Arjen
98786e527a
The macOS package accumulated a single unbounded log file — 717 MB on a node running at debug level. Nothing rotated it, and nothing could. fips logs to stdout and leaves capture to the supervisor, which is right where the platform rotates that stream: journald does, and so does syslog under procd. launchd does not. It redirects stdout to a plain file and appends to it forever, and the usual rename-and-signal rotators cannot help, because launchd holds the descriptor and passes it as fd 1 — the daemon has no way to reopen a file rotated out from under it, and signalling it achieves nothing. Rotation therefore has to happen in the process that writes, which means the daemon has to own the file. `node.log_file` names it, and is unset by default so every platform whose supervisor already rotates keeps logging to stdout exactly as before — setting it there would only duplicate what journald and syslog hold. `node.log_rotation` (hourly/daily/never, default daily) and `node.log_max_files` (default 7) govern the roll. Both parse leniently in the same way as `node.log_level`: a typo falls back to the default rather than refusing to boot, and the resolved values are logged at startup. Rotation is by period rather than by size, so `node.log_level` is what actually governs volume — debug costs roughly an order of magnitude more per day than info. Retention bounds the rest. Writes go through a non-blocking appender, so a slow or full disk cannot stall the tick loop behind a log write. The worker guard is held for the lifetime of the daemon; dropping it would silently discard every line logged afterward. The live file carries the date the current period opened, since that is how the appender names a rolled file. Splitting the configured path on its extension rather than suffixing the whole name keeps `.log` on the end, so `/var/log/fips/fips.log` is written as `fips.2026-08-31.log`. That does mean the current file no longer has a fixed name; the packaged config carries the `tail` incantation for it. Opening the log is fatal on failure, matching how this binary treats an unusable config. A daemon that silently dropped its logging because a directory was unwritable would present as exactly the disappearing-logs problem this exists to fix. macOS packaging is the only one that turns this on. The plist stops redirecting stdout and stderr, which would otherwise reintroduce the unbounded file alongside the rotated one; the cost is that a failure before logging initialises, and a panic, now go nowhere rather than to fips.log. The setting is inserted after the `node:` key rather than appended to the shared config, which ends at a top-level `peers:` key — an appended block would land under the wrong mapping, and a second top-level `node:` would collide with the first.
FIPS Documentation
FIPS (Free Internetworking Peering System) is a self-organizing encrypted mesh network built on Nostr identities, capable of operating over arbitrary transports — local networks, the public internet, Tor, Bluetooth, or point-to-point links — without central infrastructure.
With FIPS, your machine becomes a node in the mesh with a self-generated cryptographic identity. There are two ways to deploy it.
As an overlay on top of existing IP networks, FIPS lets your node reach any other FIPS node wherever it sits — behind a NAT, on a different ISP, on a phone over cellular, on a laptop with only Bluetooth in range, or behind a Tor onion. The mesh forwards IPv6 traffic transparently and end-to-end encrypted, with no central VPN concentrator or coordinating server.
From the ground up over raw Ethernet, WiFi, or Bluetooth, FIPS provides a complete permissionless network without any pre-existing IP infrastructure, ISP, or DNS. Any node that joins the link gets routable IPv6 addresses, peer discovery, and a path to every other node automatically.
Either way, existing networking software runs over it unchanged: SSH, HTTP servers, file transfer, anything IPv6-native works the same way it would on a local network.
New to FIPS? Start with the Getting Started guide.
Documentation Sections
Tutorials
If you are starting from scratch and want a guided path to a working mesh, go here.
How-To Guides
If you have a specific task in mind — enabling a feature, deploying a component, diagnosing a problem — go here.
Reference
If you need to look up wire formats, configuration keys, command flags, or counter inventories, go here.
Design
If you want to understand how the mesh self-organizes, why FIPS makes the choices it does, or how the pieces fit together, go here.
Releases
If you want the notes for a particular version — what changed, what broke, and what to do about it on upgrade — go here.