Add S3 OCSP status publishing and standalone Rust Axum responder

ocsp-responder/Dockerfile

@@ -0,0 +1,29 @@
+# syntax=docker/dockerfile:1
+# Standalone Rust/Axum OCSP responder. It has no database or KCA master-key
+# access; configuration and signer material are mounted at runtime.
+
+FROM rust:1-slim-bookworm AS builder
+WORKDIR /app
+COPY ocsp-responder/Cargo.toml ocsp-responder/Cargo.lock ./
+COPY ocsp-responder/src ./src
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/app/target \
+    cargo build --release --locked \
+ && cp /app/target/release/kca-ocsp-responder /usr/local/bin/kca-ocsp-responder
+
+FROM debian:bookworm-slim
+RUN addgroup --system ocsp \
+ && adduser --system --ingroup ocsp --no-create-home ocsp \
+ && mkdir -p /etc/ssl/certs
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
+COPY --from=builder /usr/local/bin/kca-ocsp-responder /usr/local/bin/kca-ocsp-responder
+
+ENV OCSP_CONFIG=/etc/ocsp/responder.yaml
+USER ocsp
+EXPOSE 2560
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
+  CMD ["/usr/local/bin/kca-ocsp-responder", "--healthcheck"]
+
+CMD ["/usr/local/bin/kca-ocsp-responder"]