Remove the server watchdog and require a self-hosted address lookup with custom relays

[andrewchen5678]

What

Two changes toward the standard iroh architecture, in order:

1. Remove the server home-relay watchdog (relay_watchdog module, its test-only Tokio feature): servers rely on iroh 1.1.x for relay reconnects and re-homing and keep the same endpoint through relay outages. RebuildableEndpoint stays for client reconnect escalation.
2. Require a self-hosted address lookup service with custom relays. Custom relays turned every internet address lookup off, so a server that moved to another relay had no way to tell its clients; the watchdog compensated by pinning the server to a relay clients already knew. This puts the publish path back:
   • RelayConfig::resolve(RelaySettings) rejects custom relay_urls without lookup_url and lookup_secret, and rejects either without custom relays.
   • lookup::LookupSecret: lks1- + 39 lowercase z-base-32 characters encoding 20 random bytes and their CRC-32, so a typo fails at config load on either side (never case-folded; redacted in Debug). lookup::LookupConfig takes a scheme-and-host URL and composes <url>/<secret>/pkarr.
   • endpoint_builder installs iroh's pkarr resolver on every custom-relay endpoint and its publisher on endpoints that publish (relay-only mode included). Nothing goes to n0 with custom relays.
   • create_endpoint takes publishes_address and, on custom relays, publishes the record in the foreground once online, failing with the HTTP status if the service rejects it (a wrong secret is a 404 from the reverse proxy). Rebuilds leave publishing to iroh's background publisher.

Design and deployment recipe: flexaccessdev/iroh-common-architecture#6.

Tests

• Unit: secret format (CRC-32 check value, z-base-32 vectors, typo/truncation/uppercase rejection, redaction), URL validation, RelayConfig gating.
• Integration (tests/lookup.rs, in process, no network): a plain-HTTP iroh-relay server, a pkarr store gated by the secret prefix exactly like the documented Caddy handle_path block, a server that must publish through it, and a client that dials by endpoint id with no relay hints and reaches the server through the lookup alone. Plus: a well-formed but wrong secret fails endpoint creation with the 404; a client never publishes.

cargo clippy --all-targets --all-features -- -D warnings and cargo test --all-features pass.

Consumers

tunnel-rs is the first consumer (lookup_url / lookup_secret config, generate-lookup-secret, e2e scripts). ezvpn and flextunnel follow once that is good.

🤖 Generated with Claude Code

https://claude.ai/code/session_01D3hEPd7ueTS7hchgGK6Fqf