mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
4e3bfa0a87
M-1: compose.yml commented section now enforces JWT_SECRET required syntax
M-3: TLS client config uses TOFU certificate pinning instead of blind
InsecureSkipVerify — SHA-256 fingerprint pinned on first connect,
mismatches rejected on subsequent connections
M-4: TLSOnlyListener plaintext escape hatch gated behind both
ALLOW_PLAINTEXT=true AND ENVIRONMENT=development
M-5: KMS fallback to unencrypted storage is now log.Fatal in production
(ENVIRONMENT != "development"), including Put-time failures
M-6: isKeyShare() now checks org: prefix, key-type prefixes (frost:,
bls:, sr25519:, tfhe:), and hex wallet IDs instead of returning true
M-9: AES-GCM Encrypt/Decrypt accept optional AAD variadic parameter
for context-binding; existing callers remain backward compatible
M-12: Internal /keygen endpoint requires org_id in request body (400 if
missing); orgID propagated to GenerateKeyMessage and audit log
81 lines
2.1 KiB
YAML
81 lines
2.1 KiB
YAML
# Minimal local development stack.
|
|
# SQLite is the default storage — no external DB required to start.
|
|
# For production, uncomment postgres and valkey below.
|
|
|
|
services:
|
|
api:
|
|
image: ghcr.io/luxfi/mpc-api:latest
|
|
command: >
|
|
start --mode consensus
|
|
--api-listen :8081
|
|
--data /data/mpc
|
|
--jwt-secret ${JWT_SECRET:?JWT_SECRET must be set}
|
|
ports:
|
|
- "8081:8081"
|
|
environment:
|
|
- JWT_SECRET=${JWT_SECRET:?JWT_SECRET must be set}
|
|
volumes:
|
|
- mpc-data:/data/mpc
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-q", "--spider", "http://localhost:8081/healthz"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
dashboard:
|
|
image: ghcr.io/luxfi/mpc-dashboard:latest
|
|
ports:
|
|
- "3000:3000"
|
|
environment:
|
|
- NEXT_PUBLIC_API_URL=http://localhost:8081/v1
|
|
depends_on:
|
|
api:
|
|
condition: service_healthy
|
|
|
|
## Production: uncomment to use PostgreSQL instead of SQLite.
|
|
# postgres:
|
|
# image: ghcr.io/hanzoai/sql:latest
|
|
# environment:
|
|
# POSTGRES_DB: mpc_api
|
|
# POSTGRES_USER: mpc
|
|
# POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
# volumes:
|
|
# - pgdata:/var/lib/postgresql/data
|
|
# ports:
|
|
# - "5432:5432"
|
|
# healthcheck:
|
|
# test: ["CMD-SHELL", "pg_isready -U mpc -d mpc_api"]
|
|
# interval: 5s
|
|
# timeout: 3s
|
|
# retries: 5
|
|
|
|
## Production: uncomment to enable Valkey KV cache.
|
|
# valkey:
|
|
# image: valkey/valkey:8-alpine
|
|
# ports:
|
|
# - "6379:6379"
|
|
# healthcheck:
|
|
# test: ["CMD", "valkey-cli", "ping"]
|
|
# interval: 5s
|
|
# timeout: 3s
|
|
# retries: 5
|
|
|
|
## When using postgres+valkey, change api command to:
|
|
# api:
|
|
# command: >
|
|
# start --mode consensus
|
|
# --api-db postgres://mpc:${POSTGRES_PASSWORD}@postgres:5432/mpc_api?sslmode=disable
|
|
# --api-kv valkey:6379
|
|
# --api-listen :8081
|
|
# --data /data/mpc
|
|
# --jwt-secret ${JWT_SECRET:?JWT_SECRET must be set}
|
|
# depends_on:
|
|
# postgres:
|
|
# condition: service_healthy
|
|
# valkey:
|
|
# condition: service_healthy
|
|
|
|
volumes:
|
|
mpc-data:
|
|
# pgdata: # uncomment for production postgres
|