network(ethp2p): enable with just ZEAM_ETHP2P=1 — auto-derive endpoints + per-node runtime TLS cert

[ch4r10t33r]

Continues #1045 (GitHub won't reopen a closed PR whose branch was force-pushed). Same branch, rebased onto current main, scoped to only the pieces not already merged via #1046/#1047 — now with the TLS cert generated at runtime (per the review feedback below).

The ethp2p adapter and env-config layer already landed on main; this adds what makes it turnkey.

What this adds (on top of main)

• Auto-derived endpoints. buildEthp2pConfig derives the ethp2p listen address + static peers from the node's own libp2p QUIC addresses, shifted by ZEAM_ETHP2P_PORT_OFFSET (default +1, the ethlambda convention). Set ZEAM_ETHP2P=1 and it wires itself; explicit env still overrides.
• Per-node TLS cert generated at runtime — EthLibp2p.generateAuxQuicCertPems() mints a fresh self-signed cert bound to the node's secp256k1 host identity via the same libp2p_tls_cert.generate facility the primary QUIC transport uses. The PEMs are written under the node's data dir (the adapter consumes cert/key by path — it has no in-memory PEM entry point) and overridable via ZEAM_ETHP2P_SERVER_CERT / _KEY.

Addressing the review

• No committed keypair. The earlier revision shipped a shared resources/ethp2p/{cert,key}.pem — removed. Certs are now unique per node and per process, exactly like libp2p mints its own.
• Why not literally reuse the libp2p cert? The primary transport's cert is generated in EthLibp2p.run(), which runs after beam_node.init sets up the ethp2p listener — so at that point no cert exists yet. Generating a dedicated per-node cert from the same host identity via the same facility gives the identical security property without reordering init.
• Identity ≠ cert. Peer identity is the node's unique node_key; the cert is only the QUIC listener's TLS server identity.
• No regression: excludes the old network(ethp2p): enable with just ZEAM_ETHP2P=1 — auto-derive endpoints from libp2p ports + bundled devnet cert #1045 node.zig hunk that predated/would revert the sync-wedge fix (sync: stop wedging on a false "peer does not support blocks_by_range" #1046). CI's -Dethp2p=true compile step (from cli(ethp2p): unique per-node identity + operator-configurable peering + CI coverage #1047) covers it.

Invocation

docker build --build-arg ETHP2P=true -t zeam-ethp2p .
docker run -e ZEAM_ETHP2P=1 ...   # endpoints + per-node cert auto-generated

Doubly gated (-Dethp2p=true build AND ZEAM_ETHP2P); default build/test unaffected.

Validation

• zig build -Dethp2p=true ✅ · default zig build ✅ · zig fmt --check ✅
• generateAuxQuicCertPems is a direct reuse of the proven startQuicTransport cert-gen path; memory ownership audited (listen/peers/cert/key paths freed after init; node_key retained by the engine, outlives the process).

[ch4r10t33r]

Updated per review: dropped the committed shared cert.pem/key.pem and now generate a per-node self-signed TLS cert at runtime from the node's host identity, using the same libp2p_tls_cert.generate facility the primary libp2p QUIC transport uses (EthLibp2p.generateAuxQuicCertPems). It can't literally reuse the libp2p cert because that one is minted in run(), after beam_node.init wires the ethp2p listener — so no cert exists yet at that point; a dedicated per-node cert from the same identity gives the same property. Overridable via ZEAM_ETHP2P_SERVER_CERT/_KEY.

[ch4r10t33r]

Local 2-node ethp2p smoke — runtime cert validated

Ran a local 2-node smoke on lean-quickstart (branch ethp2p) with a locally-built zeam -Dethp2p=true, ZEAM_ETHP2P=1, genesis local-devnet/genesis.

Result: the runtime-generated per-node TLS cert completes a real, stable ethp2p QUIC handshake. Both nodes reached and held connected_peers=1 (verified via a temporary peer-count probe on BroadcastNode.peers, since removed): zeam_1 dialed zeam_0:9002, TLS negotiated against the freshly-minted generateAuxQuicCertPems cert (subject O=libp2p.io, ephemeral ECDSA-P256 key), the BCAST handshake completed, and each side registered the other as a peer. Sustained across 11 consecutive probes, both processes alive.

Fix included in this push (32dce7f)

Found and fixed a self-dial bug: the genesis peer list (nodes.yaml) always contains this node itself, so the derived static_peers included our own ethp2p listen port. connect() is synchronous and blocks start() in its handshake-poll loop; a self-dial never completes (the server-side accept only runs later in tick()), stalling the dial loop before it reached the real peers. Now skip any connect-peer whose libp2p QUIC port matches our own.

Known limitation (not blocking; follow-up)

Static-peer dials are synchronous and one-shot at start(), before either node enters its tick()/accept loop. connect() polls only dial_ep, not listen_ep, so a node blocked dialing cannot service inbound accepts. With simultaneous container starts, both nodes can block dialing each other before either accepts → no ethp2p peering, with no retry. The smoke worked by staggering (dialer launched only after the responder reached its accept loop) and pinning ZEAM_ETHP2P_STATIC_PEERS to just the peer. A robust deployment needs deferred/non-blocking dials + retry in zig_ethp2p (upstream follow-up).

[zclawz]

I reviewed #1049 adversarially. I am not approving yet; I found one blocking security issue.

Blocking finding:

• pkgs/cli/src/node.zig:137 writes the generated ethp2p private-key PEM with createFile(io, path, .{ .truncate = true }), which uses Zig's default file permissions (0o666 before umask). That means the generated TLS private key can be world/group-readable under common umasks. Even though the cert key is runtime-generated and not the node host key, copying {database_path}/ethp2p/key.pem plus the signed cert is enough to impersonate that ethp2p QUIC listener for the cert lifetime. Since this PR's main security improvement is “no committed/shared keypair”, the runtime key needs owner-only permissions on creation, e.g. create/open with permissions = 0o600 (and ideally do not rely on umask).

Other checks looked fine:

• Env-only enablement stays double-gated by -Dethp2p=true and ZEAM_ETHP2P.
• Auto-derived listen/static-peer endpoints preserve explicit env overrides.
• Self-entry skipping by own libp2p UDP port matches the genesis bootnode list shape.
• generateAuxQuicCertPems reuses the libp2p TLS cert generation path and avoids committed key material.

Validation I ran:

• zig fmt --check pkgs/cli/src/node.zig pkgs/network/src/ethlibp2p.zig
• git diff --check origin/main...HEAD
• Started /tmp/zig-0.16.0/zig build -Dethp2p=true --summary all with Rust on PATH; stopped it after the review blocker was confirmed, while it was still compiling Rust glue. No compile failure was observed before stopping.

Once the PEM private key is created with owner-only permissions, I expect this to be good to merge from my side.

[ch4r10t33r]

The blocking finding (world/group-readable ethp2p private key) is addressed in follow-up #1051: the key PEM is now created 0o600 (owner-only), verified on disk as -rw-------. Thanks @zclawz.

[zclawz]

Thanks for the update @ch4r10t33r! Good to see the key permissions hardened to 0o600 in #1051. 👍

[zclawz]

Thanks for the heads up, @ch4r10t33r! Glad the key-permission fix landed in #1051 — 0o600 is the right posture for a private key. Nothing more needed on my end here. 🔒