mirror of
https://github.com/luxfi/node.git
synced 2026-10-30 15:24:05 +00:00
zeekay
7cf87b230b
The module already called itself github.com/luxfi/node while containing no node in Go: cmd/luxd was twenty-one lines that printed the size of a few types, and the Go column of the matrix measured a VM plugin. A repo that fetches the thing it claims to be has not replaced it, so the Go sources move in — 1515 files, the daemon and everything under it — and the build reaches outside this module for nothing. Rust and C++ sit beside it unchanged and are still measured against it by the differential. That is the point of one repo: the reference implementation and the two ports are the same checkout, so parity is a thing you can run rather than a thing you assert. Verified: builds, and the closure carries no lux-private — checked at build time rather than believed. The daemon starts twelve chains on a local network (P X C Q Z A B G K M F, plus D through its plugin) and reports healthy.
106 lines
3.2 KiB
Go
106 lines
3.2 KiB
Go
// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
|
|
// See the file LICENSE for licensing terms.
|
|
|
|
// Package staking includes a thin HTTP client to the external Lux KMS
|
|
// service (~/work/lux/kms, github.com/luxfi/kms). The KMS service speaks
|
|
// JSON over HTTP as its public contract — this file therefore stays on
|
|
// json/v2 by design. Do NOT migrate to ZAP: the wire format here is
|
|
// defined by the external service, not by us. Internal Lux paths that
|
|
// consume the keys MUST hash or copy the result into typed Go values
|
|
// before any internal codec.
|
|
//
|
|
// Not to be confused with Hanzo KMS (~/work/hanzo/kms) which serves
|
|
// Hanzoai apps — Lux blockchain node staking uses Lux KMS only.
|
|
package staking
|
|
|
|
import (
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"os"
|
|
"time"
|
|
|
|
// json/v2 is intentional: KMS HTTP RPC contract is JSON.
|
|
"github.com/go-json-experiment/json"
|
|
)
|
|
|
|
// KMSConfig for staking key retrieval
|
|
type KMSConfig struct {
|
|
Endpoint string // KMS API endpoint (e.g., https://kms.dev.lux.network)
|
|
SecretPath string // Path to the staking secret (e.g., /staking/devnet/node-0)
|
|
AuthToken string // Bearer token for KMS auth
|
|
}
|
|
|
|
// KMSStakingKeys holds the staking key material from KMS
|
|
type KMSStakingKeys struct {
|
|
TLSKey string `json:"tls_key"` // PEM-encoded TLS private key
|
|
TLSCert string `json:"tls_cert"` // PEM-encoded TLS certificate
|
|
SignerKey string `json:"signer_key"` // BLS signer key (hex-encoded)
|
|
}
|
|
|
|
// FetchFromKMS retrieves staking keys from a KMS endpoint.
|
|
func FetchFromKMS(cfg KMSConfig) (*KMSStakingKeys, error) {
|
|
if cfg.Endpoint == "" {
|
|
return nil, fmt.Errorf("KMS endpoint must not be empty")
|
|
}
|
|
if cfg.SecretPath == "" {
|
|
return nil, fmt.Errorf("KMS secret path must not be empty")
|
|
}
|
|
|
|
url := fmt.Sprintf("%s/api/v1/secrets%s", cfg.Endpoint, cfg.SecretPath)
|
|
|
|
client := &http.Client{Timeout: 30 * time.Second}
|
|
req, err := http.NewRequest("GET", url, nil)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("creating KMS request: %w", err)
|
|
}
|
|
|
|
if cfg.AuthToken != "" {
|
|
req.Header.Set("Authorization", "Bearer "+cfg.AuthToken)
|
|
}
|
|
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("KMS request failed: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode != http.StatusOK {
|
|
body, _ := io.ReadAll(resp.Body)
|
|
return nil, fmt.Errorf("KMS returned %d: %s", resp.StatusCode, string(body))
|
|
}
|
|
|
|
var result struct {
|
|
Secret struct {
|
|
Value string `json:"secretValue"`
|
|
} `json:"secret"`
|
|
}
|
|
if err := json.UnmarshalRead(resp.Body, &result); err != nil {
|
|
return nil, fmt.Errorf("decoding KMS response: %w", err)
|
|
}
|
|
|
|
var keys KMSStakingKeys
|
|
if err := json.Unmarshal([]byte(result.Secret.Value), &keys); err != nil {
|
|
return nil, fmt.Errorf("parsing staking keys from KMS: %w", err)
|
|
}
|
|
|
|
return &keys, nil
|
|
}
|
|
|
|
// FetchFromKMSEnv reads KMS config from environment variables and fetches staking keys.
|
|
func FetchFromKMSEnv() (*KMSStakingKeys, error) {
|
|
endpoint := os.Getenv("KMS_ENDPOINT")
|
|
secretPath := os.Getenv("KMS_STAKING_PATH")
|
|
authToken := os.Getenv("KMS_TOKEN")
|
|
|
|
if endpoint == "" || secretPath == "" {
|
|
return nil, fmt.Errorf("KMS_ENDPOINT and KMS_STAKING_PATH must be set")
|
|
}
|
|
|
|
return FetchFromKMS(KMSConfig{
|
|
Endpoint: endpoint,
|
|
SecretPath: secretPath,
|
|
AuthToken: authToken,
|
|
})
|
|
}
|