eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add smooth node enrollment flow

Browse source
This commit is contained in:
Eric Wendland 2026-05-21 18:01:38 +02:00
commit 27a79768e4
12 changed files with 1662 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

23
docs/adr/0016-owner-node-enrollment.md
View file

@ -26,10 +26,24 @@ list`. Renames and revocations are additional keychain operations. Resource
permissions remain resource-scoped auth operations and can be managed with
`geth node grant` and `geth node revoke-grant`.
New nodes can request enrollment with `geth node enroll request`. The request is
signed by the requesting agent key and includes the stable node ID, agent ID,
requested node name, optional endpoint ID, and requested resource capabilities.
The request can be submitted over Iroh with `geth node enroll submit` or moved
as a JSON file and imported on the owner machine.
The owner approves with `geth node enroll approve --signing-key <key>`. Approval
records signed keychain operations for the device, node, agent binding, and
endpoint binding, plus signed auth operations for approved capabilities. The
requesting node can run `geth node enroll sync <owner-node>` to pull both signed
logs.
`geth keychain sync <node>` pulls keychain operations and signatures over Iroh
from an imported peer. The receiver imports only operations with valid OpenSSH
signatures from currently trusted admin keys over the canonical keychain
payload. Discovery and peer cards still grant no trust by themselves.
payload. `geth auth sync <node>` applies the same trusted-admin signature rule
to resource auth operations. Discovery and peer cards still grant no trust by
themselves.
## Consequences
@ -37,6 +51,7 @@ Node names are convenience labels over stable node IDs. Endpoint rotation should
add or revoke endpoint bindings without replacing the node identity.
The current sync model is a pull-based signed operation log. It is not yet a
Keyhive-style convergent authority, does not implement advanced group
cryptography, and does not yet sign/verify replicated auth operations. Those are
future roadmap items.
Keyhive-style convergent authority and does not implement advanced group
cryptography. Manual grant/revoke commands still need the same signing
requirement as enrollment approval before this becomes a complete authorization
workflow.