00cff51ce5
All checks were successful
Closes the open broker (anonymous publish to any tenant's corrosion.*).
Per-license isolation via NATS user/password + subject permissions:
each license -> user=license_id, password=HMAC-SHA256(license_id,
NATS_TOKEN_SECRET), scoped to corrosion.{license_id}.> + _INBOX. Backend
uses a privileged internal user.
- Agent (alpha.5): nats_user/nats_password config + env, user_and_password
auth; falls back to token/anonymous (transition-safe)
- Backend: connects with NATS_INTERNAL_USER/PASSWORD when set, else anon
- scripts/generate-nats-auth.mjs: regenerates nats-auth.conf from the
licenses table; NATS_AUTH_STAGE=open keeps a no_auth_user fallback
(verify creds first), =enforce rejects anonymous
- committed nats-auth.conf is the SAFE OPEN default (no secrets); the
host copy carries real users and is not committed
- compose: NATS_INTERNAL_USER/PASSWORD/NATS_TOKEN_SECRET, mount nats-auth.conf
Entirely non-breaking until secrets+config deployed; staged cutover next.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Corrosion Host Agent
Rust rewrite of the Go companion agent (companion-agent/, retained as the
behavior reference until parity). One agent per machine supervises every game
instance on that host — Rust, Conan Exiles, Soulmask, Dune: Awakening.
- Wire protocol: see PROTOCOL.md (v2, instance-scoped subjects)
- Config: see agent.example.toml
Status — Phase 0
- Multi-instance TOML config + env overrides (
CORROSION_LICENSE_ID,CORROSION_NATS_URL,CORROSION_NATS_TOKEN) - NATS connection (infinite reconnect, capped backoff, 30s ping, offline send-buffering,
tls://support) - Host heartbeat with real telemetry (sysinfo: CPU, memory, disks) — no fabricated values
- Connectivity prober (outbound TCP, periodic + on-demand)
- Host command channel (
ping,probe,sysinfo) - Graceful shutdown (cancellation token, going-offline beacon, NATS flush)
- Phase 1a: process supervision — per-instance start/stop/restart/status over
{instance}.cmdrequest-reply, push state events on{instance}.status, crash detection with exit codes, live state in heartbeats (integration-tested with real processes + live-NATS contract test) - Phase 1b: RCON trait (WebRCON rust / TCP conan+soulmask), SteamCMD, jailed file manager
- Phase 2: Dune Docker adapter (compose lifecycle, RabbitMQ bus, Postgres admin)
- Phase 3: signed self-update (enforced ed25519 — release gate), service install, supervisor split
Build
cargo build --release # native
cargo build --release --target x86_64-unknown-linux-gnu # linux deploy target
cargo build --release --target x86_64-pc-windows-msvc # windows (cargo-xwin on non-Windows)
Run
corrosion-host-agent --config ./agent.toml # foreground
corrosion-host-agent --config ./agent.toml check # validate config only
corrosion-host-agent version # semver + git hash + build ts