40bf5fc641
Everything the VPS needs to run Prometheus is in Prometheus/deploy/:
prometheus-service.service systemd unit, Node on 127.0.0.1:3700,
ReadWritePaths narrowed to the dirs the
service actually writes (db, uploads, keys,
build). Hardened with NoNewPrivileges,
PrivateTmp, ProtectSystem=strict,
ProtectHome. Reads /etc/default/prometheus
for instance env (admin name, VT key,
payment config) so the repo carries no
per-install secrets.
prometheus-x.conf angie vhost for the BNS name's apex.
TLS-terminated with a self-signed cert that
the on-chain `tls` record pins (no CA
involved). Reverse-proxies / to the Node
service, 2 GiB client_max_body_size for
POST /api/upload, proxy_request_buffering
off so large uploads do not spool to disk.
make-tls-cert.sh ECDSA P-256, 10-year expiry (the on-chain
pin is what actually expires, not the cert
metadata). Prints the DER sha256 that goes
in the `tls` record. Idempotent — rerun to
rotate.
README.md First-time install recipe (useradd →
rsync → npm install --omit=dev → make-tls
→ angie reload → systemctl enable --now),
the matching Argus register.js command for
the record change, update + rollback.
Execution — the deploy itself, the record change, enabling payments —
is the operator's call, not something a script here runs on its own.
35 lines
1.1 KiB
Desktop File
35 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=Prometheus — the service behind prometheus.x
|
|
Documentation=https://code.silentmode.st/silentmode/prometheus
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=prometheus
|
|
Group=prometheus
|
|
WorkingDirectory=/opt/prometheus
|
|
Environment=NODE_ENV=production
|
|
Environment=BIND=127.0.0.1
|
|
Environment=PORT=3700
|
|
Environment=BNS_NETWORK=chipnet
|
|
# ADMIN_PUBLISHER, VIRUSTOTAL_API_KEY, PAYMENT_REQUIRED, PROMETHEUS_PAYMENT_ADDRESS
|
|
# and PROMETHEUS_LISTING_FEE_USD go in the drop-in file at
|
|
# /etc/systemd/system/prometheus-service.service.d/override.conf so they are
|
|
# visible to systemd but not committed to the repo.
|
|
EnvironmentFile=-/etc/default/prometheus
|
|
ExecStart=/usr/bin/node service/server.js
|
|
Restart=on-failure
|
|
RestartSec=3s
|
|
|
|
# Hardening
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
# WritablePaths: the service writes the DB, the uploads directory, and (when
|
|
# the key does not yet exist) the service key file.
|
|
ReadWritePaths=/opt/prometheus/db.sqlite /opt/prometheus/uploads /opt/prometheus/.keys /opt/prometheus/build
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|