[P2] security: optional signature verification for MLnode PoC endpoints

[x0152]

MLnode api endpoints are currently unauthenticated, allowing an attacker who can reach the mlnode port to hijack POC by sending their own callback_url

Adds request signing using the existing signerAccount key. Network Node signs requests with X-Signature header, mlnode verifies using SIGNER_PUBKEY environment variable. For standard deployment where mlnode is on the same machine, it works automatically since SIGNER_PUBKEY defaults to ACCOUNT_PUBKEY

For remote mlnode setups, you need to set SIGNER_PUBKEY manually. If SIGNER_PUBKEY is not set, verification is skipped for backward compatibility

Get public key on network node:

source config.env
inferenced keys show $KEY_NAME --pubkey --keyring-backend $KEYRING_BACKEND | jq -r '.key'

Start mlnode with signature verification:

export SIGNER_PUBKEY=<public_key_from_above>
docker-compose -f docker-compose.mlnode.yml up -d

[x0152]

Current PR covers POC as the most critical - direct reward theft. Firstly would be good to understand if this direction makes sense. I should update PR description to clarify scope

[tcharchian]

Hey @x0152 @akup! It would be great if you could sync on the next steps for this pull request and make the needed decisions together. If you can move it forward on your own, it could be included in v0.2.12. But overall, this is a nice-to-have rather than something critical.

[x0152]

@akup If the poc api update is coming, let's postpone #537 and #417 until after that. #717 can go in this upgrade - it's optional, shouldn't be affected by PoC API changes and enables cloud-hosted MLNode setups

#537 and #417 for security and stability should go on top of the new api once it is validated on mainnet, to avoid regressions

what do you think about that?

[x0152]

Agree, let's merge #717 in this release and postpone #537/ #417 to the next one

[patimen]

@akup , @x0152 - Do we want to push on this one? You seemed ready to push it forward.

[x0152]

Agreed - let's include this in v0.2.13

[tcharchian]

Hi @x0152, are you ready to include this PR in the next upgrade?

[x0152]

#1329