target-cpu=native causes SIGILL in CI because the build script is
compiled with CPU-specific instructions that the Docker builder
doesn't support. Docker images should use generic CPU targets for
portability.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
CI and Docker builds broke after removing db/ in favor of migrations/.
- ci.yml: point psql init at migrations/20260307000000_initial_schema.sql
- Dockerfile: COPY migrations instead of db; remove unused db copy in final stage
- docker-build.yml: remove db/schema.sql presence check
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add .cargo/config.toml with target-cpu=native for x86-64 and aarch64
- Update Dockerfile to pass RUSTFLAGS in both cacher and builder stages
- Enables AVX2/AVX-512 (Intel/AMD) or NEON (ARM/Apple Silicon) codepaths
- 2-3x speedup for BLAKE3 hashing and image transcoding
- JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret
- Remove setup token: first admin setup is open until system initialized
- Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top
- Update login UI and auth.js to remove setup token fields
Root cause: Docker named volumes are created as root, but the container
ran as the unprivileged 'oxicloud' user (UID 1001). Services like
thumbnail_service, image_transcode, and dedup_service call
create_dir_all under /app/storage during initialization, which fails
with 'Permission denied (os error 13)'.
Changes:
- Add entrypoint.sh that runs as root to chown /app/storage, then
drops privileges via su-exec before executing the application
- Update Dockerfile to install su-exec, copy entrypoint, and use
ENTRYPOINT instead of USER+CMD
- Downgrade id_mapping_service initial write failure from ERROR to WARN
(empty in-memory map is perfectly valid, will persist on next save)
- Improve panic message in main.rs to hint at Docker permission issue
Fixes #<issue>
- Remove Serialize/Deserialize from File, Folder, Session, User, Contact entities
- Create contact_persistence_dto.rs for JSONB persistence in infrastructure layer
- Update contact_pg_repository to use persistence DTOs
- Fix dependency on zip crate (downgrade from 7.2.0 to 2.1.0)
- Fix unused variable warnings in main.rs
- Move PathService import from domain to infrastructure
- Add missing fields to CoreServices and RepositoryServices
- Create proper service initialization in main.rs
Clean Architecture improvements:
- Domain layer no longer depends on serde framework
- Persistence concerns isolated to infrastructure layer
- TokenClaims in auth_service.rs is only exception (required for JWT)
`apk` with `--no-cache` will ensure the package index updated without leaving temporary files. Additional `apk --no-cache update` will be unnecessary. Besides, `--no-cache` is kind of conflicts with `apk update` command.
Edouard Vanbelle