Rob Thijssen
aa506b963c
deploy / fetch (push) Successful in 17s
deploy / deploy-miner (1, quadbrat.hanzalova.internal, bob.hanzalova.internal) (push) Has been skipped
deploy / deploy-node (bob.hanzalova.internal, 0x134e73f06fa9bdb1dbfa909e149c563f5860ceb71a0e7307918f7033970edf59, benjy.hanzalova.internal quadbrat.hanzalova.internal, --public-addr /dns4/nh.thgttg.com/tcp/30333, --rpc-external --rpc-methods safe --rpc-cors all… (push) Failing after 31s
deploy / deploy-miner (1, benjy.hanzalova.internal, bob.hanzalova.internal) (push) Has been skipped
deploy / deploy-metrics (push) Has been skipped
Substrate binds JSON-RPC to loopback and makes opening it deliberately awkward, which is correct for a validator. rpc_expose in the node matrix takes the complete flag string; empty keeps it on loopback. --rpc-methods safe is the load-bearing flag. It permits every state read and author_submitExtrinsic (signed, so no key exposure) while blocking author_rotateKeys, system_addReservedPeer and the rest. --rpc-methods auto happens to downgrade once listening externally, but relying on that makes the safety depend on a flag nobody wrote down. The firewalld rich rule is scoped to the node's own /16, derived from its own resolved address at deploy time -- so no subnet literal enters this repo and the rule follows the host between sites. Loopback is whitelisted from rate limiting because the arena exporter runs beside the node and makes ~4 calls every 2s, which is 120/min -- enough to throttle itself against a naive limit. validate now asserts the bind matches intent in both directions: nothing listening while rpc_expose is set is a failure, and loopback-only is reported as configuration rather than silence.
31 lines
1.7 KiB
Cheetah
31 lines
1.7 KiB
Cheetah
# Rendered by .gitea/workflows/deploy.yaml from the QUANTUS_INNER_HASH Gitea
|
|
# secret and rsynced to /etc/quantus-node/node.env (0640 root:quantus-node).
|
|
# The rendered file is never committed (generic.md §6).
|
|
#
|
|
# 32-byte wormhole preimage, 0x-prefixed — the node derives the reward address
|
|
# from it and logs that address on startup. Generated by
|
|
# script/infra-setup.sh --mint-reward-key.
|
|
QUANTUS_INNER_HASH={{QUANTUS_INNER_HASH}}
|
|
|
|
# Multiaddr other nodes should dial to reach this one, as a complete flag, or
|
|
# empty for a node with no public ingress. Behind NAT this is required — libp2p
|
|
# would otherwise advertise a 10.x address nobody outside can reach.
|
|
# Prefer a /dns4/ name over a literal address so a WAN IP change needs no
|
|
# redeploy (architecture public-dns.md uses per-site indirection names).
|
|
# --public-addr /dns4/<site-indirection-name>/tcp/30333
|
|
QUANTUS_PUBLIC_ADDR={{QUANTUS_PUBLIC_ADDR}}
|
|
|
|
# Chain spec. Deliberately configuration rather than a value baked into the unit:
|
|
# Planck is a testnet, and switching to mainnet should be one line in the
|
|
# workflow env, not an edit to a static asset. The miner credential path
|
|
# (<base-path>/chains/<chain>/) follows from the same value.
|
|
QUANTUS_CHAIN={{QUANTUS_CHAIN}}
|
|
|
|
# JSON-RPC exposure. Empty = loopback only. A complete flag string opens it:
|
|
# --rpc-external --rpc-methods safe --rpc-cors all --rpc-rate-limit 300 \
|
|
# --rpc-rate-limit-whitelisted-ips 127.0.0.1/32
|
|
# `safe` still permits author_submitExtrinsic (signed, so no key exposure) and
|
|
# every state read; it blocks author_rotateKeys, system_addReservedPeer and the
|
|
# rest of the unsafe set. Never `unsafe` on a validator.
|
|
QUANTUS_RPC_EXPOSE={{QUANTUS_RPC_EXPOSE}}
|