sudo ./build/projects/LemonadeNexus/lemonade-nexus --root-pubkey 7238fff28a315ff5a9af20fdd6b55c39736c2f598b5ceed98e33ee9bff4cebdc --data-root ./data --config ./data/lemonade-nexus.json
[2026-05-27 13:11:56.073] [info] Loaded config from ./data/lemonade-nexus.json
[2026-05-27 13:11:56.073] [info] Lemonade-Nexus starting...
[2026-05-27 13:11:56.073] [warning] Config: no seed_peers — this server won't gossip until peers are added
[2026-05-27 13:11:56.073] [info] Config: HTTP:8443 UDP/WG:41820 Gossip:8102 STUN:3478 Relay:8103 DNS:5353 data=./data
[2026-05-27 13:11:56.073] [warning] [SodiumCryptoService] AES-256-GCM not available — using XChaCha20-Poly1305 fallback (equally secure, software-only)
[2026-05-27 13:11:56.073] [info] [SodiumCryptoService] libsodium initialized (version 1.0.20)
[2026-05-27 13:11:56.073] [info] [FileStorageService] initialized at './data' (next delta seq: 1)
[2026-05-27 13:11:56.073] [info] [KeyWrappingService] identity public key loaded: c29685b7...
[2026-05-27 13:11:56.093] [info] [BinaryAttestationService] binary SHA-256: 7d4097bfd7b4e031d46213df0bb27fc86bdb6134abe59b47de7c727ef8c70bb3
[2026-05-27 13:11:56.093] [info] [BinaryAttestationService] started (0 manifests loaded)
[2026-05-27 13:11:56.093] [warning] [TeeAttestationService] no TEE hardware detected — this server will operate as Tier 2 (certificate-only, hole punching only)
[2026-05-27 13:11:56.093] [info] [TeeAttestationService] started (platform: none)
[2026-05-27 13:11:56.093] [info] [TrustPolicyService] started (our TEE platform: none, our tier: Tier2)
[2026-05-27 13:11:56.093] [info] [PermissionTreeService] loaded 0 nodes from storage
[2026-05-27 13:11:56.093] [info] [IPAMService] started (0 customer allocations loaded)
[2026-05-27 13:11:56.093] [info] RootKeyChain: loaded chain with 1 entries, current root: c29685b79e82657e...
[2026-05-27 13:11:56.093] [info] [GossipService] democratic governance enabled
[2026-05-27 13:11:56.093] [info] [GossipService] loaded identity keypair
[2026-05-27 13:11:56.093] [warning] [GossipService] no server certificate found — gossip peer verification will be limited
[2026-05-27 13:11:56.093] [info] [GossipService] no peers.json found, starting with empty peer list
[2026-05-27 13:11:56.093] [info] [GossipService] listening on UDP port 8102 (pubkey: 0Pp3dKbgCRlbgTKBm2XTIjrhxWr81roh/wr9UPHP64Q=, peers: 0)
[2026-05-27 13:11:56.093] [info] [DdnsService] started (credentials=no, hostname=(none), domain=(none))
[2026-05-27 13:11:56.093] [info] [StunService] listening on UDP port 3478 (server_id: 'lemonade-nexus-central', pubkey: a22d8405...)
[2026-05-27 13:11:56.093] [info] [RelayService] listening on UDP port 8103
[2026-05-27 13:11:56.093] [info] [RelayDiscoveryService] starting -- loading relay list from storage
[2026-05-27 13:11:56.093] [info] [RelayDiscoveryService] loaded 0 relay nodes (0 trusted)
[2026-05-27 13:11:56.093] [info] [AcmeService] scanned certs directory: 0 valid certificate(s) found
[2026-05-27 13:11:56.093] [info] [AcmeService] started (provider: 'ZeroSSL', dns: 'local', staging: false)
[2026-05-27 13:11:56.195] [info] [HostnameGenerator] geolocation: Fresno, United States (Comcast Cable Communications, LLC) -> region: us-west
[2026-05-27 13:11:56.195] [info] [HostnameGenerator] persisted hostname 'us-west-1' to ./data/identity/hostname
[2026-05-27 13:11:56.195] [info] Auto-generated server hostname: us-west-1 (region: us-west)
[2026-05-27 13:11:56.269] [info] [HostnameGenerator] geolocation: Fresno, United States (Comcast Cable Communications, LLC) -> region: us-west
[2026-05-27 13:11:56.269] [info] Region: auto-detected 'us-west', persisted
[2026-05-27 13:11:56.269] [info] DNS: auto-derived NS hostname: us-west-1.lemonade-nexus.io
[2026-05-27 13:11:56.400] [info] DNS: auto-detected public IP: 76.158.109.200
[2026-05-27 13:11:56.400] [info] [DnsService] our nameserver: us-west-1.lemonade-nexus.io (76.158.109.200)
[2026-05-27 13:11:56.400] [info] [DnsService] added nameserver us-west-1.lemonade-nexus.io -> 76.158.109.200
[2026-05-27 13:11:56.400] [info] DNS: registered as nameserver us-west-1.lemonade-nexus.io -> 76.158.109.200
[2026-05-27 13:11:56.400] [info] [AcmeService] using local authoritative DNS for ACME challenges
[2026-05-27 13:11:56.400] [info] [DnsService] set dynamic TXT _config.us-west-1.lemonade-nexus.io -> v=sp1 http=8443 udp=41820 gossip=8102 stun=3478 relay=8103 dns=5353 private_http=9101 region= load=0 host=us-west-1.srv.lemonade-nexus.io (TTL 300)
[2026-05-27 13:11:56.400] [info] [DnsService] published _config record: _config.us-west-1.lemonade-nexus.io -> v=sp1 http=8443 udp=41820 gossip=8102 stun=3478 relay=8103 dns=5353 private_http=9101 region= load=0 host=us-west-1.srv.lemonade-nexus.io
[2026-05-27 13:11:56.400] [info] DNS: published _config TXT for us-west-1 (host=us-west-1.srv.lemonade-nexus.io)
[2026-05-27 13:11:56.400] [info] Derived server node ID from identity pubkey: server-c29685b79e82657e
[2026-05-27 13:11:56.400] [info] [DnsService] set dynamic TXT _config.server-c29685b79e82657e.lemonade-nexus.io -> v=sp1 http=8443 udp=41820 gossip=8102 stun=3478 relay=8103 dns=5353 private_http=9101 region= load=0 host=us-west-1.srv.lemonade-nexus.io (TTL 300)
[2026-05-27 13:11:56.400] [info] [DnsService] published _config record: _config.server-c29685b79e82657e.lemonade-nexus.io -> v=sp1 http=8443 udp=41820 gossip=8102 stun=3478 relay=8103 dns=5353 private_http=9101 region= load=0 host=us-west-1.srv.lemonade-nexus.io
[2026-05-27 13:11:56.400] [info] DNS: published _config TXT for server-c29685b79e82657e (host=us-west-1.srv.lemonade-nexus.io)
[2026-05-27 13:11:56.400] [info] Derived server node ID from identity pubkey: server-c29685b79e82657e
[2026-05-27 13:11:56.400] [info] [DnsService] set dynamic A server-c29685b79e82657e.us-west.seip.lemonade-nexus.io -> 76.158.109.200 (TTL 300)
[2026-05-27 13:11:56.401] [info] [DnsService] set dynamic TXT _config.server-c29685b79e82657e.us-west.seip.lemonade-nexus.io -> v=sp1 http=8443 udp=41820 gossip=8102 stun=3478 relay=8103 dns=5353 private_http=9101 region=us-west load=0 host=server-c29685b79e82657e.us-west.seip.lemonade-nexus.io (TTL 300)
[2026-05-27 13:11:56.401] [info] [DnsService] published SEIP records: server-c29685b79e82657e.us-west.seip.lemonade-nexus.io
[2026-05-27 13:11:56.401] [info] SEIP: published server-c29685b79e82657e.us-west.seip.lemonade-nexus.io -> 76.158.109.200
[2026-05-27 13:11:56.401] [info] Auto-TLS: no cert on disk for server-c29685b79e82657e.us-west.seip.lemonade-nexus.io -- will request in background
[2026-05-27 13:11:56.401] [info] SEIP: requesting ACME cert for server-c29685b79e82657e.us-west.seip.lemonade-nexus.io in background
[2026-05-27 13:11:56.401] [info] [DnsService] listening on UDP port 5353 (zone: lemonade-nexus.io)
[2026-05-27 13:11:56.401] [info] [GossipService] claimed NS slot ns1 (ip=76.158.109.200, region=us-west)
[2026-05-27 13:11:56.401] [info] [DnsService] added nameserver ns1.lemonade-nexus.io -> 76.158.109.200
[2026-05-27 13:11:56.401] [info] SEIP: claimed NS slot ns1 for 76.158.109.200
[2026-05-27 13:11:56.401] [info] Generated and persisted JWT secret to ./data/identity/jwt_secret.hex
[2026-05-27 13:11:56.401] [info] AuthService started — providers: ed25519 (primary), passkey/fido2 (backup), password+2fa, token-link