feat(fips): integrate jmcorgan/fips as preferred non-Tor transport + v1.4.0
Bakes the FIPS (Free Internetworking Peering System) mesh daemon into the node stack, supervised by archipelago alongside Tor. Runs as a system service, identity derives from the same BIP-39 master seed, and user-triggered updates track upstream main. Identity seed.rs: new HKDF label archipelago/fips/secp256k1/v1 → dedicated secp256k1 key, distinct from the Nostr-node key for crypto isolation but still seed-recoverable identity.rs: writes fips_key[.pub] to /data/identity on onboarding, chmod 0600; fips_key_exists / load_fips_keys / fips_npub accessors Transport TransportKind::Fips=3 inserted between LAN and Tor (Tor bumps to 4) → router prefers FIPS over Tor for all peer traffic PeerRecord gains fips_npub + last_fips fields (serde(default) for backward-compat with older nodes) transport/fips.rs: NodeTransport stub, reports unavailable until the daemon is live so router falls through to Tor cleanly Federation invites FederatedNode and FederationInvite carry optional fips_npub create_invite / accept_invite / peer-joined callback thread it end to end; signature domain deliberately unchanged — FIPS Noise does its own session auth, so the unsigned hint only affects path selection crate::fips config.rs: renders /etc/fips/fips.yaml and sudo-installs key material service.rs: systemctl status/activate/restart/mask wrappers update.rs: GitHub API check against upstream main; apply stubbed until per-commit .deb artefact source is decided RPC + dashboard fips.status / fips.check-update / fips.apply-update / fips.install / fips.restart registered in dispatcher HomeNetworkCard.vue shipped standalone (unmounted — place in Home.vue when ready); shows state pill, version, FIPS npub, update button, activate button when key is present but service is down ISO + systemd archipelago-fips.service: conditional on key presence, masked by default — backend unmasks after onboarding writes the key build-auto-installer-iso.sh: multi-stage Dockerfile builds the FIPS .deb from jmcorgan/fips main (fail-loud), COPYs it into rootfs, apt installs it so trixie resolves deps; unit copied + masked Version bump: 1.3.5 → 1.4.0 Tests: 33 new/updated passing (seed, identity, transport, federation, fips module, transport::fips). Known gaps: fips.apply-update returns a clear stub error until upstream publishes per-commit .deb artefacts; HomeNetworkCard is not mounted in Home.vue by default. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Dorian
co-authored by
Claude Opus 4.7
Claude Opus 4.7
parent
f04804ae25
commit
c1cfca6212
@@ -239,6 +239,27 @@ if [ ! -f "$ROOTFS_TAR" ] || [ "$1" == "--rebuild" ]; then
|
||||
|
||||
# Create a Dockerfile for building the rootfs
|
||||
cat > "$WORK_DIR/Dockerfile.rootfs" <<DOCKERFILE
|
||||
# ─── Stage 1: Build the FIPS mesh daemon .deb from upstream main ─────────
|
||||
#
|
||||
# FIPS (github.com/jmcorgan/fips) is a fast Nostr-keyed mesh routing
|
||||
# protocol archipelago uses as its preferred non-Tor transport. We track
|
||||
# upstream main per project decision (2026-04) — v0.2.0 isn't stable yet.
|
||||
# The .deb is rebuilt every ISO build; Docker layer caching keeps the
|
||||
# incremental cost low. Failure here fails the ISO build on purpose:
|
||||
# we don't want to ship an ISO that silently skips FIPS.
|
||||
FROM rust:1-slim-bookworm AS fips-builder
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \\
|
||||
git ca-certificates build-essential pkg-config dpkg-dev \\
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
RUN cargo install --locked cargo-deb
|
||||
RUN git clone --depth 1 https://github.com/jmcorgan/fips.git /src/fips
|
||||
WORKDIR /src/fips
|
||||
RUN cargo build --release
|
||||
RUN cargo deb --no-build
|
||||
RUN cp target/debian/fips_*_amd64.deb /tmp/fips.deb
|
||||
|
||||
# ─── Stage 2: The actual Archipelago rootfs ──────────────────────────────
|
||||
FROM debian:trixie
|
||||
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
@@ -329,6 +350,12 @@ RUN curl -fsSL https://pkgs.tailscale.com/stable/debian/trixie.noarmor.gpg | tee
|
||||
apt-get update && apt-get install -y --no-install-recommends tailscale && \
|
||||
apt-get clean && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Install FIPS mesh daemon from the .deb built in stage 1. apt-get install
|
||||
# resolves dependencies from trixie so a cross-dist build still lands cleanly.
|
||||
COPY --from=fips-builder /tmp/fips.deb /tmp/fips.deb
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends /tmp/fips.deb && \
|
||||
apt-get clean && rm -rf /var/lib/apt/lists/* && rm /tmp/fips.deb
|
||||
|
||||
# Configure locale
|
||||
RUN echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen
|
||||
|
||||
@@ -377,6 +404,7 @@ COPY archipelago-tor-helper.path /etc/systemd/system/archipelago-tor-helper.path
|
||||
COPY nostr-vpn.service /etc/systemd/system/nostr-vpn.service
|
||||
COPY archipelago-wg.service /etc/systemd/system/archipelago-wg.service
|
||||
COPY archipelago-wg-address.service /etc/systemd/system/archipelago-wg-address.service
|
||||
COPY archipelago-fips.service /etc/systemd/system/archipelago-fips.service
|
||||
COPY nostr-relay.service /etc/systemd/system/nostr-relay.service
|
||||
COPY nostr-relay-config.toml /etc/archipelago/nostr-relay-config.toml
|
||||
|
||||
@@ -416,6 +444,11 @@ RUN systemctl enable NetworkManager || true && \
|
||||
# archipelago-wg + wg-address: enabled by first-boot after WG key is generated
|
||||
# nostr-vpn: enabled by first-boot after Nostr identity is generated
|
||||
# (env file doesn't exist until onboarding, so pre-enabling causes crash-loop)
|
||||
# archipelago-fips: masked by default; archipelago backend unmasks +
|
||||
# starts it via `fips.install` RPC once the seed-derived fips_key is on
|
||||
# disk and the fips daemon package is installed. Pre-onboarding the node
|
||||
# stays dark on FIPS so no traffic leaves an ephemeral identity.
|
||||
RUN systemctl mask archipelago-fips.service || true
|
||||
|
||||
# Remove policy-rc.d so services can start on first boot
|
||||
RUN rm -f /usr/sbin/policy-rc.d
|
||||
@@ -517,6 +550,10 @@ NGINXCONF
|
||||
cp "$SCRIPT_DIR/configs/archipelago-wg-address.service" "$WORK_DIR/archipelago-wg-address.service"
|
||||
echo " Using archipelago-wg-address.service from configs/"
|
||||
fi
|
||||
if [ -f "$SCRIPT_DIR/configs/archipelago-fips.service" ]; then
|
||||
cp "$SCRIPT_DIR/configs/archipelago-fips.service" "$WORK_DIR/archipelago-fips.service"
|
||||
echo " Using archipelago-fips.service from configs/"
|
||||
fi
|
||||
|
||||
# Copy private Nostr relay service (native, for NostrVPN signaling)
|
||||
if [ -f "$SCRIPT_DIR/configs/nostr-relay.service" ]; then
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
[Unit]
|
||||
Description=Archipelago FIPS mesh transport (wraps upstream fips daemon)
|
||||
# Stay dark until onboarding materialises the seed-derived key. Archipelago
|
||||
# backend unmasks + starts this unit via `sudo systemctl` once the key is
|
||||
# present; pre-onboarding the unit must be masked so no traffic is sent
|
||||
# from an ephemeral identity.
|
||||
ConditionPathExists=/var/lib/archipelago/identity/fips_key
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
ExecStartPre=/bin/sh -c 'test -x /usr/bin/fips || { echo "fips daemon not installed — run fips.install from dashboard" >&2; exit 1; }'
|
||||
ExecStart=/usr/bin/fips --config /etc/fips/fips.yaml
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
# UDP 8668 is reachable on all interfaces by default; the daemon does its
|
||||
# own Noise authentication so no firewall gate is added here.
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
Reference in New Issue
Block a user