@le-space/rootfs 0.6.3 → 0.6.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/rootfs",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "description": "Shared rootfs contract parsing, reference profile assets, and build helpers.",
   "license": "MIT",
   "type": "module",

package/reference/ucan-store/rootfs/ucan-store-bootstrap.sh

@@ -131,6 +131,9 @@ EOF
   write_env_var "PUBLIC_RECEIPTS_URL" ""
 
   rm -f "${BOOTSTRAP_PACKAGE_FILE}" "${BOOTSTRAP_VERIFICATION_FILE}"
+
+  # Caddy is started explicitly after /configure writes the deployment hostname.
+  systemctl disable caddy.service >/dev/null 2>&1 || true
 }
 
 case "${PHASE}" in

package/reference/ucan-store/rootfs/ucan-store-configure.sh

@@ -12,9 +12,12 @@ CADDY_SERVICE="${CADDY_SERVICE:-caddy.service}"
 CADDYFILE="${CADDYFILE:-/etc/caddy/Caddyfile}"
 SERVICE_PORT="${SERVICE_PORT:-8787}"
 PROXY_PORT="${PROXY_PORT:-8788}"
+SERVICE_GROUP="${SERVICE_GROUP:-ucan-store}"
 PUBLIC_IPV4=""
 PUBLIC_IPV6=""
 PROXY_HOSTNAME=""
+SERVICE_DID=""
+SERVICE_ORIGIN=""
 WEBAUTHN_ORIGIN=""
 WEBAUTHN_ORIGIN_FALLBACKS=""
 ADMIN_DID=""
@@ -29,6 +32,8 @@ Usage:
     --public-ipv4 <ip> \
     [--public-ipv6 <ipv6>] \
     [--proxy-hostname <hostname>] \
+    [--service-did <did>] \
+    [--service-origin <origin>] \
     [--webauthn-origin <origin>] \
     [--webauthn-origin-fallbacks <csv>] \
     [--admin-did <did>] \
@@ -138,7 +143,11 @@ install_bootstrap_package() {
     --admin-did "${ADMIN_DID}" \
     --summary-file "${BOOTSTRAP_VERIFICATION_FILE}" >/dev/null
   cp "${source_file}" "${BOOTSTRAP_PACKAGE_FILE}"
-  chmod 0640 "${BOOTSTRAP_PACKAGE_FILE}"
+  if chgrp "${SERVICE_GROUP}" "${BOOTSTRAP_PACKAGE_FILE}" 2>/dev/null; then
+    chmod 0640 "${BOOTSTRAP_PACKAGE_FILE}"
+  else
+    chmod 0644 "${BOOTSTRAP_PACKAGE_FILE}"
+  fi
   chmod 0644 "${BOOTSTRAP_VERIFICATION_FILE}"
 }
 
@@ -156,6 +165,14 @@ while [ "$#" -gt 0 ]; do
       PROXY_HOSTNAME="${2:-}"
       shift 2
       ;;
+    --service-did)
+      SERVICE_DID="${2:-}"
+      shift 2
+      ;;
+    --service-origin)
+      SERVICE_ORIGIN="${2:-}"
+      shift 2
+      ;;
     --webauthn-origin)
       WEBAUTHN_ORIGIN="${2:-}"
       shift 2
@@ -196,6 +213,7 @@ if [ -z "${PUBLIC_IPV4}" ]; then
   usage >&2
   exit 1
 fi
+SERVICE_ORIGIN="${SERVICE_ORIGIN%/}"
 
 touch "${ENV_FILE}"
 
@@ -217,14 +235,24 @@ if [ -n "${WEBAUTHN_ORIGIN}" ]; then
 fi
 write_env_var "WEBAUTHN_ORIGIN_FALLBACKS" "${WEBAUTHN_ORIGIN_FALLBACKS}"
 
+if [ -z "${SERVICE_DID}" ] && [ -n "${PROXY_HOSTNAME}" ]; then
+  SERVICE_DID="$(derive_service_did_from_hostname "${PROXY_HOSTNAME}")"
+fi
+
+if [ -z "${SERVICE_ORIGIN}" ] && [ -n "${PROXY_HOSTNAME}" ]; then
+  SERVICE_ORIGIN="https://${PROXY_HOSTNAME}"
+fi
+
+write_env_var "UCAN_STORE_SERVICE_DID" "${SERVICE_DID}"
+
+if [ -n "${SERVICE_ORIGIN}" ]; then
+  write_env_var "PUBLIC_UPLOAD_SERVICE_URL" "${SERVICE_ORIGIN}"
+  write_env_var "PUBLIC_REVOCATION_URL" "${SERVICE_ORIGIN}"
+  write_env_var "PUBLIC_RECEIPTS_URL" "${SERVICE_ORIGIN}/receipt/"
+fi
+
 if [ -n "${PROXY_HOSTNAME}" ]; then
-  write_env_var "UCAN_STORE_SERVICE_DID" "$(derive_service_did_from_hostname "${PROXY_HOSTNAME}")"
   write_caddyfile "${PROXY_HOSTNAME}"
-  write_env_var "PUBLIC_UPLOAD_SERVICE_URL" "https://${PROXY_HOSTNAME}"
-  write_env_var "PUBLIC_REVOCATION_URL" "https://${PROXY_HOSTNAME}"
-  write_env_var "PUBLIC_RECEIPTS_URL" "https://${PROXY_HOSTNAME}/receipt/"
-else
-  write_env_var "UCAN_STORE_SERVICE_DID" ""
 fi
 
 touch "${READY_FILE}"
@@ -236,25 +264,24 @@ if [ "${START_SERVICE}" = "1" ]; then
     systemctl restart "${CADDY_SERVICE}"
   fi
 
-  SERVICE_DID="$(probe_service_did)"
-  write_env_var "UCAN_STORE_SERVICE_DID" "${SERVICE_DID}"
+  PROBED_SERVICE_DID="$(probe_service_did)"
+  if [ -z "${SERVICE_DID}" ]; then
+    SERVICE_DID="${PROBED_SERVICE_DID}"
+    write_env_var "UCAN_STORE_SERVICE_DID" "${SERVICE_DID}"
+  fi
   write_env_var "PUBLIC_UPLOAD_SERVICE_DID" "${SERVICE_DID}"
   write_env_var "PUBLIC_REVOCATION_DID" "${SERVICE_DID}"
 
   if [ -f "${BOOTSTRAP_PACKAGE_FILE}" ]; then
-    RUNTIME_SERVICE_ORIGIN=""
-    if [ -n "${PROXY_HOSTNAME}" ]; then
-      RUNTIME_SERVICE_ORIGIN="https://${PROXY_HOSTNAME}"
-    fi
     python3 "${BOOTSTRAP_VALIDATOR}" \
       --package-file "${BOOTSTRAP_PACKAGE_FILE}" \
       --runtime-service-did "${SERVICE_DID}" \
-      --runtime-service-origin "${RUNTIME_SERVICE_ORIGIN}" \
+      --runtime-service-origin "${SERVICE_ORIGIN}" \
       --admin-did "${ADMIN_DID}" >/dev/null
     node "${BOOTSTRAP_CRYPTO_VERIFIER}" \
       --package-file "${BOOTSTRAP_PACKAGE_FILE}" \
       --runtime-service-did "${SERVICE_DID}" \
-      --runtime-service-origin "${RUNTIME_SERVICE_ORIGIN}" \
+      --runtime-service-origin "${SERVICE_ORIGIN}" \
       --admin-did "${ADMIN_DID}" \
       --summary-file "${BOOTSTRAP_VERIFICATION_FILE}" >/dev/null
   fi

package/reference/ucan-store/rootfs/ucan-store-setup-server.py

@@ -137,6 +137,8 @@ class Handler(BaseHTTPRequestHandler):
             proxy_candidate if "://" in proxy_candidate else f"https://{proxy_candidate}"
         ) if proxy_candidate else None
         proxy_hostname = parsed_proxy.hostname if parsed_proxy and parsed_proxy.hostname else proxy_candidate
+        service_did = str(payload.get("service_did") or "").strip()
+        service_origin = str(payload.get("service_origin") or "").strip()
         admin_did = str(payload.get("admin_did") or "").strip()
         webauthn_origin = str(payload.get("webauthn_origin") or "").strip()
         webauthn_origin_fallbacks = str(payload.get("webauthn_origin_fallbacks") or "").strip()
@@ -163,6 +165,10 @@ class Handler(BaseHTTPRequestHandler):
             args.extend(["--public-ipv6", public_ipv6])
         if proxy_hostname:
             args.extend(["--proxy-hostname", proxy_hostname])
+        if service_did:
+            args.extend(["--service-did", service_did])
+        if service_origin:
+            args.extend(["--service-origin", service_origin])
         if admin_did:
             args.extend(["--admin-did", admin_did])
         if webauthn_origin: