feat(fips): integrate jmcorgan/fips as preferred non-Tor transport + v1.4.0

Bakes the FIPS (Free Internetworking Peering System) mesh daemon into
the node stack, supervised by archipelago alongside Tor. Runs as a
system service, identity derives from the same BIP-39 master seed, and
user-triggered updates track upstream main.

Identity
  seed.rs: new HKDF label archipelago/fips/secp256k1/v1 → dedicated
  secp256k1 key, distinct from the Nostr-node key for crypto isolation
  but still seed-recoverable
  identity.rs: writes fips_key[.pub] to /data/identity on onboarding,
  chmod 0600; fips_key_exists / load_fips_keys / fips_npub accessors

Transport
  TransportKind::Fips=3 inserted between LAN and Tor (Tor bumps to 4)
  → router prefers FIPS over Tor for all peer traffic
  PeerRecord gains fips_npub + last_fips fields (serde(default) for
  backward-compat with older nodes)
  transport/fips.rs: NodeTransport stub, reports unavailable until the
  daemon is live so router falls through to Tor cleanly

Federation invites
  FederatedNode and FederationInvite carry optional fips_npub
  create_invite / accept_invite / peer-joined callback thread it end
  to end; signature domain deliberately unchanged — FIPS Noise does
  its own session auth, so the unsigned hint only affects path
  selection

crate::fips
  config.rs: renders /etc/fips/fips.yaml and sudo-installs key material
  service.rs: systemctl status/activate/restart/mask wrappers
  update.rs: GitHub API check against upstream main; apply stubbed
  until per-commit .deb artefact source is decided

RPC + dashboard
  fips.status / fips.check-update / fips.apply-update / fips.install /
  fips.restart registered in dispatcher
  HomeNetworkCard.vue shipped standalone (unmounted — place in Home.vue
  when ready); shows state pill, version, FIPS npub, update button,
  activate button when key is present but service is down

ISO + systemd
  archipelago-fips.service: conditional on key presence, masked by
  default — backend unmasks after onboarding writes the key
  build-auto-installer-iso.sh: multi-stage Dockerfile builds the FIPS
  .deb from jmcorgan/fips main (fail-loud), COPYs it into rootfs, apt
  installs it so trixie resolves deps; unit copied + masked

Version bump: 1.3.5 → 1.4.0

Tests: 33 new/updated passing (seed, identity, transport, federation,
fips module, transport::fips).

Known gaps: fips.apply-update returns a clear stub error until
upstream publishes per-commit .deb artefacts; HomeNetworkCard is not
mounted in Home.vue by default.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/archipelago/src/fips/config.rs

@@ -0,0 +1,144 @@
+//! FIPS daemon config + key materialisation.
+//!
+//! Writes `/etc/fips/fips.yaml`, `/etc/fips/fips.key`, and
+//! `/etc/fips/fips.pub` from the archipelago node's seed-derived FIPS
+//! keypair, then chmod 0600 the private key.
+//!
+//! Privileged filesystem writes go through a `sudo install` invocation
+//! rather than opening `/etc/fips/*` directly — the archipelago service
+//! user cannot write `/etc` itself. The sudoers policy in the ISO
+//! whitelists `install` into `/etc/fips/`.
+
+use anyhow::{Context, Result};
+use std::path::Path;
+use tokio::process::Command;
+
+use super::{DAEMON_CONFIG_PATH, DAEMON_KEY_PATH, DAEMON_PUB_PATH, DEFAULT_UDP_PORT};
+
+/// Write the FIPS daemon config based on the local npub and default
+/// transports. Overwrites any existing file — callers are expected to
+/// re-run this whenever the key or daemon version changes.
+///
+/// Schema is intentionally minimal: node identity comes from the key
+/// file on disk (the daemon handles it), transports enable UDP + Tor,
+/// IPv6 TUN + DNS on defaults. Static peer list is empty — archipelago
+/// feeds peers dynamically via federation updates.
+pub fn render_config_yaml() -> String {
+    format!(
+        "# Generated by archipelago — do not edit by hand.\n\
+         # Regenerated on every key change and daemon upgrade.\n\
+         identity:\n  \
+         key_file: {key_path}\n  \
+         pub_file: {pub_path}\n\
+         transports:\n  \
+         udp:\n    \
+         enabled: true\n    \
+         port: {port}\n  \
+         tor:\n    \
+         enabled: true\n\
+         tun:\n  \
+         enabled: true\n\
+         dns:\n  \
+         enabled: true\n  \
+         suffix: .fips\n\
+         peers: []\n",
+        key_path = DAEMON_KEY_PATH,
+        pub_path = DAEMON_PUB_PATH,
+        port = DEFAULT_UDP_PORT,
+    )
+}
+
+/// Install the local FIPS key + rendered config into `/etc/fips/`.
+/// Requires the seed-derived key to already exist at `identity_dir/fips_key`.
+pub async fn install(identity_dir: &Path) -> Result<()> {
+    let src_key = identity_dir.join("fips_key");
+    let src_pub = identity_dir.join("fips_key.pub");
+    if !src_key.exists() {
+        anyhow::bail!(
+            "FIPS key not materialised at {} — run seed onboarding first",
+            src_key.display()
+        );
+    }
+
+    // Ensure /etc/fips exists with mode 0755.
+    sudo_install_dir("/etc/fips").await?;
+
+    // Render + write the yaml via a staging file the archipelago user owns,
+    // then `sudo install` it into place so we never need to write to
+    // /etc directly.
+    let yaml = render_config_yaml();
+    let stage = std::env::temp_dir().join(format!("fips-{}.yaml", std::process::id()));
+    tokio::fs::write(&stage, yaml)
+        .await
+        .context("Failed to stage fips.yaml")?;
+    let install_result = sudo_install_file(&stage, DAEMON_CONFIG_PATH, "0644").await;
+    let _ = tokio::fs::remove_file(&stage).await;
+    install_result?;
+
+    sudo_install_file(&src_key, DAEMON_KEY_PATH, "0600").await?;
+    sudo_install_file(&src_pub, DAEMON_PUB_PATH, "0644").await?;
+
+    Ok(())
+}
+
+async fn sudo_install_dir(path: &str) -> Result<()> {
+    let out = Command::new("sudo")
+        .args(["install", "-d", "-m", "0755", path])
+        .output()
+        .await
+        .with_context(|| format!("sudo install -d {}", path))?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "sudo install -d {}: {}",
+            path,
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    Ok(())
+}
+
+async fn sudo_install_file(src: &Path, dest: &str, mode: &str) -> Result<()> {
+    let out = Command::new("sudo")
+        .args([
+            "install",
+            "-m",
+            mode,
+            src.to_str().context("Non-UTF8 source path")?,
+            dest,
+        ])
+        .output()
+        .await
+        .with_context(|| format!("sudo install {} -> {}", src.display(), dest))?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "sudo install {} -> {}: {}",
+            src.display(),
+            dest,
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_rendered_yaml_contains_paths_and_port() {
+        let yaml = render_config_yaml();
+        assert!(yaml.contains(DAEMON_KEY_PATH));
+        assert!(yaml.contains(DAEMON_PUB_PATH));
+        assert!(yaml.contains(&DEFAULT_UDP_PORT.to_string()));
+        assert!(yaml.contains("udp:"));
+        assert!(yaml.contains("tor:"));
+        assert!(yaml.contains("tun:"));
+    }
+
+    #[tokio::test]
+    async fn test_install_refuses_when_key_missing() {
+        let dir = tempfile::tempdir().unwrap();
+        let err = install(dir.path()).await.unwrap_err();
+        assert!(err.to_string().contains("FIPS key not materialised"));
+    }
+}

core/archipelago/src/fips/mod.rs

@@ -0,0 +1,140 @@
+//! FIPS (Free Internetworking Peering System) daemon integration.
+//!
+//! github.com/jmcorgan/fips — a spanning-tree mesh routing protocol that
+//! uses Nostr secp256k1 keys as native node identity. Archipelago ships
+//! the daemon as an apt package, feeds it the seed-derived key from
+//! `/data/identity/fips_key`, and supervises it via
+//! `archipelago-fips.service`.
+//!
+//! This module is the in-process bridge:
+//!   - [`service`]: systemctl status / start / stop / restart / unmask.
+//!   - [`config`]: materialise `/etc/fips/fips.yaml` + install the key.
+//!   - [`update`]: query GitHub (tracking `main`) for a newer build,
+//!     verify SHA256, install via dpkg, restart.
+//!
+//! Privileged operations shell out via `sudo systemctl …` and `sudo dpkg …`
+//! (mirroring the vpn/update patterns already in the codebase); the
+//! sudoers rule shipped in the ISO whitelists exactly those commands for
+//! the `archipelago` service user.
+//!
+//! FIPS is dark on the wire until onboarding writes the key. Before that,
+//! `FipsStatus::installed` reports the package state and `service_active`
+//! returns false; the transport router keeps routing via Tor.
+
+// Consumers land in the next phase (RPC endpoints + onboarding hookup);
+// the module is deliberately API-ready ahead of those call-sites.
+#![allow(dead_code)]
+
+pub mod config;
+pub mod service;
+pub mod update;
+
+use serde::{Deserialize, Serialize};
+use std::path::{Path, PathBuf};
+
+/// Systemd unit name supervised by archipelago.
+pub const SERVICE_UNIT: &str = "archipelago-fips.service";
+
+/// Path the FIPS daemon reads its config from (Debian package default).
+pub const DAEMON_CONFIG_PATH: &str = "/etc/fips/fips.yaml";
+
+/// Path the FIPS daemon reads its private key from.
+pub const DAEMON_KEY_PATH: &str = "/etc/fips/fips.key";
+
+/// Path the FIPS daemon reads its public key from.
+pub const DAEMON_PUB_PATH: &str = "/etc/fips/fips.pub";
+
+/// Upstream repository the updater tracks (branch `main`).
+pub const UPSTREAM_REPO: &str = "jmcorgan/fips";
+
+/// Default UDP port the daemon listens on.
+pub const DEFAULT_UDP_PORT: u16 = 8668;
+
+/// Aggregated runtime status of the FIPS subsystem, surfaced to the dashboard.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct FipsStatus {
+    /// Whether the `fips` debian package is installed on the host.
+    pub installed: bool,
+    /// Installed daemon version string reported by `fipsctl --version`,
+    /// or None if not installed / not queryable.
+    pub version: Option<String>,
+    /// `systemctl is-active archipelago-fips.service` result: "active",
+    /// "inactive", "failed", "masked", "unknown".
+    pub service_state: String,
+    /// True iff service_state == "active".
+    pub service_active: bool,
+    /// Whether the seed-derived FIPS key has been materialised on disk.
+    /// The service cannot start meaningfully until this is true.
+    pub key_present: bool,
+    /// Local FIPS npub (bech32), present only once the key is on disk.
+    pub npub: Option<String>,
+}
+
+impl FipsStatus {
+    /// Snapshot the current state across package, key, and service.
+    pub async fn query(identity_dir: &Path) -> Self {
+        let installed = service::package_installed().await;
+        let version = if installed {
+            service::daemon_version().await.ok()
+        } else {
+            None
+        };
+        let service_state = service::unit_state(SERVICE_UNIT).await;
+        let service_active = service_state == "active";
+        let key_present = crate::identity::fips_key_exists(identity_dir);
+        let npub = crate::identity::fips_npub(identity_dir)
+            .await
+            .unwrap_or(None);
+
+        Self {
+            installed,
+            version,
+            service_state,
+            service_active,
+            key_present,
+            npub,
+        }
+    }
+}
+
+/// Compose a data-dir–relative identity directory path.
+/// Mirrors the convention used elsewhere in the codebase so callers don't
+/// have to repeat the `.join("identity")` each time.
+pub fn identity_dir_from(data_dir: &Path) -> PathBuf {
+    data_dir.join("identity")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn test_status_reports_no_key_pre_onboarding() {
+        let dir = tempfile::tempdir().unwrap();
+        let id_dir = dir.path().join("identity");
+        tokio::fs::create_dir_all(&id_dir).await.unwrap();
+
+        let status = FipsStatus::query(&id_dir).await;
+        assert!(!status.key_present, "no key before onboarding");
+        assert!(status.npub.is_none());
+        // `installed`, `service_state`, `version` depend on the host and are
+        // not asserted here — query() must return cleanly regardless.
+    }
+
+    #[test]
+    fn test_identity_dir_from() {
+        let data = Path::new("/var/lib/archipelago");
+        assert_eq!(
+            identity_dir_from(data),
+            Path::new("/var/lib/archipelago/identity")
+        );
+    }
+
+    #[test]
+    fn test_constants_have_expected_shape() {
+        assert!(SERVICE_UNIT.ends_with(".service"));
+        assert!(DAEMON_CONFIG_PATH.starts_with('/'));
+        assert!(DAEMON_KEY_PATH.starts_with('/'));
+        assert_eq!(UPSTREAM_REPO, "jmcorgan/fips");
+    }
+}

core/archipelago/src/fips/service.rs

@@ -0,0 +1,120 @@
+//! systemctl + dpkg-query helpers for the FIPS daemon.
+//!
+//! Read-only queries (`is-active`, `--version`, `dpkg-query`) run as the
+//! archipelago service user. Write operations (`unmask`, `start`, `stop`,
+//! `restart`) go through `sudo`, matching the pattern established in
+//! `src/vpn.rs` and `src/api/rpc/vpn.rs`. The sudoers rule shipped in the
+//! ISO whitelists exactly these invocations.
+
+use anyhow::{Context, Result};
+use tokio::process::Command;
+
+/// `systemctl is-active <unit>` → "active" / "inactive" / "failed" / "masked"
+/// / "unknown". Never errors; returns "unknown" on any failure.
+pub async fn unit_state(unit: &str) -> String {
+    match Command::new("systemctl")
+        .args(["is-active", unit])
+        .output()
+        .await
+    {
+        Ok(out) => {
+            let s = String::from_utf8_lossy(&out.stdout).trim().to_string();
+            if s.is_empty() {
+                "unknown".to_string()
+            } else {
+                s
+            }
+        }
+        Err(_) => "unknown".to_string(),
+    }
+}
+
+/// Whether the `fips` debian package is installed on the host.
+pub async fn package_installed() -> bool {
+    // dpkg-query -W -f='${Status}' fips → "install ok installed" when present.
+    let out = Command::new("dpkg-query")
+        .args(["-W", "-f=${Status}", "fips"])
+        .output()
+        .await;
+    match out {
+        Ok(o) if o.status.success() => {
+            String::from_utf8_lossy(&o.stdout).contains("install ok installed")
+        }
+        _ => false,
+    }
+}
+
+/// `fipsctl --version` output stripped of the "fipsctl " prefix if present.
+pub async fn daemon_version() -> Result<String> {
+    let out = Command::new("fipsctl")
+        .arg("--version")
+        .output()
+        .await
+        .context("fipsctl --version failed to launch")?;
+    if !out.status.success() {
+        anyhow::bail!("fipsctl exited with non-zero status");
+    }
+    let raw = String::from_utf8_lossy(&out.stdout).trim().to_string();
+    Ok(raw
+        .strip_prefix("fipsctl ")
+        .map(|s| s.to_string())
+        .unwrap_or(raw))
+}
+
+/// `sudo systemctl <verb> <unit>` — returns stderr on non-zero exit.
+async fn sudo_systemctl(verb: &str, unit: &str) -> Result<()> {
+    let out = Command::new("sudo")
+        .args(["systemctl", verb, unit])
+        .output()
+        .await
+        .with_context(|| format!("sudo systemctl {} {} failed to launch", verb, unit))?;
+    if !out.status.success() {
+        let stderr = String::from_utf8_lossy(&out.stderr).trim().to_string();
+        anyhow::bail!("systemctl {} {}: {}", verb, unit, stderr);
+    }
+    Ok(())
+}
+
+/// Unmask + start + enable the FIPS service. Idempotent — safe to call
+/// on every backend startup once the key is on disk.
+pub async fn activate(unit: &str) -> Result<()> {
+    // Order matters: unmask before enable/start, otherwise enable fails
+    // on a masked unit.
+    sudo_systemctl("unmask", unit).await?;
+    sudo_systemctl("enable", unit).await?;
+    sudo_systemctl("start", unit).await?;
+    Ok(())
+}
+
+pub async fn stop(unit: &str) -> Result<()> {
+    sudo_systemctl("stop", unit).await
+}
+
+pub async fn restart(unit: &str) -> Result<()> {
+    sudo_systemctl("restart", unit).await
+}
+
+pub async fn mask(unit: &str) -> Result<()> {
+    let _ = sudo_systemctl("stop", unit).await;
+    let _ = sudo_systemctl("disable", unit).await;
+    sudo_systemctl("mask", unit).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn test_unit_state_returns_string_for_bogus_unit() {
+        // Nonexistent unit: systemctl returns "inactive" or "unknown" — we
+        // just care that the helper doesn't panic and returns *something*.
+        let s = unit_state("archipelago-bogus-test.service").await;
+        assert!(!s.is_empty());
+    }
+
+    #[tokio::test]
+    async fn test_package_installed_is_bool() {
+        // Must not panic regardless of host state.
+        let _ = package_installed().await;
+    }
+}

core/archipelago/src/fips/update.rs

@@ -0,0 +1,130 @@
+//! User-triggered FIPS upgrade from upstream `main`.
+//!
+//! Flow (no auto-update, no background polling — user clicks a button):
+//!   1. Query GitHub for the latest commit on `main` of jmcorgan/fips.
+//!   2. Compare with the installed daemon version reported by
+//!      `fipsctl --version`. If identical, report "up to date".
+//!   3. Fetch the built .deb artefact for that commit + its SHA256.
+//!   4. SHA256-verify the download.
+//!   5. `sudo dpkg -i` the .deb, `sudo systemctl restart` the service.
+//!
+//! The artefact URL / SHA256 source is not yet fixed — upstream doesn't
+//! publish stable release assets for `main` builds. This module currently
+//! implements steps 1–2 (the "is there anything newer?" query) and stubs
+//! out 3–5 so the RPC/UI can wire through. The apply path returns a
+//! clear "not yet available" error until the artefact source is decided.
+
+use anyhow::{Context, Result};
+use serde::{Deserialize, Serialize};
+
+use super::{service, UPSTREAM_REPO};
+
+const GITHUB_API: &str = "https://api.github.com";
+const USER_AGENT: &str = "archipelago-fips-updater";
+
+/// Result of `check_update()` — what the dashboard renders.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct UpdateCheck {
+    /// Currently installed daemon version (from `fipsctl --version`).
+    pub current: Option<String>,
+    /// Short SHA of the latest commit on upstream `main`.
+    pub latest_commit: String,
+    /// True when the installed version string does not mention the latest SHA.
+    pub update_available: bool,
+    /// Human-readable note for the UI.
+    pub notes: String,
+}
+
+/// Query GitHub for the latest commit on `main` and compare to the
+/// installed version. Never errors on "no package installed" — that is
+/// itself a valid state where an update is available (install needed).
+pub async fn check() -> Result<UpdateCheck> {
+    let current = service::daemon_version().await.ok();
+    let latest = fetch_latest_main_sha().await?;
+    let short = latest.chars().take(7).collect::<String>();
+
+    let update_available = match &current {
+        Some(v) => !v.contains(&short),
+        None => true,
+    };
+
+    let notes = if update_available {
+        format!(
+            "Upstream main is at {}; installed: {}",
+            short,
+            current.as_deref().unwrap_or("not installed")
+        )
+    } else {
+        format!("Up to date ({})", short)
+    };
+
+    Ok(UpdateCheck {
+        current,
+        latest_commit: short,
+        update_available,
+        notes,
+    })
+}
+
+/// Apply the update. Stubbed pending a stable artefact source for
+/// per-commit builds of the `fips` debian package. When this is wired
+/// up it must: download → SHA256-verify → `sudo dpkg -i` → restart.
+pub async fn apply() -> Result<()> {
+    anyhow::bail!(
+        "FIPS auto-apply not yet wired — upstream does not publish stable \
+         per-commit .deb artefacts for main. Upgrade manually for now: \
+         `git pull && cargo deb && sudo dpkg -i target/debian/fips_*.deb`."
+    )
+}
+
+async fn fetch_latest_main_sha() -> Result<String> {
+    let url = format!("{}/repos/{}/commits/main", GITHUB_API, UPSTREAM_REPO);
+    let client = reqwest::Client::builder()
+        .user_agent(USER_AGENT)
+        .timeout(std::time::Duration::from_secs(15))
+        .build()
+        .context("Build HTTP client")?;
+    let resp = client
+        .get(&url)
+        .header("Accept", "application/vnd.github+json")
+        .send()
+        .await
+        .context("GitHub commits API")?;
+    if !resp.status().is_success() {
+        anyhow::bail!("GitHub API returned {}", resp.status());
+    }
+    let body: serde_json::Value = resp.json().await.context("Parse commits JSON")?;
+    let sha = body
+        .get("sha")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| anyhow::anyhow!("GitHub commits response missing sha field"))?;
+    Ok(sha.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn test_apply_returns_clear_stub_error() {
+        let err = apply().await.unwrap_err().to_string();
+        assert!(
+            err.contains("not yet wired"),
+            "apply() should return an explicit not-yet-wired error, got: {}",
+            err
+        );
+    }
+
+    #[test]
+    fn test_update_check_serialises() {
+        let uc = UpdateCheck {
+            current: Some("0.2.0-abc1234".to_string()),
+            latest_commit: "def5678".to_string(),
+            update_available: true,
+            notes: "test".to_string(),
+        };
+        let json = serde_json::to_string(&uc).unwrap();
+        assert!(json.contains("latest_commit"));
+        assert!(json.contains("update_available"));
+    }
+}