0.3.3

Cargo.toml

@@ -1,5 +1,5 @@
 [workspace.package]
-version = "0.3.2"
+version = "0.3.3"
 authors = ["Jun Kurihara"]
 homepage = "https://github.com/junkurihara/modoh-server"
 repository = "https://github.com/junkurihara/modoh-server"

docker-otel/docker-compose.yml

@@ -3,6 +3,7 @@ services:
     image: otel/opentelemetry-collector-contrib:latest
     container_name: otel-collector
     restart: unless-stopped
+    user: "0:0" # run as root to access docker socket for env detection
     ports:
       - 127.0.0.1:4317:4317 # gRPC
       - 127.0.0.1:13133:13133 # health check
@@ -13,8 +14,8 @@ services:
       - 8889 # Prometheus exporter metrics
       - 8888 # Prometheus metrics exposed by the collector
     volumes:
-      - ./otel-config.yml:/etc/otel-config.yml
-      - /var/run/docker.sock:/var/run/docker.sock # docker env detector
+      - ./otel-config.yml:/etc/otel-config.yml:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro # docker env detector
       # - ./client_crt:/client_crt:ro # Needed to deploy on the internet
     command: ["--config=/etc/otel-config.yml"]
     logging:
@@ -62,39 +63,39 @@ services:
       options:
         max-size: "10m"
         max-file: "3"
-    depends_on:
-      - rclone
+    # depends_on:
+    #   - rclone
     networks:
       - net-otel
 
-  # Prometheus Remote Write Endpoint Storage (S3)
-  rclone:
-    image: rclone/rclone:latest
-    expose:
-      - 58080
-    container_name: rclone
-    security_opt:
-      - apparmor:unconfined
-    cap_add:
-      - SYS_ADMIN
-    # devices:
-    #   - /dev/fuse
-    env_file: .env
-    entrypoint: |
-      sh -c "
-        rclone serve s3 --auth-key ${ACCESS_KEY_ID},${SECRET_ACCESS_KEY} ${RCLONE_SERVER_NAME}:${S3_ROOT} --vfs-cache-mode writes --addr 0.0.0.0:58080 & \
-        wait
-      "
-    restart: always
-    volumes:
-      - ~/.config/rclone/rclone.conf:/config/rclone/rclone.conf:ro
-      - /tmp/rclone-cache:/root/.cache/
-    logging:
-      options:
-        max-size: "10m"
-        max-file: "3"
-    networks:
-      net-otel:
+  # # Prometheus Remote Write Endpoint Storage (S3)
+  # rclone:
+  #   image: rclone/rclone:latest
+  #   expose:
+  #     - 58080
+  #   container_name: rclone
+  #   security_opt:
+  #     - apparmor:unconfined
+  #   cap_add:
+  #     - SYS_ADMIN
+  #   # devices:
+  #   #   - /dev/fuse
+  #   env_file: .env
+  #   entrypoint: |
+  #     sh -c "
+  #       rclone serve s3 --auth-key ${ACCESS_KEY_ID},${SECRET_ACCESS_KEY} ${RCLONE_SERVER_NAME}:${S3_ROOT} --vfs-cache-mode writes --addr 0.0.0.0:58080 & \
+  #       wait
+  #     "
+  #   restart: always
+  #   volumes:
+  #     - ~/.config/rclone/rclone.conf:/config/rclone/rclone.conf:ro
+  #     - /tmp/rclone-cache:/root/.cache/
+  #   logging:
+  #     options:
+  #       max-size: "10m"
+  #       max-file: "3"
+  #   networks:
+  #     net-otel:
 
   # Visualize metrics
   grafana:

docker-otel/mimir.yml

@@ -5,14 +5,14 @@
 target: all,alertmanager,overrides-exporter
 
 common:
-  storage:
-    backend: s3
-    s3:
-      endpoint: rclone:58080
-      secret_access_key: "${SECRET_ACCESS_KEY}" # This is a secret injected via an environment variable
-      access_key_id: "${ACCESS_KEY_ID}" # This is a secret injected via an environment variable
-      bucket_name: "${S3_BUCKET_NAME}" # This is a secret injected via an environment variable
-      insecure: true
+  # storage:
+  #   backend: s3
+  #   s3:
+  #     endpoint: rclone:58080
+  #     secret_access_key: "${SECRET_ACCESS_KEY}" # This is a secret injected via an environment variable
+  #     access_key_id: "${ACCESS_KEY_ID}" # This is a secret injected via an environment variable
+  #     bucket_name: "${S3_BUCKET_NAME}" # This is a secret injected via an environment variable
+  #     insecure: true
 
 # Blocks storage requires a prefix when using a common object storage bucket.
 blocks_storage:

docker/Dockerfile-slim

@@ -2,7 +2,7 @@
 FROM rust:alpine AS builder
 
 ARG CFLAGS=-Ofast
-ARG BUILD_DEPS=musl-dev
+ARG BUILD_DEPS="musl-dev pkgconfig openssl-dev openssl-libs-static"
 
 # ARG BUILD_DEPS="curl make ca-certificates build-essential pkg-config libssl-dev"
 

httpsig-registry/Cargo.toml

@@ -13,22 +13,22 @@ edition.workspace = true
 publish.workspace = true
 
 [dependencies]
-anyhow = { version = "1.0.99" }
-thiserror = { version = "2.0.16" }
+anyhow = { version = "1.0.101" }
+thiserror = { version = "2.0.18" }
 pulldown-cmark = { version = "0.13.0", default-features = false }
-http = { version = "1.3.1" }
-indexmap = { version = "2.11.1" }
+http = { version = "1.4.0" }
+indexmap = { version = "2.13.0" }
 minisign-verify = { version = "0.2.4" }
-reqwest = { version = "0.12.23", default-features = false, features = [
-  "rustls-tls",
+reqwest = { version = "0.13.2", default-features = false, features = [
+  "native-tls",
   "http2",
   "hickory-dns",
 ] }
 futures = { version = "0.3.31", default-features = false, features = [
   "std",
   "async-await",
 ] }
-tokio = { version = "1.47.1", features = [
+tokio = { version = "1.49.0", features = [
   "net",
   "rt-multi-thread",
   "time",

httpsig-wire-proto/Cargo.toml

@@ -13,16 +13,16 @@ edition.workspace = true
 publish.workspace = true
 
 [dependencies]
-anyhow = "1.0.99"
-thiserror = "2.0.16"
+anyhow = "1.0.101"
+thiserror = "2.0.18"
 rand = "0.9.2"
 hpke = "0.13.0"
-bytes = "1.10.1"
+bytes = "1.11.1"
 byteorder = "1.5.0"
 p256 = { version = "0.13.2" }
 elliptic-curve = { version = "0.13.8", features = ["ecdh"] }
-ed25519-compact = { version = "2.1.1" }
-digest = "0.10.7"
+ed25519-compact = { version = "2.2.0" }
+digest = "0.11.0"
 sha2 = "0.10.9"
 hkdf = "0.12.4"
-httpsig = "0.0.19"
+httpsig = "0.0.23"

httpsig-wire-proto/src/dh.rs

@@ -7,10 +7,10 @@ use byteorder::{BigEndian, ByteOrder};
 use bytes::{Buf, BufMut, Bytes};
 use elliptic_curve::ecdh;
 use hpke::{
+  Serializable,
   generic_array::GenericArray,
-  kdf::{extract_and_expand, HkdfSha256, Kdf},
+  kdf::{HkdfSha256, Kdf, extract_and_expand},
   kem::{DhP256HkdfSha256, Kem, SharedSecret, X25519HkdfSha256},
-  Serializable,
 };
 use rand::{CryptoRng, RngCore};
 

httpsig-wire-proto/src/pk.rs

@@ -1,11 +1,11 @@
 use crate::{
-  common::{read_lengthed, to_u16, Deserialize, Serialize},
+  common::{Deserialize, Serialize, read_lengthed, to_u16},
   error::HttpSigError,
 };
 use bytes::{Buf, BufMut, Bytes};
 use hpke::{
-  kem::{DhP256HkdfSha256, X25519HkdfSha256},
   Kem, Serializable,
+  kem::{DhP256HkdfSha256, X25519HkdfSha256},
 };
 use httpsig::prelude::{AlgorithmName, PublicKey, SecretKey};
 use rand::{CryptoRng, RngCore};
@@ -76,7 +76,7 @@ impl HttpSigPkKeyPair {
   /// export private key as `httpsig` crate's `SecretKey`
   pub fn try_export_sk(&self) -> Result<SecretKey, HttpSigError> {
     let alg_name = self.public_key.alg_name();
-    let res = SecretKey::from_bytes(alg_name, self.private_key.to_vec().as_slice())?;
+    let res = SecretKey::from_bytes(&alg_name, self.private_key.to_vec().as_slice())?;
     Ok(res)
   }
 }
@@ -92,7 +92,7 @@ impl HttpSigPkConfigContents {
   /// export public key as `httpsig` crate's `PublicKey`
   pub fn try_export(&self) -> Result<PublicKey, HttpSigError> {
     let alg_name = self.alg_name();
-    let res = PublicKey::from_bytes(alg_name, self.public_key.to_vec().as_slice())?;
+    let res = PublicKey::from_bytes(&alg_name, self.public_key.to_vec().as_slice())?;
     Ok(res)
   }
   /// Get the algorithm name in `httpsig` crate

modoh-bin/Cargo.toml

@@ -52,47 +52,47 @@ modoh-server-lib = { path = "../modoh-lib", default-features = false, features =
   "rustls",
 ] }
 
-anyhow = "1.0.99"
+anyhow = "1.0.101"
 mimalloc = { version = "*", default-features = false }
-serde = { version = "1.0.219", default-features = false, features = ["derive"] }
+serde = { version = "1.0.228", default-features = false, features = ["derive"] }
 derive_builder = "0.20.2"
-tokio = { version = "1.47.1", default-features = false, features = [
+tokio = { version = "1.49.0", default-features = false, features = [
   "net",
   "rt-multi-thread",
   "time",
   "sync",
   "macros",
 ] }
 async-trait = "0.1.89"
-url = "2.5.7"
+url = "2.5.8"
 
 # config
-clap = { version = "4.5.47", features = ["std", "cargo", "wrap_help"] }
-toml = { version = "0.9.5", default-features = false, features = [
+clap = { version = "4.5.58", features = ["std", "cargo", "wrap_help"] }
+toml = { version = "1.0.1+spec-1.1.0", default-features = false, features = [
   "parse",
   "serde",
 ] }
-hot_reload = "0.2.0"
+hot_reload = "0.3.5"
 
 # tracing and metrics
-tracing = { version = "0.1.41" }
-tracing-subscriber = { version = "0.3.20", features = ["fmt"] }
-tracing-opentelemetry = { version = "0.31.0", optional = true }
-opentelemetry = { version = "0.30.0", optional = true }
-opentelemetry_sdk = { version = "0.30.0", features = [
+tracing = { version = "0.1.44" }
+tracing-subscriber = { version = "0.3.22", features = ["fmt"] }
+tracing-opentelemetry = { version = "0.32.1", optional = true }
+opentelemetry = { version = "0.31.0", optional = true }
+opentelemetry_sdk = { version = "0.31.0", features = [
   "rt-tokio",
   "spec_unstable_metrics_views",
 ], optional = true }
-opentelemetry-stdout = { version = "0.30.0", optional = true }
-opentelemetry-otlp = { version = "0.30.0", optional = true, features = [
+opentelemetry-stdout = { version = "0.31.0", optional = true }
+opentelemetry-otlp = { version = "0.31.0", optional = true, features = [
   "grpc-tonic",
 ] }
-opentelemetry-semantic-conventions = { version = "0.30.0", optional = true, features = [
+opentelemetry-semantic-conventions = { version = "0.31.0", optional = true, features = [
   "semconv_experimental",
 ] }
 
 # add random otel service id whenever restarting
-uuid = { version = "1.18.1", default-features = false, features = [
+uuid = { version = "1.21.0", default-features = false, features = [
   "v4",
   "fast-rng",
 ], optional = true }

modoh-lib/Cargo.toml

@@ -32,25 +32,25 @@ futures = { version = "0.3.31", default-features = false, features = [
   "std",
   "async-await",
 ] }
-tokio = { version = "1.47.1", features = [
+tokio = { version = "1.49.0", features = [
   "net",
   "rt-multi-thread",
   "time",
   "sync",
   "macros",
 ] }
-anyhow = "1.0.99"
-tracing = "0.1.41"
-thiserror = "2.0.16"
+anyhow = "1.0.101"
+tracing = "0.1.44"
+thiserror = "2.0.18"
 async-trait = "0.1.89"
 
 # http handling for both client and server
-url = "2.5.7"
+url = "2.5.8"
 ahash = "0.8.12"
-hyper = { version = "1.7.0", default-features = false }
-http = "1.3.1"
+hyper = { version = "1.8.1", default-features = false }
+http = "1.4.0"
 http-body-util = "0.1.3"
-hyper-util = { version = "0.1.16", features = ["full"] }
+hyper-util = { version = "0.1.20", features = ["full"] }
 
 # http handling for client
 hyper-tls = { version = "0.6.0", features = [
@@ -65,39 +65,39 @@ hyper-rustls = { version = "0.27.7", default-features = false, features = [
 ], optional = true }
 
 # modoh target handling
-odoh-rs = { git = "https://github.com/junkurihara/odoh-rs", rev = "789848b0e0fe77d409fb08fcbfffc32899a71697" }
+odoh-rs = { git = "https://github.com/junkurihara/odoh-rs", rev = "f4d4c5d246d99fac4bd51559ee5826c9d491c114" }
 rand = "0.9.2"
 base64 = "0.22.1"
 byteorder = "1.5.0"
 
 # validation of id token
-serde = { version = "1.0.219", default-features = false }
+serde = { version = "1.0.228", default-features = false }
 auth-validator = { git = "https://github.com/junkurihara/rust-token-server", package = "rust-token-server-validator", branch = "develop", default-features = false, features = [
   "blind-signatures",
 ] }
-serde_json = { version = "1.0.143" }
+serde_json = { version = "1.0.149" }
 
 # access control
 ipnet = { version = "2.11.0" }
 cedarwood = { version = "0.4.6" }
-regex = { version = "1.11.2" }
+regex = { version = "1.12.3" }
 
 # metrics
-opentelemetry = { version = "0.30.0", optional = true }
-opentelemetry_sdk = { version = "0.30.0", features = [
+opentelemetry = { version = "0.31.0", optional = true }
+opentelemetry_sdk = { version = "0.31.0", features = [
   "rt-tokio",
 ], optional = true }
 
 # tracing requests traveled among relays and targets
 # NOTE: DO NOT USE THIS IN PRODUCTION
-tracing-opentelemetry = { version = "0.31.0", optional = true }
+tracing-opentelemetry = { version = "0.32.1", optional = true }
 
 # httpsig
 httpsig-proto = { path = "../httpsig-wire-proto", default-features = false, package = "httpsig-proto" }
 httpsig-registry = { path = "../httpsig-registry", default-features = false, package = "httpsig-registry" }
-indexmap = { version = "2.11.1" }
-httpsig = { version = "0.0.19" }
-httpsig-hyper = { version = "0.0.19" }
+indexmap = { version = "2.13.0" }
+httpsig = { version = "0.0.23" }
+httpsig-hyper = { version = "0.0.23" }
 
 # logging
 crossbeam-channel = { version = "0.5.15", optional = true }

modoh-lib/src/constants.rs

@@ -18,8 +18,12 @@ pub const UPSTREAM: &str = "8.8.8.8:53";
 pub const ERROR_TTL: u32 = 2;
 pub const MAX_TTL: u32 = 604800;
 pub const MIN_TTL: u32 = 10;
-pub const STALE_IF_ERROR_SECS: u32 = 86400;
-pub const STALE_WHILE_REVALIDATE_SECS: u32 = 60;
+pub const STALE_IF_ERROR_SECS: u32 = 300;
+pub const STALE_WHILE_REVALIDATE_SECS: u32 = 5;
+/// ODoH Config cache is expired after at least 10 seconds
+pub const MAX_ODOH_CONFIG_TTL_SECS: u64 = 10;
+/// HTTPSig Config cache is expired after at least 10 seconds
+pub const MAX_HTTPSIG_CONFIG_TTL_SECS: u64 = 10;
 
 /// Maximum ratio of TCP sessions to UDP sessions
 pub const TARGET_UDP_TCP_RATIO: usize = 8;

modoh-lib/src/httpsig_handler/handler_main.rs

@@ -45,7 +45,7 @@ where
   C: Send + Sync + Connect + Clone + 'static,
   B: Body + Send + Unpin + 'static,
   <B as Body>::Data: Send,
-  <B as Body>::Error: Into<Box<(dyn std::error::Error + Send + Sync + 'static)>>,
+  <B as Body>::Error: Into<Box<dyn std::error::Error + Send + Sync + 'static>>,
 {
   /// force to refetch notifier for the public keys
   pub(super) force_refetch_notify: Arc<tokio::sync::Notify>,