feat(content-node): lock down the Kubo RPC API and gateway
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 52/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- docker-compose
- Domain
- infrastructure, security
Research direction
Start by reading the compose configuration and init scripts introduced by dependency #59, then verify Kubo's authorization settings against the pinned release. Test the node with unauthenticated and backend-secret RPC requests, and confirm the gateway rejects writes. Done means the compose init applies the configuration and the scripted checks pass.
Written by the indexing model from the issue text.
Description
Summary
Make sure the node cannot be used by the public to write, delete or reconfigure.
Estimated size: S
Motivation
The RPC API can add, remove and reconfigure; exposed publicly it is a full takeover.
Proposal
- RPC bound to the internal network; require an authorization secret for the backend (use Kubo's API authorization settings; verify against the pinned release).
- Gateway read-only; disable features we do not use; set swarm resource limits.
- Document that the backend secret lives in env, never in the repo or logs.
Acceptance criteria
- An unauthenticated RPC request is rejected.
- A request with the backend secret succeeds.
- The gateway cannot write.
- Config is applied by the compose init, not by hand.
Dependencies
- #59
Testing plan
- Scripted negative and positive requests against the compose node.
Part of #43. Ground rules for the content layer: no secrets in the repo, content-layer failures must never block or discard quantum execution, and tests and docs ship with every PR.
- Dominant language
- Python
- Stars
- 2
- Forks
- 4
- Avg merge
- 5h 19m
- Merged PRs (30d)
- 11
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from QMeshPy/distributed-quantum
-
enhancement good first issue helia storage tier-1
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
QMeshPy/distributed-quantum#53 ·
Maintainers usually reply within 1 day
-
chain-integration enhancement payments research-spike tier-2
Difficulty 4/5 3-5 days Newbie friendliness 55/100
QMeshPy/distributed-quantum#78 ·
Maintainers usually reply within 1 day
-
chain-integration enhancement payments research-spike tier-2
Difficulty 3/5 1-2 days Newbie friendliness 66/100
QMeshPy/distributed-quantum#77 ·
Maintainers usually reply within 1 day
-
chain-integration enhancement payments tier-2
Difficulty 5/5 Over a week Newbie friendliness 35/100
QMeshPy/distributed-quantum#76 ·
Maintainers usually reply within 1 day
-
documentation good first issue kubo storage tier-1
Difficulty 2/5 1-3 hours Newbie friendliness 42/100
QMeshPy/distributed-quantum#75 ·
Maintainers usually reply within 1 day
All issues in QMeshPy/distributed-quantum
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
khuisman/mcp-gee-sweet#1166 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
lugassawan/swe-workbench#823 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
gramaziokohler/compas_timber#870 ·
-
security-scan-failure
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
semantica-agi/semantica#2089 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
autowarefoundation/autoware_carla_scenario#500 ·
Maintainers usually reply within 1 day