Digibyte.X/dgb-wallet
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ops: the vhost is served by Angie (/etc/angie/http.d/digibyte-x.conf); blockbook-upstream targets it, docs updated

Browse source
This commit is contained in:
Digibyte.X 2026-10-12 00:48:17 +02:00
parent 649a256a02
commit c46de58e87
5 changed files with 12 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ops/README.md
View file

@ -7,7 +7,7 @@ web wallet needs:
| Piece | Where | Notes |
|---|---|---|
| nginx vhost | `/etc/nginx/sites-enabled/digibyte-x` — mirrored in [`nginx-digibyte-x.conf`](nginx-digibyte-x.conf) | SNI-selected on `digibyte.x`, self-signed cert pinned on-chain via the BNS `tls` record. Serves `/web/` (wallet), proxies `/p2p/*` → daemon and `/blockbook/*` → a public DGB Blockbook (Atomic Wallet's since 2026-10-11; NOWNodes before that, API key injected server-side from `/etc/dgb-core/nownodes.env` — switch with [`blockbook-upstream.sh`](blockbook-upstream.sh)), strict Content-Security-Policy on `/web/`. |
| vhost (Angie) | `/etc/angie/http.d/digibyte-x.conf` — served by **Angie** since 2026-09-16 (`systemctl reload angie`; `nginx.service` is inactive and `/etc/nginx/sites-enabled/digibyte-x` is a stale copy) — mirrored in [`nginx-digibyte-x.conf`](nginx-digibyte-x.conf) | SNI-selected on `digibyte.x`, self-signed cert pinned on-chain via the BNS `tls` record. Serves `/web/` (wallet), proxies `/p2p/*` → daemon and `/blockbook/*` → a public DGB Blockbook (Atomic Wallet's since 2026-10-11; NOWNodes before that, API key injected server-side from `/etc/dgb-core/nownodes.env` — switch with [`blockbook-upstream.sh`](blockbook-upstream.sh)), strict Content-Security-Policy on `/web/`. |
| `dgb-daemon.service` | `/opt/dgb-wallet`, runs `packages/p2p/bin/dgb-daemon.ts` via tsx, binds `127.0.0.1:5174` | The wallet's only server-side component: header sync with reorg handling, BIP157/158 filter cache (packed 1000/file under `/var/lib/dgb-wallet/.dgb-wallet/p2p/packs/`), incremental balance scans remembered in `scans.json`, Dandelion++ broadcast with relay-echo verification. |
| **No DigiByte Core, no Fulcrum** | — | Removed 2026-09-06. A full node with indexes needs ≥40 GB disk and ≥4 GB RAM; the VPS has neither, and the daemon does not use it. |

2
ops/blockbook-upstream.ps1
View file

@ -5,7 +5,7 @@
# ops/blockbook-upstream.ps1 nownodes # NOWNodes, key from /etc/dgb-core/nownodes.env on the VPS
#
# Pipes blockbook-upstream.remote.sh through `ssh silentmode`; the
# previous vhost is kept under /etc/nginx/sites-enabled-stale-baks/.
# previous vhost is kept under /etc/angie/stale-baks/.
param([Parameter(Mandatory = $true)][ValidateSet('atomic', 'nownodes')][string]$Target)
$ErrorActionPreference = 'Stop'
switch ($Target) {

14
ops/blockbook-upstream.remote.sh
View file

@ -1,14 +1,16 @@
#!/usr/bin/env bash
# Runs ON the VPS (piped through `ssh silentmode 'HOST=… KEYHDR=… bash -s'`
# by blockbook-upstream.sh / .ps1). Repoints the digibyte.x vhost's
# by blockbook-upstream.sh / .ps1). Repoints the digibyte.x vhost (served
# by Angie since 2026-09-16: /etc/angie/http.d/digibyte-x.conf — the copy
# under /etc/nginx/sites-enabled is stale, nginx.service is inactive).
# /blockbook/ proxy at $HOST, with the NOWNodes api-key header when
# KEYHDR=1, tests the config, reloads nginx and proves the route works.
set -euo pipefail
: "${HOST:?HOST (upstream hostname) is required}"
KEYHDR="${KEYHDR:-0}"
F=/etc/nginx/sites-enabled/digibyte-x
mkdir -p /etc/nginx/sites-enabled-stale-baks
cp "$F" "/etc/nginx/sites-enabled-stale-baks/digibyte-x.bak.$(date +%s)"
F=/etc/angie/http.d/digibyte-x.conf
mkdir -p /etc/angie/stale-baks
cp "$F" "/etc/angie/stale-baks/digibyte-x.bak.$(date +%s)"
KEY=""
if [ "$KEYHDR" = 1 ]; then
KEY="$(. /etc/dgb-core/nownodes.env; printf %s "$NOWNODES_API_KEY" | tr -d '\r\n ')"
@ -29,8 +31,8 @@ if key:
open(p, 'w').write(s[:a] + blk + s[b:])
print('vhost now proxies /blockbook/ ->', host, '(api-key header)' if key else '(no key)')
PY
nginx -t
systemctl reload nginx
angie -t
systemctl reload angie
sleep 1
code=$(curl -sk -o /dev/null -w '%{http_code}' --resolve digibyte.x:443:127.0.0.1 'https://digibyte.x/blockbook/')
echo "GET /blockbook/ via vhost -> HTTP $code"

2
ops/blockbook-upstream.sh
View file

@ -10,7 +10,7 @@
#
# The work happens in blockbook-upstream.remote.sh, piped over
# `ssh silentmode`; the previous vhost is kept under
# /etc/nginx/sites-enabled-stale-baks/. The repo mirror
# /etc/angie/stale-baks/. The repo mirror
# ops/nginx-digibyte-x.conf documents the same two blocks.
set -euo pipefail
here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

2
ops/push.sh
View file

@ -68,7 +68,7 @@ push_web() {
live_csp="$(ssh "$HOST" "curl -sk -D - -o /dev/null --resolve $SNI_HOST:443:127.0.0.1 https://$SNI_HOST/web/ | tr -d '\\r' | grep -i '^content-security-policy' || true")"
if [[ -n "$live_csp" && "$live_csp" != *"$want"* ]]; then
echo "WARNING: live CSP does not contain the current inline-script hash ($want)." >&2
echo " Update ops/nginx-digibyte-x.conf + /etc/nginx/sites-enabled/digibyte-x, or the wallet will not load." >&2
echo " Update ops/nginx-digibyte-x.conf + /etc/angie/http.d/digibyte-x.conf (Angie serves 443), or the wallet will not load." >&2
else
echo " CSP hash OK ($want)"
fi