Add Docker and Nix packaging for the node

server/docker/: multi-stage image (rust:1-slim build, trixie runtime) with all four binaries plus the pinned yggdrasil 0.5.14 .deb (sha256-verified, fetched from the official release), a compose example per household (host network, NET_ADMIN, /dev/net/tun, init: true), a German-commented node.toml.example (safe default: leech mode) and a README covering privileges, two-household wiring, leech mode and the kill switch. Image build and smoke tests verified locally with docker 29.8.1. flake.nix: builds the workspace as one spidernet package via rustPlatform.buildRustPackage (cargoLock against the committed Cargo.lock) plus an experimental NixOS module; written without a local Nix and marked accordingly.
2026-09-24 20:12:51 +02:00
parent f2f3609b87
commit 57b9b44d8a
6 changed files with 563 additions and 0 deletions
@@ -0,0 +1,74 @@
+# SpiderNet node — single-household example (one node per host).
+#
+# NO WARRANTY — SpiderNet is provided "as is" without warranty of any kind
+# (AGPL-3.0, sections 15/16). Running a node is entirely at the operator's
+# own responsibility.
+#
+# The same image serves both roles:
+#   - exit household:  [exit] enabled = true  in node.toml (plus neighbor
+#     addresses in [exit].allow — enabled with an empty allowlist is
+#     rejected by the daemon)
+#   - leech household: [exit] enabled = false in node.toml (the example
+#     config default — safe, receive-only)
+# There is no separate leech image; only the config differs.
+#
+# Quickstart:
+#   cp node.toml.example node.toml   # then edit node.toml
+#   docker compose up --build -d
+
+services:
+  node:
+    build:
+      # Build context is server/, matching the Dockerfile paths.
+      context: ..
+      dockerfile: docker/Dockerfile
+    image: spidernet-node
+    container_name: spidernet-node
+    # Proper PID 1: reaps zombies and makes sure SIGTERM reaches sn-node
+    # so `docker compose stop` behaves as the documented kill switch.
+    init: true
+    # Yggdrasil must bind its TUN interface and peer on the real LAN;
+    # both require the host network stack (no NAT translation).
+    network_mode: host
+    cap_add:
+      # Needed by yggdrasil to create/configure the TUN interface.
+      - NET_ADMIN
+    devices:
+      # The kernel TUN device used for the overlay interface.
+      - /dev/net/tun:/dev/net/tun
+    restart: unless-stopped
+    volumes:
+      # Config is read-only; state (node.key, yggdrasil.conf) goes to a
+      # named volume so the node identity survives container upgrades.
+      - ./node.toml:/etc/spidernet/node.toml:ro
+      - spidernet-state:/var/lib/spidernet
+
+# ---------------------------------------------------------------------------
+# EXIT VARIANT (offering the household's uplink as exit):
+#
+# The example config defaults to leech mode ([exit] enabled = false). To
+# become an exit household set enabled = true in node.toml and add the
+# neighbor overlay addresses to [exit].allow. This compose file works
+# unchanged for both roles (kill switch: `docker compose stop`).
+#
+# If you prefer two service definitions (e.g. to toggle via profiles), note
+# that `network_mode: host` allows only ONE node per host — stop the other
+# service first:
+#
+#   node-leech:
+#     build:
+#       context: ..
+#       dockerfile: docker/Dockerfile
+#     image: spidernet-node
+#     container_name: spidernet-node-leech
+#     init: true
+#     network_mode: host
+#     cap_add: [NET_ADMIN]
+#     devices: ["/dev/net/tun:/dev/net/tun"]
+#     restart: unless-stopped
+#     volumes:
+#       - ./node-leech.toml:/etc/spidernet/node.toml:ro
+#       - spidernet-state-leech:/var/lib/spidernet
+
+volumes:
+  spidernet-state: