1.7 KiB
Hockeypuck Advanced Lookup Server
This server implements the WKD advanced hashing method for the 1337.berkeley.edu keyserver, something not implemented by default on the Hockeypuck Keyserver.
The primary distinction between the WKD and Hockeypuck is that the WKD lives on the 1337.berkeley.edu domain and Hockeypuck runs on keys.1337.berkeley.edu a domain which is not made public for security reasons (though this may change in the future).
Public keys served from the WKD are done dynamically as requests are sent to the /.well-known/ directory and then reformatted to match Hockeypuck's query format, done entirely in NGINX. This works for username lookups, but not for the advanced hashing methods which combines SHA1 and zbase32 hashing methods as a form of lookup, notably with the /hu/ subdirectory. Checkout the corresponding section in the key management guide in the wiki for more information and examples.
This server sits between NGINX and Hockeypuck. It creates a list of hashed usernames generated from the LDAP server and stores them as a key, and their values are the corresponding un-hashed usernames. When it recieves a request with a hash, it looks up the corresponding username and then resends the request to the basic username lookup endpoint and passes the resulting public key back. This works since the Hockeypuck server only supports username look ups, so no further modification needs to happen Hockeypuck's side.
[User makes request to /hu/] -> [NGINX forwards to HAL] -> [HAL finds associated username to the hash, sends request to Hockeypuck] -> [Hockeypuck returns public key]