Add local Debian package build

.dockerignore

@@ -0,0 +1,3 @@
+.git
+target
+dist

.gitignore

@@ -2,6 +2,7 @@
 # will have compiled files and executables
 debug
 target
+dist
 
 # These are backup files generated by rustfmt
 **/*.rs.bk

Makefile

@@ -0,0 +1,36 @@
+SHELL := /bin/sh
+
+CONTAINER_ENGINE ?= $(shell command -v podman 2>/dev/null || command -v docker 2>/dev/null)
+ifeq ($(origin PACKAGE_VERSION),undefined)
+PACKAGE_VERSION := $(shell ./scripts/package-version)
+endif
+DEB_OUTPUT_DIR ?= dist
+BUILDER_IMAGE ?= monad-services-builder:local
+
+.PHONY: build builder deb deb-host clean
+
+build:
+	./scripts/build-binaries
+
+# Needs the docker/builder toolchain on the host; `make deb` needs only a container engine.
+deb-host:
+	PACKAGE_VERSION=$(PACKAGE_VERSION) DEB_OUTPUT_DIR=$(DEB_OUTPUT_DIR) ./scripts/build-deb
+
+builder:
+	@test -n "$(CONTAINER_ENGINE)" || { echo "Install Docker or Podman, or set CONTAINER_ENGINE."; exit 1; }
+	$(CONTAINER_ENGINE) build -t $(BUILDER_IMAGE) -f docker/builder/Dockerfile .
+
+deb: builder
+	@mkdir -p $(DEB_OUTPUT_DIR); iidfile=$$(mktemp); \
+	trap 'rm -f "$$iidfile"' EXIT; \
+	$(CONTAINER_ENGINE) build \
+		--iidfile "$$iidfile" \
+		--build-arg BUILDER_IMAGE=$(BUILDER_IMAGE) \
+		--build-arg PACKAGE_VERSION=$(PACKAGE_VERSION) \
+		-f docker/debian-package/Dockerfile . && \
+	container_id=$$($(CONTAINER_ENGINE) create "$$(cat "$$iidfile")" true) && \
+	trap '$(CONTAINER_ENGINE) rm -f $$container_id >/dev/null; rm -f "$$iidfile"' EXIT && \
+	$(CONTAINER_ENGINE) cp "$$container_id":/out/. $(DEB_OUTPUT_DIR)
+
+clean:
+	rm -rf $(DEB_OUTPUT_DIR)

debian/DEBIAN/conffiles

@@ -0,0 +1 @@
+/etc/monad-services/env

debian/DEBIAN/control.in

@@ -0,0 +1,10 @@
+Package: monad-services
+Version: @PACKAGE_VERSION@
+Section: net
+Priority: optional
+Architecture: amd64
+Maintainer: Category Labs <engineering@category.xyz>
+Depends: @DEPENDS@, ca-certificates
+Description: Monad archive and indexing services
+ Archive, validation, indexing, and block-writing binaries maintained by the
+ monad-services repository.

debian/DEBIAN/postinst

@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+
+case "$1" in
+  configure)
+    if [ -d /run/systemd/system ]; then
+      systemctl daemon-reload || true
+    fi
+    ;;
+esac

debian/DEBIAN/postrm

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eu
+
+case "$1" in
+  remove|purge)
+    if [ -d /run/systemd/system ]; then
+      systemctl daemon-reload || true
+      for unit in monad-services-archiver monad-services-archive-checker monad-services-indexer monad-services-block-writer; do
+        systemctl reset-failed "$unit.service" >/dev/null 2>&1 || true
+      done
+    fi
+    ;;
+esac

debian/DEBIAN/prerm

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -eu
+
+case "$1" in
+  remove|deconfigure)
+    if [ -d /run/systemd/system ]; then
+      for unit in monad-services-archiver monad-services-archive-checker monad-services-indexer monad-services-block-writer; do
+        systemctl stop "$unit.service" || true
+      done
+    fi
+    ;;
+esac

debian/etc/monad-services/env

@@ -0,0 +1,3 @@
+# Configuration for the monad-services units. Variables set here are
+# expanded into each unit's ExecStart line; a unit fails to start when a
+# variable it names is missing.

debian/usr/lib/systemd/system/monad-services-archive-checker.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Monad Archive Checker (monad-services)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=monad
+Group=monad
+EnvironmentFile=-/etc/monad-services/env
+ExecStart=/usr/lib/monad-services/monad-archive-checker
+Restart=always
+RestartSec=5
+LimitNOFILE=1048576
+
+[Install]
+WantedBy=multi-user.target

debian/usr/lib/systemd/system/monad-services-archiver.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Monad Archiver (monad-services)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=monad
+Group=monad
+EnvironmentFile=-/etc/monad-services/env
+ExecStart=/usr/lib/monad-services/monad-archiver
+Restart=always
+RestartSec=5
+LimitNOFILE=1048576
+
+[Install]
+WantedBy=multi-user.target

debian/usr/lib/systemd/system/monad-services-block-writer.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Monad Block Writer (monad-services)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=monad
+Group=monad
+EnvironmentFile=-/etc/monad-services/env
+ExecStart=/usr/lib/monad-services/monad-block-writer
+Restart=always
+RestartSec=5
+LimitNOFILE=1048576
+
+[Install]
+WantedBy=multi-user.target

debian/usr/lib/systemd/system/monad-services-indexer.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Monad Indexer (monad-services)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=monad
+Group=monad
+EnvironmentFile=-/etc/monad-services/env
+ExecStart=/usr/lib/monad-services/monad-indexer
+Restart=always
+RestartSec=5
+LimitNOFILE=1048576
+
+[Install]
+WantedBy=multi-user.target

debian/usr/share/doc/monad-services/copyright

@@ -0,0 +1,9 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: monad-services
+Source: https://github.com/category-labs/monad-services
+
+Files: *
+Copyright: 2026 Category Labs, Inc.
+License: GPL-3
+ On Debian systems, the complete text of the GNU General Public
+ License version 3 can be found in /usr/share/common-licenses/GPL-3.

docker/builder/Dockerfile

@@ -0,0 +1,30 @@
+FROM ubuntu:26.04
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    RUSTUP_HOME=/usr/local/rustup \
+    CARGO_HOME=/usr/local/cargo \
+    PATH=/usr/local/cargo/bin:${PATH} \
+    CC=gcc-15 \
+    CXX=g++-15 \
+    LIBCLANG_PATH=/usr/lib/llvm-19/lib \
+    CMAKE_GENERATOR=Ninja \
+    TRIEDB_TARGET=triedb_driver \
+    ASMFLAGS=-march=haswell \
+    CFLAGS=-march=haswell \
+    CXXFLAGS=-march=haswell
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      binutils ca-certificates clang-19 cmake curl g++-15 gcc-15 git \
+      libabsl-dev libarchive-dev libbenchmark-dev libboost-all-dev libbrotli-dev libcap-dev \
+      libcgroup-dev libclang-19-dev libcli11-dev libcrypto++-dev libgmp-dev \
+      libgmock-dev libgtest-dev libhugetlbfs-dev libmagicenum-dev libmimalloc-dev \
+      libsecp256k1-dev libssl-dev \
+      libstdc++-15-dev libtbb-dev liburing-dev libzstd-dev ninja-build pkg-config \
+    && rm -rf /var/lib/apt/lists/*
+
+# The toolchain version comes from rust-toolchain.toml, which the rustup
+# shims on PATH also consult at cargo time, so image and build can't drift.
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+      | sh -s -- -y --profile minimal --default-toolchain none
+COPY rust-toolchain.toml /tmp/rust-toolchain/rust-toolchain.toml
+RUN cd /tmp/rust-toolchain && rustup toolchain install && rm -rf /tmp/rust-toolchain

docker/debian-package/Dockerfile

@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1
+
+# Toolchain comes from docker/builder/Dockerfile. `make deb` builds it
+# locally; override to reuse a prebuilt copy.
+ARG BUILDER_IMAGE=monad-services-builder:local
+FROM ${BUILDER_IMAGE} AS package
+
+ARG PACKAGE_VERSION
+ENV DEBIAN_FRONTEND=noninteractive \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true
+
+# Only what docker/builder does not already carry: build-essential for the
+# packaging tools (including dpkg-shlibdeps) and patchelf for runpaths.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      build-essential patchelf \
+    && rm -rf /var/lib/apt/lists/*
+
+# .dockerignore strips .git, so scripts/package-version cannot run here.
+RUN test -n "$PACKAGE_VERSION"
+
+WORKDIR /src
+COPY . .
+
+RUN --mount=type=cache,id=monad-services-cargo-registry,target=/usr/local/cargo/registry \
+    --mount=type=cache,id=monad-services-cargo-git,target=/usr/local/cargo/git \
+    --mount=type=cache,id=monad-services-target,target=/src/target \
+    PACKAGE_VERSION="${PACKAGE_VERSION}" DEB_OUTPUT_DIR=/out ./scripts/build-deb
+
+FROM scratch
+COPY --from=package /out /out

scripts/build-binaries

@@ -0,0 +1,25 @@
+#!/usr/bin/env sh
+set -eu
+
+root_dir=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+
+# --- toolchain (matches the release build, in docker/debian-package/Dockerfile) ---
+export CC="${CC:-gcc-15}"
+export CXX="${CXX:-g++-15}"
+export CMAKE_GENERATOR="${CMAKE_GENERATOR:-Ninja}"
+# monad-triedb's build script builds libtriedb_driver.so from this target.
+export TRIEDB_TARGET="${TRIEDB_TARGET:-triedb_driver}"
+# Arch flags reach the cargo build only; the cmake toolchain file owns its own.
+asmflags="${ASMFLAGS:--march=haswell}"
+cflags="${CFLAGS:--march=haswell}"
+cxxflags="${CXXFLAGS:--march=haswell}"
+
+cd "$root_dir"
+
+# --- rust binaries ---
+# monad-triedb and the execution bindings it needs are built by Cargo build
+# scripts out of the pinned monad-bft git dependency; there is no local
+# execution checkout to build separately.
+ASMFLAGS="$asmflags" CFLAGS="$cflags" \
+CXXFLAGS="$cxxflags -DQUILL_ACTIVE_LOG_LEVEL=QUILL_LOG_LEVEL_CRITICAL" \
+cargo build --locked --release --package monad-archive --bins