Skip to content

wj-diode-quantum

Collects quantum random numbers from the Australian National University, pushes them across a data diode, and serves them one at a time on the protected side.

A data diode only carries data one way. That makes it excellent at keeping a network isolated and useless for anything that needs a reply — so a machine behind one cannot simply ask ANU for random numbers. This program splits the job in two: one side collects and pushes, the other side stockpiles what arrives and hands it out on request.

Features

  • Both ANU APIs — the current keyed service and the older unkeyed one. Enable either or both; when both are on, both are used and their values are merged.
  • Any diode tool — moving data across the diode is a configured external command. diodetool is what this was built against, but nothing about it is hard-coded.
  • Never serves the same number twice — guaranteed across crashes, not just clean shutdowns. Each value is recorded as consumed and flushed to disk before it reaches the client.
  • Bounded, self-trimming pool — newest served first, oldest discarded at capacity, so the database never grows without limit and numbers stay fresh.
  • One process per machine — the receiving side runs and supervises the diode tool for you.
  • Rejects damaged batches whole — a diode cannot retransmit, so anything malformed is set aside rather than partially imported.
  • Zero dependencies — a single static binary, Go standard library only.

How it fits together

  internet side                    diode                 protected side
  ─────────────                    ─────                 ──────────────
  ANU ──> collect ──> outbox ──> [ send ] ══════> [ recv ] ──> ingest ──> spool
                                                                            │
                                                                            v
                                                         pool.json <── serve ──> GET /api/random

The collector never learns whether anything arrived — nothing comes back. Both sides are therefore built to be restartable and to keep a buffer: batches wait in the outbox until the send command succeeds, and the pool holds a reserve so the server keeps working while the other side is down.

Getting started

See Usage. It is two commands per machine.

Requirements

  • A tool that can move a file across your diode, on both sides.
  • An ANU API key from quantumnumbers.anu.edu.au, free with an account. Optional if you only use the legacy endpoint.

Licence

Released under the Unlicense — public domain.