token-for-token/devops
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

init devops repo

Browse Source 
Mirrors cipherdolls/devops layout. Hostinger Swarm stacks for the t4t
hosted-gateway and local docker-compose for development + e2e tests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Felix FaerberandClaude Opus 4.7 committed 2026-05-27 10:31:30 +03:00
commit 032a22b6ee
16 files changed
+1444
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

hostinger/.env.example
+41
View File
@@ -0,0 +1,41 @@
# Production .env for the hosted-gateway swarm stack.
# Copy to .env on the Hostinger host, chmod 600, and `docker stack deploy`.
# DATABASE_URL, REDIS_*, BEE_API_URL are set in prod-stack.yaml — do NOT
# override here (the stack file uses internal DNS names).
# --- Auth ---
JWT_SECRET_KEY=change-me-to-a-long-random-string
GOOGLE_OAUTH_CLIENT_ID=
# --- Operator wallet (the ONLY on-chain identity) ---
# Holds xBZZ + xDAI for all tenants. Funded once at bootstrap.
OPERATOR_PRIVATE_KEY=0x...
GNOSIS_RPC_URL=https://rpc.gnosischain.com
# --- T4T protocol contracts (Gnosis mainnet) ---
REGISTRY_ADDRESS=0xf81121AAbc2F7261224BaDd0Ed871711e6D1371E
ESCROW_ADDRESS=0x34Db8E014E71928f17E23eC1272B602582222c9c
XBZZ_ADDRESS=0xdBF3Ea6F5beE45c02255B2c26a16F300502F68da
# --- Bee node ---
# Postage batch is bought once on first deploy and stored in bee-data volume.
BEE_POSTAGE_BATCH_ID=
BEE_STAMP_MANAGE=true
BEE_STAMP_LABEL=hosted-gateway
BEE_STAMP_TTL_DAYS=30
# Used by the Bee service itself (BEE_*_PASSWORD vars below):
BEE_PASSWORD=change-me
BEE_SWAP_ENDPOINT=https://rpc.gnosischain.com
# --- Pricing ---
MARKUP_BPS=2000
WELCOME_XBZZ_WEI=50000000000000000000
# --- Concurrency / server ---
MAX_CONCURRENT_JOBS=200
LOG_LEVEL=info
# --- Phase 2 (Stripe) — leave blank in v1 ---
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=
hostinger/dev-stack.yaml
+145
View File
@@ -0,0 +1,145 @@
version: '3.8'
# Staging environment — points at the `develop` image tag, mounted on a
# separate dev.t4t-gateway.com subdomain. Shares the same overlay networks
# but uses its own postgres/redis/bee volumes so prod data is untouched.
networks:
public:
external: true
internal:
external: true
volumes:
postgres-data-dev:
driver: local
redis-data-dev:
driver: local
bee-data-dev:
driver: local
services:
api:
image: ghcr.io/token-for-token/hosted-gateway:develop
command: ["bun", "run", "src/api.ts"]
env_file:
- .env.dev
environment:
DATABASE_URL: postgresql://hosted:hosted@postgres-dev:5432/hosted_gateway?schema=public
REDIS_HOST: redis-dev
REDIS_PORT: 6379
BEE_API_URL: http://bee-dev:1633
HOSTED_GATEWAY_PORT: 8080
networks:
- public
- internal
deploy:
replicas: 1
update_config:
parallelism: 1
order: start-first
resources:
limits:
memory: 256M
reservations:
memory: 128M
labels:
- "traefik.enable=true"
- "traefik.docker.network=public"
- "traefik.constraint-label=public"
- "traefik.http.routers.api-dev.rule=Host(`dev.t4t-gateway.com`)"
- "traefik.http.routers.api-dev.entrypoints=websecure"
- "traefik.http.routers.api-dev.tls.certresolver=le"
- "traefik.http.services.api-dev.loadbalancer.server.port=8080"
- "traefik.http.routers.api-dev.middlewares=redirect-to-https"
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
worker:
image: ghcr.io/token-for-token/hosted-gateway:develop
command: ["bun", "run", "src/worker.ts"]
env_file:
- .env.dev
environment:
DATABASE_URL: postgresql://hosted:hosted@postgres-dev:5432/hosted_gateway?schema=public
REDIS_HOST: redis-dev
REDIS_PORT: 6379
BEE_API_URL: http://bee-dev:1633
networks:
- internal
deploy:
replicas: 1
resources:
limits:
memory: 256M
reservations:
memory: 128M
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
postgres-dev:
image: postgres:16
networks:
- internal
environment:
POSTGRES_USER: hosted
POSTGRES_PASSWORD: hosted
POSTGRES_DB: hosted_gateway
volumes:
- postgres-data-dev:/var/lib/postgresql/data
deploy:
resources:
limits:
memory: 256M
reservations:
memory: 128M
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
redis-dev:
image: redis:7
networks:
- internal
volumes:
- redis-data-dev:/data
deploy:
resources:
limits:
memory: 64M
reservations:
memory: 32M
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
bee-dev:
image: ethersphere/bee:latest
command: dev
networks:
- internal
volumes:
- bee-data-dev:/home/bee/.bee
deploy:
resources:
limits:
memory: 256M
reservations:
memory: 128M
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
hostinger/loki.yaml
+37
View File
@@ -0,0 +1,37 @@
auth_enabled: false
server:
http_listen_port: 3100
grpc_listen_port: 9096
common:
instance_addr: 127.0.0.1
path_prefix: /tmp/loki
storage:
filesystem:
chunks_directory: /tmp/loki/chunks
rules_directory: /tmp/loki/rules
replication_factor: 1
ring:
kvstore:
store: inmemory
query_range:
results_cache:
cache:
embedded_cache:
enabled: true
max_size_mb: 100
schema_config:
configs:
- from: 2020-10-24
store: tsdb
object_store: filesystem
schema: v13
index:
prefix: index_
period: 24h
ruler:
alertmanager_url: http://localhost:9093
hostinger/prod-stack.yaml
+201
View File
@@ -0,0 +1,201 @@
version: '3.8'
networks:
public:
external: true
internal:
external: true
volumes:
postgres-data:
driver: local
redis-data:
driver: local
bee-data:
driver: local
services:
api:
image: ghcr.io/token-for-token/hosted-gateway:main
command: ["bun", "run", "src/api.ts"]
env_file:
- .env
environment:
DATABASE_URL: postgresql://hosted:hosted@postgres:5432/hosted_gateway?schema=public
REDIS_HOST: redis
REDIS_PORT: 6379
BEE_API_URL: http://bee:1633
HOSTED_GATEWAY_PORT: 8080
networks:
- public
- internal
deploy:
replicas: 2
update_config:
parallelism: 1
order: start-first
resources:
limits:
memory: 512M
reservations:
memory: 512M
labels:
- "traefik.enable=true"
- "traefik.docker.network=public"
- "traefik.constraint-label=public"
- "traefik.http.routers.api.rule=Host(`api.t4t-gateway.com`,`t4t-gateway.com`,`www.t4t-gateway.com`)"
- "traefik.http.routers.api.entrypoints=websecure"
- "traefik.http.routers.api.tls.certresolver=le"
- "traefik.http.services.api.loadbalancer.server.port=8080"
- "traefik.http.routers.api.middlewares=redirect-to-https"
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
worker:
image: ghcr.io/token-for-token/hosted-gateway:main
command: ["bun", "run", "src/worker.ts"]
env_file:
- .env
environment:
DATABASE_URL: postgresql://hosted:hosted@postgres:5432/hosted_gateway?schema=public
REDIS_HOST: redis
REDIS_PORT: 6379
BEE_API_URL: http://bee:1633
networks:
- internal
deploy:
replicas: 1
update_config:
parallelism: 1
order: start-first
resources:
limits:
memory: 512M
reservations:
memory: 512M
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
prisma:
image: ghcr.io/token-for-token/hosted-gateway:main
command: ["sh", "-c", "bunx prisma migrate deploy && tail -f /dev/null"]
env_file:
- .env
environment:
DATABASE_URL: postgresql://hosted:hosted@postgres:5432/hosted_gateway?schema=public
networks:
- internal
deploy:
replicas: 1
restart_policy:
condition: on-failure
resources:
limits:
memory: 256M
reservations:
memory: 128M
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
postgres:
image: postgres:16
networks:
- internal
environment:
POSTGRES_USER: hosted
POSTGRES_PASSWORD: hosted
POSTGRES_DB: hosted_gateway
volumes:
- postgres-data:/var/lib/postgresql/data
deploy:
resources:
limits:
memory: 512M
reservations:
memory: 512M
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
redis:
image: redis:7
networks:
- internal
volumes:
- redis-data:/data
deploy:
resources:
limits:
memory: 128M
reservations:
memory: 64M
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
bee:
image: ethersphere/bee:latest
command: start
env_file:
- .env
environment:
BEE_API_ADDR: ":1633"
BEE_P2P_ADDR: ":1634"
BEE_VERBOSITY: "info"
BEE_FULL_NODE: "false"
BEE_SWAP_ENABLE: "true"
BEE_CHAIN_ENABLE: "true"
BEE_NETWORK_ID: "1"
BEE_WELCOME_MESSAGE: "t4t-gateway"
BEE_DATA_DIR: /home/bee/.bee
volumes:
- bee-data:/home/bee/.bee
networks:
- internal
deploy:
replicas: 1
restart_policy:
condition: on-failure
resources:
limits:
memory: 1024M
reservations:
memory: 512M
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
postgres-exporter:
image: quay.io/prometheuscommunity/postgres-exporter:latest
networks:
- internal
environment:
DATA_SOURCE_NAME: "postgresql://hosted:hosted@postgres:5432/hosted_gateway?sslmode=disable"
deploy:
resources:
limits:
memory: 128M
reservations:
memory: 64M
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
hostinger/prometheus.yml
+48
View File
@@ -0,0 +1,48 @@
global:
scrape_interval: 15s
evaluation_interval: 15s
scrape_configs:
- job_name: "traefik"
static_configs:
- targets: ["traefik:8080"]
- job_name: "prometheus"
static_configs:
- targets: ["localhost:9090"]
- job_name: "grafana"
static_configs:
- targets: ["grafana:3000"]
- job_name: "loki"
static_configs:
- targets: ["loki:3100"]
- job_name: "node-exporter"
dns_sd_configs:
- names:
- "tasks.system_node-exporter"
type: A
port: 9100
- job_name: "postgres-exporter"
dns_sd_configs:
- names:
- "tasks.prod_postgres-exporter"
type: A
port: 9187
- job_name: "cadvisor"
dns_sd_configs:
- names:
- "tasks.system_cadvisor"
type: A
port: 8080
- job_name: "hosted-gateway"
dns_sd_configs:
- names:
- "tasks.prod_api"
type: A
port: 8080
hostinger/readme.md
+128
View File
@@ -0,0 +1,128 @@
# Hostinger (production) stacks
Docker Swarm stack files for the t4t hosted-gateway, deployed to a single
Hostinger VPS at `ssh root@195.35.25.26` and reachable at
[t4t-gateway.com](https://t4t-gateway.com).
Layout mirrors [cipherdolls/devops/hostinger/](https://github.com/cipherdolls/devops).
## Stacks
| Stack | File | What it runs |
| --- | --- | --- |
| `system` | `system-stack.yaml` | Traefik (TLS + ingress), Grafana, Loki, Prometheus, node-exporter, cadvisor. Owns the `public` + `internal` overlay networks. |
| `prod` | `prod-stack.yaml` | hosted-gateway api + worker + one-shot prisma migrate, plus postgres / redis / bee / postgres-exporter. |
| `dev` | `dev-stack.yaml` | Staging on `dev.t4t-gateway.com` — the `:develop` image tag against its own postgres / redis / bee volumes. |
Supporting configs:
- `loki.yaml` — Loki single-binary filesystem config
- `prometheus.yml` — scrape targets (traefik, grafana, loki, node-exporter,
postgres-exporter, cadvisor, hosted-gateway api)
- `.env.example` — copy to `.env` on the host, fill in
`OPERATOR_PRIVATE_KEY` / `JWT_SECRET_KEY` / etc.
## DNS records (Hostinger DNS panel)
Point all of these at `195.35.25.26`:
```
A t4t-gateway.com 195.35.25.26
A www.t4t-gateway.com 195.35.25.26
A api.t4t-gateway.com 195.35.25.26
A dev.t4t-gateway.com 195.35.25.26
A traefik.t4t-gateway.com 195.35.25.26
A grafana.t4t-gateway.com 195.35.25.26
A loki.t4t-gateway.com 195.35.25.26
A prometheus.t4t-gateway.com 195.35.25.26
```
## One-time host setup
```bash
ssh root@195.35.25.26
# Docker + swarm
curl -fsSL https://get.docker.com | sh
docker swarm init --advertise-addr 195.35.25.26
# Loki driver (so container logs ship to Loki via the `loki` logging driver)
docker plugin install grafana/loki-docker-driver:2.9.7 \
--alias loki --grant-all-permissions
# Drop the stack files + configs on the host
mkdir -p /opt/t4t-gateway && cd /opt/t4t-gateway
# rsync this directory up here (or `git clone` the devops repo)
cp .env.example .env && chmod 600 .env
$EDITOR .env # fill in OPERATOR_PRIVATE_KEY, JWT_SECRET_KEY, ...
```
## Deploy
The system stack creates the shared overlay networks, so deploy it first.
```bash
cd /opt/t4t-gateway
# 1. Networks + ingress + monitoring
docker stack deploy -c system-stack.yaml system
# 2. App + datastores
docker stack deploy -c prod-stack.yaml prod
# (optional) staging on dev.t4t-gateway.com
docker stack deploy -c dev-stack.yaml dev
```
Re-deploying after a new image tag:
```bash
docker service update --image ghcr.io/token-for-token/hosted-gateway:main \
--force prod_api
docker service update --image ghcr.io/token-for-token/hosted-gateway:main \
--force prod_worker
```
## Secrets
`OPERATOR_PRIVATE_KEY` is the on-chain identity for every tenant. For now it
lives in `/opt/t4t-gateway/.env` (chmod 600). Future work: migrate to a
proper Docker secret backed by the host's secret manager — never an env var
in the stack file.
## Backups
Postgres volume:
```bash
docker run --rm \
-v prod_postgres-data:/from_volume \
-v $(pwd):/workdir \
alpine \
sh -c "cd /from_volume && tar cvf /workdir/prod_postgres-data.tar ."
scp root@195.35.25.26:/opt/t4t-gateway/prod_postgres-data.tar ~/Downloads
```
Bee data volume (postage batch / swarm keys — DO NOT lose this):
```bash
docker run --rm \
-v prod_bee-data:/from_volume \
-v $(pwd):/workdir \
alpine \
sh -c "cd /from_volume && tar cvf /workdir/prod_bee-data.tar ."
```
## Troubleshooting
```bash
docker stack services system # health of ingress + monitoring
docker stack services prod # health of gateway + data
docker service logs -f prod_api
docker service logs -f prod_worker
# Replay a failed Prisma migration:
docker exec -it $(docker ps -q -f name=prod_prisma) sh
bunx prisma migrate resolve --rolled-back <migration_name>
```
hostinger/system-stack.yaml
+232
View File
@@ -0,0 +1,232 @@
version: '3.8'
networks:
public:
name: public
driver: overlay
internal:
name: internal
driver: overlay
volumes:
traefik-letsencrypt:
driver: local
traefik-logs:
driver: local
grafana-data:
driver: local
loki-data:
driver: local
prometheus-data:
driver: local
configs:
loki_config:
file: ./loki.yaml
prometheus_config:
file: ./prometheus.yml
services:
traefik:
image: traefik:v2.11.22
ports:
- "80:80"
- "443:443"
command:
- --providers.docker
- --providers.docker.network=public
- --providers.docker.constraints=Label(`traefik.constraint-label`, `public`)
- --providers.docker.exposedbydefault=false
- --providers.docker.swarmmode
- --entrypoints.web.address=:80
- --entrypoints.websecure.address=:443
- --certificatesresolvers.le.acme.email=t4t-gateway@proton.me
- --certificatesresolvers.le.acme.storage=/certificates/acme.json
- --certificatesresolvers.le.acme.tlschallenge=true
- --api=true
- --api.dashboard=true
- --metrics.prometheus=true
- --accesslog=true
- --log=true
networks:
- public
volumes:
- "/var/run/docker.sock:/var/run/docker.sock:ro"
- traefik-letsencrypt:/certificates
- traefik-logs:/var/log/traefik
deploy:
placement:
constraints:
- node.role == manager
resources:
limits:
memory: 256M
reservations:
memory: 128M
labels:
- "traefik.enable=true"
- "traefik.docker.network=public"
- "traefik.constraint-label=public"
- "traefik.http.routers.dashboard.service=api@internal"
- "traefik.http.routers.traefikk.rule=Host(`traefik.t4t-gateway.com`)"
- "traefik.http.routers.traefikk.entrypoints=websecure"
- "traefik.http.routers.traefikk.tls.certresolver=le"
- "traefik.http.routers.traefikk.middlewares=admin-auth"
- "traefik.http.services.traefikk.loadbalancer.server.port=8080"
- "traefik.http.middlewares.admin-auth.basicauth.users=admin:$$apr1$$EyLN9D7y$$4v2q7sYTN7aIlE2yeujRJ/"
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
- "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
grafana:
image: grafana/grafana:12.4.2
healthcheck:
test: ["CMD-SHELL", "wget -qO- http://localhost:3000/api/health || exit 1"]
interval: 10s
timeout: 3s
retries: 3
start_period: 10s
networks:
- public
- internal
volumes:
- grafana-data:/var/lib/grafana
environment:
- GF_AUTH_DISABLE_LOGIN_FORM=true
- GF_AUTH_ANONYMOUS_ENABLED=true
- GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
- GF_SECURITY_ALLOW_EMBEDDING=true
deploy:
resources:
limits:
memory: 512M
reservations:
memory: 256M
labels:
- "traefik.enable=true"
- "traefik.http.routers.grafana.rule=Host(`grafana.t4t-gateway.com`)"
- "traefik.http.routers.grafana.entrypoints=websecure"
- "traefik.http.routers.grafana.tls.certresolver=le"
- "traefik.docker.network=public"
- "traefik.constraint-label=public"
- "traefik.http.services.grafana.loadbalancer.server.port=3000"
- "traefik.http.middlewares.admin-auth.basicauth.users=admin:$$apr1$$EyLN9D7y$$4v2q7sYTN7aIlE2yeujRJ/"
- "traefik.http.routers.grafana.middlewares=admin-auth,redirect-to-https"
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
loki:
image: grafana/loki:2.9.7
networks:
- public
- internal
configs:
- source: loki_config
target: /etc/loki/loki.yaml
volumes:
- loki-data:/loki
command: -config.file=/etc/loki/loki.yaml
deploy:
resources:
limits:
memory: 256M
reservations:
memory: 128M
labels:
- "traefik.enable=true"
- "traefik.http.routers.loki.rule=Host(`loki.t4t-gateway.com`)"
- "traefik.http.routers.loki.entrypoints=websecure"
- "traefik.http.routers.loki.tls.certresolver=le"
- "traefik.docker.network=public"
- "traefik.constraint-label=public"
- "traefik.http.services.loki.loadbalancer.server.port=3100"
logging:
driver: json-file
options:
max-size: "10m"
max-file: "3"
prometheus:
image: prom/prometheus:v3.7.2
networks:
- public
- internal
configs:
- source: prometheus_config
target: /etc/prometheus/prometheus.yml
volumes:
- prometheus-data:/prometheus
command: --config.file=/etc/prometheus/prometheus.yml
deploy:
resources:
limits:
memory: 1024M
reservations:
memory: 512M
labels:
- "traefik.enable=true"
- "traefik.http.routers.prometheus.rule=Host(`prometheus.t4t-gateway.com`)"
- "traefik.http.routers.prometheus.entrypoints=websecure"
- "traefik.http.routers.prometheus.tls.certresolver=le"
- "traefik.docker.network=public"
- "traefik.constraint-label=public"
- "traefik.http.services.prometheus.loadbalancer.server.port=9090"
- "traefik.http.middlewares.admin-auth.basicauth.users=admin:$$apr1$$EyLN9D7y$$4v2q7sYTN7aIlE2yeujRJ/"
- "traefik.http.routers.prometheus.middlewares=admin-auth"
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
node-exporter:
image: prom/node-exporter:master
command: --path.rootfs=/host
networks:
- internal
deploy:
mode: global
resources:
limits:
memory: 32M
reservations:
memory: 24M
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
cadvisor:
image: gcr.io/cadvisor/cadvisor:latest
networks:
- internal
volumes:
- /:/rootfs:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
- /sys/fs/cgroup:/sys/fs/cgroup:ro
deploy:
mode: global
resources:
limits:
memory: 128M
reservations:
memory: 65M
logging:
driver: loki
options:
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"