- commit
- 904c0e40a59b8c199aaf5df5e10a4fbccdc2df0f
- parent
- 8b2c091ca03d59b6d6684e8bf0786b6d4fc46f9b
- author
- Dami <dami.etoile@gmail.com>
| M | .github/ | 99 | ++++-------------------------- |
| M | Cargo.lock | 10 | ++-- |
| M | Cargo.toml | 2 | +- |
| M | web/ | 5 | +- |
| M | web/ | 34 | ++++++---- |
@@ -1,95 +1,20 @@
1-dev.site v0.3.0 hardens machine enrollment and live service authorization while improving2-profile organization and installation guidance. Services continue to stay on the machines3-that own them; the dev.site control plane never carries service bytes.1+dev.site v0.3.1 is a small presentation and CLI-feedback patch for2+[v0.3.0](https://github.com/FelineStateMachine/devsite/releases/tag/v0.3.0).43 5-## important upgrade note4+## changes65 7-This release intentionally replaces the v0.2.0 machine-enrollment flow. Existing v0.2.08-machine credentials will no longer authenticate after the control plane is upgraded.6+- Successful CLI/server version validation now appears as a green check during login;7+ incompatible clients fail before consuming the enrollment ticket.8+- The public connection diagram now shows endpoint proof and registration plus the daemon's9+ live authorization-snapshot sync.910 10-After installing v0.3.0, sign in at [dev.site](https://dev.site), create a new single-use11-machine ticket, and enroll the machine again:11+There are no additional protocol, database, or enrollment changes in this patch. See the12+[v0.3.0 release](https://github.com/FelineStateMachine/devsite/releases/tag/v0.3.0) for13+installation instructions, the security-hardening summary, and its required re-enrollment14+step.1215 13-```sh14-devsite login dmt_...15-```16-17-Then restart `devsite daemon run` or its service-manager unit.18-19-## security hardening20-21-- Dashboard-created machine tickets are plaintext, single-use enrollment secrets. On use,22- the server rotates the ticket into a persistent credential stored only as a hash.23-- Machine credentials are bound to the enrolling machine's Ed25519 endpoint. Daemon24- registration requires proof of the matching private key, preventing a copied credential25- from redirecting service traffic to another endpoint.26-- Revoking a share, credential, or hosted resource now closes affected active streams. The27- daemon also fails closed when its authorization snapshot remains unavailable.28-- Authenticated CLI operations use the control-plane origin saved at enrollment instead of29- combining a saved credential with a command-line server override.30-- The durable endpoint public key is available as `identity.pub`; private key storage is31- unchanged.32-33-## workflow improvements34-35-- Profiles support declarative folder order and initial open/closed state through bounded36- theme properties.37-- Platform-aware installation guidance is now available from both the landing page and the38- signed-in dashboard.39-- Service-ticket and native client terminology now matches the current device-to-device40- architecture, with fixes for interactive accordion theme state.41-42-## install43-44-Apple Silicon macOS users can install or upgrade with Homebrew:16+Homebrew users can upgrade with:4517 4618 ```sh47-brew install FelineStateMachine/tap/devsite48-# Existing installations:4919 brew update && brew upgrade FelineStateMachine/tap/devsite5020 ```51-52-Linux and Windows users can download the matching archive below.53-54-| archive target | system |55-| --- | --- |56-| `aarch64-apple-darwin` | Apple Silicon macOS |57-| `x86_64-unknown-linux-gnu` | x86-64 Linux |58-| `aarch64-unknown-linux-gnu` | ARM64 Linux |59-| `x86_64-pc-windows-msvc` | x86-64 Windows |60-61-Each archive contains the `devsite` CLI, README, and Apache-2.0 license. `SHA256SUMS`62-contains checksums for every archive.63-64-On Linux, extract the archive and put `devsite` somewhere on `PATH`:65-66-```sh67-tar -xzf devsite-*-linux-gnu.tar.gz68-sudo install -m 0755 devsite-*-linux-gnu/devsite /usr/local/bin/devsite69-```70-71-On Windows, extract the `.zip` and put the directory containing `devsite.exe` on `PATH`.72-73-## first service74-75-```sh76-devsite service host 5432 --name postgres77-devsite daemon run78-```79-80-An approved user can open the service on dev.site, get a one-use connection ticket, and81-connect with:82-83-```sh84-devsite connect dst_...85-```86-87-The daemon is a portable foreground process. Homebrew can supervise it on macOS, systemd88-can supervise it on Linux, and any service manager can keep `devsite daemon run` alive.89-90-## verify a download91-92-```sh93-sha256sum --check SHA256SUMS94-gh attestation verify <archive> --repo FelineStateMachine/devsite95-```@@ -821,7 +821,7 @@ dependencies = [
821821 822822 [[package]]823823 name = "devsite-cli"824-version = "0.3.0"824+version = "0.3.1"825825 dependencies = [826826 "anyhow",827827 "clap",@@ -841,7 +841,7 @@ dependencies = [
841841 842842 [[package]]843843 name = "devsite-client"844-version = "0.3.0"844+version = "0.3.1"845845 dependencies = [846846 "anyhow",847847 "devsite-proto",@@ -853,7 +853,7 @@ dependencies = [
853853 854854 [[package]]855855 name = "devsite-daemon"856-version = "0.3.0"856+version = "0.3.1"857857 dependencies = [858858 "anyhow",859859 "data-encoding",@@ -872,7 +872,7 @@ dependencies = [
872872 873873 [[package]]874874 name = "devsite-proto"875-version = "0.3.0"875+version = "0.3.1"876876 dependencies = [877877 "data-encoding",878878 "ed25519-dalek 2.2.0",@@ -884,7 +884,7 @@ dependencies = [
884884 885885 [[package]]886886 name = "devsite-server"887-version = "0.3.0"887+version = "0.3.1"888888 dependencies = [889889 "anyhow",890890 "axum",@@ -567,8 +567,9 @@ function renderSignedOut() {
567567 </header>568568 <div>569569 <i aria-hidden="true"></i><i aria-hidden="true"></i><i aria-hidden="true"></i>570- <ol aria-label="A host publishes as an endpoint. An approved user redeems a one-use ticket into a client-bound session, requests a signed capability for each connection, then opens an end-to-end encrypted Iroh QUIC stream to the host service.">571- <li><span>publish endpoint id</span></li>570+ <ol aria-label="A host proves control of and registers its bound endpoint, then receives current service authorizations from dev.site. An approved user redeems a one-use ticket into a client-bound session, requests a signed capability for each connection, then opens an end-to-end encrypted Iroh QUIC stream to the host service.">571+ <li><span>prove + register bound endpoint</span></li>572+ <li><span>sync authorization snapshot</span></li>572573 <li><span>redeem one-use ticket + client key</span></li>573574 <li><span>client-bound session</span></li>574575 <li><span>request one-stream capability</span></li>@@ -302,7 +302,7 @@ main > article:has(> .sequence) h1 {
302302 }303303 .sequence > div {304304 position: relative;305- height: 19rem;305+ height: 21.5rem;306306 }307307 .sequence > div > i {308308 position: absolute;@@ -353,46 +353,52 @@ main > article:has(> .sequence) h1 {
353353 .sequence li:nth-child(2),354354 .sequence li:nth-child(3),355355 .sequence li:nth-child(4),356-.sequence li:nth-child(5) {356+.sequence li:nth-child(5),357+.sequence li:nth-child(6) {357358 left: 50%;358359 width: 33.333%;359360 }360361 .sequence li:nth-child(1) {361- top: 2.3rem;362+ top: 2.1rem;362363 left: 16.667%;363364 }364365 .sequence li:nth-child(2) {365- top: 5rem;366+ top: 4.8rem;367+ left: 16.667%;366368 }367369 .sequence li:nth-child(3) {368- top: 7.7rem;370+ top: 7.5rem;369371 }370372 .sequence li:nth-child(4) {371- top: 10.4rem;373+ top: 10.2rem;372374 }373375 .sequence li:nth-child(5) {374- top: 13.1rem;376+ top: 12.9rem;375377 }376378 .sequence li:nth-child(6) {377- top: 16rem;379+ top: 15.6rem;380+}381+.sequence li:nth-child(7) {382+ top: 18.5rem;378383 left: 16.667%;379384 width: 66.666%;380385 border-top-style: dashed;381386 animation: sequence-flow 1.4s ease-in-out infinite alternate;382387 }383388 .sequence li:nth-child(1)::after,384-.sequence li:nth-child(3)::after,385-.sequence li:nth-child(5)::after {389+.sequence li:nth-child(4)::after,390+.sequence li:nth-child(6)::after {386391 right: -0.05rem;387392 border-left: 0.42rem solid var(--pico-primary);388393 }389394 .sequence li:nth-child(2)::after,390-.sequence li:nth-child(4)::after,391-.sequence li:nth-child(6)::after {395+.sequence li:nth-child(3)::after,396+.sequence li:nth-child(5)::after,397+.sequence li:nth-child(7)::after {392398 left: -0.05rem;393399 border-right: 0.42rem solid var(--pico-primary);394400 }395-.sequence li:nth-child(6)::before {401+.sequence li:nth-child(7)::before {396402 position: absolute;397403 top: -0.28rem;398404 right: -0.05rem;@@ -406,7 +412,7 @@ main > article:has(> .sequence) h1 {
406412 }407413 408414 @media (prefers-reduced-motion: reduce) {409- .sequence li:nth-child(6) {415+ .sequence li:nth-child(7) {410416 animation: none;411417 }412418 }