feat(infra): import the IPNS signing key in the aggregator IPFS node

[jpraynaud]

Content

This PR includes the infrastructure and CI support for the IPNS signing key used by the aggregator IPFS node to publish the immutable archives directory:

• Add the mithril_ipfs_ipns_signing_key Terraform variable (PEM PKCS#8 format, base64 encoded, optional) and the mithril_ipfs_ipns_signing_key_name Terraform variable (defaults to mithril-snapshot)
• Import the signing key under its name when the IPFS node starts, replacing any existing key so a rotated key is applied
• Add ipns_key_name to the aggregator IPFS_RPC_SERVER_CONFIG when a signing key is set
• Add the mithril_ipfs_ipns_signing_key input to the deploy action, base64 encoded in the prepare step like the GCP KMS credentials
• Pass the IPFS_IPNS_SIGNING_KEY secret in the ci, pre-release, release and test-deploy-network workflows (harmless unless IPFS is enabled on the deployment)
• Bump the Kubo default version to v0.43.1
• Add a runbook to create, register and rotate the IPNS signing key, and compute its IPNS name

Pre-submit checklist

• Branch
  • Crates versions are updated (if relevant)
  • CHANGELOG file is updated (if relevant)
  • Commit sequence broadly makes sense
  • Key commits have useful messages
• PR
  • All check jobs of the CI have succeeded
  • Self-reviewed the diff
  • Useful pull request description
  • Reviewer requested

Issue(s)

Relates to #3606

[Copilot]

🟡 Changes recommended

Unresolved critical Terraform-state secret exposure and moderate issues affect key rotation, IPNS publishing, and existing-node bootstrap.

2 open findings

• Private key is persisted in Terraform state via trigger · New
• IPNS key configuration is ignored and never used for publishing · New

What changed in this PR

Adds Terraform, CI, Docker, and runbook support for importing an IPNS signing key into the aggregator’s IPFS node.

Changes:

• Adds configurable signing-key variables and updates Kubo to v0.43.1.
• Passes and imports the key during deployments.
• Documents key creation, registration, and rotation.

Unresolved review findings:

• Critical (3 votes): The private key is persisted in Terraform state through resource triggers.
• Moderate (3 votes): ipns_key_name is ignored because aggregator publishing support is missing.
• Moderate (1 vote): Regex matching can break key rotation for names containing special characters.
• Moderate (1 vote): Existing nodes may not receive the new startup assets.

File	Summary
mithril-infra/​variables.tf	Adds IPNS variables and updates the Kubo version.
mithril-infra/​mithril.aggregator.tf	Passes signing-key material and IPNS configuration.
mithril-infra/​assets/​docker/​ipfs/​container-init.d/​configure-node.sh	Imports or rotates the IPFS signing key.
mithril-infra/​assets/​docker/​docker-compose-aggregator-ipfs-override.yaml	Supplies key-related environment variables.
docs/​runbook/​README.md	Registers the IPNS signing-key runbook.
docs/​runbook/​ipns-signing-key/​README.md	Documents key creation, registration, and rotation.
.github/​workflows/​test-deploy-network.yml	Passes the IPNS secret for test deployments.
.github/​workflows/​release.yml	Passes the IPNS secret for releases.
.github/​workflows/​pre-release.yml	Passes the IPNS secret for pre-releases.
.github/​workflows/​ci.yml	Passes the IPNS secret in CI.
.github/​workflows/​actions/​deploy-terraform-infrastructure/​action.yml	Adds and encodes the deployment input.

🧠 Review effort: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Test Results

     5 files  ± 0     226 suites  ±0   1h 0m 26s ⏱️ - 1h 1m 40s
 3 996 tests  - 60   3 996 ✅  - 60  0 💤 ±0  0 ❌ ±0 
12 627 runs   - 69  12 627 ✅  - 69  0 💤 ±0  0 ❌ ±0 

Results for commit 772f3f1. ± Comparison against base commit 6b29cde.

This pull request removes 60 tests.

mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::index_out_of_bounds
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::index_too_large_for_circuit_range
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::indices_not_increasing
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_merkle_path_mismatch
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_swap_keep_merkle_path
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_wrong_verification_key
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_corrupt_sibling
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_flip_position
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_length_long
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_length_short
…

♻️ This comment has been updated with latest results.

[Alenar]

LGTM, the fact with the Kubo terminology that there's an "IPNS key name" (the local name of the key pair) and a "IPNS name" (the name of the IPNS record in the IPFS network) is confusing 😅.

[damrobi]

LGTM 👍

[turmelclem]

LGTM 👍