zix: serve the mounted certificate, drop upload, re-enable

frameworks/zix-grpc/Dockerfile

@@ -57,15 +57,8 @@ RUN set -eu; \
     -Dcpu="${ZIG_CPU}+aes+pclmul+adx" \
     --release=fast --summary failures;
 
-# Self-signed Ed25519 cert generated at image build, baked at /etc/zix-tls.
-RUN set -eu; \
-    mkdir -p /etc/zix-tls; \
-    openssl genpkey -algorithm ED25519 -out /etc/zix-tls/server.key; \
-    openssl req -new -x509 -key /etc/zix-tls/server.key -out /etc/zix-tls/server.cert \
-        -days 3650 -subj "/CN=localhost"
 
 FROM alpine:3.20
 COPY --from=build /server/zig-out/bin/zix-grpc /zix-grpc
-COPY --from=build /etc/zix-tls /etc/zix-tls
 EXPOSE 8080 8443/tcp
 ENTRYPOINT ["/zix-grpc"]

frameworks/zix-grpc/src/main.zig

@@ -7,8 +7,8 @@
 //!
 //! ONE server, two listeners through config.tls_port (dual listener):
 //! - h2c cleartext on PORT (8080). Serves unary-grpc and stream-grpc.
-//! - gRPC over TLS 1.3 on TLS_PORT (8443), ALPN h2, self-signed Ed25519 cert
-//!   baked at /etc/zix-tls, terminated on the same per-core .URING workers
+//! - gRPC over TLS 1.3 on TLS_PORT (8443), ALPN h2, the shared RSA cert
+//!   mounted at /certs, terminated on the same per-core .URING workers
 //!   (no second launch, no doubled workers or fd tables).
 //!   Serves unary-grpc-tls and stream-grpc-tls.
 //!

frameworks/zix-grpc/src/shared/paths.zig

@@ -1,13 +1,13 @@
 //! Where the fixtures and the certificate are, for every module that needs one.
 //!
 //! Note:
-//! - Constants, the way the HttpArena entries name /data and /etc/zix-tls. The
+//! - Constants, the way the HttpArena entries name /data and /certs. The
 //!   entry names the path and the harness guarantees it: there a Dockerfile and
 //!   a compose mount put the files in place
 
 pub const DATA_DIR: []const u8 = "/data";
 
 pub const DATASET: []const u8 = "/data/dataset.json";
 
-pub const TLS_CERT: []const u8 = "/etc/zix-tls/server.cert";
-pub const TLS_KEY: []const u8 = "/etc/zix-tls/server.key";
+pub const TLS_CERT: []const u8 = "/certs/server.crt";
+pub const TLS_KEY: []const u8 = "/certs/server.key";

frameworks/zix-http2/Dockerfile

@@ -58,15 +58,8 @@ RUN set -eu; \
     esac; \
     zig build -Dtarget="${ZIG_TARGET}" -Dcpu="${ZIG_CPU}+aes+pclmul+adx" --release=fast
 
-# Self-signed Ed25519 cert generated at image build, baked at /etc/zix-tls.
-RUN set -eu; \
-    mkdir -p /etc/zix-tls; \
-    openssl genpkey -algorithm ED25519 -out /etc/zix-tls/server.key; \
-    openssl req -new -x509 -key /etc/zix-tls/server.key -out /etc/zix-tls/server.crt \
-        -days 3650 -subj "/CN=localhost"
 
 FROM alpine:3.20
 COPY --from=build /server/zig-out/bin/zix-http2 /zix-http2
-COPY --from=build /etc/zix-tls /etc/zix-tls
 EXPOSE 8443/tcp 8443/udp
 ENTRYPOINT ["/zix-http2"]

frameworks/zix-http2/src/main.zig

@@ -6,7 +6,7 @@
 //!   (shared-nothing per-core io_uring, one SO_REUSEPORT
 //!   listener plus ring per CPU). Serves baseline-h2c and json-h2c.
 //! - h2 over TLS 1.3 on TLS_PORT
-//!   (ALPN h2, self-signed Ed25519 cert at /etc/zix-tls),
+//!   (ALPN h2, the RSA cert mounted at /certs),
 //!   terminated on the same per-core rings: no second launch,
 //!   no doubled workers or fd tables. Serves baseline-h2 and static-h2.
 //!
@@ -35,8 +35,8 @@ const PORT: u16 = 8082;
 const DISPATCH_MODEL: zix.Http2.DispatchModel = .URING;
 
 const TLS_PORT: u16 = 8443;
-const TLS_CERT_DEFAULT: []const u8 = "/etc/zix-tls/server.crt";
-const TLS_KEY_DEFAULT: []const u8 = "/etc/zix-tls/server.key";
+const TLS_CERT_DEFAULT: []const u8 = "/certs/server.crt";
+const TLS_KEY_DEFAULT: []const u8 = "/certs/server.key";
 
 // --------------------------------------------------------- //
 

frameworks/zix-http3/Dockerfile

@@ -58,15 +58,8 @@ RUN set -eu; \
     esac; \
     zig build -Dtarget="${ZIG_TARGET}" -Dcpu="${ZIG_CPU}+aes+pclmul+adx" --release=fast
 
-# Self-signed Ed25519 cert generated at image build, baked at /etc/zix-tls.
-RUN set -eu; \
-    mkdir -p /etc/zix-tls; \
-    openssl genpkey -algorithm ED25519 -out /etc/zix-tls/server.key; \
-    openssl req -new -x509 -key /etc/zix-tls/server.key -out /etc/zix-tls/server.crt \
-        -days 3650 -subj "/CN=localhost"
 
 FROM alpine:3.20
 COPY --from=build /server/zig-out/bin/zix-http3 /zix-http3
-COPY --from=build /etc/zix-tls /etc/zix-tls
 EXPOSE 8443/tcp 8443/udp
 ENTRYPOINT ["/zix-http3"]

frameworks/zix-http3/src/main.zig

@@ -3,7 +3,7 @@
 //! zix.Http3 (.URING) against the HttpArena HTTP/3 suite
 //! (baseline-h3, static-h3).
 //! QUIC over UDP on PORT, TLS 1.3 inside the handshake
-//! (baked Ed25519 cert at /etc/zix-tls), ALPN h3 negotiated by the engine.
+//! (the RSA cert mounted at /certs), ALPN h3 negotiated by the engine.
 //! /baseline2 sums the query integers, /static serves /data/static
 //! with .br / .gz negotiation against the request accept-encoding.
 //! A one-worker https responder on TCP 8443 answers the bench readiness
@@ -27,8 +27,8 @@ const WORKERS: usize = 0;
 // arrives on TCP 8443 (the two coexist, distinct sockets).
 const PROBE_TCP_PORT: u16 = 8443;
 
-const TLS_CERT_DEFAULT: []const u8 = "/etc/zix-tls/server.crt";
-const TLS_KEY_DEFAULT: []const u8 = "/etc/zix-tls/server.key";
+const TLS_CERT_DEFAULT: []const u8 = "/certs/server.crt";
+const TLS_KEY_DEFAULT: []const u8 = "/certs/server.key";
 
 // --------------------------------------------------------- //
 

frameworks/zix-ws/Dockerfile

@@ -57,12 +57,6 @@ RUN set -eu; \
     -Dcpu="${ZIG_CPU}+aes+pclmul+adx" \
     --release=fast --summary failures;
 
-# Self-signed Ed25519 cert generated at image build, baked at /etc/zix-tls.
-RUN set -eu; \
-    mkdir -p /etc/zix-tls; \
-    openssl genpkey -algorithm ED25519 -out /etc/zix-tls/server.key; \
-    openssl req -new -x509 -key /etc/zix-tls/server.key -out /etc/zix-tls/server.cert \
-        -days 3650 -subj "/CN=localhost"
 
 FROM alpine:3.20
 COPY --from=build /server/zig-out/bin/zix-ws /zix-ws

frameworks/zix/Dockerfile

@@ -57,15 +57,8 @@ RUN set -eu; \
     -Dcpu="${ZIG_CPU}+aes+pclmul+adx" \
     --release=fast --summary failures;
 
-# Self-signed Ed25519 cert generated at image build, baked at /etc/zix-tls.
-RUN set -eu; \
-    mkdir -p /etc/zix-tls; \
-    openssl genpkey -algorithm ED25519 -out /etc/zix-tls/server.key; \
-    openssl req -new -x509 -key /etc/zix-tls/server.key -out /etc/zix-tls/server.cert \
-        -days 3650 -subj "/CN=localhost"
 
 FROM alpine:3.20
 COPY --from=build /server/zig-out/bin/zix-http1 /zix-http1
-COPY --from=build /etc/zix-tls /etc/zix-tls
 EXPOSE 8080 8081
 ENTRYPOINT ["/zix-http1"]

frameworks/zix/meta.json

@@ -5,12 +5,11 @@
   "engine": "zix.Http1 URING Dispatch Model",
   "description": "HTTP/1.1 on the zix.Http1 raw engine, .URING dispatch: per-worker SO_REUSEPORT io_uring loops, comptime Router, staged send sink. Dual listener: cleartext 8080, TLS 1.3 on 8081. Database routes run on engine-worker lanes, each worker pumping its own pipelined postgrez connections on its ring with named prepared statements. No response cache and no startup pre-serialization anywhere: json serializes every field per request and compresses per request, static opens the file per request. The crud row cache is the 200 ms cache-aside the crud profile itself defines.",
   "repo": "https://github.com/prothegee/zix",
-  "enabled": false,
+  "enabled": true,
   "tests": [
     "baseline",
     "pipelined",
     "limited-conn",
-    "upload",
     "static",
     "static-tls",
     "json",

frameworks/zix/src/shared/paths.zig

@@ -1,13 +1,13 @@
 //! Where the fixtures and the certificate are, for every module that needs one.
 //!
 //! Note:
-//! - Constants, the way the HttpArena entries name /data and /etc/zix-tls. The
+//! - Constants, the way the HttpArena entries name /data and /certs. The
 //!   entry names the path and the harness guarantees it: there a Dockerfile and
 //!   a compose mount put the files in place
 
 pub const DATA_DIR: []const u8 = "/data";
 
 pub const DATASET: []const u8 = "/data/dataset.json";
 
-pub const TLS_CERT: []const u8 = "/etc/zix-tls/server.cert";
-pub const TLS_KEY: []const u8 = "/etc/zix-tls/server.key";
+pub const TLS_CERT: []const u8 = "/certs/server.crt";
+pub const TLS_KEY: []const u8 = "/certs/server.key";