Complete the self-hosted Signal service with sealed stores and ACK delivery

.dockerignore

@@ -0,0 +1,10 @@
+.git
+.github
+target
+tests
+docs
+*.toml
+!Cargo.toml
+*.log
+*.sqlite*
+deployment-*

.github/workflows/native.yml

@@ -0,0 +1,55 @@
+name: Signal service native checks
+on:
+  push:
+  pull_request:
+permissions:
+  contents: read
+concurrency:
+  group: signal-service-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  native:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        toolchain: ['1.94.0', stable]
+    services:
+      postgres:
+        image: postgres:16.11-alpine
+        env:
+          POSTGRES_DB: signal_node_tests
+          POSTGRES_USER: signal_node_tests
+          POSTGRES_HOST_AUTH_METHOD: trust
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U signal_node_tests -d signal_node_tests"
+          --health-interval 5s --health-timeout 5s --health-retries 10
+    env:
+      SIGNAL_NODE_TEST_POSTGRES_URL: postgres://signal_node_tests@127.0.0.1:5432/signal_node_tests
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: ${{ matrix.toolchain }}
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: signal-service-${{ matrix.toolchain }}
+      - run: cargo +${{ matrix.toolchain }} fmt --all --check
+      - run: cargo +${{ matrix.toolchain }} clippy --all-targets --locked -- -D warnings
+      - run: cargo +${{ matrix.toolchain }} test --all-targets --locked
+      - run: cargo +${{ matrix.toolchain }} test --doc --locked
+      - run: cargo +${{ matrix.toolchain }} build --release --locked
+      - run: ./target/release/signal-node --version
+  container:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - run: docker build --tag signal-node:ci .
+      - run: docker run --rm --read-only --cap-drop ALL --security-opt no-new-privileges signal-node:ci --version

.gitignore

@@ -0,0 +1 @@
+target/