Relay: the relay keys wrapped under a key file (RL-35) #274

Merged

jcoffey-dev merged 1 commits from relay/key-file into main 2026-10-31 03:05:32 +00:00

Conversation 0 Commits 1 Files Changed 8

+594 -31

1 Commits

Author	SHA1	Message	Date
jcoffey-dev	e26dea3665	Relay: the relay keys wrapped under a key file (RL-35) ... With INBUXA_RELAY_KEY_FILE naming a file of 32 random bytes in base64, the link CA key (and the next one's, during a replacement), the sealing key and each relay's recipient key are stored wrapped with AES-256-GCM, as {"wrapped": ...} where each was a string. A copy of the store or a backup alone then can't issue node certificates or open held mail. The link service wraps any key still in the clear at its next scan. Without the file, with one that can't be read, or with another key, a node starts no relay link, and each link's lastError says why; while the setting names a file that can't be read, no key is written in the clear. Without the setting, keys are stored as before. inbuxa:Relay shows keysWrapped. Tested: unit tests of the wrapping, the stored forms and the key file; the server's relay link test against the real relay binary (RL-T27: no key in the clear in the stored bytes once wrapped, still linked; with the file taken away, no link and the reason; with it back, linked again and the mail held meanwhile delivered), and relay_tests.	2026-10-30 19:51:03 -07:00