summary
exploration to replace static peer endpoints with signed identity tokens as the primary peer endpoint selection method, while keeping the existing bucket-based ownership model intact.
what changed
why tho
reverse dns and static IPs (that we get for free from aws) are location labels, not identity: they can be reassigned, changed, or cached stale, so the same ip↔hostname pair can point to a different machine over time. TLS endpoint trust is tied to hostname/cert binding, so when addresses churn, host-based verification tracks routing details instead of a durable peer identity, increasing ambiguity in who is actually at the other end.
rollout plan
- start with preferred modes that keep fallback behavior
- validate mixed-fleet behavior and failure handling
- move to stricter modes only after token coverage is complete
notes
this is not a full network rewrite. it is a compatibility-first change to peer endpoint selection that reduces direct dependence on bare ip:port in the normal path. the beauty in using s3 for the control plane & universal façade was motivation in using DNS similarly
summary
exploration to replace static peer endpoints with signed identity tokens as the primary peer endpoint selection method, while keeping the existing bucket-based ownership model intact.
what changed
crates/logic/lib.rs and
crates/celld/ownership_store.rs
crates/logic/lib.rs and
crates/celld/main.rs
crates/logic/lib.rs,
crates/celld/peer_transport.rs, and
crates/celld/main.rs
crates/logic/lib.rs,
crates/celld/peer_transport.rs, and
crates/celld/main.rs
crates/celld/peer_transport.rs and
crates/celld/main.rs
crates/celld/peer_transport.rs and
crates/celld/main.rs
docs/README.md
dev-harness/fabric/README.md,
dev-harness/fabric/examples/README.md, and
dev-harness/fabric/examples
README.md
why tho
reverse dns and static IPs (that we get for free from aws) are location labels, not identity: they can be reassigned, changed, or cached stale, so the same ip↔hostname pair can point to a different machine over time. TLS endpoint trust is tied to hostname/cert binding, so when addresses churn, host-based verification tracks routing details instead of a durable peer identity, increasing ambiguity in who is actually at the other end.
rollout plan
notes
this is not a full network rewrite. it is a compatibility-first change to peer endpoint selection that reduces direct dependence on bare ip:port in the normal path. the beauty in using s3 for the control plane & universal façade was motivation in using DNS similarly