Julius Joska
10ca35e352
GET /v1/register/challenge issues a stateless challenge (version, difficulty, expiry and a random nonce, HMAC-signed with a per-process key). The client finds a counter so that SHA-256(domain || challenge || identity_key || counter) has the requested number of leading zero bits and sends it in the X-Sepot-Pow header of POST /v1/register. Verification is one HMAC and one SHA-256; used challenges are kept in memory until they expire. SEPOT_REGISTER_POW=off|optional|required (default optional): in optional mode registrations with a valid solution get a separate, more generous per-IP bucket (SEPOT_RL_REGISTER_POW_*), registrations without one keep the existing limit; both share the global cap. required answers 428 without a valid solution. Difficulty: SEPOT_REGISTER_POW_BITS (18), raised by one bit per doubling of the registration rate over SEPOT_REGISTER_POW_ADAPT_PER_MIN up to SEPOT_REGISTER_POW_MAX_BITS (22). server-info advertises the mode. The paused-registration 503 now carries Retry-After.
63 lines
2.2 KiB
TOML
63 lines
2.2 KiB
TOML
[package]
|
|
name = "sepot-relay"
|
|
version = "0.1.0"
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[dependencies]
|
|
sepot-proto = { path = "../sepot-proto" }
|
|
prost = { workspace = true }
|
|
tokio = { workspace = true }
|
|
anyhow = { workspace = true }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
|
|
axum = { version = "0.8", features = ["ws"] }
|
|
sqlx = { version = "0.8", default-features = false, features = [
|
|
"postgres",
|
|
"runtime-tokio",
|
|
"tls-rustls",
|
|
"chrono",
|
|
"migrate",
|
|
"macros",
|
|
] }
|
|
dashmap = "6"
|
|
# CIDR match trusted proxy sítí pro anti-abuse klíč (viz net.rs)
|
|
ipnet = "2"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
base64 = "0.22"
|
|
# TURN údaje pro hovory: coturn ověřuje HMAC-SHA1 (REST schéma use-auth-secret)
|
|
hmac = "0.12"
|
|
# Proof-of-work registrace (pow.rs); už v grafu závislostí přes libsignal
|
|
sha2 = "0.10"
|
|
sha1 = "0.10"
|
|
hex = "0.4"
|
|
chrono = "0.4"
|
|
rand = "0.9"
|
|
futures-util = "0.3"
|
|
# Streaming download příloh z disku (ReaderStream)
|
|
tokio-util = { version = "0.7", features = ["io"] }
|
|
|
|
# Oficiální Signal krypto — POUZE pro roli certifikační autority sealed
|
|
# senderu (ServerCertificate/SenderCertificate) a ověření XEdDSA podpisů
|
|
# při AUTH. Relay NIKDY nešifruje/nedešifruje zprávy (hloupý relay).
|
|
libsignal-protocol = { git = "https://github.com/signalapp/libsignal", tag = "v0.96.4" }
|
|
libsignal-core = { git = "https://github.com/signalapp/libsignal", tag = "v0.96.4" }
|
|
# Rate limity (token bucket per IP / Tor / globálně, limits.rs)
|
|
governor = "0.10"
|
|
tower-http = { version = "0.7.0", features = ["timeout"] }
|
|
|
|
# Push budíčky (UnifiedPush/WebPush = POST na endpoint). rustls, ať build
|
|
# zůstane bez OpenSSL (stejně jako sqlx tls-rustls). Bez default featur —
|
|
# nechceme native-tls ani zbytečné kodeky. http2: APNs jiný protokol
|
|
# nepřijme (HTTP/1.1 spojení odmítne) — bez něj nedorazil žádný iOS budíček.
|
|
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "http2"] }
|
|
# FCM fast mode: RS256 JWT pro OAuth2 service account flow
|
|
jsonwebtoken = "9"
|
|
# setrlimit(RLIMIT_NOFILE) při startu — docker dává soft limit 1024
|
|
libc = "0.2"
|
|
|
|
[dev-dependencies]
|
|
tokio = { workspace = true, features = ["full"] }
|