Kyle Isom
4ddd32b117
Core packages: crypto (Argon2id/AES-256-GCM), config (TOML/viper), db (SQLite/migrations), barrier (encrypted storage), seal (state machine with rate-limited unseal), auth (MCIAS integration with token cache), policy (priority-based ACL engine), engine (interface + registry). Server: HTTPS with TLS 1.2+, REST API, auth/admin middleware, htmx web UI (init, unseal, login, dashboard pages). CLI: cobra/viper subcommands (server, init, status, snapshot) with env var override support (METACRYPT_ prefix). Operational tooling: Dockerfile (multi-stage, non-root), docker-compose, hardened systemd units (service + daily backup timer), install script, backup script with retention pruning, production config examples. Runbook covering installation, configuration, daily operations, backup/restore, monitoring, troubleshooting, and security procedures. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
35 lines
822 B
Docker
35 lines
822 B
Docker
FROM golang:1.23-alpine AS builder
|
|
|
|
RUN apk add --no-cache gcc musl-dev
|
|
|
|
WORKDIR /build
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /metacrypt ./cmd/metacrypt
|
|
|
|
FROM alpine:3.21
|
|
|
|
RUN apk add --no-cache ca-certificates tzdata \
|
|
&& addgroup -S metacrypt \
|
|
&& adduser -S -G metacrypt -h /metacrypt -s /sbin/nologin metacrypt
|
|
|
|
COPY --from=builder /metacrypt /usr/local/bin/metacrypt
|
|
COPY web/ /metacrypt/web/
|
|
|
|
# /data is the single volume mount point.
|
|
# It must contain:
|
|
# metacrypt.toml — configuration file
|
|
# certs/ — TLS certificate and key
|
|
# metacrypt.db — created automatically on first run
|
|
VOLUME /data
|
|
WORKDIR /data
|
|
|
|
EXPOSE 8443
|
|
|
|
USER metacrypt
|
|
|
|
ENTRYPOINT ["metacrypt"]
|
|
CMD ["server", "--config", "/data/metacrypt.toml"]
|