fix(build): statically link zlib to eliminate libz.so.1 runtime dependency

The release binary pulled in libz.so.1 dynamically through rdkafka-sys
and other transitive C dependencies. Minimal base images (Chainguard
glibc-dynamic, distroless) don't ship libz, causing the server to fail
at startup with a missing shared library error.

Force libz-sys to its `static` feature via Cargo's dependency
unification so zlib is compiled into the binary. The Dockerfile COPY
workaround that patched in a Debian-built libz at image build time is
removed. Documentation updated to reflect the [server.tls] config
section path. Workspace version bumped to 0.1.1.

Author: farhan-syah

Cargo.lock

@@ -26,7 +26,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.1.0"
+version = "0.1.1"
 edition = "2024"
 rust-version = "1.94"
 license = "BUSL-1.1"
@@ -133,6 +133,13 @@ loro = "=1.10.8"
 # Kafka bridge
 rdkafka = { version = "0.36", features = ["cmake-build"] }
 
+# zlib: rdkafka-sys (and other transitive C deps) link libz dynamically by
+# default, which makes the release binary depend on libz.so.1 at runtime and
+# breaks minimal base images (e.g. Chainguard glibc-dynamic). Force the
+# `static` feature on libz-sys via Cargo's feature unification so zlib is
+# baked into the binary and the runtime image needs no extra .so files.
+libz-sys = { version = "1", features = ["static"] }
+
 # Regex
 regex = "1"
 
@@ -152,9 +159,12 @@ serde_json = "1"
 sonic-rs = "0.5"
 chrono = { version = "0.4", features = ["std"], default-features = false }
 
-# MessagePack
+# MessagePack 
 rmpv = "1"
-zerompk = { version = "0.4", git = "https://github.com/farhan-syah/zerompk", rev = "1dd71a0de6b6c99f2c2dbbc69106bb87b1e2cdcb", features = ["std", "derive"] }
+zerompk = { version = "0.4", git = "https://github.com/farhan-syah/zerompk", rev = "1dd71a0de6b6c99f2c2dbbc69106bb87b1e2cdcb", features = [
+  "std",
+  "derive",
+] }
 
 # Bitmap
 roaring = "0.11"

Cargo.toml

@@ -45,23 +45,6 @@ USER nonroot:nonroot
 
 COPY --from=builder --chown=nonroot:nonroot /build/target/release/nodedb /usr/local/bin/nodedb
 
-# nodedb dynamically links libz.so.1 (transitively via crates that default to
-# system zlib — e.g. flate2 with its default `zlib` feature). Chainguard's
-# glibc-dynamic ships only glibc + libgcc + ca-certs + tzdata, so the runtime
-# fails immediately with: "error while loading shared libraries: libz.so.1:
-# cannot open shared object file: No such file or directory".
-#
-# Copy the Debian builder's libz into a default ld.so search path. The glob
-# covers both amd64 and arm64 — per-arch builds only see their own multiarch
-# directory, so exactly one match per build.
-#
-# Long-term cleanup options (any of these would let us drop this COPY):
-#   * Switch flate2 (and any other zlib-using deps) to the `rust_backend`
-#     feature so libz becomes a build-time C lib statically linked.
-#   * Or vendor libz via the `libz-sys` `static` feature.
-#   * Or move runtime to `cgr.dev/chainguard/wolfi-base` + `apk add zlib`.
-COPY --from=builder /lib/*-linux-gnu/libz.so.1 /usr/lib/libz.so.1
-
 # Bind to all interfaces (required for Docker port mapping)
 # Point data dir at the declared volume
 ENV NODEDB_HOST=0.0.0.0 \

Dockerfile

@@ -286,24 +286,24 @@ Native opcodes are used internally by the Rust SDK (`nodedb-client`), FFI bindin
 ### Default behaviour
 
 All five listeners (`pgwire`, `native`, `http`, `resp`, `ilp`) default to
-**plaintext** when no `[tls]` section is present in the configuration file.
+**plaintext** when no `[server.tls]` section is present in the configuration file.
 This is suitable for local development and for deployments where TLS is
 terminated at an external load balancer or sidecar proxy.
 
-**Production deployments MUST configure `[tls] cert_path` and
-`[tls] key_path`** whenever clients connect over any untrusted network.
+**Production deployments MUST configure `[server.tls] cert_path` and
+`[server.tls] key_path`** whenever clients connect over any untrusted network.
 Without TLS, credentials (including SCRAM-SHA-256 client proofs), query
 text, and result data are transmitted in plaintext.
 
 ### Enabling TLS
 
 ```toml
-[tls]
+[server.tls]
 cert_path = "/etc/nodedb/tls/server.crt"
 key_path  = "/etc/nodedb/tls/server.key"
 ```
 
-When `[tls]` is present, TLS is enabled on all five listeners by default.
+When `[server.tls]` is present, TLS is enabled on all five listeners by default.
 The certificate must be PEM-encoded. Generate a self-signed cert for
 testing with `openssl req -x509 -newkey rsa:4096 -nodes ...` or a
 production certificate from any ACME-compatible CA.
@@ -313,7 +313,7 @@ production certificate from any ACME-compatible CA.
 Individual listeners can opt out of TLS using the per-protocol flags:
 
 ```toml
-[tls]
+[server.tls]
 cert_path = "/etc/nodedb/tls/server.crt"
 key_path  = "/etc/nodedb/tls/server.key"
 pgwire    = true   # default when [tls] is set
@@ -332,7 +332,7 @@ NodeDB watches cert/key files for modification-time changes and atomically
 swaps the TLS configuration without restarting listeners:
 
 ```toml
-[tls]
+[server.tls]
 cert_path                 = "/etc/nodedb/tls/server.crt"
 key_path                  = "/etc/nodedb/tls/server.key"
 cert_reload_interval_secs = 3600   # default: 1 hour; 0 to disable

docs/protocols.md

@@ -77,7 +77,7 @@ For zero-trust environments. Both client and server present certificates.
 Configure in `nodedb.toml`:
 
 ```toml
-[tls]
+[server.tls]
 cert = "/path/to/server.crt"
 key = "/path/to/server.key"
 client_ca = "/path/to/ca.crt"     # enables mTLS

docs/security/auth.md

@@ -88,6 +88,10 @@ snap = { workspace = true }
 flate2 = { workspace = true }
 tonic = { workspace = true }
 rdkafka = { workspace = true }
+# Direct dep purely so the workspace's `libz-sys` feature set (with `static`)
+# applies via Cargo feature unification — keeps zlib statically linked into
+# the release binary so runtime images don't need libz.so.1.
+libz-sys = { workspace = true }
 
 # Password hashing & cryptography
 argon2 = { workspace = true }