Audit of the public repo against the actual server and konduit-ctl source.
The happy path was documented; the failure modes were not.
- server.toml had no reference at all. Add docs/server-config.md covering
every key, [tls], the control API, and key handling.
- The mantra could not recover the identity key on its own:
derive_from_passphrase needs the [kdf] salt, which is 32 random bytes
generated once at bootstrap. bootstrap says so in the file it generates
(core/src/config.rs:403); the quickstart claimed the opposite. Fixed, with
a backup step added before it is needed rather than after.
- konduit-server never appeared in a download step, yet
konduit-server.service expects /opt/konduit/konduit-server - a path no
instruction created. Added the install section and moved setcap after the
copy, since capabilities do not survive every cross-filesystem copy and a
binary that silently lost cap_net_bind_service fails at bind time.
- Hot config reload was a headline feature with no documented mechanism. It
is a control API on 127.0.0.1:3001, and add-client only edits the file on
disk, so a new peer is not live until something reloads it. Documented,
including that /reload does not disconnect revoked peers but /sync does.
- [tls] native termination was entirely undocumented; the key must be PKCS#8.
- Dropped a README claim about a konduit-admin-ui unit that does not exist,
and fixed a systemd copy path that only resolved if this repo had been
cloned to /opt/konduit.
#k-ops/#1/#211
