mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-22 07:48:26 +00:00
4e43cb81e9
Add an outbound-only Nym mixnet transport that tunnels FMP peer links through a local nym-socks5-client SOCKS5 proxy into the Nym mixnet. It structurally mirrors the Tor SOCKS5 transport (connection pool, connect-on-send background promotion, FMP-v0 framing reused from TCP) with the onion, inbound-listener, and control-port machinery removed. Wires the transport through the full TransportHandle dispatch, NymConfig (standard transport-instance pattern), and node instantiation, and surfaces its counters in fipstop. Includes a mock SOCKS5 harness and unit coverage for the address-parsing paths. Also adds an isolated single-container example (examples/sidecar-nostr-mixnet-relay/) demonstrating FIPS peering across the mixnet end to end. No new crate dependencies: tokio_socks, socket2, and futures are already pulled in by the Tor transport.
56 lines
1.8 KiB
YAML
56 lines
1.8 KiB
YAML
networks:
|
|
fips-net:
|
|
name: ${FIPS_NETWORK:-fips-mixnet-net}
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: ${FIPS_SUBNET:-172.20.2.0/24}
|
|
|
|
services:
|
|
# Single container running ALL services: fips daemon, nym-socks5-client,
|
|
# strfry Nostr relay, nginx, dnsmasq. See entrypoint.sh for start order.
|
|
fips:
|
|
# Builds NATIVE for the host — fips must not run under emulation
|
|
# (Rosetta breaks its AEAD on larger frames). Only the embedded
|
|
# amd64 nym-socks5-client is emulated on Apple Silicon.
|
|
build:
|
|
context: ../..
|
|
dockerfile: examples/sidecar-nostr-mixnet-relay/Dockerfile
|
|
hostname: fips-mixnet
|
|
cap_add:
|
|
- NET_ADMIN
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=0
|
|
restart: unless-stopped
|
|
ports:
|
|
- "2121:2121/udp" # FIPS UDP transport
|
|
- "8443:8443/tcp" # FIPS TCP transport
|
|
- "80:80/tcp" # Nostr relay WebSocket (via nginx)
|
|
environment:
|
|
- RUST_LOG=${RUST_LOG:-info}
|
|
- FIPS_NSEC=${FIPS_NSEC}
|
|
- FIPS_PEER_NPUB=${FIPS_PEER_NPUB:-}
|
|
- FIPS_PEER_ADDR=${FIPS_PEER_ADDR:-}
|
|
- FIPS_PEER_ALIAS=${FIPS_PEER_ALIAS:-peer}
|
|
- FIPS_PEER_TRANSPORT=${FIPS_PEER_TRANSPORT:-nym}
|
|
- FIPS_UDP_BIND=${FIPS_UDP_BIND:-0.0.0.0:2121}
|
|
- FIPS_TUN_MTU=${FIPS_TUN_MTU:-1280}
|
|
- FIPS_UDP_MTU=${FIPS_UDP_MTU:-1472}
|
|
- FIPS_NYM_SOCKS5_ADDR=${FIPS_NYM_SOCKS5_ADDR:-127.0.0.1:1080}
|
|
- NYM_CLIENT_ID=${NYM_CLIENT_ID:-fips-nym-client}
|
|
- NYM_SERVICE_PROVIDER=${NYM_SERVICE_PROVIDER:-}
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./relay/strfry.conf:/usr/src/app/strfry.conf:ro
|
|
- relay-data:/usr/src/app/strfry-db
|
|
- nym-data:/root/.nym
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: ${FIPS_IPV4:-172.20.2.20}
|
|
|
|
volumes:
|
|
relay-data:
|
|
nym-data:
|