aboutsummaryrefslogtreecommitdiffstats
path: root/src/node.rs
Commit message (Collapse)AuthorAgeFilesLines
* remake: no --follow-strict-remakes; a strict remake failing says whotv3 days1-3/+1
| | | | | | | | | | | | | | | | | A strict remake takes a majority of members whose --strict-keys take its manifest's signer: no node votes for one without, so --follow-strict-remakes (1173) goes. A node that doesn't vote still switches once the others commit, as with any remake. So that an operator can tell why one fails: a strict remake aborted for want of a majority (the voting period over, or a majority out of reach) says in its reason (GET /admin/remakes/{id}, and the coordinator's log) which members didn't vote, and that a member votes for one only with its manifest signed by a key of its --strict-keys. Each of those logs why itself (`Not voting for a strict remake`). The sim a_strict_remake_too_few_take: only a takes the manifest; the remake aborts, naming b and c.
* remake: turning a running swarm strict, keeping what an operator signedtv3 days1-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Until a swarm is strict, the user a change names is its node's word, so any member could have planted registry entries, policy, bans or user-signed values as any user, plain or signed by a key it put there itself; writing the strict policy trusted all of it as it was. A remake of a new kind, `strict`, turns a swarm strict instead: * Its content is a manifest (access::strict): the swarm, the strict policy, and each value kept at the places values are signed, by the SHA-256 of its JSON, signed by an operator (ssh-keygen -Y sign -n continuum-strict). * Every node builds the next epoch as compaction does, keeping at the signed places only the values the manifest names, as they were at the base, and writing its policy (RemakeKind::protocol, the one kind that changes protocol data). Writes after the base reach the new epoch only by replays, judged by the strict policy. * A node votes for one only with its manifest signed by one of --strict-keys, keys given out of the document; without any, for none (logged once, `Not voting for a strict remake`), unless --follow-strict-remakes. A coordinator proposes only what it would vote for (403). Once a majority commits one, every node switches, as with any remake: refusing to switch would only cut a node off. * GET /admin/strict-manifest gives the manifest keeping everything held now, the values for review and the heads they are at; continuum-signed strict shows them, signs once confirmed and proposes at those heads. The sim a_swarm_turning_strict_through_a_remake: a member plants a registry entry as a manager; the operator's manifest leaves it out; a and b, given the key, commit; c, without, follows; the entry is gone and the policy strict everywhere.
* login: logins by key capped per usertv3 days1-0/+5
| | | | | | | | | | | | Review 6: a node remembers the challenges used until they expire, 10 000 at most, and refused every login by key once full. One user holding a key could make 10 000 logins within five minutes and keep everyone else out. A user may now log in by key at most --key-logins-per-user times (100) on a node within a challenge's lifetime, past which that user waits and others don't; the 10 000 stay as the cap for all users together. The lifetime, five minutes until now, is --challenge-lifetime.
* auth: logging in by keytv4 days1-0/+1
| | | | | | | | POST /auth/challenge and /auth/login/key: a node-signed challenge, valid five minutes and taken once, signed with one of the user's SSH keys (ssh-keygen -Y sign -n continuum-login), for a token. Auth plan M7 (key login, M2b).
* access: the policy enforcedtv4 days1-0/+1
| | | | | | | | _continuum/access/policy ({"version": 1}) has every node screen every change it receives, on every path changes come in. A policy a node doesn't know stops its writes through the API. GET /admin/refused. Auth plan M6.
* signatures: on their own (SIGNATURES)tv4 days1-0/+1
| | | | | | | Signatures no sync message took go on their own within a second, to each peer not sent them yet (wire version bumped). Auth plan M5.
* signatures: with sync messagestv4 days1-2/+4
| | | | | | | Sync messages carry, for each actor's writes, the latest signature the sender checked; the receiver checks it once it holds the change. Auth plan M5.
* signatures: kept in the document filetv4 days1-1/+5
| | | | | | | A node's signatures are saved with its document (--document-file) and loaded with it. Auth plan M5.
* signatures: --sign-everytv4 days1-0/+6
| | | | | | | | Changes left unsigned are vouched for by the node's next signature: --sign-every 1s (default) signs the latest within a second, all signs every change, none only those that must be. Auth plan M5.
* signatures: changes signed by their nodetv4 days1-1/+3
| | | | | | | | | | Every node signs the changes it commits with its node key, an Ed25519 signature over the change's hash, kept beside the document. One signature on an actor's latest change vouches for its earlier ones. Protocol data and paths listed in _continuum/access/signed are signed, and writes with ?signed=true. Auth plan M5.
* dashboard: without LINKS; LINKS removedtv4 days1-4/+0
| | | | | | | | | The dashboard reads every member's links from the members themselves; LINKS and LINKS_REPLY, swarm::links and their wire tags go (wire version bumped). Nodes the browser can't reach are drawn from what the reachable ones measure. Auth plan M3.
* dashboard: own links over the API, and CORStv4 days1-0/+3
| | | | | | | | | GET /admin/dashboard/links/own and its event stream: a node's own links, as LINKS_REPLY carried them, for other members' dashboards with a token. CORS for the members' dashboard origins and --cors-origins, without credentials. Auth plan M3.
* auth: logging in, and tokens as bearerstv4 days1-0/+8
| | | | | | | | | POST /auth/login (by htpasswd or the proxy), /auth/refresh, /auth/logout, GET /auth/whoami; every request may bring Authorization: Bearer instead of a password. --token-lifetime and --session-lifetime. Auth plan M2.
* access: the users endpointstv4 days1-1/+1
| | | | | | | | /admin/users: list, add (one or several), remove, disable, grant and revoke capabilities; each one change, refused if it would lock its writer out. Capabilities as the store's paths name them. Auth plan M1.
* access: first users at genesistv4 days1-0/+5
| | | | | | | | --bootstrap-users gives a new swarm a registry from its first change, each first user with everything; other users may do nothing until added. Without it the swarm has no registry and works as before. Auth plan M1.
* HyParView (slim)tv5 days1-2/+7
|
* plumtreetv5 days1-1/+3
|
* dissemination traittv5 days1-0/+1
|
* topology traittv5 days1-0/+1
|
* working links recordedtv5 days1-0/+1
|
* push by defaulttv6 days1-4/+0
|
* push changes experimenttv6 days1-0/+4
|
* slow round back offtv7 days1-0/+1
|
* announce what trees misstv8 days1-0/+1
|
* add writer treestv8 days1-0/+1
|
* measure 2-hop neighbourhoodtv8 days1-0/+1
|
* add stream heartbeattv9 days1-0/+3
|
* dashboard: double-click opens peer dashboardtv9 days1-0/+3
|
* probe when reachabletv10 days1-0/+4
|
* introduce per-transport sync reply timeouttv10 days1-1/+2
|
* path probes follow keepalivetv10 days1-0/+1
|
* peer worker forget records on changetv10 days1-0/+1
|
* peer worker sleeps until deadline, not fixed timetv10 days1-0/+1
|
* bootstrap: replace pull by progress notifytv10 days1-0/+1
|
* LWW everywhere, mostlytv10 days1-0/+3
|
* state: drop epoch_txtv10 days1-2/+0
| | | | The stamp is the only lock-free epoch label.
* move all automerge references to documenttv11 days1-1/+1
|
* rename AutoMerge to Documenttv11 days1-2/+2
|
* detect local clock jumpstv11 days1-1/+1
|
* propagate clock figurestv11 days1-0/+1
|
* add peer clock skew warningtv11 days1-0/+3
|
* pong carries timetv11 days1-0/+1
|
* document: move knowledge about node to swarmtv11 days1-1/+1
|
* move change publisher to own moduletv12 days1-2/+2
|
* unify closing logictv12 days1-1/+1
|
* allow links subscriptionstv12 days1-0/+3
|
* add links messagestv12 days1-0/+1
| | | | | | | | | Introduce two new wire messages, LINKS and LINKS_REPLY (swarm::links). A member answers with its links: for each peer, the transport, whether it’s relayed, the RTT, and whether it’s dormant. It answers members only, at most every 5 s. This bumps wire::VERSION to 7. Every build answers, with or without the feature, so every node needs this patch before the map shows anything beyond its own node.
* add document lock statstv2026-10-281-1/+1
|
* move keepalive and firewall to pathstv2026-10-281-8/+7
|
* add identity layertv2026-10-271-6/+18
|