From 19e4d8dcc9c9e76a8c90855cccb4c4553b35389e Mon Sep 17 00:00:00 2001 From: Anders Betts Date: Sun, 20 Sep 2026 23:09:31 +0200 Subject: deploy: cross-compile static aarch64 for the Alpine image --- docs/DEPLOY.md | 21 ++++++++++++--------- docs/STATE.md | 12 +++++++----- 2 files changed, 19 insertions(+), 14 deletions(-) (limited to 'docs') diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md index 7385a8f..6fe6a53 100644 --- a/docs/DEPLOY.md +++ b/docs/DEPLOY.md @@ -56,6 +56,8 @@ Normal deploys build an image and recreate the container. While developing, `scripts/deploy.sh --dev` skips the image entirely: - the gate (`make` + `make test`) still runs locally, +- on an architecture mismatch the static aarch64 binaries are + cross-compiled here (about 20 s, `deploy/Dockerfile.cross`), - the binaries are copied into the running container with `docker cp`, - the daemon is reloaded with `SIGHUP`, which re-execs the binary in place (in-memory sessions are lost, clients reconnect), @@ -63,9 +65,7 @@ Normal deploys build an image and recreate the container. While developing, No image is built and the container is not recreated; a later normal deploy replaces the copied binaries. Use a descriptive tag, e.g. -`scripts/deploy.sh --dev v0.2.0-rc1`. Hot reload requires the host to share -the dev machine's architecture; on a mismatch `--dev` falls back to a full -remote build. +`scripts/deploy.sh --dev v0.2.0-rc1`. ## Deploying upgrades @@ -80,7 +80,8 @@ The script: 1. `make` + `make test` on the dev machine, 2. builds `bokf:`: locally and ships it with `docker save | gzip | ssh docker load`, or — when the host runs a different CPU architecture — - builds it natively on the host from a source tar, + cross-compiles the backend here and assembles the image on the host from + a source tar, 3. copies `compose.yaml` and writes `BOKF_IMAGE`/`BOKF_TAG` into the host's `.env` (other keys are preserved), 4. `docker compose up -d --no-build`, then polls the container healthcheck, @@ -88,11 +89,13 @@ The script: that is still loaded on the host. Architecture mismatches are automatic: `uname -m` is compared over SSH and a -mismatch switches to a remote build of the same Alpine image (compiled inside -the host's Docker, so the host still needs no toolchain). Override with -`BOKF_BUILD=local` or `BOKF_BUILD=remote` (also settable in `.env`). The -runtime image is Alpine and carries `bokfd` + `bokfctl` only; the ncurses TUI -is a frontend and never shipped. +mismatch runs `deploy/Dockerfile.cross`, which links `bokfd`/`bokfctl` +statically for aarch64 (glibc + OpenSSL archives; it runs on the Alpine +runtime directly, DNS included). The image is then assembled in the host's +Docker — no compilation there. Override with `BOKF_BUILD=local` or +`BOKF_BUILD=remote` (also settable in `.env`). The runtime image is Alpine, +carries `bokfd` + `bokfctl` only (no `libssl3`; the binaries are static) and +never ships the ncurses TUI, which is a frontend built on the client. Tags are `git describe` output unless passed. Tag releases (`v*`) so rollback and support have meaningful versions. The rollback image must still exist on diff --git a/docs/STATE.md b/docs/STATE.md index 21995c6..b6c5d4f 100644 --- a/docs/STATE.md +++ b/docs/STATE.md @@ -80,11 +80,13 @@ check. get accounts/roles/tokens, never VPN access. The runtime image is **Alpine + backend only** (`bokfd`, `bokfctl`; the ncurses TUI is a frontend built on the client machine). `scripts/deploy.sh` builds locally - and ships over SSH, or builds the same image natively on the host when - architectures differ (no cross-compilation — a musl cross toolchain is - not trusted yet). `scripts/deploy.sh --dev` hot-reloads the binaries in - the running container (SIGHUP re-exec via `docker cp`) when the - architecture matches, otherwise it falls back to a full remote build. + and ships over SSH, or — when the architectures differ — + cross-compiles the backend on the dev machine as **static aarch64 + (glibc + OpenSSL archives, runs directly on Alpine, DNS verified) and + assembles the image in the host's Docker** (`deploy/Dockerfile.cross`, + ~20 s; the image carries no `libssl3`). `scripts/deploy.sh --dev` + hot-reloads the binaries in the running container (SIGHUP re-exec via + `docker cp`), cross-compiling first when the architecture differs. 15. **Reports in the TUI**: rendered as fixed-width Swedish tables that mirror the Kapitas PDF exports (Saldobalans, Resultatrapport with previous-year column and 89xx bokfört/ej bokfört, Balansrapport with Ing balans/Ing -- cgit v1.3