ingest-router: Add relay signing and verification logic

Cargo.toml

@@ -5,6 +5,7 @@ default-members = ["synapse"]
 
 [workspace.dependencies]
 async-trait = "0.1.89"
+base64 = "0.22.1"
 http = "1.3.1"
 http-body-util = "0.1.3"
 hyper = { version = "1.7.0", features = ["full"] }

example_config_ingest_router.yaml

@@ -6,6 +6,18 @@ ingest_router:
     host: "0.0.0.0"
     port: 3001
 
+
+  # relay_keys:
+    # Verified downstream Relays (POPs) can be configured here, as a map of relay id to relay
+    # info.
+    # The relay id (the map key) must be a valid UUIDv4 string. This is the same ID that the
+    # Relay uses in its `X-Sentry-Relay-Id` header, and is used by Sentry to identify the relay.
+    # `public_key` must be the base64url-nopad encoding of the relay's 32 byte ed25519 public
+    # key (the `public_key` field of its credentials.json). This is the same value configured
+    # for the relay in the upstream's `static_relays`.
+    # "00000000-0000-0000-0000-000000000000":
+    #   public_key: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+
   # Locator service configuration for routing public keys to cells
   locator:
     type: in_process

ingest-router/Cargo.toml

@@ -5,6 +5,9 @@ edition = "2024"
 
 [dependencies]
 async-trait = { workspace = true }
+base64 = { workspace = true }
+chrono = { version = "0.4", features = ["clock", "serde"] }
+ed25519-dalek = "2"
 http = { workspace = true }
 http-body-util = { workspace = true }
 hyper = { workspace = true }