mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
9668807ca4
Tailscale-style sidecar pattern: a FIPS container provides mesh networking, and a companion app container shares its network namespace via network_mode: service:fips. Security model: - iptables enforces strict isolation — the app container can only communicate over the FIPS mesh (fd::/8 via fips0) - No IPv4 access: eth0 restricted to FIPS UDP transport (port 2121) - No IPv6 on eth0: ip6tables blocks all eth0 IPv6 traffic - Only fips0 and loopback are reachable from the app container The sidecar accepts peer configuration via environment variables (FIPS_NSEC, FIPS_PEER_NPUB, FIPS_PEER_ADDR), so it can be pointed at any FIPS node without config file generation. Files: - testing/sidecar/: Dockerfile, Dockerfile.app, docker-compose.yml, entrypoint.sh, .env, resolv.conf, scripts/build.sh - testing/sidecar/README.md: security model, quick-start, architecture, DNS resolution, troubleshooting, production considerations - testing/sidecar/scripts/test-sidecar.sh: 3-node chain integration test verifying link establishment, multi-hop connectivity, and network isolation on each app container - .github/workflows/ci.yml: sidecar integration test matrix entry
45 lines
1.0 KiB
YAML
45 lines
1.0 KiB
YAML
networks:
|
|
fips-net:
|
|
name: ${FIPS_NETWORK:-fips-sidecar-net}
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: ${FIPS_SUBNET:-172.20.1.0/24}
|
|
|
|
services:
|
|
fips:
|
|
build:
|
|
context: .
|
|
hostname: fips-sidecar
|
|
cap_add:
|
|
- NET_ADMIN
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=0
|
|
restart: "no"
|
|
environment:
|
|
- RUST_LOG=${RUST_LOG:-info}
|
|
- FIPS_NSEC=${FIPS_NSEC}
|
|
- FIPS_PEER_NPUB=${FIPS_PEER_NPUB:-}
|
|
- FIPS_PEER_ADDR=${FIPS_PEER_ADDR:-}
|
|
- FIPS_PEER_ALIAS=${FIPS_PEER_ALIAS:-peer}
|
|
- FIPS_UDP_BIND=${FIPS_UDP_BIND:-0.0.0.0:2121}
|
|
- FIPS_TUN_MTU=${FIPS_TUN_MTU:-1280}
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: ${FIPS_IPV4:-172.20.1.20}
|
|
|
|
app:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile.app
|
|
network_mode: "service:fips"
|
|
depends_on:
|
|
- fips
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
command: ["sleep", "infinity"]
|