init devops repo
Mirrors cipherdolls/devops layout. Hostinger Swarm stacks for the t4t hosted-gateway and local docker-compose for development + e2e tests. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Felix FaerberandClaude Opus 4.7 committed
commit
032a22b6ee
16 files changed
+1444
No files matched your search
@@ -0,0 +1,31 @@
|
||||
name: Deploy stacks
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: docker stack deploy
|
||||
uses: appleboy/ssh-action@v1.0.3
|
||||
with:
|
||||
username: root
|
||||
host: ${{ secrets.SSH_KNOWN_HOSTS }}
|
||||
key: ${{ secrets.SSH_PRIV_KEY }}
|
||||
script: |
|
||||
cd ~/devops && git pull
|
||||
docker stack deploy -c ~/devops/hostinger/system-stack.yaml system --with-registry-auth
|
||||
docker stack deploy -c ~/devops/hostinger/prod-stack.yaml prod --with-registry-auth
|
||||
|
||||
- name: prune old images
|
||||
uses: appleboy/ssh-action@v1.0.3
|
||||
with:
|
||||
username: root
|
||||
host: ${{ secrets.SSH_KNOWN_HOSTS }}
|
||||
key: ${{ secrets.SSH_PRIV_KEY }}
|
||||
script: |
|
||||
docker image prune -f --filter "until=24h"
|
||||
@@ -0,0 +1,3 @@
|
||||
.env
|
||||
.env.*
|
||||
!.env.example
|
||||
@@ -0,0 +1,41 @@
|
||||
# Production .env for the hosted-gateway swarm stack.
|
||||
# Copy to .env on the Hostinger host, chmod 600, and `docker stack deploy`.
|
||||
# DATABASE_URL, REDIS_*, BEE_API_URL are set in prod-stack.yaml — do NOT
|
||||
# override here (the stack file uses internal DNS names).
|
||||
|
||||
# --- Auth ---
|
||||
JWT_SECRET_KEY=change-me-to-a-long-random-string
|
||||
GOOGLE_OAUTH_CLIENT_ID=
|
||||
|
||||
# --- Operator wallet (the ONLY on-chain identity) ---
|
||||
# Holds xBZZ + xDAI for all tenants. Funded once at bootstrap.
|
||||
OPERATOR_PRIVATE_KEY=0x...
|
||||
GNOSIS_RPC_URL=https://rpc.gnosischain.com
|
||||
|
||||
# --- T4T protocol contracts (Gnosis mainnet) ---
|
||||
REGISTRY_ADDRESS=0xf81121AAbc2F7261224BaDd0Ed871711e6D1371E
|
||||
ESCROW_ADDRESS=0x34Db8E014E71928f17E23eC1272B602582222c9c
|
||||
XBZZ_ADDRESS=0xdBF3Ea6F5beE45c02255B2c26a16F300502F68da
|
||||
|
||||
# --- Bee node ---
|
||||
# Postage batch is bought once on first deploy and stored in bee-data volume.
|
||||
BEE_POSTAGE_BATCH_ID=
|
||||
BEE_STAMP_MANAGE=true
|
||||
BEE_STAMP_LABEL=hosted-gateway
|
||||
BEE_STAMP_TTL_DAYS=30
|
||||
|
||||
# Used by the Bee service itself (BEE_*_PASSWORD vars below):
|
||||
BEE_PASSWORD=change-me
|
||||
BEE_SWAP_ENDPOINT=https://rpc.gnosischain.com
|
||||
|
||||
# --- Pricing ---
|
||||
MARKUP_BPS=2000
|
||||
WELCOME_XBZZ_WEI=50000000000000000000
|
||||
|
||||
# --- Concurrency / server ---
|
||||
MAX_CONCURRENT_JOBS=200
|
||||
LOG_LEVEL=info
|
||||
|
||||
# --- Phase 2 (Stripe) — leave blank in v1 ---
|
||||
STRIPE_SECRET_KEY=
|
||||
STRIPE_WEBHOOK_SECRET=
|
||||
@@ -0,0 +1,145 @@
|
||||
version: '3.8'
|
||||
|
||||
# Staging environment — points at the `develop` image tag, mounted on a
|
||||
# separate dev.t4t-gateway.com subdomain. Shares the same overlay networks
|
||||
# but uses its own postgres/redis/bee volumes so prod data is untouched.
|
||||
|
||||
networks:
|
||||
public:
|
||||
external: true
|
||||
internal:
|
||||
external: true
|
||||
|
||||
|
||||
volumes:
|
||||
postgres-data-dev:
|
||||
driver: local
|
||||
redis-data-dev:
|
||||
driver: local
|
||||
bee-data-dev:
|
||||
driver: local
|
||||
|
||||
|
||||
services:
|
||||
|
||||
api:
|
||||
image: ghcr.io/token-for-token/hosted-gateway:develop
|
||||
command: ["bun", "run", "src/api.ts"]
|
||||
env_file:
|
||||
- .env.dev
|
||||
environment:
|
||||
DATABASE_URL: postgresql://hosted:hosted@postgres-dev:5432/hosted_gateway?schema=public
|
||||
REDIS_HOST: redis-dev
|
||||
REDIS_PORT: 6379
|
||||
BEE_API_URL: http://bee-dev:1633
|
||||
HOSTED_GATEWAY_PORT: 8080
|
||||
networks:
|
||||
- public
|
||||
- internal
|
||||
deploy:
|
||||
replicas: 1
|
||||
update_config:
|
||||
parallelism: 1
|
||||
order: start-first
|
||||
resources:
|
||||
limits:
|
||||
memory: 256M
|
||||
reservations:
|
||||
memory: 128M
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=public"
|
||||
- "traefik.constraint-label=public"
|
||||
- "traefik.http.routers.api-dev.rule=Host(`dev.t4t-gateway.com`)"
|
||||
- "traefik.http.routers.api-dev.entrypoints=websecure"
|
||||
- "traefik.http.routers.api-dev.tls.certresolver=le"
|
||||
- "traefik.http.services.api-dev.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.api-dev.middlewares=redirect-to-https"
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
|
||||
|
||||
worker:
|
||||
image: ghcr.io/token-for-token/hosted-gateway:develop
|
||||
command: ["bun", "run", "src/worker.ts"]
|
||||
env_file:
|
||||
- .env.dev
|
||||
environment:
|
||||
DATABASE_URL: postgresql://hosted:hosted@postgres-dev:5432/hosted_gateway?schema=public
|
||||
REDIS_HOST: redis-dev
|
||||
REDIS_PORT: 6379
|
||||
BEE_API_URL: http://bee-dev:1633
|
||||
networks:
|
||||
- internal
|
||||
deploy:
|
||||
replicas: 1
|
||||
resources:
|
||||
limits:
|
||||
memory: 256M
|
||||
reservations:
|
||||
memory: 128M
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
|
||||
|
||||
postgres-dev:
|
||||
image: postgres:16
|
||||
networks:
|
||||
- internal
|
||||
environment:
|
||||
POSTGRES_USER: hosted
|
||||
POSTGRES_PASSWORD: hosted
|
||||
POSTGRES_DB: hosted_gateway
|
||||
volumes:
|
||||
- postgres-data-dev:/var/lib/postgresql/data
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 256M
|
||||
reservations:
|
||||
memory: 128M
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
|
||||
|
||||
redis-dev:
|
||||
image: redis:7
|
||||
networks:
|
||||
- internal
|
||||
volumes:
|
||||
- redis-data-dev:/data
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 64M
|
||||
reservations:
|
||||
memory: 32M
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
|
||||
|
||||
bee-dev:
|
||||
image: ethersphere/bee:latest
|
||||
command: dev
|
||||
networks:
|
||||
- internal
|
||||
volumes:
|
||||
- bee-data-dev:/home/bee/.bee
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 256M
|
||||
reservations:
|
||||
memory: 128M
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
@@ -0,0 +1,37 @@
|
||||
auth_enabled: false
|
||||
|
||||
server:
|
||||
http_listen_port: 3100
|
||||
grpc_listen_port: 9096
|
||||
|
||||
common:
|
||||
instance_addr: 127.0.0.1
|
||||
path_prefix: /tmp/loki
|
||||
storage:
|
||||
filesystem:
|
||||
chunks_directory: /tmp/loki/chunks
|
||||
rules_directory: /tmp/loki/rules
|
||||
replication_factor: 1
|
||||
ring:
|
||||
kvstore:
|
||||
store: inmemory
|
||||
|
||||
query_range:
|
||||
results_cache:
|
||||
cache:
|
||||
embedded_cache:
|
||||
enabled: true
|
||||
max_size_mb: 100
|
||||
|
||||
schema_config:
|
||||
configs:
|
||||
- from: 2020-10-24
|
||||
store: tsdb
|
||||
object_store: filesystem
|
||||
schema: v13
|
||||
index:
|
||||
prefix: index_
|
||||
period: 24h
|
||||
|
||||
ruler:
|
||||
alertmanager_url: http://localhost:9093
|
||||
@@ -0,0 +1,201 @@
|
||||
version: '3.8'
|
||||
|
||||
networks:
|
||||
public:
|
||||
external: true
|
||||
internal:
|
||||
external: true
|
||||
|
||||
|
||||
volumes:
|
||||
postgres-data:
|
||||
driver: local
|
||||
redis-data:
|
||||
driver: local
|
||||
bee-data:
|
||||
driver: local
|
||||
|
||||
|
||||
services:
|
||||
|
||||
api:
|
||||
image: ghcr.io/token-for-token/hosted-gateway:main
|
||||
command: ["bun", "run", "src/api.ts"]
|
||||
env_file:
|
||||
- .env
|
||||
environment:
|
||||
DATABASE_URL: postgresql://hosted:hosted@postgres:5432/hosted_gateway?schema=public
|
||||
REDIS_HOST: redis
|
||||
REDIS_PORT: 6379
|
||||
BEE_API_URL: http://bee:1633
|
||||
HOSTED_GATEWAY_PORT: 8080
|
||||
networks:
|
||||
- public
|
||||
- internal
|
||||
deploy:
|
||||
replicas: 2
|
||||
update_config:
|
||||
parallelism: 1
|
||||
order: start-first
|
||||
resources:
|
||||
limits:
|
||||
memory: 512M
|
||||
reservations:
|
||||
memory: 512M
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=public"
|
||||
- "traefik.constraint-label=public"
|
||||
- "traefik.http.routers.api.rule=Host(`api.t4t-gateway.com`,`t4t-gateway.com`,`www.t4t-gateway.com`)"
|
||||
- "traefik.http.routers.api.entrypoints=websecure"
|
||||
- "traefik.http.routers.api.tls.certresolver=le"
|
||||
- "traefik.http.services.api.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.api.middlewares=redirect-to-https"
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
|
||||
|
||||
worker:
|
||||
image: ghcr.io/token-for-token/hosted-gateway:main
|
||||
command: ["bun", "run", "src/worker.ts"]
|
||||
env_file:
|
||||
- .env
|
||||
environment:
|
||||
DATABASE_URL: postgresql://hosted:hosted@postgres:5432/hosted_gateway?schema=public
|
||||
REDIS_HOST: redis
|
||||
REDIS_PORT: 6379
|
||||
BEE_API_URL: http://bee:1633
|
||||
networks:
|
||||
- internal
|
||||
deploy:
|
||||
replicas: 1
|
||||
update_config:
|
||||
parallelism: 1
|
||||
order: start-first
|
||||
resources:
|
||||
limits:
|
||||
memory: 512M
|
||||
reservations:
|
||||
memory: 512M
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
|
||||
|
||||
prisma:
|
||||
image: ghcr.io/token-for-token/hosted-gateway:main
|
||||
command: ["sh", "-c", "bunx prisma migrate deploy && tail -f /dev/null"]
|
||||
env_file:
|
||||
- .env
|
||||
environment:
|
||||
DATABASE_URL: postgresql://hosted:hosted@postgres:5432/hosted_gateway?schema=public
|
||||
networks:
|
||||
- internal
|
||||
deploy:
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: on-failure
|
||||
resources:
|
||||
limits:
|
||||
memory: 256M
|
||||
reservations:
|
||||
memory: 128M
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
|
||||
|
||||
postgres:
|
||||
image: postgres:16
|
||||
networks:
|
||||
- internal
|
||||
environment:
|
||||
POSTGRES_USER: hosted
|
||||
POSTGRES_PASSWORD: hosted
|
||||
POSTGRES_DB: hosted_gateway
|
||||
volumes:
|
||||
- postgres-data:/var/lib/postgresql/data
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 512M
|
||||
reservations:
|
||||
memory: 512M
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
|
||||
|
||||
redis:
|
||||
image: redis:7
|
||||
networks:
|
||||
- internal
|
||||
volumes:
|
||||
- redis-data:/data
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 128M
|
||||
reservations:
|
||||
memory: 64M
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
|
||||
|
||||
bee:
|
||||
image: ethersphere/bee:latest
|
||||
command: start
|
||||
env_file:
|
||||
- .env
|
||||
environment:
|
||||
BEE_API_ADDR: ":1633"
|
||||
BEE_P2P_ADDR: ":1634"
|
||||
BEE_VERBOSITY: "info"
|
||||
BEE_FULL_NODE: "false"
|
||||
BEE_SWAP_ENABLE: "true"
|
||||
BEE_CHAIN_ENABLE: "true"
|
||||
BEE_NETWORK_ID: "1"
|
||||
BEE_WELCOME_MESSAGE: "t4t-gateway"
|
||||
BEE_DATA_DIR: /home/bee/.bee
|
||||
volumes:
|
||||
- bee-data:/home/bee/.bee
|
||||
networks:
|
||||
- internal
|
||||
deploy:
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: on-failure
|
||||
resources:
|
||||
limits:
|
||||
memory: 1024M
|
||||
reservations:
|
||||
memory: 512M
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
|
||||
|
||||
postgres-exporter:
|
||||
image: quay.io/prometheuscommunity/postgres-exporter:latest
|
||||
networks:
|
||||
- internal
|
||||
environment:
|
||||
DATA_SOURCE_NAME: "postgresql://hosted:hosted@postgres:5432/hosted_gateway?sslmode=disable"
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 128M
|
||||
reservations:
|
||||
memory: 64M
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
@@ -0,0 +1,48 @@
|
||||
global:
|
||||
scrape_interval: 15s
|
||||
evaluation_interval: 15s
|
||||
|
||||
scrape_configs:
|
||||
- job_name: "traefik"
|
||||
static_configs:
|
||||
- targets: ["traefik:8080"]
|
||||
|
||||
- job_name: "prometheus"
|
||||
static_configs:
|
||||
- targets: ["localhost:9090"]
|
||||
|
||||
- job_name: "grafana"
|
||||
static_configs:
|
||||
- targets: ["grafana:3000"]
|
||||
|
||||
- job_name: "loki"
|
||||
static_configs:
|
||||
- targets: ["loki:3100"]
|
||||
|
||||
- job_name: "node-exporter"
|
||||
dns_sd_configs:
|
||||
- names:
|
||||
- "tasks.system_node-exporter"
|
||||
type: A
|
||||
port: 9100
|
||||
|
||||
- job_name: "postgres-exporter"
|
||||
dns_sd_configs:
|
||||
- names:
|
||||
- "tasks.prod_postgres-exporter"
|
||||
type: A
|
||||
port: 9187
|
||||
|
||||
- job_name: "cadvisor"
|
||||
dns_sd_configs:
|
||||
- names:
|
||||
- "tasks.system_cadvisor"
|
||||
type: A
|
||||
port: 8080
|
||||
|
||||
- job_name: "hosted-gateway"
|
||||
dns_sd_configs:
|
||||
- names:
|
||||
- "tasks.prod_api"
|
||||
type: A
|
||||
port: 8080
|
||||
@@ -0,0 +1,128 @@
|
||||
# Hostinger (production) stacks
|
||||
|
||||
Docker Swarm stack files for the t4t hosted-gateway, deployed to a single
|
||||
Hostinger VPS at `ssh root@195.35.25.26` and reachable at
|
||||
[t4t-gateway.com](https://t4t-gateway.com).
|
||||
|
||||
Layout mirrors [cipherdolls/devops/hostinger/](https://github.com/cipherdolls/devops).
|
||||
|
||||
## Stacks
|
||||
|
||||
| Stack | File | What it runs |
|
||||
| --- | --- | --- |
|
||||
| `system` | `system-stack.yaml` | Traefik (TLS + ingress), Grafana, Loki, Prometheus, node-exporter, cadvisor. Owns the `public` + `internal` overlay networks. |
|
||||
| `prod` | `prod-stack.yaml` | hosted-gateway api + worker + one-shot prisma migrate, plus postgres / redis / bee / postgres-exporter. |
|
||||
| `dev` | `dev-stack.yaml` | Staging on `dev.t4t-gateway.com` — the `:develop` image tag against its own postgres / redis / bee volumes. |
|
||||
|
||||
Supporting configs:
|
||||
|
||||
- `loki.yaml` — Loki single-binary filesystem config
|
||||
- `prometheus.yml` — scrape targets (traefik, grafana, loki, node-exporter,
|
||||
postgres-exporter, cadvisor, hosted-gateway api)
|
||||
- `.env.example` — copy to `.env` on the host, fill in
|
||||
`OPERATOR_PRIVATE_KEY` / `JWT_SECRET_KEY` / etc.
|
||||
|
||||
## DNS records (Hostinger DNS panel)
|
||||
|
||||
Point all of these at `195.35.25.26`:
|
||||
|
||||
```
|
||||
A t4t-gateway.com 195.35.25.26
|
||||
A www.t4t-gateway.com 195.35.25.26
|
||||
A api.t4t-gateway.com 195.35.25.26
|
||||
A dev.t4t-gateway.com 195.35.25.26
|
||||
A traefik.t4t-gateway.com 195.35.25.26
|
||||
A grafana.t4t-gateway.com 195.35.25.26
|
||||
A loki.t4t-gateway.com 195.35.25.26
|
||||
A prometheus.t4t-gateway.com 195.35.25.26
|
||||
```
|
||||
|
||||
## One-time host setup
|
||||
|
||||
```bash
|
||||
ssh root@195.35.25.26
|
||||
|
||||
# Docker + swarm
|
||||
curl -fsSL https://get.docker.com | sh
|
||||
docker swarm init --advertise-addr 195.35.25.26
|
||||
|
||||
# Loki driver (so container logs ship to Loki via the `loki` logging driver)
|
||||
docker plugin install grafana/loki-docker-driver:2.9.7 \
|
||||
--alias loki --grant-all-permissions
|
||||
|
||||
# Drop the stack files + configs on the host
|
||||
mkdir -p /opt/t4t-gateway && cd /opt/t4t-gateway
|
||||
# rsync this directory up here (or `git clone` the devops repo)
|
||||
cp .env.example .env && chmod 600 .env
|
||||
$EDITOR .env # fill in OPERATOR_PRIVATE_KEY, JWT_SECRET_KEY, ...
|
||||
```
|
||||
|
||||
## Deploy
|
||||
|
||||
The system stack creates the shared overlay networks, so deploy it first.
|
||||
|
||||
```bash
|
||||
cd /opt/t4t-gateway
|
||||
|
||||
# 1. Networks + ingress + monitoring
|
||||
docker stack deploy -c system-stack.yaml system
|
||||
|
||||
# 2. App + datastores
|
||||
docker stack deploy -c prod-stack.yaml prod
|
||||
|
||||
# (optional) staging on dev.t4t-gateway.com
|
||||
docker stack deploy -c dev-stack.yaml dev
|
||||
```
|
||||
|
||||
Re-deploying after a new image tag:
|
||||
|
||||
```bash
|
||||
docker service update --image ghcr.io/token-for-token/hosted-gateway:main \
|
||||
--force prod_api
|
||||
docker service update --image ghcr.io/token-for-token/hosted-gateway:main \
|
||||
--force prod_worker
|
||||
```
|
||||
|
||||
## Secrets
|
||||
|
||||
`OPERATOR_PRIVATE_KEY` is the on-chain identity for every tenant. For now it
|
||||
lives in `/opt/t4t-gateway/.env` (chmod 600). Future work: migrate to a
|
||||
proper Docker secret backed by the host's secret manager — never an env var
|
||||
in the stack file.
|
||||
|
||||
## Backups
|
||||
|
||||
Postgres volume:
|
||||
|
||||
```bash
|
||||
docker run --rm \
|
||||
-v prod_postgres-data:/from_volume \
|
||||
-v $(pwd):/workdir \
|
||||
alpine \
|
||||
sh -c "cd /from_volume && tar cvf /workdir/prod_postgres-data.tar ."
|
||||
|
||||
scp root@195.35.25.26:/opt/t4t-gateway/prod_postgres-data.tar ~/Downloads
|
||||
```
|
||||
|
||||
Bee data volume (postage batch / swarm keys — DO NOT lose this):
|
||||
|
||||
```bash
|
||||
docker run --rm \
|
||||
-v prod_bee-data:/from_volume \
|
||||
-v $(pwd):/workdir \
|
||||
alpine \
|
||||
sh -c "cd /from_volume && tar cvf /workdir/prod_bee-data.tar ."
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
```bash
|
||||
docker stack services system # health of ingress + monitoring
|
||||
docker stack services prod # health of gateway + data
|
||||
docker service logs -f prod_api
|
||||
docker service logs -f prod_worker
|
||||
|
||||
# Replay a failed Prisma migration:
|
||||
docker exec -it $(docker ps -q -f name=prod_prisma) sh
|
||||
bunx prisma migrate resolve --rolled-back <migration_name>
|
||||
```
|
||||
@@ -0,0 +1,232 @@
|
||||
version: '3.8'
|
||||
|
||||
|
||||
networks:
|
||||
public:
|
||||
name: public
|
||||
driver: overlay
|
||||
|
||||
internal:
|
||||
name: internal
|
||||
driver: overlay
|
||||
|
||||
|
||||
volumes:
|
||||
traefik-letsencrypt:
|
||||
driver: local
|
||||
traefik-logs:
|
||||
driver: local
|
||||
grafana-data:
|
||||
driver: local
|
||||
loki-data:
|
||||
driver: local
|
||||
prometheus-data:
|
||||
driver: local
|
||||
|
||||
|
||||
configs:
|
||||
loki_config:
|
||||
file: ./loki.yaml
|
||||
prometheus_config:
|
||||
file: ./prometheus.yml
|
||||
|
||||
|
||||
services:
|
||||
|
||||
traefik:
|
||||
image: traefik:v2.11.22
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
command:
|
||||
- --providers.docker
|
||||
- --providers.docker.network=public
|
||||
- --providers.docker.constraints=Label(`traefik.constraint-label`, `public`)
|
||||
- --providers.docker.exposedbydefault=false
|
||||
- --providers.docker.swarmmode
|
||||
- --entrypoints.web.address=:80
|
||||
- --entrypoints.websecure.address=:443
|
||||
- --certificatesresolvers.le.acme.email=t4t-gateway@proton.me
|
||||
- --certificatesresolvers.le.acme.storage=/certificates/acme.json
|
||||
- --certificatesresolvers.le.acme.tlschallenge=true
|
||||
- --api=true
|
||||
- --api.dashboard=true
|
||||
- --metrics.prometheus=true
|
||||
- --accesslog=true
|
||||
- --log=true
|
||||
networks:
|
||||
- public
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- traefik-letsencrypt:/certificates
|
||||
- traefik-logs:/var/log/traefik
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- node.role == manager
|
||||
resources:
|
||||
limits:
|
||||
memory: 256M
|
||||
reservations:
|
||||
memory: 128M
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=public"
|
||||
- "traefik.constraint-label=public"
|
||||
- "traefik.http.routers.dashboard.service=api@internal"
|
||||
- "traefik.http.routers.traefikk.rule=Host(`traefik.t4t-gateway.com`)"
|
||||
- "traefik.http.routers.traefikk.entrypoints=websecure"
|
||||
- "traefik.http.routers.traefikk.tls.certresolver=le"
|
||||
- "traefik.http.routers.traefikk.middlewares=admin-auth"
|
||||
- "traefik.http.services.traefikk.loadbalancer.server.port=8080"
|
||||
- "traefik.http.middlewares.admin-auth.basicauth.users=admin:$$apr1$$EyLN9D7y$$4v2q7sYTN7aIlE2yeujRJ/"
|
||||
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
|
||||
- "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
|
||||
|
||||
grafana:
|
||||
image: grafana/grafana:12.4.2
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:3000/api/health || exit 1"]
|
||||
interval: 10s
|
||||
timeout: 3s
|
||||
retries: 3
|
||||
start_period: 10s
|
||||
networks:
|
||||
- public
|
||||
- internal
|
||||
volumes:
|
||||
- grafana-data:/var/lib/grafana
|
||||
environment:
|
||||
- GF_AUTH_DISABLE_LOGIN_FORM=true
|
||||
- GF_AUTH_ANONYMOUS_ENABLED=true
|
||||
- GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
|
||||
- GF_SECURITY_ALLOW_EMBEDDING=true
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 512M
|
||||
reservations:
|
||||
memory: 256M
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.grafana.rule=Host(`grafana.t4t-gateway.com`)"
|
||||
- "traefik.http.routers.grafana.entrypoints=websecure"
|
||||
- "traefik.http.routers.grafana.tls.certresolver=le"
|
||||
- "traefik.docker.network=public"
|
||||
- "traefik.constraint-label=public"
|
||||
- "traefik.http.services.grafana.loadbalancer.server.port=3000"
|
||||
- "traefik.http.middlewares.admin-auth.basicauth.users=admin:$$apr1$$EyLN9D7y$$4v2q7sYTN7aIlE2yeujRJ/"
|
||||
- "traefik.http.routers.grafana.middlewares=admin-auth,redirect-to-https"
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
|
||||
|
||||
loki:
|
||||
image: grafana/loki:2.9.7
|
||||
networks:
|
||||
- public
|
||||
- internal
|
||||
configs:
|
||||
- source: loki_config
|
||||
target: /etc/loki/loki.yaml
|
||||
volumes:
|
||||
- loki-data:/loki
|
||||
command: -config.file=/etc/loki/loki.yaml
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 256M
|
||||
reservations:
|
||||
memory: 128M
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.loki.rule=Host(`loki.t4t-gateway.com`)"
|
||||
- "traefik.http.routers.loki.entrypoints=websecure"
|
||||
- "traefik.http.routers.loki.tls.certresolver=le"
|
||||
- "traefik.docker.network=public"
|
||||
- "traefik.constraint-label=public"
|
||||
- "traefik.http.services.loki.loadbalancer.server.port=3100"
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
|
||||
|
||||
prometheus:
|
||||
image: prom/prometheus:v3.7.2
|
||||
networks:
|
||||
- public
|
||||
- internal
|
||||
configs:
|
||||
- source: prometheus_config
|
||||
target: /etc/prometheus/prometheus.yml
|
||||
volumes:
|
||||
- prometheus-data:/prometheus
|
||||
command: --config.file=/etc/prometheus/prometheus.yml
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 1024M
|
||||
reservations:
|
||||
memory: 512M
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.prometheus.rule=Host(`prometheus.t4t-gateway.com`)"
|
||||
- "traefik.http.routers.prometheus.entrypoints=websecure"
|
||||
- "traefik.http.routers.prometheus.tls.certresolver=le"
|
||||
- "traefik.docker.network=public"
|
||||
- "traefik.constraint-label=public"
|
||||
- "traefik.http.services.prometheus.loadbalancer.server.port=9090"
|
||||
- "traefik.http.middlewares.admin-auth.basicauth.users=admin:$$apr1$$EyLN9D7y$$4v2q7sYTN7aIlE2yeujRJ/"
|
||||
- "traefik.http.routers.prometheus.middlewares=admin-auth"
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
|
||||
|
||||
node-exporter:
|
||||
image: prom/node-exporter:master
|
||||
command: --path.rootfs=/host
|
||||
networks:
|
||||
- internal
|
||||
deploy:
|
||||
mode: global
|
||||
resources:
|
||||
limits:
|
||||
memory: 32M
|
||||
reservations:
|
||||
memory: 24M
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
|
||||
|
||||
cadvisor:
|
||||
image: gcr.io/cadvisor/cadvisor:latest
|
||||
networks:
|
||||
- internal
|
||||
volumes:
|
||||
- /:/rootfs:ro
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
deploy:
|
||||
mode: global
|
||||
resources:
|
||||
limits:
|
||||
memory: 128M
|
||||
reservations:
|
||||
memory: 65M
|
||||
logging:
|
||||
driver: loki
|
||||
options:
|
||||
loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"
|
||||
@@ -0,0 +1,48 @@
|
||||
# Local dev + test env. Copy to .env and adjust.
|
||||
# Compose files load this with `env_file: [.env]`.
|
||||
|
||||
# Postgres (used by hosted-gateway via DATABASE_URL)
|
||||
POSTGRES_USER=hosted
|
||||
POSTGRES_PASSWORD=hosted
|
||||
POSTGRES_DB=hosted_gateway
|
||||
DATABASE_URL=postgresql://hosted:hosted@postgres:5432/hosted_gateway?schema=public
|
||||
|
||||
# Redis
|
||||
REDIS_HOST=redis
|
||||
REDIS_PORT=6379
|
||||
|
||||
# Auth
|
||||
JWT_SECRET_KEY=dev-only-jwt-secret-change-me
|
||||
GOOGLE_OAUTH_CLIENT_ID=
|
||||
|
||||
# Operator wallet — anvil deterministic key (account 0) for local dev/test.
|
||||
# The bootstrap step in test/setup.ts funds this address with xDAI + xBZZ
|
||||
# via anvil_setBalance + xBZZ-whale impersonation.
|
||||
OPERATOR_PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80
|
||||
GNOSIS_RPC_URL=http://anvil:8545
|
||||
|
||||
# T4T protocol contracts (Gnosis mainnet — managed by the t4t repo).
|
||||
# These are valid on the anvil fork because we --fork-url'd Gnosis mainnet.
|
||||
REGISTRY_ADDRESS=0xf81121AAbc2F7261224BaDd0Ed871711e6D1371E
|
||||
ESCROW_ADDRESS=0x34Db8E014E71928f17E23eC1272B602582222c9c
|
||||
XBZZ_ADDRESS=0xdBF3Ea6F5beE45c02255B2c26a16F300502F68da
|
||||
|
||||
# Bee — we point at a real running Bee node (bee.ffaerber.duckdns.org) rather
|
||||
# than spinning up dev-mode Bee in compose. The remote Bee already has real
|
||||
# postage stamps for PSS routing to mainnet providers.
|
||||
BEE_API_URL=https://bee.ffaerber.duckdns.org
|
||||
BEE_POSTAGE_BATCH_ID=
|
||||
BEE_STAMP_MANAGE=false
|
||||
BEE_STAMP_LABEL=hosted-gateway-local
|
||||
BEE_STAMP_TTL_DAYS=30
|
||||
|
||||
# Pricing
|
||||
MARKUP_BPS=2000
|
||||
WELCOME_XBZZ_WEI=50000000000000000000
|
||||
|
||||
# Concurrency
|
||||
MAX_CONCURRENT_JOBS=200
|
||||
|
||||
# Server
|
||||
HOSTED_GATEWAY_PORT=8080
|
||||
LOG_LEVEL=debug
|
||||
+159
@@ -0,0 +1,159 @@
|
||||
# Hosted gateway — local dev + test orchestration.
|
||||
# Mirrors cipherdolls/devops/local/Makefile.
|
||||
|
||||
PROJECT := hosted-gateway
|
||||
COMPOSE_DEV := docker-compose.yaml
|
||||
COMPOSE_TEST := docker-compose-test.yaml
|
||||
DC := docker compose -p $(PROJECT) -f $(COMPOSE_TEST)
|
||||
DC_DEV := docker compose -p $(PROJECT)-dev -f $(COMPOSE_DEV)
|
||||
TEST_CONTAINER := $(PROJECT)-bun
|
||||
LOG_DIR := /tmp/hosted-gateway-test-logs
|
||||
|
||||
SPEC ?= accounts
|
||||
SPECS := health auth models gateway ledger cancellation concurrency
|
||||
TIMEOUT ?= 600
|
||||
|
||||
SERVICES := postgres redis prisma api worker
|
||||
|
||||
# Specs that need the gnosis-fork stack (anvil + bee) and/or a registered
|
||||
# provider → activate the `gateway` compose profile. `models` only needs the
|
||||
# fork (read-only chain calls); `gateway`/`concurrency`/`cancellation` also
|
||||
# need the t4t-provider + mock-ollama containers.
|
||||
GATEWAY_SPECS := models gateway concurrency cancellation
|
||||
gateway_profile = $(if $(filter $(1),$(GATEWAY_SPECS)),--profile gateway,)
|
||||
|
||||
.PHONY: dev-up dev-down dev-watch up up-detached down logs build clean test test-all $(addprefix test-,$(SPECS)) help lock
|
||||
|
||||
# ---------- dev ----------
|
||||
|
||||
dev-up:
|
||||
$(DC_DEV) up
|
||||
|
||||
dev-down:
|
||||
$(DC_DEV) down -v --remove-orphans -t 0
|
||||
|
||||
dev-watch:
|
||||
$(DC_DEV) watch
|
||||
|
||||
# ---------- test ----------
|
||||
|
||||
# Generate / refresh bun.lock inside the hosted-gateway repo via a one-shot
|
||||
# container. Mirrors cipherdolls' approach so no host-side Bun install is
|
||||
# required.
|
||||
lock:
|
||||
@echo "========== Generating bun.lock =========="
|
||||
docker run --rm -v ../../hosted-gateway:/app -w /app oven/bun:1.2-alpine bun install
|
||||
@echo "========== bun.lock updated =========="
|
||||
|
||||
# Run a single spec by name. Example: `make test SPEC=accounts`
|
||||
define run_test
|
||||
bash -c '\
|
||||
set +e; \
|
||||
mkdir -p $(LOG_DIR); \
|
||||
cleanup() { \
|
||||
echo ""; \
|
||||
echo "========== Cleaning up =========="; \
|
||||
docker rm -f $(TEST_CONTAINER) 2>/dev/null; \
|
||||
$(DC) kill 2>/dev/null; \
|
||||
$(DC) down -v --remove-orphans -t 0 2>/dev/null; \
|
||||
}; \
|
||||
trap cleanup EXIT; \
|
||||
echo "========== Updating bun.lock =========="; \
|
||||
docker run --rm -v ../../hosted-gateway:/app -w /app oven/bun:1.2-alpine bun install --frozen-lockfile 2>/dev/null || \
|
||||
docker run --rm -v ../../hosted-gateway:/app -w /app oven/bun:1.2-alpine bun install; \
|
||||
echo "========== Starting services =========="; \
|
||||
$(DC) $(call gateway_profile,$(1)) up -d --build --wait $(SERVICES); \
|
||||
if [ "$(call gateway_profile,$(1))" != "" ]; then \
|
||||
echo "========== Starting gateway profile (anvil) =========="; \
|
||||
$(DC) $(call gateway_profile,$(1)) up -d --build --wait anvil || { echo "gateway profile failed to start"; exit 1; }; \
|
||||
if [ "$(1)" != "models" ]; then \
|
||||
echo "========== Starting t4t-provider + mock-ollama =========="; \
|
||||
$(DC) $(call gateway_profile,$(1)) up -d --build --wait t4t-provider mock-ollama || { echo "provider profile failed to start"; exit 1; }; \
|
||||
fi; \
|
||||
fi; \
|
||||
echo "========== Running $(1) =========="; \
|
||||
$(DC) build --no-cache bun; \
|
||||
$(DC) $(call gateway_profile,$(1)) run -d --no-deps --name $(TEST_CONTAINER) \
|
||||
-e SPEC_GLOB="./test/$(1).e2e-spec.ts" \
|
||||
bun; \
|
||||
\
|
||||
docker wait $(TEST_CONTAINER) &>/dev/null & \
|
||||
WAIT_PID=$$!; \
|
||||
stdbuf -oL docker logs -f $(TEST_CONTAINER) 2>&1 \
|
||||
| stdbuf -oL sed "s/\x1b\[[0-9;]*m//g" \
|
||||
> $(LOG_DIR)/$(1).log & \
|
||||
LOGS_PID=$$!; \
|
||||
\
|
||||
if ! timeout $(TIMEOUT) tail --pid=$$WAIT_PID -f /dev/null 2>/dev/null; then \
|
||||
echo "========== TIMEOUT after $(TIMEOUT)s =========="; \
|
||||
docker kill $(TEST_CONTAINER) 2>/dev/null; \
|
||||
fi; \
|
||||
wait $$WAIT_PID 2>/dev/null; \
|
||||
rc=$$(docker inspect -f "{{.State.ExitCode}}" $(TEST_CONTAINER) 2>/dev/null || echo 1); \
|
||||
kill $$LOGS_PID 2>/dev/null; \
|
||||
wait $$LOGS_PID 2>/dev/null; \
|
||||
echo "========== Tests finished (rc=$$rc) — log: $(LOG_DIR)/$(1).log =========="; \
|
||||
exit $$rc'
|
||||
endef
|
||||
|
||||
test:
|
||||
$(call run_test,$(SPEC))
|
||||
|
||||
test-all:
|
||||
@failed=""; \
|
||||
for spec in $(SPECS); do \
|
||||
echo ""; \
|
||||
echo "========== Suite: $$spec =========="; \
|
||||
$(MAKE) --no-print-directory test SPEC=$$spec; \
|
||||
if [ $$? -ne 0 ]; then failed="$$failed $$spec"; fi; \
|
||||
done; \
|
||||
if [ -n "$$failed" ]; then \
|
||||
echo ""; \
|
||||
echo "Failed specs:$$failed"; exit 1; \
|
||||
else \
|
||||
echo ""; \
|
||||
echo "All specs passed"; \
|
||||
fi
|
||||
|
||||
$(addprefix test-,$(SPECS)):
|
||||
$(call run_test,$(subst test-,,$@))
|
||||
|
||||
up:
|
||||
$(DC) up
|
||||
|
||||
up-detached:
|
||||
$(DC) up -d
|
||||
|
||||
down:
|
||||
$(DC) kill 2>/dev/null || true
|
||||
$(DC) down -v --remove-orphans -t 0
|
||||
|
||||
logs:
|
||||
$(DC) logs -f
|
||||
|
||||
build:
|
||||
$(DC) build
|
||||
|
||||
clean:
|
||||
$(DC) kill 2>/dev/null || true
|
||||
$(DC) down -v --remove-orphans --rmi local -t 0
|
||||
@docker ps -aq --filter "label=com.docker.compose.project=$(PROJECT)" | xargs -r docker rm -f 2>/dev/null || true
|
||||
@docker volume ls -q --filter "label=com.docker.compose.project=$(PROJECT)" | xargs -r docker volume rm -f 2>/dev/null || true
|
||||
@docker network ls -q --filter "label=com.docker.compose.project=$(PROJECT)" | xargs -r docker network rm 2>/dev/null || true
|
||||
|
||||
help:
|
||||
@echo "Usage:"
|
||||
@echo " make dev-up Start dev stack (postgres, redis, anvil, bee, api, worker)"
|
||||
@echo " make dev-down Stop and clean dev stack"
|
||||
@echo " make dev-watch Dev with file sync"
|
||||
@echo " make test SPEC=accounts Run one e2e spec inside docker"
|
||||
@echo " make test-accounts Same as `make test SPEC=accounts`"
|
||||
@echo " make test-all Run every spec sequentially"
|
||||
@echo " make up Start test stack (no test runner)"
|
||||
@echo " make down Tear down test stack"
|
||||
@echo " make logs Tail test stack logs"
|
||||
@echo " make lock Regenerate bun.lock via docker"
|
||||
@echo " make clean Nuclear cleanup"
|
||||
@echo ""
|
||||
@echo "Available specs:"
|
||||
@echo " $(SPECS)" | fold -s -w 70
|
||||
@@ -0,0 +1,166 @@
|
||||
# Local test stack for the hosted gateway. The smart contracts are NOT
|
||||
# deployed here — they're managed by the t4t repo and already live on Gnosis
|
||||
# mainnet. The anvil service forks Gnosis mainnet so those addresses are
|
||||
# usable as-is.
|
||||
#
|
||||
# Funding (giving the operator + test-provider xBZZ and xDAI on the fork) is
|
||||
# handled inside `test/setup.ts` via viem's anvil test actions
|
||||
# (anvil_setBalance + impersonateAccount on an xBZZ whale).
|
||||
#
|
||||
# Run from `devops/local/`: `make test SPEC=accounts` / `make test-all`.
|
||||
|
||||
services:
|
||||
|
||||
postgres:
|
||||
image: postgres:16
|
||||
env_file: [.env]
|
||||
expose:
|
||||
- "5432"
|
||||
tmpfs:
|
||||
- /var/lib/postgresql/data
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
|
||||
interval: 2s
|
||||
timeout: 2s
|
||||
retries: 60
|
||||
networks: [test]
|
||||
|
||||
redis:
|
||||
image: redis:7
|
||||
expose:
|
||||
- "6379"
|
||||
healthcheck:
|
||||
test: ["CMD", "redis-cli", "ping"]
|
||||
interval: 2s
|
||||
retries: 30
|
||||
networks: [test]
|
||||
|
||||
# Anvil + Bee are only needed by specs that hit chain / Swarm. Profile-gated
|
||||
# so `make test SPEC=auth` runs without them; `make test SPEC=gateway` adds
|
||||
# the gateway profile.
|
||||
anvil:
|
||||
image: ghcr.io/foundry-rs/foundry:latest
|
||||
pull_policy: always
|
||||
profiles: [gateway]
|
||||
# The foundry image's ENTRYPOINT is `["/bin/sh", "-c"]`, which interprets
|
||||
# only its FIRST argument as the command — anvil's flags then ended up as
|
||||
# shell positional params and were silently dropped. Override the
|
||||
# entrypoint to invoke anvil directly. Don't pass `--chain-id` here —
|
||||
# `--fork-url` propagates the chain id (100) automatically.
|
||||
entrypoint: ["anvil"]
|
||||
command:
|
||||
- --host=0.0.0.0
|
||||
- --port=8545
|
||||
- --fork-url=https://rpc.gnosischain.com
|
||||
- --block-time=1
|
||||
environment:
|
||||
ANVIL_IP_ADDR: "0.0.0.0"
|
||||
expose:
|
||||
- "8545"
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "cast block-number --rpc-url http://localhost:8545 >/dev/null 2>&1"]
|
||||
interval: 3s
|
||||
retries: 60
|
||||
start_period: 60s
|
||||
networks: [test]
|
||||
|
||||
# Local Bee was removed — see devops/local/.env BEE_API_URL. We hit
|
||||
# bee.ffaerber.duckdns.org (real running Bee node) for PSS routing + Swarm
|
||||
# uploads. Faster than the local dev container and avoids the dev-mode
|
||||
# postage / wget healthcheck quirks.
|
||||
|
||||
prisma:
|
||||
build:
|
||||
context: ../../hosted-gateway
|
||||
command: ["sh", "-c", "bunx prisma migrate deploy"]
|
||||
env_file: [.env]
|
||||
depends_on:
|
||||
postgres: { condition: service_healthy }
|
||||
networks: [test]
|
||||
|
||||
api:
|
||||
build:
|
||||
context: ../../hosted-gateway
|
||||
command: ["bun", "run", "src/api.ts"]
|
||||
env_file: [.env]
|
||||
environment:
|
||||
NODE_ENV: test
|
||||
expose:
|
||||
- "8080"
|
||||
depends_on:
|
||||
postgres: { condition: service_healthy }
|
||||
redis: { condition: service_healthy }
|
||||
prisma: { condition: service_completed_successfully }
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health || exit 1"]
|
||||
interval: 3s
|
||||
timeout: 3s
|
||||
retries: 30
|
||||
start_period: 30s
|
||||
networks: [test]
|
||||
|
||||
worker:
|
||||
build:
|
||||
context: ../../hosted-gateway
|
||||
command: ["bun", "run", "src/worker.ts"]
|
||||
env_file: [.env]
|
||||
environment:
|
||||
NODE_ENV: test
|
||||
depends_on:
|
||||
postgres: { condition: service_healthy }
|
||||
redis: { condition: service_healthy }
|
||||
prisma: { condition: service_completed_successfully }
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "ps aux | grep 'src/worker.ts' | grep -v grep || exit 1"]
|
||||
interval: 3s
|
||||
retries: 30
|
||||
networks: [test]
|
||||
|
||||
# The existing t4t-container in provider mode. Reads the canonical Gnosis
|
||||
# mainnet contract addresses from its baked defaults (see
|
||||
# t4t/container/src/lib/config.ts) — those addresses are valid on the anvil
|
||||
# fork too. Funding (xBZZ + xDAI on the fork) happens in `test/setup.ts`.
|
||||
#
|
||||
# Profile-gated: only specs that actually need to settle a chat completion
|
||||
# on-chain require this container. `make test SPEC=auth` / `make test
|
||||
# SPEC=accounts` skip it; `make test SPEC=gateway` activates the profile.
|
||||
t4t-provider:
|
||||
image: ghcr.io/token-for-token/t4t:latest
|
||||
pull_policy: missing
|
||||
profiles: [gateway]
|
||||
environment:
|
||||
T4T_MODE: provider
|
||||
T4T_OLLAMA_URL: http://mock-ollama:11434
|
||||
GNOSIS_RPC_URL: http://anvil:8545
|
||||
BEE_API_URL: http://bee:1633
|
||||
depends_on:
|
||||
anvil: { condition: service_healthy }
|
||||
mock-ollama: { condition: service_started }
|
||||
networks: [test]
|
||||
|
||||
mock-ollama:
|
||||
build:
|
||||
context: ./mock-ollama
|
||||
profiles: [gateway]
|
||||
expose:
|
||||
- "11434"
|
||||
networks: [test]
|
||||
|
||||
bun:
|
||||
build:
|
||||
context: ../../hosted-gateway
|
||||
# The leading `$$` escapes compose's variable substitution so the inner
|
||||
# shell expands $SPEC_GLOB at runtime (where `make test` set it via `-e`).
|
||||
command: ["sh", "-c", "bun test --timeout 60000 $${SPEC_GLOB:-./test/**/*.e2e-spec.ts}"]
|
||||
env_file: [.env]
|
||||
environment:
|
||||
NODE_ENV: test
|
||||
HOSTED_GATEWAY_URL: http://api:8080
|
||||
depends_on:
|
||||
api: { condition: service_healthy }
|
||||
worker: { condition: service_healthy }
|
||||
networks: [test]
|
||||
|
||||
networks:
|
||||
test:
|
||||
driver: bridge
|
||||
@@ -0,0 +1,108 @@
|
||||
# Local dev stack for the hosted gateway. Brings up everything the gateway
|
||||
# needs to serve `/v1/chat/completions` end-to-end against a forked Gnosis
|
||||
# chain + a real t4t-provider talking to a mock Ollama.
|
||||
#
|
||||
# Run from `devops/local/`: `make dev-up` / `docker compose up`.
|
||||
|
||||
services:
|
||||
|
||||
postgres:
|
||||
image: postgres:16
|
||||
env_file: [.env]
|
||||
ports:
|
||||
- "5432:5432"
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
|
||||
interval: 3s
|
||||
timeout: 3s
|
||||
retries: 30
|
||||
networks: [dev]
|
||||
|
||||
redis:
|
||||
image: redis:7
|
||||
ports:
|
||||
- "6379:6379"
|
||||
healthcheck:
|
||||
test: ["CMD", "redis-cli", "ping"]
|
||||
interval: 3s
|
||||
retries: 30
|
||||
networks: [dev]
|
||||
|
||||
anvil:
|
||||
image: ghcr.io/foundry-rs/foundry:latest
|
||||
pull_policy: always
|
||||
command:
|
||||
- anvil
|
||||
- --host=0.0.0.0
|
||||
- --port=8545
|
||||
- --chain-id=100
|
||||
- --fork-url=${GNOSIS_RPC_URL_UPSTREAM:-https://rpc.gnosischain.com}
|
||||
- --block-time=1
|
||||
environment:
|
||||
ANVIL_IP_ADDR: "0.0.0.0"
|
||||
expose:
|
||||
- "8545"
|
||||
ports:
|
||||
- "8545:8545"
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "cast block-number --rpc-url http://localhost:8545 >/dev/null 2>&1"]
|
||||
interval: 3s
|
||||
timeout: 3s
|
||||
retries: 60
|
||||
start_period: 30s
|
||||
networks: [dev]
|
||||
|
||||
bee:
|
||||
image: ethersphere/bee:latest
|
||||
command: dev
|
||||
ports:
|
||||
- "1633:1633"
|
||||
networks: [dev]
|
||||
|
||||
# Prisma migration step — runs once on `up`, then exits.
|
||||
prisma:
|
||||
build:
|
||||
context: ../../hosted-gateway
|
||||
command: ["sh", "-c", "bunx prisma migrate deploy"]
|
||||
env_file: [.env]
|
||||
depends_on:
|
||||
postgres: { condition: service_healthy }
|
||||
networks: [dev]
|
||||
|
||||
api:
|
||||
build:
|
||||
context: ../../hosted-gateway
|
||||
command: ["bun", "run", "src/api.ts"]
|
||||
env_file: [.env]
|
||||
ports:
|
||||
- "8080:8080"
|
||||
depends_on:
|
||||
postgres: { condition: service_healthy }
|
||||
redis: { condition: service_healthy }
|
||||
anvil: { condition: service_healthy }
|
||||
bee: { condition: service_started }
|
||||
prisma: { condition: service_completed_successfully }
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health || exit 1"]
|
||||
interval: 5s
|
||||
timeout: 3s
|
||||
retries: 30
|
||||
start_period: 15s
|
||||
networks: [dev]
|
||||
|
||||
worker:
|
||||
build:
|
||||
context: ../../hosted-gateway
|
||||
command: ["bun", "run", "src/worker.ts"]
|
||||
env_file: [.env]
|
||||
depends_on:
|
||||
postgres: { condition: service_healthy }
|
||||
redis: { condition: service_healthy }
|
||||
anvil: { condition: service_healthy }
|
||||
bee: { condition: service_started }
|
||||
prisma: { condition: service_completed_successfully }
|
||||
networks: [dev]
|
||||
|
||||
networks:
|
||||
dev:
|
||||
driver: bridge
|
||||
@@ -0,0 +1,8 @@
|
||||
# Minimal mock Ollama HTTP server for E2E tests — returns a canned
|
||||
# `/api/chat`-shaped completion regardless of input. The t4t-provider treats
|
||||
# this as its inference backend; no GPU needed.
|
||||
FROM oven/bun:1.2-alpine
|
||||
WORKDIR /app
|
||||
COPY server.ts ./server.ts
|
||||
EXPOSE 11434
|
||||
CMD ["bun", "run", "server.ts"]
|
||||
@@ -0,0 +1,47 @@
|
||||
// Stub Ollama HTTP for E2E tests. Returns a deterministic completion so the
|
||||
// gateway -> provider -> claim flow can be asserted end-to-end without a GPU.
|
||||
//
|
||||
// Implements just enough of the Ollama HTTP surface to satisfy the
|
||||
// t4t-provider's inference call: GET /api/tags and POST /api/chat.
|
||||
|
||||
const PORT = 11434;
|
||||
|
||||
Bun.serve({
|
||||
port: PORT,
|
||||
hostname: '0.0.0.0',
|
||||
async fetch(req: Request): Promise<Response> {
|
||||
const url = new URL(req.url);
|
||||
if (url.pathname === '/api/tags') {
|
||||
return Response.json({
|
||||
models: [
|
||||
{
|
||||
name: 'qwen2.5:0.5b',
|
||||
modified_at: new Date().toISOString(),
|
||||
size: 0,
|
||||
digest: 'mock',
|
||||
details: {
|
||||
format: 'gguf',
|
||||
family: 'qwen',
|
||||
parameter_size: '0.5B',
|
||||
quantization_level: 'Q4_0',
|
||||
},
|
||||
},
|
||||
],
|
||||
});
|
||||
}
|
||||
if (url.pathname === '/api/chat' && req.method === 'POST') {
|
||||
return Response.json({
|
||||
model: 'qwen2.5:0.5b',
|
||||
created_at: new Date().toISOString(),
|
||||
message: { role: 'assistant', content: 'pong (mock-ollama)' },
|
||||
done: true,
|
||||
total_duration: 100_000_000,
|
||||
prompt_eval_count: 10,
|
||||
eval_count: 5,
|
||||
});
|
||||
}
|
||||
return new Response('not implemented', { status: 404 });
|
||||
},
|
||||
});
|
||||
|
||||
console.log(`mock-ollama listening on :${PORT}`);
|
||||
@@ -0,0 +1,42 @@
|
||||
# DevOps
|
||||
|
||||
This repo manages the two environments for the Token4Token hosted gateway:
|
||||
|
||||
- **`local/`** — docker-compose files for running development and testing
|
||||
environments locally. Tests run inside Docker, no host-side Bun needed.
|
||||
- **`hostinger/`** — Docker Swarm stack files for the remote production
|
||||
cluster on Hostinger.
|
||||
|
||||
The layout mirrors [cipherdolls/devops](https://github.com/cipherdolls/devops).
|
||||
|
||||
## Local development
|
||||
|
||||
```bash
|
||||
cd local
|
||||
make up # bring the dev stack up (postgres, redis, bee, anvil, api, worker)
|
||||
make logs # tail
|
||||
make down # clean shutdown
|
||||
```
|
||||
|
||||
The dev compose mounts `../../hosted-gateway/src` so file changes hot-reload
|
||||
inside the container (`bun run --watch`).
|
||||
|
||||
## Local testing
|
||||
|
||||
Every E2E spec runs inside Docker against a fresh stack (anvil fork of Gnosis,
|
||||
deployed contracts, a t4t-provider container against a stub Ollama).
|
||||
|
||||
```bash
|
||||
cd local
|
||||
make test SPEC=accounts # run one spec
|
||||
make test-all # run every spec sequentially
|
||||
```
|
||||
|
||||
`make test` brings up postgres + redis + anvil + bee + t4t-provider + hosted
|
||||
api + worker, then runs the `bun` test container against them. After the run
|
||||
it tears everything down (`-v --remove-orphans`).
|
||||
|
||||
## Hostinger / production
|
||||
|
||||
Stack files in `hostinger/` are applied via `docker stack deploy` from the CI
|
||||
pipeline. Not relevant for local development.
|
||||
Reference in new issue
Block a user