feat!: genesis-pinned operator set, server identity with an encrypted control link, key-less join codes; release key continuity
Join codes need no passkey touch and carry only public values (genesis fingerprint, owner credentials, installer hashes). Nodes pin the genesis and owners at enrollment and only follow passkey-signed operator set versions. The panel's server key is listed in the set; pinned nodes require its signature and run the control link under AES-256-GCM. Password sessions carry no capabilities. The updater adopts a next_key from a signed manifest. Bump version to 0.2.0. [CI SKIP]
This commit is contained in:
justme committed
1 parent
9bb6841dce
commit
a2f88a344b
89 files changed
+2145
-1195
No files matched your search
+270
-14
@@ -867,6 +867,24 @@ export interface paths {
|
||||
patch?: never;
|
||||
trace?: never;
|
||||
};
|
||||
"/api/admin/trust": {
|
||||
parameters: {
|
||||
query?: never;
|
||||
header?: never;
|
||||
path?: never;
|
||||
cookie?: never;
|
||||
};
|
||||
/** The operator trust root: genesis fingerprint, version, whether it matches the registered passkeys, and the next version to sign */
|
||||
get: operations["trust_get"];
|
||||
put?: never;
|
||||
/** Store the next operator set, signed with a passkey (the first one sets the genesis and needs a credential window) */
|
||||
post: operations["trust_commit"];
|
||||
delete?: never;
|
||||
options?: never;
|
||||
head?: never;
|
||||
patch?: never;
|
||||
trace?: never;
|
||||
};
|
||||
"/api/admin/api-tokens": {
|
||||
parameters: {
|
||||
query?: never;
|
||||
@@ -1116,7 +1134,7 @@ export interface paths {
|
||||
path?: never;
|
||||
cookie?: never;
|
||||
};
|
||||
/** One-line installer for Linux and macOS nodes (agent or probe, decided by the code) */
|
||||
/** The static one-line installer for Linux and macOS nodes (same bytes for everyone; its SHA-256 is published with each release) */
|
||||
get: operations["install_sh"];
|
||||
put?: never;
|
||||
post?: never;
|
||||
@@ -1126,6 +1144,40 @@ export interface paths {
|
||||
patch?: never;
|
||||
trace?: never;
|
||||
};
|
||||
"/install/manifest": {
|
||||
parameters: {
|
||||
query?: never;
|
||||
header?: never;
|
||||
path?: never;
|
||||
cookie?: never;
|
||||
};
|
||||
/** The signed release manifest of the component an install code is for (exact signed bytes) */
|
||||
get: operations["install_manifest"];
|
||||
put?: never;
|
||||
post?: never;
|
||||
delete?: never;
|
||||
options?: never;
|
||||
head?: never;
|
||||
patch?: never;
|
||||
trace?: never;
|
||||
};
|
||||
"/install/manifest.sig": {
|
||||
parameters: {
|
||||
query?: never;
|
||||
header?: never;
|
||||
path?: never;
|
||||
cookie?: never;
|
||||
};
|
||||
/** Base64 DER ECDSA P-256 signature of the manifest */
|
||||
get: operations["install_manifest_signature"];
|
||||
put?: never;
|
||||
post?: never;
|
||||
delete?: never;
|
||||
options?: never;
|
||||
head?: never;
|
||||
patch?: never;
|
||||
trace?: never;
|
||||
};
|
||||
"/install.ps1": {
|
||||
parameters: {
|
||||
query?: never;
|
||||
@@ -1133,7 +1185,7 @@ export interface paths {
|
||||
path?: never;
|
||||
cookie?: never;
|
||||
};
|
||||
/** One-line installer for Windows nodes (agent or probe, decided by the code) */
|
||||
/** The static one-line installer for Windows nodes (same bytes for everyone; its SHA-256 is published with each release) */
|
||||
get: operations["install_ps1"];
|
||||
put?: never;
|
||||
post?: never;
|
||||
@@ -1160,6 +1212,23 @@ export interface paths {
|
||||
patch?: never;
|
||||
trace?: never;
|
||||
};
|
||||
"/api/agent/v1/enroll/trust": {
|
||||
parameters: {
|
||||
query?: never;
|
||||
header?: never;
|
||||
path?: never;
|
||||
cookie?: never;
|
||||
};
|
||||
get?: never;
|
||||
put?: never;
|
||||
/** The operator set chain and the grant of a join token, for the node to verify before it enrolls */
|
||||
post: operations["fleet_enroll_trust"];
|
||||
delete?: never;
|
||||
options?: never;
|
||||
head?: never;
|
||||
patch?: never;
|
||||
trace?: never;
|
||||
};
|
||||
}
|
||||
export type webhooks = Record<string, never>;
|
||||
export interface components {
|
||||
@@ -1349,6 +1418,7 @@ export interface components {
|
||||
/** Format: int32 */
|
||||
expires_in_hours: null | number | string;
|
||||
role?: null | string;
|
||||
controllers?: null | string[];
|
||||
};
|
||||
CreateTaskRequest: {
|
||||
scope: string;
|
||||
@@ -1619,6 +1689,7 @@ export interface components {
|
||||
user_id: null | string;
|
||||
username: null | string;
|
||||
csrf_token: null | string;
|
||||
auth_method?: null | string;
|
||||
};
|
||||
MetricDto: {
|
||||
id: string;
|
||||
@@ -1999,6 +2070,13 @@ export interface components {
|
||||
default: string;
|
||||
description: string;
|
||||
};
|
||||
SignedStatementDto: {
|
||||
statement?: string;
|
||||
credential_id?: string;
|
||||
authenticator_data?: string;
|
||||
client_data_json?: string;
|
||||
signature?: string;
|
||||
};
|
||||
StartTestRequestDto: {
|
||||
plan: string;
|
||||
params: null | Record<string, never>;
|
||||
@@ -2085,6 +2163,32 @@ export interface components {
|
||||
/** Format: date-time */
|
||||
finished_at: unknown;
|
||||
};
|
||||
TrustProposalDto: {
|
||||
statement: string;
|
||||
/** Format: int32 */
|
||||
version: number | string;
|
||||
challenge: string;
|
||||
};
|
||||
TrustStateDto: {
|
||||
initialized: boolean;
|
||||
genesis: null | string;
|
||||
/** Format: int32 */
|
||||
version: number | string;
|
||||
in_sync: boolean;
|
||||
proposal: null | components["schemas"]["TrustProposalDto"];
|
||||
/** @default */
|
||||
install_url: string;
|
||||
operators?: null | string[];
|
||||
/** @default */
|
||||
install_sh_sha256: string;
|
||||
/** @default */
|
||||
install_ps1_sha256: string;
|
||||
install_matches_release?: null | boolean;
|
||||
/** @default */
|
||||
server_key: string;
|
||||
/** @default false */
|
||||
server_key_listed: boolean;
|
||||
};
|
||||
UserDto: {
|
||||
id: string;
|
||||
username: string;
|
||||
@@ -5103,6 +5207,104 @@ export interface operations {
|
||||
};
|
||||
};
|
||||
};
|
||||
trust_get: {
|
||||
parameters: {
|
||||
query?: never;
|
||||
header?: never;
|
||||
path?: never;
|
||||
cookie?: never;
|
||||
};
|
||||
requestBody?: never;
|
||||
responses: {
|
||||
/** @description OK */
|
||||
200: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content: {
|
||||
"application/json": components["schemas"]["TrustStateDto"];
|
||||
};
|
||||
};
|
||||
/** @description Unauthorized */
|
||||
401: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content: {
|
||||
"application/problem+json": components["schemas"]["ProblemDto"];
|
||||
};
|
||||
};
|
||||
/** @description Forbidden */
|
||||
403: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content: {
|
||||
"application/problem+json": components["schemas"]["ProblemDto"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
trust_commit: {
|
||||
parameters: {
|
||||
query?: never;
|
||||
header?: never;
|
||||
path?: never;
|
||||
cookie?: never;
|
||||
};
|
||||
requestBody: {
|
||||
content: {
|
||||
"application/json": components["schemas"]["SignedStatementDto"];
|
||||
};
|
||||
};
|
||||
responses: {
|
||||
/** @description Created */
|
||||
201: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content: {
|
||||
"application/json": components["schemas"]["TrustStateDto"];
|
||||
};
|
||||
};
|
||||
/** @description Bad Request */
|
||||
400: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content: {
|
||||
"application/problem+json": components["schemas"]["ProblemDto"];
|
||||
};
|
||||
};
|
||||
/** @description Unauthorized */
|
||||
401: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content: {
|
||||
"application/problem+json": components["schemas"]["ProblemDto"];
|
||||
};
|
||||
};
|
||||
/** @description Forbidden */
|
||||
403: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content: {
|
||||
"application/problem+json": components["schemas"]["ProblemDto"];
|
||||
};
|
||||
};
|
||||
/** @description Conflict */
|
||||
409: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content: {
|
||||
"application/problem+json": components["schemas"]["ProblemDto"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
api_tokens_list: {
|
||||
parameters: {
|
||||
query?: never;
|
||||
@@ -5899,6 +6101,53 @@ export interface operations {
|
||||
};
|
||||
};
|
||||
install_sh: {
|
||||
parameters: {
|
||||
query?: never;
|
||||
header?: never;
|
||||
path?: never;
|
||||
cookie?: never;
|
||||
};
|
||||
requestBody?: never;
|
||||
responses: {
|
||||
/** @description OK */
|
||||
200: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content?: never;
|
||||
};
|
||||
};
|
||||
};
|
||||
install_manifest: {
|
||||
parameters: {
|
||||
query?: {
|
||||
code?: string;
|
||||
};
|
||||
header?: never;
|
||||
path?: never;
|
||||
cookie?: never;
|
||||
};
|
||||
requestBody?: never;
|
||||
responses: {
|
||||
/** @description OK */
|
||||
200: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content?: never;
|
||||
};
|
||||
/** @description Not Found */
|
||||
404: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content: {
|
||||
"application/problem+json": components["schemas"]["ProblemDto"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
install_manifest_signature: {
|
||||
parameters: {
|
||||
query?: {
|
||||
code?: string;
|
||||
@@ -5929,9 +6178,7 @@ export interface operations {
|
||||
};
|
||||
install_ps1: {
|
||||
parameters: {
|
||||
query?: {
|
||||
code?: string;
|
||||
};
|
||||
query?: never;
|
||||
header?: never;
|
||||
path?: never;
|
||||
cookie?: never;
|
||||
@@ -5945,15 +6192,6 @@ export interface operations {
|
||||
};
|
||||
content?: never;
|
||||
};
|
||||
/** @description Not Found */
|
||||
404: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content: {
|
||||
"application/problem+json": components["schemas"]["ProblemDto"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
fleet_enroll: {
|
||||
@@ -5974,4 +6212,22 @@ export interface operations {
|
||||
};
|
||||
};
|
||||
};
|
||||
fleet_enroll_trust: {
|
||||
parameters: {
|
||||
query?: never;
|
||||
header?: never;
|
||||
path?: never;
|
||||
cookie?: never;
|
||||
};
|
||||
requestBody?: never;
|
||||
responses: {
|
||||
/** @description OK */
|
||||
200: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content?: never;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in new issue
Block a user