mirror of
https://github.com/hanzoai/bootnode.git
synced 2026-10-25 02:31:30 +00:00
zeekay
0aa9c4e346
- Add Explorer product page with branded block explorer deployment, contract verification, Etherscan-compatible API, and multi-chain support - Add MPC product page with deep Lux MPC integration: CGGMP21 (ECDSA), FROST (EdDSA), LSS resharing, 15+ chain support, threshold signing API - Update landing page with 6-product grid (Node, Data, Wallets, Explorer, MPC, Rollups) and 8 API cards including Explorer API and MPC Signing - Update navbar and command menu with Explorer and MPC products - Add Lux fleet management dashboard, observability, and services pages - Add AI chat component and unified navigation with org switcher - Add Kubernetes operator (Rust) for multi-chain node lifecycle management - Add Lux Helm charts with genesis configs for devnet/testnet/mainnet - Add docker-release.yml CI/CD pipeline for automated DOKS deployment - Add monitoring, network policies, web deployments, and ingress updates - Refactor API: fleet management, billing tracker, observability endpoints - Update brand config, API client, and infrastructure manifests
245 lines
8.3 KiB
YAML
245 lines
8.3 KiB
YAML
# External Secrets Operator configuration for Hanzo KMS
|
|
# This syncs secrets from Hanzo KMS to K8s without storing credentials in code
|
|
#
|
|
# Prerequisites:
|
|
# 1. Install External Secrets Operator:
|
|
# helm install external-secrets external-secrets/external-secrets \
|
|
# -n external-secrets --create-namespace
|
|
# 2. Create KMS credentials (see bottom of this file)
|
|
#
|
|
# Hanzo KMS Integration:
|
|
# - KMS URL: https://kms.hanzo.ai (Infisical-compatible)
|
|
# - Project: bootnode
|
|
# - Environment: production
|
|
|
|
---
|
|
# ClusterSecretStore - connects to Hanzo KMS
|
|
# Uses service token stored in hanzo-kms-credentials secret
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: hanzo-kms
|
|
spec:
|
|
provider:
|
|
# Hanzo KMS is Infisical-compatible
|
|
webhook:
|
|
url: "https://kms.hanzo.ai/api/v3/secrets/raw"
|
|
headers:
|
|
Authorization:
|
|
name: hanzo-kms-credentials
|
|
namespace: external-secrets
|
|
key: service-token
|
|
result:
|
|
jsonPath: "$.secrets"
|
|
secrets:
|
|
- name: env
|
|
secretRef:
|
|
name: hanzo-kms-credentials
|
|
namespace: external-secrets
|
|
key: environment
|
|
- name: project
|
|
secretRef:
|
|
name: hanzo-kms-credentials
|
|
namespace: external-secrets
|
|
key: project-id
|
|
---
|
|
# ExternalSecret for Bootnode API
|
|
# Syncs ALL secrets from Hanzo KMS → K8s Secret (bootnode-secrets)
|
|
#
|
|
# Secret keys use UPPERCASE_UNDERSCORE to match env var names used by
|
|
# the API (Pydantic Settings reads env vars). The deployment mounts
|
|
# this secret via envFrom, so keys become env var names directly.
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: bootnode-secrets
|
|
namespace: bootnode
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: hanzo-kms
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: bootnode-secrets
|
|
creationPolicy: Owner
|
|
data:
|
|
# =========================================================================
|
|
# Database
|
|
# =========================================================================
|
|
- secretKey: DATABASE_URL
|
|
remoteRef:
|
|
key: DATABASE_URL
|
|
- secretKey: POSTGRES_PASSWORD
|
|
remoteRef:
|
|
key: POSTGRES_PASSWORD
|
|
- secretKey: REDIS_URL
|
|
remoteRef:
|
|
key: REDIS_URL
|
|
- secretKey: REDIS_PASSWORD
|
|
remoteRef:
|
|
key: REDIS_PASSWORD
|
|
- secretKey: DATASTORE_URL
|
|
remoteRef:
|
|
key: DATASTORE_URL
|
|
|
|
# =========================================================================
|
|
# Authentication & Cryptographic Keys
|
|
# =========================================================================
|
|
- secretKey: JWT_SECRET
|
|
remoteRef:
|
|
key: JWT_SECRET
|
|
- secretKey: API_KEY_SALT
|
|
remoteRef:
|
|
key: API_KEY_SALT
|
|
|
|
# =========================================================================
|
|
# Hanzo IAM (OAuth)
|
|
# =========================================================================
|
|
- secretKey: IAM_CLIENT_ID
|
|
remoteRef:
|
|
key: IAM_CLIENT_ID
|
|
- secretKey: IAM_CLIENT_SECRET
|
|
remoteRef:
|
|
key: IAM_CLIENT_SECRET
|
|
|
|
# =========================================================================
|
|
# Hanzo Commerce (Square-based billing)
|
|
# =========================================================================
|
|
- secretKey: COMMERCE_URL
|
|
remoteRef:
|
|
key: COMMERCE_URL
|
|
- secretKey: COMMERCE_API_KEY
|
|
remoteRef:
|
|
key: COMMERCE_API_KEY
|
|
- secretKey: COMMERCE_WEBHOOK_SECRET
|
|
remoteRef:
|
|
key: COMMERCE_WEBHOOK_SECRET
|
|
|
|
# =========================================================================
|
|
# Chain RPC Endpoints (contain API keys)
|
|
# =========================================================================
|
|
- secretKey: ETH_MAINNET_RPC
|
|
remoteRef:
|
|
key: ETH_MAINNET_RPC
|
|
- secretKey: ETH_SEPOLIA_RPC
|
|
remoteRef:
|
|
key: ETH_SEPOLIA_RPC
|
|
- secretKey: POLYGON_MAINNET_RPC
|
|
remoteRef:
|
|
key: POLYGON_MAINNET_RPC
|
|
- secretKey: ARBITRUM_MAINNET_RPC
|
|
remoteRef:
|
|
key: ARBITRUM_MAINNET_RPC
|
|
- secretKey: OPTIMISM_MAINNET_RPC
|
|
remoteRef:
|
|
key: OPTIMISM_MAINNET_RPC
|
|
- secretKey: BASE_MAINNET_RPC
|
|
remoteRef:
|
|
key: BASE_MAINNET_RPC
|
|
- secretKey: AVALANCHE_MAINNET_RPC
|
|
remoteRef:
|
|
key: AVALANCHE_MAINNET_RPC
|
|
- secretKey: BSC_MAINNET_RPC
|
|
remoteRef:
|
|
key: BSC_MAINNET_RPC
|
|
- secretKey: LUX_MAINNET_RPC
|
|
remoteRef:
|
|
key: LUX_MAINNET_RPC
|
|
- secretKey: SOLANA_MAINNET_RPC
|
|
remoteRef:
|
|
key: SOLANA_MAINNET_RPC
|
|
- secretKey: BTC_MAINNET_RPC
|
|
remoteRef:
|
|
key: BTC_MAINNET_RPC
|
|
- secretKey: BTC_RPC_USER
|
|
remoteRef:
|
|
key: BTC_RPC_USER
|
|
- secretKey: BTC_RPC_PASSWORD
|
|
remoteRef:
|
|
key: BTC_RPC_PASSWORD
|
|
|
|
# =========================================================================
|
|
# AI Chat (Hanzo AI Gateway at api.hanzo.ai)
|
|
# =========================================================================
|
|
- secretKey: HANZO_AI_API_KEY
|
|
remoteRef:
|
|
key: HANZO_AI_API_KEY
|
|
|
|
# =========================================================================
|
|
# ERC-4337 Bundler
|
|
# =========================================================================
|
|
- secretKey: BUNDLER_PRIVATE_KEY
|
|
remoteRef:
|
|
key: BUNDLER_PRIVATE_KEY
|
|
|
|
# =========================================================================
|
|
# Third-Party Service Keys
|
|
# =========================================================================
|
|
- secretKey: CLOUDFLARE_API_TOKEN
|
|
remoteRef:
|
|
key: CLOUDFLARE_API_TOKEN
|
|
- secretKey: CLOUDFLARE_ZONE_ID
|
|
remoteRef:
|
|
key: CLOUDFLARE_ZONE_ID
|
|
- secretKey: QDRANT_API_KEY
|
|
remoteRef:
|
|
key: QDRANT_API_KEY
|
|
- secretKey: MEILISEARCH_API_KEY
|
|
remoteRef:
|
|
key: MEILISEARCH_API_KEY
|
|
|
|
---
|
|
# Setup instructions:
|
|
#
|
|
# 1. Create secrets in Hanzo KMS:
|
|
# - Go to https://kms.hanzo.ai
|
|
# - Create project "bootnode" (or use existing)
|
|
# - Add ALL secrets listed above to the "production" environment
|
|
# - Create service token with read access to the bootnode project
|
|
#
|
|
# 2. Create K8s secret for KMS credentials:
|
|
# kubectl create secret generic hanzo-kms-credentials \
|
|
# -n external-secrets \
|
|
# --from-literal=service-token='st.xxx.xxx' \
|
|
# --from-literal=environment='production' \
|
|
# --from-literal=project-id='xxx-xxx-xxx'
|
|
#
|
|
# 3. Apply this file:
|
|
# kubectl apply -f external-secrets.yaml
|
|
#
|
|
# 4. Verify sync:
|
|
# kubectl get externalsecret -n bootnode
|
|
# kubectl get secret bootnode-secrets -n bootnode -o jsonpath='{.data}' | jq 'keys'
|
|
#
|
|
# 5. Required secrets in KMS (add these before deploying):
|
|
#
|
|
# DATABASE_URL - PostgreSQL connection string
|
|
# POSTGRES_PASSWORD - PostgreSQL password (used by postgres pod)
|
|
# REDIS_URL - Redis connection string (with password)
|
|
# REDIS_PASSWORD - Redis password (used by redis pod)
|
|
# DATASTORE_URL - ClickHouse connection string
|
|
# JWT_SECRET - JWT signing key (min 256 bits)
|
|
# API_KEY_SALT - API key hashing salt (min 128 bits)
|
|
# IAM_CLIENT_ID - Hanzo IAM OAuth client ID
|
|
# IAM_CLIENT_SECRET - Hanzo IAM OAuth client secret
|
|
# COMMERCE_URL - Hanzo Commerce API URL
|
|
# COMMERCE_API_KEY - Hanzo Commerce API key
|
|
# COMMERCE_WEBHOOK_SECRET - Commerce webhook HMAC signing key
|
|
# ETH_MAINNET_RPC - Ethereum mainnet RPC endpoint
|
|
# POLYGON_MAINNET_RPC - Polygon mainnet RPC endpoint
|
|
# ARBITRUM_MAINNET_RPC - Arbitrum mainnet RPC endpoint
|
|
# OPTIMISM_MAINNET_RPC - Optimism mainnet RPC endpoint
|
|
# BASE_MAINNET_RPC - Base mainnet RPC endpoint
|
|
# AVALANCHE_MAINNET_RPC - Avalanche mainnet RPC endpoint
|
|
# BSC_MAINNET_RPC - BSC mainnet RPC endpoint
|
|
# LUX_MAINNET_RPC - Lux mainnet RPC endpoint
|
|
# SOLANA_MAINNET_RPC - Solana mainnet RPC endpoint
|
|
# BTC_MAINNET_RPC - Bitcoin mainnet RPC endpoint
|
|
# BTC_RPC_USER - Bitcoin RPC auth username
|
|
# BTC_RPC_PASSWORD - Bitcoin RPC auth password
|
|
# BUNDLER_PRIVATE_KEY - ERC-4337 bundler signing key
|
|
# CLOUDFLARE_API_TOKEN - Cloudflare edge cache token
|
|
# CLOUDFLARE_ZONE_ID - Cloudflare zone identifier
|
|
# QDRANT_API_KEY - Qdrant vector DB API key
|
|
# MEILISEARCH_API_KEY - Meilisearch full-text search key
|