09bb42f7a6
Publishers no longer need to self-host. When the service is configured
with PROMETHEUS_S3_* credentials pointing at the hosted s3d
(s3.silentmode.st), every clean upload is pushed to
s3://${bucket}/${prefix}<sha256>.bin and the public URL comes back on
/api/upload as `hosted_url`. Step 2 of the submit form pre-fills the
Download URL input with that URL — publishers can overwrite if they
prefer their own hosting; by default they ship nothing.
- service/s3.js: SigV4 S3 client vendored from Pithos/core/s3.js so bug
fixes port by file-copy. Path-style, UNSIGNED-PAYLOAD streaming PUT,
Content-Length required (s3d chunked encoding does not round-trip
cleanly for large bodies).
- service/storage.js: thin wrapper exposing isConfigured() and
uploadScannedFile(). Idempotent on sha256 — same bytes → same key.
Failure is non-fatal; the publisher can still paste their own URL.
- service/uploads.js: after rename-to-final, push to Sia if configured.
Added `hosted_url` to the response (null when storage off).
- service/pages.js: step 2 pre-fills download_url when hosted_url is
present; hint text explains the override path.
- docker-compose.yml: PROMETHEUS_S3_* env plumbed through, with sane
defaults for bucket/prefix (bns + prometheus-storage/).
97 lines
3.4 KiB
YAML
97 lines
3.4 KiB
YAML
# Standalone compose for prometheus.x on the Hephaestus VPS.
|
|
#
|
|
# The service attaches to Hephaestus's existing docker network
|
|
# (hephaestus_default), so Hephaestus's Caddy can route prometheus.x to
|
|
# `prometheus:3700` with no changes to Hephaestus itself other than one new
|
|
# block in its Caddyfile.
|
|
#
|
|
# One volume (`data`) holds the SQLite DB, the service's ed25519 signing
|
|
# key, uploads that passed scan, and the snapshot build output. Env lives
|
|
# in an .env file alongside this one; the ones below are the defaults and
|
|
# can be overridden.
|
|
|
|
name: prometheus
|
|
|
|
services:
|
|
prometheus:
|
|
build:
|
|
context: ..
|
|
dockerfile: deploy/Dockerfile
|
|
image: prometheus:latest
|
|
restart: unless-stopped
|
|
depends_on:
|
|
clamav:
|
|
condition: service_healthy
|
|
environment:
|
|
BNS_NETWORK: chipnet
|
|
CLAMD_HOST: clamav
|
|
CLAMD_PORT: "3310"
|
|
ADMIN_PUBLISHER: ${ADMIN_PUBLISHER:-}
|
|
VIRUSTOTAL_API_KEY: ${VIRUSTOTAL_API_KEY:-}
|
|
PAYMENT_REQUIRED: ${PAYMENT_REQUIRED:-}
|
|
PROMETHEUS_PAYMENT_ADDRESS: ${PROMETHEUS_PAYMENT_ADDRESS:-}
|
|
PROMETHEUS_LISTING_FEE_USD: ${PROMETHEUS_LISTING_FEE_USD:-1}
|
|
BNS_GATEWAY: ${BNS_GATEWAY:-}
|
|
# Sia-backed storage: when set, scan-clean uploads are pushed to the
|
|
# hosted s3d and the submit UI pre-fills the download URL. All four
|
|
# must be set for storage to turn on; otherwise publishers host
|
|
# their own binaries. See service/storage.js for defaults.
|
|
PROMETHEUS_S3_ENDPOINT: ${PROMETHEUS_S3_ENDPOINT:-}
|
|
PROMETHEUS_S3_ACCESS_KEY: ${PROMETHEUS_S3_ACCESS_KEY:-}
|
|
PROMETHEUS_S3_SECRET: ${PROMETHEUS_S3_SECRET:-}
|
|
PROMETHEUS_S3_BUCKET: ${PROMETHEUS_S3_BUCKET:-bns}
|
|
PROMETHEUS_S3_PREFIX: ${PROMETHEUS_S3_PREFIX:-prometheus-storage/}
|
|
PROMETHEUS_PUBLIC_BASE: ${PROMETHEUS_PUBLIC_BASE:-}
|
|
volumes:
|
|
- data:/data
|
|
networks:
|
|
- prometheus-internal
|
|
- hephaestus
|
|
expose:
|
|
- "3700"
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--spider", "http://127.0.0.1:3700/healthz"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 60s
|
|
|
|
# ClamAV runs as a sibling container on an internal network — only
|
|
# Prometheus can reach it. First start downloads ~250 MB of signatures via
|
|
# freshclam into a volume; subsequent starts reuse it.
|
|
clamav:
|
|
image: clamav/clamav:stable
|
|
restart: unless-stopped
|
|
environment:
|
|
CLAMAV_NO_MILTERD: "true"
|
|
volumes:
|
|
- clamav-sigs:/var/lib/clamav
|
|
# Overlay our clamd.conf so the stream/file/scan size limits are
|
|
# raised from the image defaults (25 MB / 100 MB / 400 MB) to the
|
|
# 2 GiB cap Prometheus itself enforces. Without this a 100-MB APK
|
|
# scan comes back as "INSTREAM size limit exceeded".
|
|
- ./clamd.conf:/etc/clamav/clamd.conf:ro
|
|
networks:
|
|
- prometheus-internal
|
|
expose:
|
|
- "3310"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "clamdcheck.sh || clamdscan --ping 2>/dev/null || exit 1"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 10
|
|
# Signature download on first start can take a few minutes.
|
|
start_period: 5m
|
|
|
|
volumes:
|
|
data:
|
|
clamav-sigs:
|
|
|
|
networks:
|
|
# Internal: only Prometheus + clamav. Clamd never exposed off this network.
|
|
prometheus-internal:
|
|
driver: bridge
|
|
# External: shared with Hephaestus so its Caddy can route prometheus.x.
|
|
hephaestus:
|
|
external: true
|
|
name: hephaestus_default
|