diff --git a/apps/simplex-store-service/README.md b/apps/simplex-store-service/README.md index f222afaf66..c898a68b70 100644 --- a/apps/simplex-store-service/README.md +++ b/apps/simplex-store-service/README.md @@ -353,8 +353,9 @@ they refuse what it signs — never turn it on where the key is one those apps t `scripts/store-service/` holds the production deployment: the image (`Dockerfile`, built from the repository root), `compose.yml`, the ini template `store_service.ini.example` and the egress -rule `egress.sh`. The service runs with `+client_postgres` and host networking; one Caddy serves -both sites from the folders the service exports at boot and proxies the API to it. +rule `ops/egress.sh`; `dev/` holds the scripts of the dev setup and the webapp's cases. The service +runs with `+client_postgres` and host networking; one Caddy serves both sites from the folders the +service exports at boot and proxies the API to it. `compose.yml` mounts the folder `scripts/store-service/config/` read-only at `/etc/simplex-store-service`. It holds `store_service.ini`, and the App Store root and the Play @@ -459,7 +460,7 @@ On its first start, the chain writes `config/store_service.ini` for its deployme exists; it never rewrites it, so edits there are kept. The file serves both sites all in one, with `[names]` on the `.simplex` TLD, `[chain]` at the local chain with 1 confirmation, and `[issuer]` signing with a public test key at index 999, which no client trusts, through `dev_keys`. That key is -in `dev-chain.sh`, as public as anvil's: never use it elsewhere. The service starts once the chain +in `dev/chain.sh`, as public as anvil's: never use it elsewhere. The service starts once the chain and the database are healthy. `USER_UID` and `USER_GID` in `.env` (by default 1000) own the file, mode 600, and its folder, mode 700. @@ -479,7 +480,7 @@ The service key's account starts with 10,000 ETH and a sponsor allowance. To top account's balance: ``` -docker compose exec chain dev-chain.sh topup [address] [eth] +docker compose exec chain chain.sh topup [address] [eth] ``` Registrations wait 10 seconds after their commit (`MIN_COMMITMENT_AGE` in `compose.dev.yml`). @@ -608,7 +609,7 @@ BTCPay (`[btcpay] host`), the database and the DNS resolvers in `/etc/resolv.con connections already open, such as Caddy's requests, pass, and so does IPv6 neighbour discovery on the link. -`egress.sh` writes this as the chain `STORE_SERVICE_EGRESS` in `iptables` and `ip6tables`, and +`ops/egress.sh` writes this as the chain `STORE_SERVICE_EGRESS` in `iptables` and `ip6tables`, and rebuilds it on every run. With compose's host networking it matches the service's user in `OUTPUT` (`-m owner --uid-owner`). That rule covers every process of that user on the host, so the service must run as a dedicated user. `--uid` is required, and the script refuses a uid whose @@ -646,9 +647,9 @@ the environment's `BADGE_DB_CONN`, else to compose's default when compose runs with another value: ``` -sudo ./egress.sh --dry-run --uid 998 -sudo ./egress.sh --uid 998 -sudo ./egress.sh --check --uid 998 +sudo ops/egress.sh --dry-run --uid 998 +sudo ops/egress.sh --uid 998 +sudo ops/egress.sh --check --uid 998 ``` - `--dry-run` prints the `iptables-restore` input an install would commit, read against the @@ -704,7 +705,7 @@ docker compose exec store-service bash -c ': /443' - `allowed` is printed for the database. With the RPC node on this host, the same command with its port (`8545` for a local reth) prints it too. -`sudo ./egress.sh --remove --uid 998` (or `--bridge `) deletes the jumps an install +`sudo ops/egress.sh --remove --uid 998` (or `--bridge `) deletes the jumps an install adds for that user or network, then the chain, in `iptables` and `ip6tables`. Running it again changes nothing, and `--check` then reports the chain absent. @@ -1189,7 +1190,7 @@ Your names; a later late payment credits it again, and a second refund adds to ` ## Running the webapp's cases against the service -`scripts/store-service/names-contract-run.sh` runs the names webapp's end-to-end cases that need no +`scripts/store-service/dev/contract-run.sh` runs the names webapp's end-to-end cases that need no payment against this service in Chromium, as they run against the webapp's mock. It: 1. starts anvil on 8545 and deploys the contracts with the webapp's `dev/deploy.ts`, with a commitment @@ -1224,7 +1225,7 @@ the service or the code server exits before it answers. ``` cabal build exe:simplex-store-service -ENS_CONTRACTS_DIR= ANVIL= scripts/store-service/names-contract-run.sh +ENS_CONTRACTS_DIR= ANVIL= scripts/store-service/dev/contract-run.sh ``` - `WEBAPP_DIR`: the names webapp (default: the `apps/simplex-domains` submodule's `webapp/`). diff --git a/scripts/store-service/README.md b/scripts/store-service/README.md new file mode 100644 index 0000000000..ddaa3cd532 --- /dev/null +++ b/scripts/store-service/README.md @@ -0,0 +1,33 @@ +# Store service deployment + +- `compose.yml`: the service, built from `Dockerfile`, with `./config` mounted read-only. +- `compose.dev.yml`: adds a local chain and database to `compose.yml`, for development. +- `Dockerfile`, `Dockerfile.dockerignore`: the image, built from the repository root. +- `store_service.ini.example`: the template of `config/store_service.ini`. +- `dev/chain.sh`: the dev chain, which also writes the dev `config/store_service.ini`. +- `dev/contract-run.sh`: runs the names webapp's end-to-end cases against the service. +- `ops/egress.sh`: the egress rule of a production host. +- `config/`, `badges/`, `names/`, `data/`, `.env`: local state, gitignored. + +Production, with PostgreSQL at `BADGE_DB_CONN` (by default +`postgresql://simplex@127.0.0.1:5432/badge_service`), and the ini filled in before the last command: + +``` +install -d -m 700 config +install -m 600 store_service.ini.example config/store_service.ini +docker compose up -d --build +``` + +Development, from a fresh clone: + +``` +git clone https://github.com/simplex-chat/simplex-chat && cd simplex-chat +git checkout sh/store-service && git submodule update --init apps/simplex-domains +cd scripts/store-service +echo "COMPOSE_FILE=compose.yml:compose.dev.yml" > .env +docker compose up -d --build +``` + +The names site is then on `http://127.0.0.1:8081`, the badges site on `http://127.0.0.1:8080`. + +Everything else is in [apps/simplex-store-service/README.md](../../apps/simplex-store-service/README.md#deployment). diff --git a/scripts/store-service/compose.dev.yml b/scripts/store-service/compose.dev.yml index 88352e1eb8..cdf59f5896 100644 --- a/scripts/store-service/compose.dev.yml +++ b/scripts/store-service/compose.dev.yml @@ -21,8 +21,8 @@ services: volumes: - ./data/chain:/chain - ./config:/config - - ./dev-chain.sh:/usr/local/bin/dev-chain.sh:ro - command: dev-chain.sh + - ./dev/chain.sh:/usr/local/bin/chain.sh:ro + command: chain.sh healthcheck: test: ["CMD", "test", "-f", "/chain/ready"] interval: 5s diff --git a/scripts/store-service/dev-chain.sh b/scripts/store-service/dev/chain.sh similarity index 94% rename from scripts/store-service/dev-chain.sh rename to scripts/store-service/dev/chain.sh index 60ee46755f..e33a7c5d55 100755 --- a/scripts/store-service/dev-chain.sh +++ b/scripts/store-service/dev/chain.sh @@ -1,9 +1,9 @@ #!/bin/sh # The local chain of compose.dev.yml. Runs in the webapp's dev image, which has anvil, node, the deploy script and the # compiled contracts. -# dev-chain.sh anvil with its state kept in $CHAIN_DIR, the names contracts deployed on the first start, +# chain.sh anvil with its state kept in $CHAIN_DIR, the names contracts deployed on the first start, # and $CONFIG_DIR/store_service.ini written for them unless it exists -# dev-chain.sh topup [address] [eth] sets an account's balance, by default the service key's account to 10000 ETH +# chain.sh topup [address] [eth] sets an account's balance, by default the service key's account to 10000 ETH set -eu CHAIN_DIR="${CHAIN_DIR:-/chain}" @@ -70,7 +70,7 @@ write_config() { tmp="$CONFIG.tmp" rm -f "$tmp" (umask 077 && cat > "$tmp" <