sortedcord/bootstrap-auth-server
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

docs: Simplified sequence diagram

Browse Source
This commit is contained in:
Aditya Gupta
2026-06-28 21:24:20 +05:30
parent 920e4d11c1
commit 6894e80a8f
1 changed files with 28 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
README.md
View File

@@ -1,8 +1,6 @@
# Bootstrap Authentication - Asymmetric Crypto (RSA) Auth & E2E Secrets
## Introduction
This project is a centralized authentication and secrets provisioning server. It is designed to allow arbitrary client machines to securely request access and retrieve sensitive environment variables or secrets during their initialization phase. It relies on strict cryptographic verification using Ed25519 asymmetric keys to ensure that only explicitly authorized clients receive secrets.
This project is a centralized authentication and secrets provisioning server for [**Bootstrap**](https://github.com/sortedcord/bootstrap) (*Not to be confused the with CSS framework*). It is designed to allow arbitrary client machines to securely request access and retrieve sensitive environment variables or secrets during their initialization phase. It relies on strict cryptographic verification using Ed25519 asymmetric keys to ensure that only explicitly authorized clients receive secrets.
By utilizing modern encryption protocols, this system provides a highly secure mechanism to bootstrap new servers, workstations, or deployment targets without ever transmitting plain text secrets over the network or storing them insecurely.
@@ -16,6 +14,33 @@ Once the device is approved, the new client must prove it actually possesses the
This strict protocol guarantees that even if the network transport is entirely compromised, the payload remains mathematically inaccessible to anyone except the exact client device that generated the initial request.
```mermaid
sequenceDiagram
autonumber
actor Admin
participant Requester as Requester Client (b me)
participant Server as Auth Server
participant Approver as Approver Client (b trust)
Requester->>Server: POST /api/register (Host, OS, Public Key)
Server-->>Requester: 200 OK (user_code, challenge_nonce)
Note over Requester: Displays user_code & begins polling...
Admin->>Approver: Exec: b trust <user_code>
Approver->>Server: GET /api/pending/<user_code>
Server-->>Approver: 200 OK (Requester Public Key)
Note over Approver: Admin confirms public key fingerprint
Approver->>Server: POST /api/approve (user_code, Admin Signature & Fingerprint)
Note over Server: Server verifies signature against admin list
Requester->>Server: POST /api/challenge/poll (user_code, Signature of Nonce)
Server-->>Requester: 200 OK (Encrypted Secrets Payload)
Note over Requester: Decrypts payload using local Ed25519 private key
```
## Installation
To compile and install the server directly from the source code, you will need the Rust toolchain installed on your system.
@@ -120,48 +145,6 @@ A JSON object containing:
A JSON object containing:
* `encrypted_secrets` (base64 encoded string containing the age encrypted payload)
## Authentication Sequence
The complete cryptographic handshake and provisioning flow is illustrated below:
```mermaid
sequenceDiagram
autonumber
participant C as New Client
participant S as Authentication Server
participant DB as SQLite Database
participant A as Administrator Device
Note over C: Generates Ed25519 Key Pair
C->>S: POST /api/register (Public Key, System Info)
S->>DB: Insert pending device record
S-->>C: Returns User Code and Challenge Nonce
Note over C, A: Out of band communication
C->>A: Displays User Code and Public Key Fingerprint
Note over A: Signs New Client Public Key
A->>S: POST /api/approve (User Code, Cryptographic Signature)
S->>DB: Validates Administrator Key
S->>S: Verifies Signature mathematically
S->>DB: Updates pending device to approved status
S-->>A: Acknowledges approval
loop Polling mechanism
Note over C: Signs Challenge Nonce
C->>S: POST /api/challenge/poll (User Code, Nonce Signature)
S->>S: Verifies Client Signature mathematically
S->>DB: Checks approval status
end
S->>DB: Retrieves AES encrypted secrets
S->>S: Decrypts secrets in memory using Master Key
S->>S: Encrypts secrets using age protocol for Client Public Key
S->>DB: Purges pending request record
S-->>C: Returns age encrypted payload
Note over C: Decrypts payload using local Private Key
```
## Credits