V2

.env.example

@@ -0,0 +1,148 @@
+# Erebrus Node v2 — environment template
+#
+# Where to put this file:
+#   Host install  → /etc/erebrus/erebrus.env   (systemd EnvironmentFile)
+#   Docker install → /opt/erebrus/.env         (docker compose --env-file)
+#   Local dev     → copy to .env in repo root
+#
+# Never commit real secrets (MNEMONIC, NODE_KEY, EREBRUS_ORG_ENROLLMENT_SECRET).
+
+# =============================================================================
+# REQUIRED — all runs (Validate() hard-fails if missing)
+# =============================================================================
+MNEMONIC=                  # BIP39 12-word phrase: wallet, PeerID, DID
+WG_ENDPOINT_HOST=          # Public IP or DNS name clients dial
+
+# =============================================================================
+# REQUIRED — release mode only (not enforced at boot; peer API fails without it)
+# =============================================================================
+# RUNTYPE=release
+# NODE_KEY=                  # Per-node bearer for /api/v2/peers/* (gateway mints if unset)
+
+# =============================================================================
+# DEBUG profile — local smoke / gateway dev (copy these values)
+# =============================================================================
+# RUNTYPE=debug
+# SERVER=127.0.0.1
+# HTTP_PORT=9080
+# MNEMONIC=abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
+# WG_ENDPOINT_HOST=127.0.0.1
+# GATEWAY_URL=http://127.0.0.1:8080
+# ENABLE_STEALTH=false
+# STATE_DIR=./var/lib/erebrus
+# NODE_API_TOKEN=            # leave unset — peer API is open in debug only
+
+# =============================================================================
+# RELEASE profile — production node (installer container path; public by default)
+# =============================================================================
+RUNTYPE=release
+EREBRUS_ACCESS=public
+EREBRUS_MODE=container
+EREBRUS_NETWORK_PROFILE=bridge
+SERVER=0.0.0.0
+HTTP_PORT=9080
+NODE_NAME=erebrus-node
+REGION=unknown
+GATEWAY_URL=https://gateway.erebrus.io
+EREBRUS_ORG_ENROLLMENT_SECRET=
+NODE_KEY=
+ENABLE_STEALTH=true
+STEALTH_TCP_PORT=8443
+STEALTH_UDP_PORT=4443
+STATE_DIR=/var/lib/erebrus
+
+# =============================================================================
+# RELEASE profile — public access node (any deploy; host for app-hosting DNS)
+# =============================================================================
+# EREBRUS_ACCESS=public
+# EREBRUS_MODE=container          # or host for bare metal + wildcard DNS
+# EREBRUS_NETWORK_PROFILE=bridge  # host-network when EREBRUS_MODE=host
+# STEALTH_TCP_PORT=443
+# STEALTH_UDP_PORT=443
+# ENABLE_APP_HOSTING=true
+# APP_WILDCARD_DOMAIN=apps.example.com
+# PUBLIC_DOMAIN=apps.example.com
+# WILDCARD_DOMAIN=*.apps.example.com
+# PUBLIC_GATEWAY_ENABLED=true
+
+# =============================================================================
+# Deploy + access (independent knobs)
+# =============================================================================
+# EREBRUS_MODE=container|host       how the node runs (Docker vs bare metal)
+# EREBRUS_ACCESS=private|public   gateway directory visibility (org controls private access)
+# EREBRUS_NETWORK_PROFILE=bridge|host-network|native
+
+# =============================================================================
+# API bind
+# =============================================================================
+# API_BIND_ADDR=             # overrides SERVER when set
+# UNSAFE_PUBLIC_API=false    # acknowledge risk when binding 0.0.0.0 publicly
+
+# =============================================================================
+# Gateway integration (optional; empty GATEWAY_URL disables control plane)
+# =============================================================================
+# GATEWAY_URL=https://gateway.erebrus.io
+# GATEWAY_AUTO_REGISTER=true
+# EREBRUS_ORG_ENROLLMENT_SECRET=   # from org create/GET (owner/admin); required for auto-register
+# WALLET_CHAIN=sol                 # sol | evm — signs machine enrollment challenge
+# API_PUBLIC_URL=                  # gateway peer provision URL (default: http://WG_ENDPOINT_HOST:HTTP_PORT)
+# NODE_KEY=                        # optional pre-register bearer; gateway mints if empty (persisted)
+# GATEWAY_PUBLIC_KEY=              # optional override; normally saved at registration
+# NODE_ID=                         # persisted after registration; skip auto-register if set with NODE_TOKEN
+# NODE_TOKEN=
+# GATEWAY_PEER_MULTIADDR=    # libp2p bootstrap (DHT advertise only)
+
+# =============================================================================
+# WireGuard
+# =============================================================================
+WG_CONF_DIR=/etc/wireguard
+WG_INTERFACE_NAME=wg0
+WG_ENDPOINT_PORT=51820       # alias: WG_PORT
+WG_IPv4_SUBNET=10.0.0.1/16
+WG_DNS=1.1.1.1
+WG_POST_UP=iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+WG_POST_DOWN=iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+
+# =============================================================================
+# Stealth carriers (sing-box) — DPI-resistant fallbacks when WG UDP is blocked
+# Canonical ports: STEALTH_TCP_PORT / STEALTH_UDP_PORT
+# Legacy aliases:  VLESS_PORT / HYSTERIA2_PORT (same values if you prefer old names)
+# =============================================================================
+# ENABLE_STEALTH=true
+# STEALTH_TCP_PORT=8443      # VLESS+REALITY (tcp); gateway production: 443
+# STEALTH_UDP_PORT=4443      # Hysteria2 (udp); gateway production: 443
+REALITY_SERVER_NAMES=www.microsoft.com
+REALITY_HANDSHAKE_SERVER=
+HYSTERIA2_OBFS_PASSWORD=
+ENABLE_TUIC=false
+
+# =============================================================================
+# Public edge / app hosting (gateway mode, opt-in)
+# =============================================================================
+# ENABLE_APP_HOSTING=false
+# APP_WILDCARD_DOMAIN=
+# PUBLIC_DOMAIN=
+# WILDCARD_DOMAIN=
+# PUBLIC_GATEWAY_ENABLED=false
+# PUBLIC_HTTP_PORT=80
+# PUBLIC_HTTPS_PORT=443
+# AUTO_TLS=true
+
+# =============================================================================
+# Private DNS (opt-in; backed by service registry)
+# =============================================================================
+PRIVATE_DNS_ENABLED=false
+PRIVATE_DNS_DOMAIN=ere
+PRIVATE_DNS_ADDR=10.0.0.1
+UPSTREAM_DNS=1.1.1.1
+DNS_QUERY_LOGS=false
+
+# =============================================================================
+# Registrar (on-chain; noop in v2.0)
+# =============================================================================
+CHAIN_REGISTRATION=off       # off | solana (future)
+
+# =============================================================================
+# Docker only — set by docker-compose.yml; do not set on host/systemd installs
+# =============================================================================
+# LOAD_CONFIG_FILE=TRUE

.github/workflows/ci.yml

@@ -0,0 +1,36 @@
+name: ci
+
+on:
+  push:
+    branches: [main, v2]
+  pull_request:
+
+jobs:
+  go:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+      # with_reality_server enables the sing-box REALITY server (stealth carrier);
+      # required or the stealth start-test fails. Keep in sync with Makefile/Dockerfile.
+      - run: go vet -tags with_reality_server ./...
+      - run: go build -tags with_reality_server ./...
+      - run: go test -tags with_reality_server ./...
+      - uses: golangci/golangci-lint-action@v6
+        continue-on-error: true
+        with:
+          version: latest
+          args: --build-tags with_reality_server
+
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}