oxmc
685c14ba97
Node.js daemon: Ed25519 identity + self-signed TLS, signed registration/ renewal with the central registry, mDNS advertising, disk-backed fetch-through asset cache with an origin allowlist. Includes a local dev-registry stand-in for the real oxmc.me endpoints and an end-to-end smoke test (register -> token -> cache miss/hit -> SSRF rejection). See README.md for the full protocol and trust model.
60 lines
2.3 KiB
Markdown
60 lines
2.3 KiB
Markdown
# pawletcache-dev-registry
|
|
|
|
Throwaway local stand-in for the `oxmc.me` `/apis/aosp/cache/register` and
|
|
`/apis/aosp/cache/lookup` endpoints documented in `../README.md`. Exists so
|
|
`pawletcache-server` (and, separately, the Android `CentralLookupClient`) can
|
|
be exercised end-to-end without touching real `oxmc.me` infra or its actual
|
|
signing key.
|
|
|
|
**Not production code.** Two shortcuts that would be wrong on the real
|
|
`oxmc.me`:
|
|
- `lookup()` hands back whichever server registered most recently, full
|
|
stop — no public-IP/NAT matching, because on localhost there's no NAT to
|
|
match. The real registry has to match the *caller's* public IP against a
|
|
registered server's public IP (see main README's Apple-content-caching
|
|
comparison).
|
|
- Zero persistence hardening — `data/registrations.json` is a flat JSON
|
|
file, fine for a laptop, not for anything real.
|
|
|
|
Everything about the actual wire protocol (request/response shape, what's
|
|
signed, the CacheToken format) is the real thing, though — this is a
|
|
faithful implementation of the spec, just with a self-issued root key and a
|
|
dumb `lookup()`.
|
|
|
|
## Running
|
|
|
|
```bash
|
|
cd dev-registry
|
|
DEV_ENROLLMENT_TOKENS=dev-local-token node src/index.js
|
|
```
|
|
|
|
First run generates a root Ed25519 keypair under `data/identity/` and prints
|
|
its public half — paste that into
|
|
`android_packages_apps_PawletCache/src/os/pawlet/cache/Constants.kt`'s
|
|
`CACHE_TRUST_ROOT_PUBKEY_BASE64` if you want a real device/emulator to trust
|
|
tokens this registry issues.
|
|
|
|
Env vars:
|
|
| Var | Default | |
|
|
|---|---|---|
|
|
| `DEV_REGISTRY_PORT` | `4000` | |
|
|
| `DEV_REGISTRY_DATA_DIR` | `./data` | |
|
|
| `DEV_ENROLLMENT_TOKENS` | `dev-local-token` | comma-separated allowlist |
|
|
| `DEV_TOKEN_TTL_MS` | `600000` (10 min) | short by default so you can actually see `pawletcache-server`'s renewal loop fire during a normal test session |
|
|
|
|
## Pointing pawletcache-server at it
|
|
|
|
In `../config.yml`:
|
|
```yaml
|
|
centralUrl: http://localhost:4000
|
|
enrollmentToken: dev-local-token
|
|
```
|
|
(Plain `http://` — this dev registry doesn't bother with TLS; the real
|
|
`oxmc.me` obviously would. `pawletcache-server`'s own asset-serving HTTPS
|
|
endpoint is unaffected either way, that's a separate TLS cert.)
|
|
|
|
## See also
|
|
|
|
`../scripts/smoke-test.sh` — drives this registry + `pawletcache-server`
|
|
together and checks the whole register → token → cache flow with curl.
|