mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-09 08:14:42 +00:00
Johnathan Corgan
74e9d465a8
Packaging directory structure: - packaging/common/ — shared config (fips.yaml) used by all formats - packaging/systemd/ — systemd-specific installer and service units Systemd packaging includes: - build-tarball.sh: builds release binaries and creates a self-contained install tarball with stripped binaries - fips.service: systemd unit running the daemon with security hardening - fips-dns.service: oneshot unit configuring resolvectl to route .fips domain queries to the FIPS DNS shim on 127.0.0.1:5354 - install.sh: deploys binaries to /usr/local/bin, installs systemd units, creates fips group for non-root control socket access - uninstall.sh: removes service and binaries, optional --purge for config and identity key files - README.install.md: installation and configuration guide Default config enables UDP (2121), TCP inbound (8443), TUN, and DNS resolver. Identity is ephemeral by default for privacy; operators can uncomment persistent: true to maintain a stable npub for static peer publishing. Ethernet transport is commented out for per-node setup.
48 lines
1.1 KiB
YAML
48 lines
1.1 KiB
YAML
# FIPS Node Configuration
|
|
|
|
node:
|
|
identity:
|
|
# By default, a new ephemeral keypair is generated on each start.
|
|
# Uncomment persistent to keep the same identity across restarts;
|
|
# on first start a keypair is saved to fips.key/fips.pub next to
|
|
# this config file (mode 0600/0644).
|
|
# persistent: true
|
|
#
|
|
# Or set an explicit key (overrides persistent):
|
|
# nsec: "nsec1..."
|
|
|
|
tun:
|
|
enabled: true
|
|
name: fips0
|
|
mtu: 1280
|
|
|
|
dns:
|
|
enabled: true
|
|
bind_addr: "127.0.0.1"
|
|
port: 5354
|
|
|
|
transports:
|
|
udp:
|
|
bind_addr: "0.0.0.0:2121"
|
|
|
|
tcp:
|
|
# Accepts inbound connections. No static outbound peers.
|
|
bind_addr: "0.0.0.0:8443"
|
|
|
|
# Ethernet transport — uncomment and set your interface name.
|
|
# ethernet:
|
|
# interface: "eth0"
|
|
# discovery: true
|
|
# announce: true
|
|
# auto_connect: true
|
|
# accept_connections: true
|
|
|
|
peers: []
|
|
# Static peers for bootstrapping (UDP or TCP):
|
|
# - npub: "npub1..."
|
|
# alias: "gateway"
|
|
# addresses:
|
|
# - transport: udp
|
|
# addr: "217.77.8.91:2121" # public FIPS testing node
|
|
# connect_policy: auto_connect
|