docs/spec/features/relay.md gains four rules, settings, tests and a
build step:
- RL-32: the link can run over a WireGuard network the operator already
has, unchanged: --link-listen on the relay's WireGuard address, and that
address in inbuxa-admin. The link port is then off the internet, and
the pins and join proof stay. Built-in WireGuard, keys exchanged at
join, is a later option.
- RL-33: linkAllowFrom limits who may dial the link port, dropping others
before TLS. Empty by default. inbuxa-admin warns when no node's known
address is in it, and --link-allow-any recovers a relay locked out.
- RL-34: a new link CA without rejoining: nextLinkCaPin is pushed, relays
trust both and say so in status (linkCaPins), nodes move to the new CA,
then the old one is dropped. This is how a leaked node certificate is
cut off.
- RL-35: the link CA key, the sealing key and the recipient keys can be
wrapped under a key in INBUXA_RELAY_KEY_FILE, outside the store, so a
store copy or backup alone opens nothing. Losing the file loses held
mail and means rejoining every relay; inbuxa-admin says so.
- Security considerations: the link port, a leaked node certificate, and
the join window. Acceptance tests RL-T25 to RL-T27. Build order step 7
(hardening), and the WireGuard setup on step 6's docs page.
jcoffey-dev