40bf5fc641
Everything the VPS needs to run Prometheus is in Prometheus/deploy/:
prometheus-service.service systemd unit, Node on 127.0.0.1:3700,
ReadWritePaths narrowed to the dirs the
service actually writes (db, uploads, keys,
build). Hardened with NoNewPrivileges,
PrivateTmp, ProtectSystem=strict,
ProtectHome. Reads /etc/default/prometheus
for instance env (admin name, VT key,
payment config) so the repo carries no
per-install secrets.
prometheus-x.conf angie vhost for the BNS name's apex.
TLS-terminated with a self-signed cert that
the on-chain `tls` record pins (no CA
involved). Reverse-proxies / to the Node
service, 2 GiB client_max_body_size for
POST /api/upload, proxy_request_buffering
off so large uploads do not spool to disk.
make-tls-cert.sh ECDSA P-256, 10-year expiry (the on-chain
pin is what actually expires, not the cert
metadata). Prints the DER sha256 that goes
in the `tls` record. Idempotent — rerun to
rotate.
README.md First-time install recipe (useradd →
rsync → npm install --omit=dev → make-tls
→ angie reload → systemctl enable --now),
the matching Argus register.js command for
the record change, update + rollback.
Execution — the deploy itself, the record change, enabling payments —
is the operator's call, not something a script here runs on its own.
96 lines
3.7 KiB
Markdown
96 lines
3.7 KiB
Markdown
# Prometheus — deploy
|
|
|
|
Everything in this directory lands on a VPS the first time Prometheus is set
|
|
up on it, plus files that get swapped out on each release.
|
|
|
|
```
|
|
deploy/
|
|
prometheus-service.service systemd unit — the Node service on :3700
|
|
prometheus-x.conf angie vhost — TLS-terminated reverse proxy
|
|
prometheus-snapshot.service systemd unit — weekly snapshot job
|
|
prometheus-snapshot.timer systemd timer — Sunday 04:00 UTC
|
|
apps-silentmode-st.conf angie vhost — SEO mirror (apps.silentmode.st)
|
|
make-tls-cert.sh (re-)generate the self-signed cert, print the pin
|
|
```
|
|
|
|
## First-time install (VPS, root)
|
|
|
|
```bash
|
|
# Code
|
|
useradd -r -s /usr/sbin/nologin -d /opt/prometheus prometheus
|
|
mkdir -p /opt/prometheus
|
|
rsync -av --exclude=node_modules --exclude=db.sqlite\* --exclude=uploads \
|
|
--exclude=.keys --exclude=build \
|
|
<workstation>:Prometheus/ /opt/prometheus/
|
|
cd /opt/prometheus && npm install --omit=dev
|
|
chown -R prometheus:prometheus /opt/prometheus
|
|
mkdir -p /opt/prometheus/{uploads,.keys,build}
|
|
chown prometheus:prometheus /opt/prometheus/{uploads,.keys,build}
|
|
|
|
# TLS cert for prometheus.x (prints the fingerprint — save it for #6)
|
|
sudo bash /opt/prometheus/deploy/make-tls-cert.sh
|
|
|
|
# angie
|
|
install -m644 /opt/prometheus/deploy/prometheus-x.conf /etc/angie/http.d/
|
|
install -m644 /opt/prometheus/deploy/apps-silentmode-st.conf /etc/angie/http.d/
|
|
angie -t && systemctl reload angie
|
|
|
|
# systemd
|
|
install -m644 /opt/prometheus/deploy/prometheus-service.service /etc/systemd/system/
|
|
install -m644 /opt/prometheus/deploy/prometheus-snapshot.service /etc/systemd/system/
|
|
install -m644 /opt/prometheus/deploy/prometheus-snapshot.timer /etc/systemd/system/
|
|
|
|
# Instance-specific environment (NOT in the repo)
|
|
cat > /etc/default/prometheus <<EOF
|
|
ADMIN_PUBLISHER=<a BNS name you own>
|
|
# VIRUSTOTAL_API_KEY=<key> # optional
|
|
# PAYMENT_REQUIRED=1 # enable paid wave
|
|
# PROMETHEUS_PAYMENT_ADDRESS=<cashaddr> # required when PAYMENT_REQUIRED=1
|
|
# PROMETHEUS_LISTING_FEE_USD=1
|
|
EOF
|
|
chmod 600 /etc/default/prometheus
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now prometheus-service.service
|
|
systemctl enable --now prometheus-snapshot.timer
|
|
|
|
# Verify
|
|
curl -k https://127.0.0.1/healthz # should return 200 and {ok:true,…}
|
|
```
|
|
|
|
## Register the on-chain record (workstation)
|
|
|
|
```bash
|
|
IP=$(curl -s https://ifconfig.io) # or the VPS's public IP as you know it
|
|
TLS=<the fingerprint make-tls-cert.sh printed>
|
|
|
|
node Argus/src/register.js prometheus.x "{\"ip\":\"$IP\",\"tls\":\"$TLS\"}"
|
|
# Prompts for the chipnet keystore password (or set DEVIANT_KEYSTORE_PASSWORD).
|
|
```
|
|
|
|
The current record (as of 2026-10-08) is `{"u":"https://silentmode.st/prometheus/"}`.
|
|
The register command above replaces it. Within a few minutes of the TX
|
|
confirming on chipnet, Theseus and Ariadne resolve `prometheus.x` to the live
|
|
service rather than the silentmode.st teaser.
|
|
|
|
## Updates
|
|
|
|
Code: rsync Prometheus/ again, `npm install --omit=dev` (safe no-op if deps
|
|
unchanged), `systemctl restart prometheus-service`.
|
|
|
|
Snapshot: nothing to do — the timer runs itself.
|
|
|
|
Cert rotation: re-run make-tls-cert.sh, grab the new fingerprint, re-register
|
|
the `tls` record, reload angie. Theseus and Ariadne pick up the new cert as
|
|
soon as the record TX confirms.
|
|
|
|
## Rollback
|
|
|
|
Code: rsync the previous checkout, restart. There is no "schema down migration"
|
|
discipline yet — the DB file is append-only in practice (new columns, new
|
|
tables); if a rollback hits a schema change you have to decide what to do with
|
|
the newer rows.
|
|
|
|
Record: `node Argus/src/register.js prometheus.x '{"u":"https://silentmode.st/prometheus/"}'`
|
|
puts the name back to redirecting at the ICANN mirror. Takes the same few
|
|
minutes as any other record change.
|