laantungir/fips
1
0
Fork 0
mirror of https://github.com/jmcorgan/fips.git synced 2026-07-30 19:46:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: replace real IPs in docs and configs with placeholders

Browse Source 
Operator-facing IPs in user-visible configs/docs (examples, tutorials,
packaging, sidecar templates) are now the resolvable hostnames of the
public test fleet (test-us01.fips.network, etc.) so they keep working
without baking specific addresses into examples.

Doc-comment and test fixtures in src/config/transport.rs use RFC 5737
TEST-NET-2 (198.51.100.1) so they cannot accidentally point at a real
host.

Also resyncs the openwrt-ipk fips.yaml with the common reference
(merge from master) and applies the same DNS-name swap there.
This commit is contained in:
Arjen
2026-05-11 18:43:06 +01:00
parent b6bd28f77c
commit 733ee512d3
14 changed files with 35 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+2 -2
View File
@@ -535,9 +535,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
directly is impossible (1:1 NAT) directly is impossible (1:1 NAT)
- New `external_addr` field on `transports.udp.*` and - New `external_addr` field on `transports.udp.*` and
`transports.tcp.*` for explicit advertise-as override. Accepts `transports.tcp.*` for explicit advertise-as override. Accepts
either a bare IP (`"54.183.70.180"` — the configured `bind_addr` either a bare IP (`"198.51.100.1"` — the configured `bind_addr`
port is appended) or a full `host:port` port is appended) or a full `host:port`
(`"54.183.70.180:8443"`). Takes precedence over both the bound (`"198.51.100.1:8443"`). Takes precedence over both the bound
address and any STUN-derived autodiscovery. Required for TCP address and any STUN-derived autodiscovery. Required for TCP
on cloud-NAT setups (AWS EIP, GCP/Azure external IPs) where on cloud-NAT setups (AWS EIP, GCP/Azure external IPs) where
binding to the public IP directly fails with `EADDRNOTAVAIL` binding to the public IP directly fails with `EADDRNOTAVAIL`
docs/tutorials/resolve-peers-via-nostr.md
+2 -2
View File
@@ -96,7 +96,7 @@ You should currently have:
``` ```
Expect `test-us01` listed with `connectivity` active and a Expect `test-us01` listed with `connectivity` active and a
`transport_addr` of roughly `217.77.8.91:2121`. `transport_addr` of roughly `test-us01.fips.network:2121`.
If either of those isn't true, finish the previous two If either of those isn't true, finish the previous two
tutorials first; the Nostr discovery layer is built on top of tutorials first; the Nostr discovery layer is built on top of
@@ -189,7 +189,7 @@ sudo fipsctl show peers
`test-us01` should appear with `connectivity` active and a `test-us01` should appear with `connectivity` active and a
`transport_addr` reflecting the address that was resolved from `transport_addr` reflecting the address that was resolved from
the advert — `217.77.8.91:2121` at time of writing. That field the advert — `test-us01.fips.network:2121` at time of writing. That field
is the strong signal: nothing in your config gave the daemon is the strong signal: nothing in your config gave the daemon
that IP, yet there it is. that IP, yet there it is.
examples/sidecar-nostr-relay/.env
+1 -1
View File
@@ -7,6 +7,6 @@ FIPS_NSEC=
# Peer configuration (leave empty for standalone operation) # Peer configuration (leave empty for standalone operation)
FIPS_PEER_NPUB=npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98 FIPS_PEER_NPUB=npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98
FIPS_PEER_ADDR=217.77.8.91:2121 FIPS_PEER_ADDR=test-us01.fips.network:2121
FIPS_PEER_ALIAS=vps FIPS_PEER_ALIAS=vps
FIPS_PEER_TRANSPORT=udp FIPS_PEER_TRANSPORT=udp
examples/wireguard-sidecar-macos/fips.yaml
+1 -1
View File
@@ -32,5 +32,5 @@ peers:
alias: "fips-test-node" alias: "fips-test-node"
addresses: addresses:
- transport: udp - transport: udp
addr: "217.77.8.91:2121" addr: "test-us01.fips.network:2121"
connect_policy: auto_connect connect_policy: auto_connect
packaging/common/fips.yaml
+1 -1
View File
@@ -116,7 +116,7 @@ peers: []
# via_nostr: true # via_nostr: true
# addresses: # addresses:
# - transport: udp # - transport: udp
# addr: "217.77.8.91:2121" # IP or hostname (e.g., "peer.example.com:2121") # addr: "test-us01.fips.network:2121" # IP or hostname (e.g., "peer.example.com:2121")
# - transport: udp # - transport: udp
# addr: "nat" # Use node.discovery.nostr for Nostr/STUN hole punching # addr: "nat" # Use node.discovery.nostr for Nostr/STUN hole punching
# connect_policy: auto_connect # connect_policy: auto_connect
packaging/openwrt-ipk/files/etc/fips/fips.yaml
+1 -1
View File
@@ -119,7 +119,7 @@ peers: []
# via_nostr: true # via_nostr: true
# addresses: # addresses:
# - transport: udp # - transport: udp
# addr: "217.77.8.91:2121" # IP or hostname (e.g., "peer.example.com:2121") # addr: "test-us01.fips.network:2121" # IP or hostname (e.g., "peer.example.com:2121")
# - transport: udp # - transport: udp
# addr: "nat" # Use node.discovery.nostr for Nostr/STUN hole punching # addr: "nat" # Use node.discovery.nostr for Nostr/STUN hole punching
# connect_policy: auto_connect # connect_policy: auto_connect
packaging/systemd/README.install.md
+1 -1
View File
@@ -109,7 +109,7 @@ peers:
alias: "gateway" alias: "gateway"
addresses: addresses:
- transport: udp - transport: udp
addr: "217.77.8.91:2121" # IP or hostname (e.g., "peer.example.com:2121") addr: "test-us01.fips.network:2121" # IP or hostname (e.g., "peer.example.com:2121")
connect_policy: auto_connect connect_policy: auto_connect
``` ```
src/config/transport.rs
+18 -18
View File
@@ -11,9 +11,9 @@ use serde::{Deserialize, Serialize};
/// Parse an `external_addr` config string against a known bind port, /// Parse an `external_addr` config string against a known bind port,
/// producing the absolute `SocketAddr` to advertise on Nostr. /// producing the absolute `SocketAddr` to advertise on Nostr.
/// ///
/// Accepts either a bare IP (`"54.183.70.180"` or `"[::1]"`) — in which /// Accepts either a bare IP (`"198.51.100.1"` or `"[::1]"`) — in which
/// case the bind port is appended — or a full `host:port` form /// case the bind port is appended — or a full `host:port` form
/// (`"54.183.70.180:443"` or `"[::1]:443"`). Returns `None` on any parse /// (`"198.51.100.1:443"` or `"[::1]:443"`). Returns `None` on any parse
/// error. IPv6 must use bracket notation when supplying a port. /// error. IPv6 must use bracket notation when supplying a port.
fn parse_external_advert_addr(raw: &str, bind_port: u16) -> Option<SocketAddr> { fn parse_external_advert_addr(raw: &str, bind_port: u16) -> Option<SocketAddr> {
if let Ok(sa) = raw.parse::<SocketAddr>() { if let Ok(sa) = raw.parse::<SocketAddr>() {
@@ -79,8 +79,8 @@ pub struct UdpConfig {
/// Optional explicit public address to advertise when `public: true` /// Optional explicit public address to advertise when `public: true`
/// is set. Takes precedence over both the bound address and any /// is set. Takes precedence over both the bound address and any
/// STUN-derived autodiscovery. Accepts either a bare IP /// STUN-derived autodiscovery. Accepts either a bare IP
/// (`"54.183.70.180"` — the configured `bind_addr` port is appended) /// (`"198.51.100.1"` — the configured `bind_addr` port is appended)
/// or a full `host:port` (`"54.183.70.180:443"`). Useful when the /// or a full `host:port` (`"198.51.100.1:443"`). Useful when the
/// public IP isn't on a local interface (e.g. AWS EIP / cloud 1:1 /// public IP isn't on a local interface (e.g. AWS EIP / cloud 1:1
/// NAT) and the operator wants to skip STUN autodiscovery for a /// NAT) and the operator wants to skip STUN autodiscovery for a
/// deterministic value. /// deterministic value.
@@ -414,7 +414,7 @@ pub struct TcpConfig {
/// Optional explicit public address to advertise. Required when /// Optional explicit public address to advertise. Required when
/// `bind_addr` is wildcard (e.g. `"0.0.0.0:443"`) and /// `bind_addr` is wildcard (e.g. `"0.0.0.0:443"`) and
/// `advertise_on_nostr: true`, since TCP has no STUN equivalent /// `advertise_on_nostr: true`, since TCP has no STUN equivalent
/// for autodiscovery. Accepts either a bare IP (`"54.183.70.180"` /// for autodiscovery. Accepts either a bare IP (`"198.51.100.1"`
/// — the configured `bind_addr` port is appended) or a full /// — the configured `bind_addr` port is appended) or a full
/// `host:port`. Common pattern on AWS EIP / cloud 1:1 NAT setups /// `host:port`. Common pattern on AWS EIP / cloud 1:1 NAT setups
/// where the public IP isn't bindable on the host. /// where the public IP isn't bindable on the host.
@@ -875,14 +875,14 @@ mod tests {
#[test] #[test]
fn parse_external_addr_accepts_bare_ipv4_with_appended_bind_port() { fn parse_external_addr_accepts_bare_ipv4_with_appended_bind_port() {
let sa = parse_external_advert_addr("54.183.70.180", 2121).unwrap(); let sa = parse_external_advert_addr("198.51.100.1", 2121).unwrap();
assert_eq!(sa.to_string(), "54.183.70.180:2121"); assert_eq!(sa.to_string(), "198.51.100.1:2121");
} }
#[test] #[test]
fn parse_external_addr_accepts_full_ipv4_socket_addr() { fn parse_external_addr_accepts_full_ipv4_socket_addr() {
let sa = parse_external_advert_addr("54.183.70.180:443", 2121).unwrap(); let sa = parse_external_advert_addr("198.51.100.1:443", 2121).unwrap();
assert_eq!(sa.to_string(), "54.183.70.180:443"); assert_eq!(sa.to_string(), "198.51.100.1:443");
// Explicit port wins over the bind port we passed in. // Explicit port wins over the bind port we passed in.
} }
@@ -907,23 +907,23 @@ mod tests {
#[test] #[test]
fn udp_external_advert_addr_combines_with_bind_port_default() { fn udp_external_advert_addr_combines_with_bind_port_default() {
let cfg = UdpConfig { let cfg = UdpConfig {
external_addr: Some("54.183.70.180".to_string()), external_addr: Some("198.51.100.1".to_string()),
..UdpConfig::default() ..UdpConfig::default()
}; };
// bind_addr unset, so default DEFAULT_UDP_BIND_ADDR (0.0.0.0:2121) applies. // bind_addr unset, so default DEFAULT_UDP_BIND_ADDR (0.0.0.0:2121) applies.
let sa = cfg.external_advert_addr().unwrap(); let sa = cfg.external_advert_addr().unwrap();
assert_eq!(sa.to_string(), "54.183.70.180:2121"); assert_eq!(sa.to_string(), "198.51.100.1:2121");
} }
#[test] #[test]
fn udp_external_advert_addr_with_explicit_full_socket_addr_overrides_bind_port() { fn udp_external_advert_addr_with_explicit_full_socket_addr_overrides_bind_port() {
let cfg = UdpConfig { let cfg = UdpConfig {
bind_addr: Some("0.0.0.0:2121".to_string()), bind_addr: Some("0.0.0.0:2121".to_string()),
external_addr: Some("54.183.70.180:9999".to_string()), external_addr: Some("198.51.100.1:9999".to_string()),
..UdpConfig::default() ..UdpConfig::default()
}; };
let sa = cfg.external_advert_addr().unwrap(); let sa = cfg.external_advert_addr().unwrap();
assert_eq!(sa.to_string(), "54.183.70.180:9999"); assert_eq!(sa.to_string(), "198.51.100.1:9999");
} }
#[test] #[test]
@@ -935,7 +935,7 @@ mod tests {
#[test] #[test]
fn tcp_external_advert_addr_requires_bind_port() { fn tcp_external_advert_addr_requires_bind_port() {
let cfg = TcpConfig { let cfg = TcpConfig {
external_addr: Some("54.183.70.180".to_string()), external_addr: Some("198.51.100.1".to_string()),
..TcpConfig::default() ..TcpConfig::default()
}; };
// bind_addr unset → no port to combine with → None. // bind_addr unset → no port to combine with → None.
@@ -943,22 +943,22 @@ mod tests {
let cfg = TcpConfig { let cfg = TcpConfig {
bind_addr: Some("0.0.0.0:443".to_string()), bind_addr: Some("0.0.0.0:443".to_string()),
external_addr: Some("54.183.70.180".to_string()), external_addr: Some("198.51.100.1".to_string()),
..TcpConfig::default() ..TcpConfig::default()
}; };
let sa = cfg.external_advert_addr().unwrap(); let sa = cfg.external_advert_addr().unwrap();
assert_eq!(sa.to_string(), "54.183.70.180:443"); assert_eq!(sa.to_string(), "198.51.100.1:443");
} }
#[test] #[test]
fn tcp_external_advert_addr_with_full_socket_addr_independent_of_bind() { fn tcp_external_advert_addr_with_full_socket_addr_independent_of_bind() {
let cfg = TcpConfig { let cfg = TcpConfig {
bind_addr: Some("0.0.0.0:443".to_string()), bind_addr: Some("0.0.0.0:443".to_string()),
external_addr: Some("54.183.70.180:8443".to_string()), external_addr: Some("198.51.100.1:8443".to_string()),
..TcpConfig::default() ..TcpConfig::default()
}; };
let sa = cfg.external_advert_addr().unwrap(); let sa = cfg.external_advert_addr().unwrap();
assert_eq!(sa.to_string(), "54.183.70.180:8443"); assert_eq!(sa.to_string(), "198.51.100.1:8443");
} }
#[test] #[test]
testing/sidecar/.env
+1 -1
View File
@@ -8,6 +8,6 @@ FIPS_NSEC=e752b92aed3ac1595807f5d0eb5125589fbec0a2cfd3a2948d87ea076557deeb
# Peer configuration (leave empty for standalone operation) # Peer configuration (leave empty for standalone operation)
FIPS_PEER_NPUB=npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98 FIPS_PEER_NPUB=npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98
FIPS_PEER_ADDR=217.77.8.91:2121 FIPS_PEER_ADDR=test-us01.fips.network:2121
FIPS_PEER_ALIAS=vps FIPS_PEER_ALIAS=vps
FIPS_PEER_TRANSPORT=udp FIPS_PEER_TRANSPORT=udp
testing/static/configs/topologies/mesh-public.yaml
+1 -1
View File
@@ -38,7 +38,7 @@ nodes:
# External/public node (not a Docker container) # External/public node (not a Docker container)
pub: pub:
npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98" npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98"
external_ip: "217.77.8.91" external_ip: "test-us01.fips.network"
peers: [a, b, c] peers: [a, b, c]
# Spanning Tree Structure (rooted at node A): # Spanning Tree Structure (rooted at node A):
testing/tor/socks5-outbound/configs/node-a.yaml.tmpl
+2 -2
View File
@@ -1,6 +1,6 @@
# FIPS Tor test node A — socks5-outbound # FIPS Tor test node A — socks5-outbound
# #
# Connects outbound to test-us01 (217.77.8.91:443) via Tor SOCKS5 proxy. # Connects outbound to test-us01 (test-us01.fips.network:443) via Tor SOCKS5 proxy.
# Identity generated per-run to avoid mesh clashes with parallel tests. # Identity generated per-run to avoid mesh clashes with parallel tests.
node: node:
@@ -24,5 +24,5 @@ peers:
alias: "test-us01" alias: "test-us01"
addresses: addresses:
- transport: tor - transport: tor
addr: "217.77.8.91:443" addr: "test-us01.fips.network:443"
connect_policy: auto_connect connect_policy: auto_connect
testing/tor/socks5-outbound/configs/node-b.yaml.tmpl
+2 -2
View File
@@ -1,6 +1,6 @@
# FIPS Tor test node B — socks5-outbound # FIPS Tor test node B — socks5-outbound
# #
# Connects outbound to test-us01 (217.77.8.91:443) via Tor SOCKS5 proxy. # Connects outbound to test-us01 (test-us01.fips.network:443) via Tor SOCKS5 proxy.
# Identity generated per-run to avoid mesh clashes with parallel tests. # Identity generated per-run to avoid mesh clashes with parallel tests.
node: node:
@@ -24,5 +24,5 @@ peers:
alias: "test-us01" alias: "test-us01"
addresses: addresses:
- transport: tor - transport: tor
addr: "217.77.8.91:443" addr: "test-us01.fips.network:443"
connect_policy: auto_connect connect_policy: auto_connect
testing/tor/socks5-outbound/docker-compose.yml
+1 -1
View File
@@ -1,7 +1,7 @@
# Tor transport integration test — socks5-outbound # Tor transport integration test — socks5-outbound
# #
# Topology: # Topology:
# [fips-a] --tor/socks5--> test-us01 (217.77.8.91:443) <--tor/socks5-- [fips-b] # [fips-a] --tor/socks5--> test-us01 (test-us01.fips.network:443) <--tor/socks5-- [fips-b]
# #
# Both FIPS nodes connect outbound through a local Tor daemon's SOCKS5 # Both FIPS nodes connect outbound through a local Tor daemon's SOCKS5
# proxy to test-us01's TCP listener. test-us01 routes between them. # proxy to test-us01's TCP listener. test-us01 routes between them.
testing/tor/socks5-outbound/scripts/tor-test.sh
+1 -1
View File
@@ -5,7 +5,7 @@
# fips-a --tor/socks5--> test-us01 <--tor/socks5-- fips-b # fips-a --tor/socks5--> test-us01 <--tor/socks5-- fips-b
# #
# Both local FIPS nodes connect outbound through a local Tor daemon # Both local FIPS nodes connect outbound through a local Tor daemon
# to test-us01's TCP listener (217.77.8.91:443). Once both are peered # to test-us01's TCP listener (test-us01.fips.network:443). Once both are peered
# with test-us01, traffic between fips-a and fips-b is routed through it. # with test-us01, traffic between fips-a and fips-b is routed through it.
# #
# Each run generates ephemeral identities to avoid mesh clashes when # Each run generates ephemeral identities to avoid mesh clashes when