2ro
33c5ee568f
ci / fmt / clippy / test (push) Has been cancelled
Production has run GP_NYM=off for over a day: GoblinPay already reaches its relays over clearnet, which is the end state the ecosystem's Nym → Tor move aims for. This removes the now-dead ported Nym client and its plumbing. Pure subtraction — the code path that remains is exactly the one already running live, so there is no behavior change beyond "GoblinPay still boots and still moves money." Per TOR-MIGRATION-PLAN.md. Removed: - crates/gp-nostr/src/nym/ (mod, transport, nymproc, dns — 599 lines). - smolmix + hickory-proto (and the nym-only rand) deps from gp-nostr, and their transitive tree from Cargo.lock. - GP_NYM config plumbing (gp-core config: field, parse, default, summary), the opts.nym service branch, the main.rs warm-up wiring, and the admin dashboard Nym row. - The nym leg of the CI sibling-checkout gate (.github + .gitea), the `COPY nym` / sibling mentions in Dockerfile/compose/install.sh, and the GP_NYM copy in README, .env.example, and the three connector docs. GoblinPay does not gain a Tor transport of its own: it is receive-only infrastructure, and the sender privacy that matters rides the paying customer's own Goblin Wallet. Content encryption (NIP-44 in a NIP-59 gift-wrap) and the slatepack (grin1) path are untouched. The optional onion-dialing and relay-list trim the plan flags are left for the owner.
66 lines
2.5 KiB
Docker
66 lines
2.5 KiB
Docker
# Multi-stage build for the GoblinPay server, run as a non-root user.
|
|
#
|
|
# IMPORTANT — build context is the WORKSPACE PARENT, not the repo.
|
|
# The Nostr money path depends on a crate that lives next to this repo, not
|
|
# inside it (see crates/gp-nostr/Cargo.toml):
|
|
# nip44 -> ../nip44 (the NIP-44 v3 companion crate)
|
|
# So the image must be built from the directory that contains GoblinPay/ and
|
|
# nip44/ side by side. docker-compose.yml already sets
|
|
# `build.context: ../..` for this; to build by hand:
|
|
#
|
|
# cd "<workspace parent containing GoblinPay, nip44>"
|
|
# docker build -f GoblinPay/deploy/Dockerfile -t goblinpay:latest .
|
|
#
|
|
# Only `-p gp-server` is built, which EXCLUDES the gp-goblin-sender dev crate
|
|
# (it needs the goblin wallet tree, absent on servers). gp-wallet's grin_wallet
|
|
# crates are fetched from git during the build.
|
|
|
|
# ---- builder ----
|
|
FROM rust:1-bookworm AS builder
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends clang cmake pkg-config libssl-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
WORKDIR /build
|
|
|
|
# The trees the gp-server dependency graph needs, in the same relative layout
|
|
# the path deps expect (nip44 is a sibling of GoblinPay).
|
|
COPY GoblinPay ./GoblinPay
|
|
COPY nip44 ./nip44
|
|
|
|
WORKDIR /build/GoblinPay
|
|
# Build ONLY gp-server (and its deps); never the goblin-tree dev crate.
|
|
RUN cargo build --release --locked -p gp-server
|
|
|
|
# ---- runtime ----
|
|
FROM debian:bookworm-slim AS runtime
|
|
# ca-certificates for outbound TLS (node reads, CoinGecko, relays); curl for the
|
|
# healthcheck.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Non-root user; wallet files, seed-at-rest, and the SQLite db live under /data.
|
|
RUN useradd --system --uid 10001 --home-dir /data --shell /usr/sbin/nologin goblinpay \
|
|
&& mkdir -p /data \
|
|
&& chown -R goblinpay:goblinpay /data
|
|
|
|
COPY --from=builder /build/GoblinPay/target/release/gp-server /usr/local/bin/gp-server
|
|
|
|
USER goblinpay
|
|
WORKDIR /data
|
|
VOLUME ["/data"]
|
|
|
|
# Bind on all interfaces inside the container (Caddy is the only thing in front);
|
|
# keep state under the /data volume. Money/identity secrets are injected at run
|
|
# time via the *_FILE mounted-secret variants, never baked into the image.
|
|
ENV GP_BIND=0.0.0.0:8080 \
|
|
GP_DB_PATH=/data/goblinpay.db \
|
|
GP_DATA_DIR=/data/gp-data
|
|
|
|
EXPOSE 8080
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
|
|
CMD curl -fsS http://127.0.0.1:8080/health || exit 1
|
|
|
|
ENTRYPOINT ["/usr/local/bin/gp-server"]
|