Merge 1b9f483a08 into b8ca1fc166

Update release profile settings for better optimization

.github/workflows/release.yml

@@ -104,10 +104,10 @@ jobs:
   build-musl:
     name: MUSL ${{ matrix.target }}
     runs-on: ubuntu-latest
-
+  
     container:
       image: rust:slim-bookworm
-
+  
     strategy:
       fail-fast: false
       matrix:
@@ -116,18 +116,54 @@ jobs:
             asset: telemt-x86_64-linux-musl
           - target: aarch64-unknown-linux-musl
             asset: telemt-aarch64-linux-musl
-
+  
     steps:
       - uses: actions/checkout@v4
-
+  
       - name: Install deps
         run: |
           apt-get update
-          apt-get install -y musl-tools pkg-config curl
-
+          apt-get install -y \
+            musl-tools \
+            pkg-config \
+            curl
+  
+      - uses: actions/cache@v4
+        if: matrix.target == 'aarch64-unknown-linux-musl'
+        with:
+          path: ~/.musl-aarch64
+          key: musl-toolchain-aarch64-v1
+  
+      - name: Install aarch64 musl toolchain
+        if: matrix.target == 'aarch64-unknown-linux-musl'
+        run: |
+          set -e
+  
+          TOOLCHAIN_DIR="$HOME/.musl-aarch64"
+          ARCHIVE="aarch64-linux-musl-cross.tgz"
+          URL="https://github.com/telemt/telemt/releases/download/toolchains/$ARCHIVE"
+  
+          if [ -x "$TOOLCHAIN_DIR/bin/aarch64-linux-musl-gcc" ]; then
+            echo "✅ MUSL toolchain cached"
+          else
+            echo "⬇️ Downloading MUSL toolchain..."
+  
+            curl -fL \
+              --retry 5 \
+              --retry-delay 3 \
+              --connect-timeout 10 \
+              --max-time 120 \
+              -o "$ARCHIVE" "$URL"
+  
+            mkdir -p "$TOOLCHAIN_DIR"
+            tar -xzf "$ARCHIVE" --strip-components=1 -C "$TOOLCHAIN_DIR"
+          fi
+  
+          echo "$TOOLCHAIN_DIR/bin" >> $GITHUB_PATH
+  
       - name: Add rust target
         run: rustup target add ${{ matrix.target }}
-
+  
       - uses: actions/cache@v4
         with:
           path: |
@@ -135,31 +171,33 @@ jobs:
             /usr/local/cargo/git
             target
           key: musl-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
-
+  
       - name: Build
         run: |
           if [ "${{ matrix.target }}" = "aarch64-unknown-linux-musl" ]; then
             export CC=aarch64-linux-musl-gcc
+            export CC_aarch64_unknown_linux_musl=aarch64-linux-musl-gcc
             export RUSTFLAGS="-C target-feature=+crt-static -C linker=aarch64-linux-musl-gcc"
           else
             export CC=musl-gcc
+            export CC_x86_64_unknown_linux_musl=musl-gcc
             export RUSTFLAGS="-C target-feature=+crt-static"
           fi
-
+  
           cargo build --release --target ${{ matrix.target }}
-
+  
       - name: Package
         run: |
           mkdir -p dist
           cp target/${{ matrix.target }}/release/${{ env.BINARY_NAME }} dist/telemt
-
+  
           cd dist
           tar -czf ${{ matrix.asset }}.tar.gz \
             --owner=0 --group=0 --numeric-owner \
             telemt
-
+  
           sha256sum ${{ matrix.asset }}.tar.gz > ${{ matrix.asset }}.sha256
-
+  
       - uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.asset }}
@@ -194,51 +232,48 @@ jobs:
           prerelease: ${{ contains(github.ref, '-') }}
 
 # ==========================
-# Docker (FROM RELEASE)
+# Docker
 # ==========================
   docker:
-    name: Docker (from release)
+    name: Docker
     runs-on: ubuntu-latest
-    needs: release
-
+    needs: [build-gnu, build-musl]
+  
     permissions:
       contents: read
       packages: write
-
+  
     steps:
       - uses: actions/checkout@v4
-
-      - name: Install gh
-        run: apt-get update && apt-get install -y gh
-
-      - name: Extract version
-        id: vars
-        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
-
-      - name: Download binary
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist
+  
+      - name: Extract binaries
         run: |
-          mkdir dist
-
-          gh release download ${{ steps.vars.outputs.VERSION }} \
-            --repo ${{ github.repository }} \
-            --pattern "telemt-x86_64-linux-musl.tar.gz" \
-            --dir dist
-
-          tar -xzf dist/telemt-x86_64-linux-musl.tar.gz -C dist
-          chmod +x dist/telemt
-
+          mkdir bin
+  
+          tar -xzf dist/telemt-x86_64-linux-musl/telemt-x86_64-linux-musl.tar.gz -C bin
+          mv bin/telemt bin/telemt-amd64
+  
+          tar -xzf dist/telemt-aarch64-linux-musl/telemt-aarch64-linux-musl.tar.gz -C bin
+          mv bin/telemt bin/telemt-arm64
+  
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
-
+  
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build & Push
+  
+      - name: Extract version
+        id: vars
+        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
+  
+      - name: Build & Push (multi-arch)
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -248,4 +283,5 @@ jobs:
             ghcr.io/${{ github.repository }}:${{ steps.vars.outputs.VERSION }}
             ghcr.io/${{ github.repository }}:latest
           build-args: |
-            BINARY=dist/telemt
+            BINARY_AMD64=bin/telemt-amd64
+            BINARY_ARM64=bin/telemt-arm64

Cargo.toml

@@ -83,4 +83,6 @@ name = "crypto_bench"
 harness = false
 
 [profile.release]
-lto = "thin"
+lto = "fat"
+codegen-units = 1
+

Dockerfile

@@ -1,47 +1,78 @@
 # syntax=docker/dockerfile:1
 
-ARG BINARY
+ARG TARGETARCH
+ARG BINARY_AMD64
+ARG BINARY_ARM64
 
 # ==========================
-# Stage: minimal
+# Minimal Image
 # ==========================
 FROM debian:12-slim AS minimal
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    binutils \
-    curl \
-    ca-certificates \
-    && rm -rf /var/lib/apt/lists/* \
+ARG TARGETARCH
+ARG BINARY_AMD64
+ARG BINARY_ARM64
+
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends \
+        binutils \
+        curl \
+        xz-utils \
+        ca-certificates; \
+    rm -rf /var/lib/apt/lists/*
+
+# --- Select correct binary ---
+RUN set -eux; \
+    case "${TARGETARCH}" in \
+        amd64) BIN="${BINARY_AMD64}" ;; \
+        arm64) BIN="${BINARY_ARM64}" ;; \
+        *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    echo "Using binary: $BIN"; \
+    test -f "$BIN"; \
+    cp "$BIN" /telemt
+
+# --- Install UPX (arch-aware) ---
+RUN set -eux; \
+    case "${TARGETARCH}" in \
+        amd64) UPX_ARCH="amd64" ;; \
+        arm64) UPX_ARCH="arm64" ;; \
+        *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
     \
-    && curl -fL \
+    curl -fL \
         --retry 5 \
         --retry-delay 3 \
         --connect-timeout 10 \
         --max-time 120 \
         -o /tmp/upx.tar.xz \
-        https://github.com/telemt/telemt/releases/download/toolchains/upx-amd64_linux.tar.xz \
-    && tar -xf /tmp/upx.tar.xz -C /tmp \
-    && mv /tmp/upx*/upx /usr/local/bin/upx \
-    && chmod +x /usr/local/bin/upx \
-    && rm -rf /tmp/upx*
+        "https://github.com/telemt/telemt/releases/download/toolchains/upx-${UPX_ARCH}_linux.tar.xz"; \
+    \
+    tar -xf /tmp/upx.tar.xz -C /tmp; \
+    install -m 0755 /tmp/upx*/upx /usr/local/bin/upx; \
+    rm -rf /tmp/upx*
 
-COPY ${BINARY} /telemt
-
-RUN strip /telemt || true
-RUN upx --best --lzma /telemt || true
+# --- Optimize binary ---
+RUN set -eux; \
+    test -f /telemt; \
+    strip --strip-unneeded /telemt || true; \
+    upx --best --lzma /telemt || true
 
 # ==========================
-# Debug image
+# Debug Image
 # ==========================
 FROM debian:12-slim AS debug
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates \
-    tzdata \
-    curl \
-    iproute2 \
-    busybox \
-    && rm -rf /var/lib/apt/lists/*
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        tzdata \
+        curl \
+        iproute2 \
+        busybox; \
+    rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
@@ -54,7 +85,7 @@ ENTRYPOINT ["/app/telemt"]
 CMD ["config.toml"]
 
 # ==========================
-# Production (REAL distroless)
+# Production Distroless on MUSL
 # ==========================
 FROM gcr.io/distroless/static-debian12 AS prod
 
@@ -68,4 +99,4 @@ USER nonroot:nonroot
 EXPOSE 443 9090 9091
 
 ENTRYPOINT ["/app/telemt"]
-CMD ["config.toml"]
+CMD ["config.toml"]