zeekayandHanzo AI
2453240bd7
Universe CI / Resolve Environment (push) Waiting to run
Universe CI / Update Manifest (push) Blocked by required conditions
Universe CI / E2E (push) Blocked by required conditions
CI/CD / render (push) Waiting to run
The primary-network chains answer to either case; one spelling beats two. /v1/chain/c/rpc, /v1/chain/p, /v1/chain/x across the estate. Co-authored-by: Hanzo AI <[email protected]>
78 lines
5.7 KiB
YAML
78 lines
5.7 KiB
YAML
# Captured from live do-sfo3-zoo-k8s (zoo-system/zoo-dynamic) — the Traefik file
|
|
# provider that actually serves every zoo.network / zoo.ngo host. The Ingress in
|
|
# k8s/zoo-kms/ingress.yaml was never applied; this is the real routing plane.
|
|
#
|
|
# kms-block-console denies everything that is not /v1, via an ipAllowList on
|
|
# TEST-NET-1 (RFC5737, never routable) so nothing matches and Traefik returns 403.
|
|
# One middleware, applied to both offenders:
|
|
#
|
|
# kms-zoo-console-block kms.zoo.network published the KMS admin console with
|
|
# no middleware at all. The cutover that moved this host
|
|
# to the zoo cluster left the guard behind (the hanzo
|
|
# side route carried kms-admin-guard, a forwardAuth).
|
|
#
|
|
# mpc-zoo-console-block mpc.zoo.network published the same Base admin console,
|
|
# which also shipped a Hanzo analytics beacon
|
|
# (analytics.hanzo.ai/script.js) — a Zoo surface
|
|
# reporting into a Hanzo property, and the retired
|
|
# direct script tag besides. Blocking the console kills
|
|
# the beacon at the edge. mpc-api-svc had ZERO in
|
|
# cluster consumers and node to node traffic uses the
|
|
# headless service, so nothing is stranded.
|
|
#
|
|
# Both images serve /api/* and 307 everything under /v1, which is backwards. The
|
|
# rule is /v1 everywhere, never /api. The block makes that violation visible
|
|
# instead of silently serving the wrong surface.
|
|
apiVersion: v1
|
|
data:
|
|
routes.yaml: "http:\n middlewares:\n zood-root:\n replacePathRegex:\n \
|
|
\ regex: ^/$\n replacement: /v1/chain/c/rpc\n kms-block-console:\n\
|
|
\ ipAllowList:\n sourceRange:\n - 192.0.2.0/32\n routers:\n\
|
|
\ rpc-zoo:\n entryPoints:\n - websecure\n rule: Host(`rpc.zoo.network`)\n\
|
|
\ service: rpc-zoo\n tls: {}\n zoo-bridge:\n entryPoints:\n\
|
|
\ - websecure\n rule: Host(`bridge.zoo.network`)\n service: zoo-bridge\n\
|
|
\ tls:\n certResolver: letsencrypt\n api-zoo-ngo:\n entryPoints:\n\
|
|
\ - websecure\n rule: Host(`api.zoo.ngo`)\n service: rpc-zoo\n\
|
|
\ middlewares:\n - zood-root\n tls:\n certResolver: letsencrypt\n\
|
|
\ explore-zoo-ngo:\n entryPoints:\n - websecure\n rule: Host(`explore.zoo.ngo`)\n\
|
|
\ service: zoo-explorer-ngo\n tls:\n certResolver: letsencrypt\n\
|
|
\ api-zoo-network:\n entryPoints:\n - websecure\n rule: Host(`api.zoo.network`)\n\
|
|
\ service: rpc-zoo\n middlewares:\n - zood-root\n tls:\n \
|
|
\ certResolver: letsencrypt\n api-zoo-test-network:\n entryPoints:\n\
|
|
\ - websecure\n rule: Host(`api.zoo-test.network`)\n service: rpc-zoo-test\n\
|
|
\ middlewares:\n - zood-root\n tls:\n certResolver: letsencrypt\n\
|
|
\ kms-zoo:\n entryPoints: &id001\n - websecure\n rule: Host(`kms.zoo.network`)\n\
|
|
\ service: kms-zoo\n tls: &id002\n certResolver: letsencrypt\n\
|
|
\ mpc-zoo:\n entryPoints: &id003\n - websecure\n rule: Host(`mpc.zoo.network`)\n\
|
|
\ service: mpc-zoo\n tls: &id004\n certResolver: letsencrypt\n\
|
|
\ work-zoo-network:\n entryPoints:\n - websecure\n rule: Host(`work.zoo.network`)\n\
|
|
\ service: work-board\n tls:\n certResolver: letsencrypt\n \
|
|
\ bounty-bot-webhook:\n entryPoints:\n - websecure\n rule: Host(`bounties.zoo.network`)\
|
|
\ && PathPrefix(`/v1/github/`)\n service: bounty-bot\n tls:\n \
|
|
\ certResolver: letsencrypt\n kms-zoo-console-block:\n entryPoints: *id001\n\
|
|
\ rule: Host(`kms.zoo.network`) && !PathPrefix(`/v1`)\n priority: 200\n\
|
|
\ service: kms-zoo\n middlewares:\n - kms-block-console\n \
|
|
\ tls: *id002\n mpc-zoo-console-block:\n entryPoints: *id003\n rule:\
|
|
\ Host(`mpc.zoo.network`) && !PathPrefix(`/v1`)\n priority: 200\n service:\
|
|
\ mpc-zoo\n middlewares:\n - kms-block-console\n tls: *id004\n\
|
|
\ services:\n rpc-zoo:\n loadBalancer:\n passHostHeader: true\n\
|
|
\ servers:\n - url: http://zood-mv.zoo-mainnet.svc.cluster.local:9630\n\
|
|
\ rpc-zoo-test:\n loadBalancer:\n passHostHeader: true\n \
|
|
\ servers:\n - url: http://zood-testnet.zoo-mainnet.svc.cluster.local:9630\n\
|
|
\ zoo-bridge:\n loadBalancer:\n passHostHeader: true\n servers:\n\
|
|
\ - url: http://zoo-bridge.zoo-mainnet.svc.cluster.local:3000\n zoo-explorer-ngo:\n\
|
|
\ loadBalancer:\n passHostHeader: true\n servers:\n \
|
|
\ - url: http://zoo-explorer.zoo-mainnet.svc.cluster.local:8090\n kms-zoo:\n\
|
|
\ loadBalancer:\n passHostHeader: true\n servers:\n \
|
|
\ - url: http://kms.zoo-kms.svc.cluster.local:80\n mpc-zoo:\n loadBalancer:\n\
|
|
\ passHostHeader: true\n servers:\n - url: http://mpc-api-svc.zoo-mpc.svc.cluster.local:8081\n\
|
|
\ work-board:\n loadBalancer:\n passHostHeader: true\n servers:\n\
|
|
\ - url: http://work-board.zoo-mainnet.svc.cluster.local:80\n bounty-bot:\n\
|
|
\ loadBalancer:\n passHostHeader: true\n servers:\n \
|
|
\ - url: http://bounty-bot.zoo-mainnet.svc.cluster.local:80\ntls:\n certificates:\n\
|
|
\ - certFile: /certs/rpc-zoo/tls.crt\n keyFile: /certs/rpc-zoo/tls.key\n"
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: zoo-dynamic
|
|
namespace: zoo-system
|