feat(fips): integrate jmcorgan/fips as preferred non-Tor transport + v1.4.0

Bakes the FIPS (Free Internetworking Peering System) mesh daemon into the node stack, supervised by archipelago alongside Tor. Runs as a system service, identity derives from the same BIP-39 master seed, and user-triggered updates track upstream main. Identity seed.rs: new HKDF label archipelago/fips/secp256k1/v1 → dedicated secp256k1 key, distinct from the Nostr-node key for crypto isolation but still seed-recoverable identity.rs: writes fips_key[.pub] to /data/identity on onboarding, chmod 0600; fips_key_exists / load_fips_keys / fips_npub accessors Transport TransportKind::Fips=3 inserted between LAN and Tor (Tor bumps to 4) → router prefers FIPS over Tor for all peer traffic PeerRecord gains fips_npub + last_fips fields (serde(default) for backward-compat with older nodes) transport/fips.rs: NodeTransport stub, reports unavailable until the daemon is live so router falls through to Tor cleanly Federation invites FederatedNode and FederationInvite carry optional fips_npub create_invite / accept_invite / peer-joined callback thread it end to end; signature domain deliberately unchanged — FIPS Noise does its own session auth, so the unsigned hint only affects path selection crate::fips config.rs: renders /etc/fips/fips.yaml and sudo-installs key material service.rs: systemctl status/activate/restart/mask wrappers update.rs: GitHub API check against upstream main; apply stubbed until per-commit .deb artefact source is decided RPC + dashboard fips.status / fips.check-update / fips.apply-update / fips.install / fips.restart registered in dispatcher HomeNetworkCard.vue shipped standalone (unmounted — place in Home.vue when ready); shows state pill, version, FIPS npub, update button, activate button when key is present but service is down ISO + systemd archipelago-fips.service: conditional on key presence, masked by default — backend unmasks after onboarding writes the key build-auto-installer-iso.sh: multi-stage Dockerfile builds the FIPS .deb from jmcorgan/fips main (fail-loud), COPYs it into rootfs, apt installs it so trixie resolves deps; unit copied + masked Version bump: 1.3.5 → 1.4.0 Tests: 33 new/updated passing (seed, identity, transport, federation, fips module, transport::fips). Known gaps: fips.apply-update returns a clear stub error until upstream publishes per-commit .deb artefacts; HomeNetworkCard is not mounted in Home.vue by default. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-18 22:57:51 -04:00
parent 46350f48b6
commit 30a7f73ead
22 changed files with 1353 additions and 39 deletions
@@ -6,12 +6,28 @@ use std::path::Path;
 use super::storage::{add_node, load_invites, load_nodes, save_invites, save_nodes};
 use super::types::{FederatedNode, FederationInvite, TrustLevel};

-/// Generate an invite code. Format: `fed1:<base64(json{did, onion, pubkey, token})>`
+/// Parsed contents of a federation invite code.
+#[derive(Debug, Clone)]
+pub struct ParsedInvite {
+    pub did: String,
+    pub onion: String,
+    pub pubkey: String,
+    /// Per-invite randomness; retained by parsers but not consumed
+    /// end-to-end — the outer signature binds the relationship.
+    #[allow(dead_code)]
+    pub token: String,
+    /// Inviter's FIPS npub if advertised in the code.
+    pub fips_npub: Option<String>,
+}
+
+/// Generate an invite code. Format: `fed1:<base64(json{did, onion, pubkey, token, fips_npub?})>`.
+/// `fips_npub` is only included when the local node has a materialised FIPS key.
 pub async fn create_invite(
    data_dir: &Path,
    did: &str,
    onion: &str,
    pubkey: &str,
+    fips_npub: Option<&str>,
 ) -> Result<String> {
    use base64::Engine;
    use rand::Rng;
@@ -20,12 +36,15 @@ pub async fn create_invite(
    rand::thread_rng().fill(&mut token_bytes);
    let token = hex::encode(token_bytes);

-    let payload = serde_json::json!({
+    let mut payload = serde_json::json!({
        "did": did,
        "onion": onion,
        "pubkey": pubkey,
        "token": token,
    });
+    if let Some(npub) = fips_npub {
+        payload["fips_npub"] = serde_json::Value::String(npub.to_string());
+    }
    let json = serde_json::to_string(&payload).context("Failed to serialize invite")?;
    let code = format!(
        "fed1:{}",
@@ -39,6 +58,7 @@ pub async fn create_invite(
        pubkey: pubkey.to_string(),
        created_at: chrono::Utc::now().to_rfc3339(),
        accepted: false,
+        fips_npub: fips_npub.map(|s| s.to_string()),
    };

    let mut invites = load_invites(data_dir).await?;
@@ -49,7 +69,7 @@ pub async fn create_invite(
 }

 /// Parse an invite code into its components.
-pub fn parse_invite(code: &str) -> Result<(String, String, String, String)> {
+pub fn parse_invite(code: &str) -> Result<ParsedInvite> {
    use base64::Engine;

    let encoded = code
@@ -79,8 +99,18 @@ pub fn parse_invite(code: &str) -> Result<(String, String, String, String)> {
        .as_str()
        .ok_or_else(|| anyhow::anyhow!("Missing token in invite"))?
        .to_string();
+    let fips_npub = payload
+        .get("fips_npub")
+        .and_then(|v| v.as_str())
+        .map(|s| s.to_string());

-    Ok((did, onion, pubkey, token))
+    Ok(ParsedInvite {
+        did,
+        onion,
+        pubkey,
+        token,
+        fips_npub,
+    })
 }

 /// Accept an invite: parse code, verify the remote node, add to federation.
@@ -90,9 +120,16 @@ pub async fn accept_invite(
    local_did: &str,
    local_onion: &str,
    local_pubkey: &str,
+    local_fips_npub: Option<&str>,
    sign_fn: impl FnOnce(&[u8]) -> String,
 ) -> Result<FederatedNode> {
-    let (did, onion, pubkey, _token) = parse_invite(code)?;
+    let ParsedInvite {
+        did,
+        onion,
+        pubkey,
+        token: _,
+        fips_npub,
+    } = parse_invite(code)?;

    // Make accept idempotent: drop any existing entry that conflicts with
    // this invite — same DID (same node, refreshing the link), same onion
@@ -125,6 +162,7 @@ pub async fn accept_invite(
        added_at: chrono::Utc::now().to_rfc3339(),
        last_seen: None,
        last_state: None,
+        fips_npub: fips_npub.clone(),
    };

    add_node(data_dir, node.clone()).await?;
@@ -138,11 +176,20 @@ pub async fn accept_invite(
        pubkey: node.pubkey.clone(),
        created_at: chrono::Utc::now().to_rfc3339(),
        accepted: true,
+        fips_npub,
    });
    save_invites(data_dir, &invites).await?;

    // Notify remote node (best-effort over Tor)
-    let _ = notify_join(&node.onion, local_did, local_onion, local_pubkey, sign_fn).await;
+    let _ = notify_join(
+        &node.onion,
+        local_did,
+        local_onion,
+        local_pubkey,
+        local_fips_npub,
+        sign_fn,
+    )
+    .await;

    Ok(node)
 }
@@ -154,6 +201,7 @@ async fn notify_join(
    local_did: &str,
    local_onion: &str,
    local_pubkey: &str,
+    local_fips_npub: Option<&str>,
    sign_fn: impl FnOnce(&[u8]) -> String,
 ) -> Result<()> {
    let host = if remote_onion.ends_with(".onion") {
@@ -164,17 +212,26 @@ async fn notify_join(
    let url = format!("http://{}/rpc/v1", host);

    // Sign the canonical message: "peer-joined:{did}:{onion}:{pubkey}"
+    // Signature domain intentionally unchanged — fips_npub is carried
+    // as an unsigned informational field. The FIPS daemon's own Noise
+    // handshake authenticates the actual transport session, so a
+    // stripped/substituted npub here merely downgrades the path to Tor.
    let sign_data = format!("peer-joined:{}:{}:{}", local_did, local_onion, local_pubkey);
    let signature = sign_fn(sign_data.as_bytes());

+    let mut params = serde_json::json!({
+        "did": local_did,
+        "onion": local_onion,
+        "pubkey": local_pubkey,
+        "signature": signature,
+    });
+    if let Some(npub) = local_fips_npub {
+        params["fips_npub"] = serde_json::Value::String(npub.to_string());
+    }
+
    let body = serde_json::json!({
        "method": "federation.peer-joined",
-        "params": {
-            "did": local_did,
-            "onion": local_onion,
-            "pubkey": local_pubkey,
-            "signature": signature,
-        }
+        "params": params,
    });

    let proxy =
@@ -197,16 +254,48 @@ mod tests {
    #[tokio::test]
    async fn test_create_and_parse_invite() {
        let dir = tempfile::tempdir().unwrap();
-        let code = create_invite(dir.path(), "did:key:z1", "test.onion", "aabbcc")
+        let code = create_invite(dir.path(), "did:key:z1", "test.onion", "aabbcc", None)
            .await
            .unwrap();
        assert!(code.starts_with("fed1:"));

-        let (did, onion, pubkey, token) = parse_invite(&code).unwrap();
-        assert_eq!(did, "did:key:z1");
-        assert_eq!(onion, "test.onion");
-        assert_eq!(pubkey, "aabbcc");
-        assert_eq!(token.len(), 32); // 16 bytes = 32 hex chars
+        let parsed = parse_invite(&code).unwrap();
+        assert_eq!(parsed.did, "did:key:z1");
+        assert_eq!(parsed.onion, "test.onion");
+        assert_eq!(parsed.pubkey, "aabbcc");
+        assert_eq!(parsed.token.len(), 32); // 16 bytes = 32 hex chars
+        assert!(parsed.fips_npub.is_none());
+    }
+
+    #[tokio::test]
+    async fn test_invite_roundtrips_fips_npub() {
+        let dir = tempfile::tempdir().unwrap();
+        let fips = "npub1fipstest0000000000000000000000000000000000";
+        let code = create_invite(dir.path(), "did:key:z1", "test.onion", "aabbcc", Some(fips))
+            .await
+            .unwrap();
+        let parsed = parse_invite(&code).unwrap();
+        assert_eq!(parsed.fips_npub.as_deref(), Some(fips));
+    }
+
+    #[tokio::test]
+    async fn test_parse_invite_tolerates_missing_fips() {
+        // Older invites minted before fips_npub existed must still parse.
+        use base64::Engine;
+        let legacy = serde_json::json!({
+            "did": "did:key:zOld",
+            "onion": "old.onion",
+            "pubkey": "00",
+            "token": "aa",
+        });
+        let code = format!(
+            "fed1:{}",
+            base64::engine::general_purpose::URL_SAFE_NO_PAD
+                .encode(serde_json::to_string(&legacy).unwrap())
+        );
+        let parsed = parse_invite(&code).unwrap();
+        assert_eq!(parsed.did, "did:key:zOld");
+        assert!(parsed.fips_npub.is_none());
    }

    #[test]
@@ -218,9 +307,15 @@ mod tests {
    #[tokio::test]
    async fn test_accept_invite_creates_node() {
        let dir = tempfile::tempdir().unwrap();
-        let code = create_invite(dir.path(), "did:key:zRemote", "remote.onion", "remotepub")
-            .await
-            .unwrap();
+        let code = create_invite(
+            dir.path(),
+            "did:key:zRemote",
+            "remote.onion",
+            "remotepub",
+            None,
+        )
+        .await
+        .unwrap();

        // Accept from a different "local" perspective
        let dir2 = tempfile::tempdir().unwrap();
@@ -230,6 +325,7 @@ mod tests {
            "did:key:zLocal",
            "local.onion",
            "localpub",
+            None,
            |_| "test-sig".to_string(),
        )
        .await
@@ -242,6 +338,36 @@ mod tests {
        assert_eq!(nodes.len(), 1);
    }

+    #[tokio::test]
+    async fn test_accept_invite_persists_fips_npub() {
+        let dir = tempfile::tempdir().unwrap();
+        let fips = "npub1remotefipsaddrxxxxxxxxxxxxxxxxxxxxxxxxxx";
+        let code = create_invite(
+            dir.path(),
+            "did:key:zRemote",
+            "remote.onion",
+            "remotepub",
+            Some(fips),
+        )
+        .await
+        .unwrap();
+
+        let dir2 = tempfile::tempdir().unwrap();
+        let node = accept_invite(
+            dir2.path(),
+            &code,
+            "did:key:zLocal",
+            "local.onion",
+            "localpub",
+            None,
+            |_| "test-sig".to_string(),
+        )
+        .await
+        .unwrap();
+
+        assert_eq!(node.fips_npub.as_deref(), Some(fips));
+    }
+
    #[tokio::test]
    async fn test_accept_invite_is_idempotent() {
        // Re-accepting the same invite is a no-op refresh — it must not
@@ -249,9 +375,15 @@ mod tests {
        // UI relies on: clicking "Join" twice or refreshing after an
        // identity rotation always converges to one entry.
        let dir = tempfile::tempdir().unwrap();
-        let code = create_invite(dir.path(), "did:key:zRemote", "remote.onion", "remotepub")
-            .await
-            .unwrap();
+        let code = create_invite(
+            dir.path(),
+            "did:key:zRemote",
+            "remote.onion",
+            "remotepub",
+            None,
+        )
+        .await
+        .unwrap();

        let dir2 = tempfile::tempdir().unwrap();
        accept_invite(
@@ -260,6 +392,7 @@ mod tests {
            "did:key:zLocal",
            "local.onion",
            "localpub",
+            None,
            |_| "test-sig".to_string(),
        )
        .await
@@ -271,6 +404,7 @@ mod tests {
            "did:key:zLocal",
            "local.onion",
            "localpub",
+            None,
            |_| "test-sig".to_string(),
        )
        .await
@@ -172,6 +172,7 @@ mod tests {
            added_at: "2026-01-01T00:00:00Z".to_string(),
            last_seen: None,
            last_state: None,
+            fips_npub: None,
        }
    }

@@ -35,6 +35,10 @@ pub struct FederatedNode {
    pub last_seen: Option<String>,
    #[serde(default)]
    pub last_state: Option<NodeStateSnapshot>,
+    /// FIPS mesh npub (bech32) for this peer, when they advertise one.
+    /// Lets the transport router prefer FIPS over Tor for peer traffic.
+    #[serde(default)]
+    pub fips_npub: Option<String>,
 }

 /// State snapshot received from a federated peer during sync.
@@ -85,6 +89,9 @@ pub struct FederationInvite {
    pub created_at: String,
    #[serde(default)]
    pub accepted: bool,
+    /// Inviter's FIPS mesh npub if advertised in the code.
+    #[serde(default)]
+    pub fips_npub: Option<String>,
 }

 #[cfg(test)]
@@ -111,12 +118,28 @@ mod tests {
            added_at: "2026-01-01T00:00:00Z".to_string(),
            last_seen: None,
            last_state: None,
+            fips_npub: None,
        };
        let json = serde_json::to_string(&node).unwrap();
        let parsed: FederatedNode = serde_json::from_str(&json).unwrap();
        assert_eq!(parsed.did, "did:key:zABC");
        assert_eq!(parsed.trust_level, TrustLevel::Trusted);
        assert!(parsed.last_state.is_none());
+        assert!(parsed.fips_npub.is_none());
+    }
+
+    #[test]
+    fn test_federated_node_deserializes_without_fips_field() {
+        // Backward compat: nodes on older versions omit fips_npub entirely.
+        let json = r#"{
+            "did": "did:key:zOld",
+            "pubkey": "0011",
+            "onion": "old.onion",
+            "trust_level": "trusted",
+            "added_at": "2026-01-01T00:00:00Z"
+        }"#;
+        let parsed: FederatedNode = serde_json::from_str(json).unwrap();
+        assert!(parsed.fips_npub.is_none());
    }

    #[test]