refactor: rename bal-server-actix.rs to bal-server.rs

- Rename src/bin/bal-server-actix.rs -> src/bin/bal-server.rs
- Update Cargo.toml to point to new filename
- Update Dockerfile reference
- Update docs/08_security_audit.md references

Cargo.toml

@@ -34,7 +34,7 @@ zmq = 			{ version = "0.10.0" }
 
 [[bin]]
 name = "bal-server"
-path = "src/bin/bal-server-actix.rs"
+path = "src/bin/bal-server.rs"
 
 [[bin]]
 name = "bal-pusher"

Dockerfile

@@ -21,7 +21,7 @@ WORKDIR /build
 # Cache dependencies: copy Cargo.toml first, create dummy src to build deps
 COPY Cargo.toml Cargo.lock* ./
 RUN mkdir -p src/bin && \
-    echo 'fn main() {}' > src/bin/bal-server-actix.rs && \
+    echo 'fn main() {}' > src/bin/bal-server.rs && \
     echo 'fn main() {}' > src/bin/bal-pusher.rs && \
     echo '' > src/lib.rs && \
     echo '' > src/db.rs && \

docs/07_deployment_and_ops.md

@@ -133,12 +133,13 @@ This script builds a release binary, creates a Git tag, and uploads the release
 ```bash
 # WARNING: This script contains a hardcoded secret token. Do not use it as-is for production.
 ```
-- **Release Assets:** It generates a `.tar.gz` archive with the binaries, a `.sha256` checksum file, and a `.sig` GPG detached signature.
+- **Release Assets:** It generates a `.tar.gz` archive with the binaries, a `.sha256` checksum file, and both a `.sig` GPG detached binary signature and a `.asc` ASCII-armored version.
 - **Signature:** The release tarball is signed with the GPG key `Svātantrya <svatantrya@bitcoin-after.life>`. The script verifies that `gpg`, `sha256sum`, and `jq` are installed before proceeding.
-- **Verification:** The release body includes instructions for verifying the checksum and signature:
+- **Verification:** The release body includes instructions for verifying the checksum and signature (binary or ASCII-armored):
   ```bash
   sha256sum -c <release>.tar.gz.sha256
   gpg --verify <release>.tar.gz.sig <release>.tar.gz
+  gpg --verify <release>.tar.gz.asc <release>.tar.gz
   ```
 - **Security:** It also builds and uploads the binaries. The binaries should be built and signed on a separate, clean build machine, not on the production server.
 

docs/08_security_audit.md

@@ -87,7 +87,7 @@ Regression tests: `tests/panic_regression_tests.rs` (2 tests).
 - Rate limiting: `actix-governor` middleware with token-bucket — configurable via `BAL_SERVER_ACTIX_PUSHTXS_PER_SEC`/`BURST` (default 1 req/s per IP with burst 5)
 - Connection limits: `workers(4)` and `max_connections(100)` — configurable via `BAL_SERVER_ACTIX_WORKERS`/`MAX_CONNECTIONS`
 - Body timeout: configurable via `BAL_SERVER_ACTIX_TIMEOUT_SECS` (default 30s)
-**Migration:** Server replaced `hyper` custom server with `actix-web` (see `src/bin/bal-server-actix.rs`). All handlers migrated with `Arc<Mutex<Connection>>` shared DB. Old `bal-server.rs` (Hyper) removed. `bal-pusher` enhanced with ZMQ timeout (`ZMQ_RCVTIMEO` 5000ms) and RPC retry logic. **Priority:** High. (Mitigated)
+**Migration:** Server replaced `hyper` custom server with `actix-web` (see `src/bin/bal-server.rs`). All handlers migrated with `Arc<Mutex<Connection>>` shared DB. Old `bal-server.rs` (Hyper) removed. `bal-pusher` enhanced with ZMQ timeout (`ZMQ_RCVTIMEO` 5000ms) and RPC retry logic. **Priority:** High. (Mitigated)
 
 ### 5. SSRF / Network Abuse via `reqwest` (MEDIUM)
 **Location:** `src/bin/bal-pusher.rs`.
@@ -121,7 +121,7 @@ Regression tests: `tests/panic_regression_tests.rs` (2 tests).
   - Rejects symlinks and non-regular files (directories, devices, etc.).
   - If validation fails, the function returns `Err(String)` instead of panicking, preventing crashes or accidental access to system files.
 - ✅ **WAL mode:** `db::open_db` automatically executes `PRAGMA journal_mode = WAL;` and `PRAGMA synchronous = NORMAL;` on every connection. This is a best practice for safe concurrent access when `bal-server` and `bal-pusher` share the same database file.
-- ✅ **Replaced `unwrap`:** In `src/bin/bal-server-actix.rs` and `src/bin/bal-pusher.rs`, `sqlite::open(...).unwrap()` was replaced with `db::open_db(...)` with safe error handling (return `Err` in the server, `std::process::exit(1)` in the pusher with a log error).
+- ✅ **Replaced `unwrap`:** In `src/bin/bal-server.rs` and `src/bin/bal-pusher.rs`, `sqlite::open(...).unwrap()` was replaced with `db::open_db(...)` with safe error handling (return `Err` in the server, `std::process::exit(1)` in the pusher with a log error).
 - **Remaining (ops):** Ensure the database file is owned by the `bal` user and not writable by any other user (`chmod 600`). The database file should not reside on a shared or network drive.
 **Regression tests:** `tests/db_path_validation.rs` (5 tests covering traversal, forbidden absolute paths, symlink, WAL pragma, and valid relative paths). All passing.
 **Status:** Fixed. **Priority:** Medium.

make_release.sh

@@ -1,189 +0,0 @@
-#!/bin/bash
-#author: <your-name>
-
-source lib.sh
-usage() {
-  echo_w "./make_release <version> <message>"
-}
-
-if [ -n "$1" ]; then release=$1; else usage; exit; fi
-
-if [ -n "$2" ]; then message=$2; else
-  # Create temporary file using mktemp
-  TEMPFILE=$(mktemp)
-  vi $TEMPFILE
-  message=$(cat $TEMPFILE)
-  rm $TEMPFILE
-fi
-
-echo_i $message
-
-# Load secrets from .env file (not committed to git)
-if [ -f .env ]; then
-  export $(grep -v '^#' .env | xargs)
-fi
-
-TOKEN="${GITEA_API_TOKEN:-${TOKEN_GITEA}}"
-if [ -z "$TOKEN" ]; then
-  echo_e "Error: GITEA_API_TOKEN (or TOKEN_GITEA) is not set in .env file."
-  echo_e "Please create a .env file with: GITEA_API_TOKEN=your_token_here"
-  exit 1
-fi
-
-for cmd in gpg sha256sum jq; do
-  if ! command -v "$cmd" >/dev/null 2>&1; then
-    echo_e "Error: '$cmd' is required but not installed."
-    exit 1
-  fi
-done
-
-SIGNER_KEY="svatantrya@bitcoin-after.life"
-ASSET_SHA256="$ASSET_PATH.sha256"
-ASSET_SIG="$ASSET_PATH.sig"
-OWNER="bitcoinafterlife"
-basename=$(basename $(pwd))
-REPO=$basename
-TAG="v$release"
-binpath="target/release/$basename"
-release_name="$basename-$release"
-dest="releases/$release"
-arch=$(uname -m)
-platform="linux-gnu"
-destbin="$dest/$arch"
-destsrc="$dest/src"
-assetname="$release_name""_$arch""_$platform"
-
-asset_tar_gz="$assetname.tar.gz"
-ASSET_PATH="$destbin/$assetname.tar.gz"
-
-giteahost="https://bitcoin-after.life/gitea"
-url_releases="$giteahost/api/v1/repos/$OWNER/$REPO/releases"
-
-echo_i() {
-    echo -e "\033[1m==> $1\033[0m"
-}
-
-echo_e() {
-    echo -e "\033[31;1m$1\033[0m"
-}
-
-echo_s() {
-    echo -e "\033[32;1m$1\033[0m"
-}
-echo_w() {
-    echo -e "\033[33;1m$1\033[0m"
-}
-
- 
-prepare_release(){
-  mkdir -p "$destbin/$assetname"
-  if ! cargo build --release; then
-    echo_w "error building release"
-    exit 1
-  fi
-  ls -l $binpath
-  cp target/release/bal-server \
-    target/release/bal-pusher \
-    README.md \
-    "$destbin/$assetname"
-  (
-    cd "$destbin"
-    echo_w $ASSET_PATH
-    echo "ls $(pwd)"
-    ls
-    echo "ls $(pwd)/$assetname"
-    ls "$(pwd)/$assetname"
-    ls $assetname
-    tar -czf "$asset_tar_gz" "$assetname"
-
-    sha256sum "$asset_tar_gz" > "$asset_tar_gz.sha256"
-
-    if ! gpg --batch --yes --detach-sign --local-user "$SIGNER_KEY" "$asset_tar_gz"; then
-      echo_e "error signing release tarball"
-      exit 1
-    fi
-  )
-}
-
-push_tag() {
-  git commit -am"release: $release_name"
-  git push
-  #git tag -a "$TAG" -m"release: $release_name"
-  #git push origin --tags
-}
-
-# Configurazioni
-post_release() {
-  if [ -z "$1" ]; then
-    echo_e "no data to release"
-    exit 1
-  else
-    echo "data: $1"
-  fi
-  echo "token:$TOKEN"
-  echo url_releases: $url_releases
-  RELEASE="$(curl -s -X POST \
-    -H "accept: application/json" \
-    -H "Authorization: token $TOKEN" \
-    -H "Content-Type: application/json" \
-    -d "$1" \
-    $url_releases
-  )"
-  echo $RELEASE
-}
-
-add_asset_release() {
-  if [ -z "$1" ]; then
-    echo_e "error add_asset_release"
-    exit 1
-  fi
-
-  local assets=("$ASSET_PATH" "$ASSET_SHA256" "$ASSET_SIG")
-  for asset in "${assets[@]}"; do
-    if [ ! -f "$asset" ]; then
-      echo_e "missing asset: $asset"
-      exit 1
-    fi
-    echo "Uploading: $asset"
-    ls -l "$asset"
-    curl -X POST \
-      -H "accept: application/json" \
-      -H "Authorization: token $TOKEN" \
-      -H "Content-Type: multipart/form-data" \
-      -F "attachment=@$asset" \
-      "$url_releases/$1/assets"
-  done
-}
-
-release_body=$(printf '%s' "Release: $release_name enjoy
-
-$message
-
----
-Verification Instructions:
-
-SHA256 Checksum:
-sha256sum -c $assetname.tar.gz.sha256
-
-GPG Signature:
-gpg --verify $assetname.tar.gz.sig $assetname.tar.gz
-
-Signed by Svātantrya (svatantrya@bitcoin-after.life)")
-
-release_data=$(jq -n -c \
-  --arg tag_name "$TAG" \
-  --arg name "$release_name" \
-  --arg body "$release_body" \
-  '{tag_name: $tag_name, name: $name, body: $body}')
-
-prepare_release
-echo_s "prepare release done"
-push_tag
-echo_s "push tag done"
-echo "$release_data"
-post_release "$release_data"
-echo_s "prepare release done"
-echo $RELEASE
-id_release=
-add_asset_release $(echo $RELEASE | jq .id)
-echo_s "done"