aboutsummaryrefslogtreecommitdiffstats
path: root/src/node.rs
Commit message (Collapse)AuthorAgeFilesLines
* remake: no --follow-strict-remakes; a strict remake failing says whotv5 days1-3/+1
| | | | | | | | | | | | | | | | | A strict remake takes a majority of members whose --strict-keys take its manifest's signer: no node votes for one without, so --follow-strict-remakes (1173) goes. A node that doesn't vote still switches once the others commit, as with any remake. So that an operator can tell why one fails: a strict remake aborted for want of a majority (the voting period over, or a majority out of reach) says in its reason (GET /admin/remakes/{id}, and the coordinator's log) which members didn't vote, and that a member votes for one only with its manifest signed by a key of its --strict-keys. Each of those logs why itself (`Not voting for a strict remake`). The sim a_strict_remake_too_few_take: only a takes the manifest; the remake aborts, naming b and c.
* remake: turning a running swarm strict, keeping what an operator signedtv5 days1-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Until a swarm is strict, the user a change names is its node's word, so any member could have planted registry entries, policy, bans or user-signed values as any user, plain or signed by a key it put there itself; writing the strict policy trusted all of it as it was. A remake of a new kind, `strict`, turns a swarm strict instead: * Its content is a manifest (access::strict): the swarm, the strict policy, and each value kept at the places values are signed, by the SHA-256 of its JSON, signed by an operator (ssh-keygen -Y sign -n continuum-strict). * Every node builds the next epoch as compaction does, keeping at the signed places only the values the manifest names, as they were at the base, and writing its policy (RemakeKind::protocol, the one kind that changes protocol data). Writes after the base reach the new epoch only by replays, judged by the strict policy. * A node votes for one only with its manifest signed by one of --strict-keys, keys given out of the document; without any, for none (logged once, `Not voting for a strict remake`), unless --follow-strict-remakes. A coordinator proposes only what it would vote for (403). Once a majority commits one, every node switches, as with any remake: refusing to switch would only cut a node off. * GET /admin/strict-manifest gives the manifest keeping everything held now, the values for review and the heads they are at; continuum-signed strict shows them, signs once confirmed and proposes at those heads. The sim a_swarm_turning_strict_through_a_remake: a member plants a registry entry as a manager; the operator's manifest leaves it out; a and b, given the key, commit; c, without, follows; the entry is gone and the policy strict everywhere.
* login: logins by key capped per usertv5 days1-0/+5
| | | | | | | | | | | | Review 6: a node remembers the challenges used until they expire, 10 000 at most, and refused every login by key once full. One user holding a key could make 10 000 logins within five minutes and keep everyone else out. A user may now log in by key at most --key-logins-per-user times (100) on a node within a challenge's lifetime, past which that user waits and others don't; the 10 000 stay as the cap for all users together. The lifetime, five minutes until now, is --challenge-lifetime.
* auth: logging in by keytv6 days1-0/+1
| | | | | | | | POST /auth/challenge and /auth/login/key: a node-signed challenge, valid five minutes and taken once, signed with one of the user's SSH keys (ssh-keygen -Y sign -n continuum-login), for a token. Auth plan M7 (key login, M2b).
* access: the policy enforcedtv6 days1-0/+1
| | | | | | | | _continuum/access/policy ({"version": 1}) has every node screen every change it receives, on every path changes come in. A policy a node doesn't know stops its writes through the API. GET /admin/refused. Auth plan M6.
* signatures: on their own (SIGNATURES)tv6 days1-0/+1
| | | | | | | Signatures no sync message took go on their own within a second, to each peer not sent them yet (wire version bumped). Auth plan M5.
* signatures: with sync messagestv6 days1-2/+4
| | | | | | | Sync messages carry, for each actor's writes, the latest signature the sender checked; the receiver checks it once it holds the change. Auth plan M5.
* signatures: kept in the document filetv6 days1-1/+5
| | | | | | | A node's signatures are saved with its document (--document-file) and loaded with it. Auth plan M5.
* signatures: --sign-everytv6 days1-0/+6
| | | | | | | | Changes left unsigned are vouched for by the node's next signature: --sign-every 1s (default) signs the latest within a second, all signs every change, none only those that must be. Auth plan M5.
* signatures: changes signed by their nodetv6 days1-1/+3
| | | | | | | | | | Every node signs the changes it commits with its node key, an Ed25519 signature over the change's hash, kept beside the document. One signature on an actor's latest change vouches for its earlier ones. Protocol data and paths listed in _continuum/access/signed are signed, and writes with ?signed=true. Auth plan M5.
* dashboard: without LINKS; LINKS removedtv6 days1-4/+0
| | | | | | | | | The dashboard reads every member's links from the members themselves; LINKS and LINKS_REPLY, swarm::links and their wire tags go (wire version bumped). Nodes the browser can't reach are drawn from what the reachable ones measure. Auth plan M3.
* dashboard: own links over the API, and CORStv6 days1-0/+3
| | | | | | | | | GET /admin/dashboard/links/own and its event stream: a node's own links, as LINKS_REPLY carried them, for other members' dashboards with a token. CORS for the members' dashboard origins and --cors-origins, without credentials. Auth plan M3.
* auth: logging in, and tokens as bearerstv6 days1-0/+8
| | | | | | | | | POST /auth/login (by htpasswd or the proxy), /auth/refresh, /auth/logout, GET /auth/whoami; every request may bring Authorization: Bearer instead of a password. --token-lifetime and --session-lifetime. Auth plan M2.
* access: the users endpointstv6 days1-1/+1
| | | | | | | | /admin/users: list, add (one or several), remove, disable, grant and revoke capabilities; each one change, refused if it would lock its writer out. Capabilities as the store's paths name them. Auth plan M1.
* access: first users at genesistv6 days1-0/+5
| | | | | | | | --bootstrap-users gives a new swarm a registry from its first change, each first user with everything; other users may do nothing until added. Without it the swarm has no registry and works as before. Auth plan M1.
* HyParView (slim)tv7 days1-2/+7
|
* plumtreetv7 days1-1/+3
|
* dissemination traittv7 days1-0/+1
|
* topology traittv7 days1-0/+1
|
* working links recordedtv7 days1-0/+1
|
* push by defaulttv8 days1-4/+0
|
* push changes experimenttv9 days1-0/+4
|
* slow round back offtv9 days1-0/+1
|
* announce what trees misstv10 days1-0/+1
|
* add writer treestv10 days1-0/+1
|
* measure 2-hop neighbourhoodtv11 days1-0/+1
|
* add stream heartbeattv11 days1-0/+3
|
* dashboard: double-click opens peer dashboardtv11 days1-0/+3
|
* probe when reachabletv12 days1-0/+4
|
* introduce per-transport sync reply timeouttv12 days1-1/+2
|
* path probes follow keepalivetv12 days1-0/+1
|
* peer worker forget records on changetv12 days1-0/+1
|
* peer worker sleeps until deadline, not fixed timetv12 days1-0/+1
|
* bootstrap: replace pull by progress notifytv12 days1-0/+1
|
* LWW everywhere, mostlytv12 days1-0/+3
|
* state: drop epoch_txtv12 days1-2/+0
| | | | The stamp is the only lock-free epoch label.
* move all automerge references to documenttv13 days1-1/+1
|
* rename AutoMerge to Documenttv13 days1-2/+2
|
* detect local clock jumpstv13 days1-1/+1
|
* propagate clock figurestv13 days1-0/+1
|
* add peer clock skew warningtv13 days1-0/+3
|
* pong carries timetv13 days1-0/+1
|
* document: move knowledge about node to swarmtv14 days1-1/+1
|
* move change publisher to own moduletv14 days1-2/+2
|
* unify closing logictv14 days1-1/+1
|
* allow links subscriptionstv14 days1-0/+3
|
* add links messagestv14 days1-0/+1
| | | | | | | | | Introduce two new wire messages, LINKS and LINKS_REPLY (swarm::links). A member answers with its links: for each peer, the transport, whether it’s relayed, the RTT, and whether it’s dormant. It answers members only, at most every 5 s. This bumps wire::VERSION to 7. Every build answers, with or without the feature, so every node needs this patch before the map shows anything beyond its own node.
* add document lock statstv2026-10-281-1/+1
|
* move keepalive and firewall to pathstv2026-10-281-8/+7
|
* add identity layertv2026-10-271-6/+18
|
generated by cgit v1.3.1 (git 2.54.0) at 2026-11-13 16:08:41 +0000