Add initial zocket/config.toml and define Zig dependency for TOML parsing

.gitignore

@@ -2,10 +2,14 @@ zig-cache/
 .zig-cache/
 zig-out/
 
+zig-pkg
+
 build/
 build-*/
 docgen_tmp/
 
 .zbscanhelper.zig
 
-.idea
+.idea/
+
+zocket/*.md

build.zig.zon

@@ -3,7 +3,12 @@
     .version             = "0.0.0",
     .fingerprint         = 0x22ea3973fd74773f,
     .minimum_zig_version = "0.16.0",
-    .dependencies        = .{},
+    .dependencies        = .{
+        .toml = .{
+            .url  = "git+https://github.com/sam701/zig-toml?ref=zig-0.16#8685923e32e8b8a795eb2715684236975a70faed",
+            .hash = "toml-0.3.0-bV14BRmKAQAWR0FT0KUKFwVJTImaFhWjSe6HfSMtNZOH",
+        },
+    },
     .paths               = .{
         "build.zig",
         "build.zig.zon",

zocket/config.toml

@@ -0,0 +1,140 @@
+[node]
+id          = "node-01"
+data_dir    = "/var/lib/wsmesh"                      # /$data_dir/$id/*
+private_key = "/var/lib/wsmesh/node-01/identity.key" # ed25519, auto-generated on first run if missing, default = /$data_dir/$id/identity.key
+# DEFAULT ASSUMPTION: ephemeral.
+# A fresh keypair each restart is fine and expected as nothing is persisted to disk on purpose
+# (see mesh.discoverability + mesh.trust below), everything mesh-wide is rediscovered via
+# gossip/broadcast after (re)connecting to a seed peer in mesh.peers.
+# EXCEPTION:
+# If another node pins THIS node by pubkey in its own static mesh.peers[] entry, this
+# key must be persisted (mount on a volume) as a pinned pubkey is a promise of a stable identity,
+# and an ephemeral key breaks that pin on every restart.
+# Only relevant for statically pinned, long-lived "hub" style nodes; auto-enrolled/broadcast-mode peers never need this.
+
+[log]
+level  = "info"   # debug | info | warn | error
+format = "json"   # json | text
+output = "stdout" # stdout | /path/to/file.log
+
+# ----
+
+[listen.client]
+enabled = true
+bind    = "0.0.0.0:8080"
+
+[listen.client.tls]
+enabled = false
+cert    = "/etc/wsmesh/client.crt"
+key     = "/etc/wsmesh/client.key"
+
+[listen.client.auth]
+mode = "token" # none | token
+# If mode is set to "token", then the client_id is DERIVED from the matched
+# identity's id below, never self-declared by the client.
+# If mode is set to "none", any client may self-declare their client_id.
+# On collision with an already-connected client_id, the NEW connection is rejected
+# (first-connected wins) to prevent a second client from silently taking over another's routing identity.
+
+[[listen.client.auth.identities]]
+id    = "discord-bot"
+token = "sdfb08zbd98bzbh9r98gh98enb"
+
+[[listen.client.auth.identities]]
+id    = "minecraft-mod"
+token = "sv8sovz987w98ruw9fwbgfubwf"
+
+[listen.client.access_control]
+mode = "allowlist"                  # allowlist | blocklist | disabled
+list = ["10.0.0.0/24", "127.0.0.1"] # IP | CIDR
+
+[listen.client.limits]
+max_message_bytes  = 65536
+max_frame_bytes    = 65536
+idle_timeout_secs  = 300
+ping_interval_secs = 30
+max_missed_pongs   = 2
+max_connections    = 256
+
+[listen.client.limits.rate_limit]
+enabled          = true
+messages_per_sec = 50
+burst            = 100
+
+# ----
+
+[listen.peer]
+enabled = true
+bind    = "0.0.0.0:8181"
+
+[listen.peer.tls]
+enabled             = false
+cert                = "/etc/wsmesh/peer.crt"
+key                 = "/etc/wsmesh/peer.key"
+require_client_cert = false
+
+[listen.peer.auth]
+mode = "pubkey" # pubkey
+# Peer links can inject routes and broadcasts mesh-wide, so identity is always cryptographically verified, regardless of access_control.
+# Every connecting peer proves possession of the private key matching a pubkey via a signed nonce challenge - no shared secret ever transits the wire.
+# For a KNOWN node_id, the pubkey must match mesh.peers[].pubkey exactly, or the connection is rejected outright.
+# For a claimed node_id that isn't yet known, see mesh.discoverability = "broadcast" below.
+
+[listen.peer.bootstrap]
+enabled = false # only consulted when mesh.discoverability.mode = "broadcast"
+# a bootstrap token grants ONLY "permission to register one new peer identity" —
+# never permission to act as an already-known peer. keep these short-lived / single-use.
+
+[listen.peer.access_control]
+mode = "allowlist"                  # allowlist | blocklist | disabled
+list = ["10.0.0.0/24", "127.0.0.1"] # IP | CIDR
+
+[listen.peer.limits]
+max_message_bytes  = 1048576
+idle_timeout_secs  = 60
+ping_interval_secs = 15
+
+# ----
+
+[mesh]
+enabled      = true
+topology     = "full"   # full | static-partial | disabled
+routing_mode = "gossip" # gossip | reactive | static
+
+[mesh.discoverability]
+mode = "static" # static | broadcast
+# static:    mesh.peers below is the complete, manually-maintained set of instances.
+# broadcast: mesh.peers is just the initial seed; unknown nodes may connect and prove
+#            possession of a pubkey; they're auto-trusted and gossiped mesh-wide immediately.
+#            listen.peer.access_control is the real gate in this mode; scope it tightly.
+
+[[mesh.peers]]
+id             = "node-02"
+addr           = "10.0.0.2:8181"
+pubkey         = "rijgeb8u845un34tun34tou3nt3ot3untz3otn3to"
+reconnect      = true
+backoff_min_ms = 500
+backoff_max_ms = 30000
+
+[mesh.trust]
+gossip_new_peers = true # propagate newly-enrolled peer identities to the rest of the mesh
+
+[mesh.gossip]
+seen_cache_ttl_secs = 300
+route_ttl_secs      = 0   # 0 = no expiry, rely on explicit ROUTE_REMOVE
+
+[mesh.broadcast]
+enabled = true
+# Broadcasting (target = "*") is peer-only and never exposed to clients on listen.client.
+# Floods across peer links using the same seen_cache dedup as gossip route announcements.
+
+[mesh.reactive] # only used if routing_mode = "reactive"
+query_ttl_hops      = 4
+query_timeout_ms    = 2000
+negative_cache_secs = 30
+
+# ----
+
+[metrics] # prometheus format
+enabled = true
+bind    = "127.0.0.1:9090"