Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func SetPeerVerifierSingleton ¶
func SetPeerVerifierSingleton(pv *PeerVerifier)
SetPeerVerifierSingleton installs the singleton. Called at startup after NewPeerVerifier; cleared by the cancel returned from AttachToHost.
Types ¶
type PeerIdentityConfig ¶
type PeerIdentityConfig struct {
Enabled bool // PEER_IDENTITY_ENABLED
CAAddr string // PEER_IDENTITY_CA_ADDR
CAToken string // PEER_IDENTITY_CA_TOKEN
CAMountPath string // PEER_IDENTITY_CA_MOUNT (default "pki")
CARole string // PEER_IDENTITY_CA_ROLE (default "tx-rails-pod")
StoreDir string // PEER_IDENTITY_STORE_DIR (default "/var/lib/orgsnode/peeridentity")
// TTL + RotateBefore tunables — rarely overridden but exposed for
// per-deployment policy. Defaults match the peeridentity defaults.
TTL time.Duration
RotateBefore time.Duration
}
PeerIdentityConfig is the env-var-derived config bundle.
func LoadPeerIdentityConfigFromEnv ¶
func LoadPeerIdentityConfigFromEnv() PeerIdentityConfig
LoadPeerIdentityConfigFromEnv reads the PEER_IDENTITY_* env vars and returns a populated config. Unset vars take the package defaults.
type PeerVerifier ¶
type PeerVerifier struct {
// contains filtered or unexported fields
}
PeerVerifier owns the wp-06 primitives + verified-peer set for one libp2p host. Constructed by NewPeerVerifier; AttachToHost wires it into a host's lifecycle. Close (via the cancel returned by AttachToHost) releases all goroutines.
func NewPeerVerifier ¶
func NewPeerVerifier(ctx context.Context, cfg PeerIdentityConfig, libp2pPeerID peer.ID) (*PeerVerifier, error)
NewPeerVerifier constructs the wp-06 chain when cfg.Enabled is true. Returns (nil, nil) when disabled (pre-wp-06 PoC path). On enabled + failure, returns a non-nil error — caller should treat as fatal (operator configuration mistake).
The libp2pPeerID is the local libp2p host's peer ID; Vault PKI is asked to mint a cert with CommonName=libp2pPeerID.String(). The Vault role must allow that CN (operator-side: configure allow_common_names to permit base58 peer IDs).
func PeerVerifierActive ¶
func PeerVerifierActive() *PeerVerifier
PeerVerifierActive returns the singleton if wp-06 verification is currently enabled. Test seam — tests can set + reset.
func (*PeerVerifier) AttachToHost ¶
func (pv *PeerVerifier) AttachToHost(ctx context.Context, h host.Host) func()
AttachToHost wires the verifier into a libp2p host:
- Registers peerhandshake.Server (incoming exchanges).
- Subscribes to event.EvtPeerConnectednessChanged.
- On Connected: spawns a goroutine that calls VerifyOutgoing; if it fails, closes the connection.
- On NotConnected: removes the peer from the verified set.
Returns a cancel function that closes the rotator + refresher + event subscription. Idempotent; safe to call once at shutdown.
func (*PeerVerifier) IsVerified ¶
func (pv *PeerVerifier) IsVerified(p peer.ID) bool
IsVerified reports whether p is in the verified-peer set. Used by dht.go's applyEnforce (via the singleton) to reject peers that haven't completed the wp-06 handshake.
Source Files