@le-space/rootfs 0.6.39 → 0.6.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/rootfs",
-  "version": "0.6.39",
+  "version": "0.6.41",
   "description": "Shared rootfs contract parsing, reference profile assets, and build helpers.",
   "license": "MIT",
   "type": "module",

package/reference/orbitdb-relay/rootfs/orbitdb-relay-bootstrap-refresh.py

@@ -24,6 +24,20 @@ ENV_FILE = os.environ.get("ENV_FILE", "/etc/default/orbitdb-relay")
 DESCRIBE_SCRIPT = os.environ.get(
     "DESCRIBE_SCRIPT", "/usr/local/sbin/orbitdb-relay-describe.py"
 )
+# The initial registration publish (triggered once by configure.sh) must not
+# give up before the browser path is dialable: Caddy's ACME can only complete
+# after the 2n6 DNS record propagates publicly (observed up to ~6-10 min under
+# load), while a single describe run waits at most its own 240 s window. The
+# next timer firing is 20 min away, so a one-shot publish leaves a dead zone
+# in which the registration advertises no browser-dialable address. Retry
+# describe+publish until a secure browser address exists or this deadline
+# passes (then publish whatever is available, matching the old behaviour).
+PUBLISH_RETRY_TIMEOUT_SECONDS = int(
+    os.environ.get("BOOTSTRAP_PUBLISH_RETRY_TIMEOUT_SECONDS", "900")
+)
+PUBLISH_RETRY_INTERVAL_SECONDS = int(
+    os.environ.get("BOOTSTRAP_PUBLISH_RETRY_INTERVAL_SECONDS", "15")
+)
 DEFAULT_API_HOST = os.environ.get("ALEPH_BOOTSTRAP_API_HOST", "https://api.aleph.im")
 DEFAULT_CHANNEL = os.environ.get("ALEPH_BOOTSTRAP_CHANNEL", "simple-todo")
 DEFAULT_REF = os.environ.get("ALEPH_BOOTSTRAP_REF", "simple-todo-bootstrap")
@@ -78,6 +92,20 @@ def is_browser_dialable(addr: str) -> bool:
     )
 
 
+def is_secure_browser_dialable(addr: str) -> bool:
+    """Mirror of the consumer-side address policy (testkit/app): a secure
+    websocket, or webtransport/webrtc-direct carrying a certhash. Plain /ws
+    does not count — an HTTPS page cannot dial it."""
+    normalized = addr.lower()
+    if "/tls/ws" in normalized or "/wss" in normalized:
+        return True
+    if (
+        "/webtransport" in normalized or "/webrtc-direct" in normalized
+    ) and "/certhash/" in normalized:
+        return True
+    return False
+
+
 def is_public_multiaddr(addr: str) -> bool:
     parts = split_multiaddr(addr)
     if not parts:
@@ -603,6 +631,62 @@ def main() -> None:
         )
         return
 
+    deadline = time.monotonic() + PUBLISH_RETRY_TIMEOUT_SECONDS
+    result: dict[str, object] | None = None
+    while True:
+        result = attempt_publish(
+            env_values,
+            publisher_private_key,
+            publisher_address,
+            registration_id,
+            channel,
+            ref,
+            post_type,
+            api_host,
+            require_secure_browser_dialable=True,
+        )
+        if result is not None:
+            break
+        if time.monotonic() >= deadline:
+            # Deadline passed without a secure browser address — publish what
+            # exists anyway (probe addresses still serve the Actions path).
+            result = attempt_publish(
+                env_values,
+                publisher_private_key,
+                publisher_address,
+                registration_id,
+                channel,
+                ref,
+                post_type,
+                api_host,
+                require_secure_browser_dialable=False,
+            )
+            break
+        time.sleep(PUBLISH_RETRY_INTERVAL_SECONDS)
+
+    if result is None:
+        print(json_dumps({"status": "skipped", "reason": "no public browser multiaddrs"}))
+        return
+    print(json_dumps(result))
+
+
+def attempt_publish(
+    env_values: dict[str, str],
+    publisher_private_key: str,
+    publisher_address: str,
+    registration_id: str | None,
+    channel: str,
+    ref: str,
+    post_type: str,
+    api_host: str,
+    require_secure_browser_dialable: bool,
+) -> dict[str, object] | None:
+    """One describe→publish cycle. Returns the result record when a
+    registration was published, or None when the caller should retry (no
+    public addresses yet, or — while `require_secure_browser_dialable` — none
+    of them is dialable from an HTTPS page). Nothing is published on the
+    retry path: an early registration without a browser-dialable address
+    makes consumers resolve too soon and fail."""
     describe = subprocess.run([DESCRIBE_SCRIPT], check=True, capture_output=True, text=True)
     metadata = json.loads(describe.stdout.strip() or "{}")
     peer_id = metadata.get("peer_id")
@@ -614,14 +698,22 @@ def main() -> None:
         metadata.get("browser_bootstrap_multiaddrs") or [], browser_only=True
     )
 
+    now_ms = int(time.time() * 1000)
     now_seconds = now_ms / 1000
     profile = env_values.get("ALEPH_BOOTSTRAP_PROFILE", DEFAULT_PROFILE).strip() or DEFAULT_PROFILE
     version = env_values.get("ALEPH_BOOTSTRAP_VERSION", "").strip() or None
     published_multiaddrs = select_compact_multiaddrs(browser_multiaddrs or multiaddrs)
+    # Intentionally left empty: consumers read content.multiaddrs (fallback),
+    # and the relayProof signature is byte-order-sensitive — populating
+    # browserMultiaddrs would change the signed payload shape. Cadence, not
+    # wire format, is what this retry loop fixes.
     published_browser_multiaddrs: list[str] = []
     if not published_multiaddrs:
-        print(json_dumps({"status": "skipped", "reason": "no public browser multiaddrs"}))
-        return
+        return None
+    if require_secure_browser_dialable and not any(
+        is_secure_browser_dialable(addr) for addr in published_multiaddrs
+    ):
+        return None
 
     owner_authorization = load_owner_authorization(
         env_values,
@@ -684,24 +776,20 @@ def main() -> None:
         api_host, publisher_address, publisher_private_key, previous_hashes, channel
     )
 
-    print(
-        json_dumps(
-            {
-                "status": "published",
-                "httpStatus": http_status,
-                "itemHash": unsigned_message["item_hash"],
-                "sender": publisher_address,
-                "peerId": peer_id,
-                "publishedMultiaddrs": published_multiaddrs,
-                "publishedBrowserMultiaddrs": published_browser_multiaddrs or published_multiaddrs,
-                "forgottenHashes": previous_hashes,
-                "forgetStaleOlderThanSeconds": STALE_RECORD_MAX_AGE_SECONDS,
-                "ownerAuthorizationPresent": owner_authorization is not None,
-                "forgetResponse": forget_response[1] if forget_response else None,
-                "response": response,
-            }
-        )
-    )
+    return {
+        "status": "published",
+        "httpStatus": http_status,
+        "itemHash": unsigned_message["item_hash"],
+        "sender": publisher_address,
+        "peerId": peer_id,
+        "publishedMultiaddrs": published_multiaddrs,
+        "publishedBrowserMultiaddrs": published_browser_multiaddrs or published_multiaddrs,
+        "forgottenHashes": previous_hashes,
+        "forgetStaleOlderThanSeconds": STALE_RECORD_MAX_AGE_SECONDS,
+        "ownerAuthorizationPresent": owner_authorization is not None,
+        "forgetResponse": forget_response[1] if forget_response else None,
+        "response": response,
+    }
 
 
 if __name__ == "__main__":

package/reference/orbitdb-relay/rootfs/orbitdb-relay-configure.sh

@@ -120,7 +120,15 @@ write_caddyfile() {
 https://${hostname} {
   tls {
     issuer acme {
-      disable_tlsalpn_challenge
+      # Solve the ACME challenge over TLS-ALPN-01 on :443, NOT HTTP-01.
+      # HTTP-01 needs a plaintext listener on :80, but the guest's setup
+      # server frees :80 after configuration and Caddy only binds :443, so
+      # Let's Encrypt's HTTP-01 probe gets a 503 and no cert is ever issued —
+      # browsers then dial wss://.../443 and fail with ERR_SSL_PROTOCOL_ERROR.
+      # :443 is already bound and CRN-port-mapped, so TLS-ALPN-01 succeeds
+      # (verified live: cert issued in ~45 s). Do NOT flip this back to
+      # disable_tlsalpn_challenge — that was b8b8c53 and it broke provisioning.
+      disable_http_challenge
     }
   }
 

package/reference/orbitdb-relay/rootfs/orbitdb-relay-describe.py

@@ -1,6 +1,9 @@
 #!/usr/bin/env python3
 import json
 import os
+import re
+import socket
+import ssl
 import time
 import urllib.error
 import urllib.request
@@ -8,11 +11,64 @@ import urllib.request
 
 ENV_FILE = os.environ.get("ENV_FILE", "/etc/default/orbitdb-relay")
 METRICS_PORT = int(os.environ.get("METRICS_PORT", "9090"))
+CADDY_HTTPS_PORT = int(os.environ.get("CADDY_HTTPS_PORT", "443"))
 WAIT_TIMEOUT_SECONDS = int(os.environ.get("DESCRIBE_WAIT_TIMEOUT_SECONDS", "240"))
 WAIT_INTERVAL_SECONDS = float(os.environ.get("DESCRIBE_WAIT_INTERVAL_SECONDS", "2"))
 AUTOTLS_EXTRA_WAIT_SECONDS = int(os.environ.get("DESCRIBE_AUTOTLS_EXTRA_WAIT_SECONDS", "120"))
 
 
+def tls_endpoint_serves(hostname: str, port: int) -> bool:
+    """True only once the local listener on `port` serves a publicly-trusted
+    TLS certificate for `hostname`.
+
+    The recurring failure shape ("advertise before the certificate serves"):
+    an address is announced as browser-dialable while its Let's Encrypt cert
+    is still being acquired, so browsers dialing it fail the TLS handshake
+    with net::ERR_SSL_PROTOCOL_ERROR. This bit twice — first for Caddy's 2n6
+    proxy (cert acquired asynchronously after the caddy restart), then for
+    libp2p AutoTLS (multiaddrs appear before the *.libp2p.direct cert is
+    live). Verify the real browser-facing certificate with a TLS handshake to
+    the local listener using the public hostname as SNI — done locally so
+    hairpin-NAT to the VM's own public IP is irrelevant, and validated
+    against the system CA store so any self-signed placeholder (Caddy's
+    pre-ACME fallback) is rejected.
+    """
+    if not hostname:
+        return False
+    context = ssl.create_default_context()
+    try:
+        with socket.create_connection(("127.0.0.1", port), timeout=8) as raw:
+            with context.wrap_socket(raw, server_hostname=hostname) as tls:
+                # A validated peer cert here means the handshake a browser
+                # will perform against this hostname succeeds too.
+                return bool(tls.getpeercert())
+    except (ssl.SSLError, OSError, ValueError):
+        return False
+
+
+def caddy_cert_serves(hostname: str) -> bool:
+    return tls_endpoint_serves(hostname, CADDY_HTTPS_PORT)
+
+
+def autotls_cert_serves(autotls_addrs: list[str]) -> bool:
+    """Verify the AutoTLS *.libp2p.direct certificate actually serves.
+
+    The libp2p WebSocket listener terminates the AutoTLS certificate itself,
+    so a CA-validated handshake to 127.0.0.1:<port> with the libp2p.direct
+    hostname as SNI proves what a browser's wss:// dial will experience. Both
+    the hostname AND the port must come from the multiaddr — the TLS is
+    served on the announced port (e.g. .../tcp/24007/tls/ws/...), NOT on the
+    plain-ws upstream Caddy proxies to.
+    """
+    for addr in autotls_addrs:
+        host_match = re.search(r"/dns[46]/([^/]+)/", addr) or re.search(r"/sni/([^/]+)/", addr)
+        port_match = re.search(r"/tcp/(\d+)/", addr)
+        if host_match and port_match:
+            if tls_endpoint_serves(host_match.group(1), int(port_match.group(1))):
+                return True
+    return False
+
+
 def parse_env_file(path: str) -> dict[str, str]:
     values: dict[str, str] = {}
     if not os.path.exists(path):
@@ -153,9 +209,39 @@ def main() -> None:
             all_multiaddrs = normalize_multiaddrs(multiaddrs_payload)
             grouped = build_grouped_multiaddrs(env_values, all_multiaddrs, peer_id)
             proxy_hostname = env_values.get("PROXY_HOSTNAME", "").strip()
-            if grouped["autotls_wss_multiaddrs"]:
-                break
-            if proxy_hostname and grouped["proxy_wss_multiaddrs"] and time.monotonic() - started_at >= AUTOTLS_EXTRA_WAIT_SECONDS:
+
+            # Symmetric certificate gate for BOTH browser paths. Whichever of
+            # Caddy/2n6 and libp2p AutoTLS finishes its ACME first varies per
+            # VM; breaking on the mere *presence* of AutoTLS multiaddrs made
+            # the outcome a per-VM coin flip — a fast AutoTLS zone produced an
+            # acknowledgement containing only libp2p.direct addresses whose
+            # cert was not serving yet (ERR_SSL_PROTOCOL_ERROR in browsers),
+            # while the verifiable 2n6 address never made it in. Only
+            # cert-verified addresses are advertised, and the wait ends as
+            # soon as at least one verified browser path exists.
+            proxy_cert_ready = bool(
+                proxy_hostname
+                and grouped["proxy_wss_multiaddrs"]
+                and caddy_cert_serves(proxy_hostname)
+            )
+            autotls_cert_ready = bool(
+                grouped["autotls_wss_multiaddrs"]
+                and autotls_cert_serves(grouped["autotls_wss_multiaddrs"])
+            )
+
+            unverified: set[str] = set()
+            if grouped["proxy_wss_multiaddrs"] and not proxy_cert_ready:
+                unverified.update(grouped["proxy_wss_multiaddrs"])
+            if grouped["autotls_wss_multiaddrs"] and not autotls_cert_ready:
+                unverified.update(grouped["autotls_wss_multiaddrs"])
+            if unverified:
+                grouped["browser_bootstrap_multiaddrs"] = [
+                    addr
+                    for addr in grouped["browser_bootstrap_multiaddrs"]
+                    if addr not in unverified
+                ]
+
+            if proxy_cert_ready or autotls_cert_ready:
                 break
             if not proxy_hostname and time.monotonic() - started_at >= AUTOTLS_EXTRA_WAIT_SECONDS:
                 break