40bf5fc641
Everything the VPS needs to run Prometheus is in Prometheus/deploy/:
prometheus-service.service systemd unit, Node on 127.0.0.1:3700,
ReadWritePaths narrowed to the dirs the
service actually writes (db, uploads, keys,
build). Hardened with NoNewPrivileges,
PrivateTmp, ProtectSystem=strict,
ProtectHome. Reads /etc/default/prometheus
for instance env (admin name, VT key,
payment config) so the repo carries no
per-install secrets.
prometheus-x.conf angie vhost for the BNS name's apex.
TLS-terminated with a self-signed cert that
the on-chain `tls` record pins (no CA
involved). Reverse-proxies / to the Node
service, 2 GiB client_max_body_size for
POST /api/upload, proxy_request_buffering
off so large uploads do not spool to disk.
make-tls-cert.sh ECDSA P-256, 10-year expiry (the on-chain
pin is what actually expires, not the cert
metadata). Prints the DER sha256 that goes
in the `tls` record. Idempotent — rerun to
rotate.
README.md First-time install recipe (useradd →
rsync → npm install --omit=dev → make-tls
→ angie reload → systemctl enable --now),
the matching Argus register.js command for
the record change, update + rollback.
Execution — the deploy itself, the record change, enabling payments —
is the operator's call, not something a script here runs on its own.
47 lines
1.7 KiB
Bash
47 lines
1.7 KiB
Bash
#!/usr/bin/env bash
|
|
# Generate a self-signed cert for prometheus.x and print its DER sha256.
|
|
#
|
|
# The sha256 is what you register as the `tls` record on chain for the name.
|
|
# Theseus and Ariadne refuse any certificate whose DER sha256 does not match
|
|
# that value, which is the whole point of the pinning model.
|
|
#
|
|
# Run on the VPS. Writes to /etc/ssl/prometheus-x/, so sudo.
|
|
#
|
|
# Usage:
|
|
# sudo bash deploy/make-tls-cert.sh
|
|
# -> prints: tls fingerprint: 9671bd5f44047f74203a76439430bda7bcf7c36d913c0fbd4cc75e24e374dde3
|
|
#
|
|
# To rotate: run again; it overwrites the files and prints the new fingerprint.
|
|
# Then: node Argus/src/register.js prometheus.x '{"ip":"<ip>","tls":"<new fp>"}'
|
|
# After the record TX confirms (~5 min on chipnet, longer on mainnet), the
|
|
# clients see the new cert.
|
|
|
|
set -euo pipefail
|
|
|
|
DIR=/etc/ssl/prometheus-x
|
|
mkdir -p "$DIR"
|
|
|
|
# ECDSA P-256 — small and fast. 10-year expiry; the on-chain pin, not the cert
|
|
# metadata, is what expires. SAN includes both the BNS name and the "localhost"
|
|
# proxy destination so a sanity-check curl against the vhost works.
|
|
openssl req \
|
|
-x509 -nodes \
|
|
-newkey ec \
|
|
-pkeyopt ec_paramgen_curve:P-256 \
|
|
-keyout "$DIR/privkey.pem" \
|
|
-out "$DIR/fullchain.pem" \
|
|
-days 3650 \
|
|
-subj "/CN=prometheus.x" \
|
|
-addext "subjectAltName=DNS:prometheus.x,DNS:localhost" \
|
|
2>/dev/null
|
|
|
|
chmod 600 "$DIR/privkey.pem"
|
|
chmod 644 "$DIR/fullchain.pem"
|
|
|
|
FP=$(openssl x509 -in "$DIR/fullchain.pem" -outform DER | openssl dgst -sha256 | awk '{print $NF}')
|
|
|
|
echo "cert path: $DIR/fullchain.pem"
|
|
echo "key path: $DIR/privkey.pem"
|
|
echo "tls fingerprint: $FP"
|
|
echo
|
|
echo "Register with: node Argus/src/register.js prometheus.x '{\"ip\":\"<ip>\",\"tls\":\"$FP\"}'"
|