@le-space/rootfs 0.6.6 → 0.6.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/rootfs",
-  "version": "0.6.6",
+  "version": "0.6.19",
   "description": "Shared rootfs contract parsing, reference profile assets, and build helpers.",
   "license": "MIT",
   "type": "module",

package/reference/orbitdb-relay/rootfs/orbitdb-relay-bootstrap-refresh.py

@@ -168,7 +168,8 @@ def json_dumps(payload: object) -> str:
 def sign_personal_message(private_key: str, payload: str) -> str:
     message = encode_defunct(text=payload)
     signed = Account.sign_message(message, private_key=private_key)
-    return signed.signature.hex()
+    signature = signed.signature.hex()
+    return signature if signature.startswith("0x") else f"0x{signature}"
 
 
 def address_from_private_key(private_key: str) -> str:
@@ -179,6 +180,21 @@ def signature_payload(chain: str, sender: str, message_type: str, item_hash: str
     return "\n".join([chain, sender, message_type, item_hash])
 
 
+def registration_id_instance_item_hash(registration_id: str | None) -> str | None:
+    normalized = str(registration_id or "").strip()
+    if not normalized:
+        return None
+
+    parts = [part.strip() for part in normalized.split(":") if part.strip()]
+    if not parts:
+        return None
+
+    candidate = parts[-1]
+    if len(candidate) == 64 and all(char in "0123456789abcdefABCDEF" for char in candidate):
+        return candidate
+    return None
+
+
 def relay_authorization_payload(
     owner_address: str,
     publisher_address: str,
@@ -186,6 +202,7 @@ def relay_authorization_payload(
     registration_id: str | None,
     profile: str | None,
     version: str | None,
+    instance_item_hash: str | None,
     issued_at: int,
 ) -> dict[str, object]:
     return {
@@ -195,7 +212,7 @@ def relay_authorization_payload(
         "registrationId": registration_id,
         "profile": profile,
         "version": version,
-        "instanceItemHash": None,
+        "instanceItemHash": instance_item_hash,
         "issuedAt": issued_at,
         "expiresAt": None,
     }
@@ -244,6 +261,7 @@ def load_owner_authorization(
         return None
 
     owner_address = address_from_private_key(owner_private_key)
+    instance_item_hash = registration_id_instance_item_hash(registration_id)
     payload = relay_authorization_payload(
         owner_address,
         publisher_address,
@@ -251,6 +269,7 @@ def load_owner_authorization(
         registration_id,
         profile,
         version,
+        instance_item_hash,
         issued_at,
     )
     return {
@@ -260,6 +279,28 @@ def load_owner_authorization(
     }
 
 
+def resolve_owner_address(
+    env_values: dict[str, str],
+    owner_authorization: dict[str, object] | None,
+) -> str | None:
+    if isinstance(owner_authorization, dict):
+        payload = owner_authorization.get("payload")
+        if isinstance(payload, dict):
+            owner_address = str(payload.get("ownerAddress") or "").strip()
+            if owner_address:
+                return owner_address
+
+    owner_address = env_values.get("ALEPH_BOOTSTRAP_OWNER_ADDRESS", "").strip()
+    if owner_address:
+        return owner_address
+
+    owner_private_key = env_values.get("ALEPH_BOOTSTRAP_OWNER_PRIVATE_KEY", "").strip()
+    if owner_private_key:
+        return address_from_private_key(owner_private_key)
+
+    return None
+
+
 def post_json(url: str, body: dict[str, object]) -> tuple[int, dict]:
     data = json_dumps(body).encode("utf-8")
     request = urllib.request.Request(
@@ -293,9 +334,11 @@ def build_post_content(
     registration_id: str | None,
     profile: str | None,
     version: str | None,
+    owner_address: str | None,
     owner_authorization: dict[str, object] | None,
     relay_proof: dict[str, object],
     now_ms: int,
+    now_seconds: float,
     ref: str,
     post_type: str,
 ) -> dict[str, object]:
@@ -306,22 +349,20 @@ def build_post_content(
         "registrationId": registration_id,
         "profile": profile,
         "version": version,
-        "ownerAddress": (
-            owner_authorization.get("payload", {}).get("ownerAddress")
-            if isinstance(owner_authorization, dict)
-            else None
-        ),
+        "ownerAddress": owner_address,
         "publisherAddress": sender,
         "authorization": owner_authorization,
         "relayProof": relay_proof,
         "updatedAt": now_ms,
     }
+    if browser_multiaddrs:
+        content["browserMultiaddrs"] = browser_multiaddrs
     return {
         "type": post_type,
         "address": sender,
         "ref": ref,
         "content": content,
-        "time": now_ms,
+        "time": now_seconds,
     }
 
 
@@ -550,9 +591,7 @@ def main() -> None:
         version,
         now_ms,
     )
-    if owner_authorization is None:
-        print(json_dumps({"status": "skipped", "reason": "missing owner authorization"}))
-        return
+    owner_address = resolve_owner_address(env_values, owner_authorization)
 
     proof_payload = relay_proof_payload(
         peer_id,
@@ -576,9 +615,11 @@ def main() -> None:
         registration_id,
         profile,
         version,
+        owner_address,
         owner_authorization,
         relay_proof,
         now_ms,
+        now_seconds,
         ref,
         post_type,
     )
@@ -614,6 +655,7 @@ def main() -> None:
                 "publishedBrowserMultiaddrs": published_browser_multiaddrs or published_multiaddrs,
                 "forgottenHashes": previous_hashes,
                 "forgetStaleOlderThanSeconds": STALE_RECORD_MAX_AGE_SECONDS,
+                "ownerAuthorizationPresent": owner_authorization is not None,
                 "forgetResponse": forget_response[1] if forget_response else None,
                 "response": response,
             }

package/reference/orbitdb-relay/rootfs/orbitdb-relay-bootstrap.sh

@@ -118,6 +118,5 @@ write_env_var "RELAY_WEBRTC_PORT" "9093"
 write_env_var "RELAY_QUIC_PORT" "9094"
 write_env_var "RELAY_DISABLE_WEBRTC" "1"
 write_env_var "RELAY_DISABLE_BOOTSTRAP" "1"
-write_env_var "disableAutoTLS" "1"
 write_env_var "ENABLE_GENERAL_LOGS" "1"
 write_env_var "DEBUG" "'libp2p:websockets:listener'"

package/reference/orbitdb-relay/rootfs/orbitdb-relay-configure.sh

@@ -75,7 +75,13 @@ write_caddyfile() {
   auto_https disable_redirects
 }
 
-${hostname} {
+https://${hostname} {
+  tls {
+    issuer acme {
+      disable_tlsalpn_challenge
+    }
+  }
+
   # Proxy the full orbitdb-relay HTTP API surface to the metrics/HTTP port.
   # Everything else falls through to the relay WebSocket backend for browser libp2p.
   handle /health {
@@ -202,11 +208,11 @@ fi
 if [ -n "${PROXY_HOSTNAME}" ]; then
   announce+=("/dns4/${PROXY_HOSTNAME}/tcp/443/tls/ws")
   announce+=("/dns6/${PROXY_HOSTNAME}/tcp/443/tls/ws")
-else
-  announce+=("/ip4/${PUBLIC_IPV4}/tcp/${WS_PORT}/ws")
-  if [ -n "${PUBLIC_IPV6}" ]; then
-    announce+=("/ip6/${PUBLIC_IPV6}/tcp/${WS_PORT}/ws")
-  fi
+fi
+
+announce+=("/ip4/${PUBLIC_IPV4}/tcp/${WS_PORT}/ws")
+if [ -n "${PUBLIC_IPV6}" ]; then
+  announce+=("/ip6/${PUBLIC_IPV6}/tcp/${WS_PORT}/ws")
 fi
 
 if [ -n "${WEBRTC_PORT}" ]; then

package/reference/ucan-store/rootfs/ucan-store-configure.sh

@@ -8,6 +8,7 @@ BOOTSTRAP_VALIDATOR="${BOOTSTRAP_VALIDATOR:-/usr/local/sbin/ucan_store_bootstrap
 BOOTSTRAP_CRYPTO_VERIFIER="${BOOTSTRAP_CRYPTO_VERIFIER:-/usr/local/sbin/ucan-store-bootstrap-verify.mjs}"
 BOOTSTRAP_VERIFICATION_FILE="${BOOTSTRAP_VERIFICATION_FILE:-/etc/ucan-store/bootstrap-verification.json}"
 SERVICE_NAME="${SERVICE_NAME:-ucan-store.service}"
+BOOTSTRAP_SERVICE="${BOOTSTRAP_SERVICE:-ucan-store-bootstrap.service}"
 CADDY_SERVICE="${CADDY_SERVICE:-caddy.service}"
 CADDYFILE="${CADDYFILE:-/etc/caddy/Caddyfile}"
 SERVICE_PORT="${SERVICE_PORT:-8787}"
@@ -75,10 +76,19 @@ PY
 }
 
 write_caddyfile() {
+  local service_hostname="${1:-}"
+  local proxy_hostname="${2:-}"
+  local primary_hostname="${service_hostname}"
   local hostnames=()
   local hostname
   local known
-  for hostname in "$@"; do
+
+  if [ -z "${primary_hostname}" ]; then
+    primary_hostname="${proxy_hostname}"
+    proxy_hostname=""
+  fi
+
+  for hostname in "${primary_hostname}" "${proxy_hostname}"; do
     if [ -z "${hostname}" ]; then
       continue
     fi
@@ -100,11 +110,13 @@ write_caddyfile() {
     return 0
   fi
 
-  local site_label
+  local http_site_label=""
   local index
-  site_label="${hostnames[0]}"
-  for ((index = 1; index < ${#hostnames[@]}; index++)); do
-    site_label+=", ${hostnames[${index}]}"
+  for ((index = 0; index < ${#hostnames[@]}; index++)); do
+    if [ -n "${http_site_label}" ]; then
+      http_site_label+=", "
+    fi
+    http_site_label+="http://${hostnames[${index}]}"
   done
   mkdir -p "$(dirname "${CADDYFILE}")"
   cat > "${CADDYFILE}" <<EOF
@@ -112,10 +124,31 @@ write_caddyfile() {
   auto_https disable_redirects
 }
 
-${site_label} {
+${http_site_label} {
+  reverse_proxy 127.0.0.1:${PROXY_PORT}
+}
+
+https://${primary_hostname} {
+  tls {
+    issuer acme {
+      disable_tlsalpn_challenge
+    }
+  }
+
   reverse_proxy 127.0.0.1:${PROXY_PORT}
 }
 EOF
+
+  if [ -n "${proxy_hostname}" ] && [ "${proxy_hostname}" != "${primary_hostname}" ]; then
+    cat >> "${CADDYFILE}" <<EOF
+
+https://${proxy_hostname} {
+  tls internal
+
+  reverse_proxy 127.0.0.1:${PROXY_PORT}
+}
+EOF
+  fi
 }
 
 derive_hostname_from_origin() {
@@ -299,15 +332,19 @@ if [ -n "${WEBAUTHN_ORIGIN}" ]; then
 fi
 write_env_var "WEBAUTHN_ORIGIN_FALLBACKS" "${WEBAUTHN_ORIGIN_FALLBACKS}"
 
-if [ -z "${SERVICE_DID}" ] && [ -n "${PROXY_HOSTNAME}" ]; then
-  SERVICE_DID="$(derive_service_did_from_hostname "${PROXY_HOSTNAME}")"
-fi
-
 if [ -z "${SERVICE_ORIGIN}" ] && [ -n "${PROXY_HOSTNAME}" ]; then
   SERVICE_ORIGIN="https://${PROXY_HOSTNAME}"
 fi
 SERVICE_HOSTNAME="$(derive_hostname_from_origin "${SERVICE_ORIGIN}")"
 
+if [ -z "${SERVICE_DID}" ]; then
+  if [ -n "${SERVICE_HOSTNAME}" ]; then
+    SERVICE_DID="$(derive_service_did_from_hostname "${SERVICE_HOSTNAME}")"
+  elif [ -n "${PROXY_HOSTNAME}" ]; then
+    SERVICE_DID="$(derive_service_did_from_hostname "${PROXY_HOSTNAME}")"
+  fi
+fi
+
 write_env_var "UCAN_STORE_SERVICE_DID" "${SERVICE_DID}"
 write_env_var "UCAN_STORE_SERVICE_HOSTNAME" "${SERVICE_HOSTNAME}"
 
@@ -323,7 +360,7 @@ if [ -n "${SERVICE_ORIGIN}" ]; then
 fi
 
 if [ -n "${PROXY_HOSTNAME}" ]; then
-  write_caddyfile "${PROXY_HOSTNAME}" "${SERVICE_HOSTNAME}"
+  write_caddyfile "${SERVICE_HOSTNAME:-}" "${PROXY_HOSTNAME}"
 fi
 
 touch "${READY_FILE}"
@@ -332,7 +369,12 @@ if [ "${START_SERVICE}" = "1" ]; then
   systemctl daemon-reload
   systemctl restart "${SERVICE_NAME}"
   if [ -n "${PROXY_HOSTNAME}" ]; then
-    systemctl restart "${CADDY_SERVICE}"
+    systemctl enable "${CADDY_SERVICE}" >/dev/null 2>&1 || true
+    if systemctl is-active --quiet "${BOOTSTRAP_SERVICE}"; then
+      systemctl reset-failed "${CADDY_SERVICE}" >/dev/null 2>&1 || true
+    else
+      systemctl restart "${CADDY_SERVICE}"
+    fi
   fi
 
   PROBED_SERVICE_DID="$(probe_service_did)"

package/reference/ucan-store/rootfs/ucan-store-setup-server.py

@@ -12,6 +12,8 @@ ENV_FILE = os.environ.get("ENV_FILE", "/etc/default/ucan-store")
 READY_FILE = os.environ.get("READY_FILE", "/etc/default/ucan-store.ready")
 SERVICE_NAME = os.environ.get("SERVICE_NAME", "ucan-store.service")
 BOOTSTRAP_SERVICE = os.environ.get("BOOTSTRAP_SERVICE", "ucan-store-bootstrap.service")
+CADDY_SERVICE = os.environ.get("CADDY_SERVICE", "caddy.service")
+CADDYFILE = os.environ.get("CADDYFILE", "/etc/caddy/Caddyfile")
 CONFIGURE_SCRIPT = "/usr/local/sbin/ucan-store-configure.sh"
 DESCRIBE_SCRIPT = "/usr/local/sbin/ucan-store-describe.py"
 METADATA_FILE = os.environ.get("METADATA_FILE", "/run/ucan-store-setup-metadata.json")
@@ -49,6 +51,18 @@ def _generate_metadata_files() -> None:
 
 
 def _stop_bootstrap_service() -> None:
+    if os.path.exists(CADDYFILE):
+        subprocess.run(
+            [
+                "systemd-run",
+                "--unit=ucan-store-caddy-after-bootstrap",
+                "--on-active=3",
+                "/bin/systemctl",
+                "restart",
+                CADDY_SERVICE,
+            ],
+            check=False,
+        )
     subprocess.run(["systemctl", "stop", BOOTSTRAP_SERVICE], check=False)