Local Dev 40bf5fc641 prometheus: deploy — systemd unit, angie vhost, TLS pin, deploy recipe

Everything the VPS needs to run Prometheus is in Prometheus/deploy/:

  prometheus-service.service   systemd unit, Node on 127.0.0.1:3700,
                               ReadWritePaths narrowed to the dirs the
                               service actually writes (db, uploads, keys,
                               build). Hardened with NoNewPrivileges,
                               PrivateTmp, ProtectSystem=strict,
                               ProtectHome. Reads /etc/default/prometheus
                               for instance env (admin name, VT key,
                               payment config) so the repo carries no
                               per-install secrets.

  prometheus-x.conf            angie vhost for the BNS name's apex.
                               TLS-terminated with a self-signed cert that
                               the on-chain `tls` record pins (no CA
                               involved). Reverse-proxies / to the Node
                               service, 2 GiB client_max_body_size for
                               POST /api/upload, proxy_request_buffering
                               off so large uploads do not spool to disk.

  make-tls-cert.sh             ECDSA P-256, 10-year expiry (the on-chain
                               pin is what actually expires, not the cert
                               metadata). Prints the DER sha256 that goes
                               in the `tls` record. Idempotent — rerun to
                               rotate.

  README.md                    First-time install recipe (useradd →
                               rsync → npm install --omit=dev → make-tls
                               → angie reload → systemctl enable --now),
                               the matching Argus register.js command for
                               the record change, update + rollback.

Execution — the deploy itself, the record change, enabling payments —
is the operator's call, not something a script here runs on its own.

2026-10-08 21:53:40 +02:00

3.7 KiB

Raw Blame History

Prometheus — deploy

Everything in this directory lands on a VPS the first time Prometheus is set up on it, plus files that get swapped out on each release.

deploy/
  prometheus-service.service        systemd unit — the Node service on :3700
  prometheus-x.conf                 angie vhost — TLS-terminated reverse proxy
  prometheus-snapshot.service       systemd unit — weekly snapshot job
  prometheus-snapshot.timer         systemd timer — Sunday 04:00 UTC
  apps-silentmode-st.conf           angie vhost — SEO mirror (apps.silentmode.st)
  make-tls-cert.sh                  (re-)generate the self-signed cert, print the pin

First-time install (VPS, root)

# Code
useradd -r -s /usr/sbin/nologin -d /opt/prometheus prometheus
mkdir -p /opt/prometheus
rsync -av --exclude=node_modules --exclude=db.sqlite\* --exclude=uploads \
          --exclude=.keys --exclude=build \
          <workstation>:Prometheus/ /opt/prometheus/
cd /opt/prometheus && npm install --omit=dev
chown -R prometheus:prometheus /opt/prometheus
mkdir -p /opt/prometheus/{uploads,.keys,build}
chown prometheus:prometheus /opt/prometheus/{uploads,.keys,build}

# TLS cert for prometheus.x (prints the fingerprint — save it for #6)
sudo bash /opt/prometheus/deploy/make-tls-cert.sh

# angie
install -m644 /opt/prometheus/deploy/prometheus-x.conf     /etc/angie/http.d/
install -m644 /opt/prometheus/deploy/apps-silentmode-st.conf /etc/angie/http.d/
angie -t && systemctl reload angie

# systemd
install -m644 /opt/prometheus/deploy/prometheus-service.service   /etc/systemd/system/
install -m644 /opt/prometheus/deploy/prometheus-snapshot.service  /etc/systemd/system/
install -m644 /opt/prometheus/deploy/prometheus-snapshot.timer    /etc/systemd/system/

# Instance-specific environment (NOT in the repo)
cat > /etc/default/prometheus <<EOF
ADMIN_PUBLISHER=<a BNS name you own>
# VIRUSTOTAL_API_KEY=<key>              # optional
# PAYMENT_REQUIRED=1                    # enable paid wave
# PROMETHEUS_PAYMENT_ADDRESS=<cashaddr> # required when PAYMENT_REQUIRED=1
# PROMETHEUS_LISTING_FEE_USD=1
EOF
chmod 600 /etc/default/prometheus

systemctl daemon-reload
systemctl enable --now prometheus-service.service
systemctl enable --now prometheus-snapshot.timer

# Verify
curl -k https://127.0.0.1/healthz    # should return 200 and {ok:true,…}

Register the on-chain record (workstation)

IP=$(curl -s https://ifconfig.io)       # or the VPS's public IP as you know it
TLS=<the fingerprint make-tls-cert.sh printed>

node Argus/src/register.js prometheus.x "{\"ip\":\"$IP\",\"tls\":\"$TLS\"}"
# Prompts for the chipnet keystore password (or set DEVIANT_KEYSTORE_PASSWORD).

The current record (as of 2026-10-08) is {"u":"https://silentmode.st/prometheus/"}. The register command above replaces it. Within a few minutes of the TX confirming on chipnet, Theseus and Ariadne resolve prometheus.x to the live service rather than the silentmode.st teaser.

Updates

Code: rsync Prometheus/ again, npm install --omit=dev (safe no-op if deps unchanged), systemctl restart prometheus-service.

Snapshot: nothing to do — the timer runs itself.

Cert rotation: re-run make-tls-cert.sh, grab the new fingerprint, re-register the tls record, reload angie. Theseus and Ariadne pick up the new cert as soon as the record TX confirms.

Rollback

Code: rsync the previous checkout, restart. There is no "schema down migration" discipline yet — the DB file is append-only in practice (new columns, new tables); if a rollback hits a schema change you have to decide what to do with the newer rows.

Record: node Argus/src/register.js prometheus.x '{"u":"https://silentmode.st/prometheus/"}' puts the name back to redirecting at the ICANN mirror. Takes the same few minutes as any other record change.

3.7 KiB Raw Blame History