mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-10 12:47:04 +00:00
kevinveenbirkenbachandClaude Opus 4.8
e6538e4f61
Turn a NAT/edge node into a full Tor v3 onion node: DOMAIN_PRIMARY becomes the node's .onion, so the whole stack (web, SSO, LDAP, CA) resolves onion domains and is reachable over Tor without a public IP, port forwarding, VPS or DynDNS. - utils/tor_onion.py: offline v3 key mint (address + HiddenServiceDir key files), verified against a known key->address test vector. - cli .../inventory/onion: `init-env` pre-mints the node onion, writes INFINITO_DOMAIN(+_RE) into .env and authoritative key files into .onion-identity/hs (idempotent). The onion is a deploy-time input; no in-deploy random minting (that would not match the pre-set domain). - roles/svc-net-tor: Tor sidecar (Debian-built, network_mode: host), installs the minted keys, torrc with one node HiddenService + a SOCKS proxy restricted to loopback/DiD ranges. files/test.sh probes every served onion domain over the Tor SOCKS. - tls: .onion -> TLS off (onion v3 crypto is the transport auth; LE cannot sign .onion) + app-level flavor override. - harness/DNS: coredns resolves the onion zone via INFINITO_DOMAIN; skip the clearnet DNS sanity check for onion; raise nginx server_names_hash_bucket_size to 128 for long onion server_names. - test-e2e-playwright: gated browser SOCKS proxy (PLAYWRIGHT_PROXY) + navigation/action timeouts so specs reach .onion over Tor and fail fast; the onion node points it at the Tor SOCKS. - docs/requirements/031: full design. Verified: dashboard + SSO (Keycloak) + 9 apps reachable over Tor (HTTP 200 through the node hidden service). make test green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Requirements 📋
This directory contains project requirements documents. Its scope is user stories and acceptance criteria that define what the project must do and that guide agent-assisted implementation.
Archive
- 001 - Nextcloud Talk TURN relay
- 001 - Service Registry Refactoring
- 003 - Reduce
applicationsandusersto lookup-only access - 004 - Generic RBAC role auto-provisioning via OpenLDAP
- 005 - WordPress Multisite support for OIDC-driven RBAC
- 006 - Service-gated Playwright tests
- 007 - WordPress to Discourse post round-trip
- 015 - KIX Service Management integration
- 016 - web-app-hugo (Static Site Generator)
- 012 - Package Cache (Nexus 3 OSS)
- 013 - Sub-Beta-to-Beta Lifecycle Promotion for
web-*Roles - 015: Self-built Moodle image (replaces
bitnamilegacy/moodle) - 015 - OpenCloud and OpenTalk IAM integration
- 021 - SSO Flavor Migration (oauth2 + oidc → unified
ssoservice) - 008 - Role Meta Layout Refactoring
- 009 - Per-Role Networks and Ports Migration
- 010 - Role Meta
run_after/lifecycleMigration - 011 - Role
meta/info.ymlMigration - 016 - Fediwall multi-wall via OIDC-protected runtime upload
- 019 - Playwright meta/services.yml parity coverage
- 020 - CI Run 25705903504 Deploy-Failure Remediation Loop
- 022 - Zammad Helpdesk Role with OIDC SSO
- 023 - Setup Penpot
- 025 - Matrix Role Ansible Flavor (matrix-docker-ansible-deploy)
- 031 - svc-net-tor: Tor Onion-Service Provider (injected alongside the clearnet domain)