Documentation
¶
Overview ¶
Package relayauth implements publisher-minted, stateless Ed25519-signed credentials for the APNs publisher-relay.
The publisher holds an Ed25519 private key and mints tokens binding a daemonID + expiry. The relay verifies tokens with the corresponding public key alone — no credential store, no pairing dance, no I/O — so a relay restart never invalidates daemons. The relay is the exposed component, so it holds only the public key: a relay compromise must not grant minting ability.
Token format: base64url(payloadJSON).base64url(ed25519Signature), where payloadJSON = {"d":daemonID,"e":expUnix,"v":1}.
Index ¶
- func GenerateKey() (ed25519.PublicKey, ed25519.PrivateKey, error)
- func LoadPrivateKey(path string) (ed25519.PrivateKey, error)
- func LoadPublicKey(path string) (ed25519.PublicKey, error)
- func PublicKeyBase64(pub ed25519.PublicKey) string
- func SavePrivateKey(path string, priv ed25519.PrivateKey) error
- func Sign(priv ed25519.PrivateKey, daemonID string, ttl time.Duration) (string, error)
- type Credential
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GenerateKey ¶
func GenerateKey() (ed25519.PublicKey, ed25519.PrivateKey, error)
GenerateKey returns a fresh Ed25519 keypair.
func LoadPrivateKey ¶
func LoadPrivateKey(path string) (ed25519.PrivateKey, error)
LoadPrivateKey reads an Ed25519 private key from a PEM PKCS#8 file. It refuses a group/world-readable file (mode bits 0o077 set): the private key can mint credentials for any daemonID, so a world-readable source is rejected before the bytes are trusted. Mirrors apns.LoadPrivateKey's 0600 boundary.
func LoadPublicKey ¶
LoadPublicKey reads a base64-encoded Ed25519 public key from a file (whitespace trimmed). A public key is not secret, so the file need not be 0600 — it lives on the exposed relay host.
func PublicKeyBase64 ¶
PublicKeyBase64 returns the standard base64 encoding of a 32-byte Ed25519 public key. Print this from `rmote-relay-mint keygen` and store it on the relay via -verify-key.
func SavePrivateKey ¶
func SavePrivateKey(path string, priv ed25519.PrivateKey) error
SavePrivateKey writes an Ed25519 private key as PEM PKCS#8 with 0600 perms.
Types ¶
type Credential ¶
Credential is the authenticated identity extracted from a verified token. The relay uses DaemonID for Store.Authorized isolation; ExpiresAt is the signed expiry (already checked unexpired by Verify).
Source Files