Johnathan Corgan
9ccad388c8
Nothing printed a node's fd00::/8 mesh address without a running daemon: keygen prints the nsec and npub only, and every show path goes through the control socket. That blocks fips-initramfs, whose postinst has to write the address of the identity it just generated into DROPBEAR_OPTIONS at image build time, when no daemon is running and none can be. fipsctl address prints the address and nothing else, so it can be captured in a shell substitution. It takes an npub or a hostname from the hosts file, or --key naming a key file (an nsec) or public key file (an npub); with neither it reads fips.key from the default key directory, falling back to the world-readable fips.pub beside it, since fips.key is mode 0600 and an unprivileged run cannot read it. The derivation is the library's own: PeerIdentity/Identity compute the address from the public key exactly as the daemon computes its own, so the packaging does not gain a second copy free to drift. The command returns before the socket path is resolved, alongside keygen, so no connection is attempted. (cherry picked from commit 6e8a0033dbc9a546a2d24cc295335ccef0cd0ead)
FIPS Documentation
FIPS (Free Internetworking Peering System) is a self-organizing encrypted mesh network built on Nostr identities, capable of operating over arbitrary transports — local networks, the public internet, Tor, Bluetooth, or point-to-point links — without central infrastructure.
With FIPS, your machine becomes a node in the mesh with a self-generated cryptographic identity. There are two ways to deploy it.
As an overlay on top of existing IP networks, FIPS lets your node reach any other FIPS node wherever it sits — behind a NAT, on a different ISP, on a phone over cellular, on a laptop with only Bluetooth in range, or behind a Tor onion. The mesh forwards IPv6 traffic transparently and end-to-end encrypted, with no central VPN concentrator or coordinating server.
From the ground up over raw Ethernet, WiFi, or Bluetooth, FIPS provides a complete permissionless network without any pre-existing IP infrastructure, ISP, or DNS. Any node that joins the link gets routable IPv6 addresses, peer discovery, and a path to every other node automatically.
Either way, existing networking software runs over it unchanged: SSH, HTTP servers, file transfer, anything IPv6-native works the same way it would on a local network.
New to FIPS? Start with the Getting Started guide.
Documentation Sections
Tutorials
If you are starting from scratch and want a guided path to a working mesh, go here.
How-To Guides
If you have a specific task in mind — enabling a feature, deploying a component, diagnosing a problem — go here.
Reference
If you need to look up wire formats, configuration keys, command flags, or counter inventories, go here.
Design
If you want to understand how the mesh self-organizes, why FIPS makes the choices it does, or how the pieces fit together, go here.