chore: portal dist scaffolding for image builds

Author: St4NNi

.env.example

@@ -25,5 +25,10 @@ CORS_ALLOWED_ORIGINS=
 # are rejected with 413.
 MAX_HTTP_BODY_SIZE=
 
+# Directory holding the built portal dist; the node serves it on the REST
+# port with an SPA fallback. Empty/missing = portal serving disabled
+# (the REST API is unaffected).
+PORTAL_DIST_PATH=
+
 RUST_LOG=
 OTEL_EXPORTER_OTLP_ENDPOINT=

Dockerfile

@@ -20,4 +20,10 @@ COPY --from=builder /build/target/release/aruna .
 COPY --from=builder /build/target/release/aruna-doctor .
 COPY --from=builder /build/target/bin/iroh-doctor .
 
+# Portal dist baked into the image (stage 1 delivery). Populate portal-dist/
+# via scripts/fetch-portal.sh before building; an empty directory just
+# disables portal serving at runtime.
+ENV PORTAL_DIST_PATH=/var/lib/aruna/portal
+COPY portal-dist/ /var/lib/aruna/portal/
+
 CMD [ "/run/aruna" ]

portal-dist/.gitkeep

@@ -0,0 +1,5 @@
+{
+  "version": "",
+  "sha256": "",
+  "url": ""
+}

portal.lock

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Resolves portal.lock and installs the pinned portal dist into portal-dist/
+# for image builds and local development. Refuses to install a dist whose
+# sha256 does not match the pin; there is no unverified mode.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+LOCK="$ROOT/portal.lock"
+DEST="${1:-$ROOT/portal-dist}"
+
+field() { sed -n "s/.*\"$1\": *\"\([^\"]*\)\".*/\1/p" "$LOCK" | head -n1; }
+VERSION="$(field version)"
+SHA256="$(field sha256)"
+URL="$(field url)"
+
+if [ -z "$URL" ] || [ -z "$SHA256" ]; then
+    echo "portal.lock carries no pinned url/sha256 yet." >&2
+    echo "Either pin a portal release in portal.lock or place a built dist into $DEST manually." >&2
+    exit 1
+fi
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+echo "Fetching aruna portal dist ${VERSION} from ${URL}"
+curl -fsSL "$URL" -o "$TMP/dist.tar.gz"
+echo "$SHA256  $TMP/dist.tar.gz" | sha256sum -c - >/dev/null
+
+mkdir -p "$TMP/unpack"
+tar -xzf "$TMP/dist.tar.gz" -C "$TMP/unpack"
+SRC="$TMP/unpack"
+if [ -d "$TMP/unpack/dist" ]; then
+    SRC="$TMP/unpack/dist"
+fi
+if [ ! -f "$SRC/index.html" ]; then
+    echo "Portal tarball holds no index.html; refusing to install." >&2
+    exit 1
+fi
+
+rm -rf "$DEST"
+mkdir -p "$(dirname "$DEST")"
+mv "$SRC" "$DEST"
+echo "Portal dist ${VERSION} installed at $DEST"