silentmode.st + hephaestus.x static content — HTML/CSS/JS served via nginx (VPS) and Sia bucket (backup)
b0569c92d8
Before 0.1.8, a BNS name with an on-chain `ip` record made the daemon return the origin's public IP directly. Browsers then hit the origin's own HTTPS server -- and if that origin's cert was not browser-trusted (which is the whole point of the on-chain `tls` fingerprint pin next to the `ip` record), every browser except Theseus rejected the site with ERR_CERT_AUTHORITY_INVALID or SEC_ERROR_UNKNOWN_ISSUER. game.x and hephaestus.x both hit this. Theseus was fine because its in-process resolver validates against the on-chain pin. 0.1.8 answers DNS with 127.0.0.1 whenever the name has BOTH `ip` and `tls`, terminates the browser's TLS locally with our trusted leaf, and reverse-proxies to the origin over HTTPS while validating the origin's SHA-256 fingerprint against the on-chain pin. Same algorithm Theseus uses (main.js:pinnedHttpsGet, cert.fingerprint256 lower-cased, colons stripped) so a site's `tls` record means the same thing in-Theseus and system-wide. Names with just `ip` (no pin) keep direct routing -- unchanged. Only opts in when the owner has published a fingerprint pin, so nothing regresses for sites that deliberately wanted direct IP routing. Two subtle bugs found + fixed while landing this: 1. `agent: false` on the outbound https.request. With Node's default global agent (keepAlive on), the second request onwards reuses the TLS socket and `res.socket.getPeerCertificate(false)` comes back stripped of fingerprint256 -- pin validation then reads "empty" and rejects with 526. Fresh socket per request costs a handshake but is cheap next to the pin-verify miss. 2. Removed `content-encoding` from the hop-by-hop strip list. Origin sends gzip'd bytes; my proxy streams them unchanged. If we strip content-encoding while forwarding compressed bytes, the browser treats the gzip magic as text and renders garbage. content-encoding is end-to-end per RFC 7230 -- keep it. Verified on this box: game.x, hephaestus.x, theseus.x, sirius.x, coinspectrum.x, hello.bch all load HTTPS 200 in strict IWR and Chromium; DNS answers 127.0.0.1 for game.x + hephaestus.x (was their origin IP before), still their origin IP for names without a tls pin. Deployed - dl.silentmode.st/AriadneResolver-Setup-0.1.8.exe - s3://bns/silentmode/dl/AriadneResolver-Setup-0.1.8.exe - silentmode.st manifest advertises 0.1.8 - sha256 47450ad4555beb04fe3b90ae5f658dc2932061d011ada9a2fb507471e2f0a0cb |
||
|---|---|---|
| apps | ||
| brand | ||
| choose | ||
| deviant | ||
| helios | ||
| hephaestus | ||
| hephaestus.x | ||
| hermes | ||
| js | ||
| nav | ||
| prometheus | ||
| releases | ||
| sirius | ||
| store | ||
| theseus | ||
| tlds | ||
| tools | ||
| vendor | ||
| vpn | ||
| favicon.svg | ||
| GOTCHAS.md | ||
| home-cards.json | ||
| index.html | ||
| register.html | ||
| releases-manifest.json | ||
| shared.css | ||
