mirror of https://github.com/jmcorgan/fips.git synced 2026-07-30 19:46:15 +00:00

Files

T

Johnathan Corgan 5abf9a9325 docs: four-section /docs/ restructure with new-user content, accuracy pass, and gateway feature-set rewrite

Restructures /docs/ by reader purpose (tutorials, how-to,
reference, design), adds the new-user-progression and
operator-recipe content the prior layout lacked, runs an
accuracy pass against current source across the pre-existing
design docs, and rewrites the gateway feature-set documentation
end-to-end around its actual operational profile (a niche
feature designed for systems already serving DHCP/DNS to a
LAN, with two independent halves — outbound LAN→mesh, inbound
mesh→LAN — sharing one nftables table, one binary, and one
control socket). Top-level README and getting-started rewritten
around two equally-weighted deployment modes (overlay on
existing IP networks; ground-up over non-IP transports).

## Additions

- 11 new tutorials in docs/tutorials/: an 8-step new-user
  progression from single-daemon test-mesh peering through
  to a ground-up two-device mesh, an IPv6-adapter side-trip
  walkthrough, an Advanced Tutorials index, and a hand-held
  OpenWrt walk-through for fips-gateway deployment that
  exercises both halves of the feature.
- 12 new how-tos in docs/how-to/: firewall activation,
  Nostr discovery (resolve / advertise / open across five
  scenarios), Tor onion (directory + control_port modes),
  UDP buffer tuning, unprivileged-user setup, persistent
  identity, host aliases, Bluetooth LE peering, MTU
  diagnostics, manual Linux-host gateway deployment (covers
  both halves), gateway troubleshooting (organised by half),
  and a section index.
- 9 new reference docs in docs/reference/: configuration,
  wire formats, control-socket protocol, four CLI references
  (fips, fipsctl, fipstop, fips-gateway), security posture
  matrix, and Nostr events catalog. Configuration and
  wire-formats are renamed-and-extended from prior design/
  versions; the other seven are net-new.
- 6 new design docs: fips-concepts, fips-architecture, and
  fips-prior-work split out of the deleted fips-intro.md;
  consolidated fips-mmp and fips-mtu aggregations; and a
  new generic port-advertisement-and-nat-traversal doc
  (Nostr-signaled port advertisement plus UDP NAT-traversal
  protocol, FIPS as an example implementation, suitable for
  eventual NIP submission).
- Top-level docs/getting-started.md walking through the
  binary-installer-only Install story.
- packaging/common/hosts pre-populated with the eight public
  test-mesh nodes so shortnames resolve out of the box on
  every fresh install.

## Changes

- 23 wire-format diagrams relocated to reference/diagrams/
  alongside the wire-formats move.
- 4 design diagrams corrected against source code
  (fips-protocol-stack, fips-identity-derivation,
  fips-coordinate-discovery, fips-routing-decision).
- 10 pre-existing design docs reconciled with current
  source. Numeric corrections: stale link-MMP report bounds
  (now [1s, 5s] with 200 ms cold-start floor); UDP default
  MTU (now 1280, IPv6 minimum); node_addr formula
  (SHA-256(pubkey)[..16]); Noise patterns (IK at link, XK
  at session); peer-ACL semantics (strict allowlist requires
  ALL in peers.deny); daemon DNS upstream ([::1]:5354);
  on-the-wire bloom-filter size (1,071 bytes); obsolete
  Cargo-feature references (PR #79 dropped them) removed.
- Transport framing tightened across the docs: TCP is for
  UDP-filtered networks (not NAT traversal); Tor is a
  deployment mode (not failover); WebSocket dropped (not a
  shipped FIPS transport); WiFi promoted to Implemented via
  Ethernet in infrastructure mode; classic-Bluetooth row
  removed (BLE is the only Bluetooth-mode transport).
- docs/design/fips-gateway.md rewritten end-to-end to lead
  with the niche-feature framing and the two-halves
  structure. Title moved from "FIPS Outbound LAN Gateway"
  to "FIPS Gateway"; architecture section describes the
  common machinery (the fips-gateway service, the nftables
  table, the control socket) before splitting into separate
  "Outbound Half" and "Inbound Half" sections of equal
  weight; security considerations split per-half; no Future
  Work section (speculative directions live in the project
  tracker, not in protocol design docs). Inbound port
  forwarding is a first-class half rather than a buried
  "Implemented Extensions" subsection.
- Gateway terminology unified across all gateway docs as a
  separate Linux service running alongside the fips daemon
  (its own systemd unit / OpenWrt init script). Container-
  pattern terms (sidecar) are reserved for the
  Docker/Kubernetes sidecar deployment examples — the
  testing/sidecar/ tree, examples/k8s-sidecar/,
  examples/sidecar-nostr-relay/,
  examples/wireguard-sidecar-macos/, and the related
  CHANGELOG / top-level README entries — where the term
  carries its standard container meaning.
- Net-new design body content: rekey section in
  fips-mesh-layer (Noise IK msg1/msg2 over the established
  link, K-bit cutover, drain window, smaller-NodeAddr-wins
  tie-breaker on dual-init); Mesh Size Estimation and
  Antipoison FPR Cap sections in fips-bloom-filters;
  Mesh-Interface Query Filter subsection in
  fips-ipv6-adapter; failure-suppression knobs and clock-
  skew tolerance in fips-nostr-discovery; loop-rejection
  and mid-chain ancestor swap added to spanning-tree
  propagation / stability rules; Priority Chain in
  fips-mesh-operation renumbered to match the
  routing-decision diagram.
- Top-level README: dropped the stale nostr-discovery
  cargo-feature parenthetical. docs/README.md and the four
  section READMEs (tutorials, how-to, reference, design)
  refreshed for the new structure; index rows reflect both
  halves of the gateway feature and the new fips-gateway
  CLI reference.
- Cargo.toml [package.metadata.deb] assets path updated for
  the fips-security.md move; .gitignore /reference/ rule
  anchored to repo root so docs/reference/ is trackable.
- packaging/openwrt-ipk/files/etc/fips/fips.yaml
  configuration-doc URL updated to the new
  docs/reference/configuration.md location.

## Deletions

- docs/design/fips-intro.md (split into the three new intro
  design docs).
- docs/design/document-relationships.svg (orphan, no longer
  referenced).
- docs/proposals/ tree removed; the only proposal it
  contained (the Nostr UDP hole-punch protocol) was
  rewritten as the new generic
  design/port-advertisement-and-nat-traversal.md.

2026-05-08 03:02:12 +00:00

4.9 KiB

Raw Blame History

`fipstop`

Live-status terminal UI for a running FIPS daemon.

Synopsis

fipstop [-s SOCKET] [--gateway-socket PATH] [-r SECONDS]

Description

fipstop is a ratatui-based dashboard. It opens the daemon control socket, polls a small set of show_* queries on a timer, and renders the state in a tabbed full-screen UI. A separate poll runs against the gateway control socket when the Gateway tab is active.

fipstop is read-only — it cannot mutate daemon state. Use fipsctl for connect / disconnect and friends.

Options

Flag	Argument	Default	Description
`-s`, `--socket`	`PATH`	(auto)	Daemon control-socket path / port. Same default as `fipsctl`.
`--gateway-socket`	`PATH`	(auto)	`fips-gateway` control-socket path / port. Default: `/run/fips/gateway.sock` (Unix), TCP port `21211` (Windows).
`-r`, `--refresh`	`SECONDS`	`2`	Poll interval.
`-V`, `--version`	—	—	Print short version.
`--version`	—	—	Print long version.
`-h`, `--help`	—	—	Print usage and exit.

Tabs

Tabs cycle in this order. Each tab issues the listed control-socket query on its first activation and on every refresh tick while active.

Tab	Query	Shows
Node	`show_status`	Identity, version, uptime, peer/link/session counts, sparklines for mesh size, tree depth, peer count, bytes, loss.
Peers	`show_peers` (+ `show_links`, `show_transports` cross-refs)	Authenticated peers in a table. Selecting a row and pressing Enter opens a detail view.
Transports	`show_transports` (+ `show_links`, `show_peers` cross-refs)	Tree of transport instances with per-link children when expanded.
Sessions	`show_sessions`	End-to-end FSP sessions.
Tree	`show_tree`	Spanning-tree state and per-peer coordinates.
Filters	`show_bloom`	Per-peer Bloom-filter state.
Performance	`show_mmp`	Link-layer and session-layer MMP metrics.
Routing	`show_routing` (+ `show_cache` cross-ref)	Forwarding/discovery counters, pending lookups, retry state.
Graphs	`show_stats_history` family + `show_stats_peers`	Stacked time-series plots. Three modes: node-level metrics, one metric across peers, all metrics for one peer.
Gateway	`show_gateway` and `show_mappings` against the gateway socket	Pool utilisation and per-mapping state when `fips-gateway` is running. Empty when the gateway socket is unreachable.

The cycle order in the UI is: Node → Peers → Transports → Sessions → Tree → Filters → Performance → Routing → Graphs → Gateway. The Links and Cache tabs are not in the cycle but are fetched as cross-references to populate Peers, Transports, and Routing detail views.

Keybindings

Global

Key	Action
`q`, `Ctrl-C`	Quit.
`Tab`	Next tab.
`Shift-Tab`	Previous tab.
`g`	Jump to the Graphs tab.
`Esc`	Close detail view (if open).

Table tabs (Peers, Sessions, Transports, Gateway)

Key	Action
`Up`, `Down`	Move row selection.
`Enter`	Open detail view for the selected row.

Transports tab (extra)

Key	Action
`Right`, `Space`	Expand the selected transport row to show its links.
`Left`	Collapse the selected transport row.
`e`	Expand all transports.
`c`	Collapse all transports.

Graphs tab (extra)

Key	Action
`Up`, `Down`	Scroll within the stacked plots.
`Right`, `Space`	Next time window. Cycles `1m / 1s` → `10m / 1s` → `1h / 1s` → `24h / 1m`.
`Left`	Previous time window.
`m`	Cycle view mode: `Node` (stacked node metrics) → `MetricByPeer` (one per-peer metric across all peers) → `PeerByMetric` (all per-peer metrics for one peer).
`n`	Next selector (next per-peer metric in MetricByPeer; next peer in PeerByMetric).
`Shift-N`	Previous selector.

Exit Codes

Code	Meaning
`0`	Normal quit.
`1`	Failed to initialise the terminal. The reason is printed to stderr.

A failure to reach the daemon socket is not fatal: the dashboard displays "Disconnected" in the status bar and retries on every refresh tick.

Environment

Variable	Description
`XDG_RUNTIME_DIR`	Used to derive the default control-socket and gateway-socket paths when `/run/fips` is absent.

Files

Same control-socket resolution rules as fipsctl. The gateway socket follows the same pattern with gateway.sock in place of control.sock, falling back to /tmp/fips-gateway.sock if neither system path nor XDG_RUNTIME_DIR is available.

4.9 KiB Raw Blame History

fipstop