nx_andelinwest_daemon.nx source
↩ module page · 131 lines · 5624 B
1// nx_andelinwest_daemon.nx -- minimal sovereign HTTPS placeholder for
2// andelinwest.com. Pure Nishi, silicon-up: native-compiled, no libc,
3// substrate TLS 1.3 + Ed25519. Serves ONE self-labeled placeholder
4// page over the PROVEN nx_tls13_server_session_run_ed25519 path.
5//
6// Operator 2026-05-27 (full autonomy): "get andelinwest up as top
7// priority even if its a placeholder from zero up."
8//
9// Why dedicated (not the mv multi-vhost daemon): the mv app-layer
10// (nx_wiki_route_dispatch) returns a silent-negative on the NAS and
11// emits no body; this minimal daemon reuses ONLY the proven handshake
12// + app_send primitives (the ed25519 test daemon path that returns a
13// real HTTP body to curl). Multi-vhost wiki dispatch is debugged
14// separately; tonight andelinwest.com must SERVE.
15//
16// M6 anti-pretend-stub: the page SELF-LABELS as a placeholder and names
17// the exact compliance blockers (state-bar advertising review / ADA /
18// privacy) per NISHI_SITES_INVENTORY.md ยง2.
19//
20// Cert paths match the NAS deploy layout (persistent user volume).
21
22import "nx_syscalls.nx"
23import "nx_csprng.nx"
24import "nx_http_server.nx"
25import "nx_tls13_server_session.nx"
26import "nx_tls13_server_session_run.nx"
27import "nx_tls13_server_session_app_data.nx"
28
29const NX_AW_PORT: i64 = 8453 // CARVED OUT of the shared :8443 monolith: own process behind the SNI router (= SR_AW_PORT), liability-walled
30const NX_AW_BUDGET: i64 = 1000000
31
32const NX_AW_CERT_PATH: *u8 = "/volume1/homes/elderwesto/nishihost/certs/multi_san_cert.der" as *u8
33const NX_AW_PRIV_PATH: *u8 = "/volume1/homes/elderwesto/nishihost/certs/multi_san_priv.bin" as *u8
34
35// Operator 2026-06-06: "put it live for review." The daemon now serves
36// the FULL v1 law-firm site (Andelin West, PLLC), read DATA-DRIVEN from a
37// file at startup (read once, served from RAM) so review iterations need
38// only a file redeploy -- no recompile. The bar-advertising / ADA /
39// privacy review now happens against the LIVE site per operator directive;
40// the M6 placeholder gate is lifted intentionally and on the record here.
41const NX_AW_HDR: *u8 = "HTTP/1.0 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nConnection: close\r\nX-Served-By: nishi-substrate\r\n\r\n" as *u8
42const NX_AW_SITE_PATH: *u8 = "/volume1/homes/elderwesto/nishihost/andelinwest_site.html" as *u8
43
44func aw_strlen(s: *u8) -> i64 {
45 var n: i64 = 0
46 while s[n] != 0 { n = n + 1 }
47 return n
48}
49
50func aw_copy(dst: *u8, src: *u8, n: i64) -> i64 {
51 var i: i64 = 0
52 while i < n { dst[i] = src[i]; i = i + 1 }
53 return 0
54}
55
56func main() -> i64 {
57 // 1. Load cert + Ed25519 priv
58 let cert_len_box: *i64 = (sys_mmap(8)) as *i64
59 cert_len_box[0] = 0
60 let cert_der: *u8 = sys_read_file(NX_AW_CERT_PATH, cert_len_box)
61 if (cert_der as i64) == 0 { return 2 }
62 let cert_der_len: i64 = cert_len_box[0]
63 if cert_der_len < 100 { return 2 }
64
65 let priv_len_box: *i64 = (sys_mmap(8)) as *i64
66 priv_len_box[0] = 0
67 let ed25519_priv: *u8 = sys_read_file(NX_AW_PRIV_PATH, priv_len_box)
68 if (ed25519_priv as i64) == 0 { return 3 }
69 if priv_len_box[0] != 32 { return 3 }
70
71 // 2. Listen 0.0.0.0:8443
72 let addr_buf: *u8 = sys_mmap(16)
73 nx_http_server_addr_any(addr_buf, NX_AW_PORT)
74 let lv: *i64 = (sys_mmap(8)) as *i64
75 let lfd: i64 = nx_http_server_listen(addr_buf, 16, lv)
76 if lfd < 0 { return 4 }
77 sys_write(1, "andelinwest daemon listening 0.0.0.0:8443\n" as *u8, 42)
78
79 // Read the full v1 site ONCE at startup; build the header+body response
80 // in RAM (fail fast if the site file is missing -- a law site must not
81 // silently serve an empty body).
82 let site_len_box: *i64 = (sys_mmap(8)) as *i64
83 site_len_box[0] = 0
84 let site_body: *u8 = sys_read_file(NX_AW_SITE_PATH, site_len_box)
85 if (site_body as i64) == 0 { sys_close(lfd); return 5 }
86 let body_len: i64 = site_len_box[0]
87 if body_len < 100 { sys_close(lfd); return 5 }
88 let hdr_n: i64 = aw_strlen(NX_AW_HDR)
89 let resp_n: i64 = hdr_n + body_len
90 let resp_buf: *u8 = sys_mmap(resp_n + 16)
91 aw_copy(resp_buf, NX_AW_HDR, hdr_n)
92 aw_copy((((resp_buf as i64) + hdr_n) as *u8), site_body, body_len)
93
94 // CONSTANT MEMORY: hoist every per-connection buffer out of the
95 // accept loop (GC-free language; allocating per-iteration leaks).
96 let av: *i64 = (sys_mmap(8)) as *i64
97 let server_random: *u8 = sys_mmap(32)
98 let server_x25519_priv: *u8 = sys_mmap(32)
99 let req_buf: *u8 = sys_mmap(8192)
100 let out_rec: *u8 = sys_mmap(resp_n + 512)
101
102 // 3. Accept loop
103 var served: i64 = 0
104 while served < NX_AW_BUDGET {
105 let cfd: i64 = nx_http_server_accept_one(lfd, av)
106 if cfd < 0 {
107 served = served + 1
108 continue
109 }
110 // Fresh ephemeral keys per handshake (TLS hygiene); reused buffer.
111 nx_csprng_fill(server_random, 32)
112 nx_csprng_fill(server_x25519_priv, 32)
113
114 let hs_rc: i64 = nx_tls13_server_session_run_ed25519(
115 cfd, server_random, server_x25519_priv,
116 cert_der, cert_der_len, ed25519_priv)
117 if hs_rc > 0 {
118 let s: *Tls13ServerSession = hs_rc as *Tls13ServerSession
119 // Drain the client request (we serve the same page regardless).
120 sys_read(cfd, req_buf, 8192)
121 // Encrypt + send the full v1 site.
122 let out_n: i64 = nx_tls13_server_session_app_send(
123 s, resp_buf, resp_n, out_rec, resp_n + 512)
124 if out_n > 0 { sys_write(cfd, out_rec, out_n) }
125 }
126 sys_close(cfd)
127 served = served + 1
128 }
129 sys_close(lfd)
130 return 0
131}