argus/setup/install.ps1

# BNS resolver daemon installer -- run from an ELEVATED PowerShell.
#   .\setup\install.ps1            # surgical: NRPT rule routes only .bch to the daemon
#   .\setup\install.ps1 -Mode full # universal: adapter DNS -> 127.0.0.1, daemon forwards the rest
param(
  [ValidateSet("nrpt", "full")] [string]$Mode = "nrpt",
  [string]$Upstream = "1.1.1.1",
  # Collision policy the daemon should run under (docs: START-HERE.md 4b).
  # bcnr-first (default): BCNR wins, ICANN fallback on miss.
  # icann-first         : ICANN wins, BCNR fallback on NXDOMAIN.
  # bns-first is accepted as an alias for bcnr-first.
  [ValidateSet("bcnr-first", "icann-first", "bns-first")] [string]$Policy = "bcnr-first",
  # Opt-in: turn off Firefox DNS-over-HTTPS. Only needed to resolve names that
  # ALSO exist in ICANN (a reclaimed .de) via BCNR in Firefox -- BCNR-only names
  # (all .bch, etc.) already work with DoH on, because DoH returns NXDOMAIN and
  # Firefox falls back to the local resolver. Trade-off: Firefox's other DNS then
  # goes through the system resolver instead of encrypted to Cloudflare.
  [switch]$FirefoxNoDoH,
  # Opt-in: force-close a running Firefox so it reloads the new root CA + policy
  # immediately (Firefox only reads them at startup). Off by default because it
  # discards the user's open tabs/unsaved data.
  [switch]$CloseFirefox
)
$ErrorActionPreference = "Stop"
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
    ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
  throw "Run this from an elevated (Administrator) PowerShell."
}

$root = Split-Path -Parent $PSScriptRoot
# Prefer a bundled Node runtime (distributable installer ships runtime\node.exe);
# fall back to a Node on PATH for running straight from the dev repo.
$node = Join-Path $root "runtime\node.exe"
if (-not (Test-Path $node)) {
  $onPath = Get-Command node -ErrorAction SilentlyContinue
  if (-not $onPath) { throw "No Node runtime found: expected runtime\node.exe (bundle) or node on PATH (dev repo)." }
  $node = $onPath.Source
}
$daemon = Join-Path $root "src\daemon\bnsd.js"
$stateFile = Join-Path $PSScriptRoot "install-state.json"

# Discover the set of currently activated BCNR TLDs from the on-chain root TLD
# certificate (tlds.bch) -- START-HERE.md Section 1. This drives both the CA's
# nameConstraints extension and the surgical-mode NRPT rules below, so adding a
# new TLD on-chain is picked up by simply re-running this installer (no code
# release). Falls back to the bootstrap set ([bch]) if the chain is unreachable.
Push-Location $root
$activatedJson = & $node --input-type=module -e "import('./src/lib/resolver-web.js').then(async m=>{const ws=(await import('ws')).default;try{const list=await m.fetchBcnrTlds({WebSocket:ws});console.log(JSON.stringify(list||[]))}catch(e){console.error('bnsd fetchBcnrTlds:',String(e));console.log('[]')}}).catch(e=>{console.error(String(e));console.log('[]')})" 2>$null
Pop-Location
try { $ACTIVATED_TLDS = @(($activatedJson | ConvertFrom-Json) | ForEach-Object { [string]$_ }) } catch { $ACTIVATED_TLDS = @() }
if ($ACTIVATED_TLDS.Count -eq 0) {
  Write-Host "[!] tlds.bch was unreachable -- using bootstrap set: [bch]" -ForegroundColor Yellow
  $ACTIVATED_TLDS = @("bch")
}
Write-Host "[ok] activated BCNR TLDs (from tlds.bch): $($ACTIVATED_TLDS -join ', ')"

# Generate the name-constrained local root CA now (on THIS machine; the key never
# ships) so the trust-store import below always finds a valid, constrained root
# instead of racing the daemon's first request. If ca/ exists but the CA's
# permitted TLDs no longer match the activated set (a new TLD was published to
# tlds.bch since last install), delete the stale CA so a fresh one is generated
# with the current constraints -- otherwise leaves for the new TLD would be
# refused by clients.
$caCrt = Join-Path $root "ca\root-ca.crt"
$caKey = Join-Path $root "ca\root-ca.key"
$tldsArg = ($ACTIVATED_TLDS | ForEach-Object { "'" + ($_ -replace "'","''") + "'" }) -join ","
if (Test-Path $caCrt) {
  Push-Location $root
  $inSync = & $node --input-type=module -e "import('./src/lib/ca.js').then(m=>{try{const c=m.loadOrCreateRootCA([$tldsArg]);const forge=null;/* console.error only fires on mismatch; exit 0 either way */console.log('checked')}catch(e){console.error(String(e));console.log('err')}})" 2>&1
  Pop-Location
  if ($inSync -match 'is constrained to \[.*\] but the requested TLD list is') {
    Write-Host "[ok] rotating CA to match tlds.bch"
    Remove-Item -Path $caCrt, $caKey -Force -ErrorAction SilentlyContinue
  }
}
Push-Location $root
& $node --input-type=module -e "import('./src/lib/ca.js').then(m=>m.loadOrCreateRootCA([$tldsArg])).catch(e=>{console.error(String(e));process.exit(1)})"
Pop-Location

# 0) Idempotency: clear every previous NRPT rule we own (any TLD).
Get-DnsClientNrptRule | Where-Object { $_.Comment -like 'BNS *resolver' } | ForEach-Object {
  Remove-DnsClientNrptRule -Name $_.Name -Force
}
try { Stop-ScheduledTask -TaskName "BNS Resolver Daemon" -ErrorAction Stop } catch {}
try { Stop-ScheduledTask -TaskName "BNS Sia Bridge" -ErrorAction Stop } catch {}

# 1) Scheduled task: run the daemon at boot as SYSTEM (survives logoff, binds port 53/80/443)
# Pass --policy so bnsd.js applies the chosen collision mode (docs: 4b).
$action = New-ScheduledTaskAction -Execute $node -Argument "`"$daemon`" --upstream $Upstream --policy $Policy" -WorkingDirectory $root
$trigger = New-ScheduledTaskTrigger -AtStartup
$settings = New-ScheduledTaskSettingsSet -RestartCount 5 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit (New-TimeSpan -Days 3650)
Register-ScheduledTask -TaskName "BNS Resolver Daemon" -Action $action -Trigger $trigger -Settings $settings `
  -User "SYSTEM" -RunLevel Highest -Force | Out-Null
Start-ScheduledTask -TaskName "BNS Resolver Daemon"
Write-Host "[ok] daemon installed as scheduled task 'BNS Resolver Daemon' and started"

# 1b) Sia bridge (optional): serves "s3" records from the Sia network
$s3d = Join-Path $root "tools\s3d.exe"
if (Test-Path $s3d) {
  # runs as the logged-on user (s3d's login state lives in the user's APPDATA)
  $s3dAction = New-ScheduledTaskAction -Execute $s3d -WorkingDirectory $root
  $s3dTrigger = New-ScheduledTaskTrigger -AtLogOn -User $env:USERNAME
  $s3dPrincipal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive
  Register-ScheduledTask -TaskName "BNS Sia Bridge" -Action $s3dAction -Trigger $s3dTrigger `
    -Settings $settings -Principal $s3dPrincipal -Force | Out-Null
  Start-ScheduledTask -TaskName "BNS Sia Bridge"
  Write-Host "[ok] s3d Sia bridge installed (runs at your logon) and started"
}

# 2) Route queries to it
$state = @{ mode = $Mode; adapters = @() }
if ($Mode -eq "nrpt") {
  # Surgical mode: one NRPT rule per TLD that tlds.bch has activated on-chain.
  # BCNR-native TLDs are declared there and only there; a re-install after a new
  # TLD is activated picks it up with no code release. Dual TLDs that collide
  # with ICANN are still safe to route because the daemon falls through to
  # UPSTREAM on any BCNR miss.
  foreach ($tld in $ACTIVATED_TLDS) {
    $ns = ".$tld"
    # Idempotent: clean any pre-existing rule for this namespace first.
    Get-DnsClientNrptRule | Where-Object { $_.Namespace -contains $ns -and $_.Comment -like 'BNS *' } | ForEach-Object {
      Remove-DnsClientNrptRule -Name $_.Name -Force
    }
    Add-DnsClientNrptRule -Namespace $ns -NameServers "127.0.0.1" -Comment "BNS $ns resolver"
    Write-Host "[ok] NRPT rule added: $ns -> 127.0.0.1"
  }
  Write-Host "[ok] all other DNS untouched"
} else {
  # Reinstall-safe backup: if the machine is ALREADY pointed at us (127.0.0.1) from a
  # prior install, the "current" servers are a useless restore target. Reuse the last
  # good backup if we have one, else fall back to DHCP. NEVER record loopback as the
  # original -- that's exactly what left a past uninstall pointing DNS at a dead daemon.
  $prior = @{}
  if (Test-Path $stateFile) {
    try { (Get-Content $stateFile | ConvertFrom-Json).adapters | ForEach-Object { $prior[$_.alias] = $_ } } catch {}
  }
  foreach ($if in Get-DnsClientServerAddress -AddressFamily IPv4 |
      Where-Object { $_.InterfaceAlias -notmatch "Loopback" -and $_.ServerAddresses.Count -gt 0 }) {
    $orig = @($if.ServerAddresses | Where-Object { $_ -ne '127.0.0.1' -and $_ -ne '::1' })
    if ($orig.Count -eq 0 -and $prior.ContainsKey($if.InterfaceAlias)) {
      $orig = @($prior[$if.InterfaceAlias].servers | Where-Object { $_ -and $_ -ne '127.0.0.1' -and $_ -ne '::1' })
    }
    $state.adapters += @{ alias = $if.InterfaceAlias; servers = $orig; resetToDhcp = ($orig.Count -eq 0) }
    Set-DnsClientServerAddress -InterfaceAlias $if.InterfaceAlias -ServerAddresses 127.0.0.1
    $restoreTo = if ($orig.Count) { $orig -join ', ' } else { 'DHCP (automatic)' }
    Write-Host "[ok] adapter '$($if.InterfaceAlias)' DNS -> 127.0.0.1 (restore target: $restoreTo)"
  }
}
# 3) TLS trust anchor: BNS Local Root CA into the machine store, and tell
#    Firefox (which keeps its own store) to honor Windows enterprise roots.
$caCert = Join-Path $root "ca\root-ca.crt"
if (Test-Path $caCert) {
  # Refuse to trust a root that can vouch for the whole internet. Roots generated
  # before 2026-07-26 carry no name constraints; installing one means anyone who
  # can read ca\root-ca.key can forge a trusted certificate for any domain on this
  # machine. Constrained roots are limited to the TLDs in src\lib\tlds.js.
  $ncOid = "2.5.29.30"
  $parsed = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($caCert)
  $hasConstraints = @($parsed.Extensions | Where-Object { $_.Oid.Value -eq $ncOid }).Count -gt 0
  $parsed.Dispose()
  if (-not $hasConstraints) {
    Write-Host ""
    Write-Host "[STOP] ca\root-ca.crt has NO X.509 name constraints." -ForegroundColor Red
    Write-Host "       Trusting it would let anyone who reads ca\root-ca.key forge a" -ForegroundColor Red
    Write-Host "       certificate for ANY domain on this machine, not just BNS names." -ForegroundColor Red
    Write-Host "       Rotate the CA, then re-run this installer:" -ForegroundColor Red
    Write-Host "         setup\uninstall.ps1   (removes the old root from the store)" -ForegroundColor Red
    Write-Host "         Remove-Item -Recurse $($root)\ca"
    Write-Host "         setup\install.ps1     (generates a constrained root)" -ForegroundColor Red
    Write-Host ""
    throw "refusing to install an unconstrained root CA"
  }
  $imported = Import-Certificate -FilePath $caCert -CertStoreLocation Cert:\LocalMachine\Root
  $state.caThumbprint = $imported.Thumbprint
  New-Item -Path "HKLM:\SOFTWARE\Policies\Mozilla\Firefox\Certificates" -Force | Out-Null
  Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Mozilla\Firefox\Certificates" `
    -Name "ImportEnterpriseRoots" -Value 1 -Type DWord
  # Also install our specific root into Firefox's own store (works even if the
  # user disabled enterprise-roots). Both policies are applied at Firefox startup.
  New-Item -Path "HKLM:\SOFTWARE\Policies\Mozilla\Firefox\Certificates\Install" -Force | Out-Null
  Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Mozilla\Firefox\Certificates\Install" -Name "1" -Value $caCert -Type String
  Write-Host "[ok] BNS Local Root CA trusted (machine store + Firefox enterprise-roots & install policies)"
  # Firefox only loads the enterprise-roots policy + new root at startup, so a
  # running Firefox keeps rejecting .bch until it is restarted.
  $ff = Get-Process firefox -ErrorAction SilentlyContinue
  if ($ff) {
    if ($CloseFirefox) {
      $ff | Stop-Process -Force
      Write-Host "[ok] Firefox was closed -- reopen it and .bch certificates will be trusted"
    } else {
      Write-Host "[!] Firefox is open -- fully QUIT and reopen it so it trusts .bch (or re-run with -CloseFirefox)." -ForegroundColor Yellow
    }
  }
} else {
  Write-Host "[skip] no ca\root-ca.crt found -- https for .bch not enabled"
}

# 3b) Firefox DNS-over-HTTPS. BCNR-only names (all .bch, etc.) already work in
#     Firefox with DoH ON -- DoH returns NXDOMAIN and Firefox falls back to the
#     system resolver (us). Only names that ALSO exist in ICANN (a reclaimed .de)
#     lose to the real record. Turning DoH off fixes those but sends Firefox's
#     other DNS through the system resolver instead of encrypted to Cloudflare --
#     so it's opt-in (-FirefoxNoDoH) and left unlocked so the user can re-enable.
if ($FirefoxNoDoH) {
  New-Item -Path "HKLM:\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS" -Force | Out-Null
  Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS" -Name "Enabled" -Value 0 -Type DWord
  Write-Host "[ok] Firefox DNS-over-HTTPS disabled (opt-in) -- ICANN-conflicting names now resolve via BCNR in Firefox too"
} else {
  Write-Host "[info] Firefox DoH left on (BCNR-only names work anyway). To also reclaim names that exist in ICANN, re-run with -FirefoxNoDoH"
}

$state | ConvertTo-Json -Depth 5 | Set-Content $stateFile
Clear-DnsClientCache
Write-Host "[done] try:  https://hello.bch   (uninstall: .\setup\uninstall.ps1)"