merge main

Author: xDarksome

VERSION

@@ -1 +1 @@
-251104.4
+251107.0

flake.nix

@@ -32,7 +32,6 @@
           clang
           libclang
           gcc13 # jemalloc fails to build on gcc14 (in debug builds)
-          rocksdb
         ];
         rustc = {
           stable = fenixPackages.stable.rustc;
@@ -43,12 +42,17 @@
           nightly = fenixPackages.minimal.cargo;
         };
         rust-std = {
-          stable = fenixPackages.stable.rust-std;
+          stable = fenixPackages.targets.${muslTarget}.stable.rust-std;
+          # stable = fenixPackages.stable.rust-std;
           nightly = fenixPackages.minimal.rust-std;
         };
         rust-src = fenixPackages.stable.rust-src;
         rustfmt = fenixPackages.default.rustfmt;
         clippy = fenixPackages.default.clippy;
+
+        muslTarget = "x86_64-unknown-linux-musl";
+        pkgsStatic = pkgs.pkgsStatic;
+        cross = pkgs.pkgsCross.musl64;
       in
       {
         devShells.default = pkgs.mkShell {
@@ -59,11 +63,7 @@
 
           # Use the dyn library for local development to improve build times.
           # Name of this var is defined here https://github.com/rust-rocksdb/rust-rocksdb/blob/master/librocksdb-sys/build.rs 
-          ROCKSDB_LIB_DIR = "${pkgs.rocksdb}/lib";
-
-          NIX_LDFLAGS = "${pkgs.lib.optionalString pkgs.stdenv.isDarwin "\
-            -F${pkgs.darwin.apple_sdk.frameworks.Security}/Library/Frameworks -framework Security \
-            -F${pkgs.darwin.apple_sdk.frameworks.CoreFoundation}/Library/Frameworks -framework CoreFoundation"}";
+          # ROCKSDB_LIB_DIR = "${pkgs.rocksdb}/lib";
 
           buildInputs = with pkgs; [
             (fenixPackages.combine [ cargo.stable rustc.stable rust-std.stable rust-src rustfmt ])

infra/modules/node-operator/main.tf

@@ -1,7 +1,7 @@
 variable "config" {
   type = object({
     name    = string
-    peer_id = string
+    secrets_file_path = string
 
     db = object({
       ec2_instance_type = string
@@ -15,17 +15,19 @@ variable "config" {
   })
 }
 
-variable "secrets" {
-  type = object({
-    ed25519_secret_key = string
-  })
-  sensitive = true
-  ephemeral = true
+data "aws_region" "current" {}
+
+ephemeral "sops_file" "secrets" {
+  source_file = var.config.secrets_file_path
 }
 
 locals {
   region = data.aws_region.current.name
 
+  # We store encrypted secrets as a `local` to be able to derive secret versions.
+  # The decrypted secrets are not being stored in the TF state.
+  secrets_encrypted = yamldecode(file(var.config.secrets_file_path))
+
   db = {
     primary_rpc_server_port   = 3000
     secondary_rpc_server_port = 3001
@@ -42,8 +44,6 @@ resource "aws_ssm_parameter" "ed25519_secret_key" {
   value_wo_version = parseint(substr(local.ed25519_secret_key_hash, 0, 8), 16)
 }
 
-data "aws_region" "current" {}
-
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
   version = "~> 6.5"

infra/testnet/main.tf

@@ -16,35 +16,11 @@ provider "aws" {
   region = "eu-central-1"
 }
 
-provider "aws" {
-  region = "eu-central-1"
-  alias  = "eu"
-}
-
-provider "aws" {
-  region = "us-east-1"
-  alias  = "us"
-}
-
-provider "aws" {
-  region = "ap-southeast-1"
-  alias  = "ap"
-}
-
-provider "aws" {
-  region = "sa-east-1"
-  alias  = "sa"
-}
-
 module "sops-encryption-key" {
   source = "../modules/sops-encryption-key"
 }
 
-ephemeral "sops_file" "secrets" {
-  source_file = "secrets.yaml"
-}
-
-locals {
+locals {  
   db_config = {
     # 2 vCPU / 4 GiB RAM, x86_64
     ec2_instance_type = "c5a.large"
@@ -56,18 +32,24 @@ locals {
     # 512 MiB are system reserved
     ecs_task_memory = 4096 - 512
   }
+
+  eu_operators = {
+    wallet-connect-1 = {
+      db = local.db_config
+    }
+  }
 }
 
-module "eu-central-1-node-operator-1" {
+module "eu-central-1" {
   source = "../modules/node-operator"
+  for_each = local.operators
 
   config = {
-    name    = "wallet-connect-1"
-    peer_id = "12D3KooWKpZ7ch5k4ggZHAKKMmu1oNnBxM5u1VZpGiopPZQmrLHT"
-    db      = local.db_config
-  }
+    name    = each.key
+    secrets_file_path = "${path.module}/secrets/${each.key}.sops.yaml"
 
-  secrets = jsondecode(ephemeral.sops_file.secrets.raw)["operators"][0]
+    db      = each.value.db
+  }
 
   providers = {
     aws = aws.eu

infra/testnet/secrets.yaml

@@ -0,0 +1,12 @@
+peer_id_unencrypted: 12D3KooWKpZ7ch5k4ggZHAKKMmu1oNnBxM5u1VZpGiopPZQmrLHT
+ed25519_secret_key: ENC[AES256_GCM,data:j2RNFK2yWv1AimnV3jZobiI+DBA2lHnZA6yoVjXGn8JwXqutrL0I1qXjey4=,iv:+u3u55knUOIJnkcU/pfaTfY3BZIwKVzR4fS6h/eV5zw=,tag:3Y/cVAce/0HIsFHriSVuBg==,type:str]
+sops:
+    kms:
+        - arn: arn:aws:kms:eu-central-1:260477932319:key/mrk-b1e6810605c34402bb2db341187cf7ca
+          created_at: "2025-10-30T15:42:01Z"
+          enc: AQICAHi53voGJIbw5xN5Sxqidj47CKY1C6uMBW6lXoaYu7F5swHBeyxAvQLSGDnWMNCtAfbgAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM3b4RwtqWcbgqKIEeAgEQgDthHzqxt6ODHnzE7B4XGXRmKgTDxrqHRkkYpiOhD6jg9Y8SSDMqn0LN0dgxVhV7N6uWJZ4iR+C0rkNfJw==
+          aws_profile: ""
+    lastmodified: "2025-11-04T15:10:13Z"
+    mac: ENC[AES256_GCM,data:YE1yjHNTmUZbyVmth7MFdsi/sqFotVACCRsowR1+dBbJWRgijPpp0ouH386KgivJ1hCBFSTAYgtkisYHNkvFlR7cYPw9NcfE19GLL67q/o5nTpEhCwPe2YsntySLCXiPqH0EMuI8QqC9KM99kvlFTLepdG9mvIkUSjiHiF5aiVM=,iv:QB2k/+hZJ8AWr6nJigzybqR0XmkmZ2FYD8HhpI3ZD18=,tag:/fy/71/y9uNufCjmT1FYIQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2