Make landmarks mandatory; drop landmarks.enabled and landmark_url_path config

Landmark-relative certs are no longer opt-in. Removes the
LandmarkConfig.Enabled gate (landmarks always run) and the
landmark_url_path knob (the /landmarks route was already hardcoded in
tile/server.go, so the field was dead config). The cadence and
max-cert-lifetime knobs remain tunable.

- config: drop Enabled/URLPath fields; validate cadence + lifetime
  unconditionally.
- cmd/cactus: always build the landmark.Sequence and wire it into the
  log OnFlush hook, ACME, and tile server.
- update config examples, README, and the binary integration test.

Author: mcpherrinm

README.md

@@ -128,11 +128,13 @@ determined by which top-level config blocks are populated and
 
 | Concern | Adds | Set |
 |---|---|---|
-| **CA** (default) | Issuance log + ACME server | `acme`, `log`, `ca_cosigner` |
-| **Landmarks** | Landmark-relative cert support | `landmarks.enabled = true` |
+| **CA** (default) | Issuance log + ACME server + landmark-relative certs | `acme`, `log`, `ca_cosigner` |
 | **CA-side mirror collection** | Multi-mirror cosignatures during issuance | `ca_cosigner_quorum.mirrors[]` |
 | **Mirror operating mode** | Follow an upstream + serve `/sign-subtree` | `mirror.enabled = true` (and `mirror.upstream`) |
 
+Landmark-relative cert support is always on; only its cadence is
+tunable (see `landmarks` below).
+
 Cactus operating modes are not enumerated; the binary just brings up
 whichever subsystems the config asks for. The validator does enforce
 some hygiene rules — chiefly, mirror + CA modes in the same binary
@@ -271,22 +273,23 @@ and an older toolchain simply won't compile cactus.
 valid; for tests) or `http-01` (real fetch of
 `http://identifier/.well-known/acme-challenge/<token>`).
 
-### `landmarks` (optional)
+### `landmarks` (tuning only)
 
 ```json
 "landmarks": {
-  "enabled": true,
   "time_between_landmarks_ms": 3600000,
-  "max_cert_lifetime_ms": 604800000,
-  "landmark_url_path": "/landmarks"
+  "max_cert_lifetime_ms": 604800000
 }
 ```
 
-Landmark trust anchor IDs are derived from the CA ID and log number
-(`CA-ID.1.logNumber.L`, §6.3.1) — there's no separate `base_id`.
-Defaults: 1-hour landmark cadence, 7-day max cert lifetime ⇒
-`max_active_landmarks = ceil(168) + 1 = 169` ⇒ ~10 KiB of relying
-party state per CA. See §6.3.1 of the draft.
+Landmarks are always on; this block only tunes the cadence and the
+max cert lifetime (both optional, with the defaults shown). The
+§6.3.1 list is always served at `/landmarks`. Landmark trust anchor
+IDs are derived from the CA ID and log number (`CA-ID.1.logNumber.L`,
+§6.3.1) — there's no separate `base_id`. Defaults: 1-hour landmark
+cadence, 7-day max cert lifetime ⇒ `max_active_landmarks =
+ceil(168) + 1 = 169` ⇒ ~10 KiB of relying party state per CA. See
+§6.3.1 of the draft.
 
 ### `mirror` (optional, mirror mode)
 

cmd/cactus/main.go

@@ -193,25 +193,22 @@ func run(cfg config.Config, logger *slog.Logger) error {
 		return fmt.Errorf("build CA certificate: %w", err)
 	}
 
-	// Optional landmark sequence. Built before the log so we
-	// can pass the OnFlush hook to log.Config.
-	var landmarkSeq *landmark.Sequence
-	if cfg.Landmarks.Enabled {
-		landmarkSeq, err = landmark.New(landmark.Config{
-			CAID:                 caID,
-			LogNumber:            cfg.Log.Number,
-			TimeBetweenLandmarks: cfg.Landmarks.TimeBetweenLandmarks(),
-			MaxCertLifetime:      cfg.Landmarks.MaxCertLifetime(),
-		}, fsRoot, time.Now())
-		if err != nil {
-			return fmt.Errorf("landmark sequence: %w", err)
-		}
-		logger.Info("landmarks enabled",
-			"ca_id", string(caID),
-			"log_number", cfg.Log.Number,
-			"interval", cfg.Landmarks.TimeBetweenLandmarks(),
-			"max_active", landmarkSeq.MaxActive())
+	// Landmark sequence. Built before the log so we can pass the
+	// OnFlush hook to log.Config. Landmarks are mandatory.
+	landmarkSeq, err := landmark.New(landmark.Config{
+		CAID:                 caID,
+		LogNumber:            cfg.Log.Number,
+		TimeBetweenLandmarks: cfg.Landmarks.TimeBetweenLandmarks(),
+		MaxCertLifetime:      cfg.Landmarks.MaxCertLifetime(),
+	}, fsRoot, time.Now())
+	if err != nil {
+		return fmt.Errorf("landmark sequence: %w", err)
 	}
+	logger.Info("landmarks ready",
+		"ca_id", string(caID),
+		"log_number", cfg.Log.Number,
+		"interval", cfg.Landmarks.TimeBetweenLandmarks(),
+		"max_active", landmarkSeq.MaxActive())
 
 	// Issuance log. The MirrorRequester closure (CA-mode quorum)
 	// needs `l` to compute consistency proofs, so we forward-declare
@@ -231,17 +228,15 @@ func run(cfg config.Config, logger *slog.Logger) error {
 			SignatureDuration: m.SignatureDurationVec(),
 		},
 	}
-	if landmarkSeq != nil {
-		logCfg.OnFlush = func(treeSize uint64) {
-			lm, ok, err := landmarkSeq.Append(ctx, treeSize, time.Now())
-			if err != nil {
-				logger.Error("landmark append", "err", err)
-				return
-			}
-			if ok {
-				logger.Info("landmark allocated",
-					"number", lm.Number, "tree_size", lm.TreeSize)
-			}
+	logCfg.OnFlush = func(treeSize uint64) {
+		lm, ok, err := landmarkSeq.Append(ctx, treeSize, time.Now())
+		if err != nil {
+			logger.Error("landmark append", "err", err)
+			return
+		}
+		if ok {
+			logger.Info("landmark allocated",
+				"number", lm.Number, "tree_size", lm.TreeSize)
 		}
 	}
 	if len(cfg.CACosignerQuorum.Mirrors) > 0 {
@@ -336,11 +331,9 @@ func run(cfg config.Config, logger *slog.Logger) error {
 		LogID:          logID,
 		CAID:           caID,
 	}
-	if landmarkSeq != nil {
-		acmeCfg.Landmarks = landmarkSeq
-		acmeCfg.SubtreeProof = l.SubtreeProof
-		acmeCfg.LogNumber = cfg.Log.Number
-	}
+	acmeCfg.Landmarks = landmarkSeq
+	acmeCfg.SubtreeProof = l.SubtreeProof
+	acmeCfg.LogNumber = cfg.Log.Number
 	acmeSrv, err := acme.New(acmeCfg)
 	if err != nil {
 		return fmt.Errorf("acme: %w", err)
@@ -368,10 +361,7 @@ func run(cfg config.Config, logger *slog.Logger) error {
 		IdleTimeout:       idleTimeout,
 		MaxHeaderBytes:    16 * 1024,
 	}
-	tileSrv := tile.New(l, fsRoot)
-	if landmarkSeq != nil {
-		tileSrv = tileSrv.WithLandmarks(landmarkSeq)
-	}
+	tileSrv := tile.New(l, fsRoot).WithLandmarks(landmarkSeq)
 	monMux := http.NewServeMux()
 	monMux.HandleFunc("/ca-certificate", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/pem-certificate-chain")

config-example.json

@@ -25,10 +25,8 @@
     "listen": "127.0.0.1:14090"
   },
   "landmarks": {
-    "enabled": false,
     "time_between_landmarks_ms": 3600000,
-    "max_cert_lifetime_ms": 604800000,
-    "landmark_url_path": "/landmarks"
+    "max_cert_lifetime_ms": 604800000
   },
   "ca_cosigner_quorum": {
     "mirrors": [],

config-witness-example.json

@@ -25,10 +25,8 @@
     "listen": "127.0.0.1:14090"
   },
   "landmarks": {
-    "enabled": true,
     "time_between_landmarks_ms": 60000,
-    "max_cert_lifetime_ms": 3600000,
-    "landmark_url_path": "/landmarks"
+    "max_cert_lifetime_ms": 3600000
   },
   "mirror": {
     "enabled": true,

config/config.go

@@ -82,15 +82,15 @@ func (u UpstreamConfig) PollInterval() time.Duration {
 	return time.Duration(u.PollIntervalMS) * time.Millisecond
 }
 
-// LandmarkConfig configures the §6.3 landmark sequence + URL.
-// Disabled by default; set Enabled=true to opt in. In draft-04 landmark
-// trust anchor IDs are derived from the CA ID and log number
-// (CA-ID.1.logNumber.L), so there is no separate base_id parameter.
+// LandmarkConfig configures the §6.3 landmark sequence. Landmarks are
+// always on; only their cadence and the max cert lifetime (which sets
+// max_active_landmarks) are tunable. In draft-04 landmark trust anchor
+// IDs are derived from the CA ID and log number (CA-ID.1.logNumber.L),
+// so there is no separate base_id parameter. The §6.3.1 list is always
+// served at "/landmarks".
 type LandmarkConfig struct {
-	Enabled                bool   `json:"enabled"`
-	TimeBetweenLandmarksMS int    `json:"time_between_landmarks_ms"`
-	MaxCertLifetimeMS      int    `json:"max_cert_lifetime_ms"`
-	URLPath                string `json:"landmark_url_path"`
+	TimeBetweenLandmarksMS int `json:"time_between_landmarks_ms"`
+	MaxCertLifetimeMS      int `json:"max_cert_lifetime_ms"`
 }
 
 // TimeBetweenLandmarks returns the §6.3.2 interval as a time.Duration.
@@ -161,7 +161,6 @@ func Default() Config {
 		Monitoring: ListenerConfig{Listen: ":14080"},
 		Metrics:    MetricsConfig{Listen: "127.0.0.1:14090"},
 		Landmarks: LandmarkConfig{
-			URLPath:                "/landmarks",
 			TimeBetweenLandmarksMS: 3600000,   // 1 hour
 			MaxCertLifetimeMS:      604800000, // 7 days
 		},
@@ -256,16 +255,13 @@ func (c *Config) Validate() error {
 	default:
 		return fmt.Errorf("log_level %q invalid", c.LogLevel)
 	}
-	if c.Landmarks.Enabled {
-		if c.Landmarks.TimeBetweenLandmarksMS <= 0 {
-			return fmt.Errorf("landmarks.time_between_landmarks_ms must be > 0")
-		}
-		if c.Landmarks.MaxCertLifetimeMS <= 0 {
-			return fmt.Errorf("landmarks.max_cert_lifetime_ms must be > 0")
-		}
-		if c.Landmarks.URLPath == "" {
-			return fmt.Errorf("landmarks.landmark_url_path must be set")
-		}
+	// Landmarks are mandatory; their cadence and max cert lifetime
+	// always apply.
+	if c.Landmarks.TimeBetweenLandmarksMS <= 0 {
+		return fmt.Errorf("landmarks.time_between_landmarks_ms must be > 0")
+	}
+	if c.Landmarks.MaxCertLifetimeMS <= 0 {
+		return fmt.Errorf("landmarks.max_cert_lifetime_ms must be > 0")
 	}
 	if len(c.CACosignerQuorum.Mirrors) > 0 {
 		if c.CACosignerQuorum.MinSignatures < 1 {

integration/binary_landmarks_test.go

@@ -15,10 +15,10 @@ import (
 	"time"
 )
 
-// TestCactusBinaryWithLandmarks builds the cactus binary with
-// landmarks enabled in config, lets it allocate at least one landmark
-// (using a 50ms interval), then hits /landmarks and confirms the body
-// matches the §6.3.1 format with at least one allocated landmark.
+// TestCactusBinaryWithLandmarks builds the cactus binary, lets it
+// allocate at least one landmark (using a 50ms interval), then hits
+// /landmarks and confirms the body matches the §6.3.1 format with at
+// least one allocated landmark.
 func TestCactusBinaryWithLandmarks(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping in -short mode")
@@ -57,10 +57,8 @@ func TestCactusBinaryWithLandmarks(t *testing.T) {
 			"listen": fmt.Sprintf("127.0.0.1:%d", metricsPort),
 		},
 		"landmarks": map[string]any{
-			"enabled":                   true,
 			"time_between_landmarks_ms": 50, // 50ms so a landmark allocates fast
 			"max_cert_lifetime_ms":      300,
-			"landmark_url_path":         "/landmarks",
 		},
 		"log_level": "info",
 	}

tile/server.go

@@ -41,8 +41,7 @@ func New(l *log.Log, fs storage.FS) *Server {
 }
 
 // WithLandmarks attaches a landmark.Sequence so the server exposes
-// the §6.3.1 /landmarks endpoint (path configurable; "/landmarks" by
-// default in cmd/cactus).
+// the §6.3.1 /landmarks endpoint.
 func (s *Server) WithLandmarks(seq *landmark.Sequence) *Server {
 	s.landmarks = seq
 	return s