| … | … | @@ -25,34 +25,38 @@ SINGAPORE_API_KEY="${SINGAPORE_API_KEY:-}" |
| 25 | 25 | SINGAPORE2_API_KEY="${SINGAPORE2_API_KEY:-}" |
| 26 | 26 | BERN_API_KEY="${BERN_API_KEY:-}" |
| 27 | 27 | |
| 28 | | # Operator identity — WHO OWNS THE RELAY. This is the trust axis: quorum |
| 29 | | # independence, and any claim that a quorum spans parties who cannot collude, |
| 30 | | # is counted from this value. Every box below is run by one operator, so they |
| 31 | | # all declare the SAME id. A fourteen-box single-owner fleet is one operator, |
| 32 | | # and saying so is what makes a future independence claim believable. |
| 28 | # Operator — DELIBERATELY UNSET. This is an anonymity network. |
| 33 | 29 | # |
| 34 | | # This previously assigned a distinct id per box (hive-foundation-utah, |
| 35 | | # -utah-us, -singapore, -singapore-2 ...) with a comment explaining that they |
| 36 | | # existed so the replica scheduler would treat the boxes as separate nodes. |
| 37 | | # That is the right goal and was the wrong field: it made one owner report as |
| 38 | | # up to fourteen operators and satisfy any minOperators floor automatically. |
| 39 | | # Spreading now lives in FAILURE_DOMAIN below. |
| 40 | | HIVE_OPERATOR="${HIVE_OPERATOR:-hive-foundation}" |
| 30 | # The capability doc is unauthenticated: anything set here is served to anyone |
| 31 | # who asks. Declaring an operator publishes a linkage set naming every relay |
| 32 | # one party runs — precisely the correlation the Tor path, blind cells and |
| 33 | # split transport exist to prevent. A named value ("hive-foundation-utah") is |
| 34 | # worse still: it links the fleet to a real-world entity that can be |
| 35 | # subpoenaed, pressured or blocked wholesale. |
| 36 | # |
| 37 | # Leaving it unset is not a gap. quorum-selector treats undeclared as |
| 38 | # `__undeclared__` and never counts it toward independence, so this fleet |
| 39 | # forfeits diversity credit instead of leaking identity to claim it. For a |
| 40 | # single-owner fleet that credit would have been false anyway. |
| 41 | # |
| 42 | # If a future deployment must be countable, set an OPAQUE random token shared |
| 43 | # across that operator's relays — never a name. See capability-doc.js. |
| 44 | HIVE_OPERATOR="${HIVE_OPERATOR:-}" |
| 41 | 45 | UTAH_OPERATOR="${UTAH_OPERATOR:-$HIVE_OPERATOR}" |
| 42 | 46 | UTAH_US_OPERATOR="${UTAH_US_OPERATOR:-$HIVE_OPERATOR}" |
| 43 | 47 | SINGAPORE_OPERATOR="${SINGAPORE_OPERATOR:-$HIVE_OPERATOR}" |
| 44 | 48 | SINGAPORE2_OPERATOR="${SINGAPORE2_OPERATOR:-$HIVE_OPERATOR}" |
| 45 | 49 | BERN_OPERATOR="${BERN_OPERATOR:-$HIVE_OPERATOR}" |
| 46 | 50 | |
| 47 | | # Failure domain — WHAT DIES TOGETHER. This is the scheduling axis, and it is |
| 48 | | # per-box on purpose: losing one host should not lose every replica. Distinct |
| 49 | | # values here assert nothing about independence, so they are free to be as |
| 50 | | # granular as the topology warrants. |
| 51 | | UTAH_FAILURE_DOMAIN="${UTAH_FAILURE_DOMAIN:-cloudzy-utah}" |
| 52 | | UTAH_US_FAILURE_DOMAIN="${UTAH_US_FAILURE_DOMAIN:-cloudzy-utah-us}" |
| 53 | | SINGAPORE_FAILURE_DOMAIN="${SINGAPORE_FAILURE_DOMAIN:-cloudzy-singapore-1}" |
| 54 | | SINGAPORE2_FAILURE_DOMAIN="${SINGAPORE2_FAILURE_DOMAIN:-cloudzy-singapore-2}" |
| 55 | | BERN_FAILURE_DOMAIN="${BERN_FAILURE_DOMAIN:-cloudzy-bern}" |
| 51 | # Failure domain — the SCHEDULING axis, and also published, so keep it opaque. |
| 52 | # Clients need only inequality ("these two die together / they do not"); they |
| 53 | # never need to learn the provider or the datacenter. Values are per-box |
| 54 | # pseudonyms rather than "cloudzy-utah", which would leak both. |
| 55 | UTAH_FAILURE_DOMAIN="${UTAH_FAILURE_DOMAIN:-fd-a1}" |
| 56 | UTAH_US_FAILURE_DOMAIN="${UTAH_US_FAILURE_DOMAIN:-fd-a2}" |
| 57 | SINGAPORE_FAILURE_DOMAIN="${SINGAPORE_FAILURE_DOMAIN:-fd-b1}" |
| 58 | SINGAPORE2_FAILURE_DOMAIN="${SINGAPORE2_FAILURE_DOMAIN:-fd-b2}" |
| 59 | BERN_FAILURE_DOMAIN="${BERN_FAILURE_DOMAIN:-fd-c1}" |
| 56 | 60 | |
| 57 | 61 | deploy_server() { |
| 58 | 62 | local IP=$1 |
| … | … | @@ -60,7 +64,10 @@ deploy_server() { |
| 60 | 64 | local REGION=$3 |
| 61 | 65 | local MAX_MEM=$4 # systemd MemoryMax (e.g., 384M, 1G) |
| 62 | 66 | local HEAP=$5 # Node --max-old-space-size in MB |
| 63 | | local OPERATOR=${6:-hive-foundation} # operator identifier for AutoHeal v2 sybil resistance |
| 67 | # Empty by default: unset means the relay declares no operator, which is |
| 68 | # the anonymous and conservative choice (see the header). Pass an OPAQUE |
| 69 | # token only if this deployment must be countable for quorum diversity. |
| 70 | local OPERATOR=${6:-} |
| 64 | 71 | local API_KEY_OVERRIDE=${7:-} # optional per-relay API key override |
| 65 | 72 | |
| 66 | 73 | # Resolve effective API key (per-relay override beats env var) |
| … | … | @@ -68,7 +75,7 @@ deploy_server() { |
| 68 | 75 | validate_deploy_value "relay name" "$NAME" '^[A-Za-z0-9._-]{1,64}$' |
| 69 | 76 | validate_deploy_value "relay IP/host" "$IP" '^[A-Za-z0-9:._-]{1,255}$' |
| 70 | 77 | validate_deploy_value "relay region" "$REGION" '^[A-Za-z0-9._-]{1,32}$' |
| 71 | | validate_deploy_value "relay operator" "$OPERATOR" '^[A-Za-z0-9._-]{1,64}$' |
| 78 | [ -n "$OPERATOR" ] && validate_deploy_value "relay operator" "$OPERATOR" '^[A-Za-z0-9._-]{1,64}$' |
| 72 | 79 | validate_deploy_value "heap size" "$HEAP" '^[0-9]{2,6}$' |
| 73 | 80 | validate_deploy_value "memory limit" "$MAX_MEM" '^[0-9]+[MG]$' |
| 74 | 81 | validate_api_key "$EFFECTIVE_KEY" |
| … | … | @@ -153,7 +160,7 @@ Wants=network-online.target |
| 153 | 160 | [Service] |
| 154 | 161 | Type=simple |
| 155 | 162 | WorkingDirectory=/root/hiverelay |
| 156 | | ExecStart=/usr/bin/node --max-old-space-size=HEAP_PLACEHOLDER packages/core/cli/index.js start --mode public --region REGION_PLACEHOLDER --operator OPERATOR_PLACEHOLDER --auto-heal |
| 163 | ExecStart=/usr/bin/node --max-old-space-size=HEAP_PLACEHOLDER packages/core/cli/index.js start --mode public --region REGION_PLACEHOLDER OPERATOR_FLAG_PLACEHOLDER --auto-heal |
| 157 | 164 | Restart=always |
| 158 | 165 | RestartSec=15 |
| 159 | 166 | KillSignal=SIGTERM |
| … | … | @@ -177,7 +184,13 @@ SYSTEMD_UNIT |
| 177 | 184 | # Replace placeholders |
| 178 | 185 | sed -i "s/HEAP_PLACEHOLDER/${HEAP}/" /etc/systemd/system/hiverelay.service |
| 179 | 186 | sed -i "s/REGION_PLACEHOLDER/${REGION}/" /etc/systemd/system/hiverelay.service |
| 180 | | sed -i "s/OPERATOR_PLACEHOLDER/${OPERATOR}/" /etc/systemd/system/hiverelay.service |
| 187 | # Substitute the whole flag, so an unset operator emits nothing at all |
| 188 | # rather than `--operator ""` (which would publish an empty identity). |
| 189 | if [ -n "${OPERATOR}" ]; then |
| 190 | sed -i "s|OPERATOR_FLAG_PLACEHOLDER|--operator ${OPERATOR}|" /etc/systemd/system/hiverelay.service |
| 191 | else |
| 192 | sed -i "s| OPERATOR_FLAG_PLACEHOLDER||" /etc/systemd/system/hiverelay.service |
| 193 | fi |
| 181 | 194 | sed -i "s/MEM_PLACEHOLDER/${MAX_MEM}/" /etc/systemd/system/hiverelay.service |
| 182 | 195 | sed -i "s/MEMHIGH_PLACEHOLDER/${MEMORY_HIGH}/" /etc/systemd/system/hiverelay.service |
| 183 | 196 | |