2026-07-25 17:21:38 -07:00
|
|
|
# luxfi/kms — MPC-backed KMS server (headless, no React UI)
|
|
|
|
|
# lux-kms: Go + sqlcipher + MPC/ZAP. One service, one API surface (/v1/kms/*)
|
|
|
|
|
# stage so emulated cross-platform builds (M-series Mac → linux/amd64) don't
|
|
|
|
|
# trip QEMU's esbuild crash.
|
2026-06-07 14:28:00 -07:00
|
|
|
|
|
|
|
|
FROM golang:1.26.4-bookworm AS builder
|
|
|
|
|
ENV GOTOOLCHAIN=auto
|
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
|
|
|
libsqlcipher-dev gcc libc6-dev pkg-config git ca-certificates \
|
|
|
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
|
|
|
|
|
|
ARG GITHUB_TOKEN
|
|
|
|
|
RUN git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
|
2026-07-25 17:21:38 -07:00
|
|
|
# No GOPRIVATE — luxfi/hanzoai Go modules are PUBLIC; resolve via public proxy +
|
|
|
|
|
# sumdb (immutable). GOPRIVATE would route `direct` and re-poison go.sum.
|
2026-06-07 14:28:00 -07:00
|
|
|
|
|
|
|
|
WORKDIR /build
|
|
|
|
|
COPY go.mod go.sum ./
|
2026-07-25 17:21:38 -07:00
|
|
|
# GOSUMDB=off: luxfi first-party tags are periodically force-republished during the
|
|
|
|
|
# ongoing ecosystem re-tag (e.g. luxfi/vm), so immutable sum.golang.org lags the
|
|
|
|
|
# proxy and rejects the current bits. Trust the proxy/authed-git source and record
|
|
|
|
|
# what is really fetched — integrity is still enforced against the regenerated
|
|
|
|
|
# go.sum (regenerate-not-bypass). Mirrors the main Dockerfile.
|
2026-07-14 16:37:34 -07:00
|
|
|
ENV GOSUMDB=off
|
|
|
|
|
RUN rm -f go.sum && go mod download
|
2026-06-07 14:28:00 -07:00
|
|
|
COPY . .
|
|
|
|
|
|
2026-07-25 17:21:38 -07:00
|
|
|
# `COPY . .` just re-introduced the committed go.sum, which can be stale vs the bits
|
|
|
|
|
# primed above when a luxfi tag was force-republished — a -mod=mod build then aborts
|
|
|
|
|
# on a go.sum checksum mismatch. Drop and regenerate from the primed cache under
|
|
|
|
|
# GOSUMDB=off (same as the main Dockerfile). Without this, that earlier regeneration
|
|
|
|
|
# is silently reverted by this COPY.
|
2026-07-21 10:24:26 -07:00
|
|
|
RUN rm -f go.sum && go mod download
|
|
|
|
|
|
2026-07-25 17:21:38 -07:00
|
|
|
# GOFLAGS=-mod=mod builds from the module cache, not the in-tree vendor/. The
|
|
|
|
|
# committed vendor/ can lag go.mod during the re-tag (inconsistent vendoring) and
|
|
|
|
|
# also strips supranational/blst C headers. Matches the main Dockerfile.
|
2026-06-07 14:28:00 -07:00
|
|
|
RUN CGO_ENABLED=1 GOFLAGS=-mod=mod go build -tags "sqlite_fts5 sqlcipher" \
|
|
|
|
|
-ldflags="-s -w" -o /usr/local/bin/kms ./cmd/kms
|
|
|
|
|
|
|
|
|
|
FROM debian:bookworm-slim
|
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
|
|
|
libsqlcipher0 ca-certificates curl \
|
|
|
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
|
|
|
|
|
|
COPY --from=builder /usr/local/bin/kms /usr/local/bin/kms
|
|
|
|
|
RUN mkdir -p /data/kms
|
|
|
|
|
|
|
|
|
|
ENV BASE_SKIP_ROOT_REDIRECT=1
|
|
|
|
|
ENV BASE_DISABLE_ADMIN_UI=1
|
|
|
|
|
|
|
|
|
|
EXPOSE 8080
|
|
|
|
|
HEALTHCHECK --interval=10s --timeout=3s --retries=3 \
|
|
|
|
|
CMD curl -f http://localhost:8080/healthz || exit 1
|
|
|
|
|
ENTRYPOINT ["kms", "serve", "--http=0.0.0.0:8080"]
|
