mirror of
https://github.com/luxfi/bridge.git
synced 2026-09-24 00:26:46 +00:00
zeekay
8a8942ca89
User directive: 'drop LUX_ keep it brand neutral do not use nats/consul
must use standalone ~/work/lux/mpc with our native ~/work/lux/consensus
or b/m-chains'.
This commit lands all three asks.
────────────────────────────────────────────────────────────────────────
Brand neutralization
────────────────────────────────────────────────────────────────────────
Env vars renamed (LUX_* → BRIDGE_*):
LUX_IAM_ISSUER → BRIDGE_IAM_ISSUER
LUX_KMS_URL → BRIDGE_KMS_URL
LUX_KMS_ORG → BRIDGE_KMS_ORG
LUX_KMS_CLIENT_ID → BRIDGE_IAM_CLIENT_ID
LUX_KMS_CLIENT_SECRET → BRIDGE_IAM_CLIENT_SECRET
LUX_MPC_URL → BRIDGE_MPC_URL
(+ BRIDGE_MPC_WALLET_ID new — default wallet for native sign)
Client classes renamed (Lux* → brand-neutral):
LuxIAMClient → IAMClient
LuxKMSClient → KMSSecretClient (avoids collision w/ AWS SDK's KMSClient)
LuxMPCClient → MPCClient
Audience strings renamed (lux-* → bare service name):
'lux-kms' → 'kms'
'lux-mpc' → 'mpc'
File renames:
src/clients/lux-iam.ts → src/clients/iam.ts
src/clients/lux-kms.ts → src/clients/kms.ts
src/clients/lux-mpc.ts → src/clients/mpc.ts
(+ matching __tests__/ files)
────────────────────────────────────────────────────────────────────────
NATS + Consul: gone
────────────────────────────────────────────────────────────────────────
Deletions:
- app/server/src/services/mpc-service.ts (498 LOC NATS+Consul wrapper)
- app/server/src/utils/trigger-keygen.ts (dev script, NATS)
- app/server/src/scripts/trigger-keygen.ts (dev script, NATS)
- app/server/src/scripts/test-signing.ts (dev script, NATS)
- app/server/src/types/nats.d.ts (vendored type stubs)
- consul + nats sections of app/server/src/types/index.d.ts
- nats + consul devDependencies in app/server/package.json
- NATS + Consul + Vault containers in compose.local.yml
Rewritten:
- app/server/src/domain/mpc-bridge.ts (497 → 197 LOC)
Preserves the public surface (bridgeMPC.initialize() /
.generateMPCSignature() / .completeSwap() / .getHealthStatus())
so domain/mpc-modern.ts callers stay untouched. Internally:
- One MPCClient HTTP call replaces the NATS publish + subscribe
pub/sub dance. mpcd handles the threshold round atomically.
- Consul KV completion marker replaced with Prisma's
Swap.metadata_sequence_number update (single source of truth).
- Lazy IAM + MPCClient construction so the bridge boots cleanly
when BRIDGE_MPC_URL / BRIDGE_IAM_* are unset (standalone mode).
Sign calls return a clear error rather than crashing the
process.
- app/server/src/server.ts startup: no more mpcService.initialize();
bridgeMPC.initialize() now soft-fails (logger.warn) on missing
env. /health endpoint reads through bridgeMPC.getHealthStatus()
which reports { online: 0, total: 0, standalone: true } when
MPCClient isn't configured.
- compose.local.yml: replaces 6-service NATS/Consul/Vault topology
with bare 3-service (iam + iam-db + bridge postgres). Out-of-band
mpcd + KMS instructions documented in the file header.
────────────────────────────────────────────────────────────────────────
docs/LLM.md
────────────────────────────────────────────────────────────────────────
All LUX_* env mentions retargeted to BRIDGE_*. The 'Native Lux services'
section now describes the HTTP-only, env-neutral integration pattern.
Standalone mode section unchanged in shape but with refreshed env names.
────────────────────────────────────────────────────────────────────────
Tests + typecheck
────────────────────────────────────────────────────────────────────────
SDK pkg/bridge: 58 / 58
Server app/server: 123 / 123 (no regression — same set as v1.1.21
with renamed env vars)
Typecheck: clean on both packages
────────────────────────────────────────────────────────────────────────
Net effect
────────────────────────────────────────────────────────────────────────
Bridge backend is now genuinely brand-neutral:
- No 'LUX_' in any env var (the BRIDGE_ prefix is service-scoped, not
brand-scoped; same prefix the SDK uses for runtime config)
- No NATS, no Consul anywhere in the codebase or compose files
- Native m-chain signing goes through HTTP to mpcd (the canonical
~/work/lux/mpc daemon, github.com/luxfi/mpc), one round-trip per
sign, with the same wire protocol as ~/work/lux/kms/pkg/mpc/client.go
- Standalone mode preserved: when BRIDGE_MPC_URL is unset, the bridge
runs without crashing; sign calls return a clear error
114 lines
3.2 KiB
YAML
114 lines
3.2 KiB
YAML
# Lux Bridge — LOCAL compose.
|
|
#
|
|
# Boots the full local development topology: identity provider (Casdoor)
|
|
# + Postgres for both Casdoor and bridge. NO NATS, NO Consul, NO Vault —
|
|
# the bridge backend no longer needs pub/sub or service discovery for
|
|
# MPC (HTTP to mpcd does it in one round-trip; per-swap state lives in
|
|
# Postgres).
|
|
#
|
|
# For TRUE bare-minimum standalone (just bridge + Postgres, no auth),
|
|
# use compose.standalone.yml instead.
|
|
#
|
|
# To enable native m-chain (threshold MPC) at boot, run the canonical
|
|
# Lux MPC daemon out-of-band:
|
|
# make install-mpc # go install github.com/luxfi/mpc/cmd/mpcd
|
|
# make start-mpc-nodes # 3-node local cluster
|
|
# export BRIDGE_MPC_URL=http://localhost:6000
|
|
#
|
|
# Same pattern for Lux KMS (~/work/lux/kms) — point BRIDGE_KMS_URL at it.
|
|
|
|
services:
|
|
# Identity provider (Casdoor-based unified authentication).
|
|
# Brand-neutral container name + service id — tenants can point any
|
|
# OIDC provider here without renaming.
|
|
iam:
|
|
image: casbin/casdoor:latest
|
|
container_name: bridge-iam
|
|
ports:
|
|
- "8000:8000"
|
|
environment:
|
|
- RUNNING_IN_DOCKER=true
|
|
volumes:
|
|
- ./config/casdoor/app.conf:/conf/app.conf
|
|
- iam-data:/var/lib/casdoor
|
|
networks:
|
|
- bridge-network
|
|
depends_on:
|
|
iam-db:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8000"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 5
|
|
|
|
# Identity provider database.
|
|
iam-db:
|
|
image: ghcr.io/hanzoai/sql:latest
|
|
container_name: bridge-iam-db
|
|
environment:
|
|
- POSTGRES_USER=casdoor
|
|
- POSTGRES_PASSWORD=${IAM_DB_PASSWORD:-changeme}
|
|
- POSTGRES_DB=casdoor
|
|
volumes:
|
|
- iam-db-data:/var/lib/postgresql/data
|
|
ports:
|
|
- "5434:5432"
|
|
networks:
|
|
- bridge-network
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U casdoor"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 5
|
|
|
|
# Bridge swap state (canonical, via Prisma).
|
|
postgres:
|
|
image: ghcr.io/hanzoai/sql:latest
|
|
container_name: bridge-postgres
|
|
environment:
|
|
- POSTGRES_USER=bridge
|
|
- POSTGRES_PASSWORD=bridge
|
|
- POSTGRES_DB=bridge
|
|
volumes:
|
|
- postgres-data:/var/lib/postgresql/data
|
|
- ./scripts/init.sql:/docker-entrypoint-initdb.d/init.sql
|
|
ports:
|
|
- "5433:5432"
|
|
networks:
|
|
- bridge-network
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U bridge"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 5
|
|
|
|
# mpcd (the canonical Lux threshold-MPC daemon) and the KMS service
|
|
# are NOT in this compose. Run them out-of-band:
|
|
#
|
|
# # mpcd — github.com/luxfi/mpc
|
|
# make install-mpc
|
|
# make start-mpc-nodes # 3-node local cluster on :6000-6002
|
|
#
|
|
# # KMS — github.com/luxfi/kms
|
|
# cd ~/work/lux/kms && make dev
|
|
#
|
|
# Then point the bridge backend at them:
|
|
# export BRIDGE_MPC_URL=http://localhost:6000
|
|
# export BRIDGE_KMS_URL=http://localhost:8080
|
|
#
|
|
# The bridge runs in standalone mode (clean error on sign calls)
|
|
# until those are set — no crash at startup.
|
|
|
|
volumes:
|
|
iam-data:
|
|
iam-db-data:
|
|
postgres-data:
|
|
|
|
networks:
|
|
bridge-network:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 172.25.0.0/16
|