add openssh to arch-builder images

shadowsocks-rust to dev tag
updated xray plugin
2026-05-15 07:22:57 +08:00 · 2026-05-11 21:03:26 +08:00 · 2026-05-11 21:01:43 +08:00 · 2026-05-11 17:17:09 +08:00 · 2026-05-11 17:17:02 +08:00 · 2026-05-11 17:17:02 +08:00
87 changed files with 2774 additions and 307 deletions
@@ -0,0 +1,34 @@
+name: CI
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'agentmail-mcp/*'
+      - '.gitea/workflows/build-agentmail-mcp.yaml'      
+jobs:
+  "Build agentmail-mcp docker images":
+    runs-on: woryzen
+    steps:
+      -
+        name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      -
+        name: Build and push agentmail-mcp images
+        uses: docker/build-push-action@v6
+        with:
+          builder: multiplatform-builder
+          context: "{{defaultContext}}:agentmail-mcp"
+          build-args: |
+            VERSION=0.3.0
+          platforms: |
+            linux/amd64
+          push: true
+          pull: true
+          tags: |
+            "gitea.woggioni.net/woggioni/agentmail-mcp:latest"
+            "gitea.woggioni.net/woggioni/agentmail-mcp:0.3.0"
+
@@ -3,17 +3,12 @@ on:
  push:
    branches: [ master ]
    paths:
-      - 'arch-builder/*'
+      - 'arch-builder/**'
      - '.gitea/workflows/build-arch-builder.yaml'      
 jobs:
  "Build arch-builder docker images":
    runs-on: woryzen
    steps:
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver: docker-container
      -
        name: Login to Gitea container registry
        uses: docker/login-action@v3
@@ -25,65 +20,95 @@ jobs:
        name: Build and push arch-builder base images
        uses: docker/build-push-action@v6
        with:
+          builder: multiplatform-builder
          context: "{{defaultContext}}:arch-builder"
          platforms: linux/amd64
          push: true
          pull: true
          tags: |
            "gitea.woggioni.net/woggioni/arch-builder:base"
-          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/arch-builder:buildx
-          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/arch-builder:buildx          
          target: base
+      -
+        name: Build and push arch-builder openwrt-builder images
+        uses: docker/build-push-action@v6
+        with:
+          builder: multiplatform-builder
+          context: "{{defaultContext}}:arch-builder"
+          platforms: linux/amd64
+          push: true
+          pull: true
+          tags: |
+            "gitea.woggioni.net/woggioni/arch-builder:openwrt-builder"
+          target: openwrt-builder
      -
        name: Build and push arch-builder kernel images
        uses: docker/build-push-action@v6
        with:
+          builder: multiplatform-builder
          context: "{{defaultContext}}:arch-builder"
          platforms: linux/amd64
          push: true
          pull: true
          tags: |
            "gitea.woggioni.net/woggioni/arch-builder:kernel"
-          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/arch-builder:buildx
-          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/arch-builder:buildx          
          target: kernel
      -
        name: Build and push arch-builder rust images
        uses: docker/build-push-action@v6
        with:
+          builder: multiplatform-builder
          context: "{{defaultContext}}:arch-builder"
          platforms: linux/amd64
          push: true
          pull: true
          tags: |
            "gitea.woggioni.net/woggioni/arch-builder:rust"
-          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/arch-builder:buildx
-          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/arch-builder:buildx          
          target: rust
      -
        name: Build and push arch-builder rust full images
        uses: docker/build-push-action@v6
        with:
+          builder: multiplatform-builder
          context: "{{defaultContext}}:arch-builder"
          platforms: linux/amd64
          push: true
          pull: true
          tags: |
            "gitea.woggioni.net/woggioni/arch-builder:rust-full"
-          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/arch-builder:buildx
-          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/arch-builder:buildx          
          target: rust-full
      -
-        name: Build and push arch-builder rust images
+        name: Build and push arch-builder rust sccache images
        uses: docker/build-push-action@v6
        with:
+          builder: multiplatform-builder
          context: "{{defaultContext}}:arch-builder"
          platforms: linux/amd64
          push: true
          pull: true
          tags: |
-            "gitea.woggioni.net/woggioni/arch-builder:rust-full-rootless"
-            "gitea.woggioni.net/woggioni/arch-builder:latest"
-          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/arch-builder:buildx
-          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/arch-builder:buildx          
-          target: rust-full-rootless
+            "gitea.woggioni.net/woggioni/arch-builder:rust-sccache"
+          target: rust-sccache
+      -
+        name: Build and push arch-builder rust full sccache  images
+        uses: docker/build-push-action@v6
+        with:
+          builder: multiplatform-builder
+          context: "{{defaultContext}}:arch-builder"
+          platforms: linux/amd64
+          push: true
+          pull: true
+          tags: |
+            "gitea.woggioni.net/woggioni/arch-builder:rust-full-sccache"
+          target: rust-full-sccache
+      -
+        name: Build and push arch-builder gitea_act_runner images
+        uses: docker/build-push-action@v6
+        with:
+          builder: multiplatform-builder
+          context: "{{defaultContext}}:arch-builder"
+          platforms: linux/amd64
+          push: true
+          pull: true
+          tags: |
+            "gitea.woggioni.net/woggioni/arch-builder:gitea_act_runner"
+          target: gitea_act_runner
@@ -0,0 +1,58 @@
+name: CI
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'bee-dashboard/**'
+      - '.gitea/workflows/build-bee-dashboard.yaml'      
+jobs:
+  "Build & deploy Cloudflare page":
+    runs-on: woryzen
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v4
+        with:
+          path: docker-images
+      - name: Checkout bee-dashboard sources
+        run: /usr/sbin/git clone -b 0.33.3 --depth 1 https://github.com/woggioni/bee-dashboard.git src
+      - name: Execute build
+        run: cd src && npm install
+      - name: Copy _headers file
+        run: cp docker-images/bee-dashboard/_headers src/build
+      - name: Create archive
+        run: tar -czf docker-images/bee-dashboard/bee-dashboard.tar -C src/build .
+      - name: Publish archive to gitea.woggioni.net
+        run: curl --user woggioni:${{ secrets.PUBLISHER_TOKEN }} --upload-file docker-images/bee-dashboard/bee-dashboard.tar https://gitea.woggioni.net/api/packages/woggioni/generic/bee-dashboard/0.33.3/bee-dashboard.tar
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.4.0
+        with:
+          driver: docker-container
+          platforms: |
+            linux/amd64
+            linux/arm64
+      - name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      - name: Build and push bee-dashboard images
+        uses: docker/build-push-action@v6
+        with:
+          platforms: |
+            linux/amd64
+            linux/arm64
+          context: "docker-images/bee-dashboard"
+          push: true
+          pull: true
+          ssh: default=/home/luser/.ssh/id_ed25519
+          build-args: "VERSION=0.33.3"
+          tags: |
+            "gitea.woggioni.net/woggioni/bee-dashboard:0.33.3"
+          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/bee-dashboard:buildx
+          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/bee-dashboard:buildx          
+      - name: Deploy to Cloudflare
+        run: npx wrangler pages deploy --project-name bee-dashboard --branch main src/build
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
@@ -0,0 +1,42 @@
+
+name: CI
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'cgit/*'
+      - '.gitea/workflows/build-cgit.yaml'      
+jobs:
+  "Build cgit docker images":
+    runs-on: hostinger
+    steps:
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.4.0
+        with:
+          driver: docker-container
+          platforms: |
+            linux/amd64
+            linux/arm64
+      -
+        name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      -
+        name: Build and push cgit images
+        uses: docker/build-push-action@v6
+        with:
+          context: "{{defaultContext}}:cgit"
+          platforms: |
+            linux/amd64
+            linux/arm64
+          push: true
+          pull: true
+          tags: |
+            "gitea.woggioni.net/woggioni/cgit:latest"
+          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/cgit:buildx
+          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/cgit:buildx          
+
@@ -0,0 +1,41 @@
+name: CI
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'dyndns/*'
+      - '.gitea/workflows/build-dyndns.yaml'      
+jobs:
+  "Build dyndns docker images":
+    runs-on: hostinger
+    steps:
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.4.0
+        with:
+          driver: docker-container
+          platforms: |
+            linux/amd64
+            linux/arm64
+      -
+        name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      -
+        name: Build and push dyndns images
+        uses: docker/build-push-action@v6
+        with:
+          context: "{{defaultContext}}:dyndns"
+          platforms: |
+            linux/amd64
+            linux/arm64
+          push: true
+          pull: true
+          tags: |
+            "gitea.woggioni.net/woggioni/dyndns:latest"
+          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/dyndns:buildx
+          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/dyndns:buildx          
+
@@ -3,17 +3,12 @@ on:
  push:
    branches: [ master ]
    paths:
-      - 'jenkins-agent/*'
+      - 'jenkins-agent/**'
      - '.gitea/workflows/build-jenkins-agent.yaml'      
 jobs:
  "Build jenkins-agent docker images":
    runs-on: woryzen
    steps:
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.4.0
-        with:
-          driver: docker-container
      -
        name: Login to Gitea container registry
        uses: docker/login-action@v3
@@ -25,11 +20,10 @@ jobs:
        name: Build and push jenkins-agent images
        uses: docker/build-push-action@v6
        with:
+          builder: default
          context: "{{defaultContext}}:jenkins-agent"
          push: true
          pull: true
          tags: |
            "gitea.woggioni.net/woggioni/jenkins-agent:latest"
-          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/jenkins-agent:buildx
-          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/jenkins-agent:buildx          

@@ -9,14 +9,6 @@ jobs:
  "Build Jupyter Ganymede docker images":
    runs-on: woryzen
    steps:
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver: docker-container
      -
        name: Login to Gitea container registry
        uses: docker/login-action@v3
@@ -26,12 +18,12 @@ jobs:
          password: ${{ secrets.PUBLISHER_TOKEN }}
      -
        name: Build and push jupyter-ganymede image
-        uses: docker/build-push-action@v5.3.0
+        uses: docker/build-push-action@v6
        with:
+          builder: multiplatform-builder
          context: "{{defaultContext}}:jupyter-ganymede"
          platforms: linux/amd64,linux/arm64
+          ssh: default=/home/luser/.ssh/id_ed25519
          push: true
          pull: true
          tags: gitea.woggioni.net/woggioni/jupyter-ganymede:latest
-          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/jupyter-ganymede:buildx
-          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/jupyter-ganymede:buildx          
@@ -3,11 +3,11 @@ on:
  push:
    branches: [ master ]
    paths:
-      - 'jupyter-python/*'
+      - 'jupyter-python/**'
      - '.gitea/workflows/build-jupyter-python.yaml'      
 jobs:
  "Build Jupyter python Docker images":
-    runs-on: woryzen
+    runs-on: hostinger
    steps:
      -
        name: Set up QEMU
@@ -29,7 +29,7 @@ jobs:
        uses: docker/build-push-action@v5.3.0
        with:
          context: "{{defaultContext}}:jupyter-python"
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
          push: true
          pull: true
          tags: gitea.woggioni.net/woggioni/jupyter-python:latest
@@ -9,14 +9,6 @@ jobs:
  "Build Jupyter Sage docker images":
    runs-on: woryzen
    steps:
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver: docker-container
      -
        name: Login to Gitea container registry
        uses: docker/login-action@v3
@@ -28,10 +20,12 @@ jobs:
        name: Build and push jupyter-sage image
        uses: docker/build-push-action@v5.3.0
        with:
+          builder: multiplatform-builder
          context: "{{defaultContext}}:jupyter-sage"
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64
          push: true
-          pull: true
-          tags: gitea.woggioni.net/woggioni/jupyter-sage:latest
-          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/jupyter-sage:buildx
-          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/jupyter-sage:buildx          
+          build-args: "VERSION=10.8"
+          ssh: default=/home/luser/.ssh/id_ed25519
+          tags: |
+            gitea.woggioni.net/woggioni/jupyter-sage:latest
+            gitea.woggioni.net/woggioni/jupyter-sage:10.8
@@ -0,0 +1,37 @@
+name: CI
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'jupyterhub/**'
+      - '.gitea/workflows/build-jupyterhub.yaml'      
+jobs:
+  "Build jupyterhub docker images":
+    runs-on: woryzen
+    steps:
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.4.0
+        with:
+          driver: docker-container
+      -
+        name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      -
+        name: Build and push jupyterhub images
+        uses: docker/build-push-action@v6
+        with:
+          context: "{{defaultContext}}:jupyterhub"
+          push: true
+          pull: true
+          tags: |
+            "gitea.woggioni.net/woggioni/jupyterhub:latest"
+            "gitea.woggioni.net/woggioni/jupyterhub:5.3.0"
+          build-args: "VERSION=5.3.0"
+          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/jupyterhub:buildx
+          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/jupyterhub:buildx          
+
@@ -0,0 +1,35 @@
+
+name: CI
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'monerod/*'
+      - '.gitea/workflows/build-monerod.yaml'      
+jobs:
+  "Build monerod docker images":
+    runs-on: woryzen
+    steps:
+      -
+        name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      -
+        name: Build and push monerod images
+        uses: docker/build-push-action@v6
+        with:
+          context: "{{defaultContext}}:monerod"
+          builder: multiplatform-builder
+          platforms: |
+            linux/amd64
+            linux/arm64
+          push: true
+          pull: true
+          tags: |
+            "gitea.woggioni.net/woggioni/monerod:latest"
+            "gitea.woggioni.net/woggioni/monerod:0.18.4.5"
+            
+
@@ -0,0 +1,62 @@
+name: CI
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'nginx/**'
+      - '.gitea/workflows/build-nginx.yaml'      
+jobs:
+  "Build nginx docker images":
+    runs-on: woryzen
+    steps:
+      -
+        name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      -
+        name: Build and push nginx vanilla images
+        uses: docker/build-push-action@v6
+        with:
+          builder: multiplatform-builder
+          context: "{{defaultContext}}:nginx"
+          platforms: |
+            linux/amd64
+            linux/arm64
+            linux/arm/v7
+          push: true
+          pull: true
+          ssh: default=/home/luser/.ssh/id_ed25519
+          tags: |
+            "gitea.woggioni.net/woggioni/nginx:latest"
+            "gitea.woggioni.net/woggioni/nginx:v1.30.0"
+          secrets: |
+            GIT_AUTH_TOKEN.github.com=${{ secrets.GH_ACCESS_TOKEN }}
+          build-args: |
+            LIBRESSL_VERSION=4.2.1
+            NGINX_VERSION=1.30.0
+            NGINX_BRANCH=vanilla
+      -
+        name: Build and push nginx custom images
+        uses: docker/build-push-action@v6
+        with:
+          builder: multiplatform-builder
+          context: "{{defaultContext}}:nginx"
+          platforms: |
+            linux/amd64
+            linux/arm64
+            linux/arm/v7
+          push: true
+          pull: true
+          ssh: default=/home/luser/.ssh/id_ed25519
+          tags: |
+            "gitea.woggioni.net/woggioni/nginx:woggioni"
+            "gitea.woggioni.net/woggioni/nginx:v1.30.0-woggioni"
+          secrets: |
+            GIT_AUTH_TOKEN.github.com=${{ secrets.GH_ACCESS_TOKEN }}
+          build-args: |
+            LIBRESSL_VERSION=4.2.1
+            NGINX_VERSION=1.30.0
+            NGINX_BRANCH=woggioni
@@ -0,0 +1,35 @@
+
+name: CI
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'opencode/*'
+      - '.gitea/workflows/build-opencode.yaml'      
+jobs:
+  "Build opencode docker images":
+    runs-on: woryzen
+    steps:
+      -
+        name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      -
+        name: Build and push opencode images
+        uses: docker/build-push-action@v6
+        with:
+          builder: multiplatform-builder
+          context: "{{defaultContext}}:opencode"
+          build-args: |
+            OPENCODE_VERSION=1.14.48
+          platforms: |
+            linux/amd64
+          push: true
+          pull: true
+          tags: |
+            "gitea.woggioni.net/woggioni/opencode:1.14.48"
+            "gitea.woggioni.net/woggioni/opencode:latest"
+
@@ -0,0 +1,37 @@
+name: CI
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'pgvector/**'
+      - '.gitea/workflows/build-pgvector.yaml'      
+jobs:
+  "Build pgvector docker images":
+    runs-on: woryzen
+    steps:
+      -
+        name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      -
+        name: Build and push pgvector images
+        uses: docker/build-push-action@v6
+        with:
+          builder: multiplatform-builder
+          context: "{{defaultContext}}:pgvector"
+          push: true
+          pull: true
+          platforms: |
+            linux/amd64
+            linux/arm64
+          tags: |
+            "gitea.woggioni.net/woggioni/pgvector:latest"
+            "gitea.woggioni.net/woggioni/pgvector:0.8.2-pg18.3-alpine3.23"
+          build-args: |
+            PG_VERSION=18.3
+            ALPINE_VERSION=3.23
+            PGVECTOR_VERSION=0.8.2
+
@@ -0,0 +1,43 @@
+name: CI
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'rlevtree/*'
+      - '.gitea/workflows/build-rlevtree.yaml'      
+jobs:
+  "Build rlevtree docker images":
+    runs-on: woryzen
+    steps:
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.4.0
+        with:
+          driver: docker-container
+          platforms: |
+            wasm/wasm
+            linux/amd64
+            linux/arm64
+      -
+        name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      -
+        name: Build and push sserver-rust images
+        uses: docker/build-push-action@v6
+        with:
+          context: "{{defaultContext}}:rlevtree"
+          platforms: |
+            wasm/wasm
+            linux/amd64
+            linux/arm64
+          push: true
+          pull: true
+          tags: |
+            "gitea.woggioni.net/woggioni/rlevtree:latest"
+          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/rlevtree:buildx
+          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/rlevtree:buildx          
+
@@ -1,7 +1,7 @@
 name: CI
 on:
  push:
-    branches: [ master ]
+    branches: [ dev ]
    paths:
      - 'shadowsocks-rust/*'
      - '.gitea/workflows/build-shadowsocks-rust.yaml'      
@@ -9,14 +9,6 @@ jobs:
  "Build shadowsocks-rust docker images":
    runs-on: woryzen
    steps:
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.4.0
-        with:
-          driver: docker-container
-          platforms: |
-            linux/amd64
-            linux/arm64
      -
        name: Login to Gitea container registry
        uses: docker/login-action@v3
@@ -28,16 +20,14 @@ jobs:
        name: Build and push sserver-rust images
        uses: docker/build-push-action@v6
        with:
+          builder: multiplatform-builder
          context: "{{defaultContext}}:shadowsocks-rust"
          platforms: |
            linux/amd64
            linux/arm64
          push: true
-          pull: true
+          pull: false
+          ssh: default=/home/luser/.ssh/id_ed25519
          tags: |
-            "gitea.woggioni.net/woggioni/sserver-rust:latest"
-            "gitea.woggioni.net/woggioni/sserver-rust:v1.20.4"
-          build-args: "VERSION=1.20.4"
-          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/sserver-rust:buildx
-          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/sserver-rust:buildx          
-
+            "gitea.woggioni.net/woggioni/sserver-rust:dev"
+          build-args: "VERSION=1.24.0"
@@ -0,0 +1,41 @@
+name: CI
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'swarm-cli/*'
+      - '.gitea/workflows/build-swarm-cli.yaml'      
+jobs:
+  "Build swarm-cli docker images":
+    runs-on: woryzen
+    steps:
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.4.0
+        with:
+          driver: docker-container
+          platforms: |
+            linux/amd64
+            linux/arm64
+      -
+        name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      -
+        name: Build and push swarm-cli images
+        uses: docker/build-push-action@v6
+        with:
+          context: "{{defaultContext}}:swarm-cli"
+          platforms: |
+            linux/amd64
+            linux/arm64
+          push: true
+          pull: true
+          tags: |
+            "gitea.woggioni.net/woggioni/swarm-cli:latest"
+          cache-from: type=registry,ref=gitea.woggioni.net/woggioni/swarm-cli:buildx
+          cache-to: type=registry,mode=max,compression=zstd,image-manifest=true,oci-mediatypes=true,ref=gitea.woggioni.net/woggioni/swarm-cli:buildx          
+
@@ -0,0 +1,31 @@
+name: CI
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'wildfly/**'
+      - '.gitea/workflows/build-wildfly.yaml'      
+jobs:
+  "Build wildfly docker images":
+    runs-on: woryzen
+    steps:
+      -
+        name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      -
+        name: Build and push wildfly images
+        uses: docker/build-push-action@v6
+        with:
+          builder: default
+          context: "{{defaultContext}}:wildfly"
+          push: true
+          pull: true
+          tags: |
+            "gitea.woggioni.net/woggioni/wildfly:latest"
+            "gitea.woggioni.net/woggioni/wildfly:39.0.1"
+          build-args: "VERSION=39.0.1"
+
@@ -0,0 +1,35 @@
+name: CI
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'xmrig/**'
+      - '.gitea/workflows/build-xmrig.yaml'      
+jobs:
+  "Build xmrig docker images":
+    runs-on: woryzen
+    steps:
+      -
+        name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      -
+        name: Build and push xmrig images
+        uses: docker/build-push-action@v6
+        with:
+          builder: multiplatform-builder
+          context: "{{defaultContext}}:xmrig"
+          platforms: |
+            linux/amd64
+            linux/arm64
+          push: true
+          pull: true
+          ssh: default=/home/luser/.ssh/id_ed25519
+          tags: |
+            "gitea.woggioni.net/woggioni/xmrig:latest"
+            "gitea.woggioni.net/woggioni/xmrig:6.25.0"
+          build-args: "VERSION=6.25.0"
+
@@ -0,0 +1,14 @@
+FROM alpine:3.23
+ARG VERSION
+RUN --mount=type=cache,target=/var/cache/apk apk add python3 pipx
+ADD --chmod=755 ./entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN addgroup -S agentmail
+RUN adduser -D -S -h /var/lib/agentmail -G agentmail agentmail
+WORKDIR /var/lib/agentmail
+USER agentmail
+RUN pipx install mcp-streamablehttp-proxy
+RUN pipx install agentmail-mcp==${VERSION}
+ENV SERVER_HOST="0.0.0.0"
+ENV SERVER_PORT="8080"
+
+ENTRYPOINT ["entrypoint.sh"]
@@ -0,0 +1,12 @@
+#!/usr/bin/env sh
+if [ -z "${SERVER_HOST}" ]
+then
+  SERVER_HOST="0.0.0.0"
+fi
+if [ -z "${AGENTMAIL_API_KEY}" ]
+then
+  echo "You need to specify an API key setting the environmental variable 'AGENTMAIL_API_KEY'"
+  false
+else
+  exec .local/bin/mcp-streamablehttp-proxy --host ${SERVER_HOST} --port ${SERVER_PORT} .local/bin/agentmail-mcp --api-key ${AGENTMAIL_API_KEY}
+fi
@@ -2,39 +2,45 @@ FROM archlinux:latest AS base

 COPY mirrorlist /etc/pacman.d/mirrolist

+RUN pacman-key --init
 RUN pacman-key --refresh-keys
-RUN pacman -Syu --noconfirm
-RUN pacman -S --noconfirm --needed curl rustup
+
+RUN curl --retry 3 -OJ https://gitea.woggioni.net/api/packages/woggioni/arch/repository.key
+
+RUN pacman-key --add repository.key
+RUN pacman-key --lsign-key 0D28BF66FDB45D18D8EBEE5D4C91DADCD00B3F77
+
+RUN --mount=type=bind,source=pacman-gitea-repository.conf,target=pacman-gitea-repository.conf cat pacman-gitea-repository.conf  >> /etc/pacman.conf
+
+RUN rm repository.key
+RUN --mount=type=cache,target=/var/cache/pacman pacman -Syu --noconfirm
+RUN --mount=type=cache,target=/var/cache/pacman pacman -S --noconfirm --needed \
+    curl \
+    openssh \
+    aarch64-unknown-linux-musl-gcc x86_64-unknown-linux-musl-gcc \
+    arm-unknown-linux-musleabihf-gcc \
+    arm-unknown-linux-musleabi-gcc \
+    x86_64-unknown-linux-musl-gcc \
+    x86_64-w64-mingw32-gcc \
+    aarch64-unknown-linux-musl-gcc x86_64-unknown-linux-musl-zlib \
+    arm-unknown-linux-musleabihf-zlib \
+    arm-unknown-linux-musleabi-zlib \
+    x86_64-unknown-linux-musl-zlib \
+    x86_64-w64-mingw32-zlib
+

 RUN mkdir downloads
-RUN curl --retry 3 https://gitea.woggioni.net/api/packages/woggioni/generic/aarch64-unknown-linux-musl-gcc/13.2.0/aarch64-unknown-linux-musl-gcc-13.2.0-1-x86_64.pkg.tar.zst \
-    -o downloads/aarch64-unknown-linux-musl-gcc-13.2.0-1-x86_64.pkg.tar.zst
 RUN ln -s /opt/x-tools/aarch64-unknown-linux-musl/bin/aarch64-unknown-linux-musl-gcc /usr/local/bin/aarch64-linux-musl-gcc 
-
-RUN curl --retry 3 https://gitea.woggioni.net/api/packages/woggioni/generic/x86_64-unknown-linux-musl-gcc/13.2.0/x86_64-unknown-linux-musl-gcc-13.2.0-1-x86_64.pkg.tar.zst \
-    -o downloads/x86_64-unknown-linux-musl-gcc-13.2.0-1-x86_64.pkg.tar.zst
-RUN ln -s /opt/x-tools/x86_64-woggioni-linux-musl/bin/x86_64-woggioni-linux-musl-gcc /usr/local/bin/x86_64-linux-musl-gcc
-
-RUN curl --retry 3 https://gitea.woggioni.net/api/packages/woggioni/generic/arm-unknown-linux-musleabihf-gcc/13.2.0/arm-unknown-linux-musleabihf-gcc-13.2.0-1-x86_64.pkg.tar.zst \
-    -o downloads/arm-unknown-linux-musleabihf-gcc-13.2.0-1-x86_64.pkg.tar.zst
+RUN ln -s /opt/x-tools/x86_64-unknown-linux-musl/bin/x86_64-unknown-linux-musl-gcc /usr/local/bin/x86_64-linux-musl-gcc
 RUN ln -s /opt/x-tools/arm-unknown-linux-musleabihf/bin/arm-unknown-linux-musleabihf-gcc /usr/local/bin/arm-linux-musleabihf-gcc
-
-RUN curl --retry 3 https://gitea.woggioni.net/api/packages/woggioni/generic/arm-unknown-linux-musleabi-gcc/13.2.0/arm-unknown-linux-musleabi-gcc-13.2.0-1-x86_64.pkg.tar.zst \
-    -o downloads/arm-unknown-linux-musleabi-gcc-13.2.0-1-x86_64.pkg.tar.zst
 RUN ln -s /opt/x-tools/arm-unknown-linux-musleabihf/bin/arm-unknown-linux-musleabi-gcc /usr/local/bin/arm-linux-musleabi-gcc
-
-RUN curl --retry 3 https://gitea.woggioni.net/api/packages/woggioni/generic/x86_64-w64-mingw32-gcc/13.2.0/x86_64-w64-mingw32-gcc-13.2.0-1-x86_64.pkg.tar.zst \
-    -o downloads/x86_64-w64-mingw32-gcc-13.2.0-1-x86_64.pkg.tar.zst
 RUN ln -s /opt/x-tools/x86_64-w64-mingw32/bin/x86_64-w64-mingw32-gcc /usr/local/bin/x86_64-pc-windows-gnu-gcc

-RUN pacman -U downloads/*.pkg.tar.* --noconfirm
-RUN rm -rf downloads
-
 COPY makepkg/* /etc/

 RUN useradd luser -G users -u 1000 -s /bin/bash -m -d /home/luser

-RUN pacman -S --noconfirm --needed \
+RUN --mount=type=cache,target=/var/cache/pacman pacman -S --noconfirm --needed \
    git \
    cmake \
    base-devel \
@@ -49,7 +55,7 @@ RUN pacman -S --noconfirm --needed \
    upx

 FROM base AS kernel
-RUN pacman -S --noconfirm --needed \
+RUN --mount=type=cache,target=/var/cache/pacman pacman -S --noconfirm --needed \
    jre21-openjdk \
    bc \
    cpio \
@@ -65,34 +71,100 @@ RUN pacman -S --noconfirm --needed \
    imagemagick \
    python-sphinx \
    python-yaml \
-    openssh \
+    rust \
+    rust-src \
+    rust-bindgen \
    texlive-latexextra
 USER luser
 WORKDIR /home/luser

+FROM base AS openwrt-builder
+RUN mkdir -p /etc/cargo
+COPY --chown=1000:1000 config.toml /home/luser/.cargo/config.toml
+RUN --mount=type=cache,target=/var/cache/pacman pacman -S --noconfirm --needed rustup go rsync wget unzip swig python-setuptools python-pyelftools
+
 FROM base AS rust
 RUN mkdir -p /etc/cargo
-COPY config.toml /.cargo/
-RUN pacman -S --noconfirm --needed \
+COPY --chown=1000:1000 config.toml /home/luser/.cargo/config.toml
+RUN --mount=type=cache,target=/var/cache/pacman pacman -S --noconfirm --needed \
    rustup \
-    sccache \
+    trunk \
    llvm \
    clang
+    
 FROM rust AS rust-full
-RUN pacman -S --noconfirm --needed \
+RUN --mount=type=cache,target=/var/cache/pacman pacman -S --noconfirm --needed \
    hidapi \
    protobuf     
-
-FROM rust-full AS rust-full-rootless
 USER luser
 WORKDIR /home/luser
-RUN mkdir .cargo
-RUN rustup toolchain install stable-x86_64-unknown-linux-gnu
+RUN rustup update
+RUN rustup toolchain install stable-x86_64-unknown-linux-gnu --profile minimal
+RUN rustup component add rustfmt
 RUN rustup target add \
    x86_64-unknown-linux-musl \
    x86_64-unknown-linux-gnu \
-    wasm32-wasi \
    armv7-unknown-linux-musleabihf \
    arm-unknown-linux-musleabi \
    aarch64-unknown-linux-musl \
-    aarch64-unknown-linux-gnu
+    aarch64-unknown-linux-gnu \
+    wasm32-unknown-unknown \
+    wasm32-wasip2
+    
+FROM base AS rust-sccache
+RUN mkdir -p /etc/cargo
+COPY --chown=1000:1000 config-sccache.toml /home/luser/.cargo/config.toml
+COPY --chown=1000:1000 sccache_config.toml /home/luser/.config/sccache/config
+RUN --mount=type=cache,target=/var/cache/pacman pacman -S --noconfirm --needed \
+    rustup \
+    trunk \
+    sccache \
+    llvm \
+    clang
+
+FROM rust-sccache AS rust-full-sccache
+RUN --mount=type=cache,target=/var/cache/pacman pacman -S --noconfirm --needed \
+    hidapi \
+    protobuf     
+USER luser
+WORKDIR /home/luser
+RUN rustup update
+RUN rustup toolchain install stable-x86_64-unknown-linux-gnu --profile minimal
+RUN rustup component add rustfmt
+RUN rustup target add \
+    x86_64-unknown-linux-musl \
+    x86_64-unknown-linux-gnu \
+    armv7-unknown-linux-musleabihf \
+    arm-unknown-linux-musleabi \
+    aarch64-unknown-linux-musl \
+    aarch64-unknown-linux-gnu \
+    wasm32-unknown-unknown \
+    wasm32-wasip2
+
+FROM base AS gitea_act_runner
+RUN --mount=type=bind,source=woggioni.net.ca.pem,target=/root.pem trust anchor root.pem
+RUN --mount=type=cache,target=/var/cache/pacman pacman -S --noconfirm --needed nodejs npm docker docker-buildx btrfs-progs hidapi protobuf rustup llvm clang trunk emscripten sccache
+RUN --mount=type=cache,target=/var/cache/pacman pacman -S --noconfirm --needed gitea-act-runner jdk21-graalvm-bin jdk25-graalvm-bin jdk21-graalvm-ce-bin jdk25-graalvm-ce-bin go
+RUN usermod -a luser -G docker
+USER luser
+WORKDIR /home/luser
+COPY --chown=1000:1000 config.toml /home/luser/.cargo/config.toml
+COPY --chown=1000:1000 sccache_config.toml /home/luser/.config/sccache/config
+RUN rustup update
+RUN rustup toolchain install stable-x86_64-unknown-linux-gnu --profile minimal
+RUN rustup component add rustfmt
+RUN rustup component add clippy
+RUN rustup target add \
+    x86_64-unknown-linux-musl \
+    x86_64-unknown-linux-gnu \
+    armv7-unknown-linux-musleabihf \
+    arm-unknown-linux-musleabi \
+    aarch64-unknown-linux-musl \
+    aarch64-unknown-linux-gnu \
+    wasm32-unknown-unknown \
+    wasm32-wasip2
+RUN cargo install worker-build
+RUN cargo install wasm-bindgen-cli
+RUN npm install -D wrangler
+ENV PATH="/home/luser/.local/bin:/home/luser/.cargo/bin:${PATH}"
+CMD ["/usr/lib/gitea/act_runner/act_runner", "daemon", "--config", "/var/lib/gitea/act_runner.yaml"]
@@ -0,0 +1,23 @@
+[target.aarch64-unknown-linux-musl]
+linker = "/opt/x-tools/aarch64-unknown-linux-musl/bin/aarch64-unknown-linux-musl-ld"
+[target.x86_64-unknown-linux-musl]
+linker = "/opt/x-tools/x86_64-unknown-linux-musl/bin/x86_64-unknown-linux-musl-ld"
+[target.x86_64-pc-windows-gnu]
+linker = "/opt/x-tools/x86_64-w64-mingw32/bin/x86_64-w64-mingw32-gcc"
+[target.armv7-unknown-linux-musleabihf]
+linker = "/opt/x-tools/arm-unknown-linux-musleabihf/bin/arm-unknown-linux-musleabihf-ld"
+
+[registries.gitea]
+global-credential-providers = ["cargo:token"]
+index = "sparse+https://gitea.woggioni.net/api/packages/woggioni/cargo/"
+
+[net]
+git-fetch-with-cli = true
+
+[profile.release]
+opt-level = 3
+lto = true
+strip = true
+
+[build]
+rustc-wrapper = "/usr/bin/sccache"
@@ -1,7 +1,7 @@
 [target.aarch64-unknown-linux-musl]
 linker = "/opt/x-tools/aarch64-unknown-linux-musl/bin/aarch64-unknown-linux-musl-ld"
 [target.x86_64-unknown-linux-musl]
-linker = "/opt/x-tools/x86_64-woggioni-linux-musl/bin/x86_64-woggioni-linux-musl-ld"
+linker = "/opt/x-tools/x86_64-unknown-linux-musl/bin/x86_64-unknown-linux-musl-ld"
 [target.x86_64-pc-windows-gnu]
 linker = "/opt/x-tools/x86_64-w64-mingw32/bin/x86_64-w64-mingw32-gcc"
 [target.armv7-unknown-linux-musleabihf]
@@ -14,5 +14,7 @@ index = "sparse+https://gitea.woggioni.net/api/packages/woggioni/cargo/"
 [net]
 git-fetch-with-cli = true

-[build]
-rustc-wrapper = "/usr/bin/sccache"
+[profile.release]
+opt-level = 3
+lto = true
+strip = true
@@ -43,11 +43,13 @@ CFLAGS="-march=armv8-a -O3 -pipe -fstack-protector-strong -fno-plt -fexceptions
        -fstack-clash-protection \
        -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer"
 CXXFLAGS="$CFLAGS -Wp,-D_GLIBCXX_ASSERTIONS"
-LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
 LTOFLAGS="-flto=auto"
+
 #RUSTFLAGS="-C opt-level=2"
 #-- Make Flags: change this for DistCC/SMP systems
-MAKEFLAGS="-j16"
+MAKEFLAGS="--jobs=$(nproc)"
 #-- Debugging flags
 DEBUG_CFLAGS="-g -fvar-tracking-assignments"
 DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
@@ -93,7 +95,7 @@ BUILDENV=(!distcc color ccache check !sign)
 #-- debug:      Add debugging flags as specified in DEBUG_* variables
 #-- lto:        Add compile flags for building with link time optimization
 #
-OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug !lto)
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)

 #-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
 INTEGRITY_CHECK=(sha256)
@@ -137,8 +139,8 @@ DBGSRCDIR="/usr/src/debug"
 #
 COMPRESSGZ=(gzip -c -f -n)
 COMPRESSBZ2=(bzip2 -c -f)
-COMPRESSXZ=(xz -c -z -)
-COMPRESSZST=(zstd -c -z -q -)
+COMPRESSXZ=(xz -9 -c -z -)
+COMPRESSZST=(zstd -14 -c -T0 -)
 COMPRESSLRZ=(lrzip -q)
 COMPRESSLZO=(lzop -q)
 COMPRESSZ=(compress -c -f)
@@ -40,11 +40,13 @@ CHOST="x86_64-pc-linux-gnu"
 #CPPFLAGS=""
 CFLAGS="-march=armv7-a+simd -mfloat-abi=hard -mfpu=vfpv3-d16 -O3 -pipe -fstack-protector-strong -fno-plt"
 CXXFLAGS="$CFLAGS -Wp,-D_GLIBCXX_ASSERTIONS"
-LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
 LTOFLAGS="-flto=auto"
+
 #RUSTFLAGS="-C opt-level=2"
 #-- Make Flags: change this for DistCC/SMP systems
-MAKEFLAGS="-j16"
+MAKEFLAGS="--jobs=$(nproc)"
 #-- Debugging flags
 DEBUG_CFLAGS="-g -fvar-tracking-assignments"
 DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
@@ -90,7 +92,7 @@ BUILDENV=(!distcc color ccache check !sign)
 #-- debug:      Add debugging flags as specified in DEBUG_* variables
 #-- lto:        Add compile flags for building with link time optimization
 #
-OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug !lto)
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)

 #-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
 INTEGRITY_CHECK=(sha256)
@@ -134,8 +136,8 @@ DBGSRCDIR="/usr/src/debug"
 #
 COMPRESSGZ=(gzip -c -f -n)
 COMPRESSBZ2=(bzip2 -c -f)
-COMPRESSXZ=(xz -c -z -)
-COMPRESSZST=(zstd -c -z -q -)
+COMPRESSXZ=(xz -9 -c -z -)
+COMPRESSZST=(zstd -14 -c -T0 -)
 COMPRESSLRZ=(lrzip -q)
 COMPRESSLZO=(lzop -q)
 COMPRESSZ=(compress -c -f)
@@ -0,0 +1,153 @@
+#!/hint/bash
+#
+# /etc/makepkg.conf
+#
+
+#########################################################################
+# SOURCE ACQUISITION
+#########################################################################
+#
+#-- The download utilities that makepkg should use to acquire sources
+#  Format: 'protocol::agent'
+DLAGENTS=('file::/usr/bin/curl -gqC - -o %o %u'
+          'ftp::/usr/bin/curl -gqfC - --ftp-pasv --retry 3 --retry-delay 3 -o %o %u'
+          'http::/usr/bin/curl -gqb "" -fLC - --retry 3 --retry-delay 3 -o %o %u'
+          'https::/usr/bin/curl -gqb "" -fLC - --retry 3 --retry-delay 3 -o %o %u'
+          'rsync::/usr/bin/rsync --no-motd -z %u %o'
+          'scp::/usr/bin/scp -C %u %o')
+
+# Other common tools:
+# /usr/bin/snarf
+# /usr/bin/lftpget -c
+# /usr/bin/wget
+
+#-- The package required by makepkg to download VCS sources
+#  Format: 'protocol::package'
+VCSCLIENTS=('bzr::bzr'
+            'git::git'
+            'hg::mercurial'
+            'svn::subversion')
+
+#########################################################################
+# ARCHITECTURE, COMPILE FLAGS
+#########################################################################
+#
+CARCH="x86_64"
+CHOST="x86_64-pc-linux-gnu"
+
+#-- Compiler and Linker Flags
+#CPPFLAGS=""
+CFLAGS="-march=atom -mtune=atom -O3 -pipe -fno-plt -fexceptions \
+        -Wp,-D_FORTIFY_SOURCE=2,-D_GLIBCXX_ASSERTIONS \
+        -Wformat -Werror=format-security \
+        -fstack-clash-protection -fcf-protection"
+CXXFLAGS="$CFLAGS"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
+LTOFLAGS="-flto=auto"
+
+#RUSTFLAGS="-C opt-level=2"
+#-- Make Flags: change this for DistCC/SMP systems
+MAKEFLAGS="--jobs=$(nproc)"
+#-- Debugging flags
+DEBUG_CFLAGS="-g -fvar-tracking-assignments"
+DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
+#DEBUG_RUSTFLAGS="-C debuginfo=2"
+
+#########################################################################
+# BUILD ENVIRONMENT
+#########################################################################
+#
+# Defaults: BUILDENV=(!distcc !color !ccache check !sign)
+#  A negated environment option will do the opposite of the comments below.
+#
+#-- distcc:   Use the Distributed C/C++/ObjC compiler
+#-- color:    Colorize output messages
+#-- ccache:   Use ccache to cache compilation
+#-- check:    Run the check() function if present in the PKGBUILD
+#-- sign:     Generate PGP signature file
+#
+BUILDENV=(!distcc color ccache check !sign)
+#
+#-- If using DistCC, your MAKEFLAGS will also need modification. In addition,
+#-- specify a space-delimited list of hosts running in the DistCC cluster.
+#DISTCC_HOSTS=""
+#
+#-- Specify a directory for package building.
+#BUILDDIR=/tmp/makepkg
+
+#########################################################################
+# GLOBAL PACKAGE OPTIONS
+#   These are default values for the options=() settings
+#########################################################################
+#
+# Default: OPTIONS=(!strip docs libtool staticlibs emptydirs !zipman !purge !debug)
+#  A negated option will do the opposite of the comments below.
+#
+#-- strip:      Strip symbols from binaries/libraries
+#-- docs:       Save doc directories specified by DOC_DIRS
+#-- libtool:    Leave libtool (.la) files in packages
+#-- staticlibs: Leave static library (.a) files in packages
+#-- emptydirs:  Leave empty directories in packages
+#-- zipman:     Compress manual (man and info) pages in MAN_DIRS with gzip
+#-- purge:      Remove files specified by PURGE_TARGETS
+#-- debug:      Add debugging flags as specified in DEBUG_* variables
+#
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)
+
+#-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
+INTEGRITY_CHECK=(md5)
+#-- Options to be used when stripping binaries. See `man strip' for details.
+STRIP_BINARIES="--strip-all"
+#-- Options to be used when stripping shared libraries. See `man strip' for details.
+STRIP_SHARED="--strip-unneeded"
+#-- Options to be used when stripping static libraries. See `man strip' for details.
+STRIP_STATIC="--strip-debug"
+#-- Manual (man and info) directories to compress (if zipman is specified)
+MAN_DIRS=({usr{,/local}{,/share},opt/*}/{man,info})
+#-- Doc directories to remove (if !docs is specified)
+DOC_DIRS=(usr/{,local/}{,share/}{doc,gtk-doc} opt/*/{doc,gtk-doc})
+#-- Files to be removed from all packages (if purge is specified)
+PURGE_TARGETS=(usr/{,share}/info/dir .packlist *.pod)
+#-- Directory to store source code in for debug packages
+DBGSRCDIR="/usr/src/debug"
+
+#########################################################################
+# PACKAGE OUTPUT
+#########################################################################
+#
+# Default: put built package and cached source in build directory
+#
+#-- Destination: specify a fixed directory where all packages will be placed
+#PKGDEST=/home/packages
+#-- Source cache: specify a fixed directory where source files will be cached
+#SRCDEST=/home/sources
+#-- Source packages: specify a fixed directory where all src packages will be placed
+#SRCPKGDEST=/home/srcpackages
+#-- Log files: specify a fixed directory where all log files will be placed
+#LOGDEST=/home/makepkglogs
+#-- Packager: name/email of the person or organization building packages
+#PACKAGER="John Doe <john@doe.com>"
+#-- Specify a key to use for package signing
+#GPGKEY=""
+
+#########################################################################
+# COMPRESSION DEFAULTS
+#########################################################################
+#
+COMPRESSGZ=(gzip -c -f -n)
+COMPRESSBZ2=(bzip2 -c -f)
+COMPRESSXZ=(xz -9 -c -z -)
+COMPRESSZST=(zstd -14 -c -T0 -)
+COMPRESSLRZ=(lrzip -q)
+COMPRESSLZO=(lzop -q)
+COMPRESSZ=(compress -c -f)
+COMPRESSLZ4=(lz4 -q)
+COMPRESSLZ=(lzip -c -f)
+
+#########################################################################
+# EXTENSION DEFAULTS
+#########################################################################
+#
+PKGEXT='.pkg.tar.zst'
+SRCEXT='.src.tar.gz'
@@ -0,0 +1,153 @@
+#!/hint/bash
+#
+# /etc/makepkg.conf
+#
+
+#########################################################################
+# SOURCE ACQUISITION
+#########################################################################
+#
+#-- The download utilities that makepkg should use to acquire sources
+#  Format: 'protocol::agent'
+DLAGENTS=('file::/usr/bin/curl -gqC - -o %o %u'
+          'ftp::/usr/bin/curl -gqfC - --ftp-pasv --retry 3 --retry-delay 3 -o %o %u'
+          'http::/usr/bin/curl -gqb "" -fLC - --retry 3 --retry-delay 3 -o %o %u'
+          'https::/usr/bin/curl -gqb "" -fLC - --retry 3 --retry-delay 3 -o %o %u'
+          'rsync::/usr/bin/rsync --no-motd -z %u %o'
+          'scp::/usr/bin/scp -C %u %o')
+
+# Other common tools:
+# /usr/bin/snarf
+# /usr/bin/lftpget -c
+# /usr/bin/wget
+
+#-- The package required by makepkg to download VCS sources
+#  Format: 'protocol::package'
+VCSCLIENTS=('bzr::bzr'
+            'git::git'
+            'hg::mercurial'
+            'svn::subversion')
+
+#########################################################################
+# ARCHITECTURE, COMPILE FLAGS
+#########################################################################
+#
+CARCH="x86_64"
+CHOST="x86_64-pc-linux-gnu"
+
+#-- Compiler and Linker Flags
+#CPPFLAGS=""
+CFLAGS="-march=goldmont -mtune=goldmont -O3 -pipe -fno-plt -fexceptions \
+        -Wp,-D_FORTIFY_SOURCE=2,-D_GLIBCXX_ASSERTIONS \
+        -Wformat -Werror=format-security \
+        -fstack-clash-protection -fcf-protection"
+CXXFLAGS="$CFLAGS"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
+LTOFLAGS="-flto=auto"
+
+#RUSTFLAGS="-C opt-level=2"
+#-- Make Flags: change this for DistCC/SMP systems
+MAKEFLAGS="--jobs=$(nproc)"
+#-- Debugging flags
+DEBUG_CFLAGS="-g -fvar-tracking-assignments"
+DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
+#DEBUG_RUSTFLAGS="-C debuginfo=2"
+
+#########################################################################
+# BUILD ENVIRONMENT
+#########################################################################
+#
+# Defaults: BUILDENV=(!distcc !color !ccache check !sign)
+#  A negated environment option will do the opposite of the comments below.
+#
+#-- distcc:   Use the Distributed C/C++/ObjC compiler
+#-- color:    Colorize output messages
+#-- ccache:   Use ccache to cache compilation
+#-- check:    Run the check() function if present in the PKGBUILD
+#-- sign:     Generate PGP signature file
+#
+BUILDENV=(!distcc color ccache check !sign)
+#
+#-- If using DistCC, your MAKEFLAGS will also need modification. In addition,
+#-- specify a space-delimited list of hosts running in the DistCC cluster.
+#DISTCC_HOSTS=""
+#
+#-- Specify a directory for package building.
+#BUILDDIR=/tmp/makepkg
+
+#########################################################################
+# GLOBAL PACKAGE OPTIONS
+#   These are default values for the options=() settings
+#########################################################################
+#
+# Default: OPTIONS=(!strip docs libtool staticlibs emptydirs !zipman !purge !debug)
+#  A negated option will do the opposite of the comments below.
+#
+#-- strip:      Strip symbols from binaries/libraries
+#-- docs:       Save doc directories specified by DOC_DIRS
+#-- libtool:    Leave libtool (.la) files in packages
+#-- staticlibs: Leave static library (.a) files in packages
+#-- emptydirs:  Leave empty directories in packages
+#-- zipman:     Compress manual (man and info) pages in MAN_DIRS with gzip
+#-- purge:      Remove files specified by PURGE_TARGETS
+#-- debug:      Add debugging flags as specified in DEBUG_* variables
+#
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)
+
+#-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
+INTEGRITY_CHECK=(md5)
+#-- Options to be used when stripping binaries. See `man strip' for details.
+STRIP_BINARIES="--strip-all"
+#-- Options to be used when stripping shared libraries. See `man strip' for details.
+STRIP_SHARED="--strip-unneeded"
+#-- Options to be used when stripping static libraries. See `man strip' for details.
+STRIP_STATIC="--strip-debug"
+#-- Manual (man and info) directories to compress (if zipman is specified)
+MAN_DIRS=({usr{,/local}{,/share},opt/*}/{man,info})
+#-- Doc directories to remove (if !docs is specified)
+DOC_DIRS=(usr/{,local/}{,share/}{doc,gtk-doc} opt/*/{doc,gtk-doc})
+#-- Files to be removed from all packages (if purge is specified)
+PURGE_TARGETS=(usr/{,share}/info/dir .packlist *.pod)
+#-- Directory to store source code in for debug packages
+DBGSRCDIR="/usr/src/debug"
+
+#########################################################################
+# PACKAGE OUTPUT
+#########################################################################
+#
+# Default: put built package and cached source in build directory
+#
+#-- Destination: specify a fixed directory where all packages will be placed
+#PKGDEST=/home/packages
+#-- Source cache: specify a fixed directory where source files will be cached
+#SRCDEST=/home/sources
+#-- Source packages: specify a fixed directory where all src packages will be placed
+#SRCPKGDEST=/home/srcpackages
+#-- Log files: specify a fixed directory where all log files will be placed
+#LOGDEST=/home/makepkglogs
+#-- Packager: name/email of the person or organization building packages
+#PACKAGER="John Doe <john@doe.com>"
+#-- Specify a key to use for package signing
+#GPGKEY=""
+
+#########################################################################
+# COMPRESSION DEFAULTS
+#########################################################################
+#
+COMPRESSGZ=(gzip -c -f -n)
+COMPRESSBZ2=(bzip2 -c -f)
+COMPRESSXZ=(xz -9 -c -z -)
+COMPRESSZST=(zstd -14 -c -T0 -)
+COMPRESSLRZ=(lrzip -q)
+COMPRESSLZO=(lzop -q)
+COMPRESSZ=(compress -c -f)
+COMPRESSLZ4=(lz4 -q)
+COMPRESSLZ=(lzip -c -f)
+
+#########################################################################
+# EXTENSION DEFAULTS
+#########################################################################
+#
+PKGEXT='.pkg.tar.zst'
+SRCEXT='.src.tar.gz'
@@ -39,9 +39,12 @@ CHOST="x86_64-pc-linux-gnu"
 CPPFLAGS="-D_FORTIFY_SOURCE=2"
 CFLAGS="-march=native -mtune=native -O3 -pipe -fstack-protector-strong"
 CXXFLAGS="-march=native -mtune=native -O3 -pipe -fstack-protector-strong"
-LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
+LTOFLAGS="-flto=auto"
+
 #-- Make Flags: change this for DistCC/SMP systems
-MAKEFLAGS="-j32"
+MAKEFLAGS="--jobs=$(nproc)"
 #-- Debugging flags
 DEBUG_CFLAGS="-g -fvar-tracking-assignments"
 DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
@@ -83,11 +86,9 @@ BUILDENV=(!distcc color ccache check !sign)
 #-- emptydirs:  Leave empty directories in packages
 #-- zipman:     Compress manual (man and info) pages in MAN_DIRS with gzip
 #-- purge:      Remove files specified by PURGE_TARGETS
-#-- upx:        Compress binary executable files using UPX
-#-- optipng:    Optimize PNG images with optipng
 #-- debug:      Add debugging flags as specified in DEBUG_* variables
 #
-OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !optipng !upx !debug)
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)

 #-- File integrity checks to use. Valid: md5, sha1, sha256, sha384, sha512
 INTEGRITY_CHECK=(md5)
@@ -129,10 +130,13 @@ PURGE_TARGETS=(usr/{,share}/info/dir .packlist *.pod)
 #
 COMPRESSGZ=(gzip -c -f -n)
 COMPRESSBZ2=(bzip2 -c -f)
-COMPRESSXZ=(xz -c -z -)
+COMPRESSXZ=(xz -9 -c -z -)
+COMPRESSZST=(zstd -14 -c -T0 -)
 COMPRESSLRZ=(lrzip -q)
 COMPRESSLZO=(lzop -q)
 COMPRESSZ=(compress -c -f)
+COMPRESSLZ4=(lz4 -q)
+COMPRESSLZ=(lzip -c -f)

 #########################################################################
 # EXTENSION DEFAULTS
@@ -141,7 +145,7 @@ COMPRESSZ=(compress -c -f)
 # WARNING: Do NOT modify these variables unless you know what you are
 #          doing.
 #
-PKGEXT='.pkg.tar.lzo'
+PKGEXT='.pkg.tar.zst'
 SRCEXT='.src.tar.gz'

 # vim: set ft=sh ts=2 sw=2 et:
@@ -42,10 +42,13 @@ CFLAGS="-march=sandybridge -mtune=sandybridge -O3 -pipe -fno-plt -fexceptions \
        -Wformat -Werror=format-security \
        -fstack-clash-protection -fcf-protection"
 CXXFLAGS="$CFLAGS"
-LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
+LTOFLAGS="-flto=auto"
+
 #RUSTFLAGS="-C opt-level=2"
 #-- Make Flags: change this for DistCC/SMP systems
-MAKEFLAGS="-j32"
+MAKEFLAGS="--jobs=$(nproc)"
 #-- Debugging flags
 DEBUG_CFLAGS="-g -fvar-tracking-assignments"
 DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
@@ -90,7 +93,7 @@ BUILDENV=(!distcc color ccache check !sign)
 #-- purge:      Remove files specified by PURGE_TARGETS
 #-- debug:      Add debugging flags as specified in DEBUG_* variables
 #
-OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug)
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)

 #-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
 INTEGRITY_CHECK=(md5)
@@ -134,8 +137,8 @@ DBGSRCDIR="/usr/src/debug"
 #
 COMPRESSGZ=(gzip -c -f -n)
 COMPRESSBZ2=(bzip2 -c -f)
-COMPRESSXZ=(xz -c -z -)
-COMPRESSZST=(zstd -c -z -q -)
+COMPRESSXZ=(xz -9 -c -z -)
+COMPRESSZST=(zstd -14 -c -T0 -)
 COMPRESSLRZ=(lrzip -q)
 COMPRESSLZO=(lzop -q)
 COMPRESSZ=(compress -c -f)
@@ -146,5 +149,5 @@ COMPRESSLZ=(lzip -c -f)
 # EXTENSION DEFAULTS
 #########################################################################
 #
-PKGEXT='.pkg.tar.lzo'
+PKGEXT='.pkg.tar.zst'
 SRCEXT='.src.tar.gz'
@@ -42,10 +42,13 @@ CFLAGS="-march=silvermont -mtune=silvermont -O3 -pipe -fno-plt -fexceptions \
        -Wformat -Werror=format-security \
        -fstack-clash-protection -fcf-protection"
 CXXFLAGS="$CFLAGS"
-LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
+LTOFLAGS="-flto=auto"
+
 #RUSTFLAGS="-C opt-level=2"
 #-- Make Flags: change this for DistCC/SMP systems
-MAKEFLAGS="-j32"
+MAKEFLAGS="--jobs=$(nproc)"
 #-- Debugging flags
 DEBUG_CFLAGS="-g -fvar-tracking-assignments"
 DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
@@ -90,7 +93,7 @@ BUILDENV=(!distcc color ccache check !sign)
 #-- purge:      Remove files specified by PURGE_TARGETS
 #-- debug:      Add debugging flags as specified in DEBUG_* variables
 #
-OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug)
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)

 #-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
 INTEGRITY_CHECK=(md5)
@@ -134,8 +137,8 @@ DBGSRCDIR="/usr/src/debug"
 #
 COMPRESSGZ=(gzip -c -f -n)
 COMPRESSBZ2=(bzip2 -c -f)
-COMPRESSXZ=(xz -c -z -)
-COMPRESSZST=(zstd -c -z -q -)
+COMPRESSXZ=(xz -9 -c -z -)
+COMPRESSZST=(zstd -14 -c -T0 -)
 COMPRESSLRZ=(lrzip -q)
 COMPRESSLZO=(lzop -q)
 COMPRESSZ=(compress -c -f)
@@ -146,5 +149,5 @@ COMPRESSLZ=(lzip -c -f)
 # EXTENSION DEFAULTS
 #########################################################################
 #
-PKGEXT='.pkg.tar.lzo'
+PKGEXT='.pkg.tar.zst'
 SRCEXT='.src.tar.gz'
@@ -42,10 +42,13 @@ CFLAGS="-march=skylake -mtune=skylake -O3 -pipe -fno-plt -fexceptions \
        -Wformat -Werror=format-security \
        -fstack-clash-protection -fcf-protection"
 CXXFLAGS="$CFLAGS"
-LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
+LTOFLAGS="-flto=auto"
+
 #RUSTFLAGS="-C opt-level=2"
 #-- Make Flags: change this for DistCC/SMP systems
-MAKEFLAGS="-j32"
+MAKEFLAGS="--jobs=$(nproc)"
 #-- Debugging flags
 DEBUG_CFLAGS="-g -fvar-tracking-assignments"
 DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
@@ -90,7 +93,7 @@ BUILDENV=(!distcc color ccache check !sign)
 #-- purge:      Remove files specified by PURGE_TARGETS
 #-- debug:      Add debugging flags as specified in DEBUG_* variables
 #
-OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug)
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)

 #-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
 INTEGRITY_CHECK=(md5)
@@ -134,8 +137,8 @@ DBGSRCDIR="/usr/src/debug"
 #
 COMPRESSGZ=(gzip -c -f -n)
 COMPRESSBZ2=(bzip2 -c -f)
-COMPRESSXZ=(xz -c -z -)
-COMPRESSZST=(zstd -c -z -q -)
+COMPRESSXZ=(xz -9 -c -z -)
+COMPRESSZST=(zstd -14 -c -T0 -)
 COMPRESSLRZ=(lrzip -q)
 COMPRESSLZO=(lzop -q)
 COMPRESSZ=(compress -c -f)
@@ -146,5 +149,5 @@ COMPRESSLZ=(lzip -c -f)
 # EXTENSION DEFAULTS
 #########################################################################
 #
-PKGEXT='.pkg.tar.lzo'
+PKGEXT='.pkg.tar.zst'
 SRCEXT='.src.tar.gz'
@@ -42,10 +42,13 @@ CFLAGS="-march=tigerlake -mtune=tigerlake -O3 -pipe -fno-plt -fexceptions \
        -Wformat -Werror=format-security \
        -fstack-clash-protection -fcf-protection"
 CXXFLAGS="$CFLAGS"
-LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
+LTOFLAGS="-flto=auto"
+
 #RUSTFLAGS="-C opt-level=2"
 #-- Make Flags: change this for DistCC/SMP systems
-MAKEFLAGS="-j32"
+MAKEFLAGS="--jobs=$(nproc)"
 #-- Debugging flags
 DEBUG_CFLAGS="-g -fvar-tracking-assignments"
 DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
@@ -90,7 +93,7 @@ BUILDENV=(!distcc color ccache check !sign)
 #-- purge:      Remove files specified by PURGE_TARGETS
 #-- debug:      Add debugging flags as specified in DEBUG_* variables
 #
-OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug)
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)

 #-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
 INTEGRITY_CHECK=(md5)
@@ -134,8 +137,8 @@ DBGSRCDIR="/usr/src/debug"
 #
 COMPRESSGZ=(gzip -c -f -n)
 COMPRESSBZ2=(bzip2 -c -f)
-COMPRESSXZ=(xz -c -z -)
-COMPRESSZST=(zstd -c -z -q -)
+COMPRESSXZ=(xz -9 -c -z -)
+COMPRESSZST=(zstd -14 -c -T0 -)
 COMPRESSLRZ=(lrzip -q)
 COMPRESSLZO=(lzop -q)
 COMPRESSZ=(compress -c -f)
@@ -146,5 +149,5 @@ COMPRESSLZ=(lzip -c -f)
 # EXTENSION DEFAULTS
 #########################################################################
 #
-PKGEXT='.pkg.tar.lzo'
+PKGEXT='.pkg.tar.zst'
 SRCEXT='.src.tar.gz'
@@ -42,10 +42,14 @@ CFLAGS="-march=znver1 -mtune=znver1 -O3 -pipe -fno-plt -fexceptions \
        -Wformat -Werror=format-security \
        -fstack-clash-protection -fcf-protection"
 CXXFLAGS="$CFLAGS"
-LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
+LTOFLAGS="-flto=auto"
+
 #RUSTFLAGS="-C opt-level=2"
 #-- Make Flags: change this for DistCC/SMP systems
-MAKEFLAGS="-j32"
+MAKEFLAGS="--jobs=$(nproc)"
+
 #-- Debugging flags
 DEBUG_CFLAGS="-g -fvar-tracking-assignments"
 DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
@@ -90,7 +94,7 @@ BUILDENV=(!distcc color ccache check !sign)
 #-- purge:      Remove files specified by PURGE_TARGETS
 #-- debug:      Add debugging flags as specified in DEBUG_* variables
 #
-OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug)
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)

 #-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
 INTEGRITY_CHECK=(md5)
@@ -134,8 +138,8 @@ DBGSRCDIR="/usr/src/debug"
 #
 COMPRESSGZ=(gzip -c -f -n)
 COMPRESSBZ2=(bzip2 -c -f)
-COMPRESSXZ=(xz -c -z -)
-COMPRESSZST=(zstd -c -z -q -)
+COMPRESSXZ=(xz -9 -c -z -)
+COMPRESSZST=(zstd -14 -c -T0 -)
 COMPRESSLRZ=(lrzip -q)
 COMPRESSLZO=(lzop -q)
 COMPRESSZ=(compress -c -f)
@@ -146,5 +150,5 @@ COMPRESSLZ=(lzip -c -f)
 # EXTENSION DEFAULTS
 #########################################################################
 #
-PKGEXT='.pkg.tar.lzo'
+PKGEXT='.pkg.tar.zst'
 SRCEXT='.src.tar.gz'
@@ -42,10 +42,13 @@ CFLAGS="-march=znver2 -mtune=znver2 -O3 -pipe -fno-plt -fexceptions \
        -Wformat -Werror=format-security \
        -fstack-clash-protection -fcf-protection"
 CXXFLAGS="$CFLAGS"
-LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
+LTOFLAGS="-flto=auto"
+
 #RUSTFLAGS="-C opt-level=2"
 #-- Make Flags: change this for DistCC/SMP systems
-MAKEFLAGS="-j32"
+MAKEFLAGS="--jobs=$(nproc)"
 #-- Debugging flags
 DEBUG_CFLAGS="-g -fvar-tracking-assignments"
 DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
@@ -90,7 +93,7 @@ BUILDENV=(!distcc color ccache check !sign)
 #-- purge:      Remove files specified by PURGE_TARGETS
 #-- debug:      Add debugging flags as specified in DEBUG_* variables
 #
-OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug)
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)

 #-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
 INTEGRITY_CHECK=(md5)
@@ -134,8 +137,8 @@ DBGSRCDIR="/usr/src/debug"
 #
 COMPRESSGZ=(gzip -c -f -n)
 COMPRESSBZ2=(bzip2 -c -f)
-COMPRESSXZ=(xz -c -z -)
-COMPRESSZST=(zstd -c -z -q -)
+COMPRESSXZ=(xz -9 -c -z -)
+COMPRESSZST=(zstd -14 -c -T0 -)
 COMPRESSLRZ=(lrzip -q)
 COMPRESSLZO=(lzop -q)
 COMPRESSZ=(compress -c -f)
@@ -146,5 +149,5 @@ COMPRESSLZ=(lzip -c -f)
 # EXTENSION DEFAULTS
 #########################################################################
 #
-PKGEXT='.pkg.tar.lzo'
+PKGEXT='.pkg.tar.zst'
 SRCEXT='.src.tar.gz'
@@ -42,10 +42,14 @@ CFLAGS="-march=znver3 -mtune=znver3 -O3 -pipe -fno-plt -fexceptions \
        -Wformat -Werror=format-security \
        -fstack-clash-protection -fcf-protection"
 CXXFLAGS="$CFLAGS"
-LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
+LTOFLAGS="-flto=auto"
+
 #RUSTFLAGS="-C opt-level=2"
 #-- Make Flags: change this for DistCC/SMP systems
-MAKEFLAGS="-j32"
+MAKEFLAGS="--jobs=$(nproc)"
+
 #-- Debugging flags
 DEBUG_CFLAGS="-g -fvar-tracking-assignments"
 DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
@@ -90,7 +94,7 @@ BUILDENV=(!distcc color ccache check !sign)
 #-- purge:      Remove files specified by PURGE_TARGETS
 #-- debug:      Add debugging flags as specified in DEBUG_* variables
 #
-OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug)
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)

 #-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
 INTEGRITY_CHECK=(md5)
@@ -134,8 +138,8 @@ DBGSRCDIR="/usr/src/debug"
 #
 COMPRESSGZ=(gzip -c -f -n)
 COMPRESSBZ2=(bzip2 -c -f)
-COMPRESSXZ=(xz -c -z -)
-COMPRESSZST=(zstd -c -z -q -)
+COMPRESSXZ=(xz -9 -c -z -)
+COMPRESSZST=(zstd -14 -c -T0 -)
 COMPRESSLRZ=(lrzip -q)
 COMPRESSLZO=(lzop -q)
 COMPRESSZ=(compress -c -f)
@@ -146,5 +150,5 @@ COMPRESSLZ=(lzip -c -f)
 # EXTENSION DEFAULTS
 #########################################################################
 #
-PKGEXT='.pkg.tar.lzo'
+PKGEXT='.pkg.tar.zst'
 SRCEXT='.src.tar.gz'
@@ -0,0 +1,153 @@
+#!/hint/bash
+#
+# /etc/makepkg.conf
+#
+
+#########################################################################
+# SOURCE ACQUISITION
+#########################################################################
+#
+#-- The download utilities that makepkg should use to acquire sources
+#  Format: 'protocol::agent'
+DLAGENTS=('file::/usr/bin/curl -gqC - -o %o %u'
+          'ftp::/usr/bin/curl -gqfC - --ftp-pasv --retry 3 --retry-delay 3 -o %o %u'
+          'http::/usr/bin/curl -gqb "" -fLC - --retry 3 --retry-delay 3 -o %o %u'
+          'https::/usr/bin/curl -gqb "" -fLC - --retry 3 --retry-delay 3 -o %o %u'
+          'rsync::/usr/bin/rsync --no-motd -z %u %o'
+          'scp::/usr/bin/scp -C %u %o')
+
+# Other common tools:
+# /usr/bin/snarf
+# /usr/bin/lftpget -c
+# /usr/bin/wget
+
+#-- The package required by makepkg to download VCS sources
+#  Format: 'protocol::package'
+VCSCLIENTS=('bzr::bzr'
+            'git::git'
+            'hg::mercurial'
+            'svn::subversion')
+
+#########################################################################
+# ARCHITECTURE, COMPILE FLAGS
+#########################################################################
+#
+CARCH="x86_64"
+CHOST="x86_64-pc-linux-gnu"
+
+#-- Compiler and Linker Flags
+#CPPFLAGS=""
+CFLAGS="-march=znver5 -mtune=znver5 -O3 -pipe -fno-plt -fexceptions \
+        -Wp,-D_FORTIFY_SOURCE=2,-D_GLIBCXX_ASSERTIONS \
+        -Wformat -Werror=format-security \
+        -fstack-clash-protection -fcf-protection"
+CXXFLAGS="$CFLAGS"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
+LTOFLAGS="-flto=auto"
+
+#RUSTFLAGS="-C opt-level=2"
+#-- Make Flags: change this for DistCC/SMP systems
+MAKEFLAGS="--jobs=$(nproc)"
+#-- Debugging flags
+DEBUG_CFLAGS="-g -fvar-tracking-assignments"
+DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
+#DEBUG_RUSTFLAGS="-C debuginfo=2"
+
+#########################################################################
+# BUILD ENVIRONMENT
+#########################################################################
+#
+# Defaults: BUILDENV=(!distcc !color !ccache check !sign)
+#  A negated environment option will do the opposite of the comments below.
+#
+#-- distcc:   Use the Distributed C/C++/ObjC compiler
+#-- color:    Colorize output messages
+#-- ccache:   Use ccache to cache compilation
+#-- check:    Run the check() function if present in the PKGBUILD
+#-- sign:     Generate PGP signature file
+#
+BUILDENV=(!distcc color ccache check !sign)
+#
+#-- If using DistCC, your MAKEFLAGS will also need modification. In addition,
+#-- specify a space-delimited list of hosts running in the DistCC cluster.
+#DISTCC_HOSTS=""
+#
+#-- Specify a directory for package building.
+#BUILDDIR=/tmp/makepkg
+
+#########################################################################
+# GLOBAL PACKAGE OPTIONS
+#   These are default values for the options=() settings
+#########################################################################
+#
+# Default: OPTIONS=(!strip docs libtool staticlibs emptydirs !zipman !purge !debug)
+#  A negated option will do the opposite of the comments below.
+#
+#-- strip:      Strip symbols from binaries/libraries
+#-- docs:       Save doc directories specified by DOC_DIRS
+#-- libtool:    Leave libtool (.la) files in packages
+#-- staticlibs: Leave static library (.a) files in packages
+#-- emptydirs:  Leave empty directories in packages
+#-- zipman:     Compress manual (man and info) pages in MAN_DIRS with gzip
+#-- purge:      Remove files specified by PURGE_TARGETS
+#-- debug:      Add debugging flags as specified in DEBUG_* variables
+#
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)
+
+#-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
+INTEGRITY_CHECK=(md5)
+#-- Options to be used when stripping binaries. See `man strip' for details.
+STRIP_BINARIES="--strip-all"
+#-- Options to be used when stripping shared libraries. See `man strip' for details.
+STRIP_SHARED="--strip-unneeded"
+#-- Options to be used when stripping static libraries. See `man strip' for details.
+STRIP_STATIC="--strip-debug"
+#-- Manual (man and info) directories to compress (if zipman is specified)
+MAN_DIRS=({usr{,/local}{,/share},opt/*}/{man,info})
+#-- Doc directories to remove (if !docs is specified)
+DOC_DIRS=(usr/{,local/}{,share/}{doc,gtk-doc} opt/*/{doc,gtk-doc})
+#-- Files to be removed from all packages (if purge is specified)
+PURGE_TARGETS=(usr/{,share}/info/dir .packlist *.pod)
+#-- Directory to store source code in for debug packages
+DBGSRCDIR="/usr/src/debug"
+
+#########################################################################
+# PACKAGE OUTPUT
+#########################################################################
+#
+# Default: put built package and cached source in build directory
+#
+#-- Destination: specify a fixed directory where all packages will be placed
+#PKGDEST=/home/packages
+#-- Source cache: specify a fixed directory where source files will be cached
+#SRCDEST=/home/sources
+#-- Source packages: specify a fixed directory where all src packages will be placed
+#SRCPKGDEST=/home/srcpackages
+#-- Log files: specify a fixed directory where all log files will be placed
+#LOGDEST=/home/makepkglogs
+#-- Packager: name/email of the person or organization building packages
+#PACKAGER="John Doe <john@doe.com>"
+#-- Specify a key to use for package signing
+#GPGKEY=""
+
+#########################################################################
+# COMPRESSION DEFAULTS
+#########################################################################
+#
+COMPRESSGZ=(gzip -c -f -n)
+COMPRESSBZ2=(bzip2 -c -f)
+COMPRESSXZ=(xz -9 -c -z -)
+COMPRESSZST=(zstd -14 -c -T0 -)
+COMPRESSLRZ=(lrzip -q)
+COMPRESSLZO=(lzop -q)
+COMPRESSZ=(compress -c -f)
+COMPRESSLZ4=(lz4 -q)
+COMPRESSLZ=(lzip -c -f)
+
+#########################################################################
+# EXTENSION DEFAULTS
+#########################################################################
+#
+PKGEXT='.pkg.tar.zst'
+SRCEXT='.src.tar.gz'
@@ -0,0 +1,154 @@
+#
+# /etc/makepkg.conf
+#
+
+#########################################################################
+# SOURCE ACQUISITION
+#########################################################################
+#
+#-- The download utilities that makepkg should use to acquire sources
+#  Format: 'protocol::agent'
+DLAGENTS=('file::/usr/bin/curl -qgC - -o %o %u'
+          'ftp::/usr/bin/curl -qgfC - --ftp-pasv --retry 3 --retry-delay 3 -o %o %u'
+          'http::/usr/bin/curl -qgb "" -fLC - --retry 3 --retry-delay 3 -o %o %u'
+          'https::/usr/bin/curl -qgb "" -fLC - --retry 3 --retry-delay 3 -o %o %u'
+          'rsync::/usr/bin/rsync --no-motd -z %u %o'
+          'scp::/usr/bin/scp -C %u %o')
+
+# Other common tools:
+# /usr/bin/snarf
+# /usr/bin/lftpget -c
+# /usr/bin/wget
+
+#-- The package required by makepkg to download VCS sources
+#  Format: 'protocol::package'
+VCSCLIENTS=('bzr::breezy'
+            'fossil::fossil'
+            'git::git'
+            'hg::mercurial'
+            'svn::subversion')
+
+
+#########################################################################
+# ARCHITECTURE, COMPILE FLAGS
+#########################################################################
+#
+CARCH="x86_64"
+CHOST="x86_64-pc-linux-gnu"
+
+#-- Compiler and Linker Flags
+# -march (or -mcpu) builds exclusively for an architecture
+# -mtune optimizes for an architecture, but builds for whole processor family
+CPPFLAGS="-D_FORTIFY_SOURCE=2"
+CFLAGS="-march=x86-64 -mtune=generic -O3 -pipe -fstack-protector-strong"
+CXXFLAGS="-march=x86-64 -mtune=generic -O3 -pipe -fstack-protector-strong"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
+LTOFLAGS="-flto=auto"
+#-- Make Flags: change this for DistCC/SMP systems
+MAKEFLAGS="--jobs=$(nproc)"
+#-- Debugging flags
+DEBUG_CFLAGS="-g -fvar-tracking-assignments"
+DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
+
+#########################################################################
+# BUILD ENVIRONMENT
+#########################################################################
+#
+# Defaults: BUILDENV=(!distcc color !ccache check !sign)
+#  A negated environment option will do the opposite of the comments below.
+#
+#-- distcc:   Use the Distributed C/C++/ObjC compiler
+#-- color:    Colorize output messages
+#-- ccache:   Use ccache to cache compilation
+#-- check:    Run the check() function if present in the PKGBUILD
+#-- sign:     Generate PGP signature file
+#
+BUILDENV=(!distcc color ccache check !sign)
+#
+#-- If using DistCC, your MAKEFLAGS will also need modification. In addition,
+#-- specify a space-delimited list of hosts running in the DistCC cluster.
+#DISTCC_HOSTS=""
+#
+#-- Specify a directory for package building.
+#BUILDDIR=/tmp/makepkg
+
+#########################################################################
+# GLOBAL PACKAGE OPTIONS
+#   These are default values for the options=() settings
+#########################################################################
+#
+# Default: OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !optipng !upx !debug)
+#  A negated option will do the opposite of the comments below.
+#
+#-- strip:      Strip symbols from binaries/libraries
+#-- docs:       Save doc directories specified by DOC_DIRS
+#-- libtool:    Leave libtool (.la) files in packages
+#-- staticlibs: Leave static library (.a) files in packages
+#-- emptydirs:  Leave empty directories in packages
+#-- zipman:     Compress manual (man and info) pages in MAN_DIRS with gzip
+#-- purge:      Remove files specified by PURGE_TARGETS
+#-- debug:      Add debugging flags as specified in DEBUG_* variables
+#
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)
+
+#-- File integrity checks to use. Valid: md5, sha1, sha256, sha384, sha512
+INTEGRITY_CHECK=(md5)
+#-- Options to be used when stripping binaries. See `man strip' for details.
+STRIP_BINARIES="--strip-all"
+#-- Options to be used when stripping shared libraries. See `man strip' for details.
+STRIP_SHARED="--strip-unneeded"
+#-- Options to be used when stripping static libraries. See `man strip' for details.
+STRIP_STATIC="--strip-debug"
+#-- Manual (man and info) directories to compress (if zipman is specified)
+MAN_DIRS=({usr{,/local}{,/share},opt/*}/{man,info})
+#-- Doc directories to remove (if !docs is specified)
+DOC_DIRS=(usr/{,local/}{,share/}{doc,gtk-doc} opt/*/{doc,gtk-doc})
+#-- Files to be removed from all packages (if purge is specified)
+PURGE_TARGETS=(usr/{,share}/info/dir .packlist *.pod)
+
+#########################################################################
+# PACKAGE OUTPUT
+#########################################################################
+#
+# Default: put built package and cached source in build directory
+#
+#-- Destination: specify a fixed directory where all packages will be placed
+#PKGDEST=/home/packages
+#-- Source cache: specify a fixed directory where source files will be cached
+#SRCDEST=/home/sources
+#-- Source packages: specify a fixed directory where all src packages will be placed
+#SRCPKGDEST=/home/srcpackages
+#-- Log files: specify a fixed directory where all log files will be placed
+#LOGDEST=/home/makepkglogs
+#-- Packager: name/email of the person or organization building packages
+#PACKAGER="John Doe <john@doe.com>"
+#-- Specify a key to use for package signing
+#GPGKEY=""
+
+#########################################################################
+# COMPRESSION DEFAULTS
+#########################################################################
+#
+COMPRESSGZ=(gzip -c -f -n)
+COMPRESSBZ2=(bzip2 -c -f)
+COMPRESSXZ=(xz -9 -c -z -)
+COMPRESSZST=(zstd -14 -c -T0 -)
+COMPRESSLRZ=(lrzip -q)
+COMPRESSLZO=(lzop -q)
+COMPRESSZ=(compress -c -f)
+COMPRESSLZ4=(lz4 -q)
+COMPRESSLZ=(lzip -c -f)
+
+
+#########################################################################
+# EXTENSION DEFAULTS
+#########################################################################
+#
+# WARNING: Do NOT modify these variables unless you know what you are
+#          doing.
+#
+PKGEXT='.pkg.tar.zst'
+SRCEXT='.src.tar.gz'
+
+# vim: set ft=sh ts=2 sw=2 et:
@@ -0,0 +1,4 @@
+
+[woggioni.gitea.woggioni.net]
+SigLevel = Required
+Server = https://gitea.woggioni.net/api/packages/woggioni/arch/default/x86_64
@@ -0,0 +1,3 @@
+[cache.disk]
+dir = "/home/luser/.cache/sccache"
+size = 12884901888 # 12 GiBytes
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAmKgAwIBAgIIO2L7XtRN+bwwCgYIKoZIzj0EAwQwgYUxCzAJBgNVBAYT
+AklUMRAwDgYDVQQDEwdSb290IENBMQswCQYDVQQrEwJXTzERMA8GA1UEQRMId29n
+Z2lvbmkxITAfBgNVBA0TGFdhbHRlciBPZ2dpb25pJ3MgUm9vdCBDQTEPMA0GA1UE
+KhMGV2FsdGVyMRAwDgYDVQQEEwdPZ2dpb25pMCAXDTIzMDMwNDA3MjkwMFoYDzIw
+ODgxMDI1MDIwMDAwWjCBhTELMAkGA1UEBhMCSVQxEDAOBgNVBAMTB1Jvb3QgQ0Ex
+CzAJBgNVBCsTAldPMREwDwYDVQRBEwh3b2dnaW9uaTEhMB8GA1UEDRMYV2FsdGVy
+IE9nZ2lvbmkncyBSb290IENBMQ8wDQYDVQQqEwZXYWx0ZXIxEDAOBgNVBAQTB09n
+Z2lvbmkwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAAnz0lcWZvbLHOiguC/Ax7B
+ZI85vd2OT/YqDCYPnQtOsQPgUNrun/3tR9s0/W4XH8294mZplg373a0KOawaKzqz
+tQEK5JXLQABYs/iCJpWVDGWgEZIOBAxhW5UHlpvCDIPYk2D12wijJ0Gd8oLdnu8H
+rnNegYqs5r9uWrNcWjnWBoVj3qN1MHMwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
+FgQUcjx/Fuwuncxwt3F3LqoXI27rOiUwCwYDVR0PBAQDAgEGMDQGCCsGAQUFBwEB
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL3dvZ2dpb25pLm5ldC9vY3NwMAoGCCqG
+SM49BAMEA4GLADCBhwJBerGRivjCvA9e/UVs0qjpgKLlE2+uTGONUcLWUErxEqsJ
+Mr+MQPJoqJo43JvAFC/vB2xAXr+ZwR0Tc0fRSyxN3C8CQgH5/kFPPnISpzEXxks4
+hfDiOG/Kc8FhhNU07dNIrhWJxh5HcD+deItcEmSRSeMQtVjrbSv1/HydJ8jLSh49
+7gL5cA==
+-----END CERTIFICATE-----
@@ -0,0 +1,4 @@
+FROM gitea.woggioni.net/woggioni/nginx:v1.29.4
+RUN mkdir /srv/http
+RUN --mount=type=bind,source=bee-dashboard.tar,target=/bee-dashboard.tar tar -xf /bee-dashboard.tar -C /srv/http
+COPY bee-dashboard.conf /etc/nginx/conf.d/http/bee-dashboard.conf
@@ -0,0 +1,2 @@
+/*
+  Content-Security-Policy: default-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' http://localhost:1633 https://xdai.fairdatasociety.org https://rpc.gnosis.gateway.fm https://rpc.gnosischain.com https://rpc.ankr.com;
@@ -0,0 +1,7 @@
+server {
+    listen 80;
+    root   /srv/http;    
+    location / {
+    }
+}
+
@@ -0,0 +1,10 @@
+FROM alpine:3.22
+RUN --mount=type=cache,target=/var/cache/apk apk add cgit uwsgi uwsgi-cgi py3-pygments py3-markdown py3-docutils lzip gzip bzip2 xz zstd
+ADD cgit.ini /etc/uwsgi/cgit.ini
+RUN mkdir -p /var/run/cgit
+RUN addgroup -S cgit
+RUN adduser -D -S -h /var/lib/cgit -G cgit cgit
+RUN chown cgit:cgit /var/run/cgit
+WORKDIR /var/lib/cgit
+USER cgit
+ENTRYPOINT ["/usr/sbin/uwsgi", "--ini", "/etc/uwsgi/cgit.ini"]
@@ -0,0 +1,12 @@
+[uwsgi]
+master = true
+plugins = cgi
+socket = /var/run/cgit/cgit.sock
+chmod-socket = 666
+http-modifier1 = 9
+uid = cgit
+gid = cgit
+procname-master = uwsgi cgit
+processes = 1
+threads = 2
+cgi = /usr/share/webapps/cgit/cgit.cgi
@@ -0,0 +1,12 @@
+FROM alpine:3.22
+
+RUN --mount=type=cache,target=/var/cache/apk apk add python3 pipx
+RUN addgroup -S dyndns
+RUN adduser -D -S -h /var/lib/dyndns -G dyndns dyndns
+
+ADD --chown=dyndns:dyndns pip.conf /var/lib/dyndns/.pip/pip.conf
+
+USER dyndns
+WORKDIR /var/lib/dyndns
+RUN pipx install wdyndns
+ENV PATH="/var/lib/dyndns/.local/bin:$PATH"
@@ -0,0 +1,3 @@
+[global]
+index-url = https://gitea.woggioni.net/api/packages/woggioni/pypi/simple
+extra-index-url = https://pypi.org/simple
@@ -1,4 +1,4 @@
-FROM jenkins/agent:alpine-jdk21
+FROM jenkins/agent:3355.v388858a_47b_33-4-alpine3.23-jdk25
 USER root
 RUN --mount=type=cache,target=/var/cache/apk apk add docker
 USER jenkins
@@ -1,25 +1,45 @@
-FROM alpine:3.19 AS build
+FROM alpine:3.23 AS build-base
 RUN --mount=type=cache,target=/var/cache/apk/,sharing=locked \
    apk update &&\
-    apk add python3 python3-dev openjdk21-jre pipx gcc g++ musl-dev linux-headers which curl libffi-dev
-RUN curl -O https://repo1.maven.org/maven2/dev/hcf/ganymede/ganymede/2.1.2.20230910/ganymede-2.1.2.20230910.jar
+    apk add python3 python3-dev pipx gcc g++ musl-dev linux-headers which curl libffi-dev git
 RUN adduser jovyan -u 1000 --system -s /bin/sh -h /home/jovyan
+
+FROM --platform=$BUILDPLATFORM alpine:3.22 AS java-build
+RUN --mount=type=cache,target=/var/cache/apk/,sharing=locked \
+    apk update &&\
+    apk add python3 python3-dev pipx gcc g++ musl-dev linux-headers which curl libffi-dev git
+RUN adduser jovyan -u 1000 --system -s /bin/sh -h /home/jovyan
+
+RUN --mount=type=cache,target=/var/cache/apk/,sharing=locked \
+    apk add openjdk11-jdk maven
+USER jovyan
+WORKDIR /home/jovyan
+#RUN curl -O https://repo1.maven.org/maven2/dev/hcf/ganymede/ganymede/2.1.2.20230910/ganymede-2.1.2.20230910.jar
+ADD --chown=jovyan:jovyan git@github.com:allen-ball/ganymede.git#trunk ganymede
+#RUN git clone https://github.com/allen-ball/ganymede.git ganymede
+WORKDIR /home/jovyan/ganymede
+RUN --mount=type=cache,target=/home/jovyan/.m2/,uid=1000,gid=1000,sharing=locked mvn -Dmaven.test.skip=true -q package
+    
+FROM build-base AS python-build
+RUN --mount=type=cache,target=/var/cache/apk/,sharing=locked \
+    apk add openjdk25-jre
 USER jovyan
 WORKDIR /home/jovyan
 RUN python -m venv venv
-RUN venv/bin/pip install jupyter-core
-RUN venv/bin/pip install notebook==5.7.16
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install jupyter-core
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install "notebook<7" jupyterlab
 ENV PATH="/home/jovyan/venv/bin/:$PATH"
-RUN java -jar /ganymede-2.1.2.20230910.jar -i --copy-jar=true
-RUN venv/bin/pip install jupyterhub
+RUN --mount=type=bind,from=java-build,src=/home/jovyan/ganymede/ganymede/target/ganymede-2.1.3-SNAPSHOT.jar,target=/home/jovyan/ganymede.jar\
+    java -jar /home/jovyan/ganymede.jar -i --copy-jar=true
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install jupyterhub

-FROM alpine:3.19
+FROM alpine:3.23
 RUN --mount=type=cache,target=/var/cache/apk/,sharing=locked \
    apk update &&\
-    apk add python3 openjdk21-jre
+    apk add python3 openjdk25-jre
 RUN adduser jovyan -u 1000 --system -s /bin/sh -h /home/jovyan
 USER jovyan
-COPY --from=build /home/jovyan /home/jovyan
+COPY --from=python-build /home/jovyan /home/jovyan
 COPY jupyter_server_config.py docker_healthcheck.py /etc/jupyter/
 COPY start-notebook.py start-singleuser.py /usr/local/bin/
 RUN mkdir /home/jovyan/work
@@ -2,25 +2,25 @@ FROM debian:stable AS build
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt update &&\
-    apt install python3 python3-dev pipx gcc g++ linux-headers-amd64 libffi-dev cargo cmake autoconf swig ninja-build patchelf meson
-RUN adduser jovyan -u 1000 --system -s /bin/sh -h /home/jovyan
+    apt install -y python3 python3-dev pipx gcc g++ libffi-dev cargo cmake autoconf swig ninja-build patchelf meson python3-faiss adduser
+RUN adduser -u 1000 --system --shell /bin/sh --home /home/jovyan jovyan
 USER jovyan
 WORKDIR /home/jovyan
-RUN python -m venv venv
-RUN venv/bin/pip install solders
-RUN venv/bin/pip install solana
-RUN venv/bin/pip install numpy
-RUN venv/bin/pip install matplotlib
-RUN venv/bin/pip install jupyter-core
-RUN venv/bin/pip install jupyterhub
-RUN venv/bin/pip install jupyterlab
-RUN venv/bin/pip install notebook
-RUN venv/bin/pip install ipywidgets
-RUN venv/bin/pip install jupyterlab-lsp
-RUN venv/bin/pip install python-lsp-server[yapf,rope,pyflakes] 
-RUN venv/bin/pip install --no-binary :all: faiss-cpu
-RUN venv/bin/pip install jupyter-ai
-RUN venv/bin/pip install langchain-openai 
+RUN python3 -m venv venv
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install solders
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install solana
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install numpy
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install matplotlib
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install jupyter-core
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install jupyterhub
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install jupyterlab
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install notebook
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install ipywidgets
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install jupyterlab-lsp
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install python-lsp-server[yapf,rope,pyflakes] 
+# RUN venv/bin/pip install --no-binary :all: faiss-cpu
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install jupyter-ai
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install langchain-openai langchain_ollama

 #RUN venv/bin/pip install pylsp-mypy
 ENV PATH="/home/jovyan/venv/bin/:$PATH"
@@ -29,8 +29,8 @@ FROM debian:stable
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt update &&\
-    apt install python3
-RUN adduser jovyan -u 1000 --system -s /bin/sh -h /home/jovyan
+    apt install -y python3 adduser
+RUN adduser -u 1000 --system --shell /bin/sh --home /home/jovyan jovyan
 USER jovyan
 COPY --from=build /home/jovyan /home/jovyan
 COPY jupyter_server_config.py docker_healthcheck.py /etc/jupyter/
@@ -1,36 +1,44 @@
-FROM debian:latest
-RUN apt-get update && apt-get upgrade
-RUN apt-get install -y bc binutils bzip2 ca-certificates cliquer cmake curl \
-        ecl eclib-tools fflas-ffpack g++ gap gcc gengetopt gfan gfortran \
-        glpk-utils gmp-ecm lcalc libatomic-ops-dev libboost-dev \
-        libbraiding-dev libbrial-dev libbrial-groebner-dev libbz2-dev \
-        libcdd-dev libcdd-tools libcliquer-dev libcurl4-openssl-dev libec-dev \
-        libecm-dev libffi-dev libflint-dev libfplll-dev libfreetype-dev \
-        libgap-dev libgc-dev libgd-dev libgf2x-dev libgiac-dev libgivaro-dev \
-        libglpk-dev libgmp-dev libgsl-dev libhomfly-dev libiml-dev \
-        liblfunction-dev liblinbox-dev liblrcalc-dev liblzma-dev libm4ri-dev \
-        libm4rie-dev libmpc-dev libmpfi-dev libmpfr-dev libncurses5-dev \
-        libntl-dev libopenblas-dev libpari-dev libplanarity-dev libppl-dev \
-        libprimesieve-dev libpython3-dev libqhull-dev libreadline-dev \
-        librw-dev libsingular4-dev libsqlite3-dev libssl-dev \
-        libsuitesparse-dev libsymmetrica2-dev libz-dev libzmq3-dev m4 make \
-        maxima maxima-sage meson nauty ninja-build openssl palp pari-doc \
-        pari-elldata pari-galdata pari-galpol pari-gp2c pari-seadata patch \
-        patchelf perl pkg-config planarity ppl-dev python3 python3-setuptools \
-        python3-venv singular singular-doc sqlite3 sympow tachyon tar texinfo \
-        tox xcas xz-utils git
-RUN apt-get install -y default-jdk dvipng ffmpeg fonts-freefont-otf \
-        imagemagick latexmk libavdevice-dev libjpeg-dev pandoc tex-gyre \
-        texlive-fonts-recommended texlive-lang-cyrillic texlive-lang-english \
-        texlive-lang-european texlive-lang-french texlive-lang-german \
-        texlive-lang-italian texlive-lang-japanese texlive-lang-polish \
-        texlive-lang-portuguese texlive-lang-spanish texlive-latex-extra \
-        texlive-luatex texlive-xetex xindy
-RUN useradd jovyan -u 1000 -s /bin/bash -m -h /home/jovyan
+FROM debian:stable AS build
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    apt update &&\
+    apt install -y python3 python3-dev pipx gcc g++ libffi-dev cargo cmake autoconf swig ninja-build patchelf meson python3-faiss adduser
+RUN adduser -u 1000 --system --shell /bin/sh --home /home/jovyan jovyan
 USER jovyan
 WORKDIR /home/jovyan
-COPY build.sh build.sh
-RUN git clone -c core.symlinks=true --filter blob:none  \
-    --origin upstream --branch master --tags \
-    https://github.com/sagemath/sage.git
-RUN export srcdir=/home/jovyan/sage source build.sh && prepare && build
+RUN python3 -m venv venv
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install sagemath
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install jupyter-core
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install jupyterhub
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install jupyterlab
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install notebook
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install ipywidgets
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install jupyterlab-lsp
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install python-lsp-server[yapf,rope,pyflakes] 
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install jupyter-ai
+RUN --mount=type=cache,target=/home/jovyan/.cache/pip,uid=1000,gid=1000 venv/bin/pip install langchain-openai langchain_ollama
+
+ENV PATH="/home/jovyan/venv/bin/:$PATH"
+
+FROM debian:stable
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    apt update &&\
+    apt install -y python3 adduser
+RUN adduser -u 1000 --system --shell /bin/sh --home /home/jovyan jovyan
+USER jovyan
+COPY --from=build /home/jovyan /home/jovyan
+COPY jupyter_server_config.py docker_healthcheck.py /etc/jupyter/
+COPY start-notebook.py start-singleuser.py /usr/local/bin/
+RUN mkdir /home/jovyan/work
+WORKDIR /home/jovyan/work
+ENV JUPYTER_PORT=8888
+EXPOSE $JUPYTER_PORT
+ENV PATH="/home/jovyan/venv/bin/:$PATH"
+CMD ["start-notebook.py"]
+
+# HEALTHCHECK documentation: https://docs.docker.com/engine/reference/builder/#healthcheck
+# This healtcheck works well for `lab`, `notebook`, `nbclassic`, `server`, and `retro` jupyter commands
+# https://github.com/jupyter/docker-stacks/issues/915#issuecomment-1068528799
+HEALTHCHECK --interval=3s --timeout=1s --start-period=3s --retries=3 \
+    CMD /etc/jupyter/docker_healthcheck.py || exit 1
@@ -1,15 +1,18 @@
 #!/usr/bin/env sh
+set -e

-pkgs=(standard
-       bliss
-       coxeter3
-       mcqd
-       meataxe
-       sirocco
-       tdlib)
+# pkgs=(
+#   standard
+#   bliss
+#   coxeter3
+#   mcqd
+#   meataxe
+#   sirocco
+#   tdlib
+# )

-prepare(){
-  cd sage
+prepare() {
+  cd "${srcdir}"
 # use correct latte-count binary name
 #  patch -p1 -i ../latte-count.patch
 # update to tdlib 0.9 (Fedora)
@@ -23,29 +26,17 @@ prepare(){
 }

 build() {
-  export SAGE_NUM_THREADS=$(($(nproc)/2))
-  export PYTHONPATH="$PWD"/sage/pkgs/sage-setup
-
-  for _pkg in ${_pkgs[@]}; do
-    cd "$srcdir"/sage/pkgs/sagemath-$_pkg
-    python setup.py build
-  done
+  #export SAGE_NUM_THREADS=$(($(nproc)/2))
+  #export PYTHONPATH="$PWD"/sage/pkgs/sage-setup
+  python3 -m build --wheel --no-isolation -C setup-args=-Dbuild-docs=false
 }

 package() {
-  for _pkg in ${_pkgs[@]}; do
-    cd "$srcdir"/sage/pkgs/sagemath-$_pkg
-    python setup.py install --root="$pkgdir" --optimize=1
-  done
-
-# fix symlinks to assets
-#  _pythonpath=`python -c "from sysconfig import get_path; print(get_path('platlib'))"`
-#  for _i in $(ls "$srcdir"/sage/src/sage/ext_data/notebook-ipython); do
-#    rm "$pkgdir"/usr/share/jupyter/kernels/sagemath/$_i
-#    ln -s $_pythonpath/sage/ext_data/notebook-ipython/$_i "$pkgdir"/usr/share/jupyter/kernels/sagemath/
-#  done
-
-# adjust threejs version
-#  rm "$pkgdir"$_pythonpath/sage/ext_data/threejs/threejs-version.txt
-#  ln -s /usr/share/threejs-sage/version "$pkgdir"$_pythonpath/sage/ext_data/threejs/threejs-version.txt
+    python -m installer dist/*.whl
 }
+
+# prepare
+
+build
+
+package
@@ -0,0 +1,44 @@
+#!/usr/bin/env python
+# Copyright (c) Jupyter Development Team.
+# Distributed under the terms of the Modified BSD License.
+import os
+import shlex
+import sys
+
+# If we are in a JupyterHub, we pass on to `start-singleuser.py` instead so it does the right thing
+if "JUPYTERHUB_API_TOKEN" in os.environ:
+    print(
+        "WARNING: using start-singleuser.py instead of start-notebook.py to start a server associated with JupyterHub."
+    )
+    command = ["/usr/local/bin/start-singleuser.py"] + sys.argv[1:]
+    os.execvp(command[0], command)
+
+
+# Entrypoint is start.sh
+command = []
+
+# If we want to survive restarts, launch the command using `run-one-constantly`
+if os.environ.get("RESTARTABLE") == "yes":
+    command.append("run-one-constantly")
+
+# We always launch a jupyter subcommand from this script
+command.append("jupyter")
+
+# Launch the configured subcommand.
+# Note that this should be a single string, so we don't split it.
+# We default to `lab`.
+jupyter_command = os.environ.get("DOCKER_STACKS_JUPYTER_CMD", "lab")
+command.append(jupyter_command)
+
+# Append any optional NOTEBOOK_ARGS we were passed in.
+# This is supposed to be multiple args passed on to the notebook command,
+# so we split it correctly with shlex
+if "NOTEBOOK_ARGS" in os.environ:
+    command += shlex.split(os.environ["NOTEBOOK_ARGS"])
+
+# Pass through any other args we were passed on the command line
+command += sys.argv[1:]
+
+# Execute the command!
+print("Executing: " + " ".join(command))
+os.execvp(command[0], command)
@@ -0,0 +1,31 @@
+FROM alpine:latest AS base
+
+ARG VERSION
+
+RUN --mount=type=cache,target=/var/cache/apk apk update
+RUN --mount=type=cache,target=/var/cache/apk apk add python3 nodejs libcurl
+
+RUN adduser -D -u 1000 jupyterhub
+RUN mkdir -p /var/lib/jupyterhub 
+RUN chown jupyterhub:jupyterhub /var/lib/jupyterhub
+
+FROM base AS build
+USER root
+RUN --mount=type=cache,target=/var/cache/apk apk add npm curl-dev gcc musl-dev python3-dev
+RUN --mount=type=cache,target=/home/jupyterhub/.cache/pip npm install -g configurable-http-proxy
+USER jupyterhub
+WORKDIR /var/lib/jupyterhub
+RUN python3 -m venv .
+RUN --mount=type=cache,target=/home/jupyterhub/.cache/pip ./bin/pip install "jupyterhub==${VERSION}" jupyterhub_idle_culler dockerspawner psycopg2-binary oauthenticator pycurl
+
+
+FROM base AS release
+USER root
+COPY --from=build /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -s ../lib/node_modules/configurable-http-proxy/bin/configurable-http-proxy /usr/local/bin/configurable-http-proxy
+COPY --from=build /var/lib/jupyterhub /var/lib/jupyterhub
+USER jupyterhub
+WORKDIR /home/jupyterhub
+ENV PATH="/var/lib/jupyterhub/bin/:$PATH"
+EXPOSE 43080
+ENTRYPOINT ["jupyterhub"]
@@ -0,0 +1,70 @@
+# Contributor: André Klitzing <aklitzing@gmail.com>
+# Maintainer: André Klitzing <aklitzing@gmail.com>
+pkgname=monero
+pkgver=0.18.4.5
+pkgrel=0
+_ver_randomx=10494476d6236b177733224123747201dec180bb
+_ver_supercop=633500ad8c8759995049ccd022107d1fa8a1bbc9
+pkgdesc="Secure, private, untraceable cryptocurrency"
+url="https://getmonero.org/"
+arch="all !riscv64" # build failure
+license="BSD-3-Clause"
+makedepends="
+	boost-dev
+	cmake
+	cppzmq
+	hidapi-dev
+	libsodium-dev
+	miniupnpc-dev
+	openssl-dev>3
+	rapidjson-dev
+	readline-dev
+	samurai
+	unbound-dev
+	zeromq-dev
+	"
+options="!check"
+source="$pkgname-$pkgver.tar.gz::https://github.com/monero-project/monero/archive/refs/tags/v$pkgver.tar.gz
+	$pkgname-randomx-$_ver_randomx.tar.gz::https://github.com/tevador/RandomX/archive/$_ver_randomx.tar.gz
+	$pkgname-supercop-$_ver_supercop.tar.gz::https://github.com/monero-project/supercop/archive/$_ver_supercop.tar.gz
+	easylogging.patch
+	gcc13.patch
+	system-miniupnpc.patch
+	version-string.patch
+	loongarch64.patch
+	miniupnpc.patch
+	"
+
+prepare() {
+	default_prepare
+
+	rm -fr external/randomx external/supercop
+	ln -s $srcdir/RandomX-$_ver_randomx external/randomx
+	ln -s $srcdir/supercop-$_ver_supercop external/supercop
+}
+
+build() {
+	cmake -B build -G Ninja \
+		-DCMAKE_BUILD_TYPE=None \
+		-DCMAKE_INSTALL_PREFIX=/usr \
+		-DSTACK_TRACE=OFF \
+		-DMANUAL_SUBMODULES=1 \
+		-DARCH=default
+	cmake --build build
+}
+
+package() {
+	DESTDIR="$pkgdir" cmake --install build
+}
+
+sha512sums="
+9899c53e79fad57fd66a77b2053fd2d9856b1834a041800826337110b9f8188300b67c78d5c93dbd01510f7bf6b9c682f19f154ceb9ecad6adf818474b517cfa  monero-0.18.4.5.tar.gz
+41ab097ec43b79844f4e9f2143ead381bcda228e6eae6fe082f078846ca2e3e50e2800f645355f879dc14ef7980c98a4019da9f9aaa2175b59c80e099d5be3fc  monero-randomx-10494476d6236b177733224123747201dec180bb.tar.gz
+06cca8d1def31aa11bf5aa42d861c4a027786f7cc494fa3ab53a2bc4bd9d1f55b2389020ba5fd1816ed277b6e4320ad8edbb3117dcf4981fc7fba655c4bbe648  monero-supercop-633500ad8c8759995049ccd022107d1fa8a1bbc9.tar.gz
+c149f1e6a6968115f95213d512116457b36665ff1159c5137dda45fa27712ce6f088b908663fb429b8e5f74e41d6cd57669db79d596564ddaca481dbdc63393e  easylogging.patch
+9d1ae2b057d49abb1fcd04744069bc3898f8822db2ecf259bc6f0f8b20c4871ba9947356c548e43d2fc20aa4aa03aaf02e0052d53056028d334638c0a360842a  gcc13.patch
+15aacc364c0877bce1113c65c40daf33287bc9f26d94e0d8841940eb9fa7a9abf3c25f6ab37a9f91cdb093668e2a345a59b0a6a0e3f06dbad1078530f216dc72  system-miniupnpc.patch
+411d041754bf801a4dcff6eb52d0d7fa29ad07ce673f956764b2d4b8c8252233b5f09f8833f8461be0f9b0c922748db71fecad04ae755c61ebe50113e2648485  version-string.patch
+f71bace84a4569cf6c7e094303bb98ba7472d8e8f35b5ece4d5d1e60b3c6a75fb212cbf88a3bc5a5b0ef28a645c7b1c32520f940fa935e42421885cfb0268f74  loongarch64.patch
+c7e143b31906e1b08f8c04374a8ec5285d83bb8f5a958e2bbd1c2d4fc78645e3a43f456eb321810998ff4c147a85d9617188eb68b3287e7279b2495805645939  miniupnpc.patch
+"
@@ -0,0 +1,46 @@
+FROM alpine:3.23 AS base
+
+FROM base AS builder
+RUN --mount=type=cache,target=/var/cache/apk apk update
+RUN --mount=type=cache,target=/var/cache/apk apk add \
+	abuild \
+  build-base \
+	boost-dev \
+	cmake \
+  cppzmq \
+  hidapi-dev \
+  libsodium-dev \
+  miniupnpc-dev \
+  openssl-dev \
+  rapidjson-dev \
+  readline-dev \
+  samurai \
+  unbound-dev \
+  zeromq-dev
+
+RUN adduser -D -G abuild luser
+USER luser
+WORKDIR /home/luser
+
+ADD --chown=luser:luser ./APKBUILD .
+ADD --chown=luser:luser ./easylogging.patch .
+ADD --chown=luser:luser ./gcc13.patch .
+ADD --chown=luser:luser ./system-miniupnpc.patch .
+ADD --chown=luser:luser ./version-string.patch .
+ADD --chown=luser:luser ./loongarch64.patch .
+ADD --chown=luser:luser ./miniupnpc.patch .
+RUN abuild-keygen -a -n
+USER root
+RUN cp /home/luser/.abuild/*.pub /etc/apk/keys/
+USER luser
+RUN abuild
+
+
+FROM base AS release
+RUN adduser -D -h /var/lib/monero monero
+RUN --mount=type=bind,from=builder,source=/home/luser/.abuild,target=/.abuild cp /.abuild/*.pub /etc/apk/keys
+RUN --mount=type=bind,from=builder,source=/home/luser/packages,target=/packages apk add /packages/*/*/*.apk
+USER monero
+WORKDIR /var/lib/monero
+ENTRYPOINT /usr/bin/monerod
+
@@ -0,0 +1,11 @@
+--- a/external/easylogging++/easylogging++.h
+++ b/external/easylogging++/easylogging++.h
+@@ -221,7 +221,7 @@
+ #  define ELPP_INTERNAL_INFO(lvl, msg)
+ #endif  // (defined(ELPP_DEBUG_INFO))
+ #if (defined(ELPP_FEATURE_ALL)) || (defined(ELPP_FEATURE_CRASH_LOG))
+-#  if (ELPP_COMPILER_GCC && !ELPP_MINGW && !ELPP_OS_OPENBSD && !ELPP_OS_NETBSD && !ELPP_OS_ANDROID && !ELPP_OS_EMSCRIPTEN)
+#  if (__has_include(<execinfo.h>) && ELPP_COMPILER_GCC && !ELPP_MINGW && !ELPP_OS_OPENBSD && !ELPP_OS_NETBSD && !ELPP_OS_ANDROID && !ELPP_OS_EMSCRIPTEN)
+ #    define ELPP_STACKTRACE 1
+ #  else
+ #    define ELPP_STACKTRACE 0
@@ -0,0 +1,24 @@
+diff --git a/contrib/epee/src/file_io_utils.cpp b/contrib/epee/src/file_io_utils.cpp
+index c0798a5..4549ead 100644
+--- a/contrib/epee/src/file_io_utils.cpp
+++ b/contrib/epee/src/file_io_utils.cpp
+@@ -26,6 +26,7 @@
+ 
+ #include "file_io_utils.h"
+ 
+#include <cstdint>
+ #include <fstream>
+ #include <boost/filesystem/path.hpp>
+ #include <boost/filesystem/operations.hpp>
+diff --git a/src/common/combinator.cpp b/src/common/combinator.cpp
+index 72b1397..c98e3da 100644
+--- a/src/common/combinator.cpp
+++ b/src/common/combinator.cpp
+@@ -29,6 +29,7 @@
+ //
+ // Parts of this file are originally copyright (c) 2012-2013 The Cryptonote developers
+ 
+#include <cstdint>
+ #include "combinator.h"
+ 
+ namespace tools {
@@ -0,0 +1,34 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 8fb03ba..3fbd9cf 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -335,6 +335,11 @@ set(RISCV   1)
+ set(RISCV32 1)
+ endif()
+ 
+if(ARCH_ID STREQUAL "loongarch64")
+set(LOONGARCH 1)
+set(LOONGARCH64 1)
+endif()
+
+ if(WIN32 OR ARM OR PPC64LE OR PPC64 OR PPC)
+   set(OPT_FLAGS_RELEASE "-O2")
+ else()
+@@ -748,7 +753,7 @@ else()
+     message(STATUS "AES support explicitly disabled")
+     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DNO_AES")
+     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -DNO_AES")
+-  elseif(NOT ARM AND NOT PPC64LE AND NOT PPC64 AND NOT PPC AND NOT S390X AND NOT RISCV)
+  elseif(NOT ARM AND NOT PPC64LE AND NOT PPC64 AND NOT PPC AND NOT S390X AND NOT RISCV AND NOT LOONGARCH64)
+     message(STATUS "AES support enabled")
+     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -maes")
+     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -maes")
+@@ -762,6 +767,8 @@ else()
+     message(STATUS "AES support not available on ARMv6")
+   elseif(ARM7)
+     message(STATUS "AES support not available on ARMv7")
+  elseif(LOONGARCH64)
+    message(STATUS "AES support not available on LoongArch64")
+   elseif(ARM8)
+     CHECK_CXX_ACCEPTS_FLAG("-march=${ARCH}+crypto" ARCH_PLUS_CRYPTO)
+     if(ARCH_PLUS_CRYPTO)
@@ -0,0 +1,22 @@
+API changed in miniupnpc 2.2.8
+
+--- a/src/p2p/net_node.inl
+++ b/src/p2p/net_node.inl
+@@ -2989,7 +2989,7 @@
+     UPNPUrls urls;
+     IGDdatas igdData;
+     char lanAddress[64];
+-    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress);
+    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress, nullptr, 0);
+     freeUPNPDevlist(deviceList);
+     if (result > 0) {
+       if (result == 1) {
+@@ -3057,7 +3057,7 @@
+     UPNPUrls urls;
+     IGDdatas igdData;
+     char lanAddress[64];
+-    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress);
+    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress, nullptr, 0);
+     freeUPNPDevlist(deviceList);
+     if (result > 0) {
+       if (result == 1) {
@@ -0,0 +1,100 @@
+--- monero-0.18.4.1/CMakeLists.txt
+++ monero-0.18.4.1.final/CMakeLists.txt
+@@ -676,6 +676,14 @@
+ include_directories("${CMAKE_CURRENT_BINARY_DIR}/translations")
+ add_subdirectory(external)
+ 
+# Final setup for miniupnpc
+if(UPNP_STATIC OR IOS)
+  add_definitions("-DUPNP_STATIC")
+else()
+  add_definitions("-DUPNP_DYNAMIC")
+  include_directories(${UPNP_INCLUDE})
+endif()
+
+ # Final setup for libunbound
+ include_directories(${UNBOUND_INCLUDE_DIR})
+ 
+--- monero-0.18.4.1/external/CMakeLists.txt
+++ monero-0.18.4.1.final/external/CMakeLists.txt
+@@ -34,25 +34,45 @@
+ # We always compile if we are building statically to reduce static dependency issues...
+ # ...except for FreeBSD, because FreeBSD is a special case that doesn't play well with
+ # others.
+if(NOT IOS)
+    find_package(Miniupnpc QUIET)
+endif()
+ 
+-find_package(Miniupnpc REQUIRED)
+-
+-message(STATUS "Using in-tree miniupnpc")
+-set(UPNPC_NO_INSTALL TRUE CACHE BOOL "Disable miniupnp installation" FORCE)
+-set(UPNPC_BUILD_SHARED OFF CACHE BOOL "Disable building shared library" FORCE)
+-add_subdirectory(miniupnp/miniupnpc)
+-set_property(TARGET libminiupnpc-static PROPERTY FOLDER "external")
+-set_property(TARGET libminiupnpc-static PROPERTY POSITION_INDEPENDENT_CODE ON)
+-if(MSVC)
+-  set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -wd4244 -wd4267")
+-elseif(NOT MSVC)
+-  set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -Wno-undef -Wno-unused-result -Wno-unused-value")
+# If we have the correct shared version and we're not building static, use it
+if(STATIC OR IOS)
+ set(USE_SHARED_MINIUPNPC false)
+elseif(MINIUPNP_FOUND AND MINIUPNPC_VERSION_1_7_OR_HIGHER)
+ set(USE_SHARED_MINIUPNPC true)
+ endif()
+ if(CMAKE_SYSTEM_NAME MATCHES "NetBSD")
+ 	set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -D_NETBSD_SOURCE")
+ endif()
+ 
+-set(UPNP_LIBRARIES "libminiupnpc-static" PARENT_SCOPE)
+if(USE_SHARED_MINIUPNPC)
+  message(STATUS "Using shared miniupnpc found at ${MINIUPNP_INCLUDE_DIR}")
+
+  set(UPNP_STATIC false PARENT_SCOPE)
+  set(UPNP_INCLUDE ${MINIUPNP_INCLUDE_DIR} PARENT_SCOPE)
+  set(UPNP_LIBRARIES ${MINIUPNP_LIBRARY} PARENT_SCOPE)
+else()
+  if(STATIC)
+    message(STATUS "Using miniupnpc from local source tree for static build")
+  else()
+    message(STATUS "Using miniupnpc from local source tree (/external/miniupnp/miniupnpc)")
+  endif()
+  add_subdirectory(miniupnp/miniupnpc)
+
+  set_property(TARGET libminiupnpc-static PROPERTY FOLDER "external")
+  if(MSVC)
+    set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -wd4244 -wd4267")
+  elseif(NOT MSVC)
+    set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -Wno-undef -Wno-unused-result -Wno-unused-value")
+  endif()
+
+  set(UPNP_STATIC true PARENT_SCOPE)
+  set(UPNP_LIBRARIES "libminiupnpc-static" PARENT_SCOPE)
+endif()
+
+ 
+ find_package(Unbound)
+ 
+--- monero-0.18.4.1/src/p2p/net_node.inl
+++ monero-0.18.4.1.final/src/p2p/net_node.inl
+@@ -60,9 +60,16 @@
+ #include "cryptonote_core/cryptonote_core.h"
+ #include "net/parse.h"
+ 
+-#include <miniupnp/miniupnpc/miniupnpc.h>
+-#include <miniupnp/miniupnpc/upnpcommands.h>
+-#include <miniupnp/miniupnpc/upnperrors.h>
+// We have to look for miniupnpc headers in different places, dependent on if its compiled or external
+#ifdef UPNP_STATIC
+  #include <miniupnp/miniupnpc/miniupnpc.h>
+  #include <miniupnp/miniupnpc/upnpcommands.h>
+  #include <miniupnp/miniupnpc/upnperrors.h>
+#else
+  #include "miniupnpc.h"
+  #include "upnpcommands.h"
+  #include "upnperrors.h"
+#endif
+ 
+ #undef MONERO_DEFAULT_LOG_CATEGORY
+ #define MONERO_DEFAULT_LOG_CATEGORY "net.p2p"
@@ -0,0 +1,13 @@
+diff --git a/cmake/Version.cmake b/cmake/Version.cmake
+index 3677e80..490de2c 100644
+--- a/cmake/Version.cmake
+++ b/cmake/Version.cmake
+@@ -32,7 +32,7 @@ function (write_static_version_header hash)
+ endfunction ()
+ 
+ find_package(Git QUIET)
+-if ("$Format:$" STREQUAL "")
+if ("$Format:$" STREQUAL "" OR NOT EXISTS .git)
+   # We're in a tarball; use hard-coded variables.
+   set(VERSION_IS_RELEASE "true")
+   write_version("release")
@@ -0,0 +1,116 @@
+ARG NGINX_BRANCH=vanilla
+FROM alpine:3.23 AS base
+
+FROM base AS build_stage_1
+ARG NGINX_VERSION LIBRESSL_VERSION
+RUN --mount=type=cache,target=/var/cache/apk apk update
+RUN --mount=type=cache,target=/var/cache/apk apk add \
+	autoconf \
+	automake \
+	bind-tools \
+	binutils \
+	build-base \
+	ca-certificates \
+	cmake \
+	gcc \
+	gd-dev \
+	geoip-dev \
+	git \
+	gnupg \
+	go \
+	libc-dev \
+	libgcc \
+	libstdc++ \
+	libtool \
+	libxslt-dev \
+	linux-headers \
+	make \
+	ninja \
+	pcre \
+	pcre-dev \
+	perl-dev \
+	quickjs-dev \
+	su-exec \
+	tar \
+	tzdata \
+	zlib \
+	zlib-dev \
+	mercurial
+RUN adduser -D luser
+USER luser
+WORKDIR /home/luser
+
+#RUN git clone --depth 1 --branch v4.2.0 https://github.com/libressl/portable.git libressl
+#ADD --chown=luser:luser git@github.com:libressl/portable.git#v${LIBRESSL_VERSION} libressl
+ADD --chown=luser:luser https://cdn.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${LIBRESSL_VERSION}.tar.gz libressl.tgz
+RUN tar -xzf libressl.tgz && mv libressl-${LIBRESSL_VERSION} libressl && rm libressl.tgz
+RUN mkdir -p libressl/build
+RUN cmake -G Ninja -B libressl/build -S libressl \ 
+	-DCMAKE_BUILD_TYPE=Release \
+	-DLIBRESSL_APPS=OFF \
+	-DLIBRESSL_SKIP_INSTALL=ON \
+	-DENABLE_ASM=OFF \
+	-DENABLE_NC=OFF \
+	-DLIBRESSL_TESTS=OFF \
+	-DBUILD_SHARED_LIBS=OFF
+RUN cmake --build libressl/build
+
+FROM build_stage_1 AS build_stage_2_vanilla
+ARG NGINX_VERSION
+ADD --chown=luser:luser https://github.com/nginx/nginx.git#release-${NGINX_VERSION} /nginx
+
+FROM build_stage_1 AS build_stage_2_woggioni
+ARG NGINX_VERSION
+ADD --chown=luser:luser git@github.com:woggioni/nginx.git#release-${NGINX_VERSION} /nginx
+
+FROM build_stage_2_${NGINX_BRANCH} AS build
+ADD --chown=luser:luser https://github.com/openresty/headers-more-nginx-module.git /ngx_headers_more
+ADD --chown=luser:luser https://github.com/google/ngx_brotli.git /ngx_brotli
+
+USER root
+WORKDIR /
+RUN hg clone http://hg.nginx.org/njs /njs
+RUN chown luser:luser -R /njs
+USER luser
+WORKDIR /home/luser
+ADD --chown=luser:luser --chmod=755 ./build.sh ./build.sh
+RUN ./build.sh
+
+FROM build_stage_2_${NGINX_BRANCH} AS build-rtmp
+ADD --chown=luser:luser https://github.com/arut/nginx-rtmp-module.git /ngx-rtmp-module
+USER luser
+WORKDIR /home/luser
+ADD --chown=luser:luser --chmod=755 ./build-rtmp.sh ./build-rtmp.sh
+RUN ./build-rtmp.sh
+
+FROM base AS release
+ARG VERSION
+ENV NGINX_VERSION=${VERSION}
+
+RUN addgroup -S nginx
+RUN adduser -D -S -h /var/cache/nginx -s /sbin/nologin -G nginx nginx
+
+RUN --mount=type=cache,target=/var/cache/apk apk add --virtual .install_deps make perl-dev gettext binutils
+RUN --mount=type=cache,target=/var/cache/apk \
+    --mount=type=bind,from=build,source=/nginx,target=/nginx \
+    --mount=type=bind,from=build,source=/ngx_headers_more,target=/ngx_headers_more \
+    --mount=type=bind,from=build,source=/ngx_brotli,target=/ngx_brotli \
+    --mount=type=bind,from=build,source=/njs,target=/njs \
+    --mount=type=bind,source=install.sh,target=/install.sh \
+	 (cd nginx && sh /install.sh)
+RUN --mount=type=cache,target=/var/cache/apk apk del .install_deps
+COPY --from=build-rtmp --chown=root:root /nginx/objs/ngx_rtmp_module.so /usr/lib/nginx/modules/
+COPY --from=build /home/luser/libressl/openssl.cnf /etc/ssl/openssl.cnf
+COPY conf/nginx.conf /etc/nginx/nginx.conf
+COPY conf/dhparam /etc/nginx/dhparam
+
+LABEL description="NGINX Docker built top of LibreSSL" \
+      maintainer="Walter Oggioni <oggioni.walter@gmail.com>" \
+      openssl="LibreSSL" \
+      nginx="nginx ${NGINX_VERSION}"
+
+EXPOSE 80 443 443/udp
+
+STOPSIGNAL SIGTERM
+
+CMD ["nginx", "-g", "daemon off;"]
@@ -0,0 +1,30 @@
+#!/usr/bin/env sh
+
+set -e
+
+CONFIG='
+		--prefix=/etc/nginx
+		--sbin-path=/usr/sbin/nginx
+		--modules-path=/usr/lib/nginx/modules
+		--conf-path=/etc/nginx/nginx.conf
+		--error-log-path=/var/log/nginx/error.log
+		--http-log-path=/var/log/nginx/access.log
+		--pid-path=/var/run/nginx.pid
+		--lock-path=/var/run/nginx.lock
+		--http-client-body-temp-path=/var/cache/nginx/client_temp
+		--http-proxy-temp-path=/var/cache/nginx/proxy_temp
+		--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp
+		--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp
+		--http-scgi-temp-path=/var/cache/nginx/scgi_temp
+		--user=nginx
+		--group=nginx
+		--with-http_ssl_module
+		--add-dynamic-module=/ngx-rtmp-module
+'
+
+cd /nginx
+
+auto/configure $CONFIG \
+    --with-cc-opt="-I/home/luser/libressl/build/include" \
+    --with-ld-opt="-lstdc++ -L/home/luser/libressl/build/ssl -L/home/luser/libressl/build/crypto"
+make -j$(nproc)
@@ -0,0 +1,62 @@
+#!/usr/bin/env sh
+
+set -e
+
+CONFIG='
+		--prefix=/etc/nginx
+		--sbin-path=/usr/sbin/nginx
+		--modules-path=/usr/lib/nginx/modules
+		--conf-path=/etc/nginx/nginx.conf
+		--error-log-path=/var/log/nginx/error.log
+		--http-log-path=/var/log/nginx/access.log
+		--pid-path=/var/run/nginx.pid
+		--lock-path=/var/run/nginx.lock
+		--http-client-body-temp-path=/var/cache/nginx/client_temp
+		--http-proxy-temp-path=/var/cache/nginx/proxy_temp
+		--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp
+		--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp
+		--http-scgi-temp-path=/var/cache/nginx/scgi_temp
+		--user=nginx
+		--group=nginx
+		--with-pcre
+		--with-http_ssl_module
+		--with-http_realip_module
+		--with-http_addition_module
+		--with-http_sub_module
+		--with-http_dav_module
+		--with-http_flv_module
+		--with-http_mp4_module
+		--with-http_degradation_module
+		--with-http_slice_module
+		--with-http_gunzip_module
+		--with-http_gzip_static_module
+		--with-http_random_index_module
+		--with-http_secure_link_module
+		--with-http_stub_status_module
+		--with-http_auth_request_module
+		--with-http_xslt_module=dynamic
+		--with-http_geoip_module=dynamic
+		--with-threads
+		--with-stream
+		--with-stream_ssl_module
+		--with-stream_ssl_preread_module
+		--with-stream_realip_module
+		--with-stream_geoip_module=dynamic
+		--with-http_slice_module
+		--with-mail=dynamic
+		--with-mail_ssl_module
+		--with-compat
+		--with-file-aio
+		--with-http_v2_module
+		--with-http_v3_module
+		--add-dynamic-module=/ngx_headers_more
+		--add-module=/ngx_brotli
+		--add-dynamic-module=/njs/nginx
+'
+
+cd /nginx
+
+auto/configure $CONFIG \
+    --with-cc-opt="-I/home/luser/libressl/build/include" \
+    --with-ld-opt="-lstdc++ -L/home/luser/libressl/build/ssl -L/home/luser/libressl/build/crypto"
+make -j$(nproc)
@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
+87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
+YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
+7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
+ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
+-----END DH PARAMETERS-----
@@ -0,0 +1,123 @@
+include /etc/nginx/conf.d/modules/*.conf;
+
+user  nginx;
+worker_processes  1;
+
+error_log  /var/log/nginx/error.log warn;
+pid        /var/run/nginx.pid;
+
+pcre_jit  on;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+    aio             threads;
+
+    tcp_nopush      on;
+    tcp_nodelay     on;
+    server_tokens   off;
+
+    keepalive_disable  msie6;
+
+    # intermediate configuration
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ecdh_curve X25519:prime256v1:secp384r1;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+
+    # see also ssl_session_ticket_key alternative to stateful session cache
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
+    ssl_session_tickets off;
+
+    http2 on;
+    http3 on;
+    http3_hq on;
+    quic_gso on;
+    quic_retry on;
+    ssl_early_data off;
+    
+    gzip_static on;
+    gzip on;
+    gzip_comp_level 5;
+    gzip_min_length 512;
+    gzip_proxied any;
+    gzip_vary on;
+    gzip_disable "msie6";
+    
+    gzip_types 
+        application/atom+xml 
+        application/javascript 
+        application/json 
+        application/ld+json 
+        application/manifest+json 
+        application/rss+xml 
+        application/vnd.geo+json 
+        application/vnd.ms-fontobject 
+        application/x-font-ttf 
+        application/x-web-app-manifest+json 
+        application/xhtml+xml 
+        application/xml 
+        font/opentype 
+        image/bmp 
+        image/svg+xml
+        image/x-icon 
+        text/cache-manifest 
+        text/css 
+        text/plain 
+        text/vcard 
+        text/vnd.rim.location.xloc 
+        text/vtt text/x-component 
+        text/x-cross-domain-policy 
+        application/wasm;
+
+
+
+    brotli_static on;
+    brotli on;
+    brotli_comp_level 6;
+    brotli_types 
+        application/atom+xml 
+        application/javascript 
+        application/json 
+        application/rss+xml
+        application/vnd.ms-fontobject
+        application/x-font-opentype 
+        application/x-font-truetype
+        application/x-font-ttf 
+        application/x-javascript 
+        application/xhtml+xml 
+        application/xml
+        font/eot 
+        font/opentype 
+        font/otf 
+        font/truetype 
+        image/svg+xml 
+        image/vnd.microsoft.icon
+        image/x-icon 
+        image/x-win-bitmap 
+        text/css 
+        text/javascript 
+        text/plain 
+        text/xml 
+        application/wasm;
+
+
+    include /etc/nginx/conf.d/http/*.conf;
+}
+
+stream {
+    include /etc/nginx/conf.d/stream/*.conf;
+}
@@ -0,0 +1,17 @@
+# Drop requests for unknown hosts
+#
+# If no default server is defined, nginx will use the first found server.
+# To prevent host header attacks, or other potential problems when an unknown
+# servername is used in a request, it's recommended to drop the request
+# returning 444 "no response".
+
+server {
+  listen 80 default_server;
+  return 444;
+}
+
+server {
+  listen 443 ssl default_server;
+  http2 on;
+  ssl_reject_handshake on;
+}
@@ -0,0 +1,27 @@
+#!/usr/bin/env sh
+set -e
+make install
+rm -rf /etc/nginx/html/
+mkdir -p /etc/nginx/conf.d/
+mkdir -p /usr/share/nginx/html/
+install -m644 docs/html/index.html /usr/share/nginx/html/
+install -m644 docs/html/50x.html /usr/share/nginx/html/
+ln -s ../../usr/lib/nginx/modules /etc/nginx/modules
+strip -s /usr/sbin/nginx*
+strip -s /usr/lib/nginx/modules/*.so
+
+# Bring in gettext so we can get `envsubst`, then throw
+# the rest away. To do this, we need to install `gettext`
+# then move `envsubst` out of the way so `gettext` can
+# be deleted completely, then move `envsubst` back.
+
+apk add --no-cache --virtual .gettext gettext
+mv /usr/bin/envsubst /tmp/
+runDeps="libintl libxml2 musl zlib tzdata ca-certificates pcre brotli-libs libxslt geoip"
+apk add --no-cache $runDeps
+apk del .gettext
+mv /tmp/envsubst /usr/local/bin/
+# forward request and error logs to docker log collect
+mkdir -p /var/log/nginx
+ln -sf /dev/stdout /var/log/nginx/access.log
+ln -sf /dev/stderr /var/log/nginx/error.log
@@ -0,0 +1,40 @@
+FROM archlinux:latest AS release
+ARG OPENCODE_VERSION
+
+COPY mirrorlist /etc/pacman.d/mirrolist
+
+RUN pacman-key --init
+#RUN pacman-key --refresh-keys
+
+ADD https://gitea.woggioni.net/api/packages/woggioni/arch/repository.key ./repository.key
+
+RUN pacman-key --add repository.key
+RUN pacman-key --lsign-key 0D28BF66FDB45D18D8EBEE5D4C91DADCD00B3F77
+
+RUN --mount=type=bind,source=pacman-gitea-repository.conf,target=pacman-gitea-repository.conf cat pacman-gitea-repository.conf  >> /etc/pacman.conf
+RUN echo PATH	DEFAULT=${HOME}/.local/bin:/usr/local/bin:/bin >> /etc/security/pam_env.conf
+RUN rm repository.key
+RUN --mount=type=cache,target=/var/cache/pacman pacman -Syu --noconfirm
+RUN --mount=type=cache,target=/var/cache/pacman pacman -S --noconfirm --needed \
+    rustup rust-analyzer jdtls python-pipx ripgrep git rustup gradle curl sccache openssh \
+    helix bash-language-server marksman python-lsp-server vscode-css-languageserver \
+    vscode-html-languageserver vscode-json-languageserver yaml-language-server base-devel 
+RUN --mount=type=cache,target=/var/cache/pacman pacman -S --noconfirm --needed jdk25-graalvm-ce-bin
+RUN useradd -m -d /var/lib/opencode opencode
+RUN mkdir /workspace
+RUN chown opencode:opencode /workspace
+USER opencode
+RUN pipx install pyright
+USER root
+ADD https://github.com/anomalyco/opencode/releases/download/v${OPENCODE_VERSION}/opencode-linux-x64.tar.gz ./opencode.tgz
+RUN tar -xvf ./opencode.tgz -C /usr/bin
+RUN rm opencode.tgz
+ADD --chown=opencode:opencode ./opencode.json /etc/opencode/opencode.json
+RUN mkdir -p /usr/lib/opencode/addons
+ADD --chmod=644 https://repo1.maven.org/maven2/org/projectlombok/lombok/1.18.44/lombok-1.18.44.jar /usr/lib/opencode/addons/lombok.jar
+ENV OPENCODE_CONFIG=/etc/opencode/opencode.json
+ENV EDITOR=helix
+USER opencode
+WORKDIR /workspace
+ENTRYPOINT ["opencode"]
+VOLUME ["/var/lib/opencode", "/workspace"]
@@ -0,0 +1,15 @@
+################################################################################
+################# Arch Linux mirrorlist generated by Reflector #################
+################################################################################
+
+# With:       reflector @/etc/xdg/reflector/reflector.conf
+# When:       2024-07-09 04:16:31 UTC
+# From:       https://archlinux.org/mirrors/status/json/
+# Retrieved:  2024-07-09 04:16:31 UTC
+# Last Check: 2024-07-09 03:46:09 UTC
+
+Server = https://archlinux.thaller.ws/$repo/os/$arch
+Server = https://mirror.ubrco.de/archlinux/$repo/os/$arch
+Server = https://mirror.qctronics.com/archlinux/$repo/os/$arch
+Server = https://mirrors.neusoft.edu.cn/archlinux/$repo/os/$arch
+Server = https://arch.phinau.de/$repo/os/$arch
@@ -0,0 +1,33 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "lsp": {
+    "java": {
+      "command": [
+        "jdtls"
+      ],
+      "extensions": [
+        ".java"
+      ],
+      "env": {
+        "JAVA_TOOL_OPTIONS": "-javaagent:/usr/lib/opencode/addons/lombok.jar"
+      }
+    },
+    "python": {
+      "command": [
+        "pyright"
+      ],
+      "extensions": [
+        ".py",
+        "pyi"
+      ]
+    },
+    "rust": {
+      "command": [
+        "rust-analyzer"
+      ],
+      "extensions": [
+        ".rs"
+      ]
+    }
+  }
+}
@@ -0,0 +1,4 @@
+
+[woggioni.gitea.woggioni.net]
+SigLevel = Required
+Server = https://gitea.woggioni.net/api/packages/woggioni/arch/default/x86_64
@@ -0,0 +1,15 @@
+ARG PG_VERSION=18.3 ALPINE_VERSION=3.23
+FROM postgres:${PG_VERSION}-alpine${ALPINE_VERSION} AS build
+
+ARG PGVECTOR_VERSION
+WORKDIR /
+RUN apk update
+RUN apk add gcc make musl-dev clang19 llvm19 git
+RUN git clone --branch v${PGVECTOR_VERSION} https://github.com/pgvector/pgvector.git pgvector
+WORKDIR pgvector
+RUN make
+RUN make install
+
+FROM postgres:${PG_VERSION}-alpine${ALPINE_VERSION} AS release
+RUN rm -rf /usr/local
+COPY --from=build /usr/local /usr/local
@@ -0,0 +1,9 @@
+FROM gitea.woggioni.net/woggioni/pgvector:0.8.0-pg16 AS release-16
+RUN --mount=type=cache,target=/var/cache/apk apk update
+RUN --mount=type=cache,target=/var/cache/apk apk add patchelf
+RUN find /usr/local/bin -type f ! -name "*.sh" -exec patchelf --set-rpath /usr/local-16/lib {} \;
+
+FROM gitea.woggioni.net/woggioni/pgvector:0.8.0-pg17 AS release-17
+
+COPY --from=release-16 /usr/local/ /usr/local-16/
+
@@ -0,0 +1,3 @@
+FROM scratch
+ADD benchmark.wasm /benchmark.wasm
+CMD ["/benchmark.wasm"]
@@ -1,65 +1,57 @@
-FROM --platform=$BUILDPLATFORM rust:alpine AS builder
+FROM --platform=$BUILDPLATFORM gitea.woggioni.net/woggioni/arch-builder:rust-full AS base

 ARG VERSION TARGETPLATFORM BUILDPLATFORM
-
-RUN set -x \
-    && apk add --no-cache build-base cmake llvm15-dev clang15-libclang clang15 rust-bindgen git rustup curl
-
-WORKDIR /root/shadowsocks-rust
-
+WORKDIR /home/luser/shadowsocks-rust
+#ADD --chown=luser:luser git@github.com:shadowsocks/shadowsocks-rust.git#v${VERSION} .
 RUN git clone --depth 1 --branch "v${VERSION}" https://github.com/shadowsocks/shadowsocks-rust.git .

-RUN case "$TARGETPLATFORM" in \
-    "linux/386") \
-        RUST_TARGET="i686-unknown-linux-musl" \
-        MUSL="i686-linux-musl" \
-    ;; \
-    "linux/amd64") \
-        RUST_TARGET="x86_64-unknown-linux-musl" \
-        MUSL="x86_64-linux-musl" \
-    ;; \
-    "linux/arm64") \
-        RUST_TARGET="aarch64-unknown-linux-musl" \
-        MUSL="aarch64-linux-musl" \
-    ;; \
-    "linux/arm/v7") \
-        RUST_TARGET="arm-unknown-linux-musleabihf" \
-        MUSL="arm-linux-musleabihf" \
-    ;; \
-    *) \
-        echo "Doesn't support $TARGETPLATFORM architecture" \
-        exit 1 \
-    ;; \
-    esac \
-    && wget -qO- "https://musl.cc/$MUSL-cross.tgz" | tar -xzC /root/ \
-    && PATH="/root/$MUSL-cross/bin:$PATH" \
-    && CC=/root/$MUSL-cross/bin/$MUSL-gcc \
-    && echo "CC=$CC" \
-    && rustup override set stable \
-    && rustup target add "$RUST_TARGET" \
-    && RUSTFLAGS="-C linker=$CC" CC=$CC cargo build --target "$RUST_TARGET" --release --features "full-extra" \
+FROM base AS builder-linux_386
+ENV RUST_TARGET="i686-unknown-linux-musl"
+
+FROM base AS builder-linux_amd64
+ENV RUST_TARGET="x86_64-unknown-linux-musl"
+ENV CC_x86_64-unknown-linux-musl=/opt/x-tools/x86_64-unknown-linux-musl/bin/x86_64-unknown-linux-musl-gcc
+ENV CXX_x86_64-unknown-linux-musl=/opt/x-tools/x86_64-unknown-linux-musl/bin/x86_64-unknown-linux-musl-g++
+
+FROM base AS builder-linux_arm64
+ENV RUST_TARGET="aarch64-unknown-linux-musl"
+ENV CC_aarch64_unknown_linux_musl=/opt/x-tools/aarch64-unknown-linux-musl/bin/aarch64-unknown-linux-musl-gcc
+ENV CXX_aarch64_unknown_linux_musl=/opt/x-tools/aarch64-unknown-linux-musl/bin/aarch64-unknown-linux-musl-g++
+
+FROM base AS builder-linux_arm_v7
+ENV RUST_TARGET="arm-unknown-linux-musleabihf"
+ENV CC_armv7_unknown_linux_musleabihf=/opt/x-tools/arm-unknown-linux-musleabi/bin/arm-unknown-linux-musleabi-gcc
+ENV CXX_armv7_unknown_linux_musleabihf=/opt/x-tools/arm-unknown-linux-musleabi/bin/arm-unknown-linux-musleabi-g++
+
+FROM builder-${TARGETPLATFORM//\//_} AS builder
+RUN rustup target add $RUST_TARGET
+RUN cargo +stable build --locked --target "$RUST_TARGET" --release --features "full,aead-cipher-extra,aead-cipher-2022-extra,security-replay-attack-detect" \
    && mv target/$RUST_TARGET/release/ss* target/release/

 COPY download_v2ray.sh download_v2ray.sh
 RUN ./download_v2ray.sh "$TARGETPLATFORM"
+COPY download_xray.sh download_xray.sh
+RUN ./download_xray.sh "$TARGETPLATFORM"

 FROM busybox:musl AS sslocal

 # NOTE: Please be careful to change the path of these binaries, refer to #1149 for more information.
-COPY --from=builder /root/shadowsocks-rust/target/release/sslocal /usr/bin/
-COPY --from=builder /root/shadowsocks-rust/examples/config.json /etc/shadowsocks-rust/
-COPY --from=builder /root/shadowsocks-rust/docker/docker-entrypoint.sh /usr/bin/
-COPY --from=builder /tmp/v2ray-plugin /usr/bin/v2ray-plugin
+COPY --from=builder --chown=root:root /home/luser/shadowsocks-rust/target/release/sslocal /usr/bin/
+COPY --from=builder --chown=root:root /home/luser/shadowsocks-rust/examples/config.json /etc/shadowsocks-rust/
+COPY --from=builder --chown=root:root /home/luser/shadowsocks-rust/docker/docker-entrypoint.sh /usr/bin/
+COPY --from=builder --chown=root:root --chmod=755 /tmp/v2ray-plugin /usr/bin/v2ray-plugin
+COPY --from=builder --chown=root:root --chmod=755 /tmp/xray-plugin /usr/bin/xray-plugin

 ENTRYPOINT [ "docker-entrypoint.sh" ]
 CMD [ "sslocal", "--log-without-time", "-c", "/etc/shadowsocks-rust/config.json" ]

 FROM busybox:musl AS ssserver

-COPY --from=builder /root/shadowsocks-rust/target/release/ssserver /usr/bin/
-COPY --from=builder /root/shadowsocks-rust/examples/config.json /etc/shadowsocks-rust/
-COPY --from=builder /root/shadowsocks-rust/docker/docker-entrypoint.sh /usr/bin/
-COPY --from=builder /tmp/v2ray-plugin /usr/bin/v2ray-plugin
+COPY --from=builder --chown=root:root /home/luser/shadowsocks-rust/target/release/ssserver /usr/bin/
+COPY --from=builder --chown=root:root /home/luser/shadowsocks-rust/examples/config.json /etc/shadowsocks-rust/
+COPY --from=builder --chown=root:root /home/luser/shadowsocks-rust/docker/docker-entrypoint.sh /usr/bin/
+COPY --from=builder --chown=root:root --chmod=755 /tmp/v2ray-plugin /usr/bin/v2ray-plugin
+COPY --from=builder --chown=root:root --chmod=755 /tmp/xray-plugin /usr/bin/xray-plugin

 ENTRYPOINT [ "docker-entrypoint.sh" ]

@@ -4,7 +4,7 @@ mkdir /tmp/v2ray_plugin.d
 cd /tmp/v2ray_plugin.d
 case "$TARGETPLATFORM" in
    "linux/386")
-        url="curl -OJ https://gitea.woggioni.net/api/packages/woggioni/generic/v2ray_plugin-linux-386/v1.3.2-6-g5ffaa81/v2ray-plugin-linux-386-v1.3.2-6-g5ffaa81.tar.gz"
+        url="https://gitea.woggioni.net/api/packages/woggioni/generic/v2ray_plugin-linux-386/v1.3.2-6-g5ffaa81/v2ray-plugin-linux-386-v1.3.2-6-g5ffaa81.tar.gz"
        curl --retry 3 "$url" | tar -xvz
        mv v2ray-plugin* /tmp/v2ray-plugin
    ;;
@@ -0,0 +1,25 @@
+#!/usr/bin/env sh
+set -e
+TARGETPLATFORM=$1
+PLUGIN_VERSION=1.260327.0
+mkdir /tmp/xray_plugin.d
+cd /tmp/xray_plugin.d
+case "$TARGETPLATFORM" in
+    "linux/386")
+        url="https://gitea.woggioni.net/api/packages/woggioni/generic/shadowsocks-xray-plugin/${PLUGIN_VERSION}/shadowsocks-xray-plugin-linux-i386"
+    ;;
+    "linux/amd64")
+        url="https://gitea.woggioni.net/api/packages/woggioni/generic/shadowsocks-xray-plugin/${PLUGIN_VERSION}/shadowsocks-xray-plugin-linux-x86_64"
+    ;;
+    "linux/arm64")
+        url="https://gitea.woggioni.net/api/packages/woggioni/generic/shadowsocks-xray-plugin/${PLUGIN_VERSION}/shadowsocks-xray-plugin-linux-aarch64"
+    ;;
+    "linux/arm/v7")
+        url="https://gitea.woggioni.net/api/packages/woggioni/generic/shadowsocks-xray-plugin/${PLUGIN_VERSION}/shadowsocks-xray-plugin-linux-armv7h"
+    ;;
+    *)
+        echo "Doesn't support $TARGETPLATFORM architecture"
+        exit 1
+    ;;
+esac
+curl --fail -L --retry 3 "$url" -o /tmp/xray-plugin
@@ -0,0 +1,14 @@
+FROM alpine:3.22
+
+RUN --mount=type=cache,target=/var/cache/apk apk update
+RUN --mount=type=cache,target=/var/cache/apk apk add nodejs npm nushell curl
+RUN npm install --global @ethersphere/swarm-cli
+RUN addgroup -S ethswarm
+RUN adduser -D -S -h /var/lib/ethswarm -s /usr/bin/nu -G ethswarm ethswarm
+ADD --chown=ethswarm:ethswarm config.nu /var/lib/ethswarm/.config/nushell/config.nu
+
+USER ethswarm
+WORKDIR /var/lib/ethswarm
+ENTRYPOINT ["/usr/bin/nu"]
+
+
@@ -0,0 +1,40 @@
+# config.nu
+#
+# Installed by:
+# version = "0.104.1"
+#
+# This file is used to override default Nushell settings, define
+# (or import) custom commands, or run any other startup tasks.
+# See https://www.nushell.sh/book/configuration.html
+#
+# This file is loaded after env.nu and before login.nu
+#
+# You can open this file in your default editor using:
+# config nu
+#
+# See `help config nu` for more options
+#
+# You can remove these comments if you want or leave
+# them for future reference.
+
+use std/util "path add"
+
+path add ($env.HOME | path join "bin")
+path add ($env.HOME | path join ".local/bin")
+path add ($env.HOME | path join ".cargo/bin")
+
+$env.config.show_banner = false
+$env.config.history.max_size = 10000
+
+$env.PROMPT_COMMAND = { ||
+    let username = id -u -n
+    let hostname = sys host | get hostname
+    let current_dir = (pwd)
+    
+    $"($username)@($hostname) ($current_dir)"
+}
+
+def --env mkcd [p: string] {
+    mkdir $p
+    cd $p
+}
@@ -0,0 +1,41 @@
+FROM busybox:latest AS build
+ARG VERSION
+RUN wget https://github.com/wildfly/wildfly/releases/download/${VERSION}.Final/wildfly-${VERSION}.Final.tar.gz
+RUN echo "   -> Removing unneeded .bat and .ps1 files..." &&\
+    rm -f "wildfly-${VERSION}.Final/bin/"*.{bat,ps1} &&\
+    echo "   -> Unpacking the package files..." &&\
+    install -d -m 755 "/opt/" &&\
+    tar -xf wildfly-${VERSION}.Final.tar.gz &&\
+    cp -R "wildfly-${VERSION}.Final" "/opt/wildfly" &&\
+    rm /opt/wildfly/bin/standalone.conf &&\
+    cd "wildfly-${VERSION}.Final/docs/contrib/scripts/systemd" &&\
+    echo "   -> Creating wildfly.conf (environment settings)..." &&\
+    install -D -t "/opt/wildfly/etc/wildfly" -m 644 wildfly.conf &&\
+    echo "   -> Copying launch.sh to the bin directory..." &&\
+    install -D -t "/opt/wildfly/bin" -m 755 launch.sh &&\
+    chmod -R u=rwX,g=rwX,o=rX "/opt/wildfly"
+
+FROM archlinux:latest AS release
+RUN pacman-key --init
+RUN pacman-key --refresh-keys
+RUN curl --retry 3 -OJ https://gitea.woggioni.net/api/packages/woggioni/arch/repository.key
+RUN pacman-key --add repository.key
+RUN pacman-key --lsign-key 0D28BF66FDB45D18D8EBEE5D4C91DADCD00B3F77
+
+RUN --mount=type=bind,source=pacman-gitea-repository.conf,target=pacman-gitea-repository.conf cat pacman-gitea-repository.conf  >> /etc/pacman.conf
+RUN --mount=type=cache,target=/var/cache/pacman pacman -Syu --noconfirm
+RUN --mount=type=cache,target=/var/cache/pacman pacman -S --noconfirm jre21-openjdk
+RUN useradd wildfly -u 1000 --system -s /bin/sh -d /opt/wildfly
+COPY --from=build /opt/wildfly /opt/wildfly
+RUN install -d -m 755 -o wildfly /opt/wildfly/standalone/log
+RUN install -d -m 755 -o wildfly /opt/wildfly/standalone/data
+RUN install -d -m 755 -o wildfly /opt/wildfly/standalone/tmp
+RUN install -d -m 755 -o wildfly /opt/wildfly/standalone/deployments
+RUN chown -R wildfly /opt/wildfly/standalone/configuration
+VOLUME ["/opt/wildfly/standalone/tmp", "/opt/wildfly/standalone/data", "/opt/wildfly/standalone/log"]
+USER wildfly
+WORKDIR /opt/wildfly
+ENV LAUNCH_JBOSS_IN_BACKGROUND=true
+EXPOSE 8080/tcp
+EXPOSE 9990/tcp
+ENTRYPOINT ["/opt/wildfly/bin/standalone.sh", "-c", "standalone.xml", "-b", "0.0.0.0"]
@@ -0,0 +1,4 @@
+
+[woggioni.gitea.woggioni.net]
+SigLevel = Required
+Server = https://gitea.woggioni.net/api/packages/woggioni/arch/default/x86_64
@@ -0,0 +1,15 @@
+diff --git a/src/donate.h b/src/donate.h
+index 206b1b8f..14cdf9ea 100644
+--- a/src/donate.h
+++ b/src/donate.h
+@@ -37,8 +37,8 @@
+  * If you plan on changing donations to 0%, please consider making a one-off donation to my wallet:
+  * XMR: 48edfHu7V9Z84YzzMa6fUueoELZ9ZRXq9VetWzYGzKt52XU5xvqgzYnDK9URnRoJMk1j8nLwEVsaSWJ4fhdUyZijBGUicoD
+  */
+-constexpr const int kDefaultDonateLevel = 1;
+-constexpr const int kMinimumDonateLevel = 1;
+constexpr const int kDefaultDonateLevel = 0;
+constexpr const int kMinimumDonateLevel = 0;
+ 
+ 
+ #endif // XMRIG_DONATE_H
@@ -0,0 +1,51 @@
+FROM alpine:3.23 AS base
+
+FROM base AS build
+ARG VERSION
+RUN --mount=type=cache,target=/var/cache/apk apk add gcc g++ musl-dev cmake ninja hwloc-dev libuv-dev openssl-dev git upx linux-headers
+RUN adduser -D -S -h /home/luser luser
+WORKDIR /home/luser
+USER luser
+ADD --chown=luser:luser git@github.com:xmrig/xmrig.git#v${VERSION} xmrig
+ADD 001-remove-donation.patch .
+RUN mkdir build
+WORKDIR xmrig
+RUN git apply /home/luser/001-remove-donation.patch
+WORKDIR /home/luser
+RUN cmake -G Ninja -S xmrig -B build -DCMAKE_BUILD_TYPE=Release \ 
+  -DWITH_VAES=TRUE \
+  -DWITH_RANDOMX=ON \
+  -DWITH_OPENCL=OFF \
+  -DWITH_MSR=ON \
+  -DWITH_CUDA=OFF \
+  -DWITH_BENCHMARK=OFF \
+  -DWITH_HWLOC=ON \
+  -DWITH_HTTP=ON \
+  -DWITH_SSE41=ON \
+  -DWITH_AVX2=ON \
+  -DWITH_ASM=ON \
+  -DWITH_ARGON2=ON \
+  -DWITH_ADL=ON \
+  -DWITH_CN_PICO=ON \
+  -DWITH_CN_LITE=ON \
+  -DWITH_CN_HEAVY=ON \
+  -DWITH_CN_FEMTO=ON \
+  -DWITH_GHOSTRIDER=ON \
+  -DWITH_KAWPOW=ON \
+  -DWITH_ENV_VARS=ON \
+  -DWITH_RANDOMX=ON
+
+WORKDIR build
+RUN ninja
+RUN strip -s xmrig
+RUN upx -6 xmrig
+
+
+
+FROM base AS release
+RUN --mount=type=cache,target=/var/cache/apk apk add hwloc libuv openssl
+COPY --from=build /home/luser/build/xmrig /usr/local/bin/xmrig
+RUN adduser -D -S -h /var/lib/xmrig xmrig
+WORKDIR /var/lib/xmrig
+USER xmrig
+ENTRYPOINT ["/usr/local/bin/xmrig"]