clawbot
e96d27f35c
- Workspace: common (protocol/crypto/tarball), server (axum+rustls), stub (registration, poll, verify-before-execute) - Ed25519 payload signing + request-signature auth on /poll, /report - flate2/miniz_oxide pure-Rust tarball, no system deps - CI matrix: linux musl x86_64/aarch64, windows x86_64 - Compiles clean: cargo build --workspace, 0 errors 0 warnings
55 lines
2.0 KiB
Markdown
55 lines
2.0 KiB
Markdown
# Deploy-Agent
|
|
|
|
A secure deployment runner for automated system updates and change rollout.
|
|
|
|
## Architecture
|
|
|
|
- **Server**: Rust (axum), TLS (rustls+Let's Encrypt), per-machine instruction state, payload distribution
|
|
- **Stub**: Rust, single static binary (musl for Linux), polls server via HTTPS (mTLS), executes signed payload tarballs
|
|
- **Common**: All protocol, signatures, and tarball logic shared. Ed25519 for all signatures.
|
|
|
|
## Threat Model / Security
|
|
1. All instructions whitelisted (cannot push arbitrary shell — only allowed enum types)
|
|
2. All payloads are Ed25519 signed (dalek). Each payload's tarball hash is signed — must verify signature before extraction/execution.
|
|
3. All transport is TLS 1.3: mTLS on all endpoints (client/server auth)
|
|
4. Even with server compromise, unsigned payloads cannot be executed
|
|
5. Linux builds: musl static. Windows: modern, rustls native.
|
|
|
|
---
|
|
|
|
## Build Instructions
|
|
|
|
### Prereqs
|
|
- Rust 1.73+ (for musl: `rustup target add x86_64-unknown-linux-musl aarch64-unknown-linux-musl`)
|
|
- Let's Encrypt on server target
|
|
|
|
### Build all targets
|
|
```sh
|
|
cargo build --release --target x86_64-unknown-linux-musl
|
|
cargo build --release --target aarch64-unknown-linux-musl
|
|
cargo build --release --target x86_64-pc-windows-gnu
|
|
```
|
|
|
|
### Running the Server
|
|
|
|
1. Update the Acme domain in `server/src/api.rs:build_tls` for your domain
|
|
2. Start server:
|
|
```sh
|
|
cd server && cargo run --release
|
|
```
|
|
3. mTLS provisioning writes certs to acme cache dir
|
|
|
|
### Running the Stub
|
|
|
|
1. Copy server public key to config directory or use auto-provision
|
|
2. On first run, the stub registers itself, generates an Ed25519 keypair (machine identity)
|
|
3. Configuration (~/.config/deploy-agent/config.toml or %APPDATA%)
|
|
|
|
### Signing a Payload
|
|
|
|
Follow the scripts in `payloads/sign-payload`. Instructions are in the comments — uses bash + Rust. You may also implement your own sign tool in Rust using common/crypto.
|
|
|
|
---
|
|
|
|
For technical details, see the code + `common/` for protocol. All types and serialization are shared. See `.gitea/workflows/build.yml` for CI config.
|