inbuxa Relay spec: a WireGuard underlay, and link hardening #256

Merged

jcoffey-dev merged 1 commits from relay/spec-hardening into main

2026-10-30 07:20:45 +00:00

jcoffey-dev commented

2026-10-30 07:10:08 +00:00

Owner

docs/spec/features/relay.md gains four rules, settings, tests and a
build step:

RL-32: the link can run over a WireGuard network the operator already
has, unchanged: --link-listen on the relay's WireGuard address, and that
address in inbuxa-admin. The link port is then off the internet, and
the pins and join proof stay. Built-in WireGuard, keys exchanged at
join, is a later option.
RL-33: linkAllowFrom limits who may dial the link port, dropping others
before TLS. Empty by default. inbuxa-admin warns when no node's known
address is in it, and --link-allow-any recovers a relay locked out.
RL-34: a new link CA without rejoining: nextLinkCaPin is pushed, relays
trust both and say so in status (linkCaPins), nodes move to the new CA,
then the old one is dropped. This is how a leaked node certificate is
cut off.
RL-35: the link CA key, the sealing key and the recipient keys can be
wrapped under a key in INBUXA_RELAY_KEY_FILE, outside the store, so a
store copy or backup alone opens nothing. Losing the file loses held
mail and means rejoining every relay; inbuxa-admin says so.
Security considerations: the link port, a leaked node certificate, and
the join window. Acceptance tests RL-T25 to RL-T27. Build order step 7
(hardening), and the WireGuard setup on step 6's docs page.

docs/spec/features/relay.md gains four rules, settings, tests and a build step: - RL-32: the link can run over a WireGuard network the operator already has, unchanged: --link-listen on the relay's WireGuard address, and that address in inbuxa-admin. The link port is then off the internet, and the pins and join proof stay. Built-in WireGuard, keys exchanged at join, is a later option. - RL-33: linkAllowFrom limits who may dial the link port, dropping others before TLS. Empty by default. inbuxa-admin warns when no node's known address is in it, and --link-allow-any recovers a relay locked out. - RL-34: a new link CA without rejoining: nextLinkCaPin is pushed, relays trust both and say so in status (linkCaPins), nodes move to the new CA, then the old one is dropped. This is how a leaked node certificate is cut off. - RL-35: the link CA key, the sealing key and the recipient keys can be wrapped under a key in INBUXA_RELAY_KEY_FILE, outside the store, so a store copy or backup alone opens nothing. Losing the file loses held mail and means rejoining every relay; inbuxa-admin says so. - Security considerations: the link port, a leaked node certificate, and the join window. Acceptance tests RL-T25 to RL-T27. Build order step 7 (hardening), and the WireGuard setup on step 6's docs page.

jcoffey-dev added 1 commit 2026-10-30 07:10:08 +00:00

inbuxa Relay spec: a WireGuard underlay, and link hardening

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 10m5s

Details

12e62a70ce

docs/spec/features/relay.md gains four rules, settings, tests and a
build step:

- RL-32: the link can run over a WireGuard network the operator already
  has, unchanged: --link-listen on the relay's WireGuard address, and that
  address in inbuxa-admin. The link port is then off the internet, and
  the pins and join proof stay. Built-in WireGuard, keys exchanged at
  join, is a later option.
- RL-33: linkAllowFrom limits who may dial the link port, dropping others
  before TLS. Empty by default. inbuxa-admin warns when no node's known
  address is in it, and --link-allow-any recovers a relay locked out.
- RL-34: a new link CA without rejoining: nextLinkCaPin is pushed, relays
  trust both and say so in status (linkCaPins), nodes move to the new CA,
  then the old one is dropped. This is how a leaked node certificate is
  cut off.
- RL-35: the link CA key, the sealing key and the recipient keys can be
  wrapped under a key in INBUXA_RELAY_KEY_FILE, outside the store, so a
  store copy or backup alone opens nothing. Losing the file loses held
  mail and means rejoining every relay; inbuxa-admin says so.
- Security considerations: the link port, a leaked node certificate, and
  the join window. Acceptance tests RL-T25 to RL-T27. Build order step 7
  (hardening), and the WireGuard setup on step 6's docs page.

jcoffey-dev merged commit 2b3a40405a into main

2026-10-30 07:20:45 +00:00

jcoffey-dev deleted branch relay/spec-hardening

2026-10-30 07:20:45 +00:00

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: inbuxa/inbuxa-server#256