Bundle a tested Traefik in releases, the image and the installer

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

deploy/blacktip.service

@@ -7,6 +7,8 @@ Wants=network-online.target
 [Service]
 User=blacktip
 Group=blacktip
+# The Traefik that ships with Blacktip; set BLACKTIP_TRAEFIK= (empty) in the env file for the built-in proxy.
+Environment=BLACKTIP_TRAEFIK=/usr/local/lib/blacktip/traefik
 EnvironmentFile=-/etc/blacktip/blacktip.env
 ExecStart=/usr/local/bin/blacktip -data /var/lib/blacktip
 WorkingDirectory=/var/lib/blacktip

deploy/build.sh

@@ -4,7 +4,7 @@
 #   deploy/build.sh [version]      version defaults to `git describe`
 #
 # Output:
-#   dist/bin/<os>_<arch>/blacktip             the raw binaries (the Docker image uses the linux ones)
+#   dist/bin/<os>_<arch>/blacktip and traefik             the raw binaries (the Docker image uses the linux ones)
 #   dist/blacktip_<version>_<os>_<arch>.tar.gz or .zip
 #   dist/SHA256SUMS
 #
@@ -28,10 +28,13 @@ for t in $TARGETS; do
 	CGO_ENABLED=0 GOOS=$os GOARCH=$arch GOARM=7 \
 		go build -trimpath -ldflags "-s -w -X main.version=$VERSION" -o "$out/$NAME$ext" "./cmd/$NAME"
 
+	# the Traefik that Blacktip drives for http/https (see BLACKTIP_TRAEFIK)
+	sh deploy/fetch-traefik.sh "$os" "$arch" "$out"
+
 	pkg="${NAME}_${VERSION}_${os}_${arch}"
 	stage="dist/stage/$pkg"
 	mkdir -p "$stage"
-	cp "$out/$NAME$ext" "$stage/"
+	cp "$out/$NAME$ext" "$out/traefik$ext" "$stage/"
 	for f in LICENSE README.md .env.example; do
 		[ -f "$f" ] && cp "$f" "$stage/"
 	done

deploy/docker-compose.yml

@@ -15,8 +15,6 @@ services:
       - blacktip-data:/data
       # To list this machine's Docker containers as targets (BLACKTIP_DOCKER=1):
       # - /var/run/docker.sock:/var/run/docker.sock:ro
-      # To serve websites with Traefik (BLACKTIP_TRAEFIK=/traefik): mount a Traefik v3 binary
-      # - /usr/local/bin/traefik:/traefik:ro
 
 volumes:
   blacktip-data:

deploy/fetch-traefik.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+# Downloads the official Traefik release for one platform and checks its checksum.
+#
+#   deploy/fetch-traefik.sh <os> <arch> <destination-dir>
+#
+# Blacktip ships this exact Traefik version, which is the one it was tested with.
+# Set TRAEFIK_VERSION to try another.
+set -eu
+OS=${1:?os} ARCH=${2:?arch} DEST=${3:?destination}
+VERSION=${TRAEFIK_VERSION:-3.7.16}
+case "$ARCH" in arm) ARCH=armv7 ;; esac
+EXT=tar.gz
+[ "$OS" = windows ] && EXT=zip
+BASE="https://github.com/traefik/traefik/releases/download/v$VERSION"
+FILE="traefik_v${VERSION}_${OS}_${ARCH}.$EXT"
+CACHE=${TRAEFIK_CACHE:-${TMPDIR:-/tmp}/traefik-cache}
+mkdir -p "$CACHE" "$DEST"
+[ -f "$CACHE/$FILE" ] || curl -fsSL -o "$CACHE/$FILE" "$BASE/$FILE"
+[ -f "$CACHE/checksums-$VERSION.txt" ] || curl -fsSL -o "$CACHE/checksums-$VERSION.txt" "$BASE/traefik_v${VERSION}_checksums.txt"
+want=$(grep " $FILE\$" "$CACHE/checksums-$VERSION.txt" | cut -d' ' -f1)
+[ -n "$want" ] || { echo "no checksum listed for $FILE" >&2; exit 1; }
+got=$(sha256sum "$CACHE/$FILE" | cut -d' ' -f1)
+[ "$want" = "$got" ] || { echo "checksum mismatch for $FILE" >&2; rm -f "$CACHE/$FILE"; exit 1; }
+if [ "$EXT" = zip ]; then
+	unzip -qo "$CACHE/$FILE" traefik.exe -d "$DEST"
+else
+	tar -xzf "$CACHE/$FILE" -C "$DEST" traefik
+fi
+echo "traefik $VERSION for $OS/$ARCH ready"

deploy/install.sh

@@ -30,7 +30,7 @@ if [ "${1:-}" = "--uninstall" ]; then
 	if real; then
 		systemctl disable --now "$NAME" > /dev/null 2>&1 || true
 	fi
-	rm -f "$UNIT" "$BIN"
+	rm -f "$UNIT" "$BIN" "$ROOT/usr/local/lib/$NAME/traefik"
 	if real; then
 		systemctl daemon-reload || true
 	fi
@@ -45,9 +45,13 @@ if real && ! id "$NAME" > /dev/null 2>&1; then
 	say "Created the system user '$NAME'."
 fi
 
-mkdir -p "$ROOT/usr/local/bin" "$ROOT/etc/systemd/system" "$CONF" "$DATA"
+mkdir -p "$ROOT/usr/local/lib/$NAME" "$ROOT/usr/local/bin" "$ROOT/etc/systemd/system" "$CONF" "$DATA"
 install -m 0755 "$HERE/$NAME" "$BIN.new"
 mv -f "$BIN.new" "$BIN" # atomic, so upgrading a running service is safe
+if [ -f "$HERE/traefik" ]; then
+	install -m 0755 "$HERE/traefik" "$ROOT/usr/local/lib/$NAME/traefik.new"
+	mv -f "$ROOT/usr/local/lib/$NAME/traefik.new" "$ROOT/usr/local/lib/$NAME/traefik"
+fi
 install -m 0644 "$HERE/$NAME.service" "$UNIT"
 if [ ! -f "$ENVFILE" ]; then
 	install -m 0600 "$HERE/.env.example" "$ENVFILE"