Merge branch 'master' into master-android

scripts/badge-service/Dockerfile

@@ -0,0 +1,99 @@
+# syntax=docker/dockerfile:1
+# Built from the repository root, not this directory, because the COPY paths are repo-relative.
+# The Haskell stage compiles simplexmq and simplex-chat from source, which takes hours on a cold
+# cache and needs about 15 GB.
+
+ARG UBUNTU=24.04
+ARG GHC=9.6.3
+ARG CABAL=3.10.2.0
+ARG NODE=24
+
+# The checkout page's dist/ is gitignored, so this stage builds it.
+FROM node:${NODE}-bookworm-slim AS web
+
+WORKDIR /web
+COPY apps/simplex-badge-service/web/package.json apps/simplex-badge-service/web/package-lock.json ./
+RUN npm ci
+COPY apps/simplex-badge-service/web ./
+RUN npm run build
+
+FROM ubuntu:${UBUNTU} AS build
+
+ARG GHC
+ARG CABAL
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential ca-certificates curl git libgmp3-dev libnuma-dev \
+        libpq-dev libssl-dev llvm pkg-config zlib1g-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+ENV BOOTSTRAP_HASKELL_NONINTERACTIVE=1 \
+    BOOTSTRAP_HASKELL_GHC_VERSION=${GHC} \
+    BOOTSTRAP_HASKELL_CABAL_VERSION=${CABAL} \
+    BOOTSTRAP_HASKELL_INSTALL_NO_STACK=true \
+    BOOTSTRAP_HASKELL_INSTALL_NO_STACK_HOOK=true
+RUN curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | sh
+ENV PATH="/root/.ghcup/bin:/root/.cabal/bin:$PATH"
+# Set explicitly so the cache mount below matches where cabal keeps its store.
+ENV CABAL_DIR=/root/.cabal
+
+WORKDIR /src
+COPY cabal.project simplex-chat.cabal README.md PRIVACY.md ./
+COPY scripts/cabal.project.local.linux ./cabal.project.local
+COPY src ./src
+# Excluding web/ keeps a webapp edit from invalidating this layer and re-running the cabal build,
+# and the binary does not depend on it.
+COPY --exclude=web apps/simplex-badge-service ./apps/simplex-badge-service
+
+# The store and build tree are cache mounts rather than layers, so the binary is copied out inside
+# the same RUN because dist-newstyle does not exist in the resulting layer.
+RUN --mount=type=cache,target=/root/.cabal \
+    --mount=type=cache,target=/src/dist-newstyle \
+    set -eu; \
+    cabal update; \
+    cabal build --flags="+client_postgres" exe:simplex-badge-service; \
+    mkdir -p /out; \
+    cp "$(cabal list-bin --flags="+client_postgres" exe:simplex-badge-service)" /out/simplex-badge-service; \
+    strip /out/simplex-badge-service
+
+FROM ubuntu:${UBUNTU} AS runtime
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Built with +client_postgres, so the binary needs libpq and there is no SQLite backend.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates dumb-init libgmp10 libpq5 libssl3 zlib1g && \
+    rm -rf /var/lib/apt/lists/*
+
+# Set these to your own uid and gid so the state volume is readable without root.
+ARG USER_UID=1000
+ARG USER_GID=1000
+
+# ubuntu:24.04 ships a default user at 1000, so drop whoever holds the ids.
+RUN if existing_user=$(getent passwd ${USER_UID} | cut -d: -f1) && [ -n "${existing_user}" ]; then \
+        userdel -r "${existing_user}" 2>/dev/null || userdel "${existing_user}"; \
+    fi && \
+    if existing_group=$(getent group ${USER_GID} | cut -d: -f1) && [ -n "${existing_group}" ]; then \
+        groupdel "${existing_group}" 2>/dev/null || true; \
+    fi && \
+    groupadd -g ${USER_GID} badge && \
+    useradd -u ${USER_UID} -g ${USER_GID} -m -d /home/badge badge
+
+COPY --from=build /out/simplex-badge-service /usr/local/bin/simplex-badge-service
+COPY --from=web /web/dist /srv/web
+
+USER badge
+WORKDIR /home/badge
+
+EXPOSE 8080
+
+# There is no HEALTHCHECK because the listener answers before the chat side has an address, so it
+# would report healthy too early.
+
+# The flags live in CMD so `docker compose run` can replace them while dumb-init still forwards
+# signals.
+ENTRYPOINT ["dumb-init", "--", "simplex-badge-service"]
+# Without --yes-migrate the service blocks on stdin at every schema change, and a container has no
+# console to answer.
+CMD ["-d", "postgresql://simplex@127.0.0.1:5432/badge_service", "--create-schema", "--yes-migrate", "--service-config", "/etc/simplex-badge-service/badge_service.ini"]

scripts/badge-service/Dockerfile.dockerignore

@@ -0,0 +1,30 @@
+# The build context is the repository root. Exclude everything, then add back
+# what the image is built from, one directory level at a time.
+*
+
+!cabal.project
+!simplex-chat.cabal
+!README.md
+!PRIVACY.md
+!src
+
+!scripts
+scripts/*
+!scripts/cabal.project.local.linux
+
+!apps
+apps/*
+!apps/simplex-badge-service
+
+# Build output, caches, local state, and anything holding a secret. The ini is
+# mounted at run time and must never be baked into an image: it holds the issuer
+# secret, and with [btcpay] the API key and webhook secret too.
+badge_service.ini
+**/dist
+**/dist-newstyle
+**/node_modules
+**/*.db
+**/*.db-*
+apps/simplex-badge-service/test-fixtures
+apps/simplex-badge-service/web-traversal-test
+apps/simplex-badge-service/web/build

scripts/badge-service/badge_service.ini.example

@@ -0,0 +1,46 @@
+[listener]
+host = 0.0.0.0
+port = 8080
+; the built webapp in the image, read as the export source
+static_dir = /srv/web
+; split deployment: Caddy serves the exported folder; this service is the API and webhooks only.
+; Set to on for an all-in-one deployment where this service serves the webapp itself.
+serve_webapp = off
+; the webapp is written here at boot with the publishable key injected; compose bind-mounts it to a
+; host path Caddy serves. Unset it when serve_webapp = on.
+webapp_export_dir = /srv/webapp
+; on because Caddy proxies /api and /webhooks to this service; without it the rate limiter keys on
+; Caddy's address and shares one bucket across all callers
+trust_forwarded_for = on
+
+[btcpay]
+host = https://btcpay.example.org
+api_key = replace-me
+store_id = replace-me
+webhook_secret = replace-me
+expiry_minutes = 60
+speed_policy = MediumSpeed
+payment_tolerance = 0.5
+
+; optional; omit the whole [stripe] section to disable card payments
+[stripe]
+; restricted key (rk_): Payment Intents write + Charges read — never a full secret key (sk_)
+secret_key = rk_test_replace-me
+publishable_key = pk_test_replace-me
+; the signing secret of the /webhooks/stripe endpoint configured in the Dashboard
+webhook_secret = whsec_replace-me
+; minutes the service holds an unpaid card invoice open before it expires it; 1-1440
+session_minutes = 60
+
+[poll]
+waiting_seconds = 3
+idle_seconds = 60
+
+; index is the one clients verify against; private_key is from `simplex-chat badge keygen`.
+; To rotate, change both together, once clients trust the new index.
+[issuer]
+index = 1
+private_key = replace-me
+
+[dev]
+chat_redeem = on

scripts/badge-service/compose.yml

@@ -0,0 +1,24 @@
+services:
+  badge-service:
+    image: simplex-badge-service:latest
+    build:
+      context: ../..
+      dockerfile: scripts/badge-service/Dockerfile
+      args:
+        USER_UID: ${USER_UID:-1000}
+        USER_GID: ${USER_GID:-1000}
+    restart: on-failure:5
+    user: "${USER_UID:-1000}:${USER_GID:-1000}"
+    tty: true
+    network_mode: host
+    command:
+      - "-d"
+      - "${BADGE_DB_CONN:-postgresql://simplex@127.0.0.1:5432/badge_service}"
+      - "--create-schema"
+      - "--yes-migrate"
+      - "--service-config"
+      - "/etc/simplex-badge-service/badge_service.ini"
+    volumes:
+      - ./badge_service.ini:/etc/simplex-badge-service/badge_service.ini:ro
+      - ./web:/srv/webapp
+    stop_grace_period: 10s

scripts/nix/sha256map.nix

@@ -1,5 +1,5 @@
 {
-  "https://github.com/simplex-chat/simplexmq.git"."900c45ffaee5eb7eef8ec9402bc4971e4eb7ef33" = "1iygb9hkc86ky553jg5apc8vfbjj0lghjaywikc0m7h1yk7zibxg";
+  "https://github.com/simplex-chat/simplexmq.git"."5eecd99bc2450705dfdc4982bb3604cc4942a51a" = "08jwx1inj96dgbq9vwry9fcprx9sjf9w2a7d4cdfbrfp2xwv52kg";
   "https://github.com/simplex-chat/hs-socks.git"."a30cc7a79a08d8108316094f8f2f82a0c5e1ac51" = "0yasvnr7g91k76mjkamvzab2kvlb1g5pspjyjn2fr6v83swjhj38";
   "https://github.com/simplex-chat/direct-sqlcipher.git"."f814ee68b16a9447fbb467ccc8f29bdd3546bfd9" = "1ql13f4kfwkbaq7nygkxgw84213i0zm7c1a8hwvramayxl38dq5d";
   "https://github.com/simplex-chat/sqlcipher-simple.git"."a46bd361a19376c5211f1058908fc0ae6bf42446" = "1z0r78d8f0812kxbgsm735qf6xx8lvaz27k1a0b4a2m0sshpd5gl";