clawbot
e96d27f35c
- Workspace: common (protocol/crypto/tarball), server (axum+rustls), stub (registration, poll, verify-before-execute) - Ed25519 payload signing + request-signature auth on /poll, /report - flate2/miniz_oxide pure-Rust tarball, no system deps - CI matrix: linux musl x86_64/aarch64, windows x86_64 - Compiles clean: cargo build --workspace, 0 errors 0 warnings
Deploy-Agent
A secure deployment runner for automated system updates and change rollout.
Architecture
- Server: Rust (axum), TLS (rustls+Let's Encrypt), per-machine instruction state, payload distribution
- Stub: Rust, single static binary (musl for Linux), polls server via HTTPS (mTLS), executes signed payload tarballs
- Common: All protocol, signatures, and tarball logic shared. Ed25519 for all signatures.
Threat Model / Security
- All instructions whitelisted (cannot push arbitrary shell — only allowed enum types)
- All payloads are Ed25519 signed (dalek). Each payload's tarball hash is signed — must verify signature before extraction/execution.
- All transport is TLS 1.3: mTLS on all endpoints (client/server auth)
- Even with server compromise, unsigned payloads cannot be executed
- Linux builds: musl static. Windows: modern, rustls native.
Build Instructions
Prereqs
- Rust 1.73+ (for musl:
rustup target add x86_64-unknown-linux-musl aarch64-unknown-linux-musl) - Let's Encrypt on server target
Build all targets
cargo build --release --target x86_64-unknown-linux-musl
cargo build --release --target aarch64-unknown-linux-musl
cargo build --release --target x86_64-pc-windows-gnu
Running the Server
- Update the Acme domain in
server/src/api.rs:build_tlsfor your domain - Start server:
cd server && cargo run --release - mTLS provisioning writes certs to acme cache dir
Running the Stub
- Copy server public key to config directory or use auto-provision
- On first run, the stub registers itself, generates an Ed25519 keypair (machine identity)
- Configuration (~/.config/deploy-agent/config.toml or %APPDATA%)
Signing a Payload
Follow the scripts in payloads/sign-payload. Instructions are in the comments — uses bash + Rust. You may also implement your own sign tool in Rust using common/crypto.
For technical details, see the code + common/ for protocol. All types and serialization are shared. See .gitea/workflows/build.yml for CI config.