lfg2025/archy
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases 33 Wiki Activity

feat: federate 3 servers with Tor, fix inter-node auth (FED-DEPLOY-02)

Browse Source 
- Add tor-hostnames fallback for reading onion addresses when system Tor
  owns hidden_service directories (permissions 700)
- Exempt federation.peer-joined, federation.get-state, and
  federation.peer-address-changed from auth/CSRF (inter-node RPC)
- Set up system Tor with AppArmor overrides on archipelago-2 and 3
- All 3 servers federated and syncing successfully

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Dorian
2026-03-13 01:52:50 +00:00
parent 16f6cda679
commit c45f0c8fb8
3 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
loop/plan.md
View File

@@ -504,7 +504,7 @@
- [x] **FED-DEPLOY-01** — Deployed to 3/4 servers (192.168.1.198 offline). Primary (192.168.1.228): full deploy via deploy script. Archipelago-2: full deploy via deploy script. Archipelago-3: SCP binary from archipelago-2, frontend tarball extracted, service restarted. All 3 servers return health OK (200), frontend loads.
- [ ] **FED-DEPLOY-02** — Federate all servers. On primary (192.168.1.228), call `federation.invite` to generate 3 invite codes (one per peer server). On each secondary server, call `federation.join` with the invite code. Verify bilateral trust is established: `federation.list-nodes` on primary shows all 3 peers as "trusted", each peer shows primary as "trusted". Trigger `federation.sync-state` and verify state snapshots contain real data (CPU, memory, disk, app list) from each peer. **Acceptance**: `federation.list-nodes` on any server lists all 4 nodes with recent `last_seen` timestamps and valid state snapshots.
- [x] **FED-DEPLOY-02** — Federated 3 servers (192.168.1.198 offline). Fixed: Tor hostname reading (tor-hostnames dir for system Tor), AppArmor profiles, inter-node RPC auth exemption (federation.peer-joined/get-state/peer-address-changed). Primary has 2 peers (archipelago-2 and archipelago-3), each peer has primary as trusted. Sync works: archipelago-2 has 24 apps, archipelago-3 has 10 apps.
- [ ] **FED-DEPLOY-03** — Validate Nostr discovery across all nodes. On each server, call `node.nostr-publish` to publish identity to relays. Wait 30 seconds for relay propagation. On each server, call `node.nostr-discover` — verify it finds all other 3 nodes (DID, onion address, version). If discovery fails: check relay connectivity (are relays reachable from server?), check Tor proxy routing, check NIP-33 event format. Fix any issues. **Acceptance**: Every server can discover every other server via Nostr relays. Run discovery 3 times from each to confirm reliability.