stapeln.toml

# SPDX-License-Identifier: PMPL-1.0-or-later
# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
#
# stapeln.toml — Layer-based container build configuration for VeriSimDB
#
# stapeln builds containers as composable layers (German: "to stack").
# Each layer is independently cacheable, verifiable, and signable.

[metadata]
name = "verisimdb"
version = "0.1.0-alpha"
description = "6-core multimodal database with self-normalization"
author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"
license = "PMPL-1.0-or-later"
registry = "ghcr.io/hyperpolymath"

[build]
containerfile = "container/Containerfile"
context = "."
runtime = "podman"

# ── Layer Definitions ──────────────────────────────────────────
# Layers are built bottom-up. Each layer extends the previous.

[layers.base]
description = "Chainguard Wolfi minimal base"
from = "cgr.dev/chainguard/wolfi-base:latest"
cache = true
verify = true

[layers.rust-toolchain]
description = "Rust compiler and build dependencies"
extends = "base"
packages = ["rust", "pkgconf", "build-base", "protoc", "clang-19"]
env = { LIBCLANG_PATH = "/usr/lib", PROTOC = "/usr/bin/protoc" }
cache = true

[layers.rust-deps]
description = "Cargo dependency fetch and compile (no source)"
extends = "rust-toolchain"
commands = [
    "cargo fetch --locked",
    "cargo build --release --workspace --lib 2>/dev/null || true",
]
cache-key = "Cargo.lock"
cache = true

[layers.rust-build]
description = "VeriSimDB Rust core compilation"
extends = "rust-deps"
commands = ["cargo build --release -p verisim-api"]
artifacts = [
    { src = "target/release/verisim-api", dst = "/app/verisim-api" },
]

[layers.elixir-toolchain]
description = "Elixir/OTP 27 runtime and build tools"
extends = "base"
packages = ["erl27-elixir-1.18", "erlang-27", "erlang-27-dev", "git", "build-base"]
cache = true

[layers.elixir-deps]
description = "Mix dependency fetch and compile"
extends = "elixir-toolchain"
env = { MIX_ENV = "prod" }
commands = [
    "mix local.hex --force",
    "mix local.rebar --force",
    "mix deps.get --only prod",
    "mix compile",
]
cache-key = "elixir-orchestration/mix.lock"
cache = true

[layers.elixir-build]
description = "Elixir OTP release build"
extends = "elixir-deps"
commands = ["mix release verisim"]
artifacts = [
    { src = "_build/prod/rel/verisim", dst = "/app/elixir/" },
]

[layers.runtime]
description = "Minimal runtime with Rust binary + Elixir release"
from = "cgr.dev/chainguard/wolfi-base:latest"
packages = ["ca-certificates", "curl", "libstdc++", "ncurses"]
copy-from = [
    { layer = "rust-build", src = "/app/verisim-api", dst = "/app/verisim-api" },
    { layer = "elixir-build", src = "/app/elixir/", dst = "/app/elixir/" },
]
entrypoint = ["/app/entrypoint.sh"]
user = "verisim"
expose = [8080]

# ── Security ───────────────────────────────────────────────────

[security]
non-root = true
read-only-root = false
no-new-privileges = true
cap-drop = ["ALL"]
seccomp-profile = "default"

[security.signing]
algorithm = "ML-DSA-87"
provider = "cerro-torre"

[security.sbom]
format = "spdx-json"
output = "sbom.spdx.json"
include-deps = true

[security.attestation]
slsa-level = 3
provenance = true
reproducible = true

# ── Verification ───────────────────────────────────────────────

[verify]
vordr = true
svalinn = true
scan-on-build = true
fail-on = ["critical", "high"]

# ── Targets ────────────────────────────────────────────────────
# Named build targets for different deployment scenarios.

[targets.development]
layers = ["base", "rust-toolchain", "rust-build", "elixir-toolchain", "elixir-build"]
env = { RUST_LOG = "debug", MIX_ENV = "dev" }

[targets.production]
layers = ["runtime"]
env = { RUST_LOG = "info", MIX_ENV = "prod" }

[targets.test]
layers = ["base", "rust-toolchain", "rust-build", "elixir-toolchain", "elixir-build"]
commands = ["cargo test", "mix test"]
env = { RUST_LOG = "debug", MIX_ENV = "test" }