+2

.gitignore

··· 1 1 + # PLC 2 2 + /plc/did-method-plc

+24 -1

README.md

··· 1 1 # localdev 2 2 3 3 - Code and configuration to create a local development environment. 3 3 + Code and configuration to create a network-local development environment. It uses tailscale and can be used to have shared isolated infrastructure that can be used to support individuals and teams. 4 4 + 5 5 + ## Configuration 6 6 + 7 7 + 8 8 + ## Operation 9 9 + 10 10 + 1. Configure and start the PLC service. See plc/README.md 11 11 + 12 12 + 2. Configure and start the PDS service. See pds/README.md 13 13 + 14 14 + 3. Configure and start the DNS service. See dns/README.md 15 15 + 16 16 + 4. Configure split-DNS in Tailscale. 17 17 + 18 18 + 1. Visit https://tailscale.com/ 19 19 + 2. Go to the Machines tab and get the internal IP address of `didadmin` 20 20 + 2. Go to the DNS configuration page 21 21 + 3. Add a nameserver and select "Custom" 22 22 + 4. Enter the IP address of the `didadmin`, select "Restrict to domain (Split DNS)", and set the domain to "pyroclastic.cloud" 23 23 + 24 24 + ## Maintenance 25 25 + 26 26 + Tailscale SSL certificates need to be periodically regenerated. Run the respective `docker compose exec tailscale /bin/sh -c "tailscale cert ..."` command to generate new certs and restart (stop and start) the nginx proxy for it to use the new cert.

+14

dns/Corefile.example

··· 1 1 + . { 2 2 + log 3 3 + errors 4 4 + 5 5 + reload 10s 6 6 + 7 7 + records pyroclastic.cloud { 8 8 + @ 60 IN TXT "TEST" 9 9 + _atproto.test1734305850 60 IN TXT "did=did:plc:p75ngbyvabgetgoy52aswele" 10 10 + _atproto.test1734440080 60 IN TXT "did=did:plc:k5d6h7nlhbh5tuxrlxczgal3" 11 11 + _atproto.test1734440644 60 IN TXT "did=did:plc:x45wmz7vktj2aqcqwj7yakxs" 12 12 + } 13 13 + 14 14 + }

+50

dns/README.md

··· 1 1 + # DNS 2 2 + 3 3 + The DNS component does several things: 4 4 + 5 5 + 1. It uses CoreDNS as a split-DNS nameserver for resolving local handles. 6 6 + 2. It provides a small HTTP application for generating new handles for testing purposes. 7 7 + 8 8 + ## Configuration 9 9 + 10 10 + This service makes API calls to the local PDS and also exists on a tailscale network. Please make note of any `PLACEHOLDER` and `OPTIONAL` strings in the following files: 11 11 + 12 12 + In `./docker-compose.yml`: 13 13 + 14 14 + * Set the `PDS_ADMIN_PASSWORD` environment variable to your PDS admin password. 15 15 + * Set the `PDS_HOSTNAME` to the internal hostname of your PDS. (i.e. `pds.sneaky-fox.ts.net`) 16 16 + * Optionally, if you are not using the `pyroclastic.cloud` domain (it's fine to leave this as-is) then change that. 17 17 + 18 18 + ## Operation 19 19 + 20 20 + 1. First, build the `didadmin` tool. 21 21 + 22 22 + `docker build -f ./didadmin/Dockerfile -t didadmin ./didadmin/` 23 23 + 24 24 + 3. Bring networking up. 25 25 + 26 26 + `docekr compose up tailscale -d` 27 27 + 28 28 + If you are using dynamic node registration, you'll need to view the logs and click on the link. 29 29 + 30 30 + `docker compose logs tailscale` 31 31 + 32 32 + 4. Generate an SSL certificate for the node. Be sure to change `internal.ts.net` to whatever your Tailnet name is (i.e. `sneaky-fox.ts.net`) 33 33 + 34 34 + `docker compose exec tailscale /bin/sh -c "tailscale cert --cert-file /mnt/tls/cert.pem --key-file /mnt/tls/cert.key didadmin.internal.ts.net"` 35 35 + 36 36 + 5. Bring didadmin up. 37 37 + 38 38 + `docekr compose up app -d` 39 39 + 40 40 + When this first starts, it'll create the `/etc/coredns/database.db` and `/etc/coredns/Corefile` files inside the container. 41 41 + 42 42 + 6. Bring coredns and the proxy up. 43 43 + 44 44 + `docker compose up -d` 45 45 + 46 46 + 7. Ensure the PLC and PDS services are running, and split-DNS is configured before using. 47 47 + 48 48 + ## Usage 49 49 + 50 50 + In a browser, visit https://didadmin.sneaky-fox.ts.net/ and use the form to create accounts on the local PDS.

+15

dns/didadmin/Dockerfile

··· 1 1 + FROM golang:alpine3.21 AS build 2 2 + ENV CGO_ENABLED=1 3 3 + RUN apk add --no-cache gcc musl-dev 4 4 + WORKDIR /workspace 5 5 + COPY go.mod /workspace/ 6 6 + COPY go.sum /workspace/ 7 7 + RUN go mod download 8 8 + COPY main.go /workspace/ 9 9 + ENV GOCACHE=/root/.cache/go-build 10 10 + RUN --mount=type=cache,target="/root/.cache/go-build" go install -ldflags='-s -w -extldflags "-static"' ./main.go 11 11 + 12 12 + FROM scratch 13 13 + COPY --from=build /go/bin/main /usr/local/bin/didadmin 14 14 + COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ 15 15 + ENTRYPOINT [ "/usr/local/bin/didadmin" ]

+27

dns/didadmin/go.mod

··· 1 1 + module github.com/astrenoxcoop/magicdev-admin 2 2 + 3 3 + go 1.23.5 4 4 + 5 5 + require ( 6 6 + github.com/coreos/go-semver v0.3.0 // indirect 7 7 + github.com/coreos/go-systemd/v22 v22.3.2 // indirect 8 8 + github.com/dustinkirkland/golang-petname v0.0.0-20240428194347-eebcea082ee0 // indirect 9 9 + github.com/gogo/protobuf v1.3.2 // indirect 10 10 + github.com/golang/protobuf v1.5.4 // indirect 11 11 + github.com/mattn/go-sqlite3 v1.14.24 // indirect 12 12 + github.com/sethvargo/go-envconfig v1.1.0 // indirect 13 13 + go.etcd.io/etcd/api/v3 v3.5.17 // indirect 14 14 + go.etcd.io/etcd/client/pkg/v3 v3.5.17 // indirect 15 15 + go.etcd.io/etcd/client/v3 v3.5.17 // indirect 16 16 + go.uber.org/atomic v1.7.0 // indirect 17 17 + go.uber.org/multierr v1.6.0 // indirect 18 18 + go.uber.org/zap v1.17.0 // indirect 19 19 + golang.org/x/net v0.23.0 // indirect 20 20 + golang.org/x/sys v0.18.0 // indirect 21 21 + golang.org/x/text v0.14.0 // indirect 22 22 + google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d // indirect 23 23 + google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d // indirect 24 24 + google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect 25 25 + google.golang.org/grpc v1.59.0 // indirect 26 26 + google.golang.org/protobuf v1.33.0 // indirect 27 27 + )

+83

dns/didadmin/go.sum

··· 1 1 + github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM= 2 2 + github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk= 3 3 + github.com/coreos/go-systemd/v22 v22.3.2 h1:D9/bQk5vlXQFZ6Kwuu6zaiXJ9oTPe68++AzAJc1DzSI= 4 4 + github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= 5 5 + github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= 6 6 + github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= 7 7 + github.com/dustinkirkland/golang-petname v0.0.0-20240428194347-eebcea082ee0 h1:aYo8nnk3ojoQkP5iErif5Xxv0Mo0Ga/FR5+ffl/7+Nk= 8 8 + github.com/dustinkirkland/golang-petname v0.0.0-20240428194347-eebcea082ee0/go.mod h1:8AuBTZBRSFqEYBPYULd+NN474/zZBLP+6WeT5S9xlAc= 9 9 + github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= 10 10 + github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= 11 11 + github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= 12 12 + github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= 13 13 + github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= 14 14 + github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= 15 15 + github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= 16 16 + github.com/mattn/go-sqlite3 v1.14.24 h1:tpSp2G2KyMnnQu99ngJ47EIkWVmliIizyZBfPrBWDRM= 17 17 + github.com/mattn/go-sqlite3 v1.14.24/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y= 18 18 + github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= 19 19 + github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= 20 20 + github.com/sethvargo/go-envconfig v1.1.0 h1:cWZiJxeTm7AlCvzGXrEXaSTCNgip5oJepekh/BOQuog= 21 21 + github.com/sethvargo/go-envconfig v1.1.0/go.mod h1:JLd0KFWQYzyENqnEPWWZ49i4vzZo/6nRidxI8YvGiHw= 22 22 + github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= 23 23 + github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= 24 24 + github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= 25 25 + github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= 26 26 + github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= 27 27 + go.etcd.io/etcd/api/v3 v3.5.17 h1:cQB8eb8bxwuxOilBpMJAEo8fAONyrdXTHUNcMd8yT1w= 28 28 + go.etcd.io/etcd/api/v3 v3.5.17/go.mod h1:d1hvkRuXkts6PmaYk2Vrgqbv7H4ADfAKhyJqHNLJCB4= 29 29 + go.etcd.io/etcd/client/pkg/v3 v3.5.17 h1:XxnDXAWq2pnxqx76ljWwiQ9jylbpC4rvkAeRVOUKKVw= 30 30 + go.etcd.io/etcd/client/pkg/v3 v3.5.17/go.mod h1:4DqK1TKacp/86nJk4FLQqo6Mn2vvQFBmruW3pP14H/w= 31 31 + go.etcd.io/etcd/client/v3 v3.5.17 h1:o48sINNeWz5+pjy/Z0+HKpj/xSnBkuVhVvXkjEXbqZY= 32 32 + go.etcd.io/etcd/client/v3 v3.5.17/go.mod h1:j2d4eXTHWkT2ClBgnnEPm/Wuu7jsqku41v9DZ3OtjQo= 33 33 + go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw= 34 34 + go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= 35 35 + go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4= 36 36 + go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU= 37 37 + go.uber.org/zap v1.17.0 h1:MTjgFu6ZLKvY6Pvaqk97GlxNBuMpV4Hy/3P6tRGlI2U= 38 38 + go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo= 39 39 + golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= 40 40 + golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= 41 41 + golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= 42 42 + golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= 43 43 + golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= 44 44 + golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= 45 45 + golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= 46 46 + golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= 47 47 + golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= 48 48 + golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs= 49 49 + golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= 50 50 + golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= 51 51 + golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= 52 52 + golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= 53 53 + golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= 54 54 + golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= 55 55 + golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= 56 56 + golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4= 57 57 + golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= 58 58 + golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= 59 59 + golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= 60 60 + golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ= 61 61 + golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= 62 62 + golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= 63 63 + golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= 64 64 + golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= 65 65 + golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= 66 66 + golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= 67 67 + golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= 68 68 + golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= 69 69 + golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= 70 70 + google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d h1:VBu5YqKPv6XiJ199exd8Br+Aetz+o08F+PLMnwJQHAY= 71 71 + google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d/go.mod h1:yZTlhN0tQnXo3h00fuXNCxJdLdIdnVFVBaRJ5LWBbw4= 72 72 + google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d h1:DoPTO70H+bcDXcd39vOqb2viZxgqeBeSGtZ55yZU4/Q= 73 73 + google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d/go.mod h1:KjSP20unUpOx5kyQUFa7k4OJg0qeJ7DEZflGDu2p6Bk= 74 74 + google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d h1:uvYuEyMHKNt+lT4K3bN6fGswmK8qSvcreM3BwjDh+y4= 75 75 + google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M= 76 76 + google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk= 77 77 + google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98= 78 78 + google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI= 79 79 + google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos= 80 80 + gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= 81 81 + gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= 82 82 + gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= 83 83 + gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

+265

dns/didadmin/main.go

··· 1 1 + package main 2 2 + 3 3 + import ( 4 4 + "bytes" 5 5 + "context" 6 6 + "database/sql" 7 7 + "encoding/base64" 8 8 + "encoding/json" 9 9 + "errors" 10 10 + "fmt" 11 11 + "io" 12 12 + "log" 13 13 + "net/http" 14 14 + "os" 15 15 + "text/template" 16 16 + 17 17 + petname "github.com/dustinkirkland/golang-petname" 18 18 + _ "github.com/mattn/go-sqlite3" 19 19 + "github.com/sethvargo/go-envconfig" 20 20 + ) 21 21 + 22 22 + type ServerConfig struct { 23 23 + Database string `env:"DATABASE, default=./database.db"` 24 24 + PDSHostName string `env:"PDS_HOSTNAME, default=pds.internal.ts.net"` 25 25 + PDSAdminPassword string `env:"PDS_ADMIN_PASSWORD, required"` 26 26 + Domain string `env:"DOMAIN, default=pyroclastic.cloud"` 27 27 + Corefile string `env:"COREFILE, default=./Corefile"` 28 28 + } 29 29 + 30 30 + type createInviteResponse struct { 31 31 + Code string `json:"code"` 32 32 + } 33 33 + 34 34 + type createAccountRequest struct { 35 35 + Email string `json:"email"` 36 36 + Handle string `json:"handle"` 37 37 + Password string `json:"password"` 38 38 + InviteCode string `json:"inviteCode"` 39 39 + } 40 40 + 41 41 + type createAccountResponse struct { 42 42 + DID string `json:"did"` 43 43 + } 44 44 + 45 45 + func createInvite(server, password string) (string, error) { 46 46 + url := fmt.Sprintf("https://%s/xrpc/com.atproto.server.createInviteCode", server) 47 47 + 48 48 + requestBody := []byte(`{"useCount":1}`) 49 49 + req, err := http.NewRequest("POST", url, bytes.NewBuffer(requestBody)) 50 50 + if err != nil { 51 51 + return "", err 52 52 + } 53 53 + req.Header.Set("Content-Type", "application/json") 54 54 + req.Header.Add("Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte("admin:"+password))) 55 55 + 56 56 + client := &http.Client{} 57 57 + resp, err := client.Do(req) 58 58 + if err != nil { 59 59 + return "", err 60 60 + } 61 61 + 62 62 + decoder := json.NewDecoder(resp.Body) 63 63 + var createInvite createInviteResponse 64 64 + err = decoder.Decode(&createInvite) 65 65 + if err != nil { 66 66 + return "", err 67 67 + } 68 68 + 69 69 + return createInvite.Code, nil 70 70 + } 71 71 + 72 72 + func createAccount(server, password, inviteCode, handle, email string) (string, error) { 73 73 + url := fmt.Sprintf("https://%s/xrpc/com.atproto.server.createAccount", server) 74 74 + 75 75 + createAccountRequestBody := createAccountRequest{ 76 76 + Email: email, 77 77 + Handle: handle, 78 78 + Password: "password", 79 79 + InviteCode: inviteCode, 80 80 + } 81 81 + requestBody, err := json.Marshal(createAccountRequestBody) 82 82 + if err != nil { 83 83 + return "", err 84 84 + } 85 85 + 86 86 + req, err := http.NewRequest("POST", url, bytes.NewBuffer(requestBody)) 87 87 + if err != nil { 88 88 + return "", err 89 89 + } 90 90 + req.Header.Set("Content-Type", "application/json") 91 91 + req.Header.Add("Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte("admin:"+password))) 92 92 + 93 93 + client := &http.Client{} 94 94 + resp, err := client.Do(req) 95 95 + if err != nil { 96 96 + return "", err 97 97 + } 98 98 + 99 99 + decoder := json.NewDecoder(resp.Body) 100 100 + var createdAccount createAccountResponse 101 101 + err = decoder.Decode(&createdAccount) 102 102 + if err != nil { 103 103 + return "", err 104 104 + } 105 105 + 106 106 + return createdAccount.DID, nil 107 107 + } 108 108 + 109 109 + type handlers struct { 110 110 + config *ServerConfig 111 111 + db *sql.DB 112 112 + } 113 113 + 114 114 + func (h *handlers) indexHandler(w http.ResponseWriter, r *http.Request) { 115 115 + handle := r.PostFormValue("handle") 116 116 + 117 117 + if handle == "" { 118 118 + handle = petname.Generate(2, "-") 119 119 + body := fmt.Sprintf(`<html><body><form method="post" action="/"><input type="text" name="handle" value="%s" /><input type="submit" /></form></body></html>`, handle) 120 120 + io.WriteString(w, body) 121 121 + return 122 122 + } 123 123 + 124 124 + inviteCode, err := createInvite(h.config.PDSHostName, h.config.PDSAdminPassword) 125 125 + if err != nil { 126 126 + io.WriteString(w, fmt.Sprintf("Error: %s", err)) 127 127 + return 128 128 + } 129 129 + 130 130 + email := fmt.Sprintf("%s@%s", handle, h.config.Domain) 131 131 + full_handle := fmt.Sprintf("%s.%s", handle, h.config.Domain) 132 132 + 133 133 + did, err := createAccount(h.config.PDSHostName, h.config.PDSAdminPassword, inviteCode, full_handle, email) 134 134 + if err != nil { 135 135 + io.WriteString(w, fmt.Sprintf("Error: %s", err)) 136 136 + return 137 137 + } 138 138 + 139 139 + _, err = h.db.Exec(`INSERT INTO handles (did, handle) VALUES (?, ?)`, &did, &handle) 140 140 + if err != nil { 141 141 + io.WriteString(w, fmt.Sprintf("Error: %s", err)) 142 142 + return 143 143 + } 144 144 + 145 145 + if err = generateCorefile(h.config, h.db); err != nil { 146 146 + io.WriteString(w, fmt.Sprintf("Error: %s", err)) 147 147 + return 148 148 + } 149 149 + 150 150 + body := fmt.Sprintf(`<html><body><p>Created <span>%s</span> with handle <span>%s</span></p><p><a href="/">Back</a></body></html>`, did, full_handle) 151 151 + 152 152 + io.WriteString(w, body) 153 153 + } 154 154 + 155 155 + func (h *handlers) newHandler(w http.ResponseWriter, r *http.Request) { 156 156 + handle := r.PostFormValue("handle") 157 157 + if handle == "" { 158 158 + handle = "testy" 159 159 + } 160 160 + 161 161 + io.WriteString(w, fmt.Sprintf("Hello, %s!\n", handle)) 162 162 + } 163 163 + 164 164 + func generateCorefile(config *ServerConfig, db *sql.DB) error { 165 165 + corefileTemplate := ` 166 166 + . { 167 167 + log 168 168 + errors 169 169 + reload 10s 170 170 + records {{ .Domain }} { 171 171 + @ 60 IN TXT "TEST" 172 172 + {{ range .Records }} 173 173 + _atproto.{{ .Handle }} 60 IN TXT "did={{ .DID }}"{{ end }} 174 174 + } 175 175 + }` 176 176 + 177 177 + corefile, err := template.New("corefile").Parse(corefileTemplate) 178 178 + if err != nil { 179 179 + log.Fatal(err) 180 180 + } 181 181 + 182 182 + type corefileValueRecord struct { 183 183 + DID string 184 184 + Handle string 185 185 + } 186 186 + type corefileValues struct { 187 187 + Domain string 188 188 + Records []corefileValueRecord 189 189 + } 190 190 + 191 191 + records := make([]corefileValueRecord, 0) 192 192 + 193 193 + rows, err := db.Query("SELECT handle, did FROM handles") 194 194 + if err != nil { 195 195 + return err 196 196 + } 197 197 + defer rows.Close() 198 198 + 199 199 + for rows.Next() { 200 200 + var handle string 201 201 + var did string 202 202 + err = rows.Scan(&handle, &did) 203 203 + if err != nil { 204 204 + return err 205 205 + } 206 206 + records = append(records, corefileValueRecord{did, handle}) 207 207 + } 208 208 + err = rows.Err() 209 209 + if err != nil { 210 210 + return err 211 211 + } 212 212 + data := corefileValues{ 213 213 + Domain: config.Domain, 214 214 + Records: records, 215 215 + } 216 216 + 217 217 + output, err := os.Create(config.Corefile) 218 218 + if err != nil { 219 219 + return err 220 220 + } 221 221 + defer output.Close() 222 222 + 223 223 + err = corefile.Execute(output, data) 224 224 + if err != nil { 225 225 + log.Fatal(err) 226 226 + } 227 227 + return nil 228 228 + } 229 229 + 230 230 + func main() { 231 231 + ctx := context.Background() 232 232 + 233 233 + var config ServerConfig 234 234 + if err := envconfig.Process(ctx, &config); err != nil { 235 235 + log.Fatal(err) 236 236 + } 237 237 + 238 238 + db, err := sql.Open("sqlite3", config.Database) 239 239 + if err != nil { 240 240 + log.Fatal(err) 241 241 + } 242 242 + defer db.Close() 243 243 + 244 244 + _, err = db.Exec(`CREATE TABLE IF NOT EXISTS handles (did TEXT NOT NULL PRIMARY KEY, handle TEXT NOT NULL UNIQUE)`) 245 245 + if err != nil { 246 246 + log.Fatal(err) 247 247 + } 248 248 + 249 249 + h := handlers{ 250 250 + config: &config, 251 251 + db: db, 252 252 + } 253 253 + 254 254 + if err = generateCorefile(h.config, h.db); err != nil { 255 255 + log.Fatal(err) 256 256 + } 257 257 + 258 258 + mux := http.NewServeMux() 259 259 + mux.HandleFunc("/", h.indexHandler) 260 260 + mux.HandleFunc("/new", h.newHandler) 261 261 + if err = http.ListenAndServe(":3333", mux); !errors.Is(err, http.ErrServerClosed) { 262 262 + log.Fatal(err) 263 263 + } 264 264 + 265 265 + }

+43

dns/docker-compose.yml

··· 1 1 + version: '3.8' 2 2 + volumes: 3 3 + dns_db: 4 4 + dns_ts: 5 5 + dns_tls: 6 6 + dns_coredns: 7 7 + services: 8 8 + coredns: 9 9 + image: coredns 10 10 + network_mode: service:tailscale 11 11 + restart: on-failure 12 12 + volumes: 13 13 + - dns_coredns:/etc/coredns/ 14 14 + entrypoint: /coredns 15 15 + command: -conf /etc/coredns/Corefile 16 16 + app: 17 17 + image: "didadmin" 18 18 + restart: unless-stopped 19 19 + environment: 20 20 + - PDS_ADMIN_PASSWORD=PLACEHOLDER 21 21 + - DATABASE=/etc/coredns/database.db 22 22 + - PDS_HOSTNAME=PLACEHOLDER pds.internal.ts.net 23 23 + - DOMAIN=pyroclastic.cloud 24 24 + - COREFILE=/etc/coredns/Corefile 25 25 + volumes: 26 26 + - dns_coredns:/etc/coredns/ 27 27 + tailscale: 28 28 + image: tailscale/tailscale:latest 29 29 + restart: unless-stopped 30 30 + environment: 31 31 + # OPTIONAL - TS_AUTHKEY=YOUR-TS-KEY-GOES-HERE 32 32 + - TS_STATE_DIR=/var/run/tailscale 33 33 + - TS_HOSTNAME=didadmin 34 34 + volumes: 35 35 + - dns_tls:/mnt/tls 36 36 + - dns_ts:/var/run/tailscale 37 37 + nginx: 38 38 + image: nginx 39 39 + restart: unless-stopped 40 40 + network_mode: service:tailscale 41 41 + volumes: 42 42 + - ./nginx.conf:/etc/nginx/nginx.conf 43 43 + - dns_tls:/mnt/tls:ro

+17

dns/nginx.conf

··· 1 1 + events {} 2 2 + http { 3 3 + server { 4 4 + resolver 127.0.0.11 [::1]:5353 valid=15s; 5 5 + set $backend "http://app:3333"; 6 6 + listen 443 ssl; 7 7 + ssl_certificate /mnt/tls/cert.pem; 8 8 + ssl_certificate_key /mnt/tls/cert.key; 9 9 + location / { 10 10 + proxy_pass $backend; 11 11 + proxy_set_header Host $host; 12 12 + proxy_set_header X-Real-IP $remote_addr; 13 13 + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 14 14 + client_max_body_size 64M; 15 15 + } 16 16 + } 17 17 + }

+41

pds/README.md

··· 1 1 + # PDS 2 2 + 3 3 + ## Configuration 4 4 + 5 5 + This is a fully operational PDS and needs appropriate configuration. If you decide to run multiple PDS instances for testing, be sure to configure each one individually. 6 6 + 7 7 + Copy the `env.example` file to `env` and update the following entry "PLACEHOLDER" values. 8 8 + 9 9 + * `PDS_JWT_SECRET` value set with `openssl rand --hex 16` 10 10 + * `PDS_ADMIN_PASSWORD` value set with `openssl rand --hex 16` 11 11 + * `PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX` value set with `openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32` 12 12 + * `PDS_HOSTNAME` value updated to relflect your internal tailnet 13 13 + * `PDS_ADMIN_EMAIL` value updated to relflect your internal tailnet 14 14 + * `PDS_DID_PLC_URL` value updated to relflect your internal tailnet 15 15 + * Optionally, if you are not using the `pyroclastic.cloud` domain (it's fine to leave this as-is) then change that. 16 16 + 17 17 + ## Operation 18 18 + 19 19 + 1. Create the configuration file and update it accordingly. 20 20 + 21 21 + 2. Bring networking up. 22 22 + 23 23 + `docekr compose up tailscale -d` 24 24 + 25 25 + If you are using dynamic node registration, you'll need to view the logs and click on the link. 26 26 + 27 27 + `docker compose logs tailscale` 28 28 + 29 29 + 3. Generate an SSL certificate for the node. Be sure to change `internal.ts.net` to whatever your Tailnet name is (i.e. `sneaky-fox.ts.net`) 30 30 + 31 31 + `docker compose exec tailscale /bin/sh -c "tailscale cert --cert-file /mnt/tls/cert.pem --key-file /mnt/tls/cert.key pds.internal.ts.net"` 32 32 + 33 33 + 4. Bring the app and proxy up. 34 34 + 35 35 + `docker compose up -d` 36 36 + 37 37 + ## Usage 38 38 + 39 39 + The PDS will be available at https://pds.internal.ts.net/. 40 40 + 41 41 + The maildev service will be available at http://pds.internal.ts.net:1080/.

+32

pds/docker-compose.yml

··· 1 1 + version: '3.8' 2 2 + volumes: 3 3 + pds_data: 4 4 + pds_ts: 5 5 + pds_tls: 6 6 + services: 7 7 + maildev: 8 8 + image: maildev/maildev 9 9 + restart: unless-stopped 10 10 + app: 11 11 + image: ghcr.io/bluesky-social/pds:0.4 12 12 + restart: unless-stopped 13 13 + env_file: "env" 14 14 + volumes: 15 15 + - pds_data:/pds 16 16 + tailscale: 17 17 + image: tailscale/tailscale:latest 18 18 + restart: unless-stopped 19 19 + environment: 20 20 + # OPTIONAL - TS_AUTHKEY=YOUR-TS-KEY-GOES-HERE 21 21 + - TS_STATE_DIR=/var/run/tailscale 22 22 + - TS_HOSTNAME=pds 23 23 + volumes: 24 24 + - pds_tls:/mnt/tls 25 25 + - pds_ts:/var/run/tailscale 26 26 + nginx: 27 27 + image: nginx 28 28 + restart: unless-stopped 29 29 + network_mode: service:tailscale 30 30 + volumes: 31 31 + - ./nginx.conf:/etc/nginx/nginx.conf 32 32 + - pds_tls:/mnt/tls:ro

+20

pds/env.example

··· 1 1 + PDS_SERVICE_HANDLE_DOMAINS=.pyroclastic.cloud 2 2 + PDS_HOSTNAME=pds.internal.ts.net 3 3 + PDS_JWT_SECRET=PLACEHOLDER 4 4 + PDS_ADMIN_PASSWORD=PLACEHOLDER 5 5 + PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=PLACEHOLDER 6 6 + PDS_ADMIN_EMAIL=admin@plc.internal.ts.net 7 7 + PDS_DATA_DIRECTORY=/pds 8 8 + PDS_BLOBSTORE_DISK_LOCATION=/pds/blobs 9 9 + LOG_ENABLED=true 10 10 + PDS_DID_PLC_URL=https://plc.internal.ts.net 11 11 + PDS_BSKY_APP_VIEW_DID=did:web:api.bsky.app 12 12 + PDS_REPORT_SERVICE_DID=did:plc:ar7c4by46qjdydhdevvrndac 13 13 + PDS_EMAIL_FROM_ADDRESS=postmaster@localhost 14 14 + PDS_EMAIL_SMTP_URL=smtp://maildev:1025 15 15 + PDS_ACCEPTING_REPO_IMPORTS=true 16 16 + PDS_DEV_MODE=TRUE 17 17 + DEBUG_MODE=TRUE 18 18 + LOG_LEVEL=trace 19 19 + PDS_PORT=3001 20 20 + PDS_BLOB_UPLOAD_LIMIT=52428800

+17

pds/nginx.conf

··· 1 1 + events {} 2 2 + http { 3 3 + server { 4 4 + resolver 127.0.0.11 [::1]:5353 valid=15s; 5 5 + set $backend "http://app:3001"; 6 6 + listen 443 ssl; 7 7 + ssl_certificate /mnt/tls/cert.pem; 8 8 + ssl_certificate_key /mnt/tls/cert.key; 9 9 + location / { 10 10 + proxy_pass $backend; 11 11 + proxy_set_header Host $host; 12 12 + proxy_set_header X-Real-IP $remote_addr; 13 13 + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 14 14 + client_max_body_size 64M; 15 15 + } 16 16 + } 17 17 + }

+31

plc/README.md

··· 1 1 + # PLC 2 2 + 3 3 + To start a PLC server, you must build a container from the PLC repository. 4 4 + 5 5 + 1. First, clone https://github.com/did-method-plc/did-method-plc 6 6 + 7 7 + `git clone https://github.com/did-method-plc/did-method-plc` 8 8 + 9 9 + 2. Build the container 10 10 + 11 11 + `docker build -f ./did-method-plc/packages/server/Dockerfile -t plcjs ./did-method-plc/` 12 12 + 13 13 + 3. Bring networking up. 14 14 + 15 15 + `docekr compose up tailscale -d` 16 16 + 17 17 + If you are using dynamic node registration, you'll need to view the logs and click on the link. 18 18 + 19 19 + `docker compose logs tailscale` 20 20 + 21 21 + 4. Generate an SSL certificate for the node. Be sure to change `internal.ts.net` to whatever your Tailnet name is (i.e. `sneaky-fox.ts.net`) 22 22 + 23 23 + `docker compose exec tailscale /bin/sh -c "tailscale cert --cert-file /mnt/tls/cert.pem --key-file /mnt/tls/cert.key plc.internal.ts.net"` 24 24 + 25 25 + 5. Bring the database up. 26 26 + 27 27 + `docekr compose up db -d` 28 28 + 29 29 + 6. Bring the app and proxy up. 30 30 + 31 31 + `docker compose up -d`

+55

plc/docker-compose.yml

··· 1 1 + version: '3.8' 2 2 + volumes: 3 3 + plc_db: 4 4 + plc_ts: 5 5 + plc_tls: 6 6 + services: 7 7 + db: 8 8 + image: postgres:14.4-alpine 9 9 + restart: unless-stopped 10 10 + environment: 11 11 + - POSTGRES_USER=pg 12 12 + - POSTGRES_PASSWORD=password 13 13 + healthcheck: 14 14 + test: 'pg_isready -U pg' 15 15 + interval: 500ms 16 16 + timeout: 10s 17 17 + retries: 20 18 18 + volumes: 19 19 + - plc_db:/var/lib/postgresql/data 20 20 + - ./init.sql:/docker-entrypoint-initdb.d/init.sql 21 21 + app: 22 22 + depends_on: 23 23 + db: 24 24 + condition: service_healthy 25 25 + restart: true 26 26 + image: plcjs 27 27 + restart: unless-stopped 28 28 + environment: 29 29 + - DATABASE_URL=postgres://pg:password@db/plc 30 30 + - DEBUG_MODE=1 31 31 + - LOG_ENABLED=true 32 32 + - LOG_LEVEL=debug 33 33 + - DB_CREDS_JSON={"username":"pg","password":"password","host":"db","port":"5432","database":"plc"} 34 34 + - DB_MIGRATE_CREDS_JSON={"username":"pg","password":"password","host":"db","port":"5432","database":"plc"} 35 35 + - ENABLE_MIGRATIONS=true 36 36 + - LOG_DESTINATION=1 37 37 + ports: 38 38 + - '3000:3000' 39 39 + tailscale: 40 40 + image: tailscale/tailscale:latest 41 41 + restart: unless-stopped 42 42 + environment: 43 43 + # OPTIONAL - TS_AUTHKEY=YOUR-TS-KEY-GOES-HERE 44 44 + - TS_STATE_DIR=/var/run/tailscale 45 45 + - TS_HOSTNAME=plc 46 46 + volumes: 47 47 + - plc_tls:/mnt/tls 48 48 + - plc_ts:/var/run/tailscale 49 49 + nginx: 50 50 + image: nginx 51 51 + restart: unless-stopped 52 52 + network_mode: service:tailscale 53 53 + volumes: 54 54 + - ./nginx.conf:/etc/nginx/nginx.conf 55 55 + - plc_tls:/mnt/tls:ro

+3

plc/init.sql

··· 1 1 + -- plc 2 2 + CREATE DATABASE plc; 3 3 + GRANT ALL PRIVILEGES ON DATABASE plc TO pg;

+17

plc/nginx.conf

··· 1 1 + events {} 2 2 + http { 3 3 + server { 4 4 + resolver 127.0.0.11 [::1]:5353 valid=15s; 5 5 + set $backend "http://app:3000"; 6 6 + listen 443 ssl; 7 7 + ssl_certificate /mnt/tls/cert.pem; 8 8 + ssl_certificate_key /mnt/tls/cert.key; 9 9 + location / { 10 10 + proxy_pass $backend; 11 11 + proxy_set_header Host $host; 12 12 + proxy_set_header X-Real-IP $remote_addr; 13 13 + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 14 14 + client_max_body_size 64M; 15 15 + } 16 16 + } 17 17 + }