Logan CusanoandClaude Opus 5
ee633cbe46
Edge nodes are deployed to arbitrary locations by arbitrary people, so the
broker has to be reachable from the internet and secured on its own merits
rather than by a VPN.
Three defects made that impossible. The broker only had a plaintext 1883
listener; every node shared one drb-node password; and the ACL pattern used
%c, the client-supplied client id, so any holder of that shared password
could set client_id to another node and take over its namespace. The comment
claiming this cryptographically prevented cross-node access was wrong and is
gone.
Authentication now uses mosquitto 2.x's built-in dynamic-security plugin on
the stock eclipse-mosquitto image. c2-core administers it over the control
topic, creating each node's client on approval with username=<node_id> and
password=<its node_keys api_key>, attached to a role whose ACL is nodes/%u/#
against the authenticated username. One credential, one revocation point.
An HTTP-callback plugin was implemented first and rejected: that project is
archived upstream, which is not an acceptable dependency on an
internet-facing broker.
Because dynsec state is a second source of truth alongside Firestore,
approve/reissue/delete now write to the broker first and surface a 502
rather than drifting, and c2-core reconciles every approved node into dynsec
on startup.
Adds node self-enrollment (POST /nodes/enroll, GET /nodes/{id}/credentials)
so a new node can obtain its key over HTTPS without an operator handling
secrets by hand. Enrolling an already-approved node_id is refused on the
fleet token alone — otherwise a leaked token plus a guessable id would let
an attacker steal a live node's key before the real node asked for it.
Pickup secrets are stored hashed and returned once, and the endpoint is rate
limited per source IP.
Infrastructure: an 8883 TLS listener fed by Caddy's certificate via a
systemd path unit, a firewall rule for it, and Caddy now 404s /internal/*
so the api vhost cannot proxy internal routes.
Also fixes CORS, which allowed https://app.<domain> while the frontend is
served on the bare domain — every call from the portal would have failed —
and widens the vault gitignore to a glob, since ansible-vault leaves
backup siblings that the exact-name rule left committable.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
59 lines
3.9 KiB
Plaintext
59 lines
3.9 KiB
Plaintext
# Template for your Ansible Vault secrets file.
|
|
# Copy to vault.yml, fill in values, then encrypt:
|
|
# ansible-vault encrypt vault.yml
|
|
# Edit later with:
|
|
# ansible-vault edit vault.yml
|
|
|
|
# DO NOT put a literal "$" in any value here. Docker compose interpolates the
|
|
# top-level .env, and depending on version it also interpolates env_file, so a
|
|
# password like "aB$fPx" is read as the variable $fPx and silently replaced
|
|
# with an empty string — on one side of the connection but not the other.
|
|
# That produced "MQTT connect refused: Not authorized" with no obvious cause.
|
|
# Generate with: openssl rand -hex 32 (hex output has no shell metacharacters)
|
|
|
|
# ── MQTT ─────────────────────────────────────────────────────────────────────
|
|
# No more shared node credential (vault_mqtt_node_user/pass) — nodes now
|
|
# authenticate as username=<node_id>, password=<their node_keys.api_key>,
|
|
# checked by mosquitto's built-in dynamic-security plugin (c2-core
|
|
# administers it — see app/internal/dynsec.py). See vault_enrollment_token
|
|
# below for how a node gets that key in the first place.
|
|
vault_mqtt_c2_user: drb-c2-core
|
|
vault_mqtt_c2_pass: "CHANGE_ME"
|
|
vault_mqtt_dynsec_admin_pass: "CHANGE_ME" # openssl rand -hex 32 — must be >=12 chars, plugin-enforced minimum
|
|
|
|
# ── C2 Core ───────────────────────────────────────────────────────────────────
|
|
vault_service_key: "" # openssl rand -hex 32
|
|
vault_enrollment_token: "" # openssl rand -hex 32 — fleet-wide, shared by every node's POST /nodes/enroll
|
|
vault_openai_api_key: ""
|
|
vault_google_maps_api_key: ""
|
|
vault_gemini_api_key: ""
|
|
vault_gcs_bucket: "your-gcs-bucket-name"
|
|
vault_firestore_database: "c2-server"
|
|
|
|
# ── Gitea Container Registry ──────────────────────────────────────────────────
|
|
vault_registry_host: "git.vpn.cusano.net"
|
|
vault_registry_user: "logan"
|
|
vault_registry_token: "" # Gitea access token, READ-ONLY package scope.
|
|
# The VM only pulls (roles/deploy/tasks/main.yml:62-72);
|
|
# nothing here pushes. Pushing is CI's job and uses a
|
|
# separate write-scoped token (BUILD_TOKEN in Gitea
|
|
# repo secrets). Keep them separate: this token sits on
|
|
# an internet-facing VM, and a write-scoped one there
|
|
# would let an attacker publish a poisoned image that
|
|
# every future deploy and edge node would install.
|
|
vault_registry: "git.vpn.cusano.net/logan" # full image prefix
|
|
|
|
# ── Discord Bot ───────────────────────────────────────────────────────────────
|
|
vault_discord_token: ""
|
|
|
|
# ── Frontend (Firebase) ───────────────────────────────────────────────────────
|
|
vault_firebase_api_key: ""
|
|
vault_firebase_auth_domain: ""
|
|
vault_firebase_project_id: ""
|
|
vault_firebase_storage_bucket: ""
|
|
vault_firebase_messaging_sender_id: ""
|
|
vault_firebase_app_id: ""
|
|
|
|
# No GCP key needed — the VM uses Application Default Credentials via the
|
|
# GCE metadata server. Terraform grants the required IAM roles at apply time.
|