init devops repo

Mirrors cipherdolls/devops layout. Hostinger Swarm stacks for the t4t hosted-gateway and local docker-compose for development + e2e tests. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-27 10:31:30 +03:00
commit 032a22b6ee
@@ -0,0 +1,48 @@
+# Local dev + test env. Copy to .env and adjust.
+# Compose files load this with `env_file: [.env]`.
+
+# Postgres (used by hosted-gateway via DATABASE_URL)
+POSTGRES_USER=hosted
+POSTGRES_PASSWORD=hosted
+POSTGRES_DB=hosted_gateway
+DATABASE_URL=postgresql://hosted:hosted@postgres:5432/hosted_gateway?schema=public
+
+# Redis
+REDIS_HOST=redis
+REDIS_PORT=6379
+
+# Auth
+JWT_SECRET_KEY=dev-only-jwt-secret-change-me
+GOOGLE_OAUTH_CLIENT_ID=
+
+# Operator wallet — anvil deterministic key (account 0) for local dev/test.
+# The bootstrap step in test/setup.ts funds this address with xDAI + xBZZ
+# via anvil_setBalance + xBZZ-whale impersonation.
+OPERATOR_PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80
+GNOSIS_RPC_URL=http://anvil:8545
+
+# T4T protocol contracts (Gnosis mainnet — managed by the t4t repo).
+# These are valid on the anvil fork because we --fork-url'd Gnosis mainnet.
+REGISTRY_ADDRESS=0xf81121AAbc2F7261224BaDd0Ed871711e6D1371E
+ESCROW_ADDRESS=0x34Db8E014E71928f17E23eC1272B602582222c9c
+XBZZ_ADDRESS=0xdBF3Ea6F5beE45c02255B2c26a16F300502F68da
+
+# Bee — we point at a real running Bee node (bee.ffaerber.duckdns.org) rather
+# than spinning up dev-mode Bee in compose. The remote Bee already has real
+# postage stamps for PSS routing to mainnet providers.
+BEE_API_URL=https://bee.ffaerber.duckdns.org
+BEE_POSTAGE_BATCH_ID=
+BEE_STAMP_MANAGE=false
+BEE_STAMP_LABEL=hosted-gateway-local
+BEE_STAMP_TTL_DAYS=30
+
+# Pricing
+MARKUP_BPS=2000
+WELCOME_XBZZ_WEI=50000000000000000000
+
+# Concurrency
+MAX_CONCURRENT_JOBS=200
+
+# Server
+HOSTED_GATEWAY_PORT=8080
+LOG_LEVEL=debug
@@ -0,0 +1,159 @@
+# Hosted gateway — local dev + test orchestration.
+# Mirrors cipherdolls/devops/local/Makefile.
+
+PROJECT      := hosted-gateway
+COMPOSE_DEV  := docker-compose.yaml
+COMPOSE_TEST := docker-compose-test.yaml
+DC           := docker compose -p $(PROJECT) -f $(COMPOSE_TEST)
+DC_DEV       := docker compose -p $(PROJECT)-dev -f $(COMPOSE_DEV)
+TEST_CONTAINER := $(PROJECT)-bun
+LOG_DIR := /tmp/hosted-gateway-test-logs
+
+SPEC ?= accounts
+SPECS := health auth models gateway ledger cancellation concurrency
+TIMEOUT ?= 600
+
+SERVICES := postgres redis prisma api worker
+
+# Specs that need the gnosis-fork stack (anvil + bee) and/or a registered
+# provider → activate the `gateway` compose profile. `models` only needs the
+# fork (read-only chain calls); `gateway`/`concurrency`/`cancellation` also
+# need the t4t-provider + mock-ollama containers.
+GATEWAY_SPECS := models gateway concurrency cancellation
+gateway_profile = $(if $(filter $(1),$(GATEWAY_SPECS)),--profile gateway,)
+
+.PHONY: dev-up dev-down dev-watch up up-detached down logs build clean test test-all $(addprefix test-,$(SPECS)) help lock
+
+# ---------- dev ----------
+
+dev-up:
+	$(DC_DEV) up
+
+dev-down:
+	$(DC_DEV) down -v --remove-orphans -t 0
+
+dev-watch:
+	$(DC_DEV) watch
+
+# ---------- test ----------
+
+# Generate / refresh bun.lock inside the hosted-gateway repo via a one-shot
+# container. Mirrors cipherdolls' approach so no host-side Bun install is
+# required.
+lock:
+	@echo "========== Generating bun.lock =========="
+	docker run --rm -v ../../hosted-gateway:/app -w /app oven/bun:1.2-alpine bun install
+	@echo "========== bun.lock updated =========="
+
+# Run a single spec by name. Example: `make test SPEC=accounts`
+define run_test
+	bash -c '\
+		set +e; \
+		mkdir -p $(LOG_DIR); \
+		cleanup() { \
+			echo ""; \
+			echo "========== Cleaning up =========="; \
+			docker rm -f $(TEST_CONTAINER) 2>/dev/null; \
+			$(DC) kill 2>/dev/null; \
+			$(DC) down -v --remove-orphans -t 0 2>/dev/null; \
+		}; \
+		trap cleanup EXIT; \
+		echo "========== Updating bun.lock =========="; \
+		docker run --rm -v ../../hosted-gateway:/app -w /app oven/bun:1.2-alpine bun install --frozen-lockfile 2>/dev/null || \
+		docker run --rm -v ../../hosted-gateway:/app -w /app oven/bun:1.2-alpine bun install; \
+		echo "========== Starting services =========="; \
+		$(DC) $(call gateway_profile,$(1)) up -d --build --wait $(SERVICES); \
+		if [ "$(call gateway_profile,$(1))" != "" ]; then \
+			echo "========== Starting gateway profile (anvil) =========="; \
+			$(DC) $(call gateway_profile,$(1)) up -d --build --wait anvil || { echo "gateway profile failed to start"; exit 1; }; \
+			if [ "$(1)" != "models" ]; then \
+				echo "========== Starting t4t-provider + mock-ollama =========="; \
+				$(DC) $(call gateway_profile,$(1)) up -d --build --wait t4t-provider mock-ollama || { echo "provider profile failed to start"; exit 1; }; \
+			fi; \
+		fi; \
+		echo "========== Running $(1) =========="; \
+		$(DC) build --no-cache bun; \
+		$(DC) $(call gateway_profile,$(1)) run -d --no-deps --name $(TEST_CONTAINER) \
+			-e SPEC_GLOB="./test/$(1).e2e-spec.ts" \
+			bun; \
+		\
+		docker wait $(TEST_CONTAINER) &>/dev/null & \
+		WAIT_PID=$$!; \
+		stdbuf -oL docker logs -f $(TEST_CONTAINER) 2>&1 \
+			| stdbuf -oL sed "s/\x1b\[[0-9;]*m//g" \
+			> $(LOG_DIR)/$(1).log & \
+		LOGS_PID=$$!; \
+		\
+		if ! timeout $(TIMEOUT) tail --pid=$$WAIT_PID -f /dev/null 2>/dev/null; then \
+			echo "========== TIMEOUT after $(TIMEOUT)s =========="; \
+			docker kill $(TEST_CONTAINER) 2>/dev/null; \
+		fi; \
+		wait $$WAIT_PID 2>/dev/null; \
+		rc=$$(docker inspect -f "{{.State.ExitCode}}" $(TEST_CONTAINER) 2>/dev/null || echo 1); \
+		kill $$LOGS_PID 2>/dev/null; \
+		wait $$LOGS_PID 2>/dev/null; \
+		echo "========== Tests finished (rc=$$rc) — log: $(LOG_DIR)/$(1).log =========="; \
+		exit $$rc'
+endef
+
+test:
+	$(call run_test,$(SPEC))
+
+test-all:
+	@failed=""; \
+	for spec in $(SPECS); do \
+		echo ""; \
+		echo "========== Suite: $$spec =========="; \
+		$(MAKE) --no-print-directory test SPEC=$$spec; \
+		if [ $$? -ne 0 ]; then failed="$$failed $$spec"; fi; \
+	done; \
+	if [ -n "$$failed" ]; then \
+		echo ""; \
+		echo "Failed specs:$$failed"; exit 1; \
+	else \
+		echo ""; \
+		echo "All specs passed"; \
+	fi
+
+$(addprefix test-,$(SPECS)):
+	$(call run_test,$(subst test-,,$@))
+
+up:
+	$(DC) up
+
+up-detached:
+	$(DC) up -d
+
+down:
+	$(DC) kill 2>/dev/null || true
+	$(DC) down -v --remove-orphans -t 0
+
+logs:
+	$(DC) logs -f
+
+build:
+	$(DC) build
+
+clean:
+	$(DC) kill 2>/dev/null || true
+	$(DC) down -v --remove-orphans --rmi local -t 0
+	@docker ps -aq --filter "label=com.docker.compose.project=$(PROJECT)" | xargs -r docker rm -f 2>/dev/null || true
+	@docker volume ls -q --filter "label=com.docker.compose.project=$(PROJECT)" | xargs -r docker volume rm -f 2>/dev/null || true
+	@docker network ls -q --filter "label=com.docker.compose.project=$(PROJECT)" | xargs -r docker network rm 2>/dev/null || true
+
+help:
+	@echo "Usage:"
+	@echo "  make dev-up                 Start dev stack (postgres, redis, anvil, bee, api, worker)"
+	@echo "  make dev-down               Stop and clean dev stack"
+	@echo "  make dev-watch              Dev with file sync"
+	@echo "  make test SPEC=accounts     Run one e2e spec inside docker"
+	@echo "  make test-accounts          Same as `make test SPEC=accounts`"
+	@echo "  make test-all               Run every spec sequentially"
+	@echo "  make up                     Start test stack (no test runner)"
+	@echo "  make down                   Tear down test stack"
+	@echo "  make logs                   Tail test stack logs"
+	@echo "  make lock                   Regenerate bun.lock via docker"
+	@echo "  make clean                  Nuclear cleanup"
+	@echo ""
+	@echo "Available specs:"
+	@echo "  $(SPECS)" | fold -s -w 70
@@ -0,0 +1,166 @@
+# Local test stack for the hosted gateway. The smart contracts are NOT
+# deployed here — they're managed by the t4t repo and already live on Gnosis
+# mainnet. The anvil service forks Gnosis mainnet so those addresses are
+# usable as-is.
+#
+# Funding (giving the operator + test-provider xBZZ and xDAI on the fork) is
+# handled inside `test/setup.ts` via viem's anvil test actions
+# (anvil_setBalance + impersonateAccount on an xBZZ whale).
+#
+# Run from `devops/local/`: `make test SPEC=accounts` / `make test-all`.
+
+services:
+
+  postgres:
+    image: postgres:16
+    env_file: [.env]
+    expose:
+      - "5432"
+    tmpfs:
+      - /var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 2s
+      timeout: 2s
+      retries: 60
+    networks: [test]
+
+  redis:
+    image: redis:7
+    expose:
+      - "6379"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 2s
+      retries: 30
+    networks: [test]
+
+  # Anvil + Bee are only needed by specs that hit chain / Swarm. Profile-gated
+  # so `make test SPEC=auth` runs without them; `make test SPEC=gateway` adds
+  # the gateway profile.
+  anvil:
+    image: ghcr.io/foundry-rs/foundry:latest
+    pull_policy: always
+    profiles: [gateway]
+    # The foundry image's ENTRYPOINT is `["/bin/sh", "-c"]`, which interprets
+    # only its FIRST argument as the command — anvil's flags then ended up as
+    # shell positional params and were silently dropped. Override the
+    # entrypoint to invoke anvil directly. Don't pass `--chain-id` here —
+    # `--fork-url` propagates the chain id (100) automatically.
+    entrypoint: ["anvil"]
+    command:
+      - --host=0.0.0.0
+      - --port=8545
+      - --fork-url=https://rpc.gnosischain.com
+      - --block-time=1
+    environment:
+      ANVIL_IP_ADDR: "0.0.0.0"
+    expose:
+      - "8545"
+    healthcheck:
+      test: ["CMD-SHELL", "cast block-number --rpc-url http://localhost:8545 >/dev/null 2>&1"]
+      interval: 3s
+      retries: 60
+      start_period: 60s
+    networks: [test]
+
+  # Local Bee was removed — see devops/local/.env BEE_API_URL. We hit
+  # bee.ffaerber.duckdns.org (real running Bee node) for PSS routing + Swarm
+  # uploads. Faster than the local dev container and avoids the dev-mode
+  # postage / wget healthcheck quirks.
+
+  prisma:
+    build:
+      context: ../../hosted-gateway
+    command: ["sh", "-c", "bunx prisma migrate deploy"]
+    env_file: [.env]
+    depends_on:
+      postgres: { condition: service_healthy }
+    networks: [test]
+
+  api:
+    build:
+      context: ../../hosted-gateway
+    command: ["bun", "run", "src/api.ts"]
+    env_file: [.env]
+    environment:
+      NODE_ENV: test
+    expose:
+      - "8080"
+    depends_on:
+      postgres: { condition: service_healthy }
+      redis: { condition: service_healthy }
+      prisma: { condition: service_completed_successfully }
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health || exit 1"]
+      interval: 3s
+      timeout: 3s
+      retries: 30
+      start_period: 30s
+    networks: [test]
+
+  worker:
+    build:
+      context: ../../hosted-gateway
+    command: ["bun", "run", "src/worker.ts"]
+    env_file: [.env]
+    environment:
+      NODE_ENV: test
+    depends_on:
+      postgres: { condition: service_healthy }
+      redis: { condition: service_healthy }
+      prisma: { condition: service_completed_successfully }
+    healthcheck:
+      test: ["CMD-SHELL", "ps aux | grep 'src/worker.ts' | grep -v grep || exit 1"]
+      interval: 3s
+      retries: 30
+    networks: [test]
+
+  # The existing t4t-container in provider mode. Reads the canonical Gnosis
+  # mainnet contract addresses from its baked defaults (see
+  # t4t/container/src/lib/config.ts) — those addresses are valid on the anvil
+  # fork too. Funding (xBZZ + xDAI on the fork) happens in `test/setup.ts`.
+  #
+  # Profile-gated: only specs that actually need to settle a chat completion
+  # on-chain require this container. `make test SPEC=auth` / `make test
+  # SPEC=accounts` skip it; `make test SPEC=gateway` activates the profile.
+  t4t-provider:
+    image: ghcr.io/token-for-token/t4t:latest
+    pull_policy: missing
+    profiles: [gateway]
+    environment:
+      T4T_MODE: provider
+      T4T_OLLAMA_URL: http://mock-ollama:11434
+      GNOSIS_RPC_URL: http://anvil:8545
+      BEE_API_URL: http://bee:1633
+    depends_on:
+      anvil: { condition: service_healthy }
+      mock-ollama: { condition: service_started }
+    networks: [test]
+
+  mock-ollama:
+    build:
+      context: ./mock-ollama
+    profiles: [gateway]
+    expose:
+      - "11434"
+    networks: [test]
+
+  bun:
+    build:
+      context: ../../hosted-gateway
+    # The leading `$$` escapes compose's variable substitution so the inner
+    # shell expands $SPEC_GLOB at runtime (where `make test` set it via `-e`).
+    command: ["sh", "-c", "bun test --timeout 60000 $${SPEC_GLOB:-./test/**/*.e2e-spec.ts}"]
+    env_file: [.env]
+    environment:
+      NODE_ENV: test
+      HOSTED_GATEWAY_URL: http://api:8080
+    depends_on:
+      api: { condition: service_healthy }
+      worker: { condition: service_healthy }
+    networks: [test]
+
+networks:
+  test:
+    driver: bridge
@@ -0,0 +1,108 @@
+# Local dev stack for the hosted gateway. Brings up everything the gateway
+# needs to serve `/v1/chat/completions` end-to-end against a forked Gnosis
+# chain + a real t4t-provider talking to a mock Ollama.
+#
+# Run from `devops/local/`: `make dev-up` / `docker compose up`.
+
+services:
+
+  postgres:
+    image: postgres:16
+    env_file: [.env]
+    ports:
+      - "5432:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 3s
+      timeout: 3s
+      retries: 30
+    networks: [dev]
+
+  redis:
+    image: redis:7
+    ports:
+      - "6379:6379"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 3s
+      retries: 30
+    networks: [dev]
+
+  anvil:
+    image: ghcr.io/foundry-rs/foundry:latest
+    pull_policy: always
+    command:
+      - anvil
+      - --host=0.0.0.0
+      - --port=8545
+      - --chain-id=100
+      - --fork-url=${GNOSIS_RPC_URL_UPSTREAM:-https://rpc.gnosischain.com}
+      - --block-time=1
+    environment:
+      ANVIL_IP_ADDR: "0.0.0.0"
+    expose:
+      - "8545"
+    ports:
+      - "8545:8545"
+    healthcheck:
+      test: ["CMD-SHELL", "cast block-number --rpc-url http://localhost:8545 >/dev/null 2>&1"]
+      interval: 3s
+      timeout: 3s
+      retries: 60
+      start_period: 30s
+    networks: [dev]
+
+  bee:
+    image: ethersphere/bee:latest
+    command: dev
+    ports:
+      - "1633:1633"
+    networks: [dev]
+
+  # Prisma migration step — runs once on `up`, then exits.
+  prisma:
+    build:
+      context: ../../hosted-gateway
+    command: ["sh", "-c", "bunx prisma migrate deploy"]
+    env_file: [.env]
+    depends_on:
+      postgres: { condition: service_healthy }
+    networks: [dev]
+
+  api:
+    build:
+      context: ../../hosted-gateway
+    command: ["bun", "run", "src/api.ts"]
+    env_file: [.env]
+    ports:
+      - "8080:8080"
+    depends_on:
+      postgres: { condition: service_healthy }
+      redis: { condition: service_healthy }
+      anvil: { condition: service_healthy }
+      bee: { condition: service_started }
+      prisma: { condition: service_completed_successfully }
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health || exit 1"]
+      interval: 5s
+      timeout: 3s
+      retries: 30
+      start_period: 15s
+    networks: [dev]
+
+  worker:
+    build:
+      context: ../../hosted-gateway
+    command: ["bun", "run", "src/worker.ts"]
+    env_file: [.env]
+    depends_on:
+      postgres: { condition: service_healthy }
+      redis: { condition: service_healthy }
+      anvil: { condition: service_healthy }
+      bee: { condition: service_started }
+      prisma: { condition: service_completed_successfully }
+    networks: [dev]
+
+networks:
+  dev:
+    driver: bridge
@@ -0,0 +1,8 @@
+# Minimal mock Ollama HTTP server for E2E tests — returns a canned
+# `/api/chat`-shaped completion regardless of input. The t4t-provider treats
+# this as its inference backend; no GPU needed.
+FROM oven/bun:1.2-alpine
+WORKDIR /app
+COPY server.ts ./server.ts
+EXPOSE 11434
+CMD ["bun", "run", "server.ts"]
@@ -0,0 +1,47 @@
+// Stub Ollama HTTP for E2E tests. Returns a deterministic completion so the
+// gateway -> provider -> claim flow can be asserted end-to-end without a GPU.
+//
+// Implements just enough of the Ollama HTTP surface to satisfy the
+// t4t-provider's inference call: GET /api/tags and POST /api/chat.
+
+const PORT = 11434;
+
+Bun.serve({
+  port: PORT,
+  hostname: '0.0.0.0',
+  async fetch(req: Request): Promise<Response> {
+    const url = new URL(req.url);
+    if (url.pathname === '/api/tags') {
+      return Response.json({
+        models: [
+          {
+            name: 'qwen2.5:0.5b',
+            modified_at: new Date().toISOString(),
+            size: 0,
+            digest: 'mock',
+            details: {
+              format: 'gguf',
+              family: 'qwen',
+              parameter_size: '0.5B',
+              quantization_level: 'Q4_0',
+            },
+          },
+        ],
+      });
+    }
+    if (url.pathname === '/api/chat' && req.method === 'POST') {
+      return Response.json({
+        model: 'qwen2.5:0.5b',
+        created_at: new Date().toISOString(),
+        message: { role: 'assistant', content: 'pong (mock-ollama)' },
+        done: true,
+        total_duration: 100_000_000,
+        prompt_eval_count: 10,
+        eval_count: 5,
+      });
+    }
+    return new Response('not implemented', { status: 404 });
+  },
+});
+
+console.log(`mock-ollama listening on :${PORT}`);