Swarm: TLS between peers, pinned by the hub issue #48
closed: completed andymccall opened this · 0 comments
andymccall
Peer traffic (tickets, sessions, chunks) was plain HTTP. Each runner now keeps its own TLS certificate, reports its BLAKE3 with its swarm address, and the hub hands it on with the peer; a fetcher trusts only that certificate (handshake signature checked), so no CA is needed and nothing is readable on the network. Plain HTTP is gone. Hub side: oxygenhub, tracker passes the fingerprint and requires it.
Peer traffic (tickets, sessions, chunks) was plain HTTP. Each runner now keeps its own TLS certificate, reports its BLAKE3 with its swarm address, and the hub hands it on with the peer; a fetcher trusts only that certificate (handshake signature checked), so no CA is needed and nothing is readable on the network. Plain HTTP is gone. Hub side: oxygenhub, tracker passes the fingerprint and requires it.