40bf5fc641
Everything the VPS needs to run Prometheus is in Prometheus/deploy/:
prometheus-service.service systemd unit, Node on 127.0.0.1:3700,
ReadWritePaths narrowed to the dirs the
service actually writes (db, uploads, keys,
build). Hardened with NoNewPrivileges,
PrivateTmp, ProtectSystem=strict,
ProtectHome. Reads /etc/default/prometheus
for instance env (admin name, VT key,
payment config) so the repo carries no
per-install secrets.
prometheus-x.conf angie vhost for the BNS name's apex.
TLS-terminated with a self-signed cert that
the on-chain `tls` record pins (no CA
involved). Reverse-proxies / to the Node
service, 2 GiB client_max_body_size for
POST /api/upload, proxy_request_buffering
off so large uploads do not spool to disk.
make-tls-cert.sh ECDSA P-256, 10-year expiry (the on-chain
pin is what actually expires, not the cert
metadata). Prints the DER sha256 that goes
in the `tls` record. Idempotent — rerun to
rotate.
README.md First-time install recipe (useradd →
rsync → npm install --omit=dev → make-tls
→ angie reload → systemctl enable --now),
the matching Argus register.js command for
the record change, update + rollback.
Execution — the deploy itself, the record change, enabling payments —
is the operator's call, not something a script here runs on its own.
|
||
|---|---|---|
| .. | ||
| apps-silentmode-st.conf | ||
| make-tls-cert.sh | ||
| prometheus-service.service | ||
| prometheus-snapshot.service | ||
| prometheus-snapshot.timer | ||
| prometheus-x.conf | ||
| README.md | ||
Prometheus — deploy
Everything in this directory lands on a VPS the first time Prometheus is set up on it, plus files that get swapped out on each release.
deploy/
prometheus-service.service systemd unit — the Node service on :3700
prometheus-x.conf angie vhost — TLS-terminated reverse proxy
prometheus-snapshot.service systemd unit — weekly snapshot job
prometheus-snapshot.timer systemd timer — Sunday 04:00 UTC
apps-silentmode-st.conf angie vhost — SEO mirror (apps.silentmode.st)
make-tls-cert.sh (re-)generate the self-signed cert, print the pin
First-time install (VPS, root)
# Code
useradd -r -s /usr/sbin/nologin -d /opt/prometheus prometheus
mkdir -p /opt/prometheus
rsync -av --exclude=node_modules --exclude=db.sqlite\* --exclude=uploads \
--exclude=.keys --exclude=build \
<workstation>:Prometheus/ /opt/prometheus/
cd /opt/prometheus && npm install --omit=dev
chown -R prometheus:prometheus /opt/prometheus
mkdir -p /opt/prometheus/{uploads,.keys,build}
chown prometheus:prometheus /opt/prometheus/{uploads,.keys,build}
# TLS cert for prometheus.x (prints the fingerprint — save it for #6)
sudo bash /opt/prometheus/deploy/make-tls-cert.sh
# angie
install -m644 /opt/prometheus/deploy/prometheus-x.conf /etc/angie/http.d/
install -m644 /opt/prometheus/deploy/apps-silentmode-st.conf /etc/angie/http.d/
angie -t && systemctl reload angie
# systemd
install -m644 /opt/prometheus/deploy/prometheus-service.service /etc/systemd/system/
install -m644 /opt/prometheus/deploy/prometheus-snapshot.service /etc/systemd/system/
install -m644 /opt/prometheus/deploy/prometheus-snapshot.timer /etc/systemd/system/
# Instance-specific environment (NOT in the repo)
cat > /etc/default/prometheus <<EOF
ADMIN_PUBLISHER=<a BNS name you own>
# VIRUSTOTAL_API_KEY=<key> # optional
# PAYMENT_REQUIRED=1 # enable paid wave
# PROMETHEUS_PAYMENT_ADDRESS=<cashaddr> # required when PAYMENT_REQUIRED=1
# PROMETHEUS_LISTING_FEE_USD=1
EOF
chmod 600 /etc/default/prometheus
systemctl daemon-reload
systemctl enable --now prometheus-service.service
systemctl enable --now prometheus-snapshot.timer
# Verify
curl -k https://127.0.0.1/healthz # should return 200 and {ok:true,…}
Register the on-chain record (workstation)
IP=$(curl -s https://ifconfig.io) # or the VPS's public IP as you know it
TLS=<the fingerprint make-tls-cert.sh printed>
node Argus/src/register.js prometheus.x "{\"ip\":\"$IP\",\"tls\":\"$TLS\"}"
# Prompts for the chipnet keystore password (or set DEVIANT_KEYSTORE_PASSWORD).
The current record (as of 2026-10-08) is {"u":"https://silentmode.st/prometheus/"}.
The register command above replaces it. Within a few minutes of the TX
confirming on chipnet, Theseus and Ariadne resolve prometheus.x to the live
service rather than the silentmode.st teaser.
Updates
Code: rsync Prometheus/ again, npm install --omit=dev (safe no-op if deps
unchanged), systemctl restart prometheus-service.
Snapshot: nothing to do — the timer runs itself.
Cert rotation: re-run make-tls-cert.sh, grab the new fingerprint, re-register
the tls record, reload angie. Theseus and Ariadne pick up the new cert as
soon as the record TX confirms.
Rollback
Code: rsync the previous checkout, restart. There is no "schema down migration" discipline yet — the DB file is append-only in practice (new columns, new tables); if a rollback hits a schema change you have to decide what to do with the newer rows.
Record: node Argus/src/register.js prometheus.x '{"u":"https://silentmode.st/prometheus/"}'
puts the name back to redirecting at the ICANN mirror. Takes the same few
minutes as any other record change.