mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
d3cf1d6f25
Bring the source tree to its finished v0.4.0 content state ahead of the release candidate. Documentation, changelog, release notes, and packaging metadata only; no code or version-string changes. CHANGELOG.md: backfill the operator-visible changes that landed since v0.3.0 (the show_metrics scraper query and fipsctl stats metrics, the discovery dedup-cache-full counter, the off-rx_loop control read surface and its new daemon-resolved fields, the fipstop TUI overhaul, the TCP inbound cap now honoring max_connections, host-map hot-reload, log-noise demotions, and the net bug fixes), topic-grouped rather than replayed per commit; intra-cycle fixes folded into their feature entries; the duplicate Unreleased Fixed section merged into one. Release notes: author docs/releases/release-notes-v0.4.0.md to the operator-upgrade bar and mirror it byte-for-byte into the root RELEASE-NOTES.md. Attribute each feature to its author in Contributors (Nym transport and the mixnet demo to @oleksky, opt-in mDNS LAN discovery to @mmalmi). README.md: add the Nym transport to the support matrix (Linux, macOS, Windows; OpenWrt pending verification), the multi-transport bullet, and the "What works today" list; fold mDNS LAN discovery into the existing Nostr-discovery bullets; refresh the status narrative to v0.4.0 over a global, public test mesh. packaging/common/fips.yaml: add commented Nym transport and mDNS LAN discovery example stanzas with verified field names and defaults. Cargo.toml: add homepage, keywords, and categories crate metadata. docs/reference: update the cli-fips version example to the released form; document the new control-socket output fields and the typed RejectReason families in control-socket.md; sync cli-fipstop.md with the overhauled TUI keybindings.
152 lines
5.8 KiB
YAML
152 lines
5.8 KiB
YAML
# FIPS Node Configuration
|
|
|
|
node:
|
|
identity:
|
|
# By default, a new ephemeral keypair is generated on each start.
|
|
# Uncomment persistent to keep the same identity across restarts;
|
|
# on first start a keypair is saved to fips.key/fips.pub next to
|
|
# this config file (mode 0600/0644).
|
|
# persistent: true
|
|
#
|
|
# Or set an explicit key (overrides persistent):
|
|
# nsec: "nsec1..."
|
|
discovery:
|
|
# Optional Nostr-mediated overlay endpoint discovery.
|
|
# nostr:
|
|
# enabled: true
|
|
# policy: configured_only # disabled | configured_only | open
|
|
# open_discovery_max_pending: 64 # caps queued open-discovery retries
|
|
# app: "fips-overlay-v1"
|
|
# advertise: true
|
|
# advert_relays:
|
|
# - "wss://relay.damus.io"
|
|
# - "wss://nos.lol"
|
|
# - "wss://offchain.pub"
|
|
# dm_relays:
|
|
# - "wss://relay.damus.io"
|
|
# - "wss://nos.lol"
|
|
# - "wss://offchain.pub"
|
|
# # Optional override. If omitted, FIPS uses the built-in STUN list.
|
|
# # Built-in relay/STUN defaults are best-effort and should be
|
|
# # overridden by operators for production use.
|
|
# stun_servers:
|
|
# - "stun:stun.l.google.com:19302"
|
|
# - "stun:stun.cloudflare.com:3478"
|
|
# - "stun:global.stun.twilio.com:3478"
|
|
#
|
|
# Optional mDNS-based LAN discovery for sub-second same-LAN pairing.
|
|
# Opt-in (default false): default-off avoids a per-LAN identity
|
|
# broadcast on nodes that have deliberately disabled other discovery
|
|
# channels, and avoids any multicast surprise on upgrade. Requires an
|
|
# operational UDP transport (the advertised port is the one peers dial).
|
|
# lan:
|
|
# enabled: false
|
|
# # Optional application/network scope carried in the LAN-only TXT
|
|
# # record. Browsers that set a scope ignore adverts for other scopes.
|
|
# # Kept separate from the Nostr discovery `app` tag so relay-visible
|
|
# # adverts can stay generic while LAN discovery stays per-private-network.
|
|
# # scope: "lab-floor-3"
|
|
# # Advanced: overrides the mDNS service type. Leave unset in normal
|
|
# # use — only needed to run multiple isolated services on one
|
|
# # interface (e.g. test isolation on loopback).
|
|
# # service_type: "_fips._udp.local."
|
|
|
|
tun:
|
|
enabled: true
|
|
name: fips0
|
|
mtu: 1280
|
|
|
|
dns:
|
|
enabled: true
|
|
# bind_addr defaults to "::1" (IPv6 loopback). The shipped
|
|
# fips-dns-setup script configures systemd-resolved with a global
|
|
# /etc/systemd/resolved.conf.d/fips.conf drop-in pointing at
|
|
# [::1]:5354.
|
|
#
|
|
# Set "::" to expose the responder to mesh peers as well (e.g. for
|
|
# gateway hosts that resolve .fips on behalf of LAN clients). The
|
|
# mesh-interface filter in src/upper/dns.rs will still defend
|
|
# /etc/fips/hosts aliases from cross-mesh enumeration.
|
|
# bind_addr: "::1"
|
|
port: 5354
|
|
|
|
transports:
|
|
udp:
|
|
bind_addr: "0.0.0.0:2121"
|
|
# advertise_on_nostr: true
|
|
# public: false # false => advertise udp:nat; true => advertise bound host:port
|
|
# accept_connections: true # default; refuse inbound msg1 when false
|
|
# outbound_only: false # true => bind ephemeral, no listener on a
|
|
# # known port. Forces advertise_on_nostr=false
|
|
# # and accept_connections=false. Pure-client
|
|
# # posture; bind_addr is ignored.
|
|
|
|
tcp:
|
|
# Accepts inbound connections. No static outbound peers.
|
|
bind_addr: "0.0.0.0:8443"
|
|
# advertise_on_nostr: true
|
|
|
|
# Ethernet transport — uncomment and set your interface name.
|
|
# ethernet:
|
|
# interface: "eth0"
|
|
# discovery: true
|
|
# announce: true
|
|
# auto_connect: true
|
|
# accept_connections: true
|
|
|
|
# Bluetooth Low Energy transport — requires BlueZ and the 'ble' feature.
|
|
# ble:
|
|
# adapter: "hci0"
|
|
# mtu: 2048
|
|
# advertise: true
|
|
# scan: true
|
|
# auto_connect: true
|
|
# accept_connections: true
|
|
|
|
# Nym transport — outbound-only connections through the Nym mixnet for
|
|
# sender/receiver privacy. This is a privacy posture, not a NAT-traversal
|
|
# or failover transport: it only dials out (no inbound listener) and is
|
|
# chosen for its anonymity properties. Requires a nym-socks5-client
|
|
# running separately as its own process; FIPS dials it over SOCKS5.
|
|
# nym:
|
|
# socks5_addr: "127.0.0.1:1080" # nym-socks5-client SOCKS5 address
|
|
# connect_timeout_ms: 300000 # outbound connect timeout (300s);
|
|
# # mixnet round-trips can take minutes
|
|
# mtu: 1400 # per-connection MTU
|
|
# startup_timeout_secs: 120 # wait for nym-socks5-client readiness
|
|
|
|
# Outbound LAN gateway. Allows non-FIPS hosts on the LAN to reach
|
|
# mesh destinations via DNS-allocated virtual IPs and kernel NAT.
|
|
# Requires: IPv6 forwarding enabled, fips daemon running with DNS.
|
|
# gateway:
|
|
# enabled: true
|
|
# pool: "fd01::/112"
|
|
# lan_interface: "eth0"
|
|
# dns:
|
|
# listen: "[::1]:5353"
|
|
# # upstream must match the daemon's dns.bind_addr above. The
|
|
# # default "[::1]:5354" matches the daemon's default. If you set
|
|
# # the daemon to bind on a wildcard ("::") or specific address,
|
|
# # update upstream to match — explicit ::1 sockets do not accept
|
|
# # v4 traffic.
|
|
# upstream: "[::1]:5354"
|
|
# ttl: 60
|
|
# pool_grace_period: 60
|
|
# conntrack:
|
|
# tcp_established: 432000
|
|
# udp_timeout: 30
|
|
# udp_assured: 180
|
|
# icmp_timeout: 30
|
|
|
|
peers: []
|
|
# Static peers for bootstrapping (UDP or TCP):
|
|
# - npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98"
|
|
# alias: "gateway"
|
|
# via_nostr: true
|
|
# addresses:
|
|
# - transport: udp
|
|
# addr: "test-us01.fips.network:2121" # IP or hostname (e.g., "peer.example.com:2121")
|
|
# - transport: udp
|
|
# addr: "nat" # Use node.discovery.nostr for Nostr/STUN hole punching
|
|
# connect_policy: auto_connect
|