code wiki / _hdl_build / nx_sites_daemon_v2.nx
nx_sites_daemon_v2.nx
buildroot/runtime/_hdl_build/nx_sites_daemon_v2.nx
about
nx_sites_daemon_v2.nx -- sovereign multi-vhost HTTPS daemon, generation 2.
Operator 2026-06-09: "nishi video from the hardware layer up ... hosted
again on nishifamily.com/video ... improve anything on the website hosting
path to S-class exceed" + "less lag for ukrainians/belarusians" + "record
circles like telegram, private/romantic ones auto-archived for review."
What changed vs runtime/bin/nx_sites_daemon.nx (v1) and WHY (each is a
measured v1 defect, see gates):
D1 CHUNKED TLS SEND -- v1's app_send built ONE record for the whole
payload; RFC 8446 5.1 caps record plaintext at 16384, so v1 could
not serve ANY asset over ~16.3KB (the /video page is 19KB).
v2 sends everything through nx_tls13_app_send_fd (gated).
D2 RECORD-FRAMED RECEIVE -- v1 assumed one sys_read = one TLS record;
v2 reads with nx_tls13_read_record_from_fd and reassembles the
request across records until CRLFCRLF (bounded).
D3 HOT HOSTING WITH FALLTHROUGH -- v1's hr_serve 404'd on a missing
file, so nishifamily.com could not live in sites.conf without
killing /wiki. v2 uses hr_serve2: file hit = hot serve (keep-alive,
bounds-checked); MISS = fall through to the legacy baked routing.
andelinwest keeps REAL 404s (no placeholder bleed).
D4 WSS -- /signal/* upgrade requests become a TLS-terminating pump to
the loopback N-party signaling daemon (nx_signaling_v2 on
127.0.0.1:8445). wss://nishifamily.com/signal/<room> on :8443 --
no new public port, secure-origin so getUserMedia works (the root
cause the old :8282 HTTP video room died).
D5 CIRCLES -- POST /video/circle?room=R&from=F&priv=0|1 streams the
browser-recorded webm body (record by record) to the circles store;
priv=1 -> circles/private (auto-archive for later review),
else circles/public. GET /video/circles?room=R lists a room's
public circles as JSON; GET /video/circle/<name> plays one back
(8MB serve buffer). Storage is OUTSIDE the doc root.
Composes (all KAT'd/gated): nx_tls13_* session + record stack,
nx_tls13_app_send_fd (gate: 10/10), nx_host_router v2 (gate: 14/14),
nx_poll, nx_sites_telemetry, wiki engine handles.
license_tier: ORIGINAL
dependencies 22 imports · 0 importers
diagram shows first 10 each side; +12 more imports, +0 more importers in the complete lists below.
imports: nx_syscalls.nxnx_connect.nxnx_csprng.nxnx_http_server.nxnx_tls13_server_session.nxnx_tls13_server_session_run.nxnx_tls13_server_session_app_data.nxnx_tls13_read_record_from_fd.nxnx_sites_telemetry.nxnx_poll.nxnx_wiki_status.nxnx_wiki_article.nxnx_wiki_queue.nxnx_host_router.nxnx_proxy_route.nxnx_adnet_slot.nxnx_adnet_view.nxnx_adnet_dash.nxnx_adnet_submit.nxnx_tls13_app_send_fd.nxnx_nv1.nxnx_sni_cert_select.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 64 | const NX_MAGIC_8192: i64 = 8192 |
| 65 | const NX_MAGIC_8445: i64 = 8445 |
| 66 | const NX_MAGIC_16000: i64 = 16000 |
| 67 | const NX_MAGIC_65536: i64 = 65536 |
| 68 | const NX_MAGIC_16384: i64 = 16384 |
| 69 | const NX_MAGIC_60000: i64 = 60000 |
| 70 | const NX_MAGIC_51850: i64 = 51850 |
| 71 | const NX_MAGIC_4096: i64 = 4096 |
| 72 | const NX_MAGIC_1048576: i64 = 1048576 |
| 73 | const NX_MAGIC_262144: i64 = 262144 |
| 74 | const NX_MAGIC_131072: i64 = 131072 |
| 75 | const NX_MAGIC_9091: i64 = 9091 |
| 76 | const NX_MAGIC_18190: i64 = 18190 |
| 77 | const NX_MAGIC_18791: i64 = 18791 |
| 78 | const NX_MAGIC_18792: i64 = 18792 |
| 79 | const NX_MAGIC_18794: i64 = 18794 |
| 80 | const NX_MAGIC_18793: i64 = 18793 |
| 81 | const NX_MAGIC_18099: i64 = 18099 |
| 82 | const NX_MAGIC_8791: i64 = 8791 |
| 84 | const NX_SD2_PORT: i64 = 8443 |
| 85 | const NX_SD2_BUDGET: i64 = 100000000 |
| 86 | const NX_SD2_MAX_CHILDREN: i64 = 64 |
| 87 | const NX_SD2_CERT_PATH: *u8 = "/volume1/homes/elderwesto/nishihost/certs/le_fullchain.der" as *u8 |
| 88 | const NX_SD2_PRIV_PATH: *u8 = "/volume1/homes/elderwesto/nishihost/certs/le_ecdsa_key.bin" as *u8 |
| 93 | const NX_SD2_CERT_NISHI: *u8 = "/volume1/homes/elderwesto/nishihost/certs/le_nishifamily_fullchain.der" as *u8 |
| 94 | const NX_SD2_PRIV_NISHI: *u8 = "/volume1/homes/elderwesto/nishihost/certs/le_nishifamily_ecdsa_key.bin" as *u8 |
| 95 | const NX_SD2_CERT_ANDELIN: *u8 = "/volume1/homes/elderwesto/nishihost/certs/le_andelinwest_fullchain.der" as *u8 |
| 96 | const NX_SD2_PRIV_ANDELIN: *u8 = "/volume1/homes/elderwesto/nishihost/certs/le_andelinwest_ecdsa_key.bin" as *u8 |
| 99 | const NX_SD2_MSG_PEEK: i64 = 2 |
| 100 | const NX_SD2_SNI_PEEK_CAP: i64 = 8192 |
| 101 | const NX_SD2_SITES_CONF: *u8 = "/volume1/homes/elderwesto/nishihost/sites.conf" as *u8 |
| 103 | const NX_SD2_PROXY_CONF: *u8 = "/volume1/homes/elderwesto/nishihost/proxy_routes.conf" as *u8 |
| 110 | const NX_SD2_ADNET_CONF: *u8 = "/volume1/homes/elderwesto/nishihost/sites/nishifamily/synth/adnet_inventory.txt" as *u8 |
| 111 | const NX_SD2_ADNET_IMPLOG: *u8 = "/volume1/homes/elderwesto/nishihost/adnet_impressions.log" as *u8 |
| 112 | const NX_SD2_ADNET_CLKLOG: *u8 = "/volume1/homes/elderwesto/nishihost/adnet_clicks.log" as *u8 |
| 114 | const NX_SD2_ADNET_ROT_US: i64 = 60000000 |
| 115 | const NX_SD2_TELEMETRY_PATH: *u8 = "/volume1/homes/elderwesto/nishihost/sites_telemetry.log" as *u8 |
| 116 | const NX_SD2_CIRCLES_DIR: *u8 = "/volume1/homes/elderwesto/nishihost/circles" as *u8 |
| 117 | const NX_SD2_MAX_REQ_PER_CONN: i64 = 64 |
| 127 | const NX_SD2_KA_IDLE_S: i64 = 65 |
| 130 | const NX_SD2_ADNET_VIEWLOG: *u8 = "/volume1/homes/elderwesto/nishihost/knowledge/status/adnet_viewable.log" as *u8 |
| 132 | const NX_SD2_RECCAP: i64 = 20480 |
| 137 | const NX_SD2_PLAINCAP: i64 = 2097152 |
| 139 | const NX_SD2_OUTREC: i64 = 17408 |
| 141 | const NX_SD2_DYN_CAP: i64 = 8388608 // assembled-response buffer (dynamic pages). Oversize STATICS no longer bound by this: they take the HR_S2_STREAM zero-ceiling path (debt 1785879638 root fix; the interim 32MiB bump is REVERTED -- no magic ceilings) |
| 142 | const NX_SD2_HDR_RESERVE: i64 = 1024 // baked-page buffer header reserve: must exceed sd2_build_resp's header size (status+ctype+len+SOTA security-header set) |
| 145 | const NX_SD2_SEC_HDRS: *u8 = "\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nContent-Security-Policy: default-src 'self'; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' data:; connect-src 'self'; media-src 'self'; frame-ancestors 'self'; base-uri 'none'; object-src 'none'" |
| 146 | const NX_SD2_STREAM_CHUNK: i64 = 262144 // 256KB read/encrypt window for the streaming reverse-proxy (media) |
| 148 | const NX_SD2_CIRCLE_MAX: i64 = 33554432 |
| 154 | const RESP2_413: *u8 = "HTTP/1.1 413 Payload Too Large\r\nContent-Length: 0\r\nConnection: close\r\n\r\n" |
| 156 | const NX_SD2_WS_IDLE_MS: i64 = 180000 |
| 157 | const NX_SD2_STATUS_CAP: i64 = 65536 |
| 158 | const NX_SD2_ART_CAP: i64 = 65536 |
| 159 | const RESP2_FAVICON: *u8 = "HTTP/1.1 204 No Content\r\nConnection: keep-alive\r\n\r\n" as *u8 |
| 161 | const RESP2_VIDEO_301: *u8 = "HTTP/1.1 301 Moved Permanently\r\nLocation: /video/index.html\r\nContent-Length: 0\r\nConnection: keep-alive\r\n\r\n" as *u8 |
| 164 | const RESP2_ADV_301: *u8 = "HTTP/1.1 301 Moved Permanently\r\nLocation: /wiki/advertising.html\r\nContent-Length: 0\r\nConnection: keep-alive\r\n\r\n" as *u8 |
| 168 | const RESP2_GATE_LOGIN: *u8 = "HTTP/1.1 302 Found\r\nLocation: /login\r\nContent-Length: 0\r\nConnection: keep-alive\r\n\r\n" as *u8 |
| 170 | const RESP2_STATUS_301: *u8 = "HTTP/1.1 301 Moved Permanently\r\nLocation: /status.html\r\nContent-Length: 0\r\nConnection: keep-alive\r\n\r\n" as *u8 |
| 172 | const BODY2_ANDELIN: *u8 = "<!DOCTYPE html>\n<html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Andelin West Law - Coming Soon</title><style>body{font-family:Georgia,serif;max-width:680px;margin:8vh auto;padding:0 24px;color:#1a1a2e;line-height:1.6}h1{font-size:2rem}.tag{color:#555}.note{margin-top:2rem;padding:16px 20px;background:#f4f4f8;border-left:4px solid #2a4d8f;font-size:.95rem}.foot{margin-top:3rem;font-size:.8rem;color:#888}</style></head><body><h1>Andelin West Law</h1><p class=\"tag\">A modern legal practice. Site launching soon.</p><div class=\"note\"><strong>Placeholder page.</strong> Served by the sovereign Nishi substrate. The full site is pending attorney review of state-bar advertising rules, ADA accessibility conformance, and the privacy notice before any client-facing or intake content goes live.</div><p class=\"foot\">Served bits-up by the Nishi stack — TLS 1.3, no third-party web server.</p></body></html>\n" as *u8 |
| 174 | const BODY2_WIKI: *u8 = "<!DOCTYPE html>\n<html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Nishi Ecosystem Wiki</title><style>body{font-family:-apple-system,Segoe UI,Roboto,sans-serif;max-width:760px;margin:6vh auto;padding:0 24px;color:#161622;line-height:1.65}h1{font-size:2.1rem}h2{font-size:1.1rem;margin-top:2rem;color:#2a4d8f}ul{padding-left:1.2rem}li{margin:.35rem 0}.note{padding:14px 18px;background:#eef2fb;border-left:4px solid #2a4d8f;border-radius:4px;font-size:.95rem}code{background:#f0f0f4;padding:1px 5px;border-radius:3px;font-size:.9em}.foot{margin-top:3rem;font-size:.8rem;color:#888}</style></head><body><h1>Nishi Ecosystem Wiki</h1><p class=\"note\"><strong>Launch placeholder — the live wiki engine is coming online.</strong> What you are reading is itself served bits-up by the substrate below: no nginx, no OpenSSL, no libc.</p><p style=\"margin:1.2rem 0\"><a href=\"/wiki/status\"><strong>▸ Live stack scorecard →</strong></a> <a href=\"/wiki/components\"><strong>▸ Component articles (Gitea×Wikipedia) →</strong></a></p><h2>Shipped substrate</h2><ul><li>Self-hosting NishiLang compiler (RV64 + x86_64), bits-up from C bootstrap</li><li>TLS 1.3 server — serving this page now</li><li>SHA-256/512, ChaCha20-Poly1305, AES-GCM, HKDF, Argon2id — all KAT-verified</li><li>Sovereign secrets vault (HashiCorp-class, ChaCha20-Poly1305 at rest)</li><li>Multi-vhost HTTPS daemon + N-party video signaling (wss) + circles store</li></ul><h2>In progress</h2><ul><li>Full wiki engine (search index, doc store, markdown render)</li><li>Modern auth (OPAQUE PAKE + BIP39 recovery, no cookies)</li><li>Multi-agent concurrent editing (CRDT, sovereign)</li></ul><p class=\"foot\">nishifamily.com/wiki — bits-up sovereign hosting on the west NAS.</p></body></html>\n" as *u8 |
| 180 | const BODY2_WIKI_BOOTSTRAP: *u8 = "<!doctype html><html><head><meta charset=utf-8><meta name=viewport content='width=device-width,initial-scale=1'><title>Nishi</title></head><body><script>var t=sessionStorage.getItem('nsess');function go(){location='/login?return='+encodeURIComponent(location.pathname+location.search)}function R(h){document.open();document.write(h);document.close()}function F(p,nx){fetch(p,{headers:{'X-Nishi-Session':t}}).then(function(r){return r.ok?r.text():null}).then(function(h){if(h){R(h)}else{nx()}}).catch(go)}if(t){var p=location.pathname,s=location.search;F(p+s,function(){F(p+'.html'+s,go)})}else{go()}</script></body></html>" as *u8 |
| 182 | const BODY2_FAMILY: *u8 = "<!DOCTYPE html>\n<html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Nishi Family</title><style>body{font-family:-apple-system,Segoe UI,Roboto,sans-serif;max-width:680px;margin:8vh auto;padding:0 24px;color:#161622;line-height:1.65;text-align:center}h1{font-size:2.3rem}.tag{color:#555;font-size:1.05rem}a{color:#2a4d8f}.links a{display:inline-block;margin:8px 14px;font-size:1.1rem}.foot{margin-top:3rem;font-size:.8rem;color:#888}</style></head><body><h1>Nishi Family</h1><p class=\"tag\">The family hub — home of the Nishi sovereign ecosystem.</p><p class=\"links\"><a href=\"/video\">🎥 Family Video →</a> <a href=\"/wiki\">Wiki →</a></p><p class=\"foot\">Served bits-up by the Nishi stack — TLS 1.3, no third-party web server.</p></body></html>\n" as *u8 |
| 212 | const NX_SD2_CERT_MANIFEST: *u8 = "/volume1/homes/elderwesto/nishihost/certs/sni_certs.manifest" as *u8 |
| 213 | const NX_SD2_CERT_MAX: i64 = 32 |
functions
| 184 | func sd2_strlen(s: *u8) -> i64 |
| 191 | func sd2_load_chain(path: *u8, len_box: *i64) -> *u8 |
| 200 | func sd2_load_key(path: *u8) -> *u8 |
| 217 | func sd2_field(buf: *u8, pos: i64, end: i64, out: *u8, out_cap: i64) -> i64 called by 1: sd2_load_cert_table |
| 254 | func sd2_next_line(buf: *u8, pos: i64, end: i64) -> i64 called by 1: sd2_load_cert_table |
| 266 | func sd2_load_cert_table(man: *u8, man_n: i64, |
| 316 | func sd2_statsig(path: *u8, statb: *u8, out2: *i64) -> i64 |
| 324 | func sd2_contains(hay: *u8, hlen: i64, needle: *u8, nlen: i64) -> i64 |
| 341 | func sd2_lower(c: u8) -> u8 |
| 347 | func sd2_contains_ci(hay: *u8, hlen: i64, needle: *u8, nlen: i64) -> i64 |
| 364 | func sd2_body_start(hay: *u8, hlen: i64) -> i64 |
| 377 | func sd2_u64_to_dec(n: i64, buf: *u8) -> i64 |
| 392 | func sd2_append(dst: *u8, off: i64, src: *u8, n: i64) -> i64 |
| 398 | func sd2_append_str(dst: *u8, off: i64, s: *u8) -> i64 called by 4: sd2_build_respsd2_circle_pathsd2_circle_listsd2_circle_play calls 2: sd2_appendsd2_strlen |
| 403 | func sd2_build_resp(out: *u8, ctype: *u8, body: *u8, body_len: i64) -> i64 |
| 419 | func sd2_content_length(req: *u8, reqn: i64) -> i64 |
| 459 | func sd2_query_param(req: *u8, reqn: i64, key: *u8, keyn: i64, out: *u8) -> i64 |
| 514 | func sd2_recv_request(s: *Tls13ServerSession, cfd: i64, rec_buf: *u8, plain: *u8, plain_cap: i64) -> i64 |
| 549 | func sd2_fill_body(s: *Tls13ServerSession, cfd: i64, rec_buf: *u8, plain: *u8, have: i64, plain_cap: i64) -> i64 |
| 571 | func sd2_ws_pump(s: *Tls13ServerSession, cfd: i64, first_req: *u8, first_n: i64, called by 1: main calls 14: sys_socketsys_mmapnx_connect_boundedsys_closesys_setsockoptnx_tls13_sendfd_write_all+8 |
| 641 | func sd2_circle_path(out: *u8, priv: i64, room: *u8, room_n: i64, |
| 663 | func sd2_body_copy(body: *u8, got: i64, cl: i64, src: *u8, pn: i64) -> i64 called by 1: sd2_circle_upload |
| 673 | func sd2_circle_upload(s: *Tls13ServerSession, cfd: i64, plain: *u8, plain_n: i64, called by 1: main calls 16: sd2_content_lengthsys_mmapsd2_query_paramhr_emit_bsd2_strlensd2_body_start+10 |
| 776 | func sd2_circle_list(plain: *u8, plain_n: i64, dyn: *u8) -> i64 called by 1: main calls 7: sys_mmapsd2_query_paramsd2_append_strsys_openat_rdsys_getdents64sys_close+1 |
| 840 | func sd2_circle_play(plain: *u8, plain_n: i64, dyn: *u8) -> i64 |
| 902 | func sd2_lc(c: i64) -> i64 { if c>=65 { if c<=90 { return c+32 } } return c } called by 1: sd2_is_conn_line |
| 903 | func sd2_is_conn_line(plain: *u8, p: i64, n: i64) -> i64 |
| 913 | func sd2_force_close(plain: *u8, n: i64, out: *u8) -> i64 |
| 946 | func sd2_proxy_to(plain: *u8, plain_n: i64, dyn: *u8, port: i64) -> i64 called by 2: sd2_wiki_proxymain calls 8: sys_socketsys_mmapnx_connect_boundedsys_closesys_set_socket_timeoutsd2_force_close+2 |
| 981 | func sd2_proxy_stream(s: *Tls13ServerSession, cfd: i64, plain: *u8, plain_n: i64, port: i64, out_rec: *u8) -> i64 called by 1: main calls 9: sys_socketsys_mmapnx_connect_boundedsys_closesys_set_socket_timeoutsd2_force_close+3 |
| 1016 | func sd2_wiki_proxy(plain: *u8, plain_n: i64, dyn: *u8) -> i64 |
| 1027 | func sd2_hdr_span(p: *u8, n: i64) -> i64 called by 1: main |
| 1038 | func sd2_is_login_route(plain: *u8, plain_n: i64) -> i64 |
| 1055 | func sd2_wiki_public(p: *u8, n: i64) -> i64 |
| 1064 | func sd2_wiki_gated(p: *u8, n: i64) -> i64 |
| 1070 | func sd2_atoi(s: *u8) -> i64 { var v: i64=0; var i: i64=0; while s[i]!=(0 as u8){ let c: i64=s[i] as i64; if c<48{return v} if c>57{return v} v=v*10+(c-48); i=i+1 } return v } called by 1: main |
| 1072 | func main(argc: i64, argv: *i64) -> i64 |