RAMBO

RAMBO stands for Rights, Accounts, Multi-factor, Bearer tokens & OAuth. It is a sign-in service, an OpenID Provider, written in Hilde with Wolly. It serves the projects around Hilde and is the OAuth and OpenID sign-in for Gitea. Source: github.com/heikozim/hilde-rambo. Built on github.com/heikozim/hilde-wolly and github.com/heikozim/hilde.

From Go to Hilde

The first RAMBO, go-rambo, was written in Go: an OpenID Provider for a fixed list of its own tools, as FastCGI behind Hiawatha, made for OpenBSD. There is nothing wrong with Go, and go-rambo did its work. The Hilde version keeps everything a relying party sees: the same endpoints, claims, token headers, cookie names, configuration keys and command line. It reads go-rambo's data as it is: its SQLite schema, the peppered Argon2id hashes, the sealed TOTP secrets and the vault.

What the Hilde version adds comes from Hilde:

• Contracts: every public function states its contract, and the build checks hold to that.
• Linear types: a value that holds a resource must be ended exactly once, and RAMBO has no unsafe module.
• ML-DSA-44: tokens are signed with ML-DSA-44 (JWK type AKP), or with the composite ML-DSA-44 with Ed25519, chosen per client. RSA is not offered. On OpenBSD ML-DSA comes from libcrux, without OpenSSL.
• Passkeys: sign-in without a name first (discoverable credentials), ES256 and EdDSA; passkeys are managed on the account page after a fresh sign-in, and listed and revoked on the command line.

No user management in the browser

User management runs on the command line, on purpose: accounts, clients, roles, sessions and keys. The web interface has no admin routes, only each user's own account page. The commands are those of go-rambo (serve, setup, account, client, role, session, keys rotate, version), and what they print is go-rambo's text where a script could read it. Help and usage come from Standard.Arguments, which follows the builder form of clap; go-rambo's command line was built with cobra.

Running

RAMBO runs as FastCGI on a Unix socket behind Hiawatha; the repository carries the configuration for Hiawatha and the scripts to move from go-rambo on OpenBSD. It writes its audit lines to the system log and confines itself with Hilde's sandbox.