jwinterm
12e4a54c63
A binary that talks to Postgres directly, bypassing the HTTP admin plane and all network rate limits — the recovery path when the network plane is unreachable or a solo admin key is compromised. Authority = shell + DB creds + ADMIN_KEY_INTEGRITY_SECRET. Every mutation writes a hash-chained audit row (actor_kind=cli). Commands: - list-keys - add-key --pubkey <64hex> [--label] - revoke-key --id <uuid> — MAY revoke the last key (keep_min_live=false; the network DELETE refuses that, the CLI is the authority) - replace-key --old <uuid> --pubkey <64hex> [--revoke-all] — atomic rotate; with --revoke-all, the global break-glass that revokes every other live key - create-admin-wallet --out <path> — generate a schnorr keypair from OS entropy, write the secret hex to a NEW 0600 file (create_new, never clobber/stdout/log), register only the pubkey; seed + secret buffers zeroized (zeroize crate) - doctor — DB reachability, live-key count, audit-chain verification Preflight refuses to run if a present .env is group/other-readable. No new dep beyond zeroize; bin auto-discovered as `smirk-admin`. Smoke-tested end to end (wallet file is 0600; bad pubkey rejected; doctor detects a wrong-secret chain). Deferred (documented): remac-keys (integrity-secret rotation must also re-chain the audit log) and setup/reset-setup (first-run bootstrap = Subsystem 3).
smirk-backend-core
Open, self-hostable backend for the Smirk non-custodial, multi-chain wallet. It provides the chain-access and identity surface a Smirk wallet needs — authentication, per-chain wallet access (Bitcoin, Litecoin, Monero, Wownero, Grin), the Grin slatepack relay, and Nostr-based identity — so anyone can run their own backend and a Smirk wallet can connect to it.
Status: early, under active development. Interfaces and the database schema may change before the first tagged release. Not yet recommended for production self-hosting.
What it is
- Non-custodial. The server never holds spend keys or seeds. It brokers access to blockchain data and relays wallet-to-wallet messages.
- Open core, feature-flagged. Every feature ships in this codebase and is
toggled per deployment; the wallet reads
GET /api/v1/capabilitiesand adapts to what a given backend offers. - Identity via "Sign in with Smirk". Authentication uses a seed-derived Nostr key (NIP-98); the server stores only public keys.
- Privacy first. No PII is required to use it; operator and user privacy are explicit design goals.
Architecture
Rust + Axum, PostgreSQL via sqlx. The public HTTP contract is generated from the handlers with utoipa (OpenAPI), which in turn drives the wallet's generated TypeScript client — one source of truth, checked for drift in CI.
Quickstart
cp .env.example .env # then fill in DATABASE_URL, JWT_SECRET, node URLs
cargo run # starts the API server
A full self-hosting guide (node requirements, reverse proxy, Tor admin onion,
backups) will live in docs/ as it stabilises.
Security
Please report vulnerabilities privately — see SECURITY.md. Do not open public issues for security reports.
License
To be finalized (MIT vs AGPL-3.0-or-later). Until a LICENSE file is added,
all rights are reserved.