@le-space/rootfs 0.7.0 → 0.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/rootfs",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Shared rootfs contract parsing, reference profile assets, and build helpers.",
   "license": "MIT",
   "type": "module",

package/reference/orbitdb-relay/contract.json

@@ -44,6 +44,12 @@
       "udp": false,
       "purpose": "libp2p TCP"
     },
+    {
+      "port": 9092,
+      "tcp": true,
+      "udp": false,
+      "purpose": "libp2p WebSocket and AutoTLS"
+    },
     {
       "port": 443,
       "tcp": true,

package/reference/orbitdb-relay/rootfs/build-rootfs-image.sh

@@ -245,6 +245,7 @@ case "${ROOTFS_PROFILE}" in
       --copy-in "${SCRIPT_DIR}/orbitdb-relay-bootstrap-refresh.timer:/etc/systemd/system"
       --copy-in "${SCRIPT_DIR}/orbitdb-relay-bootstrap-deregister.service:/etc/systemd/system"
       --copy-in "${SCRIPT_DIR}/orbitdb-relay-autotls-refresh.service:/etc/systemd/system"
+      --copy-in "${SCRIPT_DIR}/orbitdb-relay-autotls-refresh.timer:/etc/systemd/system"
       --copy-in "${SCRIPT_DIR}/orbitdb-relay-bootstrap.conf:/etc/systemd/system/orbitdb-relay.service.d"
       --run-command "tar -xf /opt/$(basename "${APP_TAR}") -C /opt/orbitdb-relay"
       --run-command "chmod 0755 /usr/local/sbin/orbitdb-relay-bootstrap.sh"
@@ -259,6 +260,7 @@ case "${ROOTFS_PROFILE}" in
 
     orbitdb_customize_args+=(
       --run-command "systemctl enable orbitdb-relay-bootstrap.service"
+      --run-command "systemctl enable orbitdb-relay-autotls-refresh.timer"
       --run-command "systemctl enable orbitdb-relay.service"
       --run-command "rm -f /opt/$(basename "${APP_TAR}")"
     )

package/reference/orbitdb-relay/rootfs/build-rootfs.sh

@@ -254,6 +254,7 @@ required_port_forwards_json() {
     { "port": 80, "tcp": true, "udp": false, "purpose": "Temporary setup endpoint" },
     { "port": 9090, "tcp": true, "udp": false, "purpose": "Metrics and health API" },
     { "port": 9091, "tcp": true, "udp": false, "purpose": "libp2p TCP" },
+    { "port": 9092, "tcp": true, "udp": false, "purpose": "libp2p WebSocket and AutoTLS" },
     { "port": 443, "tcp": true, "udp": false, "purpose": "Caddy HTTPS and WSS proxy" },
     { "port": 9093, "tcp": false, "udp": true, "purpose": "WebRTC direct" },
     { "port": 9094, "tcp": false, "udp": true, "purpose": "QUIC" }

package/reference/orbitdb-relay/rootfs/orbitdb-relay-autotls-refresh.py

@@ -1,6 +1,8 @@
 #!/usr/bin/env python3
 import json
 import os
+import socket
+import ssl
 import subprocess
 import time
 import urllib.error
@@ -24,6 +26,7 @@ CADDYFILE = os.environ.get("CADDYFILE", "/etc/caddy/Caddyfile")
 METRICS_PORT = int(os.environ.get("METRICS_PORT", "9090"))
 WAIT_TIMEOUT_SECONDS = int(os.environ.get("AUTOTLS_WAIT_TIMEOUT_SECONDS", "900"))
 WAIT_INTERVAL_SECONDS = float(os.environ.get("AUTOTLS_WAIT_INTERVAL_SECONDS", "5"))
+TLS_PROBE_TIMEOUT_SECONDS = float(os.environ.get("AUTOTLS_TLS_PROBE_TIMEOUT_SECONDS", "5"))
 
 
 def fetch_json(path: str) -> dict:
@@ -98,6 +101,43 @@ def ipv6_domain(ipv6: str, zone: str) -> str:
     return f"{subdomain}.{zone}"
 
 
+def listener_presents_certificate(port: str, server_name: str) -> bool:
+    """Does the local WebSocket listener actually terminate TLS?
+
+    This is the only question that matters before announcing a `/tls/...`
+    address, and until this existed nothing asked it. The previous gate read
+    `/multiaddrs` from the metrics endpoint and looked for a `/tls/ws` entry -
+    but that list is the *announce* list, which is what this script writes. It
+    confirmed its own output from the run before, so it passed on a relay whose
+    WebSocket port had never spoken TLS in its life.
+
+    The result on a live relay: `/ip4/.../tcp/52194/tls/sni/<host>/ws` announced
+    for a port that answers a plaintext handshake with `101 Switching
+    Protocols`. Browsers on an https origin got ERR_SSL_PROTOCOL_ERROR, and
+    every peer paid a TLS timeout on every connect
+    (see NiKrause/simple-todo#154).
+
+    Opening a socket cannot be fooled that way.
+    """
+    context = ssl.create_default_context()
+    # Asking whether *a* certificate is served, not whether it validates: the
+    # probe runs against loopback while the certificate is issued for the public
+    # AutoTLS hostname, so a chain check would fail on a healthy relay.
+    context.check_hostname = False
+    context.verify_mode = ssl.CERT_NONE
+
+    try:
+        with socket.create_connection(("127.0.0.1", int(port)), TLS_PROBE_TIMEOUT_SECONDS) as raw:
+            # SNI is not optional. Without `server_hostname` a name-based TLS
+            # server has nothing to select a certificate by and aborts the
+            # handshake - which made an earlier version of this probe report
+            # "no TLS" for Caddy on 443, a port that demonstrably serves one.
+            with context.wrap_socket(raw, server_hostname=server_name) as tls:
+                return tls.getpeercert(binary_form=True) is not None
+    except (OSError, ssl.SSLError, ValueError):
+        return False
+
+
 def wait_for_autotls_zone() -> str:
     deadline = time.monotonic() + WAIT_TIMEOUT_SECONDS
     last_error = "metrics endpoint never became ready"
@@ -105,17 +145,10 @@ def wait_for_autotls_zone() -> str:
     while time.monotonic() < deadline:
         try:
             health = fetch_json("/health")
-            payload = fetch_json("/multiaddrs")
             zone = health.get("autoTlsServingZone")
-            all_addrs = payload.get("all")
-            if (
-                isinstance(zone, str)
-                and zone
-                and isinstance(all_addrs, list)
-                and any(isinstance(addr, str) and "/tls/ws" in addr for addr in all_addrs)
-            ):
+            if isinstance(zone, str) and zone:
                 return zone
-            last_error = "AutoTLS secure websocket multiaddrs not advertised yet"
+            last_error = "AutoTLS serving zone not published yet"
         except (urllib.error.URLError, TimeoutError, json.JSONDecodeError) as error:
             last_error = str(error)
 
@@ -187,14 +220,40 @@ def main() -> None:
 
     env_values = parse_env_file(ENV_FILE)
     zone = wait_for_autotls_zone()
-    secure_addrs = build_secure_addrs(env_values, zone)
-    exact_hosts = secure_hosts(env_values, zone)
+
+    # Announce a TLS address only where something terminates TLS. The relay
+    # listens plaintext on RELAY_WS_PORT and Caddy terminates on 443; if AutoTLS
+    # has not taken over that listener, the libp2p.direct addresses would be a
+    # promise the port cannot keep. Caddy's own 443 address is written elsewhere
+    # and is unaffected by this - it keeps working either way.
+    internal_ws_port = env_values.get("RELAY_WS_PORT", "").strip()
+    autotls_hostname = metrics_https_public_host(env_values, zone)
+    autotls_serving = bool(internal_ws_port and autotls_hostname) and listener_presents_certificate(
+        internal_ws_port, autotls_hostname
+    )
+
+    if autotls_serving:
+        secure_addrs = build_secure_addrs(env_values, zone)
+    else:
+        secure_addrs = []
+        print(
+            f"AutoTLS is not terminating TLS on 127.0.0.1:{internal_ws_port or '<unset>'} - "
+            "skipping the libp2p.direct announce addresses. Peers keep the Caddy "
+            "address on 443, which is served by a separate process."
+        )
+    exact_hosts = secure_hosts(env_values, zone) if autotls_serving else []
     metrics_host = metrics_https_public_host(env_values, zone)
     current_value = env_values.get("VITE_APPEND_ANNOUNCE", "")
     current_metrics_host = env_values.get("METRICS_HTTPS_PUBLIC_HOST", "").strip()
-    merged = dedupe(
-        [normalize_addr(addr) for addr in current_value.split(",") if addr.strip()] + secure_addrs
-    )
+    previous = [normalize_addr(addr) for addr in current_value.split(",") if addr.strip()]
+
+    # Drop stale libp2p.direct entries when the probe says they are not served.
+    # Without this the first bad run leaves them in the file forever - which is
+    # how the live relay kept announcing a plaintext port across restarts.
+    if not autotls_serving:
+        previous = [addr for addr in previous if "libp2p.direct" not in addr]
+
+    merged = dedupe(previous + secure_addrs)
     announce_changed = current_value.split(",") != merged
     metrics_host_changed = bool(metrics_host) and current_metrics_host != metrics_host
 
@@ -223,7 +282,21 @@ def main() -> None:
     elif os.path.exists(AUTOTLS_CADDY_READY_FILE):
         os.remove(AUTOTLS_CADDY_READY_FILE)
 
-    open(AUTOTLS_READY_FILE, "a", encoding="utf-8").close()
+    # The ready file is what stops this unit from running again
+    # (ConditionPathExists=! in the unit), so it may only be written once the
+    # AutoTLS addresses are actually announced. Writing it unconditionally is
+    # what made a single early probe final: AutoTLS needs a minute or two to
+    # fetch its certificate, the probe correctly found a plaintext port before
+    # that, marked itself done - and the certificate that arrived afterwards was
+    # never announced. The timer beside this unit retries until it is here.
+    if autotls_serving:
+        open(AUTOTLS_READY_FILE, "a", encoding="utf-8").close()
+    else:
+        print(
+            "Not marking AutoTLS ready - no TLS on the listener yet. "
+            f"{os.path.basename(AUTOTLS_READY_FILE)} stays absent so the timer retries."
+        )
+
     print(f"Updated VITE_APPEND_ANNOUNCE={announce_value}")
 
 

package/reference/orbitdb-relay/rootfs/orbitdb-relay-autotls-refresh.timer

@@ -0,0 +1,22 @@
+[Unit]
+# AutoTLS fetches its certificate a minute or two after the relay starts, and
+# the refresh unit runs seconds after it. Without a retry the probe sees a
+# plaintext listener, correctly declines to announce a TLS address - and never
+# looks again, so a certificate that arrives later is never advertised.
+#
+# The unit's own ConditionPathExists=! on the ready file is the stop condition:
+# once the addresses are announced, every later firing is skipped by systemd
+# before python starts. This timer therefore costs nothing after success.
+Description=Retry the AutoTLS announce refresh for orbitdb-relay until it succeeds
+After=orbitdb-relay.service
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=2min
+# Certificates can take a while on a busy ACME endpoint, and the relay is
+# usable over Caddy on 443 throughout - so retrying patiently costs nothing.
+AccuracySec=15s
+Unit=orbitdb-relay-autotls-refresh.service
+
+[Install]
+WantedBy=timers.target

package/reference/uc-go-peer/rootfs/uc-go-peer-configure.sh

@@ -83,6 +83,23 @@ https://${proxy_hostname} {
         reverse_proxy http://127.0.0.1:80
     }
 
+    # The address and readiness documents live on the setup server (:80). A PWA
+    # served over HTTPS cannot fetch that port directly -- the browser blocks it
+    # as mixed content -- so they have to be reachable through this proxy.
+    # Named handles must precede the catch-all, which swallows everything else
+    # into the WebSocket backend.
+    handle /describe {
+        reverse_proxy http://127.0.0.1:80
+    }
+
+    handle /multiaddrs {
+        reverse_proxy http://127.0.0.1:80
+    }
+
+    handle /health {
+        reverse_proxy http://127.0.0.1:80
+    }
+
     handle {
         reverse_proxy http://127.0.0.1:${WS_BACKEND_PORT}
     }

package/reference/uc-go-peer/rootfs/uc-go-peer-setup-server.py

@@ -476,6 +476,15 @@ class Handler(BaseHTTPRequestHandler):
             self._handle_metadata()
             return
 
+        # orbitdb-relay serves its address document at /multiaddrs, so consumers
+        # look for one path on every profile. /metadata already carries exactly
+        # that document -- it runs the same describe script -- it was just named
+        # after the deploy flow that first needed it and reachable only on the
+        # plain-HTTP setup port. Expose the same payload under the shared names.
+        if self._request_path() in ("/describe", "/multiaddrs"):
+            self._handle_describe()
+            return
+
         if self._request_path() not in ("/", "/health"):
             self._send_json(404, {"status": "not-found"})
             return
@@ -486,6 +495,23 @@ class Handler(BaseHTTPRequestHandler):
         status, payload = _metadata_status_payload()
         self._send_json(status, payload)
 
+    def _handle_describe(self) -> None:
+        status, payload = _metadata_status_payload()
+        if status != 200:
+            self._send_json(status, payload)
+            return
+        # Unwrap the `metadata` envelope: a consumer asking for the address
+        # document wants the document, not the readiness wrapper around it.
+        metadata = payload.get("metadata")
+        if not isinstance(metadata, dict):
+            self._send_json(500, {"status": "error", "error": "describe payload missing"})
+            return
+        document = dict(metadata)
+        document["profile"] = "uc-go-peer"
+        if payload.get("stale"):
+            document["stale"] = True
+        self._send_json(200, document)
+
     def do_POST(self) -> None:  # noqa: N802
         if self._request_path() != "/configure":
             self._send_json(404, {"status": "not-found"})