Audit of the public repo against the actual server and konduit-ctl source.
The happy path was documented; the failure modes were not.
- server.toml had no reference at all. Add docs/server-config.md covering
every key, [tls], the control API, and key handling.
- The mantra could not recover the identity key on its own:
derive_from_passphrase needs the [kdf] salt, which is 32 random bytes
generated once at bootstrap. bootstrap says so in the file it generates
(core/src/config.rs:403); the quickstart claimed the opposite. Fixed, with
a backup step added before it is needed rather than after.
- konduit-server never appeared in a download step, yet
konduit-server.service expects /opt/konduit/konduit-server - a path no
instruction created. Added the install section and moved setcap after the
copy, since capabilities do not survive every cross-filesystem copy and a
binary that silently lost cap_net_bind_service fails at bind time.
- Hot config reload was a headline feature with no documented mechanism. It
is a control API on 127.0.0.1:3001, and add-client only edits the file on
disk, so a new peer is not live until something reloads it. Documented,
including that /reload does not disconnect revoked peers but /sync does.
- [tls] native termination was entirely undocumented; the key must be PKCS#8.
- Dropped a README claim about a konduit-admin-ui unit that does not exist,
and fixed a systemd copy path that only resolved if this repo had been
cloned to /opt/konduit.
#k-ops/#1/#211
Both sections showed
./konduit connect --config client.toml --use-proxy ...
which cannot work. `--config` is declared on the top-level Args struct,
while `--use-proxy` and `--listen-socks` belong to the `connect`
subcommand, so clap rejects the combination outright:
$ konduit connect --config client.toml --use-proxy socks5://...
error: unexpected argument '--config' found
$ konduit --config client.toml --use-proxy socks5://...
error: unexpected argument '--use-proxy' found
Neither ordering works — an invocation has to pick one style: config file
(everything from the file) or `connect` subcommand (everything as flags).
Replaced with the full flag form and said so explicitly, since "or via the
CLI" read as though you could bolt a flag onto a config-file run.
Both replacement command lines were run against the built binary to
confirm they parse; they get as far as the connection attempt.
