build(rust): enable fat lto and one codegen unit in release (#2185)

Cargo.toml

@@ -25,3 +25,8 @@ resolver = "2"
 [workspace.package]
 edition = "2024"
 license = "AGPL-3.0-or-later"
+
+[profile.release]
+lto = "fat"
+codegen-units = 1
+strip = "symbols"

fluxer_admin/Dockerfile

@@ -37,6 +37,11 @@ RUN printf '%s\n' \
 	'[workspace.package]' \
 	'edition = "2024"' \
 	'license = "AGPL-3.0-or-later"' \
+	'' \
+	'[profile.release]' \
+	'lto = "fat"' \
+	'codegen-units = 1' \
+	'strip = "symbols"' \
 	> Cargo.toml
 
 ENV FLUXER_BUILD_VERSION="${BUILD_VERSION}"

fluxer_app_proxy/Dockerfile

@@ -127,6 +127,11 @@ RUN printf '%s\n' \
 	'[workspace.package]' \
 	'edition = "2024"' \
 	'license = "AGPL-3.0-or-later"' \
+	'' \
+	'[profile.release]' \
+	'lto = "fat"' \
+	'codegen-units = 1' \
+	'strip = "symbols"' \
 	> Cargo.toml
 
 RUN if [ "${FLUXER_APP_PROXY_TIME_FREEZE_ENABLED}" = "false" ]; then \

tools/ci/src/app_proxy.rs

@@ -452,6 +452,33 @@ mod tests {
         );
     }
 
+    #[test]
+    fn dockerfile_workspace_manifest_keeps_the_release_profile() {
+        let dockerfile = include_str!("../../../fluxer_app_proxy/Dockerfile");
+        let manifest = dockerfile
+            .split("'[workspace]'")
+            .nth(1)
+            .expect("synthesized workspace manifest")
+            .split("> Cargo.toml")
+            .next()
+            .expect("synthesized workspace manifest body");
+        for entry in [
+            "'[profile.release]'",
+            "'lto = \"fat\"'",
+            "'codegen-units = 1'",
+            "'strip = \"symbols\"'",
+        ] {
+            assert!(
+                manifest.contains(entry),
+                "the rust-builder workspace manifest replaces the repository root one, so it must carry {entry}"
+            );
+        }
+        assert!(
+            !manifest.contains("panic"),
+            "fluxer_svc runs every request on its own tokio task, so a panicking handler must unwind instead of aborting the pod"
+        );
+    }
+
     #[test]
     fn asset_manifest_entries_are_sorted_and_relative_to_dist() {
         let temp = tempfile::tempdir().unwrap();