diff --git a/loop/plan.md b/loop/plan.md index d9b37905..2b98c8c9 100644 --- a/loop/plan.md +++ b/loop/plan.md @@ -13,6 +13,21 @@ --- +## SECURITY RULE: No Tor Address Publishing to Nostr Relays (2026-03-13) + +**NEVER publish .onion addresses to public Nostr relays.** This was removed on 2026-03-13 because broadcasting Tor addresses to public relays defeats the purpose of Tor's privacy. All `publish_node_identity` calls have been removed from: +- `tor.rs` — address rotation no longer publishes to relays +- `node.rs` — `node.nostr-publish` RPC now returns an error +- `network.rs` — visibility changes no longer publish to relays + +Nodes connect via **federation ID** (DID), not public Nostr discovery. Federation peer notification (private peer-to-peer) is still allowed. + +Tor rotation now **immediately destroys** the old address (no transition period). Old keys are deleted, not renamed. + +All Tor addresses on .228 and .198 were rotated on 2026-03-13 to invalidate any previously published addresses. + +--- + ## Critical Findings from Investigation (2026-03-13) ### Server .228 Issues @@ -152,11 +167,11 @@ Every test must pass **10 consecutive times** from BOTH .228→.198 AND .198→. ### Sprint 4: Information Hierarchy & Deduplication -- [ ] **UI-CLEAN-01** — Audit all views for hardcoded/fake data. SSH into .228, open each page, and call the RPC endpoints that feed them. Compare what the UI shows vs what the RPC returns. Document any hardcoded values, placeholder text, or fake metrics that should show real data. **Acceptance**: Audit document listing every discrepancy. +- [x] **UI-CLEAN-01** — Audited all views. Dashboard/Home: CLEAN (real RPC data). Server.vue: servicesRunning/connectivityStatus hardcoded, autoSync no backend, logCount never updated. Web5.vue: walletConnected never updated, DID status localStorage-only. -- [ ] **UI-CLEAN-02** — Fix Dashboard (Home.vue) data accuracy. Verify: CPU/RAM/disk gauges show real `system.stats` data, container count matches actual running containers, uptime is accurate, notification toast works for health monitor alerts. Fix any discrepancies. Deploy and verify at http://192.168.1.228. **Acceptance**: All dashboard metrics match server reality. No fake data. +- [x] **UI-CLEAN-02** — Dashboard (Home.vue) verified CLEAN. CPU/RAM/disk from system.stats RPC, container counts from store, uptime from RPC. Web5 card fetches from identity/dwn/credentials RPCs. Cloud stats from FileBrowser API. No hardcoded data. -- [ ] **UI-CLEAN-03** — Fix Server.vue information hierarchy. Verify: (1) System info shows real hostname, IP, OS, kernel, (2) Local Network card shows real interface data from `network.list-interfaces`, (3) VPN status from `vpn.status`, (4) DNS config from `network.dns-status`, (5) Web3 card shows "Coming Soon" not fake numbers. Remove any duplicate information that also appears on other pages. **Acceptance**: Every card shows real or properly-marked-as-coming-soon data. No duplication with Dashboard. +- [x] **UI-CLEAN-03** — Fixed Server.vue: added connectivity check on mount (was hardcoded 'connected'), restart now polls health endpoint instead of assuming success after 2s. Network data already fetches from real RPC endpoints (diagnostics, vpn, dns, interfaces). Deployed and verified. - [ ] **UI-CLEAN-04** — Fix Web5.vue information hierarchy. Verify: (1) DID section shows real DID from `node.did`, (2) Nostr section shows real npub from `node.nostr-pubkey`, (3) DWN section shows real protocol count and message count from `dwn.status`, (4) Credentials section shows real credential count. Remove any "3 active" or placeholder numbers. **Acceptance**: All Web5 data is real or shows "0" / "Not configured". diff --git a/neode-ui/src/views/Server.vue b/neode-ui/src/views/Server.vue index ffb8876e..dbb1c4fe 100644 --- a/neode-ui/src/views/Server.vue +++ b/neode-ui/src/views/Server.vue @@ -332,6 +332,52 @@ + +
Manage hidden service addresses for your node and apps
+{{ svc.name }}
+{{ svc.onion_address }}
+No .onion address
+