feat: make Keryx deployable with pluggable storage, OCI sharing, Postgres and a config file

.github/workflows/ci.yml

@@ -42,6 +42,39 @@ jobs:
       - name: cargo test
         run: cargo test
 
+  postgres:
+    name: Store suite on Postgres
+    runs-on: ubuntu-latest
+    env:
+      CARGO_PROFILE_DEV_DEBUG: 0
+      # The store's test factory opens a fresh schema here instead of
+      # in-memory SQLite, so the same suite proves both backends. The plain
+      # test job above is the SQLite run.
+      KERYX_TEST_DATABASE_URL: postgres://postgres:keryx@localhost:5432/keryx
+    services:
+      postgres:
+        image: postgres:18.6-alpine
+        env:
+          POSTGRES_PASSWORD: keryx
+          POSTGRES_DB: keryx
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install the pinned toolchain
+        run: rustup toolchain install
+      - uses: Swatinem/rust-cache@v2
+      # keryx-db holds the store suite, including concurrent uploads to one
+      # draft and concurrent migrators; keryx-server drives the same store
+      # through every handler.
+      - name: cargo test (Postgres)
+        run: cargo test -p keryx-db -p keryx-server
+
   supply-chain:
     name: Supply chain (deny + vet)
     runs-on: ubuntu-latest
@@ -53,8 +86,36 @@ jobs:
 
       - uses: taiki-e/install-action@v2
         with:
-          tool: cargo-deny,cargo-vet
+          tool: cargo-deny
+      # Pinned, and built from crates.io, on purpose. The newest prebuilt
+      # cargo-vet release is 0.10.0, which cannot parse the trusted-publisher
+      # entries that 0.10.2 writes to imports.lock for crates published through
+      # crates.io Trusted Publishing. CI must run the version that writes the
+      # files.
+      #
+      # Built with stable, not the repository's nightly: cargo-vet's own
+      # lockfile pins a rustix that turns on internal rustc attributes when it
+      # sees a nightly compiler, and current nightlies reject them. Only this
+      # tool build uses stable; Keryx itself stays on the pinned nightly.
+      # rust-cache keeps ~/.cargo/bin, so this compiles once.
+      - name: Install cargo-vet
+        working-directory: ${{ runner.temp }}
+        run: |
+          if ! cargo vet --version 2>/dev/null | grep -qx "cargo-vet 0.10.2"; then
+            rustup toolchain install stable --profile minimal
+            cargo +stable install cargo-vet --version 0.10.2 --locked
+          fi
       - name: cargo deny
         run: cargo deny check
       - name: cargo vet
         run: cargo vet --locked
+      # ring is the only crypto backend. aws-lc-rs is a C build and a second
+      # TLS provider, and several dependencies switch it on by default.
+      - name: aws-lc-rs must never enter the build
+        run: |
+          for crate in aws-lc-rs aws-lc-sys; do
+            if cargo tree --workspace --all-features --target all -i "$crate" 2>/dev/null; then
+              echo "::error::$crate entered the dependency graph"
+              exit 1
+            fi
+          done