Plan: gate public FOSS nodes so strangers cannot host workspaces - #1271
Draft
joepio wants to merge 2 commits into
Draft
Plan: gate public FOSS nodes so strangers cannot host workspaces#1271joepio wants to merge 2 commits into
joepio wants to merge 2 commits into
Conversation
A stock atomic-server on a public address currently uses OpenPolicy, so
Create account / a genesis commit / an Iroh SYNC_PUSH of a missing drive
all land. Propose HostMode { Open, Owner }: localhost stays open, a
public node installs a local AllowlistPolicy with zero grace, a setup
token claims the owner, and collaborators keep write on invited drives
only.
Co-authored-by: joepmeindertsma <joepmeindertsma@gmail.com>
Drop the setup-token / first-visitor claim. Owner mode requires the operator's existing agent DID in the env before bind; a missing or pasted-secret value refuses to start. The public welcome page never offers Create account. Co-authored-by: joepmeindertsma <joepmeindertsma@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issues
Design proposal — no issue number yet.
Checklist
Planning only. Changelog, tests, and user-facing docs land with the implementation phases in
planning/foss-public-host-mode.md.What this is
A stock
atomic-serveron a public address currently usesOpenPolicy. Welcome → Create account,POST /commitgenesis, and an IrohSYNC_PUSHof a missing drive all land on your disk. Managed nodes already close this withAllowlistPolicyfrom the control plane. FOSS never installs that policy.This PR proposes
HostMode { Open, Owner }:--host-mode=owner): local allowlist, zero grace. RequiresATOMIC_OWNER_AGENT=did:ad:agent:…before bind — the DID only, never the secret. Missing or invalid value refuses to start (does not fall back to Open). Only that signer may enroll a new Drive. Collaborators invited to a Drive keepread/writeon that Drive.:443is expected to already have a secret (localhost, desktop, or phone) and to put that agent ID in the env./servergrowshostMode,acceptsNewDrives,ownerSet. Owner mode redacts the Iroh node id and peer list from unauthenticated clients. Welcome never offers Create account on an Owner node.ATOMIC_OWNER_AGENT, then enroll. Open keeps the bootstrap carve-out.Public read of what the owner shared (
ATOMIC_HOME_DRIVE, public Agent) does not change. No control plane, no email, no phone-home.Docs in this PR
planning/foss-public-host-mode.md— threat model, env claim, UX journeys, admission rules, phased implementationplanning/README.md,unified-sync.md(OQ5),cloud-sync-managed-node.md,sync-onboarding-ux.mdNot in this PR
No runtime change. Phase 1 is policy-on-the-node (reuse
AllowlistPolicy+ required env), Phase 2 is welcome copy, Phase 3 is rate limits / Iroh leftovers.