mrambossekandClaude Opus 5
8a80026d49
Pure stdlib. Implements the spec's core: enrollment (single-use tokens), profile (SPKI pin, only real capabilities advertised), sessions with the §2.4 HKDF-SHA256 key schedule; UDP data plane with the 32-byte ELT1 header, 4-byte HMAC gate, 1024-wide anti-replay window, ECHO_RESP with observation block, TIMESYNC, and the §3.4 anti-amplification cap. Wire format has tests (roundtrip + silent-drop cases); enroll→profile→session smoke-tested live. Modes: container (autodetect /.dockerenv|/run/.containerenv|cgroup, or --docker/ECHOLOT_DOCKER=1; config via ECHOLOT_* env; distroless image; network_mode host required — Docker NAT would falsify observed sources) and native (--install-systemd/--uninstall-systemd with a hardened unit, opt-in --self-update from Gitea releases; refused in containers). CI: tests on any server/ push; server-v* tags build+push the image to the Gitea registry and attach linux amd64/arm64 binaries + SHA256SUMS to a release — the artifact self-update consumes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
29 lines
1.1 KiB
YAML
29 lines
1.1 KiB
YAML
# SPDX-FileCopyrightText: 2026 Echolot contributors
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
#
|
|
# Reference deployment. host networking is REQUIRED, not an optimization:
|
|
# behind Docker's NAT the observed source address, port-rebinding evidence and
|
|
# TTLs — the things the probe protocol measures — would be the proxy's, not
|
|
# the client's. With network_mode: host the ECHOLOT_*_LISTEN vars bind real
|
|
# host ports; pick free ones.
|
|
services:
|
|
echolot-server:
|
|
image: git.rambossek.at/echolot/echolot-server:latest
|
|
container_name: echolot-server
|
|
network_mode: host
|
|
restart: unless-stopped
|
|
environment:
|
|
ECHOLOT_NAME: homelab
|
|
ECHOLOT_CONTROL_LISTEN: ":8443"
|
|
ECHOLOT_UDP_LISTEN: ":8442"
|
|
ECHOLOT_TCP_LISTEN: ":8441"
|
|
# Admin stays loopback-only; reach it via SSH tunnel from the LAN host.
|
|
ECHOLOT_ADMIN_LISTEN: "127.0.0.1:8444"
|
|
# ECHOLOT_TLS_CERT / ECHOLOT_TLS_KEY: omit to self-sign into /state
|
|
# (clients pin the SPKI — self-signed is first-class).
|
|
volumes:
|
|
- echolot-state:/state
|
|
|
|
volumes:
|
|
echolot-state:
|