Struct NodeIdentity 

pub struct NodeIdentity { /* private fields */ }

Keys the node holds. Persisted as two 0600 files in the node’s own state directory.

Implementations

impl NodeIdentity

pub fn generate() -> Result<Self, EnrollError>

pub fn from_seeds(identity_seed: [u8; 32], wg_seed: [u8; 32]) -> Self

Deterministic construction for tests.

pub fn identity_public_key(&self) -> String

pub fn wg_public_key(&self) -> String

pub fn identity_path(dir: &Path) -> PathBuf

Paths of the key files inside dir.

pub fn wg_path(dir: &Path) -> PathBuf

The WireGuard private key file, in the base64 format wg and the node’s GATE4AGENT_WG_PRIVATE_KEY path expect.

pub fn load_or_create(dir: &Path) -> Result<Self, EnrollError>

Load the keys from dir, or generate and store them (directory 0700, files 0600).

pub fn load_signing_only(dir: &Path) -> Result<Self, EnrollError>

Load only the signing identity (for a node whose tunnel is set up by a privileged helper and which therefore never needs, or reads, the WireGuard private key). The returned identity carries a throwaway WireGuard secret that is never written anywhere.

pub fn sign_bytes(&self, message: &[u8]) -> String

Sign arbitrary bytes with the node identity (callers add their own domain prefix).

pub fn sign_request( &self, node_id: &str, kind: NodeKind, code: Option<&str>, now_ms: u64, ) -> Result<EnrollmentRequest, EnrollError>

Build and sign an enrollment request.

pub fn answer_challenge( &self, node_id: &str, challenge_frame: &[u8; 68], ) -> Result<([u8; 96], String), EnrollError>

Answer a call-home challenge. Returns the answer frame and the session token.