mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 11:36:15 +00:00
Johnathan Corgan
507086e39d
Pre-cut documentation pass for the 0.4.0 release, verified against current source. Corrections: - fipsctl: stale 'show identities'/'show node' -> 'show status' (host-a-service, run-as-unprivileged-user) - mesh address derivation: first 16 bytes of SHA-256(pubkey) with the leading byte set to 0xfd, not a fixed fd97: prefix (reach-mesh-services, ipv6-adapter-walkthrough) - gateway control socket mode 0660 -> 0770 (troubleshoot-gateway) - Tor example: add advertised_port: 8443 so the published port matches the prose (enable-nostr-discovery) - bloom mesh-size estimate rewritten to the OR-union-of-peer-filters algorithm; plus mtu deep-link, gateway pool wording, and a NAT failure-mode line - examples: delete orphaned nostr-rs-relay config, accept inbound to the local 8443 TCP listener, fix fd::/8 -> fd00::/8 typos, dotless wireguard alias Additions: - new Nym mixnet transport section (fips-transport-layer) and the architecture transport list - new LAN/mDNS discovery section (fips-nostr-discovery) - reference docs: Nym transport, LAN discovery, and new control/stats surfaces; drop ble from the connect transport list
92 lines
2.6 KiB
Bash
Executable File
92 lines
2.6 KiB
Bash
Executable File
#!/bin/bash
|
|
# FIPS sidecar entrypoint: generate config, apply iptables isolation, launch FIPS.
|
|
set -e
|
|
|
|
# --- Generate FIPS config from environment variables ---
|
|
|
|
FIPS_NSEC="${FIPS_NSEC:?FIPS_NSEC is required}"
|
|
FIPS_UDP_BIND="${FIPS_UDP_BIND:-0.0.0.0:2121}"
|
|
FIPS_TCP_BIND="${FIPS_TCP_BIND:-0.0.0.0:8443}"
|
|
FIPS_TUN_MTU="${FIPS_TUN_MTU:-1280}"
|
|
FIPS_UDP_MTU="${FIPS_UDP_MTU:-1472}"
|
|
FIPS_PEER_TRANSPORT="${FIPS_PEER_TRANSPORT:-udp}"
|
|
|
|
mkdir -p /etc/fips
|
|
|
|
# Build peers section
|
|
PEERS_SECTION=""
|
|
if [ -n "$FIPS_PEER_NPUB" ] && [ -n "$FIPS_PEER_ADDR" ]; then
|
|
FIPS_PEER_ALIAS="${FIPS_PEER_ALIAS:-peer}"
|
|
PEERS_SECTION=" - npub: \"${FIPS_PEER_NPUB}\"
|
|
alias: \"${FIPS_PEER_ALIAS}\"
|
|
addresses:
|
|
- transport: ${FIPS_PEER_TRANSPORT}
|
|
addr: \"${FIPS_PEER_ADDR}\"
|
|
connect_policy: auto_connect"
|
|
fi
|
|
|
|
cat > /etc/fips/fips.yaml <<EOF
|
|
node:
|
|
identity:
|
|
nsec: "${FIPS_NSEC}"
|
|
|
|
tun:
|
|
enabled: true
|
|
name: fips0
|
|
mtu: ${FIPS_TUN_MTU}
|
|
|
|
dns:
|
|
enabled: true
|
|
bind_addr: "127.0.0.1"
|
|
|
|
transports:
|
|
udp:
|
|
bind_addr: "${FIPS_UDP_BIND}"
|
|
# 1472 = Docker bridge IPv4 max (1500 MTU - 8 UDP - 20 IPv4 header).
|
|
# Override with FIPS_UDP_MTU=1280 for IPv6-min-safe deploys.
|
|
mtu: ${FIPS_UDP_MTU}
|
|
tcp:
|
|
bind_addr: "${FIPS_TCP_BIND}"
|
|
|
|
peers:
|
|
${PEERS_SECTION:- []}
|
|
EOF
|
|
|
|
echo "Generated /etc/fips/fips.yaml"
|
|
|
|
# --- Apply iptables rules for strict network isolation ---
|
|
#
|
|
# Goal: only FIPS UDP transport (port 2121) may use eth0.
|
|
# All other eth0 traffic is dropped. fips0 and loopback are unrestricted.
|
|
# This ensures the app container (sharing this network namespace) can only
|
|
# communicate over the FIPS mesh.
|
|
|
|
# IPv4: allow only FIPS transport on eth0
|
|
iptables -A OUTPUT -o lo -j ACCEPT
|
|
iptables -A INPUT -i lo -j ACCEPT
|
|
iptables -A OUTPUT -o eth0 -p udp --dport 2121 -j ACCEPT
|
|
iptables -A OUTPUT -o eth0 -p udp --sport 2121 -j ACCEPT
|
|
iptables -A INPUT -i eth0 -p udp --dport 2121 -j ACCEPT
|
|
iptables -A INPUT -i eth0 -p udp --sport 2121 -j ACCEPT
|
|
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -j ACCEPT
|
|
iptables -A INPUT -i eth0 -p tcp --sport 443 -j ACCEPT
|
|
iptables -A INPUT -i eth0 -p tcp --dport "${FIPS_TCP_BIND##*:}" -j ACCEPT
|
|
iptables -A OUTPUT -o eth0 -p tcp --sport "${FIPS_TCP_BIND##*:}" -j ACCEPT
|
|
iptables -A OUTPUT -o eth0 -j DROP
|
|
iptables -A INPUT -i eth0 -j DROP
|
|
|
|
# IPv6: allow fips0 and loopback, block eth0
|
|
ip6tables -A OUTPUT -o lo -j ACCEPT
|
|
ip6tables -A INPUT -i lo -j ACCEPT
|
|
ip6tables -A OUTPUT -o fips0 -j ACCEPT
|
|
ip6tables -A INPUT -i fips0 -j ACCEPT
|
|
ip6tables -A OUTPUT -o eth0 -j DROP
|
|
ip6tables -A INPUT -i eth0 -j DROP
|
|
|
|
echo "iptables isolation rules applied"
|
|
|
|
# --- Start dnsmasq and launch FIPS ---
|
|
|
|
dnsmasq
|
|
exec fips --config /etc/fips/fips.yaml
|