke): enable Plan A assertions (ASSERT_ENGINE_REPLY + ASSERT_ZERO_DROPS) 1bc36c21b2 
Plan A (PR #24, merged as 7e2ae6d) landed the TCP_NODELAY +
TCP_QUICKACK-suppression + WS ping fixes that the smoke harness's
ASSERT_ENGINE_REPLY + ASSERT_ZERO_DROPS flags gate on. The flags
were left False during deploy-B's Task 6 (commit 4c62222) pending
Plan A's integration. Plan A is now integrated in docs/deployment-topology-spec
at 838ecdf, so the flags flip True — the smoke + smoke-reload CI jobs
now have teeth.

Signed-off-by: Aaron D. Lee <himself@adlee.work>
alee merged commit c772485f92 into docs/deployment-topology-spec 2026-07-06 19:53:33 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
alee
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: alee/rutster#26
Delete Branch "deploy-b/packaging-ci"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?