mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
674c7fe1ff
Three related UDP transport changes that together close a real gap in the v0.2.x "this transport accepts inbound" assumption: - outbound_only (default false). When true, the transport binds a kernel-assigned ephemeral port (0.0.0.0:0) regardless of the configured bind_addr, refuses inbound handshakes (Transport trait's accept_connections() returns false), and is never advertised on Nostr regardless of advertise_on_nostr. Lets a node participate in the mesh as a pure client — initiate outbound links without exposing an inbound listener on a known port. Also closes the "loopback bind as outbound-only workaround" trap: a UDP socket bound to 127.0.0.1 pins 127.0.0.1 as the source IP on outbound packets, and Linux refuses to deliver such packets out an external interface — the daemon happily reports "transport started" while no flow ever reaches an external peer. - accept_connections (default true). Mirrors the existing Ethernet/BLE knob. Lets operators run UDP in a "client" posture (initiate outbound, refuse inbound msg1 from new addresses) without switching transport. The Node-level handshake gate already carves out msg1 from peers established on the transport so rekey works on existing sessions. - Startup validation: reject `transports.udp[*].bind_addr` set to a loopback address (127.x.x.x, ::1, localhost) when at least one peer has a non-loopback UDP address. Replaces the silent "peer link won't establish" failure mode with a clear error pointing at the bind misconfiguration. outbound_only is exempt (it overrides bind_addr to 0.0.0.0:0). The is_punch_packet-based filter from the previous commit, the Node-level admission gate landed earlier on master, and these new config fields together cover the three distinct ways the v0.2.x "this transport accepts inbound" assumption could break. Tests: validation truth table (loopback+external rejected, loopback+loopback ok, outbound_only exempt), is_loopback_addr_str helper, accept_connections wiring (default, explicit-false, outbound_only-forces-false), end-to-end ephemeral-bind in the runtime. 1082 tests pass with --features nostr-discovery.
124 lines
4.2 KiB
YAML
124 lines
4.2 KiB
YAML
# FIPS Node Configuration
|
|
|
|
node:
|
|
identity:
|
|
# By default, a new ephemeral keypair is generated on each start.
|
|
# Uncomment persistent to keep the same identity across restarts;
|
|
# on first start a keypair is saved to fips.key/fips.pub next to
|
|
# this config file (mode 0600/0644).
|
|
# persistent: true
|
|
#
|
|
# Or set an explicit key (overrides persistent):
|
|
# nsec: "nsec1..."
|
|
discovery:
|
|
# Optional Nostr-mediated overlay endpoint discovery.
|
|
# Requires a build of fips compiled with the 'nostr-discovery' feature.
|
|
# nostr:
|
|
# enabled: true
|
|
# policy: configured_only # disabled | configured_only | open
|
|
# open_discovery_max_pending: 64 # caps queued open-discovery retries
|
|
# app: "fips-overlay-v1"
|
|
# advertise: true
|
|
# advert_relays:
|
|
# - "wss://relay.damus.io"
|
|
# - "wss://nos.lol"
|
|
# - "wss://offchain.pub"
|
|
# dm_relays:
|
|
# - "wss://relay.damus.io"
|
|
# - "wss://nos.lol"
|
|
# - "wss://offchain.pub"
|
|
# # Optional override. If omitted, FIPS uses the built-in STUN list.
|
|
# # Built-in relay/STUN defaults are best-effort and should be
|
|
# # overridden by operators for production use.
|
|
# stun_servers:
|
|
# - "stun:stun.l.google.com:19302"
|
|
# - "stun:stun.cloudflare.com:3478"
|
|
# - "stun:global.stun.twilio.com:3478"
|
|
|
|
tun:
|
|
enabled: true
|
|
name: fips0
|
|
mtu: 1280
|
|
|
|
dns:
|
|
enabled: true
|
|
# bind_addr defaults to "::1" (IPv6 loopback). The shipped
|
|
# fips-dns-setup script configures systemd-resolved with a global
|
|
# /etc/systemd/resolved.conf.d/fips.conf drop-in pointing at
|
|
# [::1]:5354.
|
|
#
|
|
# Set "::" to expose the responder to mesh peers as well (e.g. for
|
|
# gateway hosts that resolve .fips on behalf of LAN clients). The
|
|
# mesh-interface filter in src/upper/dns.rs will still defend
|
|
# /etc/fips/hosts aliases from cross-mesh enumeration.
|
|
# bind_addr: "::1"
|
|
port: 5354
|
|
|
|
transports:
|
|
udp:
|
|
bind_addr: "0.0.0.0:2121"
|
|
# advertise_on_nostr: true
|
|
# public: false # false => advertise udp:nat; true => advertise bound host:port
|
|
# accept_connections: true # default; refuse inbound msg1 when false
|
|
# outbound_only: false # true => bind ephemeral, no listener on a
|
|
# # known port. Forces advertise_on_nostr=false
|
|
# # and accept_connections=false. Pure-client
|
|
# # posture; bind_addr is ignored.
|
|
|
|
tcp:
|
|
# Accepts inbound connections. No static outbound peers.
|
|
bind_addr: "0.0.0.0:8443"
|
|
# advertise_on_nostr: true
|
|
|
|
# Ethernet transport — uncomment and set your interface name.
|
|
# ethernet:
|
|
# interface: "eth0"
|
|
# discovery: true
|
|
# announce: true
|
|
# auto_connect: true
|
|
# accept_connections: true
|
|
|
|
# Bluetooth Low Energy transport — requires BlueZ and the 'ble' feature.
|
|
# ble:
|
|
# adapter: "hci0"
|
|
# mtu: 2048
|
|
# advertise: true
|
|
# scan: true
|
|
# auto_connect: true
|
|
# accept_connections: true
|
|
|
|
# Outbound LAN gateway. Allows non-FIPS hosts on the LAN to reach
|
|
# mesh destinations via DNS-allocated virtual IPs and kernel NAT.
|
|
# Requires: IPv6 forwarding enabled, fips daemon running with DNS.
|
|
# gateway:
|
|
# enabled: true
|
|
# pool: "fd01::/112"
|
|
# lan_interface: "eth0"
|
|
# dns:
|
|
# listen: "[::]:53"
|
|
# # upstream must match the daemon's dns.bind_addr above. The
|
|
# # default "[::1]:5354" matches the daemon's default. If you set
|
|
# # the daemon to bind on a wildcard ("::") or specific address,
|
|
# # update upstream to match — explicit ::1 sockets do not accept
|
|
# # v4 traffic.
|
|
# upstream: "[::1]:5354"
|
|
# ttl: 60
|
|
# pool_grace_period: 60
|
|
# conntrack:
|
|
# tcp_established: 432000
|
|
# udp_timeout: 30
|
|
# udp_assured: 180
|
|
# icmp_timeout: 30
|
|
|
|
peers: []
|
|
# Static peers for bootstrapping (UDP or TCP):
|
|
# - npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98"
|
|
# alias: "gateway"
|
|
# via_nostr: true
|
|
# addresses:
|
|
# - transport: udp
|
|
# addr: "217.77.8.91:2121" # IP or hostname (e.g., "peer.example.com:2121")
|
|
# - transport: udp
|
|
# addr: "nat" # Use node.discovery.nostr for Nostr/STUN hole punching
|
|
# connect_policy: auto_connect
|