Decision: Nextcloud "Trusted servers" compatibility (status.php + federation handshake + directory sync?) #455
Labels
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: Cordy/Cairn#455
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Context
Nikola tried adding files-bao to NC's Federation admin → "No server to federate with found". NC 34 probed
/.well-known/ocm/status.php→ our 401 → NC log: "No Nextcloud server." Question raised: shouldn't Cairn be addable there, like the other players?What "Trusted servers" actually is (research, 2026-09)
Not OCM. It is NC-family compat with three layers: (1)
status.phpprobe ("is this a Nextcloud-like?"), (2) shared-secret handshake via/ocs/v2.php/apps/federation/…, (3) periodic system address book sync (CardDAV) exchanging the full user list. Its only function is share-dialog autocomplete of remote users; it gates no sharing whatsoever (confirmed in #117 research and by NC docs).Who can be added today: ownCloud 10 yes (ships status.php, same lineage). OpenCloud/oCIS yes at probe level (ships a status.php compat endpoint). Seafile no — no status.php, cannot be added, and has no equivalent feature of its own.
Options for Cairn
Ask
Decide tier. If >0: mockup for the opt-in surface first, then house TDD build; document in handbook federation-ocm.md ("appearing in Nextcloud's Trusted servers" section) either way — including, for tier 0, an explicit "why not" paragraph.
House rules: karpathy-guidelines, Superpowers brainstorming before any build.
Tier-3 steering design (mockup
ocm-directory-optin-mockup.html, rev 1, awaiting Nikola):Four stacked gates, each owned by the right party. (1) Server on the allow-list — admin, exists today. (2) Directory compat enabled — admin, new master toggle in a Directory tab beside Status/Servers in the OCM topic (status endpoint + handshake live only while on; uses the same Apply/Discard bar). (3) Handshake completed — automatic, shown per server as verified/pending with last-sync stamp. (4) User opted in — a "Let trusted servers list me" card at the top of Federated → Contacts, default off for everyone, IdP and local users identical.
Key properties: the admin sees a live tally (e.g. "3 of 14 users opted in") but has no control to list anyone — consent stays with the user, mirroring the #117 user-owned-contacts decision. The user card names exactly what is exposed (display name + federated address, nothing else) and shows gate chips ("directory not enabled" / "2 servers verified" / "you: listed") so a toggle never silently does nothing. Opt-out removes the user from the next sync; opted-out users never appear in any address-book response. Removing a server from the allow-list drops its handshake.
Decisions (Nikola, 2026-09-09) — supersedes the rev-1 mockup's steering:
Build remains gated on: #454 root cause first, then mockup rev 2 → approval → house TDD.
Listing model revised (Nikola, 2026-09-09) — supersedes point 3 of the previous decision comment.
Relationship-derived, per-server listing. A user is included in the directory served to trusted server X iff:
Default with no relationship: not listed. This is per-(user, server) — technically clean because each trusted server fetches the address book itself, authenticated by its own handshake secret, so we serve each server its own subset.
Recorded properties:
Next step when #455 is picked up (after #454 root cause): mockup rev 2 on this model → approval → house TDD build.
Shipped in v0.6.158, live on both dogfoods —
cairn_build_info{version="v0.6.158"}verified, andhttps://files-bao.c0rdyceps.ch/status.phpalready answers the probe JSON (active because nextcloud.c0rdyceps.ch sits on the allow-list as a legacy-dialect server).Built exactly to the locked decisions + approved rev-2 mockups, house TDD (backend red witnessed on the runner; wire formats pinned against the actual Nextcloud federation-app source):
internal/ocm/directory.go, mounted on the public mux, active only while a legacy server is allow-listed):status.php, OCSrequest-shared-secret(allow-list gated; async callback fetches the secret, retrying once with a trailing slash — the classic NC url-hash mismatch),get-shared-secretalways 403 (Cairn never initiates), and the CardDAV system address book atremote.php/dav/addressbooks/system/system/system— REPORT sync-collection with per-server sync tokens, 404 tombstones via a cumulative Gone list (an opted-out user is actively deleted from the NC side, not just omitted), per-user vCards carryingCLOUD:user@instance.ocm-directory-override.Dogfood test path (Nikola): on Nextcloud → Settings → Federation, add
files-bao.c0rdyceps.ch(no trailing slash). The add should now be accepted; the row goes green after NC's background job completes the handshake (cron — may take a few minutes) and the first address-book sync runs (occ federation:sync-addressbooksforces it). After that, nikola-test should autocomplete in NC's share dialog for Cordyborski — nikola-test is listed to that server by derivation (accepted shares). The Cairn side is visible under Administration → Open Cloud Mesh → Directory and, as a user, Federated → Contacts → Where you appear. Any handshake trouble now logs astrusted-servers …lines in the pod log.Live end-to-end confirmation (2026-09-11), after v0.6.159–161 follow-ups:
Nextcloud completed the handshake (Cairn Directory tab: verified), ran its address-book sync, and downloaded exactly one vCard — the single user with a derived relationship to that server. Row green on the NC side; nikola-test autocompletes in its share dialog. The sovereign per-(user, server) directory works as designed against a real Nextcloud 34.
Follow-up fixes that made it work, all shipped: v0.6.159 (Directory tab in
ADM_TABS, neutral placeholder), v0.6.160 (in-app remove-server dialog), v0.6.161 (handshake callback follows the peer's OCS discovery — NC 34 serves the legacyGET /ocs/v2.php/cloud/shared-secretflavour, not the modern federation path). Operator-side prerequisites found during dogfooding, now in the handbook's troubleshooting picture: the NC instance must haveoverwrite.cli.urlset to its public name (it identifies itself with it in the handshake), and NC only turns the row green after its first address-book sync, which is a slow timed job —occ federation:sync-addressbooksforces it.