lux/bridge
2
0
Fork 0
mirror of https://github.com/luxfi/bridge.git synced 2026-09-24 00:26:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

kms.lux.cloud is the brand host; kms.lux.network is retired

Browse Source 
The .network host was retired 2026-07-27 and no longer resolves at all, so every
reference to it named an address that cannot answer. The brand host is .cloud,
matching kms.zoo.cloud and the rest of the white-label convention.

Left alone deliberately, because rewriting them would invert what they say: the
LLM.md line that RECORDS the retirement, the e2e spec that ASSERTS
kms.lux.network must not resolve, and the recorded applies + cluster backups,
which are faithful accounts of what was applied and are not config.
This commit is contained in:
zeekay
2026-08-05 07:51:13 -07:00
parent 52988e2142
commit 83f826794a
11 changed files with 16 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/server/src/clients/__tests__/kms.test.ts
+1 -1
View File
@@ -5,7 +5,7 @@ import { KMSError, KMSSecretClient } from "../kms"
import { IAMClient } from "../iam"
const ISSUER = "https://iam.lux.network"
const KMS_URL = "https://kms.lux.network"
const KMS_URL = "https://kms.lux.cloud"
function jsonResponse(body: object, status = 200): Response {
return new Response(JSON.stringify(body), {
app/server/src/clients/kms.ts
+1 -1
View File
@@ -27,7 +27,7 @@ const _fetch = (...args: Parameters<typeof globalThis.fetch>) =>
globalThis.fetch(...args)
export interface KMSConfig {
/** Lux KMS endpoint, e.g. `https://kms.lux.network`. */
/** Lux KMS endpoint, e.g. `https://kms.lux.cloud`. */
url: string
/** Org slug whose secret namespace we're reading from. */
org: string
app/server/src/domain/__tests__/cosigners-kms-secret-fetch.test.ts
+6 -6
View File
@@ -60,7 +60,7 @@ function textResponse(body: string, status = 200): Response {
describe("fetchCosignerSecret — KMS-backed", () => {
it("reads utila PEM from bridge/cosigners/utila/{org}/sa_pem when KMS is configured", async () => {
process.env.BRIDGE_KMS_URL = "https://kms.lux.network"
process.env.BRIDGE_KMS_URL = "https://kms.lux.cloud"
process.env.BRIDGE_KMS_ORG = "lux"
process.env.BRIDGE_IAM_ISSUER = "https://iam.lux.network"
process.env.BRIDGE_IAM_CLIENT_ID = "lux-bridge"
@@ -81,12 +81,12 @@ describe("fetchCosignerSecret — KMS-backed", () => {
expect(pem).toBe("UTILA-PEM-BYTES")
const url = fetchSpy.mock.calls[1]?.[0] as string
expect(url).toBe(
"https://kms.lux.network/v1/kms/orgs/lux/secrets/bridge/cosigners/utila/ORG_A/sa_pem",
"https://kms.lux.cloud/v1/kms/orgs/lux/secrets/bridge/cosigners/utila/ORG_A/sa_pem",
)
})
it("reads fireblocks PEM from bridge/cosigners/fireblocks/{api_key}/secret_pem", async () => {
process.env.BRIDGE_KMS_URL = "https://kms.lux.network"
process.env.BRIDGE_KMS_URL = "https://kms.lux.cloud"
process.env.BRIDGE_KMS_ORG = "lux"
process.env.BRIDGE_IAM_ISSUER = "https://iam.lux.network"
process.env.BRIDGE_IAM_CLIENT_ID = "lux-bridge"
@@ -106,12 +106,12 @@ describe("fetchCosignerSecret — KMS-backed", () => {
expect(pem).toBe("FB-PEM")
const url = fetchSpy.mock.calls[1]?.[0] as string
expect(url).toBe(
"https://kms.lux.network/v1/kms/orgs/lux/secrets/bridge/cosigners/fireblocks/PUB_KEY/secret_pem",
"https://kms.lux.cloud/v1/kms/orgs/lux/secrets/bridge/cosigners/fireblocks/PUB_KEY/secret_pem",
)
})
it("falls back to env var when KMS returns 404", async () => {
process.env.BRIDGE_KMS_URL = "https://kms.lux.network"
process.env.BRIDGE_KMS_URL = "https://kms.lux.cloud"
process.env.BRIDGE_KMS_ORG = "lux"
process.env.BRIDGE_IAM_ISSUER = "https://iam.lux.network"
process.env.BRIDGE_IAM_CLIENT_ID = "lux-bridge"
@@ -156,7 +156,7 @@ describe("fetchCosignerSecret — KMS-backed", () => {
})
it("non-404 KMS error propagates (retryable on the caller side)", async () => {
process.env.BRIDGE_KMS_URL = "https://kms.lux.network"
process.env.BRIDGE_KMS_URL = "https://kms.lux.cloud"
process.env.BRIDGE_KMS_ORG = "lux"
process.env.BRIDGE_IAM_ISSUER = "https://iam.lux.network"
process.env.BRIDGE_IAM_CLIENT_ID = "lux-bridge"
cmd/bridge/main_test.go
+1 -1
View File
@@ -115,7 +115,7 @@ iam:
clientID: lux-bridge
organization: lux
kms:
endpoint: https://kms.lux.network
endpoint: https://kms.lux.cloud
projectID: lux-bridge
environment: prod
mpc:
compose.standalone.yml
+1 -1
View File
@@ -59,7 +59,7 @@ services:
LOG_LEVEL: info
# All external integrations are OPTIONAL — uncomment to enable.
# BRIDGE_IAM_ISSUER: https://iam.lux.network
# BRIDGE_KMS_URL: https://kms.lux.network
# BRIDGE_KMS_URL: https://kms.lux.cloud
# BRIDGE_KMS_ORG: lux
# BRIDGE_IAM_CLIENT_ID: lux-bridge
# BRIDGE_IAM_CLIENT_SECRET: <fetch from your secret store>
config.kms.yaml
+1 -1
View File
@@ -7,7 +7,7 @@ kms:
site_url: "http://localhost:8080"
# For production Lux KMS
# site_url: "https://kms.lux.network"
# site_url: "https://kms.lux.cloud"
# Project settings (required)
project_id: "your-project-id" # Or set KMS_PROJECT_ID env var
pkg/bridge/README.md
+1 -1
View File
@@ -65,7 +65,7 @@ mountBridge({
},
// KMS endpoint — same shape as <Exchange kms={…} />.
kms: { url: 'https://kms.lux.network' },
kms: { url: 'https://kms.lux.cloud' },
// Wallet connector defaults (WalletConnect v2 + EVM chain set).
wallet: {
pkg/bridge/src/types.ts
+1 -1
View File
@@ -60,7 +60,7 @@ export interface BridgeAuthConfig {
* runtime secrets via JWT-gated requests.
*/
export interface BridgeKMSConfig {
/** KMS endpoint URL (e.g. `https://kms.lux.network`). */
/** KMS endpoint URL (e.g. `https://kms.lux.cloud`). */
url: string
}
pkg/tenant/config.go
+1 -1
View File
@@ -48,7 +48,7 @@ type Config struct {
IAM IAMConfig `yaml:"iam"`
// KMS points the bridge at the tenant's KMS (kms.hanzo.ai,
// kms.lux.network, ...). All secrets (mpc tokens, coingecko keys,
// kms.lux.cloud, ...). All secrets (mpc tokens, coingecko keys,
// release-wallet seeds) come from KMS via Universal Auth, NEVER
// from environment variables in production.
KMS KMSConfig `yaml:"kms"`
pkg/tenant/config_test.go
+1 -1
View File
@@ -354,7 +354,7 @@ iam:
clientID: lux-bridge
organization: lux
kms:
endpoint: https://kms.lux.network
endpoint: https://kms.lux.cloud
projectID: lux-bridge
environment: prod
mpc:
tenant.example.yaml
+1 -1
View File
@@ -54,7 +54,7 @@ iam:
# material) MUST come from KMS via Universal Auth. NEVER from env vars
# in production.
kms:
endpoint: "https://kms.lux.network"
endpoint: "https://kms.lux.cloud"
projectID: "lux-bridge"
environment: "prod" # prod | staging | dev