building appimage on the nixos for debian

packaging/appimage/build-debian.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+
+set -euo pipefail
+
+if [[ $# -lt 1 || $# -gt 3 ]]; then
+    echo "Usage: $0 SERVER_FEATURE [OUTPUT_DIRECTORY] [OUTPUT_FILENAME]" >&2
+    echo "SERVER_FEATURE must be full-embed or full" >&2
+    exit 2
+fi
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd -- "$script_dir/../.." && pwd)"
+server_feature="$1"
+output_directory="${2:-$repo_root/debian-dist}"
+
+case "$server_feature" in
+    full-embed)
+        server_db_mode=embedded
+        default_output_name=KompAC-embedded-debian12-amd64.AppImage
+        ;;
+    full)
+        server_db_mode=external
+        default_output_name=KompAC-external-debian12-amd64.AppImage
+        ;;
+    *)
+        echo "SERVER_FEATURE must be full-embed or full, got: $server_feature" >&2
+        exit 2
+        ;;
+esac
+
+output_name="${3:-$default_output_name}"
+
+if [[ "$output_name" == */* || "$output_name" != *.AppImage ]]; then
+    echo "OUTPUT_FILENAME must be a portable filename ending in .AppImage" >&2
+    exit 2
+fi
+if ! command -v podman >/dev/null 2>&1; then
+    echo "podman is required to build the Debian production AppImage" >&2
+    exit 1
+fi
+
+# Podman normally reads a vendor configuration from /usr/share before the
+# NixOS-generated configuration in /etc. Some NixOS installations have no
+# traversable /usr/share, so point Podman directly at the generated file.
+if [[ -z "${CONTAINERS_CONF:-}" ]] \
+    && [[ ! -r /usr/share/containers/containers.conf ]] \
+    && [[ -r /etc/containers/containers.conf ]]; then
+    export CONTAINERS_CONF=/etc/containers/containers.conf
+    echo "Using NixOS Podman configuration: $CONTAINERS_CONF"
+fi
+
+podman_security_options=()
+if [[ ! -r /usr/share/containers/seccomp.json ]]; then
+    podman_security_options=(--security-opt seccomp=unconfined)
+    echo "Warning: Podman's seccomp profile is unreadable; build-container seccomp is disabled"
+    echo "Host fix: sudo chmod 755 /usr/share"
+fi
+
+if [[ ! -r /usr/share/containers/oci/hooks.d ]]; then
+    if [[ -n "${CONTAINERS_CONF_OVERRIDE:-}" ]]; then
+        echo "Podman's OCI hooks directory is unreadable and CONTAINERS_CONF_OVERRIDE is already set" >&2
+        echo "Fix the host with: sudo chmod 755 /usr/share" >&2
+        exit 1
+    fi
+    export CONTAINERS_CONF_OVERRIDE="$script_dir/containers-nix-unreadable-usr-share.conf"
+    echo "Disabling unreadable vendor OCI hooks with: $CONTAINERS_CONF_OVERRIDE"
+fi
+
+mkdir -p "$output_directory"
+output_directory="$(cd -- "$output_directory" && pwd)"
+image=localhost/komp-ac-debian-builder:bookworm
+
+echo "Building Debian 12 production artifacts"
+echo "  server feature: $server_feature"
+echo "  database mode:  $server_db_mode"
+echo "  output:         $output_directory/$output_name"
+echo
+echo "+ podman build ${podman_security_options[*]} --platform linux/amd64 --file $script_dir/Containerfile.debian --tag $image $script_dir"
+podman build \
+    "${podman_security_options[@]}" \
+    --platform linux/amd64 \
+    --file "$script_dir/Containerfile.debian" \
+    --tag "$image" \
+    "$script_dir"
+
+echo
+echo "+ podman run ${podman_security_options[*]} ... SERVER_FEATURE=$server_feature SERVER_DB_MODE=$server_db_mode ... $image"
+podman run --rm \
+    "${podman_security_options[@]}" \
+    --platform linux/amd64 \
+    --env "OUTPUT_NAME=$output_name" \
+    --env "SERVER_FEATURE=$server_feature" \
+    --env "SERVER_DB_MODE=$server_db_mode" \
+    --volume "$repo_root:/source:ro" \
+    --volume "$output_directory:/out" \
+    --volume komp-ac-debian-cargo-target:/cargo-target \
+    --volume komp-ac-debian-cargo-registry:/opt/rust/cargo/registry \
+    --volume komp-ac-debian-cargo-git:/opt/rust/cargo/git \
+    --volume komp-ac-debian-yarn-cache:/var/cache/yarn \
+    "$image"
+
+echo "Created $output_directory/$output_name"