mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
21da3d64e0
- Add bearer token auth to internal MPC API (port 9800): /keygen, /keys, /backup now require Authorization header. Token from MPC_INTERNAL_API_KEY env (KMS-synced) or derived from Ed25519 node identity. - Replace DualModeListener with TLSOnlyListener: plaintext peer connections are rejected. TLS 1.3 with PQ key exchange is mandatory. - Add dedicated 20 RPM rate limiter on bridge signing and intent signing endpoints (separate from global 100 RPM). - Add body size limit (1MB), read/write timeouts, and 10 RPM rate limiter to internal MPC API server. - Restrict K8s NetworkPolicy egress for MPC nodes to peers, postgres, valkey, DNS, and HTTPS only (was unrestricted). - Wire cluster-api-key in api-deployment for authenticated proxy to internal MPC API. Forward as Authorization: Bearer header. - Remove hardcoded dev JWT_SECRET default from compose.yml (now required). - Add internal-api-key to KMSSecret CRD and StatefulSet env.
81 lines
2.1 KiB
YAML
81 lines
2.1 KiB
YAML
# Minimal local development stack.
|
|
# SQLite is the default storage — no external DB required to start.
|
|
# For production, uncomment postgres and valkey below.
|
|
|
|
services:
|
|
api:
|
|
image: ghcr.io/luxfi/mpc-api:latest
|
|
command: >
|
|
start --mode consensus
|
|
--api-listen :8081
|
|
--data /data/mpc
|
|
--jwt-secret ${JWT_SECRET:?JWT_SECRET must be set}
|
|
ports:
|
|
- "8081:8081"
|
|
environment:
|
|
- JWT_SECRET=${JWT_SECRET:?JWT_SECRET must be set}
|
|
volumes:
|
|
- mpc-data:/data/mpc
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-q", "--spider", "http://localhost:8081/healthz"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
dashboard:
|
|
image: ghcr.io/luxfi/mpc-dashboard:latest
|
|
ports:
|
|
- "3000:3000"
|
|
environment:
|
|
- NEXT_PUBLIC_API_URL=http://localhost:8081/v1
|
|
depends_on:
|
|
api:
|
|
condition: service_healthy
|
|
|
|
## Production: uncomment to use PostgreSQL instead of SQLite.
|
|
# postgres:
|
|
# image: ghcr.io/hanzoai/sql:latest
|
|
# environment:
|
|
# POSTGRES_DB: mpc_api
|
|
# POSTGRES_USER: mpc
|
|
# POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
# volumes:
|
|
# - pgdata:/var/lib/postgresql/data
|
|
# ports:
|
|
# - "5432:5432"
|
|
# healthcheck:
|
|
# test: ["CMD-SHELL", "pg_isready -U mpc -d mpc_api"]
|
|
# interval: 5s
|
|
# timeout: 3s
|
|
# retries: 5
|
|
|
|
## Production: uncomment to enable Valkey KV cache.
|
|
# valkey:
|
|
# image: valkey/valkey:8-alpine
|
|
# ports:
|
|
# - "6379:6379"
|
|
# healthcheck:
|
|
# test: ["CMD", "valkey-cli", "ping"]
|
|
# interval: 5s
|
|
# timeout: 3s
|
|
# retries: 5
|
|
|
|
## When using postgres+valkey, change api command to:
|
|
# api:
|
|
# command: >
|
|
# start --mode consensus
|
|
# --api-db postgres://mpc:${POSTGRES_PASSWORD}@postgres:5432/mpc_api?sslmode=disable
|
|
# --api-kv valkey:6379
|
|
# --api-listen :8081
|
|
# --data /data/mpc
|
|
# --jwt-secret ${JWT_SECRET}
|
|
# depends_on:
|
|
# postgres:
|
|
# condition: service_healthy
|
|
# valkey:
|
|
# condition: service_healthy
|
|
|
|
volumes:
|
|
mpc-data:
|
|
# pgdata: # uncomment for production postgres
|