v1.0.0 - Dial keys. Not IPs.

[dignifiedquire]

We made it. After 4 years and more than 65 versions iroh 1.0 is here to give you the direct connections you deserve.
We know you have already been building, and can’t wait to see what you will build!

https://github.com/n0-computer/iroh/releases/tag/v1.0.0

[ckcr4lyf]

Hiya, trying to understand the use-case and how it works at a more technical (networking) level. The docs don't make the architecture clear (maybe intentional?), but as a P2P enthusiast I'm try to understand better.

From what I can tell, as a "server", I'd generate a keypair, and the associated "identifier" will be published to n0's DNS/Pkarr registry (automatically? against my public IP?). Then someone trying to connect would lookup the identifier against this registry, see my IP, and then attempt a connection.

I guess in that sense, where the public key is effectively the identifier, is quite similar to how Tor does it? Except that in tor the server side is a bit simpler, because you just register the key against a local TCP port which could be running any server (HTTP, IRC etc.)

[flub]

The docs are certainly not trying to hide anything. If you have specific suggestions that would have helped you please do make them.

Each endpoint uses an EndpointId that serves as it's identity. There are than many possible ways, depending on how you configure iroh. The "typical default" way is that the endpoint will connect to a "home" relay server on which other peers can reach it. Then it would publish a pkarr record containing only the (endpoint_id, relay_url). By default it does not publish the IP addresses directly if there is a home relay.

Another endpoint that has the EndpointId and wants to connect would in this typical scenario look up the EndpointId in DNS and find the published relay_url. It would then connect to this relay and start sending the QUIC handshake packets with the EndpointId as destination. The relay server will forward these packets in both directions and the QUIC handshake will complete.

Once the QUIC handshake is complete and both peers are fully authenticated in TLS using the EndpointIds will they start exchanging IP addresses to perform holepunching.

That is the "canonical" scenario, but as said there are many ways to do things. Because iroh has to work in many situations. E.g. you can also work on an isolated network without being able to reach a relay server by configuring mDNS. Or you may have a publicly reachable server that does not need holepunching so you publish the IP addresses directly in the DNS pkarr records and avoid the extra hop and latency of the relay server. Many more possibilities.