Build static musl OCSP image in Gitea Actions

ocsp-responder/README.md

@@ -30,8 +30,8 @@ responder never infers status from a partial revoked-only list.
 1. Create a config based on `responder.example.yaml`.
 2. Put your CA certificates and delegated signer files where the config points.
 3. Export standard AWS credentials / endpoint variables as needed.
-4. Make the signer key readable by the container user (`ocsp`, uid/gid
-   `100:101` in the provided image), or mount it via a Docker secret.
+4. Make the signer key readable by the container user (`65532:65532` in the
+   published scratch image), or mount it via a Docker secret.
 5. Run:
 
 ```sh
@@ -40,6 +40,21 @@ OCSP_CONFIG=./responder.yaml cargo run
 
 The default listen address is `0.0.0.0:2560`.
 
+The published image is built by Gitea Actions on `release/*` tags:
+
+```sh
+docker run --rm -p 2560:2560 \
+  -v "$PWD/responder.yaml:/etc/ocsp/responder.yaml:ro" \
+  -v "$PWD/ca:/etc/ocsp/ca:ro" \
+  -v "$PWD/signers:/etc/ocsp/signers:ro" \
+  -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY \
+  gitea.woggioni.net/woggioni/kca-ocsp:latest
+```
+
+It runs `FROM scratch` and contains only a statically linked musl executable
+and a CA bundle for outbound S3 HTTPS. There is no shell or package manager in
+the image.
+
 ## Verify with OpenSSL
 
 For a CA certificate `ca.crt` and leaf certificate `leaf.crt`: