mirror of
https://github.com/luxfi/dex.git
synced 2026-09-24 00:26:31 +00:00
zeekay
cb46f347b6
deploy/testnet: one-command-per-box bring-up for a fleet of standalone `dexd run` venues across two boxes, a cross-arch determinism proof, and a ZAP load/throughput bench (drives the existing cmd/dexbench). - compose.yml + gen-compose.sh: N independent venues/box (default 3, scales to ~11), one ZAP port/node, per-node data dirs, 128GB-box resource caps. - Dockerfile: pure-Go CPU image (dexd + dexbench), native amd64/arm64. - Makefile: make up/bench/verify/down — git pull + one command per box. - topology.md: honest consensus model (independent venues, deterministic per-node genesis, no gossip) + the luxd `dexd plugin` BFT path. - overlay/: opt-in hanzozt (OpenZiti) tunneler for NAT; direct 2.5GbE is the default for true wire numbers. - README.md: exact per-box commands, 128GB sizing, reading bench output. Validated locally: signed place/cross load 0 rejects (cross=1 fill/submit); dexbench -verify across two independent venues PASS (byte-identical 3-fill multi-level sweep).
42 lines
1.9 KiB
YAML
42 lines
1.9 KiB
YAML
# hanzozt overlay tunneler — OPT-IN, for when the boxes CANNOT reach each other
|
|
# directly (NAT / different sites). On a direct 2.5 GbE link DO NOT use this:
|
|
# the overlay adds mTLS + encapsulation overhead and an extra hop, which lowers
|
|
# throughput and raises latency. Direct LAN (the default in ../README.md) is what
|
|
# you want for the benchmark. See ./README.md for the controller-side recipe.
|
|
#
|
|
# Run it ALONGSIDE the venue stack:
|
|
# docker compose -f ../compose.gen.yml -f overlay/compose.hanzozt.yml up -d
|
|
#
|
|
# Modes (set ZT_MODE):
|
|
# run-host on each VENUE box — binds the box's Ziti service to local venues
|
|
# (no tun device, no privilege needed). DEFAULT.
|
|
# run-proxy on the BENCH/client box — opens local TCP ports forwarding to the
|
|
# overlay services; the bench then dials 127.0.0.1:<proxy-port>.
|
|
# run full tun mode (intercept overlay DNS). Needs /dev/net/tun +
|
|
# NET_ADMIN (uncomment below). Often unavailable under WSL.
|
|
#
|
|
# Identity is OWNER-SUPPLIED (only you have your controller + enrollment JWTs):
|
|
# ZITI_ENROLL_TOKEN one-time enrollment JWT (first boot), or
|
|
# ZITI_IDENTITY_JSON pre-enrolled identity JSON.
|
|
# The enrolled identity persists in the ./zt-identity volume.
|
|
|
|
services:
|
|
zt:
|
|
image: ${ZT_IMAGE:-hanzozt/zt-edge-tunnel:latest} # PIN a real tag in .env
|
|
container_name: dex-zt
|
|
command: ["${ZT_MODE:-run-host}"]
|
|
network_mode: host
|
|
restart: unless-stopped
|
|
environment:
|
|
ZITI_IDENTITY_BASENAME: ${ZT_IDENTITY_BASENAME:-dex-node}
|
|
ZITI_IDENTITY_DIR: /zt-edge-tunnel
|
|
# supply ONE of these (env or .env):
|
|
ZITI_ENROLL_TOKEN: ${ZT_ENROLL_TOKEN:-}
|
|
ZITI_IDENTITY_JSON: ${ZT_IDENTITY_JSON:-}
|
|
volumes:
|
|
- ./zt-identity:/zt-edge-tunnel
|
|
# --- only for ZT_MODE=run (full tun intercept); harmless to leave commented
|
|
# for run-host / run-proxy, which need neither: ---
|
|
# cap_add: [NET_ADMIN]
|
|
# devices: ["/dev/net/tun:/dev/net/tun"]
|