code wiki / _hdl_build / nx_modauth_arm_vault.nx

nx_modauth_arm_vault.nx

buildroot/runtime/_hdl_build/nx_modauth_arm_vault.nx

5826 B111 linesdepth 15pulls 43 transitivereach 0 importersview sourcekind tooltopic modauth
docsdependenciesstructsconstsfunctions

about

nx_modauth_arm_vault.nx -- PRODUCTION arming: provision an admin with the passphrase sourced from the SEALED VAULT (the documented machine-key vault, the same one nx_aw_push uses for the NAS password), NOT a plaintext file. Flow (mirrors nx_aw_push): run nx_machine_key (writes the machine-derived unseal key to /tmp/nxpass) -> nx_vault open <pw-vault.nv> (decrypts -> /tmp/nxsecret.out, 0600, AES-128-GCM authenticated) -> read the passphrase -> register -> SHRED /tmp/nxsecret.out immediately. The passphrase never persists as plaintext; at rest it lives only inside the AES-GCM-sealed .nv. Idempotent (re-run supersedes). Operator seals their passphrase once (out-of-band): stage it to /tmp/nxsecret.in -> nx_machine_key -> nx_vault seal <pw-vault.nv>. The keys-bundle + store live in the documented secrets dir (~/.nishi/secrets/). MUST run with CWD = the nxc2 repo root (the _offc/ helper paths are relative, like nx_aw_push). argv: [1]=pw-vault.nv [2]=auth-keysfile [3]=auth-storefile [4]=realm [5]=handle [6]=mnemonic-outfile Sovereign: nx_modern_auth_flow + nx_machine_key.elf + nx_vault.elf + nx_syscalls. license_tier: ORIGINAL

dependencies 2 imports · 0 importers

nx_modern_auth_flow.nx nx_syscalls.nx nx_modauth_arm_vault.nx

imports: nx_modern_auth_flow.nxnx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sys_write av_len av_run sys_fork sys_mmap sys_execve sys_exit sys_wait4 av_w sys_write ↻ av_len ↻ av_unlink sys_mmap ↻ sys_read_file sys_openat_rd sys_lseek sys_mmap ↻ sys_read sys_close nx_uas_server_keys_load_or sys_mmap ↻ sys_read_file ↻ _uas_hex_dec _uas_nib nx_csprng_fill sys_mmap ↻ nx_csprng_urandom_path sys_openat_rd ↻ sys_read ↻ sys_close ↻ nx_opq_derive_keypair sys_mmap ↻ _voprf_load_context_string u256_alloc nx_scratch nx_scratch_init sys_mmap ↻ nx_scratch_oom sys_write ↻

structs

none

consts

15const AV_MAGIC_8192: i64 = 8192
17const AV_NXPASS: *u8 = "/tmp/nxpass"
18const AV_SECRET_OUT: *u8 = "/tmp/nxsecret.out"

functions

20func av_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
called by 2: av_wmain
21func av_w(s: *u8) -> i64 { sys_write(1, s, av_len(s)); return 0 }
called by 1: main calls 2: sys_writeav_len
25func av_run(path: *u8, a1: *u8, a2: *u8) -> i64
called by 1: main calls 5: sys_forksys_mmapsys_execvesys_exitsys_wait4
45func main(argc: i64, argv: *i64) -> i64
calls 12: sys_writeav_lenav_runav_wav_unlinksys_mmap+6