You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A node with a publicly dialable /tcp/443 listener now gets its TLS
certificate for its own IP address, straight from Let's Encrypt, instead
of registering a name with the libp2p.direct broker. Browsers reach it
at /ip4/<ip>/tcp/443/tls/ws with no DNS lookup and nobody else in the
path, and HTTPProvider serves the trustless gateway behind the same
certificate on the same port.
The only thing to configure is the listener. The ACME challenge that
proves an address is defined on port 443 and nowhere else, so a node on
any other port, or one the authority cannot reach, keeps using the
broker exactly as before.
- AutoTLS.IPCerts, on by default, opts back out to the broker path
- AutoTLS.IPCertsPort is an advanced knob for a local ACME server; a
public authority connects to 443 and ignores anything else
p2p-forge and boxo are pinned to unreleased commits from
ipshipyard/p2p-forge#94 and ipfs/boxo#1196 until those land.
This release was brought to you by the [Shipyard](https://ipshipyard.com/) team.
6
-
7
3
-[vTBD](#vtbd)
8
4
9
5
## vTBD
10
6
11
7
-[Overview](#overview)
12
8
-[🔦 Highlights](#-highlights)
13
9
-[🌐 Experimental `HTTPProvider`: serve local data over plain HTTP/2](#-experimental-httpprovider-serve-local-data-over-plain-http2)
10
+
-[🔒 AutoTLS without a broker: certificates for your own IP](#-autotls-without-a-broker-certificates-for-your-own-ip)
14
11
-[📝 Changelog](#-changelog)
15
12
-[👨👩👧👦 Contributors](#-contributors)
16
13
@@ -28,6 +25,16 @@ This is a meaningful step toward broader IPFS interoperability: a stock HTTP cli
28
25
29
26
Off by default. See [`HTTPProvider`](https://github.com/ipfs/kubo/blob/master/docs/config.md#httpprovider) for the available settings and how to turn it on.
30
27
28
+
#### 🔒 AutoTLS without a broker: certificates for your own IP
29
+
30
+
If your node is reachable on TCP port 443, AutoTLS now gets its TLS certificate for your node's own IP address, directly from Let's Encrypt. No name is registered with the `libp2p.direct` broker, and no DNS lookup sits between a browser and your node.
31
+
32
+
The only change needed is a port 443 listener in [`Addresses.Swarm`](https://github.com/ipfs/kubo/blob/master/docs/config.md#addressesswarm), such as `/ip4/0.0.0.0/tcp/443`. Let's Encrypt checks the address by connecting back to it and speaking TLS, which your node answers on the same listener it already serves peers on, so nothing extra is exposed. Such a node announces `/ip4/<your-ip>/tcp/443/tls/ws` (and the matching `/tls/http` when [`HTTPProvider.AnnounceMultiaddrs`](https://github.com/ipfs/kubo/blob/master/docs/config.md#httpproviderannouncemultiaddrs) is on) in place of its `libp2p.direct` address.
33
+
34
+
Nodes on any other port, or whose port 443 turns out to be unreachable, keep using the broker exactly as before.
35
+
36
+
Certificates covering an IP address are short-lived by policy, valid for about six days, so a node has to stay online to keep renewing. Requests are paced to stay well inside Let's Encrypt's rate limits, and the pacing survives daemon restarts. See [`AutoTLS.IPCerts`](https://github.com/ipfs/kubo/blob/master/docs/config.md#autotlsipcerts).
Optional. Lets a node get its TLS certificate for its own IP address, straight from the certificate authority, instead of registering a name with the `libp2p.direct` broker.
806
+
807
+
The only thing this needs is a `/tcp/443` listener in [`Addresses.Swarm`](#addressesswarm) that the internet can reach, for example `/ip4/0.0.0.0/tcp/443`. The authority checks the address by connecting back to it on port 443 and speaking TLS, which the node answers on the very listener it serves peers on. Nothing else is exposed, and no extra port is opened.
808
+
809
+
A node that gets such a certificate announces `/ip4/<your-ip>/tcp/443/tls/ws` (and, with [`HTTPProvider.AnnounceMultiaddrs`](#httpproviderannouncemultiaddrs), the matching `/tls/http`) and stops announcing its `libp2p.direct` name. Browsers and other peers connect to the IP directly, so no DNS lookup and no third-party service sit between a client and the node.
810
+
811
+
A node without a reachable port 443 keeps using the broker, as does one whose certificate request fails, so turning this off is only needed to force the broker path.
812
+
813
+
**Note:**
814
+
815
+
- Certificates for IP addresses are short-lived, currently valid for about six days, and are renewed a few days ahead of expiry. A node that stays offline past expiry falls back to the broker until it has renewed.
816
+
- Binding port 443 needs root or `CAP_NET_BIND_SERVICE` on Linux. Kubo has to listen on 443 itself, including behind a router: forward the router's port 443 to port 443 on this node, not to some other port.
817
+
- Address changes are handled: a certificate is requested per reachable address, and an address that goes away stops being renewed and announced. A node whose public address is not on any of its own interfaces, which is the normal case behind a router, waits a few minutes for other peers to tell it that address before deciding it needs the broker.
818
+
- Requests are paced to stay inside the authority's [rate limits](https://letsencrypt.org/docs/rate-limits/): a failure is retried after an hour, doubling to at most a day, and the wait is written to disk before each attempt, so a node that keeps crashing cannot spend its budget one restart at a time.
819
+
- Let's Encrypt issues IP certificates only under its short-lived [profile](https://letsencrypt.org/docs/profiles/), and only for `http-01` or `tls-alpn-01` validation. Kubo uses `tls-alpn-01`, which is why port 443 is the only port that works.
820
+
821
+
Default: `true` (if `AutoTLS.Enabled` and a reachable `/tcp/443` listener exists)
822
+
823
+
Type: `flag`
824
+
825
+
### `AutoTLS.IPCertsPort`
826
+
827
+
Optional. Overrides the TCP port the certificate authority is expected to connect to when it checks an IP address for [`AutoTLS.IPCerts`](#autotlsipcerts).
828
+
829
+
Advanced, meant for testing against a local ACME server. Public authorities always connect to port 443 and ignore anything else, so changing this on a production node only stops certificates from being issued.
830
+
831
+
Default: `443`
832
+
833
+
Type: `optionalInteger`
834
+
801
835
### `AutoTLS.ShortAddrs`
802
836
803
837
Optional. Controls if final AutoTLS listeners are announced under shorter `/dnsX/A.B.C.D.peerid.libp2p.direct/tcp/4001/tls/ws` addresses instead of fully resolved `/ip4/A.B.C.D/tcp/4001/tls/sni/A-B-C-D.peerid.libp2p.direct/tls/ws`.
0 commit comments