DorianandClaude Opus 4.7
30a7f73ead
Bakes the FIPS (Free Internetworking Peering System) mesh daemon into the node stack, supervised by archipelago alongside Tor. Runs as a system service, identity derives from the same BIP-39 master seed, and user-triggered updates track upstream main. Identity seed.rs: new HKDF label archipelago/fips/secp256k1/v1 → dedicated secp256k1 key, distinct from the Nostr-node key for crypto isolation but still seed-recoverable identity.rs: writes fips_key[.pub] to /data/identity on onboarding, chmod 0600; fips_key_exists / load_fips_keys / fips_npub accessors Transport TransportKind::Fips=3 inserted between LAN and Tor (Tor bumps to 4) → router prefers FIPS over Tor for all peer traffic PeerRecord gains fips_npub + last_fips fields (serde(default) for backward-compat with older nodes) transport/fips.rs: NodeTransport stub, reports unavailable until the daemon is live so router falls through to Tor cleanly Federation invites FederatedNode and FederationInvite carry optional fips_npub create_invite / accept_invite / peer-joined callback thread it end to end; signature domain deliberately unchanged — FIPS Noise does its own session auth, so the unsigned hint only affects path selection crate::fips config.rs: renders /etc/fips/fips.yaml and sudo-installs key material service.rs: systemctl status/activate/restart/mask wrappers update.rs: GitHub API check against upstream main; apply stubbed until per-commit .deb artefact source is decided RPC + dashboard fips.status / fips.check-update / fips.apply-update / fips.install / fips.restart registered in dispatcher HomeNetworkCard.vue shipped standalone (unmounted — place in Home.vue when ready); shows state pill, version, FIPS npub, update button, activate button when key is present but service is down ISO + systemd archipelago-fips.service: conditional on key presence, masked by default — backend unmasks after onboarding writes the key build-auto-installer-iso.sh: multi-stage Dockerfile builds the FIPS .deb from jmcorgan/fips main (fail-loud), COPYs it into rootfs, apt installs it so trixie resolves deps; unit copied + masked Version bump: 1.3.5 → 1.4.0 Tests: 33 new/updated passing (seed, identity, transport, federation, fips module, transport::fips). Known gaps: fips.apply-update returns a clear stub error until upstream publishes per-commit .deb artefacts; HomeNetworkCard is not mounted in Home.vue by default. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
48 lines
1.9 KiB
Rust
48 lines
1.9 KiB
Rust
//! RPC handlers for the FIPS mesh transport subsystem.
|
|
//!
|
|
//! Surface is deliberately thin: a read-only `fips.status`, a user-gated
|
|
//! `fips.check-update`, a stubbed `fips.apply-update`, and a
|
|
//! `fips.install` that (re-)materialises the daemon config + key and
|
|
//! activates the service. All writes go through `sudo` helpers in
|
|
//! `crate::fips`.
|
|
|
|
use super::RpcHandler;
|
|
use crate::fips;
|
|
use anyhow::Result;
|
|
|
|
impl RpcHandler {
|
|
pub(super) async fn handle_fips_status(&self) -> Result<serde_json::Value> {
|
|
let identity_dir = fips::identity_dir_from(&self.config.data_dir);
|
|
let status = fips::FipsStatus::query(&identity_dir).await;
|
|
Ok(serde_json::to_value(status)?)
|
|
}
|
|
|
|
pub(super) async fn handle_fips_check_update(&self) -> Result<serde_json::Value> {
|
|
let check = fips::update::check().await?;
|
|
Ok(serde_json::to_value(check)?)
|
|
}
|
|
|
|
pub(super) async fn handle_fips_apply_update(&self) -> Result<serde_json::Value> {
|
|
fips::update::apply().await?;
|
|
Ok(serde_json::json!({ "applied": true }))
|
|
}
|
|
|
|
/// Install config + key into /etc/fips and activate the service.
|
|
/// Intended to be called:
|
|
/// - once by the seed-onboarding flow, right after the FIPS key
|
|
/// is written to /data/identity/fips_key, and
|
|
/// - on user demand from the dashboard if something drifted.
|
|
pub(super) async fn handle_fips_install(&self) -> Result<serde_json::Value> {
|
|
let identity_dir = fips::identity_dir_from(&self.config.data_dir);
|
|
fips::config::install(&identity_dir).await?;
|
|
fips::service::activate(fips::SERVICE_UNIT).await?;
|
|
let status = fips::FipsStatus::query(&identity_dir).await;
|
|
Ok(serde_json::to_value(status)?)
|
|
}
|
|
|
|
pub(super) async fn handle_fips_restart(&self) -> Result<serde_json::Value> {
|
|
fips::service::restart(fips::SERVICE_UNIT).await?;
|
|
Ok(serde_json::json!({ "restarted": true }))
|
|
}
|
|
}
|