chore: merge main - #181
Merged
Merged
Conversation
Bump gcp measure script version
Order ssh-pubkey-server after dropbear instead of requiring searcher-container, and serve both host keys via the generic --ssh-pubkey-file flag. Generate the dropbear .pub in dropbear-prereq so the control-plane key exists at boot. This makes the attested pubkey channel available before disk init, so the searcher can attest the host key before their first SSH instead of trusting it on first use (TOFU). The container key is served lazily by /pubkey once it appears after the disk is unlocked. Pin ssh-pubkey-server to v0.1.0 (lazy available-subset serving) and update the L1 readme accordingly.
…ple-pubkey-server Decouple ssh-pubkey-server from the searcher container
* flashbox-l1: allowlist BuilderNet bottom-of-block endpoints (production only) Add a temporary egress allowlist for the new BuilderNet bottom-of-block endpoints so a searcher can connect to a specific pre-configured builder instance for testing. These 6 IPs serve both the tx stream (persistent wss, path /bob) and bundle submission (bare path) over the same HTTPS endpoint, so they cannot be split into an always-on bundle rule + production-only tx stream rule the way the Flashbots/Titan endpoints are. Since tx stream is an observable side channel, the whole set is gated to production mode. - firewall-config: add 6 BuilderNet IPs to PRODUCTION_OUT (HTTPS/443) - toggle-config: add the same IPs to PRODUCTION_ENDPOINTS so tx-stream flows are torn down via conntrack when leaving production mode - searcher-container-after-init: add static /etc/hosts entries (US nodes first) so the searcher connects by hostname and TLS validates without DNS Tradeoff: BuilderNet bundle submission only works in production mode, unlike the Flashbots/Titan bundle endpoints which are always on. * flashbox-l1: reword BuilderNet endpoint comments to be purely descriptive Drop the "temporary test allowlist" framing and other non-descriptive notes from the BuilderNet egress comments across firewall-config, toggle-config, and searcher-container-after-init. The comments now describe only what the config is and why it is shaped this way.
BuilderNet IPs are allowlisted in PRODUCTION_OUT and torn down on toggle via toggle-config PRODUCTION_ENDPOINTS, but were missing the MAINTENANCE_OUT drop that the Flashbots tx-stream endpoints already have. Because MAINTENANCE_OUT accepts HTTPS to any IP (catch-all), the BuilderNet endpoints -- which carry the tx-stream side channel on 443 -- were reachable in maintenance mode, contradicting their production-only intent. Add the drop before the accept-all rules, mirroring the Flashbots Protect tx-stream treatment. flashbox-l2 reviewed: it has no BuilderNet endpoints (production-only egress is the simulator, already dropped in maintenance), so no change needed there.
* flashbox-l1: document BuilderNet bottom-of-block in readme BuilderNet bottom-of-block order flow is now live, with the same API format as Titan's. Document it alongside the existing Flashbots/Titan order-flow sections. - Add "Searching on BuilderNet's Bottom of Block" section: state diff stream (eth_subscribe / flashbots_stateDiffs) on wss://rpc.buildernet.org/bob and bundle submission (eth_sendBobBundle) on https://rpc.buildernet.org. Format mirrors Titan; both share one HTTPS endpoint so both are production-only. - Add the section to the table of contents. - Add a BuilderNet row to the firewall rules table (443, production only). - List BuilderNet in the intro line of supported order flow. - Fix DNS row port in the firewall table (54 -> 53). * Added note on readme --------- Co-authored-by: pablin-10 <118397961+pablin-10@users.noreply.github.com>
Titan Builder's bottom of block is no longer supported, so remove its endpoints from the image config and documentation entirely. Code (modules/flashbox/flashbox-l1/mkosi.extra/etc/bob/): - firewall-config: drop TITAN_* vars, the ALWAYS_OUT Titan bundle rule, and the PRODUCTION_OUT Titan state diff rule; update BuilderNet comments that compared against "Flashbots/Titan" to just "Flashbots". - toggle-config: drop the Titan entry from PRODUCTION_ENDPOINTS. - searcher-container-after-init: drop the fbtee.titanbuilder.xyz /etc/hosts entry. Docs (readme.md): - Remove the "Searching on Titan Builder's Bottom of Block" section, its TOC entry, the two Titan firewall-table rows, and the intro-line mention; drop the comparative Titan mention from the BuilderNet section.
…proxy flashbox - switch cvm-reverse-proxy to attested-tls-proxy
* Add reusable build+publish workflow for flashbox-l1 --------- Co-authored-by: Niccolo Raspa <niccoloraspa@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
subj.