diff options
Diffstat (limited to 'packages/meshbay-node/src/meshbay_node/config.py')
| -rw-r--r-- | packages/meshbay-node/src/meshbay_node/config.py | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/packages/meshbay-node/src/meshbay_node/config.py b/packages/meshbay-node/src/meshbay_node/config.py index 9e6a391..a7a0785 100644 --- a/packages/meshbay-node/src/meshbay_node/config.py +++ b/packages/meshbay-node/src/meshbay_node/config.py @@ -52,6 +52,11 @@ visibility = "public" [keystore] # unlock_file = "~/.config/meshbay/unlock.key" # or set MESHBAY_UNLOCK_KEY env var + +# Node sovereignty: pin the operator's Ed25519 public key (base64, 32 bytes raw). +# Admin operations (file delete) require cryptographic proof of this key. +# Auto-pinned on first startup from the node operator's keystore. +# admin_pk_ed25519 = "base64-encoded-32-bytes" """ @@ -59,7 +64,6 @@ visibility = "public" class HubConfig: url: str = "https://meshbay.org" username: str = "" - password: str = "" # loaded from keystore or env; never written to TOML @dataclass @@ -94,6 +98,7 @@ class Config: groups: list[GroupConfig] = field(default_factory=list) keystore: KeystoreConfig = field(default_factory=KeystoreConfig) data_dir: Path = field(default_factory=lambda: Path.home() / ".local" / "share" / "meshbay") + admin_pk_ed25519: str = "" # base64 raw Ed25519 public key pinned locally # Back-compat: single-group access @property @@ -144,6 +149,9 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH) -> Config: if "data_dir" in raw: cfg.data_dir = Path(raw["data_dir"]).expanduser().resolve() + if "admin_pk_ed25519" in raw: + cfg.admin_pk_ed25519 = raw["admin_pk_ed25519"] + ks = raw.get("keystore", {}) if "path" in ks: cfg.keystore.path = Path(ks["path"]).expanduser() @@ -155,8 +163,6 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH) -> Config: cfg.hub.url = url if user := os.environ.get("MESHBAY_USERNAME"): cfg.hub.username = user - if pwd := os.environ.get("MESHBAY_PASSWORD"): - cfg.hub.password = pwd if port := os.environ.get("MESHBAY_PORT"): cfg.node.port = int(port) |