collin/anvil · 5c9b6b3e

Build the image from source; `hag deploy` is now the whole deploy

Collin Richards · 2026-08-27 02:05 UTC · 5c9b6b3ef8fc178f0dc9c1e53a01cce893c9f8f4 · parent a5967525 · browse files

modified.gitignore+0 −5

modifiedCLAUDE.md+16 −9

addedCargo.lock+5820 −0

modifiedDEPLOY.md+51 −43

modifiedREADME.md+6 −7

modifiedcompose.override.yaml+12 −5

modifiedcompose.yaml+10 −10

deleteddeploy/build.sh+0 −67

deleteddeploy/deploy.sh+0 −39

modifieddeploy/dev.sh+12 −19

addeddocker/Dockerfile+153 −0

deleteddocker/anvil/Dockerfile+0 −34

deleteddocker/worker/Dockerfile+0 −32

modifieddocs/remote-runners.md+5 −5

1		-	Cargo.lock
2	1		/target
3	2		/data
4	3		*.db
5	4		*.db-wal
6	5		*.db-shm
7	6		anvil.toml
8		-	# Binaries staged by ./deploy/build.sh beside the Dockerfile that COPYs each.
9		-	/docker/anvil/anvild
10		-	# `--worker` only; for the local runner containers.
11		-	/docker/worker/anvil-worker
12	7		# CA bundle deploy/dev.sh builds so the dev container trusts portless (docs/oidc.md).
13	8		/deploy/dev-ca.crt
14	9		# Local-only API credentials for fetching attachments (never committed).
⋯ 1 unchanged line

⋯ 25 unchanged lines
26	26		letting the list rot.
27	27
28	28		The Rust version is set in exactly one place: `rust-toolchain.toml`. It
29		-	pins the toolchain and the musl cross target for every `cargo` invocation here,
30		-	and `docker/runner/build.sh` parses `[toolchain] channel` out of it to bake the
31		-	same version into `anvil-runner:rust` — so a CI job and a checkout compile with
32		-	the same rustc. Bumping Rust means editing that file and Cargo.toml's floor
33		-	(the hook catches you if you forget the second), then rebuilding the image.
	29	+	pins the toolchain and the musl cross target for every `cargo` invocation here;
	30	+	`docker/runner/build.sh` parses `[toolchain] channel` out of it to bake the
	31	+	same version into `anvil-runner:rust`; and `docker/Dockerfile` copies it in
	32	+	ahead of the sources and lets rustup materialize it, so the deployed binary
	33	+	compiles with that rustc too. Bumping Rust means editing that file and
	34	+	Cargo.toml's floor (the hook catches you if you forget the second), then
	35	+	rebuilding the images.
34	36
	37	+	`Cargo.lock` is committed, and `docker/Dockerfile` builds `--locked`. The
	38	+	image is built from the dependency set the commit records rather than whatever
	39	+	resolves that day. A change that needs the lockfile updated fails the build
	40	+	instead of drifting; commit the new lockfile with the change.
	41	+
35	42		## Viewing attachments referenced in tasks
36	43
37	44		TODO items and tickets may embed an uploaded image as
⋯ 91 unchanged lines
129	136		Setting one up on the Mac mini (build, Rosetta, the launchd agent in
130	137		`deploy/worker/`) is written out in `docs/remote-runners.md` § Isolation on
131	138		macOS. Locally, `compose.override.yaml` runs two of them in containers
132		-	(`./deploy/build.sh --debug --worker`, then `docker compose up -d --build`) so
133		-	concurrency and routing are testable on one machine; that mount is a
134		-	development-only concession, never production's. Who is connected, and what
135		-	each is running, is at `/-/admin/runners` — presence comes from ordinary claims
	139	+	(`docker compose up -d --build`) so concurrency and routing are testable on one
	140	+	machine; that mount is a development-only concession, never production's. Who
	141	+	is connected, and what each is running, is at `/-/admin/runners` — presence
	142	+	comes from ordinary claims
136	143		and heartbeats rather than a ping of its own, so anything watching for a runner
137	144		to go quiet has to allow a full claim poll first.
138	145		Agent sessions still drive Docker locally and are the one thing the dropped
⋯ 5 unchanged lines

⋯ 17 unchanged lines
18	18		passes `-f compose.yaml` explicitly, so none of it ever reaches hagrid. See the
19	19		README for the local loop.
20	20
21		-	anvil needs one step in front of that, because the image carries a prebuilt
22		-	binary — `deploy/deploy.sh` is the whole deploy:
	21	+	`hag deploy` is the whole deploy:
23	22
24	23		```sh
25		-	./deploy/deploy.sh # cross-compile, build, push, restart on hagrid
26		-	./deploy/deploy.sh -n # dry run: print every step, change nothing
	24	+	hag deploy # build, push, pull and recreate on hagrid
	25	+	hag deploy -n # dry run: print every step, change nothing
27	26		```
28	27
29		-	which is:
	28	+	`docker/Dockerfile` compiles anvild itself, from the build context, in a
	29	+	builder stage that cross-links to a fully static `x86_64-unknown-linux-musl`
	30	+	binary with cargo-zigbuild. The builder runs on your architecture
	31	+	(`--platform=$BUILDPLATFORM`) and only the linker targets amd64, so an arm64
	32	+	Mac produces hagrid's image at native speed rather than emulating rustc. The
	33	+	runtime stage then `COPY --from=builder`s the binary onto `ubuntu:26.04`.
30	34
31		-	1. `deploy/build.sh` — `cargo zigbuild --release --target
32		-	x86_64-unknown-linux-musl` cross-compiles a fully static binary natively
33		-	(~2 min, no emulation) and stages it at `docker/anvil/anvild`,
34		-	2. `hag deploy` — `docker compose build --push` builds the thin image that just
35		-	`COPY`s that binary in (the `Dockerfile` compiles nothing), pushes it, then
36		-	drives the host.
	35	+	That the build context is the only input is the point: there is no staged
	36	+	artifact in the working tree, so `hag deploy` cannot ship a binary older than
	37	+	the commit it tags. It replaces the `deploy/build.sh` + `deploy/deploy.sh` pair
	38	+	that used to sit in front of it.
37	39
38	40		Do not build on the VPS — a release build needs ~2–4 GB peak and OOMs a
39	41		cheap, swap-less droplet. The VPS never compiles anything; it only pulls.
40	42
41		-	One-time toolchain setup:
	43	+	One-time setup is now just the registry:
42	44
43	45		```sh
44		-	dnf install zig # or: brew install zig
45		-	cargo install cargo-zigbuild
46	46		docker login registry.vibe.richardscollin.com # on this machine and hagrid
47	47		```
48	48
49		-	The Rust toolchain itself needs no setup step: `rust-toolchain.toml` pins the
50		-	version and the `x86_64-unknown-linux-musl` target, and rustup installs both
51		-	on the first `cargo` invocation in the repo. That file is the one place the
52		-	Rust version is set — `docker/runner/build.sh` reads it to bake the same
53		-	toolchain into `anvil-runner:rust`.
	49	+	No host Rust toolchain, no `zig`, no `cargo-zigbuild` — the builder stage
	50	+	carries all three, with zig pinned by version and sha256 and cargo-zigbuild
	51	+	pinned by version. The Rust version still comes from `rust-toolchain.toml` and
	52	+	nowhere else: the Dockerfile copies that file in ahead of the sources and lets
	53	+	rustup materialize the pinned channel and the musl target, exactly as
	54	+	`docker/runner/build.sh` reads it to bake the same toolchain into
	55	+	`anvil-runner:rust`.
	56	+
	57	+	`Cargo.lock` is committed and the builder passes `--locked`, so the image is
	58	+	built from the resolved dependency set the commit records — a build that would
	59	+	need to change the lockfile fails instead of silently drifting.
	60	+
	61	+	Build caching. The builder mounts BuildKit caches over the cargo registry
	62	+	and `target/`, so only what you changed recompiles. They are not part of any
	63	+	layer, which is why the binaries are copied out to `/out` inside the same
	64	+	`RUN`. `docker builder prune` throws these away and the next build is cold.
54	65
55	66		Every build is tagged twice: with the short git sha of the checkout (plus a
56	67		`-dirty` suffix when the working tree has uncommitted changes) and with
⋯ 2 unchanged lines
59	70		host:
60	71
61	72		```sh
62		-	ssh hagrid 'cd anvil && IMAGE_TAG=<sha> docker compose up -d --no-build'
	73	+	ssh hagrid 'cd compose/anvil && IMAGE_TAG=<sha> docker compose up -d --no-build'
63	74		```
64	75
65	76		Managing it afterwards needs no ssh and no remembering where it lives:
⋯ 46 unchanged lines
112	123		The baked config lives at `/etc/anvil/anvil.toml` (see `deploy/anvil.toml`).
113	124		Override it by bind-mounting your own file over that path.
114	125
115		-	Host-side config. `compose.yaml` loads `~/anvil/.env` on the host if it
116		-	exists, and skips it if not — `hag` never copies a local `.env` up, so the
117		-	workstation and the host keep separate config. Today that file carries the SSO
118		-	client secret (§ [docs/oidc.md](docs/oidc.md)):
	126	+	Host-side config. `compose.yaml` loads `.env` from the project directory
	127	+	on the host (`~/compose/anvil`) if it exists, and skips it if not — `hag` never
	128	+	copies a local `.env` up, so the workstation and the host keep separate config.
	129	+	Today that file carries the SSO client secret (§ [docs/oidc.md](docs/oidc.md)):
119	130
120	131		```sh
121	132		ssh hagrid 'printf "ANVIL_OIDC_CLIENT_SECRET=%s\n" \
122		-	"$(tr -d "[:space:]" < ~/.config/anvil/oidc-client-secret)" > ~/anvil/.env \
123		-	&& chmod 600 ~/anvil/.env'
	133	+	"$(tr -d "[:space:]" < ~/.config/anvil/oidc-client-secret)" \
	134	+	> ~/compose/anvil/.env && chmod 600 ~/compose/anvil/.env'
124	135		```
125	136
126	137		Leave the variable out entirely rather than setting it empty: empty would
127	138		override the baked config and turn a confidential OIDC client into a public one.
128	139
129		-	Migrating from the `docker run` deploys. The old container was created by
130		-	`docker run`, so it carries no compose labels; compose reads `container_name:
131		-	anvil` as taken by a foreign container and refuses to adopt it. Clear it once,
132		-	before the first compose deploy:
133		-
134		-	```sh
135		-	ssh hagrid 'docker rm -f anvil'
136		-	```
137		-
138		-	The `anvil-data` volume is untouched by that and is what the new container
139		-	picks up.
	140	+	Migrating from the `docker run` deploys. Done on 2026-08-27, kept here
	141	+	because the failure mode is not obvious. The old container was created by
	142	+	`docker run`, so it carried no compose labels; compose read `container_name:
	143	+	anvil` as taken by a foreign container and refused to adopt it. Clearing it
	144	+	once (`ssh hagrid 'docker rm -f anvil'`) left the `anvil-data` volume untouched,
	145	+	which is what the compose container picked up. `hag` also moved projects from
	146	+	`~/<name>` to `~/compose/<name>` and refuses to deploy while state sits at the
	147	+	old path — it prints the `mv` to run.
140	148
141	149		## 5. First run: create your account, key, and the repo
142	150
⋯ 55 unchanged lines
198	206
199	207		Architecture. The Mac is arm64 and hagrid is x86_64, so a job running
200	208		`cargo test` on the runner tests an architecture you do not ship. Images are
201		-	unaffected (`deploy/build.sh` cross-compiles, and `compose.yaml` pins
202		-	`platforms: [linux/amd64]`), and per-pipeline platform selection is designed but
203		-	not yet wired to a config key.
	209	+	unaffected (the builder stage cross-compiles, and both it and `compose.yaml`
	210	+	pin amd64), and per-pipeline platform selection is designed but not yet wired
	211	+	to a config key.
204	212
205	213		## 8. The redeploy webhook (CD)
206	214
⋯ 59 unchanged lines
266	274
267	275		## Operations
268	276
269		-	- Update: `./deploy/deploy.sh` (cross-compile + push + restart in one
270		-	command); or `hag restart` to recreate the container from the image already
271		-	on the host (the `anvil-data` volume persists). NOTE: adding new DB tables in a
	277	+	- Update: `hag deploy` (compile + push + restart in one command); or
	278	+	`hag restart` to recreate the container from the image already on the host
	279	+	(the `anvil-data` volume persists). NOTE: adding new DB tables in a
272	280		future version won't auto-apply to an existing database yet (Toasty migration
273	281		support is pending) — the git repos on disk are unaffected, but repo metadata
274	282		in SQLite may need recreating until migrations land.
⋯ 7 unchanged lines

⋯ 33 unchanged lines
34	34		automatically:
35	35
36	36		```sh
37		-	./deploy/build.sh --debug # stage the binary the image COPYs in
38	37		docker compose up -d --build # then http://127.0.0.1:20640
39	38		docker compose logs -f
40	39		docker compose down
⋯ 13 unchanged lines
54	53		## Deploying
55	54
56	55		`compose.yaml` describes the deployment; `hag`, the shared deploy tool for
57		-	every project on hagrid, runs it there. The image carries a prebuilt static
58		-	binary rather than compiling in Docker, so one step comes first:
	56	+	every project on hagrid, runs it there. `docker/Dockerfile` compiles anvild out
	57	+	of the build context, so there is nothing to stage first:
59	58
60	59		```sh
61		-	./deploy/deploy.sh # cross-compile, build, push, then restart on the host
62		-	./deploy/deploy.sh -n # dry run: print every step, change nothing
63		-	hag status # what the host is running
64		-	hag logs -f # its logs
	60	+	hag deploy # build, push, then pull and recreate on the host
	61	+	hag deploy -n # dry run: print every step, change nothing
	62	+	hag status # what the host is running
	63	+	hag logs -f # its logs
65	64		```
66	65
67	66		Full details, including first-run setup and the CD webhook, are in
⋯ 11 unchanged lines

⋯ 3 unchanged lines
4	4		# the SSO issuer is a public HTTPS URL with a normal CA, and there is
5	5		# deliberately no Docker socket.
6	6		#
7		-	# The images carry prebuilt binaries, so stage them first (--debug compiles in
8		-	# a fraction of the time a release build takes; --worker adds anvil-worker for
9		-	# the two runner containers below):
	7	+	# The images compile themselves (docker/Dockerfile), so bringing the stack up
	8	+	# is one command -- PROFILE=debug below keeps the local loop off the optimizer,
	9	+	# and a BuildKit cache mount means an edit recompiles the crate you touched
	10	+	# rather than the whole workspace:
10	11		#
11		-	# ./deploy/build.sh --debug --worker
12	12		# docker compose up -d --build
13	13		#
14	14		# Then http://127.0.0.1:20640. `docker compose logs -f`, `docker compose down`.
⋯ 16 unchanged lines
31	31		image: anvil-worker-dev:latest
32	32		build:
33	33		context: .
34		-	dockerfile: docker/worker/Dockerfile
	34	+	dockerfile: docker/Dockerfile
	35	+	target: worker
	36	+	args:
	37	+	PROFILE: debug
35	38		platforms:
36	39		- linux/amd64
37	40		restart: unless-stopped
⋯ 34 unchanged lines
72	75		# production's: local base_url, the login.localhost issuer, agent
73	76		# sessions on, and shorter periodic scans.
74	77		CONFIG: deploy/anvil.dev.toml
	78	+	# Unoptimized: the local loop cares about how long a rebuild takes,
	79	+	# not how fast the server runs. Must match the runners' PROFILE, or
	80	+	# the two stages fall out of one cargo invocation into two.
	81	+	PROFILE: debug
75	82		# Not `anvil`: that name belongs to deploy/dev.sh's container, and compose
76	83		# refuses to adopt a container it did not label.
77	84		container_name: anvil-dev
⋯ 78 unchanged lines

⋯ 2 unchanged lines
3	3		# recreate there). Both this machine and hagrid need
4	4		# `docker login registry.vibe.richardscollin.com` once.
5	5		#
6		-	# The image carries a PREBUILT binary: the Dockerfile only COPYs in
7		-	# docker/anvil/anvild, which deploy/build.sh cross-compiles as a static
8		-	# x86_64-musl executable. So `hag deploy` on its own is not enough -- use
9		-	# ./deploy/deploy.sh, which stages the binary and then calls it.
	6	+	# `hag deploy` is the whole deploy. docker/Dockerfile compiles anvild itself
	7	+	# from this build context, cross-linking to static x86_64-musl, so there is no
	8	+	# staging step in front of it and nothing that can be silently out of date.
10	9		#
11	10		# IMAGE_TAG picks which build runs. hag sets it to the git sha it just pushed,
12	11		# so `hag status` names the exact build, and rolling back on the host is
⋯ 2 unchanged lines
15	14		anvil:
16	15		image: registry.vibe.richardscollin.com/anvil:${IMAGE_TAG:-latest}
17	16		build:
18		-	# Context is the repo root (the binary is staged under docker/, and the
19		-	# baked config lives in deploy/), so the Dockerfile has to be named.
	17	+	# Context is the repo root -- the Dockerfile compiles the workspace out
	18	+	# of it, and the baked config lives in deploy/ -- so it has to be named.
20	19		context: .
21		-	dockerfile: docker/anvil/Dockerfile
22		-	# hagrid is x86_64 and the staged binary is x86_64-musl. Pinning the
23		-	# platform stops an arm64 workstation from producing an image whose
24		-	# base layers the host cannot run.
	20	+	dockerfile: docker/Dockerfile
	21	+	target: anvil
	22	+	# hagrid is x86_64 and the binary is cross-compiled to x86_64-musl.
	23	+	# The Dockerfile's runtime stages pin the same thing; saying it here too
	24	+	# keeps an arm64 workstation from being asked to resolve an arm64 base.
25	25		platforms:
26	26		- linux/amd64
27	27		container_name: anvil
⋯ 56 unchanged lines

1	-	#!/usr/bin/env bash
2	-	# Stage the anvild binary that the image COPYs in. NOT run on the VPS — it
3	-	# never compiles anything.
4	-	#
5	-	# Uses cargo-zigbuild to cross-compile a fully static x86_64-musl executable at
6	-	# native speed (no QEMU) and leaves it in docker/, beside the Dockerfile that
7	-	# COPYs it. Building and pushing the image is compose's job from there (see
8	-	# compose.yaml); ./deploy/deploy.sh runs both halves.
9	-	#
10	-	# ./deploy/build.sh release — what gets deployed
11	-	# ./deploy/build.sh --debug unoptimized, for the local compose.override.yaml
12	-	# ./deploy/build.sh --worker also stage anvil-worker, for the local runners
13	-	#
14	-	# --worker is a local-development thing only: production runners are native
15	-	# processes on the build host (docs/remote-runners.md), and nothing on hagrid
16	-	# builds or runs the worker image.
17	-	#
18	-	# Prereqs (one-time):
19	-	# zig (dnf install zig, or brew install zig)
20	-	# cargo install cargo-zigbuild
21	-	# The toolchain and the musl target come from rust-toolchain.toml — rustup
22	-	# installs both on the first cargo invocation in the repo.
23	-	set -euo pipefail
24	-
25	-	TARGET="x86_64-unknown-linux-musl"
26	-	PROFILE=release
27	-	CARGO_FLAGS=(--release)
28	-	# Binary name → the image dir whose Dockerfile COPYs it. Both are gitignored
29	-	# and overwritten by the next build.
30	-	BINS=(anvild)
31	-	stage_dir() {
32	-	case "$1" in
33	-	anvild) echo docker/anvil ;;
34	-	anvil-worker) echo docker/worker ;;
35	-	*) echo "no image dir for binary $1" >&2; exit 1 ;;
36	-	esac
37	-	}
38	-
39	-	for arg in "$@"; do
40	-	case "$arg" in
41	-	--debug) PROFILE=debug; CARGO_FLAGS=() ;;
42	-	--worker) BINS+=(anvil-worker) ;;
43	-	*) echo "usage: $0 [--debug] [--worker]" >&2; exit 64 ;;
44	-	esac
45	-	done
46	-
47	-	cd "$(dirname "$0")/.."
48	-
49	-	# macOS terminals default to a 256 open-file soft limit; zig's linker opens
50	-	# every rlib at once and dies with ProcessFdQuotaExceeded. Raise it for this
51	-	# process (children inherit it).
52	-	ulimit -n 4096 2>/dev/null \|\| true
53	-
54	-	# Static musl even for --debug: the runtime image is Ubuntu, and a binary
55	-	# linked against Fedora's glibc would not run there.
56	-	for bin in "${BINS[@]}"; do
57	-	echo "==> cross-compiling $bin for $TARGET ($PROFILE, native, via zig)"
58	-	cargo zigbuild --target "$TARGET" --bin "$bin" "${CARGO_FLAGS[@]}"
59	-
60	-	dir="$(stage_dir "$bin")"
61	-	echo "==> staging binary at $dir/$bin"
62	-	cp "target/$TARGET/$PROFILE/$bin" "$dir/$bin"
63	-	done
64	-
65	-	# Deliberately left in place: `docker compose build` runs after this and needs
66	-	# it in the context. It is gitignored, and the next build overwrites it.
67	-	echo "==> staged ($PROFILE). Build the image with: docker compose build"

1	-	#!/usr/bin/env bash
2	-	# Build and deploy anvil to hagrid.
3	-	#
4	-	# Two halves, because the image carries a prebuilt binary rather than compiling
5	-	# in Docker:
6	-	#
7	-	# 1. build.sh cross-compiles anvild and stages it at docker/anvil/anvild,
8	-	# 2. `hag deploy` does the rest from compose.yaml — build the image, push it
9	-	# to the registry, copy compose.yaml to the host, pull and recreate there.
10	-	#
11	-	# hag is the shared deploy tool for every project on hagrid and lives in the
12	-	# hagrid repo, so nothing here is anvil-specific any more. Install it once with
13	-	# `~/Code/hagrid/hag install`.
14	-	#
15	-	# Usage: ./deploy/deploy.sh [hag deploy options]
16	-	# e.g. ./deploy/deploy.sh -n dry run (skips the compile)
17	-	# ./deploy/deploy.sh --host other deploy elsewhere
18	-	#
19	-	# Afterwards: `hag status`, `hag logs -f`, `hag restart`, `hag down`.
20	-	set -euo pipefail
21	-
22	-	if ! command -v hag >/dev/null; then
23	-	echo "deploy.sh: hag is not on PATH — run: ~/Code/hagrid/hag install" >&2
24	-	exit 1
25	-	fi
26	-
27	-	# A dry run reports what would happen and changes nothing, so spending two
28	-	# minutes on a release build first would defeat the point. hag reads the image
29	-	# reference out of compose.yaml, which does not need the binary to exist.
30	-	DRY_RUN=0
31	-	for arg in "$@"; do
32	-	case "$arg" in
33	-	-n \| --dry-run) DRY_RUN=1 ;;
34	-	esac
35	-	done
36	-
37	-	[ "$DRY_RUN" = 1 ] \|\| "$(dirname "$0")/build.sh"
38	-
39	-	exec hag deploy "$@"

1	1		#!/usr/bin/env bash
2	2		# Run anvil locally in Docker, reachable at https://anvil.localhost.
3	3		#
4		-	# The same image shape as production (deploy/build.sh + docker/anvil/Dockerfile
5		-	# + compose.yaml), but built and run on this machine: a container publishing
6		-	# 3000 to a fixed host port, with portless reverse-proxying a stable
7		-	# `.localhost` name onto it. Running in
8		-	# Docker rather than `cargo run` is what makes CI testable — the runner drives
9		-	# the host's Docker socket, which is mounted in.
	4	+	# The same image as production (docker/Dockerfile, which compiles anvild
	5	+	# itself), but built and run on this machine: a container publishing 3000 to a
	6	+	# fixed host port, with portless reverse-proxying a stable `.localhost` name
	7	+	# onto it. Running in Docker rather than `cargo run` is what makes CI testable
	8	+	# — the runner drives the host's Docker socket, which is mounted in.
10	9		#
11	10		# Usage:
12	11		# ./deploy/dev.sh build + (re)start, then print the URL
⋯ 9 unchanged lines
22	21
23	22		NAME="${ANVIL_DEV_NAME:-anvil}"
24	23		IMAGE="anvil-dev:latest"
25		-	TARGET="x86_64-unknown-linux-musl"
26	24		VOLUME="anvil-dev-data"
27	25		# A stable, collision-resistant port for this project (see `devport -h`), so the
28	26		# published port does not wander between runs. portless maps a name onto it.
29	27		PORT="${ANVIL_DEV_PORT:-$(command -v devport >/dev/null && devport \|\| echo 20640)}"
30	28		SSH_PORT="${ANVIL_DEV_SSH_PORT:-$((PORT + 1))}"
31	29		PROFILE=debug
32		-	CARGO_FLAGS=()
33	30
34	31		for arg in "$@"; do
35	32		case "$arg" in
36	33		--release)
37	34		PROFILE=release
38		-	CARGO_FLAGS+=(--release)
39	35		;;
40	36		--stop)
41	37		docker rm -f "$NAME" >/dev/null 2>&1 \|\| true
⋯ 11 unchanged lines
53	49		esac
54	50		done
55	51
56		-	echo "==> building anvild ($PROFILE, static musl)"
57		-	# Static musl, exactly as in production: the runtime image is debian-slim and a
58		-	# binary linked against Fedora's glibc would not run there.
59		-	cargo zigbuild --target "$TARGET" --bin anvild "${CARGO_FLAGS[@]}"
60		-	cp "target/$TARGET/$PROFILE/anvild" docker/anvil/anvild
61		-	trap 'rm -f docker/anvil/anvild' EXIT
62		-
63		-	echo "==> building $IMAGE"
	52	+	# One step now: the Dockerfile cross-compiles the static musl binary itself
	53	+	# (BuildKit cache mounts keep a rebuild to whatever crate changed), then bakes
	54	+	# the dev config in. Nothing is staged in the working tree.
	55	+	echo "==> building $IMAGE ($PROFILE, static musl)"
64	56		docker build --quiet --platform linux/amd64 \
65		-	-f docker/anvil/Dockerfile \
66		-	--build-arg CONFIG=deploy/anvil.dev.toml -t "$IMAGE" . >/dev/null
	57	+	-f docker/Dockerfile --target anvil \
	58	+	--build-arg CONFIG=deploy/anvil.dev.toml \
	59	+	--build-arg "PROFILE=$PROFILE" -t "$IMAGE" . >/dev/null
67	60
68	61		echo "==> (re)starting container $NAME"
69	62		docker rm -f "$NAME" >/dev/null 2>&1 \|\| true
⋯ 72 unchanged lines

1	+	# syntax=docker/dockerfile:1
2	+	#
3	+	# Both images anvil ships, from one builder.
4	+	#
5	+	# --target anvil the forge (compose.yaml) — this is the default
6	+	# --target worker a CI runner, LOCAL DEVELOPMENT ONLY (compose.override.yaml)
7	+	#
8	+	# The build stage runs on the BUILD host's architecture and cross-compiles to
9	+	# x86_64-musl with cargo-zigbuild, so an arm64 workstation produces the amd64
10	+	# image hagrid runs without emulating rustc. That is what deploy/build.sh used
11	+	# to do outside Docker; doing it here means the build context is the only
12	+	# input, so `hag deploy` is the whole deploy and there is no staged binary
13	+	# left lying around to go stale.
14	+	#
15	+	# The VPS still compiles nothing — it only ever pulls the finished image.
16	+	#
17	+	# The two runtime stages share the builder, so `docker compose build` compiles
18	+	# the workspace once and takes two binaries out of it.
19	+
20	+	# ---------------------------------------------------------------- builder --
21	+
22	+	# --platform=$BUILDPLATFORM: compile natively, cross-link to the target. Rust
23	+	# comes from rust-toolchain.toml below, not from this tag, which is only a
24	+	# rustup to bootstrap from.
25	+	FROM --platform=$BUILDPLATFORM rust:1-bookworm AS builder
26	+
27	+	# zig is the cross-linker cargo-zigbuild drives. Pinned with a checksum: this
28	+	# is a toolchain fetched over the network into the build that produces the
29	+	# internet-facing binary. Both digests come from ziglang.org/download/index.json
30	+	# and have to be bumped together with ZIG_VERSION.
31	+	ARG ZIG_VERSION=0.16.0
32	+	ARG ZIG_SHA256_amd64=70e49664a74374b48b51e6f3fdfbf437f6395d42509050588bd49abe52ba3d00
33	+	ARG ZIG_SHA256_arm64=ea4b09bfb22ec6f6c6ceac57ab63efb6b46e17ab08d21f69f3a48b38e1534f17
34	+	ARG BUILDARCH
35	+	RUN set -eux; \
36	+	case "$BUILDARCH" in \
37	+	amd64) zig_arch=x86_64; zig_sha="$ZIG_SHA256_amd64" ;; \
38	+	arm64) zig_arch=aarch64; zig_sha="$ZIG_SHA256_arm64" ;; \
39	+	*) echo "no pinned zig for BUILDARCH=$BUILDARCH" >&2; exit 1 ;; \
40	+	esac; \
41	+	url="https://ziglang.org/download/${ZIG_VERSION}/zig-${zig_arch}-linux-${ZIG_VERSION}.tar.xz"; \
42	+	curl -fsSL "$url" -o /tmp/zig.tar.xz; \
43	+	echo "${zig_sha} /tmp/zig.tar.xz" \| sha256sum -c -; \
44	+	mkdir -p /opt/zig; \
45	+	tar -xJf /tmp/zig.tar.xz -C /opt/zig --strip-components=1; \
46	+	rm /tmp/zig.tar.xz; \
47	+	ln -s /opt/zig/zig /usr/local/bin/zig; \
48	+	zig version
49	+
50	+	# Installed before rust-toolchain.toml lands, so it builds with the image's own
51	+	# toolchain rather than dragging the pinned one in early. --locked so this
52	+	# layer is reproducible too.
53	+	ARG CARGO_ZIGBUILD_VERSION=0.23.0
54	+	RUN cargo install cargo-zigbuild --version "$CARGO_ZIGBUILD_VERSION" --locked
55	+
56	+	WORKDIR /app
57	+
58	+	# rust-toolchain.toml on its own, ahead of the sources: rustup materializes the
59	+	# pinned channel and the musl target in a layer that only rebuilds when the pin
60	+	# changes. It stays the ONE place the Rust version is set (see CLAUDE.md) —
61	+	# nothing here names a version.
62	+	COPY rust-toolchain.toml ./
63	+	RUN rustup show
64	+
65	+	COPY Cargo.toml Cargo.lock ./
66	+	COPY crates ./crates
67	+	COPY vendor ./vendor
68	+
69	+	# Release unless a caller asks otherwise; compose.override.yaml passes debug so
70	+	# the local loop is not paying for optimization.
71	+	ARG PROFILE=release
72	+	ARG TARGET=x86_64-unknown-linux-musl
73	+
74	+	# Cache mounts rather than the dummy-crate trick: the registry and target dirs
75	+	# survive between builds, so editing one crate recompiles that crate and not
76	+	# 536 dependencies. `sharing=locked` because compose builds the two runtime
77	+	# stages concurrently and they share one target dir.
78	+	#
79	+	# Both binaries come out of a single cargo invocation, and they have to be
80	+	# copied OUT of the target mount inside the same RUN — a cache mount is not
81	+	# part of the layer, so a later COPY --from could not see them.
82	+	RUN --mount=type=cache,id=anvil-cargo-registry,target=/usr/local/cargo/registry,sharing=locked \
83	+	--mount=type=cache,id=anvil-cargo-target,target=/app/target,sharing=locked \
84	+	set -eux; \
85	+	case "$PROFILE" in \
86	+	release) flags="--release" ;; \
87	+	debug) flags= ;; \
88	+	*) echo "PROFILE must be release or debug, got '$PROFILE'" >&2; exit 1 ;; \
89	+	esac; \
90	+	cargo zigbuild --locked --target "$TARGET" --bin anvild --bin anvil-worker $flags; \
91	+	mkdir -p /out; \
92	+	cp "target/${TARGET}/${PROFILE}/anvild" "target/${TARGET}/${PROFILE}/anvil-worker" /out/
93	+
94	+	# ------------------------------------------------------------------ anvil --
95	+
96	+	# Pinned to amd64 rather than inherited from TARGETPLATFORM: the binaries above
97	+	# are always x86_64-musl, so the base they ride on must not follow an arm64
98	+	# workstation. compose.yaml's `platforms:` says the same thing one level up.
99	+	FROM --platform=linux/amd64 ubuntu:26.04 AS anvil
100	+
101	+	# No git in the image: anvil is pure gitoxide (see CLAUDE.md), including the
102	+	# push-mirroring client.
103	+	RUN apt-get update \
104	+	&& apt-get install -y --no-install-recommends ca-certificates \
105	+	&& rm -rf /var/lib/apt/lists/* \
106	+	&& useradd --system --user-group --home-dir /data anvil \
107	+	&& mkdir -p /data /etc/anvil \
108	+	&& chown -R anvil:anvil /data
109	+
110	+	COPY --from=builder /out/anvild /usr/local/bin/anvild
111	+
112	+	# Which baked config to ship: production's by default, the committed local one
113	+	# when compose.override.yaml or deploy/dev.sh builds the image.
114	+	ARG CONFIG=deploy/anvil.toml
115	+	COPY ${CONFIG} /etc/anvil/anvil.toml
116	+
117	+	EXPOSE 3000 2222
118	+	VOLUME /data
119	+	USER anvil
120	+
121	+	ENTRYPOINT ["/usr/local/bin/anvild"]
122	+	CMD ["-c", "/etc/anvil/anvil.toml", "serve"]
123	+
124	+	# ----------------------------------------------------------------- worker --
125	+
126	+	# LOCAL DEVELOPMENT ONLY.
127	+	#
128	+	# Production runners are native processes on their own host (a launchd agent on
129	+	# the Mac mini, see ../docs/remote-runners.md § Isolation on macOS; the plist
130	+	# for it stays in deploy/worker/, which is not a Docker artifact). This stage
131	+	# exists so compose.override.yaml can bring up two runners next to the local
132	+	# forge and exercise concurrency and platform routing without a second machine.
133	+	# Do not deploy it: a containerized runner needs the host's Docker socket
134	+	# mounted in, which is the root-equivalent hold that moving CI off the forge was
135	+	# meant to remove. That trade is already made locally — the dev compose file
136	+	# mounts the same socket into anvil for agent sessions.
137	+	FROM --platform=linux/amd64 ubuntu:26.04 AS worker
138	+
139	+	# ca-certificates so the claim loop can talk to an https:// forge. The local one
140	+	# is plain http over the compose network, but the image should not be the reason
141	+	# a runner cannot reach a real instance.
142	+	RUN apt-get update \
143	+	&& apt-get install -y --no-install-recommends ca-certificates \
144	+	&& rm -rf /var/lib/apt/lists/* \
145	+	&& useradd --system --user-group --home-dir /nonexistent worker
146	+
147	+	COPY --from=builder /out/anvil-worker /usr/local/bin/anvil-worker
148	+
149	+	# Unprivileged in the container; compose grants the docker group separately
150	+	# (`group_add`), which is the only host access the runner needs.
151	+	USER worker
152	+
153	+	ENTRYPOINT ["/usr/local/bin/anvil-worker"]

1	-	# anvil runtime image — just the prebuilt binary, no compilation in Docker.
2	-	#
3	-	# The binary is cross-compiled on the build host into a fully static
4	-	# x86_64-musl executable (see deploy/build.sh: `cargo zigbuild --target
5	-	# x86_64-unknown-linux-musl`), then staged next to this file and copied in.
6	-	# So building this image is a fast `COPY` — no QEMU-emulated release build, and
7	-	# the VPS never compiles anything.
8	-
9	-	FROM ubuntu:26.04
10	-
11	-	# No git in the image: anvil is pure gitoxide (see CLAUDE.md), including the
12	-	# push-mirroring client.
13	-	RUN apt-get update \
14	-	&& apt-get install -y --no-install-recommends ca-certificates \
15	-	&& rm -rf /var/lib/apt/lists/* \
16	-	&& useradd --system --user-group --home-dir /data anvil \
17	-	&& mkdir -p /data /etc/anvil \
18	-	&& chown -R anvil:anvil /data
19	-
20	-	# Prebuilt static binary staged by deploy/build.sh. The build context is the
21	-	# repo root (compose.yaml, deploy/dev.sh), so this path is repo-relative.
22	-	COPY docker/anvil/anvild /usr/local/bin/anvild
23	-
24	-	# Which baked config to ship: production's by default, the committed local one
25	-	# when deploy/dev.sh builds the image.
26	-	ARG CONFIG=deploy/anvil.toml
27	-	COPY ${CONFIG} /etc/anvil/anvil.toml
28	-
29	-	EXPOSE 3000 2222
30	-	VOLUME /data
31	-	USER anvil
32	-
33	-	ENTRYPOINT ["/usr/local/bin/anvild"]
34	-	CMD ["-c", "/etc/anvil/anvil.toml", "serve"]

1	-	# anvil-worker image — LOCAL DEVELOPMENT ONLY.
2	-	#
3	-	# Production runners are native processes on their own host (a launchd agent on
4	-	# the Mac mini, see ../../docs/remote-runners.md § Isolation on macOS; the
5	-	# plist for it stays in deploy/worker/, which is not a Docker artifact). This
6	-	# image exists so `compose.override.yaml` can bring up two runners next to the
7	-	# local forge and exercise concurrency and platform routing without a second
8	-	# machine. Do not deploy it: a containerized runner needs the host's Docker
9	-	# socket mounted in, which is the root-equivalent hold moving CI off the forge
10	-	# was meant to remove. That trade is already made locally — the dev compose
11	-	# file mounts the same socket into anvil for agent sessions.
12	-	#
13	-	# Same shape as ../anvil/Dockerfile: no compilation here, just a COPY of the
14	-	# static x86_64-musl binary that `./deploy/build.sh --worker` stages.
15	-
16	-	FROM ubuntu:26.04
17	-
18	-	# ca-certificates so the claim loop can talk to an https:// forge. The local
19	-	# one is plain http over the compose network, but the image should not be the
20	-	# reason a runner cannot reach a real instance.
21	-	RUN apt-get update \
22	-	&& apt-get install -y --no-install-recommends ca-certificates \
23	-	&& rm -rf /var/lib/apt/lists/* \
24	-	&& useradd --system --user-group --home-dir /nonexistent worker
25	-
26	-	COPY docker/worker/anvil-worker /usr/local/bin/anvil-worker
27	-
28	-	# Unprivileged in the container; compose grants the docker group separately
29	-	# (`group_add`), which is the only host access the runner needs.
30	-	USER worker
31	-
32	-	ENTRYPOINT ["/usr/local/bin/anvil-worker"]

⋯ 198 unchanged lines
199	199
200	200		The build host is arm64; hagrid is x86_64. Two separate concerns:
201	201
202		-	What the shipped image is. Already solved: `deploy/build.sh` cross-compiles
203		-	with zigbuild and `compose.yaml` pins `platforms: [linux/amd64]`. Nothing to do,
204		-	though note the `Dockerfile`'s `RUN apt-get …` does execute amd64 binaries
205		-	under emulation. Since `anvild` is a static musl binary,
	202	+	What the shipped image is. Already solved: the builder stage in
	203	+	`docker/Dockerfile` cross-compiles with zigbuild on the build host's own
	204	+	architecture, and both it and `compose.yaml` pin the runtime to amd64. Nothing
	205	+	to do, though note the runtime stages' `RUN apt-get …` does execute amd64
	206	+	binaries under emulation. Since `anvild` is a static musl binary,
206	207		`gcr.io/distroless/static:nonroot` would make that build pure `COPY` and
207	208		genuinely emulation-free. Nice-to-have.
208	209
⋯ 134 unchanged lines
343	344		half of routing — are testable without a second machine:
344	345
345	346		```sh
346		-	./deploy/build.sh --debug --worker # stages the anvild and anvil-worker binaries
347	347		docker compose up -d --build
348	348		docker compose logs -f runner-1 runner-2
349	349		# anvil-worker dev-1 (linux/amd64) → http://anvil:3000
⋯ 104 unchanged lines

1	+	# This file is automatically @generated by Cargo.
2	+	# It is not intended for manual editing.
3	+	version = 4
4	+
5	+	[[package]]
6	+	name = "adler2"
7	+	version = "2.0.1"
8	+	source = "registry+https://github.com/rust-lang/crates.io-index"
9	+	checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
10	+
11	+	[[package]]
12	+	name = "aead"
13	+	version = "0.6.1"
14	+	source = "registry+https://github.com/rust-lang/crates.io-index"
15	+	checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
16	+	dependencies = [
17	+	"crypto-common 0.2.2",
18	+	"inout",
19	+	]
20	+
21	+	[[package]]
22	+	name = "aes"
23	+	version = "0.9.2"
24	+	source = "registry+https://github.com/rust-lang/crates.io-index"
25	+	checksum = "f8eb277bec05f56a0e0591f155a484cbd0f4f07ff2905051a48c72f004f7ed58"
26	+	dependencies = [
27	+	"cipher",
28	+	"cpubits",
29	+	"cpufeatures 0.3.0",
30	+	"zeroize",
31	+	]
32	+
33	+	[[package]]
34	+	name = "aes-gcm"
35	+	version = "0.11.1"
36	+	source = "registry+https://github.com/rust-lang/crates.io-index"
37	+	checksum = "7f2b8006a0c83f52b62ba44a97b58bf76fe2f70a329e588f67f89691d93d498f"
38	+	dependencies = [
39	+	"aead",
40	+	"aes",