qriton 0.3.1 → 0.4.0

package/deploy/nats/README.md

@@ -0,0 +1,68 @@
+# A qriton mesh relay on Azure
+
+The relay is a plain NATS server. qriton seals every payload end to end, so the relay sees only opaque bytes on opaque subjects: it cannot read, forge or replay messages, and it never holds a group key. It still sees client IP addresses, message sizes and timing.
+
+On a trusted local network you can skip all of this and run `nats-server` on any machine; the mesh is end-to-end encrypted either way.
+
+## 1. A small VM with a DNS name
+
+```bash
+az group create -n qriton-mesh -l westeurope
+az vm create -g qriton-mesh -n relay --image Ubuntu2404 --size Standard_B1s \
+  --admin-username azureuser --generate-ssh-keys --public-ip-address-dns-name <label>
+az vm open-port -g qriton-mesh -n relay --port 4222 --priority 900
+az vm open-port -g qriton-mesh -n relay --port 80 --priority 910   # only while issuing the certificate
+```
+
+The relay's name is `<label>.westeurope.cloudapp.azure.com`.
+
+## 2. nats-server, pinned and verified
+
+```bash
+ssh azureuser@<label>.westeurope.cloudapp.azure.com
+curl -fsSL -o nats.tar.gz https://github.com/nats-io/nats-server/releases/download/v2.15.0/nats-server-v2.15.0-linux-amd64.tar.gz
+echo "5d2c51caca950333aba84911df7d377f826f3a59ec36061c6539105084f65c92  nats.tar.gz" | sha256sum -c -
+tar -xzf nats.tar.gz && sudo install -m 755 nats-server-v2.15.0-linux-amd64/nats-server /usr/local/bin/
+sudo useradd --system --no-create-home --shell /usr/sbin/nologin nats
+```
+
+## 3. A TLS certificate
+
+```bash
+sudo apt-get install -y certbot
+sudo certbot certonly --standalone -d <label>.westeurope.cloudapp.azure.com
+sudo install -d -o root -g nats -m 750 /etc/nats/tls
+sudo cp /etc/letsencrypt/live/<label>.westeurope.cloudapp.azure.com/{fullchain,privkey}.pem /etc/nats/tls/
+sudo chgrp nats /etc/nats/tls/*.pem && sudo chmod 640 /etc/nats/tls/*.pem
+```
+
+Then close port 80 again (`az network nsg rule delete ...`, or open it only for renewals) and add a renewal hook that copies the new files and runs `systemctl reload nats-server`.
+
+## 4. Configuration and machine keys
+
+Copy `nats-server.conf` and `nats-server.service` from this folder to `/etc/nats/nats-server.conf` and `/etc/systemd/system/nats-server.service`. On each machine that will join, run `qriton mesh status` and add its **NATS user key** to the `users` list:
+
+```
+users = [
+  { nkey: "UCCBXLED...", permissions: $QRITON }   # laptop
+  { nkey: "UD4K2P7Q...", permissions: $QRITON }   # windows server
+]
+```
+
+```bash
+sudo nats-server -c /etc/nats/nats-server.conf -t       # check the file
+sudo systemctl daemon-reload && sudo systemctl enable --now nats-server
+```
+
+To remove a machine, delete its line and `sudo systemctl reload nats-server`. The server stores public keys only.
+
+## 5. The group
+
+```bash
+qriton mesh init tls://<label>.westeurope.cloudapp.azure.com:4222   # on the first machine; prints an invite code
+qriton mesh join <code>                                             # on each other machine
+```
+
+The invite code contains the group secret: pass it only over a channel you trust, never through the relay. Then set `"mesh": { "enabled": true }` in each machine's `~/.qriton/config.json`. `/peers` shows every machine's fingerprint; compare fingerprints out of band once.
+
+If a machine is lost or no longer trusted, remove its NATS key from the server and create a new group (`mesh leave`, `mesh init`, fresh invites) so the old group secret stops working.

package/deploy/nats/nats-server.conf

@@ -0,0 +1,31 @@
+# NATS server for the qriton mesh. qriton seals every payload end to end, so
+# this server only relays opaque bytes on opaque subjects (q.<hex>). It never
+# holds a group key and cannot read or forge messages.
+
+listen: "0.0.0.0:4222"
+
+# TLS is required for any server reachable from the internet.
+tls {
+  cert_file: "/etc/nats/tls/fullchain.pem"
+  key_file:  "/etc/nats/tls/privkey.pem"
+  timeout: 5
+}
+
+# One entry per machine: the "NATS user key" printed by `qriton mesh status`.
+# Removing a line removes that machine; no shared password to rotate.
+authorization {
+  QRITON = {
+    publish:   { allow: ["q.*"], deny: ["$SYS.>", "_INBOX.>"] }
+    subscribe: { allow: ["q.*"], deny: ["$SYS.>", "_INBOX.>"] }
+  }
+  users = [
+    # { nkey: "UXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", permissions: $QRITON }
+  ]
+}
+
+# Small messages only, and no monitoring or clustering port exposed.
+max_payload: 65536
+max_connections: 256
+max_subscriptions: 64
+write_deadline: "10s"
+ping_interval: "30s"

package/deploy/nats/nats-server.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=NATS server for the qriton mesh
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+User=nats
+Group=nats
+ExecStart=/usr/local/bin/nats-server -c /etc/nats/nats-server.conf
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=2
+
+# The relay needs its config, its certificate and a socket; nothing else.
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+CapabilityBoundingSet=
+ReadOnlyPaths=/etc/nats
+
+[Install]
+WantedBy=multi-user.target