feat(infra): testnet

.sops.yaml

@@ -0,0 +1,3 @@
+creation_rules:
+    - path_regex: ^infra/testnet/
+      kms: arn:aws:kms:eu-central-1:260477932319:key/mrk-b1e6810605c34402bb2db341187cf7ca 

env.sh

@@ -0,0 +1,12 @@
+secrets=$(sops -d $1)
+
+smart_contract_address=$(echo $secrets | jq -r '.["smart_contract_address_unencrypted"]')
+smart_contract_encryption_key=$(echo $secrets | jq -r '.["smart_contract_encryption_key"]')
+ecdsa_private_key=$(echo $secrets | jq -r '.["ecdsa_private_key"]')
+rpc_provider_url=$(echo $secrets | jq -r '.["rpc_provider_url"]')
+
+export WCN_CLUSTER_SMART_CONTRACT_ADDRESS=$smart_contract_address
+export WCN_CLUSTER_SMART_CONTRACT_ENCRYPTION_KEY=$smart_contract_encryption_key
+export WCN_CLUSTER_SMART_CONTRACT_OWNER_PRIVATE_KEY=$ecdsa_private_key
+export WCN_NODE_OPERATOR_PRIVATE_KEY=$ecdsa_private_key
+export OPTIMISM_RPC_PROVIDER_URL=$rpc_provider_url

flake.nix

@@ -74,23 +74,26 @@
               text = ''cargo "$@"'';
             })
 
+            (writeShellApplication {
+              name = "nu-env";
+              text = ''
+                # shellcheck disable=SC1091
+                . ./env.sh "$1"
+                exec nu
+              '';
+            })
+
             fenixPackages.rust-analyzer
             cargo-udeps
             docker-compose
 
             solc
             foundry
-          ];
 
-          shellHook = ''
-            alias ga="$(which git) add"
-            alias gst="$(which git) status"
-            alias gc="$(which git) commit"
-            alias gco="$(which git) checkout -b"
-            alias glog="$(which git) log"
-            alias lsa="ls -lah"
-            alias prettyup="cargo fmt --all && cargo clippy --all-features --fix --allow-dirty"
-          '';
+            terraform
+            sops
+            jq
+          ];
         };
       }
     );

infra/modules/https-gateway/main.tf

@@ -0,0 +1,62 @@
+variable "service" {
+  type = object({
+    name = string
+    ip   = string
+    port = number
+  })
+}
+
+variable "vpc" {
+  type = object({
+    vpc_id         = string
+    public_subnets = list(string)
+  })
+}
+
+variable "certificate_arn" {
+  type = string
+}
+
+locals {
+  name = "${var.service.name}-https-gw"
+}
+
+resource "aws_lb" "this" {
+  name               = local.name
+  internal           = false
+  load_balancer_type = "network"
+  subnets            = var.vpc.public_subnets
+
+  enable_deletion_protection = false
+}
+
+resource "aws_lb_target_group" "this" {
+  name        = var.service.name
+  port        = var.service.port
+  protocol    = "TCP"
+  vpc_id      = var.vpc.vpc_id
+  target_type = "ip"
+}
+
+resource "aws_lb_target_group_attachment" "this" {
+  target_group_arn = aws_lb_target_group.this.arn
+  target_id        = var.service.ip
+  port             = var.service.port
+}
+
+resource "aws_lb_listener" "https" {
+  load_balancer_arn = aws_lb.this.arn
+  port              = 443
+  protocol          = "TLS"
+  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09"
+  certificate_arn   = var.certificate_arn
+
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.this.arn
+  }
+}
+
+output "lb" {
+  value = aws_lb.this
+}