Felix FaerberandClaude Opus 4.7
bc3079b97a
Bee dashboard reports reachability=Private and underlay only lists 172.x/127.0.0.1 — peers see our node as unreachable, PSS messages won't route. Setting BEE_NAT_ADDR to the host's public IP+port lets libp2p autonat confirm reachability. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Hostinger (production) stacks
Docker Swarm stack files for the t4t hosted-gateway, deployed to a single
Hostinger VPS at ssh root@195.35.25.26 and reachable at
t4t-gateway.com.
Layout mirrors cipherdolls/devops/hostinger/.
Stacks
| Stack | File | What it runs |
|---|---|---|
system |
system-stack.yaml |
Traefik (TLS + ingress), Grafana, Loki, Prometheus, node-exporter, cadvisor. Owns the public + internal overlay networks. |
prod |
prod-stack.yaml |
hosted-gateway api + worker + one-shot prisma migrate, plus postgres / redis / bee / postgres-exporter. |
dev |
dev-stack.yaml |
Staging on dev.t4t-gateway.com — the :develop image tag against its own postgres / redis / bee volumes. |
Supporting configs:
loki.yaml— Loki single-binary filesystem configprometheus.yml— scrape targets (traefik, grafana, loki, node-exporter, postgres-exporter, cadvisor, hosted-gateway api).env.example— copy to.envon the host, fill inOPERATOR_PRIVATE_KEY/JWT_SECRET_KEY/ etc.
DNS records (Hostinger DNS panel)
Point all of these at 195.35.25.26:
A t4t-gateway.com 195.35.25.26
A www.t4t-gateway.com 195.35.25.26
A api.t4t-gateway.com 195.35.25.26
A dev.t4t-gateway.com 195.35.25.26
A traefik.t4t-gateway.com 195.35.25.26
A grafana.t4t-gateway.com 195.35.25.26
A loki.t4t-gateway.com 195.35.25.26
A prometheus.t4t-gateway.com 195.35.25.26
One-time host setup
ssh root@195.35.25.26
# Docker + swarm
curl -fsSL https://get.docker.com | sh
docker swarm init --advertise-addr 195.35.25.26
# Loki driver (so container logs ship to Loki via the `loki` logging driver)
docker plugin install grafana/loki-docker-driver:2.9.7 \
--alias loki --grant-all-permissions
# Drop the stack files + configs on the host
mkdir -p /opt/t4t-gateway && cd /opt/t4t-gateway
# rsync this directory up here (or `git clone` the devops repo)
cp .env.example .env && chmod 600 .env
$EDITOR .env # fill in OPERATOR_PRIVATE_KEY, JWT_SECRET_KEY, ...
Deploy
The system stack creates the shared overlay networks, so deploy it first.
cd /opt/t4t-gateway
# 1. Networks + ingress + monitoring
docker stack deploy -c system-stack.yaml system
# 2. App + datastores
docker stack deploy -c prod-stack.yaml prod
# (optional) staging on dev.t4t-gateway.com
docker stack deploy -c dev-stack.yaml dev
Re-deploying after a new image tag:
docker service update --image ghcr.io/token-for-token/hosted-gateway:main \
--force prod_api
docker service update --image ghcr.io/token-for-token/hosted-gateway:main \
--force prod_worker
Secrets
OPERATOR_PRIVATE_KEY is the on-chain identity for every tenant. For now it
lives in /opt/t4t-gateway/.env (chmod 600). Future work: migrate to a
proper Docker secret backed by the host's secret manager — never an env var
in the stack file.
Backups
Postgres volume:
docker run --rm \
-v prod_postgres-data:/from_volume \
-v $(pwd):/workdir \
alpine \
sh -c "cd /from_volume && tar cvf /workdir/prod_postgres-data.tar ."
scp root@195.35.25.26:/opt/t4t-gateway/prod_postgres-data.tar ~/Downloads
Bee data volume (postage batch / swarm keys — DO NOT lose this):
docker run --rm \
-v prod_bee-data:/from_volume \
-v $(pwd):/workdir \
alpine \
sh -c "cd /from_volume && tar cvf /workdir/prod_bee-data.tar ."
Troubleshooting
docker stack services system # health of ingress + monitoring
docker stack services prod # health of gateway + data
docker service logs -f prod_api
docker service logs -f prod_worker
# Replay a failed Prisma migration:
docker exec -it $(docker ps -q -f name=prod_prisma) sh
bunx prisma migrate resolve --rolled-back <migration_name>