code wiki / _hdl_build / nx_sites_daemon_v2.nx

nx_sites_daemon_v2.nx

buildroot/runtime/_hdl_build/nx_sites_daemon_v2.nx

155452 B2241 linesdepth 14pulls 111 transitivereach 0 importersview sourcekind tooltopic sites
docsdependenciesstructsconstsfunctions

about

nx_sites_daemon_v2.nx -- sovereign multi-vhost HTTPS daemon, generation 2. Operator 2026-06-09: "nishi video from the hardware layer up ... hosted again on nishifamily.com/video ... improve anything on the website hosting path to S-class exceed" + "less lag for ukrainians/belarusians" + "record circles like telegram, private/romantic ones auto-archived for review." What changed vs runtime/bin/nx_sites_daemon.nx (v1) and WHY (each is a measured v1 defect, see gates): D1 CHUNKED TLS SEND -- v1's app_send built ONE record for the whole payload; RFC 8446 5.1 caps record plaintext at 16384, so v1 could not serve ANY asset over ~16.3KB (the /video page is 19KB). v2 sends everything through nx_tls13_app_send_fd (gated). D2 RECORD-FRAMED RECEIVE -- v1 assumed one sys_read = one TLS record; v2 reads with nx_tls13_read_record_from_fd and reassembles the request across records until CRLFCRLF (bounded). D3 HOT HOSTING WITH FALLTHROUGH -- v1's hr_serve 404'd on a missing file, so nishifamily.com could not live in sites.conf without killing /wiki. v2 uses hr_serve2: file hit = hot serve (keep-alive, bounds-checked); MISS = fall through to the legacy baked routing. andelinwest keeps REAL 404s (no placeholder bleed). D4 WSS -- /signal/* upgrade requests become a TLS-terminating pump to the loopback N-party signaling daemon (nx_signaling_v2 on 127.0.0.1:8445). wss://nishifamily.com/signal/<room> on :8443 -- no new public port, secure-origin so getUserMedia works (the root cause the old :8282 HTTP video room died). D5 CIRCLES -- POST /video/circle?room=R&from=F&priv=0|1 streams the browser-recorded webm body (record by record) to the circles store; priv=1 -> circles/private (auto-archive for later review), else circles/public. GET /video/circles?room=R lists a room's public circles as JSON; GET /video/circle/<name> plays one back (8MB serve buffer). Storage is OUTSIDE the doc root. Composes (all KAT'd/gated): nx_tls13_* session + record stack, nx_tls13_app_send_fd (gate: 10/10), nx_host_router v2 (gate: 14/14), nx_poll, nx_sites_telemetry, wiki engine handles. license_tier: ORIGINAL

dependencies 28 imports · 0 importers

nx_syscalls.nx nx_connect.nx nx_csprng.nx nx_http_server.nx nx_tls13_server_session.nx nx_tls13_server_session_run.nx nx_tls13_server_session_app_data.n nx_tls13_read_record_from_fd.nx nx_sites_telemetry.nx nx_poll.nx nx_sites_daemon_v2.nx

diagram shows first 10 each side; +18 more imports, +0 more importers in the complete lists below.

imports: nx_syscalls.nxnx_connect.nxnx_csprng.nxnx_http_server.nxnx_tls13_server_session.nxnx_tls13_server_session_run.nxnx_tls13_server_session_app_data.nxnx_tls13_read_record_from_fd.nxnx_sites_telemetry.nxnx_poll.nxnx_deadline_lib.nxnx_itoa_lib.nxnx_wiki_status.nxnx_wiki_article.nxnx_wiki_queue.nxnx_host_router.nxnx_proxy_route.nxnx_adnet_slot.nxnx_adnet_view.nxnx_adnet_dash.nxnx_adnet_submit.nxnx_adnet_campaign.nxnx_adnet_apply.nxnx_adnet_selfserve.nxnx_tls13_app_send_fd.nxnx_nv1.nxnx_sni_cert_select.nxnx_edge_refusal_lib.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sd2_atoi sys_mmap nxa_die sys_write sys_exit nxa_lock_take nxa_lock_addr sys_write ↻ nxa_lock_give nxa_lock_addr ↻ nxa_report_overrun sys_write ↻ nxa_dump_printable sys_write ↻ nxa_dump_sizes sys_write ↻ sd2_load_chain sys_read_file sys_openat_rd sys_lseek sys_mmap ↻ sys_read sys_munmap sys_close sd2_load_key sys_mmap ↻ sys_read_file ↻ sys_read_file ↻ sd2_load_cert_table sys_mmap ↻ sd2_field sd2_next_line sd2_load_chain ↻ sd2_load_key ↻ sys_write ↻ sd2_u64_to_dec pr_conf_announce sys_mmap ↻ pr_conf_scan

structs

none

consts

73const NX_MAGIC_8192: i64 = 8192
74const NX_MAGIC_8445: i64 = 8445
75const NX_MAGIC_16000: i64 = 16000
76const NX_MAGIC_65536: i64 = 65536
77const NX_MAGIC_16384: i64 = 16384
78const NX_MAGIC_60000: i64 = 60000
79const NX_MAGIC_51850: i64 = 51850
80const NX_MAGIC_4096: i64 = 4096
81const NX_MAGIC_1048576: i64 = 1048576
82const NX_MAGIC_262144: i64 = 262144
83const NX_MAGIC_131072: i64 = 131072
84const NX_MAGIC_9091: i64 = 9091
118const NX_SD2_PORT_GALLERY_BRIDGE: i64 = 18190 // /gallery -> bridge -> tunnel -> workstation gw:18091 -> gallery:18090
119const NX_SD2_PORT_WIKI_GATEWAY: i64 = 18791 // /wiki -> OPAQUE-gated wiki gateway
120const NX_SD2_PORT_HUB_GATEWAY: i64 = 18792 // /hub -> maturity-leveled hub gateway
121const NX_SD2_PORT_TORRENT_GATEWAY: i64 = 18793 // /torrent -> OWNER-gated acquirer gateway -> daemon:8097
122const NX_SD2_PORT_GEN_GATEWAY: i64 = 18794 // /gen -> gen gateway -> orchestrator:18795 -> laptop 5080
123const NX_SD2_PORT_STUDIO: i64 = 18099 // /studio -> NAS-local operator-only gated daemon
124const NX_SD2_PORT_READER: i64 = 8791 // /library AND /media -> the SAME auth-walled reader, keeper-supervised
126const NX_SD2_PORT: i64 = 8443
127const NX_SD2_BUDGET: i64 = 100000000
128const NX_SD2_MAX_CHILDREN: i64 = 64
129const NX_SD2_CERT_PATH: *u8 = "/volume1/homes/elderwesto/nishihost/certs/le_fullchain.der" as *u8
130const NX_SD2_PRIV_PATH: *u8 = "/volume1/homes/elderwesto/nishihost/certs/le_ecdsa_key.bin" as *u8
135const NX_SD2_CERT_NISHI: *u8 = "/volume1/homes/elderwesto/nishihost/certs/le_nishifamily_fullchain.der" as *u8
136const NX_SD2_PRIV_NISHI: *u8 = "/volume1/homes/elderwesto/nishihost/certs/le_nishifamily_ecdsa_key.bin" as *u8
137const NX_SD2_CERT_ANDELIN: *u8 = "/volume1/homes/elderwesto/nishihost/certs/le_andelinwest_fullchain.der" as *u8
138const NX_SD2_PRIV_ANDELIN: *u8 = "/volume1/homes/elderwesto/nishihost/certs/le_andelinwest_ecdsa_key.bin" as *u8
141const NX_SD2_MSG_PEEK: i64 = 2
142const NX_SD2_SNI_PEEK_CAP: i64 = 8192
160const NX_SD2_DEADLINE_HDR: *u8 = "X-Nishi-Deadline-Mono-Ms: " as *u8
161const NX_SD2_MS_PER_S: i64 = 1000 // seconds -> milliseconds for the stamped budget
167const NX_SD2_PROXY_DEADLINE_EXPIRED: i64 = 0 - 2
172const NX_SD2_METH_P: i64 = 80
173const NX_SD2_METH_D: i64 = 68
174const NX_SD2_DEC_BUF: i64 = 24 // decimal digits of a u64 (20) plus slack; the size this file already uses for sd2_u64_to_dec scratch
175const NX_SD2_ADNET_APPS: *u8 = "/volume1/homes/elderwesto/nishihost/knowledge/status/adnet_applications.log" as *u8 // advertiser applications journal (staged-never-live)
180const NX_SD2_ADNET_CO_CAP: i64 = 256 // applicant company name
181const NX_SD2_ADNET_EM_CAP: i64 = 256 // applicant contact email
182const NX_SD2_ADNET_CU_CAP: i64 = 512 // applicant click-through url
183const NX_SD2_ADNET_NOTE_CAP: i64 = 1024 // applicant free-text note (the largest field; the ratchet flagged this pair)
184const NX_SD2_SITES_CONF: *u8 = "/volume1/homes/elderwesto/nishihost/sites.conf" as *u8
186const NX_SD2_PROXY_CONF: *u8 = "/volume1/homes/elderwesto/nishihost/proxy_routes.conf" as *u8
193const NX_SD2_ADNET_CONF: *u8 = "/volume1/homes/elderwesto/nishihost/sites/nishifamily/synth/adnet_inventory.txt" as *u8
194const NX_SD2_ADNET_IMPLOG: *u8 = "/volume1/homes/elderwesto/nishihost/adnet_impressions.log" as *u8
195const NX_SD2_ADNET_CLKLOG: *u8 = "/volume1/homes/elderwesto/nishihost/adnet_clicks.log" as *u8
197const NX_SD2_ADNET_ROT_US: i64 = 60000000
198const NX_SD2_TELEMETRY_PATH: *u8 = "/volume1/homes/elderwesto/nishihost/sites_telemetry.log" as *u8
199const NX_SD2_CIRCLES_DIR: *u8 = "/volume1/homes/elderwesto/nishihost/circles" as *u8
200const NX_SD2_MAX_REQ_PER_CONN: i64 = 64
210const NX_SD2_KA_IDLE_S: i64 = 65
213const NX_SD2_ADNET_VIEWLOG: *u8 = "/volume1/homes/elderwesto/nishihost/knowledge/status/adnet_viewable.log" as *u8
215const NX_SD2_RECCAP: i64 = 20480
220const NX_SD2_PLAINCAP: i64 = 2097152
222const NX_SD2_OUTREC: i64 = 17408
224const NX_SD2_DYN_CAP: i64 = 8388608 // assembled-response buffer (dynamic pages). Oversize STATICS no longer bound by this: they take the HR_S2_STREAM zero-ceiling path (debt 1785879638 root fix; the interim 32MiB bump is REVERTED -- no magic ceilings)
225const NX_SD2_HDR_RESERVE: i64 = 1024 // baked-page buffer header reserve: must exceed sd2_build_resp's header size (status+ctype+len+SOTA security-header set)
228const NX_SD2_SEC_HDRS: *u8 = "\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nContent-Security-Policy: default-src 'self'; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' data:; connect-src 'self'; media-src 'self'; frame-ancestors 'self'; base-uri 'none'; object-src 'none'"
229const NX_SD2_STREAM_CHUNK: i64 = 262144 // 256KB read/encrypt window for the streaming reverse-proxy (media)
231const NX_SD2_CIRCLE_MAX: i64 = 33554432
237const RESP2_413: *u8 = "HTTP/1.1 413 Payload Too Large\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
239const NX_SD2_WS_IDLE_MS: i64 = 180000
240const NX_SD2_STATUS_CAP: i64 = 65536
241const NX_SD2_ART_CAP: i64 = 65536
242const RESP2_FAVICON: *u8 = "HTTP/1.1 204 No Content\r\nConnection: keep-alive\r\n\r\n" as *u8
244const RESP2_VIDEO_301: *u8 = "HTTP/1.1 301 Moved Permanently\r\nLocation: /video/index.html\r\nContent-Length: 0\r\nConnection: keep-alive\r\n\r\n" as *u8
247const RESP2_ADV_301: *u8 = "HTTP/1.1 301 Moved Permanently\r\nLocation: /wiki/advertising.html\r\nContent-Length: 0\r\nConnection: keep-alive\r\n\r\n" as *u8
251const RESP2_GATE_LOGIN: *u8 = "HTTP/1.1 302 Found\r\nLocation: /login\r\nContent-Length: 0\r\nConnection: keep-alive\r\n\r\n" as *u8
253const RESP2_STATUS_301: *u8 = "HTTP/1.1 301 Moved Permanently\r\nLocation: /status.html\r\nContent-Length: 0\r\nConnection: keep-alive\r\n\r\n" as *u8
255const BODY2_ANDELIN: *u8 = "<!DOCTYPE html>\n<html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Andelin West Law - Coming Soon</title><style>body{font-family:Georgia,serif;max-width:680px;margin:8vh auto;padding:0 24px;color:#1a1a2e;line-height:1.6}h1{font-size:2rem}.tag{color:#555}.note{margin-top:2rem;padding:16px 20px;background:#f4f4f8;border-left:4px solid #2a4d8f;font-size:.95rem}.foot{margin-top:3rem;font-size:.8rem;color:#888}</style></head><body><h1>Andelin West Law</h1><p class=\"tag\">A modern legal practice. Site launching soon.</p><div class=\"note\"><strong>Placeholder page.</strong> Served by the sovereign Nishi substrate. The full site is pending attorney review of state-bar advertising rules, ADA accessibility conformance, and the privacy notice before any client-facing or intake content goes live.</div><p class=\"foot\">Served bits-up by the Nishi stack &mdash; TLS 1.3, no third-party web server.</p></body></html>\n" as *u8
257const BODY2_WIKI: *u8 = "<!DOCTYPE html>\n<html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Nishi Ecosystem Wiki</title><style>body{font-family:-apple-system,Segoe UI,Roboto,sans-serif;max-width:760px;margin:6vh auto;padding:0 24px;color:#161622;line-height:1.65}h1{font-size:2.1rem}h2{font-size:1.1rem;margin-top:2rem;color:#2a4d8f}ul{padding-left:1.2rem}li{margin:.35rem 0}.note{padding:14px 18px;background:#eef2fb;border-left:4px solid #2a4d8f;border-radius:4px;font-size:.95rem}code{background:#f0f0f4;padding:1px 5px;border-radius:3px;font-size:.9em}.foot{margin-top:3rem;font-size:.8rem;color:#888}</style></head><body><h1>Nishi Ecosystem Wiki</h1><p class=\"note\"><strong>Launch placeholder &mdash; the live wiki engine is coming online.</strong> What you are reading is itself served bits-up by the substrate below: no nginx, no OpenSSL, no libc.</p><p style=\"margin:1.2rem 0\"><a href=\"/wiki/status\"><strong>&#9656; Live stack scorecard &rarr;</strong></a> &nbsp; <a href=\"/wiki/components\"><strong>&#9656; Component articles (Gitea&times;Wikipedia) &rarr;</strong></a></p><h2>Shipped substrate</h2><ul><li>Self-hosting NishiLang compiler (RV64 + x86_64), bits-up from C bootstrap</li><li>TLS 1.3 server &mdash; serving this page now</li><li>SHA-256/512, ChaCha20-Poly1305, AES-GCM, HKDF, Argon2id &mdash; all KAT-verified</li><li>Sovereign secrets vault (HashiCorp-class, ChaCha20-Poly1305 at rest)</li><li>Multi-vhost HTTPS daemon + N-party video signaling (wss) + circles store</li></ul><h2>In progress</h2><ul><li>Full wiki engine (search index, doc store, markdown render)</li><li>Modern auth (OPAQUE PAKE + BIP39 recovery, no cookies)</li><li>Multi-agent concurrent editing (CRDT, sovereign)</li></ul><p class=\"foot\">nishifamily.com/wiki &mdash; bits-up sovereign hosting on the west NAS.</p></body></html>\n" as *u8
263const BODY2_WIKI_BOOTSTRAP: *u8 = "<!doctype html><html><head><meta charset=utf-8><meta name=viewport content='width=device-width,initial-scale=1'><title>Nishi</title></head><body><script>var t=sessionStorage.getItem('nsess');function go(){location='/login?return='+encodeURIComponent(location.pathname+location.search)}function R(h){document.open();document.write(h);document.close()}function F(p,nx){fetch(p,{headers:{'X-Nishi-Session':t}}).then(function(r){return r.ok?r.text():null}).then(function(h){if(h){R(h)}else{nx()}}).catch(go)}if(t){var p=location.pathname,s=location.search;F(p+s,function(){F(p+'.html'+s,go)})}else{go()}</script></body></html>" as *u8
265const BODY2_FAMILY: *u8 = "<!DOCTYPE html>\n<html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Nishi Family</title><style>body{font-family:-apple-system,Segoe UI,Roboto,sans-serif;max-width:680px;margin:8vh auto;padding:0 24px;color:#161622;line-height:1.65;text-align:center}h1{font-size:2.3rem}.tag{color:#555;font-size:1.05rem}a{color:#2a4d8f}.links a{display:inline-block;margin:8px 14px;font-size:1.1rem}.foot{margin-top:3rem;font-size:.8rem;color:#888}</style></head><body><h1>Nishi Family</h1><p class=\"tag\">The family hub &mdash; home of the Nishi sovereign ecosystem.</p><p class=\"links\"><a href=\"/video\">&#127909; Family Video &rarr;</a> <a href=\"/wiki\">Wiki &rarr;</a></p><p class=\"foot\">Served bits-up by the Nishi stack &mdash; TLS 1.3, no third-party web server.</p></body></html>\n" as *u8
295const NX_SD2_CERT_MANIFEST: *u8 = "/volume1/homes/elderwesto/nishihost/certs/sni_certs.manifest" as *u8
296const NX_SD2_CERT_MAX: i64 = 32
1089const NX_SD2_BACKEND_TIMEOUT_S: i64 = 15

functions

267func sd2_strlen(s: *u8) -> i64
274func sd2_load_chain(path: *u8, len_box: *i64) -> *u8
283func sd2_load_key(path: *u8) -> *u8
300func sd2_field(buf: *u8, pos: i64, end: i64, out: *u8, out_cap: i64) -> i64
called by 1: sd2_load_cert_table
337func sd2_next_line(buf: *u8, pos: i64, end: i64) -> i64
called by 1: sd2_load_cert_table
349func sd2_load_cert_table(man: *u8, man_n: i64,
399func sd2_statsig(path: *u8, statb: *u8, out2: *i64) -> i64
called by 1: main calls 1: sys_fstatat
407func sd2_contains(hay: *u8, hlen: i64, needle: *u8, nlen: i64) -> i64
424func sd2_lower(c: u8) -> u8
430func sd2_contains_ci(hay: *u8, hlen: i64, needle: *u8, nlen: i64) -> i64
called by 1: main calls 1: sd2_lower
447func sd2_body_start(hay: *u8, hlen: i64) -> i64
460func sd2_u64_to_dec(n: i64, buf: *u8) -> i64
475func sd2_append(dst: *u8, off: i64, src: *u8, n: i64) -> i64
481func sd2_append_str(dst: *u8, off: i64, s: *u8) -> i64
486func sd2_build_resp(out: *u8, ctype: *u8, body: *u8, body_len: i64) -> i64
514func sd2_content_length(req: *u8, reqn: i64) -> i64
554func sd2_query_param(req: *u8, reqn: i64, key: *u8, keyn: i64, out: *u8) -> i64
609func sd2_recv_request(s: *Tls13ServerSession, cfd: i64, rec_buf: *u8, plain: *u8, plain_cap: i64) -> i64
644func sd2_fill_body(s: *Tls13ServerSession, cfd: i64, rec_buf: *u8, plain: *u8, have: i64, plain_cap: i64) -> i64
666func sd2_ws_pump(s: *Tls13ServerSession, cfd: i64, first_req: *u8, first_n: i64,
736func sd2_circle_path(out: *u8, priv: i64, room: *u8, room_n: i64,
758func sd2_body_copy(body: *u8, got: i64, cl: i64, src: *u8, pn: i64) -> i64
called by 1: sd2_circle_upload
768func sd2_circle_upload(s: *Tls13ServerSession, cfd: i64, plain: *u8, plain_n: i64,
871func sd2_circle_list(plain: *u8, plain_n: i64, dyn: *u8) -> i64
935func sd2_circle_play(plain: *u8, plain_n: i64, dyn: *u8) -> i64
997func sd2_lc(c: i64) -> i64 { if c>=65 { if c<=90 { return c+32 } } return c }
called by 1: sd2_is_conn_line
1003func sd2_is_conn_line(plain: *u8, p: i64, n: i64) -> i64
called by 1: sd2_force_close_dl calls 1: sd2_lc
1016func sd2_force_close(plain: *u8, n: i64, out: *u8) -> i64 { return sd2_force_close_dl(plain, n, out, 0) }
called by 1: sd2_proxy_stream calls 1: sd2_force_close_dl
1017func sd2_force_close_dl(plain: *u8, n: i64, out: *u8, deadline_ms: i64) -> i64
1095func sd2_proxy_to(plain: *u8, plain_n: i64, dyn: *u8, port: i64) -> i64
called by 2: sd2_wiki_proxymain calls 1: sd2_proxy_to_tmo
1098func sd2_proxy_to_tmo(plain: *u8, plain_n: i64, dyn: *u8, port: i64, tmo_s: i64) -> i64
1152func sd2_proxy_stream(s: *Tls13ServerSession, cfd: i64, plain: *u8, plain_n: i64, port: i64, out_rec: *u8) -> i64
1187func sd2_wiki_proxy(plain: *u8, plain_n: i64, dyn: *u8) -> i64
called by 1: main calls 1: sd2_proxy_to
1198func sd2_hdr_span(p: *u8, n: i64) -> i64
called by 1: main
1209func sd2_is_login_route(plain: *u8, plain_n: i64) -> i64
called by 1: main calls 1: sd2_contains
1226func sd2_wiki_public(p: *u8, n: i64) -> i64
called by 1: sd2_wiki_gated calls 1: sd2_contains
1235func sd2_wiki_gated(p: *u8, n: i64) -> i64
called by 1: main calls 2: sd2_containssd2_wiki_public
1241func sd2_atoi(s: *u8) -> i64 { var v: i64=0; var i: i64=0; while s[i]!=(0 as u8){ let c: i64=s[i] as i64; if c<48{return v} if c>57{return v} v=v*10+(c-48); i=i+1 } return v }
called by 1: main
1243func main(argc: i64, argv: *i64) -> i64