# Deploy-Agent

A secure deployment runner for automated system updates and change rollout.

## Architecture

- **Server**: Rust (axum), TLS (rustls+Let's Encrypt), per-machine instruction state, payload distribution
- **Stub**: Rust, single static binary (musl for Linux), polls server via HTTPS (mTLS), executes signed payload tarballs
- **Common**: All protocol, signatures, and tarball logic shared. Ed25519 for all signatures.

## Threat Model / Security
1. All instructions whitelisted (cannot push arbitrary shell — only allowed enum types)
2. All payloads are Ed25519 signed (dalek). Each payload's tarball hash is signed — must verify signature before extraction/execution.
3. All transport is TLS 1.3: mTLS on all endpoints (client/server auth)
4. Even with server compromise, unsigned payloads cannot be executed
5. Linux builds: musl static. Windows: modern, rustls native.

---

## Build Instructions

### Prereqs
- Rust 1.73+ (for musl: `rustup target add x86_64-unknown-linux-musl aarch64-unknown-linux-musl`)
- Let's Encrypt on server target

### Build all targets
```sh
cargo build --release --target x86_64-unknown-linux-musl
cargo build --release --target aarch64-unknown-linux-musl
cargo build --release --target x86_64-pc-windows-gnu
```

### Running the Server

1. Update the Acme domain in `server/src/api.rs:build_tls` for your domain
2. Start server:
   ```sh
   cd server && cargo run --release
   ```
3. mTLS provisioning writes certs to acme cache dir

### Running the Stub

1. Copy server public key to config directory or use auto-provision
2. On first run, the stub registers itself, generates an Ed25519 keypair (machine identity)
3. Configuration (~/.config/deploy-agent/config.toml or %APPDATA%)

### Signing a Payload

Follow the scripts in `payloads/sign-payload`. Instructions are in the comments — uses bash + Rust. You may also implement your own sign tool in Rust using common/crypto.

---

For technical details, see the code + `common/` for protocol. All types and serialization are shared. See `.gitea/workflows/build.yml` for CI config.