Add a headless Linux -server build (no GUI, no auto-update) to releases

Server operators can't run the default release binary: it's built with
the gui feature and dynamically links GTK, so it won't start on a box
without a display stack. Add a console variant.

- New CI job build-server: cargo build --release (no gui) →
  decryptd-linux-x86_64-server.tar.gz, attached to the release. Only the
  archive is uploaded (no triple-named raw binary), so rsupd publish --ci
  ignores it and it stays out of the signed update package.
- Gate the auto-updater behind the gui feature. The console build has no
  updater: the master channel carries the GTK-linked GUI binary, so a
  headless build must never pull from it. Operators update by
  re-downloading. (RSUPD_FINGERPRINT/build_updater are now gui-only.)
- The console build keeps the CWD-relative ./decryptd-data default (the
  per-user data dir default is GUI-only, from 0.1.12).

Both feature sets build clean; server binary smoke-run (claim → run).
Bump version to 0.1.13.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: MagicalTux

.github/workflows/build.yml

@@ -90,3 +90,41 @@ jobs:
           name: ${{ matrix.target }}
           path: target/release/${{ matrix.bin }}
           if-no-files-found: error
+
+  # Headless console build for servers: no GUI/tray, and — by design — no
+  # auto-updater (the `master` update channel carries the GTK-linked GUI binary,
+  # which won't start on a headless box). Shipped as a download-only release asset;
+  # operators upgrade by re-downloading. Only the .tar.gz is uploaded (no
+  # triple-named raw binary), so `rsupd publish --ci` never stages it into the
+  # signed update package.
+  build-server:
+    name: linux-x86_64-server
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      # build.rs links libcuda regardless of the GUI feature, so the CUDA toolkit
+      # is still needed to resolve the driver symbols at link time.
+      - name: Install CUDA toolkit
+        uses: Jimver/cuda-toolkit@v0.2.35
+        id: cuda
+        with:
+          cuda: "12.6.0"
+
+      - name: Build (console, no GUI)
+        run: cargo build --release --locked
+
+      - name: Package (→ tar.gz)
+        run: |
+          mkdir -p dist
+          tar -czf "dist/decryptd-linux-x86_64-server.tar.gz" -C target/release decryptd
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: decryptd-linux-x86_64-server.tar.gz
+          path: dist/decryptd-linux-x86_64-server.tar.gz
+          if-no-files-found: error

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "decryptd"
-version = "0.1.12"
+version = "0.1.13"
 edition = "2024"
 license = "Proprietary"
 authors = ["Karpeles Lab Inc"]

Cargo.toml

@@ -921,13 +921,15 @@ fn upload_loop(ctx: RestContext, inflight: InFlight, done: Arc<Mutex<Receiver<Fi
 /// Trust anchor for self-updates: the SHA-256 fingerprint of the decryptd
 /// release signing key (`rsupd id export`). It's a hash of a public key, so it's
 /// safe to embed; the updater refuses any manifest not signed by the matching
-/// private identity.
+/// private identity. GUI-build only — the console `-server` build has no updater.
+#[cfg(feature = "gui")]
 const RSUPD_FINGERPRINT: &str = "80b9edc7e6eaebf10b2a25bb10556b9b7fa6abc9fbe556706a2b680cefa4a0fc";
 
 /// Build the signed auto-updater. The transport (dist-go over rsurl) and channel
 /// (`master`) default from the fingerprint, so the anchor is the only required
 /// input. The git stamps from `build.rs` let it also spot a newer build of the
-/// same version (and never reinstall the identical build).
+/// same version (and never reinstall the identical build). GUI-build only.
+#[cfg(feature = "gui")]
 fn build_updater() -> rsupd::Result<rsupd::Updater> {
     rsupd::Updater::builder(env!("CARGO_PKG_NAME"), env!("CARGO_PKG_VERSION"))
         .fingerprint_hex(RSUPD_FINGERPRINT)
@@ -943,9 +945,13 @@ fn main() -> Result<()> {
     let args = RunArgs::parse();
     let status = Status::default();
 
-    // Long-lived workers keep themselves current: check hourly in the background
-    // and restart into each new signed build. `--once` is short-lived, so it
-    // skips the updater.
+    // Self-update is a GUI-build feature only. The headless `-server` build ships
+    // without it (operators update by re-downloading) — the master update channel
+    // carries the GTK-linked GUI binary, which wouldn't even start on a server, so
+    // a console build must never pull from it. Long-lived GUI workers keep
+    // themselves current: check hourly in the background and restart into each new
+    // signed build. `--once` is short-lived, so it skips the updater.
+    #[cfg(feature = "gui")]
     if !args.once {
         match build_updater() {
             Ok(updater) => {