From aa3b77eedadc0c3942ffd6767df299055c9a08c2 Mon Sep 17 00:00:00 2001 From: Overlord Date: Fri, 31 Jul 2026 23:09:10 +0200 Subject: [PATCH] Add initial `zocket/config.toml` and define Zig dependency for TOML parsing --- .gitignore | 6 +- build.zig.zon | 9 ++- zocket/config.toml | 140 +++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 152 insertions(+), 3 deletions(-) create mode 100644 zocket/config.toml diff --git a/.gitignore b/.gitignore index c423837..27bd3e4 100644 --- a/.gitignore +++ b/.gitignore @@ -2,10 +2,14 @@ zig-cache/ .zig-cache/ zig-out/ +zig-pkg + build/ build-*/ docgen_tmp/ .zbscanhelper.zig -.idea +.idea/ + +zocket/*.md diff --git a/build.zig.zon b/build.zig.zon index 5aa8703..41fe827 100644 --- a/build.zig.zon +++ b/build.zig.zon @@ -3,7 +3,12 @@ .version = "0.0.0", .fingerprint = 0x22ea3973fd74773f, .minimum_zig_version = "0.16.0", - .dependencies = .{}, + .dependencies = .{ + .toml = .{ + .url = "git+https://github.com/sam701/zig-toml?ref=zig-0.16#8685923e32e8b8a795eb2715684236975a70faed", + .hash = "toml-0.3.0-bV14BRmKAQAWR0FT0KUKFwVJTImaFhWjSe6HfSMtNZOH", + }, + }, .paths = .{ "build.zig", "build.zig.zon", @@ -11,4 +16,4 @@ "LICENSE", "README.md", }, -} \ No newline at end of file +} diff --git a/zocket/config.toml b/zocket/config.toml new file mode 100644 index 0000000..b364731 --- /dev/null +++ b/zocket/config.toml @@ -0,0 +1,140 @@ +[node] +id = "node-01" +data_dir = "/var/lib/wsmesh" # /$data_dir/$id/* +private_key = "/var/lib/wsmesh/node-01/identity.key" # ed25519, auto-generated on first run if missing, default = /$data_dir/$id/identity.key +# DEFAULT ASSUMPTION: ephemeral. +# A fresh keypair each restart is fine and expected as nothing is persisted to disk on purpose +# (see mesh.discoverability + mesh.trust below), everything mesh-wide is rediscovered via +# gossip/broadcast after (re)connecting to a seed peer in mesh.peers. +# EXCEPTION: +# If another node pins THIS node by pubkey in its own static mesh.peers[] entry, this +# key must be persisted (mount on a volume) as a pinned pubkey is a promise of a stable identity, +# and an ephemeral key breaks that pin on every restart. +# Only relevant for statically pinned, long-lived "hub" style nodes; auto-enrolled/broadcast-mode peers never need this. + +[log] +level = "info" # debug | info | warn | error +format = "json" # json | text +output = "stdout" # stdout | /path/to/file.log + +# ---- + +[listen.client] +enabled = true +bind = "0.0.0.0:8080" + +[listen.client.tls] +enabled = false +cert = "/etc/wsmesh/client.crt" +key = "/etc/wsmesh/client.key" + +[listen.client.auth] +mode = "token" # none | token +# If mode is set to "token", then the client_id is DERIVED from the matched +# identity's id below, never self-declared by the client. +# If mode is set to "none", any client may self-declare their client_id. +# On collision with an already-connected client_id, the NEW connection is rejected +# (first-connected wins) to prevent a second client from silently taking over another's routing identity. + +[[listen.client.auth.identities]] +id = "discord-bot" +token = "sdfb08zbd98bzbh9r98gh98enb" + +[[listen.client.auth.identities]] +id = "minecraft-mod" +token = "sv8sovz987w98ruw9fwbgfubwf" + +[listen.client.access_control] +mode = "allowlist" # allowlist | blocklist | disabled +list = ["10.0.0.0/24", "127.0.0.1"] # IP | CIDR + +[listen.client.limits] +max_message_bytes = 65536 +max_frame_bytes = 65536 +idle_timeout_secs = 300 +ping_interval_secs = 30 +max_missed_pongs = 2 +max_connections = 256 + +[listen.client.limits.rate_limit] +enabled = true +messages_per_sec = 50 +burst = 100 + +# ---- + +[listen.peer] +enabled = true +bind = "0.0.0.0:8181" + +[listen.peer.tls] +enabled = false +cert = "/etc/wsmesh/peer.crt" +key = "/etc/wsmesh/peer.key" +require_client_cert = false + +[listen.peer.auth] +mode = "pubkey" # pubkey +# Peer links can inject routes and broadcasts mesh-wide, so identity is always cryptographically verified, regardless of access_control. +# Every connecting peer proves possession of the private key matching a pubkey via a signed nonce challenge - no shared secret ever transits the wire. +# For a KNOWN node_id, the pubkey must match mesh.peers[].pubkey exactly, or the connection is rejected outright. +# For a claimed node_id that isn't yet known, see mesh.discoverability = "broadcast" below. + +[listen.peer.bootstrap] +enabled = false # only consulted when mesh.discoverability.mode = "broadcast" +# a bootstrap token grants ONLY "permission to register one new peer identity" — +# never permission to act as an already-known peer. keep these short-lived / single-use. + +[listen.peer.access_control] +mode = "allowlist" # allowlist | blocklist | disabled +list = ["10.0.0.0/24", "127.0.0.1"] # IP | CIDR + +[listen.peer.limits] +max_message_bytes = 1048576 +idle_timeout_secs = 60 +ping_interval_secs = 15 + +# ---- + +[mesh] +enabled = true +topology = "full" # full | static-partial | disabled +routing_mode = "gossip" # gossip | reactive | static + +[mesh.discoverability] +mode = "static" # static | broadcast +# static: mesh.peers below is the complete, manually-maintained set of instances. +# broadcast: mesh.peers is just the initial seed; unknown nodes may connect and prove +# possession of a pubkey; they're auto-trusted and gossiped mesh-wide immediately. +# listen.peer.access_control is the real gate in this mode; scope it tightly. + +[[mesh.peers]] +id = "node-02" +addr = "10.0.0.2:8181" +pubkey = "rijgeb8u845un34tun34tou3nt3ot3untz3otn3to" +reconnect = true +backoff_min_ms = 500 +backoff_max_ms = 30000 + +[mesh.trust] +gossip_new_peers = true # propagate newly-enrolled peer identities to the rest of the mesh + +[mesh.gossip] +seen_cache_ttl_secs = 300 +route_ttl_secs = 0 # 0 = no expiry, rely on explicit ROUTE_REMOVE + +[mesh.broadcast] +enabled = true +# Broadcasting (target = "*") is peer-only and never exposed to clients on listen.client. +# Floods across peer links using the same seen_cache dedup as gossip route announcements. + +[mesh.reactive] # only used if routing_mode = "reactive" +query_ttl_hops = 4 +query_timeout_ms = 2000 +negative_cache_secs = 30 + +# ---- + +[metrics] # prometheus format +enabled = true +bind = "127.0.0.1:9090"