diff --git a/README.md b/README.md index dec1944..5099548 100644 --- a/README.md +++ b/README.md @@ -31,8 +31,9 @@ relay does not know is refused when it starts. start. There is no shell, no exec route, and no remote update. - It does not inspect or rewrite upstream responses. Give each upstream a read-only token. -- Revoking the relay token in Perfloop Setup ends its tunnels within thirty - seconds, enforced by the Perfloop API. +- Revoking the relay token in Perfloop Setup ends its tunnels within 40 + seconds, enforced by the Perfloop API. Stopping the relay ends its tunnels + at once. The full model, with the code that enforces each point: [docs/security.md](docs/security.md). diff --git a/SECURITY.md b/SECURITY.md index fef7f92..af5c924 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,5 +8,4 @@ public issue for a vulnerability. Supported: the `main` branch and the latest published image (`docs/image.md`). A fix lands on `main` and is published as a new image; you choose when to roll -it, as with every relay change. This document makes no commitment beyond the -address: no response time, embargo, or reward program is published here. +it, as with every relay change. diff --git a/docs/security.md b/docs/security.md index 9c6abed..866a51a 100644 --- a/docs/security.md +++ b/docs/security.md @@ -146,10 +146,11 @@ never a short body that looks complete. you own; Perfloop's own validation of each read happens before the read reaches the relay, and the relay does not repeat or replace it. - When the relay token is revoked in Perfloop Setup, the Perfloop API ends - its open tunnels within thirty seconds (the API checks each tunnel's key on - that schedule; the relay takes no part in it), and every reconnect after - that is refused with `401 Unauthorized`, which the relay logs as + its open tunnels within 40 seconds (the API checks each tunnel's key on a + schedule; the relay takes no part in it), and every reconnect after that + is refused with `401 Unauthorized`, which the relay logs as `perfloop refused tunnel`. + Stopping the relay ends its tunnels at once. ## The relay token @@ -159,6 +160,6 @@ The plaintext is shown once; Perfloop stores only its hash. The token lets a relay answer that tenant's validated reads and nothing else: the Perfloop API refuses it as a bearer everywhere but the tunnel route, so a token held in your network reads no Perfloop data. More than one relay may run with the -same token; the API uses any live tunnel of the tenant and holds at most eight -tunnels per tenant on each replica, refusing a further one with status 429 -until one ends. +same token; the API uses any live tunnel of the tenant and accepts a limited +number of tunnels per tenant, refusing another with status 429 until one +ends. diff --git a/docs/setup.md b/docs/setup.md index 73833dc..7007255 100644 --- a/docs/setup.md +++ b/docs/setup.md @@ -168,7 +168,7 @@ and Perfloop. | `-print-routes` exits non-zero | The file is invalid. | The last line names the field and the rule. | | No `tunnel open`; `tunnel ended` with a dial or TLS error | The relay cannot reach `app.perfloop.ai:443`. | Egress from the namespace, the NetworkPolicy, DNS, an egress proxy (`HTTPS_PROXY` must carry WebSockets), `api_ca` if TLS is re-signed. | | `perfloop refused tunnel: 401 Unauthorized` | The token is wrong or revoked. | Create a new token in Setup and replace the Secret's `token` key; the Deployment restarts on its own only if you roll it. | -| `perfloop refused tunnel: 429` | This tenant already has the maximum tunnels on that API replica. | Another relay of yours is connected; stop the extra one or wait for it to end. | +| `perfloop refused tunnel: 429` | This tenant already has the maximum number of open tunnels. | Another relay of yours is connected; stop the extra one or wait for it to end. | | Setup connection fails; relay log shows `"decision":"upstream-error"` | The relay reached the tunnel but not the upstream. | `url`, the upstream's TLS (`ca`), and network reachability from the namespace to the upstream. | | Setup connection fails; relay log shows `"status":404,"decision":"unknown-upstream"` | The endpoint name in Setup does not match `upstreams[].name`. | Use exactly `relay://`. | | Setup connection fails; relay log shows no line at all | The read never reached this relay. | Confirm the tunnels are open; the tenant in Setup is the tenant the token belongs to. | @@ -178,5 +178,6 @@ and Perfloop. Create the new token in Setup, update the Secret's `token` key, roll the Deployment, confirm two `tunnel open` lines, then revoke the old token in -Setup. Tunnels on the old token end within thirty seconds of revocation, so -do it in that order to avoid a gap. +Setup. Tunnels on the old token end within 40 seconds of revocation, so do +it in that order to avoid a gap. To end them at once, stop the relays that +still use the old token.