mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
9668807ca4
Tailscale-style sidecar pattern: a FIPS container provides mesh networking, and a companion app container shares its network namespace via network_mode: service:fips. Security model: - iptables enforces strict isolation — the app container can only communicate over the FIPS mesh (fd::/8 via fips0) - No IPv4 access: eth0 restricted to FIPS UDP transport (port 2121) - No IPv6 on eth0: ip6tables blocks all eth0 IPv6 traffic - Only fips0 and loopback are reachable from the app container The sidecar accepts peer configuration via environment variables (FIPS_NSEC, FIPS_PEER_NPUB, FIPS_PEER_ADDR), so it can be pointed at any FIPS node without config file generation. Files: - testing/sidecar/: Dockerfile, Dockerfile.app, docker-compose.yml, entrypoint.sh, .env, resolv.conf, scripts/build.sh - testing/sidecar/README.md: security model, quick-start, architecture, DNS resolution, troubleshooting, production considerations - testing/sidecar/scripts/test-sidecar.sh: 3-node chain integration test verifying link establishment, multi-hop connectivity, and network isolation on each app container - .github/workflows/ci.yml: sidecar integration test matrix entry
56 lines
1.9 KiB
Bash
Executable File
56 lines
1.9 KiB
Bash
Executable File
#!/bin/bash
|
|
# Build the FIPS binary and Docker sidecar image.
|
|
# Usage: ./build.sh
|
|
set -e
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
DOCKER_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
|
|
# Find project root (directory containing Cargo.toml)
|
|
PROJECT_ROOT="$(cd "$DOCKER_DIR/../.." && pwd)"
|
|
if [ ! -f "$PROJECT_ROOT/Cargo.toml" ]; then
|
|
echo "Error: Cannot find Cargo.toml at $PROJECT_ROOT" >&2
|
|
echo "Expected layout: <project-root>/testing/sidecar/scripts/build.sh" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Detect host OS
|
|
UNAME_S=$(uname -s)
|
|
CARGO_TARGET="x86_64-unknown-linux-musl"
|
|
|
|
if [ "$UNAME_S" = "Darwin" ]; then
|
|
echo "Detected macOS host — using cross-compilation for Linux..."
|
|
|
|
if ! command -v cargo-zigbuild &> /dev/null; then
|
|
echo "Error: cargo-zigbuild not found." >&2
|
|
echo "Please install it: cargo install cargo-zigbuild" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! rustup target list --installed | grep -q "$CARGO_TARGET"; then
|
|
echo "Installing Rust target $CARGO_TARGET..."
|
|
rustup target add "$CARGO_TARGET"
|
|
fi
|
|
|
|
echo "Building FIPS for Linux (release) using cargo-zigbuild..."
|
|
cargo zigbuild --release --target "$CARGO_TARGET" --manifest-path="$PROJECT_ROOT/Cargo.toml"
|
|
|
|
echo "Copying binaries to docker context..."
|
|
cp "$PROJECT_ROOT/target/$CARGO_TARGET/release/fips" "$DOCKER_DIR/fips"
|
|
cp "$PROJECT_ROOT/target/$CARGO_TARGET/release/fipsctl" "$DOCKER_DIR/fipsctl"
|
|
else
|
|
echo "Building FIPS (release)..."
|
|
cargo build --release --manifest-path="$PROJECT_ROOT/Cargo.toml"
|
|
|
|
echo "Copying binaries to docker context..."
|
|
cp "$PROJECT_ROOT/target/release/fips" "$DOCKER_DIR/fips"
|
|
cp "$PROJECT_ROOT/target/release/fipsctl" "$DOCKER_DIR/fipsctl"
|
|
fi
|
|
|
|
echo "Done. Binaries at $DOCKER_DIR/{fips,fipsctl}"
|
|
echo ""
|
|
echo "Building Docker image..."
|
|
docker compose -f "$DOCKER_DIR/docker-compose.yml" build
|
|
echo ""
|
|
echo "Ready: cd testing/sidecar && docker compose up -d"
|