Add encryption notes.

notes/encrypting-zenoh.md

@@ -0,0 +1,83 @@
+# Encrypting Zenoh Traffic
+
+## Make the CA and Certs
+
+Use the tools we have for that!
+
+git.jpace121.net:2222/public/j7s-ca
+
+```
+7s_mk_ca --org-name test -o ca
+j7s_mk_cert --common-name test-node --identity-type domain --identity node.test.internal.jpace121.net --auth-mode server --ca ./ca/ -o cert
+```
+
+## Change the configs
+
+```
+diff --git a/config/ROUTER_CONFIG.json5 b/config/ROUTER_CONFIG.json5
+index d425fa6..2cb06a0 100644
+--- a/config/ROUTER_CONFIG.json5
++++ b/config/ROUTER_CONFIG.json5
+@@ -12,7 +12,7 @@
+   /// Which endpoints to listen on. E.g. tcp/0.0.0.0:7447.
+   listen: {
+     endpoints: [
+-      "tcp/0.0.0.0:7447",
++      "tls/0.0.0.0:7447",
+     ],
+   },
+   /// Configure the scouting mechanisms and their behaviours
+@@ -44,6 +44,12 @@
+       },
+     },
+     link: {
++      tls: {
++         root_ca_certificate: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/ca/cert.pem",
++         listen_private_key: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/cert/key.pem",
++         listen_certificate: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/cert/cert.pem",
++         verify_name_on_connect: false,
++      },
+       tx: {
+         queue: {
+           congestion_control: {
+diff --git a/config/SESSION_CONFIG.json5 b/config/SESSION_CONFIG.json5
+index 17fd660..785cbf5 100644
+--- a/config/SESSION_CONFIG.json5
++++ b/config/SESSION_CONFIG.json5
+@@ -7,7 +7,7 @@
+   /// We only connect our local router at first.
+   connect: {
+     endpoints: [
+-      "tcp/localhost:7447",
++      "tls/0.0.0.0:7447",
+     ],
+     retry: {
+        period_init_ms: 100,
+@@ -21,7 +21,7 @@
+   /// "tcp/[::]:0", "udp/0.0.0.0:0?rel=1;mixed_rel=1"
+   listen: {
+     endpoints: [
+-      "tcp/0.0.0.0:0", "udp/0.0.0.0:0?rel=1;mixed_rel=1"
++      "quic/0.0.0.0:0"
+     ],
+   },
+ 
+@@ -52,6 +52,12 @@
+       },
+     },
+     link: {
++      tls: {
++         root_ca_certificate: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/ca/cert.pem",
++         listen_private_key: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/cert/key.pem",
++         listen_certificate: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/cert/cert.pem",
++         verify_name_on_connect: false,
++      },
+       tx: {
+         queue: {
+           congestion_control: {
+
+```
+
+Note: Can also TLS instead of quic. I tried both, and just saved the last one.
+
+Inspect the traffic in wireshark!