Microservice Isolation (handleUsingRemote)
Run the same PHP code on two servers with different roles. The public-facing sandbox handles HTML, assets, and reads. Sensitive operations — payments, email, OAuth — forward to the authority server via HMAC-signed HTTP. The sandbox never loads the handler, never sees the secrets.
How it works
// sandbox config — forwards sensitive events to authority
{
"Q": {
"handlersUsingRemote": {
"swarm/payment": {"baseUrl": "http://authority:4001"},
"swarm/task_add": {"baseUrl": "http://authority:4001"},
"users/email/send": {"baseUrl": "http://authority:4001"}
},
"internal": {
"secret": "shared_hmac_key"
}
}
}
// authority config — has the real secrets
{
"Q": {
"internal": {
"secret": "shared_hmac_key",
"paymentApiKey": "sk_live_abc123",
"smtp": {"host": "smtp.mailgun.org", "pass": "..."}
}
}
}
When the sandbox receives a swarm/payment event, it forwards it to the authority via HMAC-signed POST. The authority verifies the signature, runs the handler locally, and returns the result. The sandbox never loads the payment handler, never reads the API key.
If the sandbox is compromised, the attacker gets an HMAC key that can only make the same API calls the sandbox already makes — not raw access to payment credentials.
M-of-N Code Signing
Verify that PHP code hasn't been tampered with. Multiple developers sign a manifest; the server enforces a quorum before running the code.
Signing workflow
# Generate a keypair php qbixserver.php --generate-key=alice # Sign the web directory php qbixserver.php --sign=web --key=local/keys/alice.pem --key-id=alice # Another developer signs php qbixserver.php --sign=web --key=local/keys/bob.pem --key-id=bob # Server enforces 2-of-N policy php qbixserver.php --verify=web --policy=2
The manifest stores SHA-256 hashes of every file. Each signer adds their RSA signature. At startup, the server verifies that at least M signers agree on every file hash. Any modified, added, or unsigned file fails verification.
Inter-Server Trust
Server identity and trust levels
On first run, each server generates a self-signed certificate. The SHA-256 fingerprint is the server’s identity — like SSH known_hosts, no certificate authority needed.
Trust levels:
| Level | What it means |
|---|---|
| none | Unknown server, no communication |
| peer | Can replicate events, sync state |
| authority | Can receive forwarded sensitive events |
| full | Can execute any event on our behalf |
All inter-server requests are HMAC-signed. The signature format is compatible with the Qbix Platform — servers upgrading to the full Platform keep working without changes.
Access-Controlled File Serving
Serve files through PHP access checks
// web/download.php
session_start();
if (!$_SESSION['user_id']) {
http_response_code(403);
exit;
}
Q_Response::header('X-Sendfile: /protected/report.pdf');
Q_Response::header('Content-Type: application/pdf');
The X-Sendfile header tells the server to stream the file directly. PHP handles the access check, the server handles the byte transfer. The client never sees the file’s real path.