Merge branch 'deploytest'

.github/workflows/build-and-deploy.yml

@@ -4,7 +4,7 @@ name: Build and Deploy
 
 on:
   push:
-    branches: ["deploytest"]
+    branches: ["main", "deploytest"]
 
 jobs:
   build-and-deploy:
@@ -19,7 +19,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      # --- NEW STEP TO FIX THE ERROR ---
       - name: Set repo name to lowercase
         id: repo_name
         run: echo "name=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
@@ -34,41 +33,74 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      # --- Build and push one image for each service ---
       - name: Build and push web-app image 🚀
         uses: docker/build-push-action@v6
         with:
           context: ./web-app
           push: true
-          # CHANGED: Uses the new lowercase repo name
           tags: ghcr.io/${{ steps.repo_name.outputs.name }}/web-app:${{ github.sha }}
-          cache-from: type=gha
+          cache-from: type=gha,scope=web-app
-          cache-to: type=gha,mode=max
+          cache-to: type=gha,mode=max,scope=web-app
 
       - name: Build and push Rust engine image ⚙️
         uses: docker/build-push-action@v6
         with:
           context: ./rust-engine
           push: true
-          # CHANGED: Uses the new lowercase repo name
           tags: ghcr.io/${{ steps.repo_name.outputs.name }}/rust-engine:${{ github.sha }}
-          cache-from: type=gha
+          cache-from: type=gha,scope=rust-engine
-          cache-to: type=gha,mode=max
+          cache-to: type=gha,mode=max,scope=rust-engine
 
-      # --- Deploy the new images to your server ---
+      - name: Ensure remote deploy directory exists
-      - name: Deploy to server via SSH ☁️
         uses: appleboy/ssh-action@v1.0.3
         with:
           host: ${{ secrets.SERVER_HOST }}
           username: ${{ secrets.SERVER_USERNAME }}
           key: ${{ secrets.SSH_PRIVATE_KEY }}
           script: |
-            cd /var/www/codered-astra
+            mkdir -p /home/github-actions/codered-astra
+
+      - name: Upload compose files to server
+        uses: appleboy/scp-action@v0.1.7
+        with:
+          host: ${{ secrets.SERVER_HOST }}
+          username: ${{ secrets.SERVER_USERNAME }}
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          source: "docker-compose.yml,docker-compose.prod.yml"
+          target: "/home/github-actions/codered-astra/"
+
+      - name: Deploy to server via SSH ☁️
+        uses: appleboy/ssh-action@v1.0.3
+        env:
+          RUNNER_GH_ACTOR: ${{ github.actor }}
+          RUNNER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          host: ${{ secrets.SERVER_HOST }}
+          username: ${{ secrets.SERVER_USERNAME }}
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          # pass selected env vars to the remote shell so docker login works
+          envs: RUNNER_GITHUB_TOKEN,RUNNER_GH_ACTOR
+          debug: true
+          script: |
+            cd /home/github-actions/codered-astra
+            # wrapper to support both Docker Compose v2 and legacy v1
+            compose() { docker compose "$@" || docker-compose "$@"; }
+            # Log in to GHCR using the run's GITHUB_TOKEN so compose can pull images.
+            if [ -n "$RUNNER_GITHUB_TOKEN" ] && [ -n "$RUNNER_GH_ACTOR" ]; then
+              echo "$RUNNER_GITHUB_TOKEN" | docker login ghcr.io -u "$RUNNER_GH_ACTOR" --password-stdin || true
+            fi
+            export REPO_NAME_LOWER='${{ steps.repo_name.outputs.name }}'
             export GEMINI_API_KEY='${{ secrets.GEMINI_API_KEY }}'
             export MYSQL_DATABASE='${{ secrets.MYSQL_DATABASE }}'
             export MYSQL_USER='${{ secrets.MYSQL_USER }}'
             export MYSQL_PASSWORD='${{ secrets.MYSQL_PASSWORD }}'
             export MYSQL_ROOT_PASSWORD='${{ secrets.MYSQL_ROOT_PASSWORD }}'
             export IMAGE_TAG=${{ github.sha }}
-            docker-compose pull
+            # Stop and remove old containers before pulling new images
-            docker-compose up -d --force-recreate
+            compose -f docker-compose.prod.yml down
+            # Clear previous logs for a clean deployment log
+            : > ~/astra-logs/astra-errors.log || true
+            compose -f docker-compose.prod.yml pull
+            compose -f docker-compose.prod.yml up -d
+            # Security hygiene: remove GHCR credentials after pulling
+            docker logout ghcr.io || true

docker-compose.prod.yml

@@ -0,0 +1,50 @@
+services:
+  web-app:
+    image: ghcr.io/${REPO_NAME_LOWER}/web-app:${IMAGE_TAG}
+    restart: always
+    ports:
+      - "80:3000"
+    environment:
+      - DATABASE_URL=mysql://${MYSQL_USER}:${MYSQL_PASSWORD}@mysql:3306/${MYSQL_DATABASE}
+      - RUST_ENGINE_URL=http://rust-engine:8000
+      - GEMINI_API_KEY=${GEMINI_API_KEY}
+    depends_on:
+      - mysql
+      - rust-engine
+
+  rust-engine:
+    image: ghcr.io/${REPO_NAME_LOWER}/rust-engine:${IMAGE_TAG}
+    restart: always
+    environment:
+      - DATABASE_URL=mysql://${MYSQL_USER}:${MYSQL_PASSWORD}@mysql:3306/${MYSQL_DATABASE}
+    depends_on:
+      - mysql
+    user: "1004"
+    volumes:
+      - ~/astra-logs:/var/log
+
+  mysql:
+    image: mysql:8.0
+    restart: always
+    ports:
+      - "45.43.2.25:3306:3306"
+    environment:
+      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
+      - MYSQL_DATABASE=${MYSQL_DATABASE}
+      - MYSQL_USER=${MYSQL_USER}
+      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
+    volumes:
+      - mysql-data:/var/lib/mysql
+
+  phpmyadmin:
+    image: phpmyadmin/phpmyadmin
+    restart: always
+    ports:
+      - "127.0.0.1:8080:80"
+    environment:
+      - PMA_HOST=mysql
+    depends_on:
+      - mysql
+
+volumes:
+  mysql-data:

rust-engine/Cargo.lock

@@ -32,18 +32,18 @@ dependencies = [
  "num-traits",
 ]
 
-[[package]]
-name = "atomic-waker"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
-
 [[package]]
 name = "autocfg"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -192,6 +192,12 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "data-encoding"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
+
 [[package]]
 name = "der"
 version = "0.7.10"
@@ -241,6 +247,15 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -402,16 +417,16 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.12"
+version = "0.3.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c0b69cfcb4e1b9f1bf2f53f95f766e4661169728ec61cd3fe5a0166f2d1386"
+checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d"
 dependencies = [
- "atomic-waker",
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
- "http",
+ "futures-util",
+ "http 0.2.12",
  "indexmap",
  "slab",
  "tokio",
@@ -447,14 +462,14 @@ dependencies = [
 
 [[package]]
 name = "headers"
-version = "0.4.1"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3314d5adb5d94bcdf56771f2e50dbbc80bb4bdf88967526706205ac9eff24eb"
+checksum = "06683b93020a07e3dbcf5f8c0f6d40080d725bea7936fc01ad345c01b97dc270"
 dependencies = [
- "base64",
+ "base64 0.21.7",
  "bytes",
  "headers-core",
- "http",
+ "http 0.2.12",
  "httpdate",
  "mime",
  "sha1",
@@ -462,11 +477,11 @@ dependencies = [
 
 [[package]]
 name = "headers-core"
-version = "0.3.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54b4a22553d4242c49fddb9ba998a99962b5cc6f22cb5a3482bec22522403ce4"
+checksum = "e7f66481bfee273957b1f20485a4ff3362987f85b2c236580d81b4eb7a326429"
 dependencies = [
- "http",
+ "http 0.2.12",
 ]
 
 [[package]]
@@ -508,6 +523,17 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "http"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
 [[package]]
 name = "http"
 version = "1.3.1"
@@ -521,24 +547,12 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "1.0.1"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
 dependencies = [
  "bytes",
- "http",
+ "http 0.2.12",
-]
-
-[[package]]
-name = "http-body-util"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
-dependencies = [
- "bytes",
- "futures-core",
- "http",
- "http-body",
  "pin-project-lite",
 ]
 
@@ -556,40 +570,26 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hyper"
-version = "1.7.0"
+version = "0.14.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb3aa54a13a0dfe7fbe3a59e0c76093041720fdc77b110cc0fc260fafb4dc51e"
+checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
 dependencies = [
- "atomic-waker",
  "bytes",
  "futures-channel",
  "futures-core",
+ "futures-util",
  "h2",
- "http",
+ "http 0.2.12",
  "http-body",
  "httparse",
  "httpdate",
  "itoa",
  "pin-project-lite",
- "pin-utils",
+ "socket2 0.5.10",
- "smallvec",
- "tokio",
-]
-
-[[package]]
-name = "hyper-util"
-version = "0.1.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d9b05277c7e8da2c93a568989bb6207bef0112e8d17df7a6eda4a3cf143bc5e"
-dependencies = [
- "bytes",
- "futures-core",
- "http",
- "http-body",
- "hyper",
- "pin-project-lite",
  "tokio",
  "tower-service",
+ "tracing",
+ "want",
 ]
 
 [[package]]
@@ -855,6 +855,24 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "multer"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01acbdc23469fd8fe07ab135923371d5f5a422fbf9c522158677c8eb15bc51c2"
+dependencies = [
+ "bytes",
+ "encoding_rs",
+ "futures-util",
+ "http 0.2.12",
+ "httparse",
+ "log",
+ "memchr",
+ "mime",
+ "spin",
+ "version_check",
+]
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -1131,7 +1149,7 @@ dependencies = [
 
 [[package]]
 name = "rust-engine"
-version = "0.1.1"
+version = "0.1.0"
 dependencies = [
  "anyhow",
  "chrono",
@@ -1329,6 +1347,16 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "socket2"
+version = "0.5.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "socket2"
 version = "0.6.1"
@@ -1377,7 +1405,7 @@ version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee6798b1838b6a0f69c007c133b8df5866302197e404e8b6ee8ed3e3a5e68dc6"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "crc",
@@ -1400,7 +1428,7 @@ dependencies = [
  "serde_json",
  "sha2",
  "smallvec",
- "thiserror",
+ "thiserror 2.0.17",
  "tokio",
  "tokio-stream",
  "tracing",
@@ -1453,7 +1481,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526"
 dependencies = [
  "atoi",
- "base64",
+ "base64 0.22.1",
  "bitflags",
  "byteorder",
  "bytes",
@@ -1484,7 +1512,7 @@ dependencies = [
  "smallvec",
  "sqlx-core",
  "stringprep",
- "thiserror",
+ "thiserror 2.0.17",
  "tracing",
  "whoami",
 ]
@@ -1496,7 +1524,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46"
 dependencies = [
  "atoi",
- "base64",
+ "base64 0.22.1",
  "bitflags",
  "byteorder",
  "chrono",
@@ -1522,7 +1550,7 @@ dependencies = [
  "smallvec",
  "sqlx-core",
  "stringprep",
- "thiserror",
+ "thiserror 2.0.17",
  "tracing",
  "whoami",
 ]
@@ -1547,7 +1575,7 @@ dependencies = [
  "serde",
  "serde_urlencoded",
  "sqlx-core",
- "thiserror",
+ "thiserror 2.0.17",
  "tracing",
  "url",
 ]
@@ -1597,13 +1625,33 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
 [[package]]
 name = "thiserror"
 version = "2.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 2.0.17",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -1663,7 +1711,7 @@ dependencies = [
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2",
+ "socket2 0.6.1",
  "tokio-macros",
  "windows-sys 0.61.2",
 ]
@@ -1690,6 +1738,18 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tokio-tungstenite"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c83b561d025642014097b66e6c1bb422783339e0909e4429cde4749d1990bc38"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.16"
@@ -1767,6 +1827,31 @@ dependencies = [
  "tracing-log",
 ]
 
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "tungstenite"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ef1a641ea34f399a848dea702823bbecfb4c486f911735368f1f137cb8257e1"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "data-encoding",
+ "http 1.3.1",
+ "httparse",
+ "log",
+ "rand",
+ "sha1",
+ "thiserror 1.0.69",
+ "url",
+ "utf-8",
+]
+
 [[package]]
 name = "typenum"
 version = "1.19.0"
@@ -1824,6 +1909,12 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -1849,22 +1940,30 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
-name = "warp"
+name = "want"
-version = "0.4.2"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d06d9202adc1f15d709c4f4a2069be5428aa912cc025d6f268ac441ab066b0"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "warp"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4378d202ff965b011c64817db11d5829506d3404edeadb61f190d111da3f231c"
 dependencies = [
  "bytes",
+ "futures-channel",
  "futures-util",
  "headers",
- "http",
+ "http 0.2.12",
- "http-body",
- "http-body-util",
  "hyper",
- "hyper-util",
  "log",
  "mime",
  "mime_guess",
+ "multer",
  "percent-encoding",
  "pin-project",
  "scoped-tls",
@@ -1872,6 +1971,7 @@ dependencies = [
  "serde_json",
  "serde_urlencoded",
  "tokio",
+ "tokio-tungstenite",
  "tokio-util",
  "tower-service",
  "tracing",

rust-engine/Cargo.toml

@@ -2,18 +2,17 @@
 
 [package]
 name = "rust-engine"
-version = "0.1.1"
+version = "0.1.0"
-edition = "2024"
+edition = "2021"
 
-# --- CORRECTED DEPENDENCIES ---
 [dependencies]
 tokio = { version = "1.38.0", features = ["full"] }
-warp = { version = "0.4.2", features = ["server"] }
+warp = "0.3.7"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 sqlx = { version = "0.8.6", features = ["runtime-tokio-rustls", "mysql", "chrono"] }
 chrono = { version = "0.4", features = ["serde"] }
 tracing = "0.1"
 tracing-subscriber = "0.3"
-dotenvy = "0.15.7" # Using 'dotenvy' as 'dotenv' is unmaintained
+dotenvy = "0.15.7" # Switched from unmaintained 'dotenv'
 anyhow = "1.0"

rust-engine/Dockerfile

@@ -1,30 +1,82 @@
+# syntax=docker/dockerfile:1.7
 # rust-engine/Dockerfile
+
 # --- Stage 1: Builder ---
-FROM rust:1.82-slim AS builder
+# Use a stable Rust version
+FROM rust:1.88-slim AS builder
 WORKDIR /usr/src/app
 
-# Install build dependencies
+# Install build dependencies needed for sqlx
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     pkg-config \
     libssl-dev \
-    && rm -rf /var/lib/apt/lists/*
+    curl \
-
+    build-essential \
-# Copy Cargo files for dependency caching
-COPY Cargo.toml Cargo.lock ./
-# Create a dummy src/main.rs for dependency build
-RUN mkdir src && echo "fn main() {}" > src/main.rs
-RUN cargo build --release && rm src/main.rs
-
-# Copy source code and build
-COPY src ./src
-RUN cargo build --release
-
-# --- Stage 2: Final Image ---
-FROM debian:bookworm-slim
-RUN apt-get update && apt-get install -y \
     ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
+
+# Allow optional override of toolchain (e.g., nightly or a pinned version). Leave empty to use image default.
+ARG RUSTUP_TOOLCHAIN=
+
+# Use rustup and cargo from the official Rust image location
+ENV PATH="/usr/local/cargo/bin:${PATH}"
+
+# Copy manifest files first to leverage Docker layer caching for dependencies
+COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
+
+# Ensure the pinned toolchain from rust-toolchain.toml (or provided ARG) is installed only if missing
+RUN set -eux; \
+    if [ -n "${RUSTUP_TOOLCHAIN}" ]; then \
+        if ! rustup toolchain list | grep -q "^${RUSTUP_TOOLCHAIN}"; then \
+            rustup toolchain install "${RUSTUP_TOOLCHAIN}"; \
+        fi; \
+        rustup default "${RUSTUP_TOOLCHAIN}"; \
+    else \
+        if [ -f rust-toolchain.toml ]; then \
+            TOOLCHAIN=$(sed -n 's/^channel *= *"\(.*\)"/\1/p' rust-toolchain.toml | head -n1); \
+            if [ -n "$TOOLCHAIN" ]; then \
+                if ! rustup toolchain list | grep -q "^$TOOLCHAIN"; then \
+                    rustup toolchain install "$TOOLCHAIN"; \
+                fi; \
+                rustup default "$TOOLCHAIN"; \
+            fi; \
+        fi; \
+    fi; \
+    rustup show active-toolchain || true
+
+# Create a dummy src to allow cargo to download dependencies into the cache layer
+RUN mkdir -p src && echo "fn main() { println!(\"cargo cache build\"); }" > src/main.rs
+
+# Warm up dependency caches without compiling a dummy binary
+RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
+    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
+    cargo fetch
+
+
+# Remove dummy main.rs before copying the real source
+RUN rm -f src/main.rs
+COPY src ./src
+# Build the real binary
+RUN cargo build --release --locked
+
+# --- Stage 2: Final, small image ---
+
+FROM debian:bookworm-slim
+# Install only necessary runtime dependencies (no upgrade, just ca-certificates)
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+
+# Add a non-root user for security
+RUN useradd --system --uid 10001 --no-create-home --shell /usr/sbin/nologin appuser
+
+# Copy the compiled binary from the builder stage
+
 COPY --from=builder /usr/src/app/target/release/rust-engine /usr/local/bin/rust-engine
+RUN chown appuser:appuser /usr/local/bin/rust-engine \
+    && mkdir -p /var/log \
+    && touch /var/log/astra-errors.log \
+    && chown appuser:appuser /var/log/astra-errors.log
+
 EXPOSE 8000
-CMD ["rust-engine"]
+# Redirect all output to /var/log/astra-errors.log for easy monitoring
+ENTRYPOINT ["/bin/sh", "-c", "/usr/local/bin/rust-engine >> /var/log/astra-errors.log 2>&1"]

rust-engine/rust-toolchain.toml

@@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.88.0"
+# components = ["rustfmt", "clippy"]
+# targets = ["x86_64-unknown-linux-gnu"]

rust-engine/src/main.rs

@@ -123,6 +123,7 @@ async fn start_server_without_db() -> Result<(), Box<dyn std::error::Error>> {
         .with(warp::log("rust_engine"));
 
     info!("Rust Engine started on http://0.0.0.0:8000 (DB-less mode)");
+    info!("Rust Engine prepared!");
 
     warp::serve(routes)
         .run(([0, 0, 0, 0], 8000))