Skip to content

v0.15.1 — Remote access

Choose a tag to compare

View all tags
@erikvankempen erikvankempen released this 12 Aug 05:25
· 124 commits to main since this release
v0.15.1
da22b80

Remote access — drive the books from any device

Host the books on one machine (an in-house server, a VPS) and drive them from a phone, a laptop, or an agent on another VPS — while the private signing keys stay on the devices that own them.

What's new

  • bukio server start — serve ONE company DB over HTTP(S). Clients POST signed command envelopes; the server verifies each against the company registry (Ed25519 signature, ±5 min window, nonce replay refusal, authz) and executes it. Output is byte-identical to local mode; audit rows carry the real signature (audit verify works server-side).
  • bukio server token <actor> — mint a one-time enrolment token (single-use, TTL, actor-bound, stored sha256-hashed at rest).
  • bukio actor register --server <url> --token <t> — remote enrolment: the client's public key is enrolled; the private key never leaves the client.
  • Global --server <url> / BUKIO_SERVER — run ANY command remotely, e.g. bukio --server https://bukio.intranet vat book ....
  • Transport guidance — SSH tunnel (recommended for humans, zero new listening ports), Tailscale/WireGuard for agents & always-on clients, native TLS for direct exposure. Plain HTTP on a public interface is discouraged.
  • Same-device mode — --server http://127.0.0.1:PORT on the same host works too.

Security model

The private key never leaves the client; the server verifies signatures against enrolled public keys only. Enrolment is capability-gated (one-time, short-lived tokens). Every command is tamper- and replay-proof (canonical digest + nonce + time window); the authz gate and actor enforce on apply server-side. Full rationale in issue #2.

Also in this release

  • SSH/Tailscale transport options documented (README + AGENTS.md)
  • README screenshot regenerated (v0.15.1) showing the remote-access flow
  • Fix: test suite no longer leaks bukio-* temp dirs into /tmp (RAM-starved SQLite on tmpfs hosts)
  • Cost-section refresh: 28.25 KLOC, token spend $13.59, owner time ≈8.8 h / €396

Stats

  • 773/773 tests passing (20 new e2e tests for remote access)
  • 3 new files: src/cli/server.js, src/cli/remote.js, test/remote.test.js
  • Resolves #2 — issue auto-closed by this release

Built with an AI agent (Hermes) and reviewed by a human owner who is not a professional developer. All code Apache-2.0.

Assets 2
Loading