mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-22 15:52:20 +00:00
e99654d464
Implement identity management for the FIPS daemon with two modes: Ephemeral (default): A fresh keypair is generated on every start. Key files (fips.key, fips.pub) are written for operator visibility but overwritten on each restart. This is privacy-friendly and requires no configuration. Persistent (opt-in via `node.identity.persistent: true`): Uses three-tier identity resolution: 1. Explicit nsec in config file (advanced users) 2. Persistent key file alongside config (reused across restarts) 3. Generate new keypair, persist to key file Key files follow the SSH id_ed25519/id_ed25519.pub convention: - fips.key: bare bech32 nsec string, mode 0600 - fips.pub: bare bech32 npub string, mode 0644 The daemon always writes fips.pub on startup so operators can find their current identity via `cat /etc/fips/fips.pub`. Identity resolution extracted into testable `resolve_identity()` function in config module. Graceful degradation: key file write failure silently falls back to ephemeral identity. Add `fipsctl keygen` subcommand for manual key generation: - `-d <dir>` output directory (default: /etc/fips) - `-f` force overwrite existing files - `-s` print nsec/npub to stdout instead of writing files - Warns that `persistent: true` must be set in config - Works without a running daemon Includes unit tests for key file read/write roundtrip, file permissions, whitespace trimming, empty file error, path derivation, ephemeral-by-default behavior, ephemeral key cycling, persistent key file loading, and persistent generate-and-reuse lifecycle.