edge-control: append-only audit log for register/deregister operations #1095

New issue

Closed

opened 2026-04-20 18:46:26 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-04-20 18:46:26 +00:00

Collaborator

Mirrored from johba/disinto#836

---## Problem

tools/edge-control/register.sh mutates registry.json, authorized_keys, and Caddy routes, but records nothing beyond the final state in the registry. If a bad register/deregister happens (squatting, ownership-check bypass, operator mistake), there is no trail to reconstruct when the change happened or what it replaced.

Proposal

Every successful do_register / do_deregister appends one line to /var/log/disinto/edge-register.log:

2026-04-20T14:30:12Z register   project=myproj port=20034 pubkey_fp=SHA256:… caller=alice
2026-04-20T14:31:55Z deregister project=myproj port=20034 pubkey_fp=SHA256:… caller=alice

Log dir created by install.sh: /var/log/disinto/ owned root:disinto-register, 0750.
Log file append-only (chattr +a on ext4, optional — call out in docs).
Rotate via /etc/logrotate.d/disinto-edge (new file installed by install.sh).
Write failures emit a warning but do not fail the register/deregister.

Acceptance

Every register/deregister produces one line in the audit log.
Log format is stable (space-separated key=value pairs) so it is greppable.
Logrotate config rotates daily, keeps 30 days.

_Mirrored from [johba/disinto#836](https://codeberg.org/johba/disinto/issues/836)_ ---## Problem `tools/edge-control/register.sh` mutates `registry.json`, `authorized_keys`, and Caddy routes, but records nothing beyond the final state in the registry. If a bad register/deregister happens (squatting, ownership-check bypass, operator mistake), there is no trail to reconstruct *when* the change happened or *what* it replaced. ## Proposal Every successful `do_register` / `do_deregister` appends one line to `/var/log/disinto/edge-register.log`: ``` 2026-04-20T14:30:12Z register project=myproj port=20034 pubkey_fp=SHA256:… caller=alice 2026-04-20T14:31:55Z deregister project=myproj port=20034 pubkey_fp=SHA256:… caller=alice ``` - Log dir created by `install.sh`: `/var/log/disinto/` owned `root:disinto-register`, `0750`. - Log file append-only (`chattr +a` on ext4, optional — call out in docs). - Rotate via `/etc/logrotate.d/disinto-edge` (new file installed by `install.sh`). - Write failures emit a warning but do not fail the register/deregister. ## Acceptance - Every register/deregister produces one line in the audit log. - Log format is stable (space-separated `key=value` pairs) so it is greppable. - Logrotate config rotates daily, keeps 30 days.