rnsfips: a native bridge between Reticulum and FIPS

I've been building a bridge between two self-sovereign mesh networks: Reticulum (markqvist/reticulum) and FIPS (jmcorgan/fips). Both do end-to-end encryption, identity-as-address and run over anything, but they sit at opposite ends of the design space: Reticulum is built for LoRa and other tiny links, FIPS for an IPv6 overlay with a spanning tree and bloom-filter routing. They complement each other well.

rnsfips works in both directions:

• Reticulum over FIPS: a Reticulum interface that carries RNS frames over FIPS native-API flows. Two Reticulum sites anywhere on the FIPS mesh become one network, with full link MTU across the hop.
• FIPS over Reticulum: a small daemon that tunnels FIPS wire frames over a Reticulum link and hands them to the local FIPS daemon as a loopback UDP peer. A FIPS node whose only route out is Reticulum still joins the mesh.

Bridges find each other through Reticulum announces; you configure one existing peer and learn the rest. Each network keeps its own end-to-end crypto; the bridge never decrypts either side. It's a standalone Python package that imports Reticulum as a library, no forks of either project, and talks to FIPS over its native API and control socket.

Status: 0.1.x, early but verified live between two real nodes in both directions (300 KB rncp transfer at ~1.3 Mbps over FIPS; an isolated FIPS daemon reaching third mesh nodes through a Reticulum link). systemd units, status tool and a Docker lab included.

Code: https://github.com/fr34aky/reticulum-fips-bridge

#reticulum #fips #meshnet #nostr

fips-ui v0.6.0 is out: the web dashboard for your FIPS mesh node got a lot of new features since 0.2.0.

Names instead of npubs

• Edit the FIPS hosts file right in the UI: .fips for any npub
• Names show up next to npubs everywhere in the dashboard
• Set each name's web UI access (viewer/admin) straight from the hosts list

Hosts sync over the mesh

• One master node keeps the names, trusted nodes follow it
• Pull-based, authenticated by the mesh itself, no passwords
• Works as a tree (master -> followers -> their followers), with loop protection
• The master shows which nodes sync from it and when

Smarter daemon upgrades

• After upgrading fips, your fips.yaml is merged with the new version's config template
• Your own edits stay; a clean merge applies automatically with rollback, conflicts wait for review
• Rolling back the daemon also restores the old config

fips-ui updates itself

• New releases show next to the version
• One click: fetch, build, self-test, restart. Rolls back on any failure

Also: the dashboard reachable via any .fips name over the mesh, clear error messages when access is refused, and more docs.

MIT licensed. https://github.com/fr34aky/fips-ui

#fips #nostr #mesh #selfhosted

fips-ui announcement

Introducing fips-ui v0.2.0: a web dashboard to watch and manage your FIPS mesh node.

Watch:
- Live overview: mesh size, peers, tree depth, traffic, loss, uplink RTT
- Peers, spanning-tree topology, metrics charts, live logs
- Which of your services the mesh can reach, and whether the firewall filters them

Manage:
- Connect and disconnect peers, run probes
- Edit fips config in the browser: diff view, backups, automatic rollback if the node fails to come back healthy. Private keys and passwords are hidden in the browser and put back when you save.
- fips firewall: start, stop, reload, and allow services per npub with one click
- Upgrade fips: install a release or build master, with backups and rollback

Remote access over the mesh, with npubs instead of passwords:
Open the dashboard from another FIPS node. FIPS authenticates every connection's source address, so the UI just checks it against your list of allowed npubs, each with a viewer or admin role. A kernel rule makes sure a LAN host can't fake a mesh address.

Runs on Linux (systemd, OpenRC, OpenWrt), macOS, FreeBSD and Windows. No dependencies on the server side, no sudo prompts in the browser, and an optional read-only mode.

MIT licensed. https://github.com/fr34aky/fips-ui

#fips #nostr #mesh #selfhosted

Full feature list

Monitoring (live, updates in real time)

• Overview: node status, npub and IPv6 address, estimated mesh size, peers, tree depth, traffic in and out, loss rate, uplink quality (RTT, loss, ETX), forwarding counters, transports, service states, and the listeners reachable from the mesh with their firewall status.
• Peers: connection state, role, transport, RTT, loss, goodput and traffic per peer, with connect, disconnect and probe actions.
• Topology: a diagram of the spanning tree, coordinates, and tree protocol counters.
• Metrics: history charts.
• Logs: the live journal of the fips daemon.
• Access: the peer ACL and the hosts file.
• Gateway: status of fips-gateway.
• Also Network, Internals and Diagnostics pages, plus dark and light themes.

Node management

Through one small privileged helper, installed by the admin and allowed by a single sudoers rule.

• Configuration editor for fips config file
  • Checks the YAML as you type and shows a diff before saving.
  • Private keys, passwords and comments that contain them are hidden in the browser and put back when you save.
  • Every save makes a backup and restarts fips. If fips doesn't stay healthy, the previous file is restored automatically.
• Firewall
  • Start, stop, reload, enable or disable the fips firewall, and see how many packets it has dropped.
  • Allow rules for specific npubs, names from the hosts file, address prefixes, or everyone.
  • "Allow…" button on each filtered listener.
  • Every change is checked against the full ruleset (nft -c) before it is written.
• Services: start and restart the fips services with no polkit setup.
• Upgrades: install a published release or build master, with binary backups and rollback.

Remote access over the mesh

• A second listener on the node's fips0 address. Allowed npubs are admitted with a viewer or admin role.
• No passwords: the npub comes from the source address, which FIPS authenticates.
• A kernel guard (nftables) plus a check on every new connection stop spoofing from the LAN.
• The UI opens its own firewall port for exactly the allowed npubs.

Platforms and security

• Linux (systemd, OpenRC, OpenWrt procd), macOS (launchd), FreeBSD (rc.d), Windows (Service Control Manager). Node management and mesh access currently need Linux with systemd.
• The server has no dependencies, and the browser never asks for a sudo password.
• Checks against DNS rebinding and cross-site requests, an optional access token, and a read-only mode.
• MIT licensed.