mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
115 lines
3.1 KiB
TeX
115 lines
3.1 KiB
TeX
\section{Reference Implementation}
|
|
\label{sec:impl}
|
|
%% ============================================================
|
|
|
|
\subsection{Components}
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\caption{Reference implementation components.}
|
|
\label{tab:components}
|
|
\begin{tabular}{@{}llp{6cm}@{}}
|
|
\toprule
|
|
\textbf{Component} & \textbf{Package} & \textbf{Description} \\
|
|
\midrule
|
|
Replicator & \texttt{hanzoai/replicate} & Litestream fork with age
|
|
encryption. Go binary. Ships as
|
|
\texttt{ghcr.io/hanzoai/replicate}. \\
|
|
age library & \texttt{hanzoai/age}, \texttt{luxfi/age} &
|
|
\texttt{filippo.io/age} vendored. X25519 + scrypt recipients. \\
|
|
Object storage & \texttt{hanzoai/s3} & MinIO deployment.
|
|
\texttt{ghcr.io/hanzoai/s3}. \\
|
|
Key management & \texttt{hanzoai/kms} & Secrets and key lifecycle.
|
|
HKDF derivation endpoint. \\
|
|
K8s patches & \texttt{universe/k8s/patches/} &
|
|
\texttt{replicate-sidecar.yaml},
|
|
\texttt{replicate-config.yaml},
|
|
\texttt{replicate-restore.yaml}. \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
\subsection{Replicator CLI}
|
|
|
|
The \texttt{hanzoai/replicate} binary provides two subcommands:
|
|
|
|
\begin{lstlisting}[language={},caption={Replicator CLI usage.}]
|
|
# Continuous replication (sidecar)
|
|
replicate replicate -config /etc/litestream.yml
|
|
|
|
# Restore from S3 (init container)
|
|
replicate restore -config /etc/litestream.yml -o /data/pb_data/data.db
|
|
|
|
# Verify backup integrity
|
|
replicate verify -config /etc/litestream.yml
|
|
\end{lstlisting}
|
|
|
|
\subsection{Key Derivation Implementation}
|
|
|
|
\begin{lstlisting}[language=Go,caption={Per-org age key derivation.}]
|
|
func DeriveOrgAgeIdentity(masterKey []byte, orgID string) (
|
|
*age.X25519Identity, error,
|
|
) {
|
|
// HKDF-SHA256: master -> org-scoped key material
|
|
hkdf := hkdf.New(sha256.New, masterKey,
|
|
[]byte(orgID), []byte("age-replicate-v1"))
|
|
|
|
scalar := make([]byte, 32)
|
|
if _, err := io.ReadFull(hkdf, scalar); err != nil {
|
|
return nil, fmt.Errorf("hkdf derive: %w", err)
|
|
}
|
|
|
|
identity, err := age.X25519IdentityFromScalar(scalar)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("age identity: %w", err)
|
|
}
|
|
|
|
// Zero the intermediate scalar
|
|
for i := range scalar {
|
|
scalar[i] = 0
|
|
}
|
|
|
|
return identity, nil
|
|
}
|
|
\end{lstlisting}
|
|
|
|
\subsection{Compose Configuration}
|
|
|
|
For local development, the replicator runs as a compose service:
|
|
|
|
\begin{lstlisting}[language=YAML,caption={compose.yml excerpt for replicate sidecar.}]
|
|
services:
|
|
ats:
|
|
image: ghcr.io/regulated-ats:dev
|
|
volumes:
|
|
- ats-data:/data
|
|
|
|
replicate:
|
|
image: ghcr.io/hanzoai/replicate:latest
|
|
command: ["replicate", "-config", "/etc/litestream.yml"]
|
|
volumes:
|
|
- ats-data:/data:ro
|
|
- ./litestream.yml:/etc/litestream.yml:ro
|
|
- ./age-keys:/etc/age:ro
|
|
depends_on:
|
|
ats:
|
|
condition: service_started
|
|
s3:
|
|
condition: service_healthy
|
|
|
|
s3:
|
|
image: ghcr.io/hanzoai/s3:latest
|
|
ports: ["9000:9000"]
|
|
environment:
|
|
MINIO_ROOT_USER: minioadmin
|
|
MINIO_ROOT_PASSWORD: minioadmin
|
|
volumes:
|
|
- s3-data:/data
|
|
|
|
volumes:
|
|
ats-data:
|
|
s3-data:
|
|
\end{lstlisting}
|
|
|
|
%% ============================================================
|