build: switch to musl targets and rustls for portable binaries

- reqwest: use rustls-tls instead of native-tls (no OpenSSL dependency)
- release.yml: build x86_64/aarch64-unknown-linux-musl (static binaries)
- Dockerfile: update debian:buster-slim → bookworm-slim, drop libpq-dev

Statically linked binaries work on any Linux distro including Alpine.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: vsilent

.github/workflows/release.yml

@@ -18,9 +18,9 @@ jobs:
     strategy:
       matrix:
         include:
-          - target: x86_64-unknown-linux-gnu
+          - target: x86_64-unknown-linux-musl
             artifact: stackdog-linux-x86_64
-          - target: aarch64-unknown-linux-gnu
+          - target: aarch64-unknown-linux-musl
             artifact: stackdog-linux-aarch64
 
     steps:

Cargo.toml

@@ -48,7 +48,7 @@ r2d2 = "0.8"
 bollard = "0.16"
 
 # HTTP client (for LLM API)
-reqwest = { version = "0.12", features = ["json", "blocking"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "blocking", "rustls-tls"] }
 
 # Compression
 zstd = "0.13"

docker/prod/Dockerfile

@@ -1,20 +1,17 @@
 # base image
-FROM debian:buster-slim
+FROM debian:bookworm-slim
 
-# create app directory
-RUN mkdir app
 WORKDIR /app
 
-# install libpq
-RUN apt-get update; \
-    apt-get install --no-install-recommends -y libpq-dev; \
+# install ca-certificates for HTTPS requests
+RUN apt-get update && \
+    apt-get install --no-install-recommends -y ca-certificates && \
     rm -rf /var/lib/apt/lists/*
 
 # copy binary and configuration files
 COPY ./stackdog .
 COPY ./.env .
-# expose port
+
 EXPOSE 5000
 
-# run the binary
 ENTRYPOINT ["/app/stackdog"]