Johnathan Corgan
9979826235
Move the staged changelog entries under a 0.5.2 heading dated 2026-09-28 and leave an empty Unreleased section above it. The date is provisional: a comment beside the heading says so, and the two release-notes files carry the same date with the same marker, so the check at the version bump finds all three. Add the release notes and mirror them byte for byte to RELEASE-NOTES.md. Every link is absolute so the Release body resolves them, and each paragraph and list item is on one line, because the Release page shows every newline inside a paragraph as a line break; the file exempts itself from the line-length lint rule. The notes lead with who should upgrade and with the three defaults that changed: the gateway's DNS port, the Windows config directory, and an ephemeral node no longer writing its key file. They say what was measured and what was not, including the mixed-version interop run against v0.5.1 and v0.5.0, the Windows installer checks on Windows Server under Windows PowerShell 5.1 and PowerShell 7, and the checks still outstanding. They state that a link to a v0.5.0 or v0.5.1 node can still drop after a lost rekey reply until that node is upgraded, since the fix is on the answering side. The Windows upgrade notes say to stop the service before every run of the installer, and to move fips.yaml and fips.key from \etc\fips into C:\ProgramData\fips before upgrading a service that was set up by hand to read its config from \etc\fips, which otherwise comes up under a new identity with no warning. The README's status badge, release-notes link and status paragraph follow the release. Correct documentation that no longer matches the gateway, tree, Windows and packaging behavior: - The gateway design document, how-to, OpenWrt tutorial and the configuration reference describe the NAT rebuild as one transaction, the 1000-mapping ceiling and the new-name rate limit in place of the pool size as a hard cap, and which DNS queries allocate a mapping. - The spanning-tree documents describe the periodic re-broadcast and the resend of an unconfirmed announce, and the bloom filter update triggers include a parent switch and a child joining or leaving. - The fips, fipsctl and security references cover the restricted C:\ProgramData\fips on Windows, the ACL and key paths on macOS, FreeBSD and Windows, the legacy peer ACL fallback in \etc\fips, and the Debian fips.yaml's actual mode and conffile status. - The packaging guides no longer list MIPS as supported, the arm64 .deb leg is described as also purging the package, and the OpenWrt SDK-feed README says a package built from its Makefile carries none of the released packages' maintainer scripts. - The testing README gains a section for the OpenWrt maintainer-script suite and says the ACL allowlist suite runs by hand only, and the interop README lists the mesh-size check as its eighth phase. The upgrade notes were then corrected where following them as written would have left a node worse off: - Gateway DNS port: a fips.yaml that sets gateway.dns.listen keeps its port through the upgrade, and the v0.5.1 example config and deployment guide set it to [::1]:5353, so the resolver instruction depends on whether the config sets it. - OpenWrt: an operator who had the gateway disabled must stop it and then disable it after the first opkg upgrade. - FreeBSD: an upgrade step that restarts fips and fips_dns; the command comes from pkg's source and is listed as not measured. - Debian: the upgrade re-enables and starts fips-dns every time; `systemctl mask fips-dns` keeps it off. The .deb start bound is 90 seconds for fips-gateway. - Arch and the systemd tarball: what to restart or start after the upgrade, and that only a .deb upgrade reloads the firewall. - Ephemeral nodes: set persistent before upgrading to keep a key. - Windows: one ordered sequence in an elevated PowerShell, with the installer run under -ExecutionPolicy Bypass. - Building from source on glibc Linux also needs libdbus-1-dev and pkg-config. README, getting-started and the packaging README install the .deb with apt install ./ and point to the packaging README for per-format install commands. The notes record an OpenWrt 24 router test of the gateway DNS port, and that a gateway that fails to start leaves dnsmasq forwarding .fips to its port, with how to hand .fips back to the daemon. Drop the test-us03-next alias from the shipped hosts file and from the roster in the host-aliases how-to.
Tutorials
If you have just installed FIPS, this is where to start. The tutorials below take you from a freshly-installed daemon to a node that:
- Has joined the public test mesh and can reach other nodes on it.
- Carries a stable identity that other operators can address.
- Discovers peers — and is discoverable — over Nostr.
- Hosts and consumes real services across the mesh.
Each tutorial is a complete, working session at the keyboard. You configure something, restart the daemon, watch it come up, and verify the result. The point is to build muscle memory, not to cover every option.
Read them in order. Each tutorial assumes the state the previous one left you in. If you skip ahead, the cross-references that lead you back may not match what you have on disk.
The new-user progression
| # | Tutorial | What you'll do |
|---|---|---|
| 1 | join-the-test-mesh.md | Add one public test peer to your config, watch the link come up, ping that peer and a second mesh node it routes you to. The starting point for everything else. |
| 2 | persistent-identity.md | Pin your daemon to a stable Nostr keypair so your address stops changing on every restart. Other operators can now add you to their peers: lists; the services you host get a fixed name. |
| 3 | resolve-peers-via-nostr.md | Stop hard-coding peer addresses. Drop the address line from your peer entry and let the daemon look up the current endpoint from public Nostr relays at dial time. |
| 4 | advertise-your-node.md | Publish your own UDP endpoint to Nostr so any operator who knows your npub can reach you, with a short final section on udp:nat best-effort hole-punching for nodes without a directly reachable UDP endpoint. |
| 5 | open-discovery.md | Switch to policy: open and let your peer list populate itself from the ambient fips-overlay-v1 namespace. Hands-off mesh participation. |
| 6 | reach-mesh-services.md | Drive ordinary IPv6 tools — ping6, nc, traceroute6, curl, ssh — at mesh nodes by <npub>.fips. Get a feel for the daemon's IPv6 adapter, which makes unmodified IPv6 software work over the mesh. |
| 7 | host-a-service.md | Bring up an HTTP server bound to fips0 so mesh nodes can reach it, with a deliberate exposure decision (mesh-only vs every interface), and the mesh firewall as a default-deny baseline. The peer ACL (a separate, transport-layer control over which npubs may peer with your node) is briefly mentioned alongside. |
| 8 | ground-up-mesh.md | Bring up a second deployment mode: two devices joined by Ethernet (or WiFi, or BLE) with no IP infrastructure between them. The mesh emerges from layer 2 up. Coexists with overlay peers — the same daemon can carry both. |
After tutorial 8 you have a fully participating mesh node that reaches services hosted by other mesh nodes and hosts services of its own, with identity, discovery, reachability, an explicit exposure policy, and an understanding of both deployment modes — overlay on top of existing IP, and ground-up where the mesh is the network.
There are also two side trips you can take:
-
ipv6-adapter-walkthrough.md — trace one
sshfrom DNS query through session setup to the far-side TUN, usingfipstopandfipsctlto watch each step. Optional, but if you like seeing how the pieces fit together, this is the doc that shows you. Take it any time after tutorial 1. -
native-api-walkthrough.md — write a program against the experimental native datagram API, addressing a peer by public key and port with no IPv6 emulation and no TUN. Runs two throwaway nodes on one machine, so it needs no mesh and no root, and you can take it without doing the tutorials first.
Advanced
These are not part of the new-user progression. They assume you have already worked through the tutorials above and now want to fold FIPS into a wider network deployment.
- deploy-fips-gateway.md — Stand up a
fips-gatewayon an OpenWrt access point so unmodified LAN hosts can reach<npub>.fipsdestinations through a DNS- allocated virtual IPv6 pool and kernel nftables NAT, with no per-host FIPS install. Also walks through one inbound port forward exposing a LAN service to mesh peers. Aimed at operators bridging a LAN segment into the overlay from the edge router. For a non-OpenWrt host the same deployment is in ../how-to/deploy-gateway.md.
When to use the how-to guides instead
The tutorials here walk through one specific path each. The how-to guides under ../how-to/ are the operator recipes — alternative provisioning paths, less-common configurations, troubleshooting techniques. Once you have the shape of FIPS in your head from these tutorials, the how-tos are where you'll go to look up "how do I do X?" without being walked through the surrounding context.