5 Commits

Include renames

Author	SHA1	Message	Date
jochen	86cbebd10f	Say controller in the installer's and the token's words, as the glossary does	2026-10-08 01:46:21 +02:00
jschoubben	c38f21bb39	A machine makes its tunnel key first and joins through the tunnel ... nox-mesh-host key makes the tunnel key, or reads the one made, and prints its public half for the token to be issued for. enrol with a token that carries a tunnel takes that key, refuses another, writes mesh0 with the hub as its one peer and starts it, then reaches the bus over it (novox/hq ADR 0169). Tokens without a tunnel enrol as before.	2026-10-08 01:33:30 +02:00
jschoubben	770f589401	Report what an adopted node holds, its firewall and what is reachable, and speak unasked when that changes (hq ADR 0100)	2026-09-22 17:22:31 +02:00
jschoubben	bdc9c436b4	The token says what the mesh calls this machine ... Found by raising a mesh end to end for the first time. Enrolment's own help says the token "is the only thing it needs", and it also needed --name, with no default. Without it the failure is: cannot reach the broker at 192.0.2.10:5671 as : username or password not allowed An empty username, and nothing about the cause. The node cannot work its own name out. The broker account it authenticates as is named after it and exists before this machine has been told anything, so the name has to arrive with the rest. It is not a secret and the issuer already knows it. --name stays, as an override for a token issued before the name travelled in one, and says so when it is needed rather than failing at the broker. Also corrects the bundle example, which claimed to stop before the control plane runs and has raised one for some time. A comment about what something does not do is a comment nobody updates.	2026-08-30 02:36:42 +02:00
jschoubben	65d896d96e	A node makes its own identity, and checks the broker before speaking ... The host side of enrolment. It parses a token the control plane issued, dials the broker, refuses anything but the pinned certificate, and generates an Ed25519 keypair whose private half never leaves the machine. Verified against a real LavinMQ serving a real certificate: the pin matched and the node proceeded. Then against a second broker with a different certificate on another port, which was refused -- with an error that says retrying will not help, because it does not mean the network is down, it means the mesh was substituted. InsecureSkipVerify is set and that is the point rather than a weakening. At bootstrap the broker is self-signed and reached at an address, so there is no authority to trace and no name to match. Chain and hostname checks are replaced with something stricter: this exact certificate or nothing, checked in VerifyPeerCertificate, which runs before the handshake completes -- so nothing is sent to the wrong broker. There is a test that counts the bytes an impostor receives, and it is zero. The token format is defined separately here and in the control plane, because this binary requires nothing present and does not import it. They are held together by a test on each side asserting the exact field names, so a rename breaks both immediately rather than at enrolment on a real machine. Two distinctions the identity file has to keep. A machine that never joined has no identity, which is an ordinary state and not a fault. A machine whose identity cannot be read is a different thing entirely, and must not take the same path -- re-enrolling would discard the identity the mesh still believes and need a person with a new token. Fault injection found the second case untested: the corrupt-file test was passing on the parse check, so the read-error path had nothing defending it. It does now. An already-enrolled machine refuses to enrol again rather than quietly acquiring a second identity. What is not built is the link. Enrolment stops after verifying the broker and generating the identity, having saved nothing, so it can be run again unchanged. 132 tests, plus 32 launcher and 9 rollback.	2026-08-29 15:38:19 +02:00