40bf5fc641
Everything the VPS needs to run Prometheus is in Prometheus/deploy/:
prometheus-service.service systemd unit, Node on 127.0.0.1:3700,
ReadWritePaths narrowed to the dirs the
service actually writes (db, uploads, keys,
build). Hardened with NoNewPrivileges,
PrivateTmp, ProtectSystem=strict,
ProtectHome. Reads /etc/default/prometheus
for instance env (admin name, VT key,
payment config) so the repo carries no
per-install secrets.
prometheus-x.conf angie vhost for the BNS name's apex.
TLS-terminated with a self-signed cert that
the on-chain `tls` record pins (no CA
involved). Reverse-proxies / to the Node
service, 2 GiB client_max_body_size for
POST /api/upload, proxy_request_buffering
off so large uploads do not spool to disk.
make-tls-cert.sh ECDSA P-256, 10-year expiry (the on-chain
pin is what actually expires, not the cert
metadata). Prints the DER sha256 that goes
in the `tls` record. Idempotent — rerun to
rotate.
README.md First-time install recipe (useradd →
rsync → npm install --omit=dev → make-tls
→ angie reload → systemctl enable --now),
the matching Argus register.js command for
the record change, update + rollback.
Execution — the deploy itself, the record change, enabling payments —
is the operator's call, not something a script here runs on its own.
47 lines
1.8 KiB
Text
47 lines
1.8 KiB
Text
# prometheus.x — the standalone service, served by this VPS.
|
|
#
|
|
# BCNR serves this name via its `ip`+`tls` records: Theseus and Ariadne
|
|
# resolve prometheus.x by fetching the on-chain record, which says
|
|
# "connect to <this IP>, pin the TLS cert whose DER sha256 equals <this
|
|
# fingerprint>". The resolver reverse-proxies to this vhost; a browser
|
|
# with Ariadne's Thread installed does the same.
|
|
#
|
|
# The cert is self-signed and pinned on chain — no CA is involved and
|
|
# none needs to be, which is a narrower claim than a CA makes and does
|
|
# not expire on anyone else's schedule. Rotating is one record update.
|
|
#
|
|
# To regenerate the cert and read out its DER sha256:
|
|
# bash /opt/prometheus/deploy/make-tls-cert.sh
|
|
#
|
|
# The vhost listens only on HTTPS; the on-chain `tls` pin means plain
|
|
# HTTP would be refused by the resolver anyway, and we do not want a
|
|
# scanner to be able to read ANYTHING here over cleartext.
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name prometheus.x;
|
|
|
|
ssl_certificate /etc/ssl/prometheus-x/fullchain.pem;
|
|
ssl_certificate_key /etc/ssl/prometheus-x/privkey.pem;
|
|
|
|
# The TLS resolver reaches us over the raw IP but passes `prometheus.x`
|
|
# as the Host header. The service's canonical URL generator looks at
|
|
# that header; preserving it keeps rel=canonical honest.
|
|
location / {
|
|
proxy_pass http://127.0.0.1:3700;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
|
|
# Publishers upload binaries that can be hundreds of MB. 2 GiB
|
|
# matches the service's own cap in uploads.js.
|
|
client_max_body_size 2g;
|
|
proxy_request_buffering off;
|
|
|
|
proxy_buffering off;
|
|
proxy_read_timeout 120s;
|
|
}
|
|
}
|