mirror of
https://github.com/luxfi/bridge.git
synced 2026-09-24 00:26:46 +00:00
unify on hanzoai/sql:17-alpine, IngressClass ingress
All postgres images → ghcr.io/hanzoai/sql:17-alpine All ingress classes → ingress (was nginx/hanzo)
This commit is contained in:
@@ -19,7 +19,7 @@ jobs:
|
||||
services:
|
||||
# Database for Bridge
|
||||
postgres-bridge:
|
||||
image: postgres:15-alpine
|
||||
image: ghcr.io/hanzoai/sql:17-alpine
|
||||
env:
|
||||
POSTGRES_USER: bridge
|
||||
POSTGRES_PASSWORD: bridge
|
||||
@@ -34,7 +34,7 @@ jobs:
|
||||
|
||||
# Database for Lux ID (Casdoor)
|
||||
postgres-id:
|
||||
image: postgres:15-alpine
|
||||
image: ghcr.io/hanzoai/sql:17-alpine
|
||||
env:
|
||||
POSTGRES_USER: casdoor
|
||||
POSTGRES_PASSWORD: casdoor
|
||||
|
||||
@@ -16,7 +16,7 @@ jobs:
|
||||
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:15-alpine
|
||||
image: ghcr.io/hanzoai/sql:17-alpine
|
||||
env:
|
||||
POSTGRES_USER: bridge
|
||||
POSTGRES_PASSWORD: bridge
|
||||
|
||||
+1
-1
@@ -38,7 +38,7 @@ services:
|
||||
|
||||
# Database
|
||||
postgres:
|
||||
image: postgres:15-alpine
|
||||
image: ghcr.io/hanzoai/sql:17-alpine
|
||||
container_name: bridge-postgres
|
||||
environment:
|
||||
- POSTGRES_USER=bridge
|
||||
|
||||
+2
-2
@@ -23,7 +23,7 @@ services:
|
||||
|
||||
# Lux ID Database (PostgreSQL for Casdoor)
|
||||
lux-id-db:
|
||||
image: postgres:15-alpine
|
||||
image: ghcr.io/hanzoai/sql:17-alpine
|
||||
container_name: bridge-lux-id-db
|
||||
environment:
|
||||
- POSTGRES_USER=casdoor
|
||||
@@ -99,7 +99,7 @@ services:
|
||||
|
||||
# Database
|
||||
postgres:
|
||||
image: postgres:15-alpine
|
||||
image: ghcr.io/hanzoai/sql:17-alpine
|
||||
container_name: bridge-postgres
|
||||
environment:
|
||||
- POSTGRES_USER=bridge
|
||||
|
||||
+1
-1
@@ -43,7 +43,7 @@ services:
|
||||
|
||||
# Database with replication support
|
||||
postgres:
|
||||
image: postgres:15-alpine
|
||||
image: ghcr.io/hanzoai/sql:17-alpine
|
||||
container_name: bridge-postgres
|
||||
restart: always
|
||||
environment:
|
||||
|
||||
+1
-1
@@ -41,7 +41,7 @@ services:
|
||||
|
||||
# Database
|
||||
postgres:
|
||||
image: postgres:15-alpine
|
||||
image: ghcr.io/hanzoai/sql:17-alpine
|
||||
container_name: bridge-postgres
|
||||
restart: always
|
||||
environment:
|
||||
|
||||
+2
-2
@@ -23,7 +23,7 @@ services:
|
||||
|
||||
# Lux ID Database (PostgreSQL for Casdoor)
|
||||
lux-id-db:
|
||||
image: postgres:15-alpine
|
||||
image: ghcr.io/hanzoai/sql:17-alpine
|
||||
container_name: bridge-lux-id-db
|
||||
environment:
|
||||
- POSTGRES_USER=casdoor
|
||||
@@ -181,7 +181,7 @@ services:
|
||||
|
||||
# Database
|
||||
postgres:
|
||||
image: postgres:15-alpine
|
||||
image: ghcr.io/hanzoai/sql:17-alpine
|
||||
container_name: bridge-postgres
|
||||
environment:
|
||||
- POSTGRES_USER=bridge
|
||||
|
||||
@@ -0,0 +1,104 @@
|
||||
# MPC Operator Compose — Distributed 3-of-5 Multi-Geo Setup
|
||||
#
|
||||
# OVERVIEW
|
||||
# --------
|
||||
# Each geo-distributed operator runs this file on their own server.
|
||||
# Together, 5 operators form a 3-of-5 threshold MPC cluster: any 3 nodes
|
||||
# can produce a valid signature; no single operator holds a complete key.
|
||||
#
|
||||
# SETUP SEQUENCE (one-time, done by the initiator — node0)
|
||||
# ---------------------------------------------------------
|
||||
# 1. All 5 operators share their public IP and port 9651 with each other.
|
||||
# 2. Each operator copies this file, creates a .env (see ENVIRONMENT below),
|
||||
# and sets MPC_NODE_ID to their assigned node name (node0 .. node4).
|
||||
# 3. MPC_PEERS lists the OTHER 4 operators' endpoints, e.g.:
|
||||
# node0 sets: [email protected]:9651,[email protected]:9651,...
|
||||
# 4. The initiator (node0) runs key generation once:
|
||||
# docker compose -f mpc-operator.yml exec mpcd mpcd keygen --threshold 2 --nodes 5
|
||||
# The resulting key shares are written to /data and backed up to S3.
|
||||
# Each operator's share is encrypted with their own LUX_MPC_PASSWORD.
|
||||
# 5. After keygen, all 5 operators start their compose stack:
|
||||
# docker compose -f mpc-operator.yml up -d
|
||||
#
|
||||
# S3 BACKUP
|
||||
# ---------
|
||||
# Each operator manages their own backup independently using their own
|
||||
# bucket/prefix. Credentials never leave the operator's server.
|
||||
# Recommended prefix: mpc/<node-id>/ e.g. mpc/node0/
|
||||
#
|
||||
# NETWORKING
|
||||
# ----------
|
||||
# Port 9651 (p2p) MUST be reachable from the internet — open it in your
|
||||
# firewall/security group. Ports 8080 and 8081 are private; bind them to
|
||||
# 127.0.0.1 or restrict with a firewall rule to prevent public exposure.
|
||||
#
|
||||
# ENVIRONMENT (.env file alongside this compose file)
|
||||
# ---------------------------------------------------
|
||||
# LUX_MPC_PASSWORD=<strong-random-passphrase> # encrypts the local ZapDB key share
|
||||
# MPC_NODE_ID=node0 # node0 .. node4
|
||||
# MPC_LISTEN_ADDR=:9651 # p2p — must be internet-accessible
|
||||
# MPC_API_ADDR=:8080 # HTTP API — keep private
|
||||
# MPC_DASHBOARD_ADDR=:8081 # dashboard — keep private
|
||||
# MPC_THRESHOLD=2 # minimum signers required (2-of-5)
|
||||
# MPC_PEERS=node1@<ip1>:9651,node2@<ip2>:9651,node3@<ip3>:9651,node4@<ip4>:9651
|
||||
# MPC_S3_ENDPOINT=https://s3.amazonaws.com # or MinIO endpoint
|
||||
# MPC_S3_BUCKET=my-mpc-backups
|
||||
# MPC_S3_ACCESS_KEY=<access-key>
|
||||
# MPC_S3_SECRET_KEY=<secret-key>
|
||||
|
||||
services:
|
||||
mpcd:
|
||||
image: ghcr.io/luxfi/mpc:latest
|
||||
restart: unless-stopped
|
||||
|
||||
# Run in consensus mode: no NATS or Consul dependency.
|
||||
# Peers are discovered statically via MPC_PEERS.
|
||||
# ZapDB stores the encrypted key share under /data.
|
||||
command:
|
||||
- mpcd
|
||||
- start
|
||||
- --node-id=${MPC_NODE_ID}
|
||||
- --listen=${MPC_LISTEN_ADDR}
|
||||
- --api=${MPC_API_ADDR}
|
||||
- --dashboard=${MPC_DASHBOARD_ADDR}
|
||||
- --threshold=${MPC_THRESHOLD}
|
||||
- --peers=${MPC_PEERS}
|
||||
- --db=/data/zapdb
|
||||
- --s3-endpoint=${MPC_S3_ENDPOINT}
|
||||
- --s3-bucket=${MPC_S3_BUCKET}
|
||||
- --s3-prefix=mpc/${MPC_NODE_ID}/
|
||||
- --consensus=direct
|
||||
|
||||
environment:
|
||||
LUX_MPC_PASSWORD: ${LUX_MPC_PASSWORD}
|
||||
MPC_NODE_ID: ${MPC_NODE_ID}
|
||||
MPC_LISTEN_ADDR: ${MPC_LISTEN_ADDR}
|
||||
MPC_API_ADDR: ${MPC_API_ADDR}
|
||||
MPC_DASHBOARD_ADDR: ${MPC_DASHBOARD_ADDR}
|
||||
MPC_THRESHOLD: ${MPC_THRESHOLD}
|
||||
MPC_PEERS: ${MPC_PEERS}
|
||||
MPC_S3_ENDPOINT: ${MPC_S3_ENDPOINT}
|
||||
MPC_S3_BUCKET: ${MPC_S3_BUCKET}
|
||||
MPC_S3_ACCESS_KEY: ${MPC_S3_ACCESS_KEY}
|
||||
MPC_S3_SECRET_KEY: ${MPC_S3_SECRET_KEY}
|
||||
LOG_LEVEL: info
|
||||
|
||||
ports:
|
||||
# p2p consensus — internet-accessible; open in firewall
|
||||
- "9651:9651"
|
||||
# HTTP API — private; restrict at firewall or bind to 127.0.0.1
|
||||
- "127.0.0.1:8080:8080"
|
||||
# Dashboard API — private; restrict at firewall or bind to 127.0.0.1
|
||||
- "127.0.0.1:8081:8081"
|
||||
|
||||
volumes:
|
||||
# Persistent ZapDB storage for encrypted key share and consensus state.
|
||||
# Back this up to S3 regularly; the node cannot sign without it.
|
||||
- ./data:/data
|
||||
|
||||
healthcheck:
|
||||
test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/health"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
@@ -397,7 +397,7 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: postgres
|
||||
image: ghcr.io/hanzoai/sql:16-alpine
|
||||
image: ghcr.io/hanzoai/sql:17-alpine
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
name: postgres
|
||||
@@ -472,7 +472,7 @@ metadata:
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
ingressClassName: hanzo
|
||||
ingressClassName: ingress
|
||||
tls:
|
||||
- hosts:
|
||||
- bridge.lux.network
|
||||
|
||||
@@ -94,6 +94,7 @@ data:
|
||||
<a href="#chains">Chains</a>
|
||||
<a href="#performance">Performance</a>
|
||||
<a href="https://docs.lux.network/mpc">Docs</a>
|
||||
<a href="https://api.mpc.lux.network" class="btn btn-outline btn-sm">API</a>
|
||||
<a href="https://bridge.lux.network" class="btn btn-primary btn-sm">Bridge</a>
|
||||
</div>
|
||||
</div>
|
||||
@@ -106,8 +107,8 @@ data:
|
||||
<p class="subtitle">Multi-party computation infrastructure securing the Lux Bridge. 3-of-5 threshold signatures with CGGMP21 and FROST protocols. Your keys never exist in a single location.</p>
|
||||
<div class="ctas">
|
||||
<a href="https://bridge.lux.network" class="btn btn-primary">Go to Bridge</a>
|
||||
<a href="https://api.mpc.lux.network/healthz" class="btn btn-outline">Node Status</a>
|
||||
<a href="https://explore.lux.network" class="btn btn-outline">Explorer</a>
|
||||
<a href="https://github.com/luxfi/mpc" class="btn btn-outline">GitHub</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
@@ -567,7 +568,7 @@ metadata:
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
ingressClassName: hanzo
|
||||
ingressClassName: ingress
|
||||
rules:
|
||||
- host: mpc.lux.network
|
||||
http:
|
||||
|
||||
@@ -0,0 +1,86 @@
|
||||
# MPC Network Security Policy
|
||||
# Namespace: lux-bridge
|
||||
#
|
||||
# Threat model:
|
||||
# - MPC nodes hold key shares; lateral movement from any other pod must be blocked
|
||||
# - Only the bridge-server may call the MPC HTTP/dashboard APIs
|
||||
# - MPC nodes must reach each other for ZAP p2p consensus on port 9651
|
||||
# - Egress is unrestricted (nodes need S3, postgres, external peers)
|
||||
#
|
||||
# Ports:
|
||||
# 9651 - ZAP p2p consensus (mpc-node ↔ mpc-node only)
|
||||
# 8080 - HTTP API (bridge-server → mpc-node only)
|
||||
# 8081 - Dashboard API (bridge-server → mpc-node only; also exposed via Ingress)
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: mpc-node-ingress
|
||||
namespace: lux-bridge
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: mpc-node
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
# bridge-server → mpc-node: HTTP API and dashboard API
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: bridge-server
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
- protocol: TCP
|
||||
port: 8081
|
||||
# mpc-node ↔ mpc-node: ZAP p2p consensus
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: mpc-node
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9651
|
||||
---
|
||||
# Egress: unrestricted — nodes must reach S3, postgres, and external MPC peers
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: mpc-node-egress
|
||||
namespace: lux-bridge
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: mpc-node
|
||||
policyTypes:
|
||||
- Egress
|
||||
egress:
|
||||
- {}
|
||||
---
|
||||
# Ingress: api.mpc.lux.network → mpc-api-svc:8081
|
||||
# API key auth is enforced by mpcd itself. TLS via cert-manager.
|
||||
# DNS: add A record api.mpc.lux.network → ingress controller IP.
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: mpc-api-ingress
|
||||
namespace: lux-bridge
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
ingressClassName: ingress
|
||||
tls:
|
||||
- hosts:
|
||||
- api.mpc.lux.network
|
||||
secretName: mpc-api-lux-tls
|
||||
rules:
|
||||
- host: api.mpc.lux.network
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: mpc-api-svc
|
||||
port:
|
||||
number: 8081
|
||||
Reference in New Issue
Block a user