docker: build and run on Debian trixie

Add a multi-stage image that compiles inside Debian trixie and runs on the
same glibc/libssl/libopus, avoiding the Arch-built binary failing on
Debian. The runtime image installs ffmpeg, qalc, the shared libraries, and
the latest yt-dlp zipapp, and runs as uid 1000.

compose.yaml mounts data/ and piper/, overrides TTS_MODEL_PATH for the
container layout, and builds with host networking because the default
Docker bridge DNS cannot resolve crates.io or deb.debian.org on this host.

1 files changed, 76 insertions, 0 deletions

diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..eaedc7f
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,76 @@
+# Build on the same Debian release as the runtime image. This pins glibc,
+# libssl and libopus, so a binary built on a rolling-release host (Arch, etc.)
+# no longer fails on Debian due to newer toolchain/glibc symbols.
+FROM rust:1-trixie AS builder
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Build dependencies:
+# - cmake + clang + libclang-dev: espeak-rs-sys (pulled in by piper-rs) builds
+#   espeak-ng and runs bindgen
+# - pkg-config + libopus-dev: libopus_sys
+# - libssl-dev: native-tls / openssl-sys
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        cmake \
+        clang \
+        libclang-dev \
+        pkg-config \
+        libopus-dev \
+        libssl-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# Compile the dependency graph once with a dummy main so source edits do not
+# invalidate the expensive piper/espeak/onnxruntime build.
+COPY Cargo.toml Cargo.lock build.rs ./
+RUN mkdir src \
+    && printf 'fn main() {}\n' > src/main.rs \
+    && cargo build --release \
+    && rm -rf src
+
+COPY src ./src
+RUN cargo build --release
+
+# ── Runtime ───────────────────────────────────────────────────────────
+FROM debian:trixie-slim
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Runtime libraries reported by `readelf -d`: libstdc++, libopus, libssl,
+# libcrypto. ffmpeg/qalc/yt-dlp are invoked as subprocesses.
+# Full python3 (not python3-minimal) is required by the yt-dlp zipapp.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        ffmpeg \
+        libopus0 \
+        libssl3t64 \
+        libstdc++6 \
+        passwd \
+        python3 \
+        qalc \
+        tzdata \
+    && rm -rf /var/lib/apt/lists/*
+
+# yt-dlp is distributed as a self-contained Python zipapp; using the latest
+# release avoids the stale Debian package breaking on YouTube changes.
+ADD https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp /usr/local/bin/yt-dlp
+RUN chmod 755 /usr/local/bin/yt-dlp
+
+RUN useradd --create-home --uid 1000 --shell /usr/sbin/nologin bot \
+    && mkdir -p /app/data /app/piper /tmp/senator_sperma \
+    && chown -R bot:bot /app /tmp/senator_sperma
+
+WORKDIR /app
+COPY --from=builder /app/target/release/senator-sperma /usr/local/bin/senator-sperma
+
+USER bot
+
+ENV TZ=Europe/Warsaw \
+    TTS_MODEL_PATH=/app/piper \
+    RUST_LOG=info \
+    HOME=/home/bot
+
+ENTRYPOINT ["/usr/local/bin/senator-sperma"]