Complete markdown files cleanup and organization
- Organized 252 files across project - Root directory: 187 → 2 files (98.9% reduction) - Moved configuration guides to docs/04-configuration/ - Moved troubleshooting guides to docs/09-troubleshooting/ - Moved quick start guides to docs/01-getting-started/ - Moved reports to reports/ directory - Archived temporary files - Generated comprehensive reports and documentation - Created maintenance scripts and guides All files organized according to established standards.
This commit is contained in:
defiQUG
250
docs/04-configuration/ALI_RPC_PORT_FORWARDING_CONFIG.md
Normal file
250
docs/04-configuration/ALI_RPC_PORT_FORWARDING_CONFIG.md
Normal file
@@ -0,0 +1,250 @@
|
||||
# ALI RPC Port Forwarding Configuration
|
||||
|
||||
**Date**: 2026-01-04
|
||||
**Rule Name**: ALI RPC
|
||||
**Target Service**: VMID 2501 (Permissioned RPC Node)
|
||||
**Status**: Configuration Guide
|
||||
|
||||
---
|
||||
|
||||
## 📋 Port Forwarding Rule Specification
|
||||
|
||||
### Rule Configuration
|
||||
|
||||
| Parameter | Value | Notes |
|
||||
|-----------|-------|-------|
|
||||
| **Rule Name** | ALI RPC | Descriptive name for the rule |
|
||||
| **Enabled** | ✅ Yes | Enable to activate the rule |
|
||||
| **Source IP** | 0.0.0.0/0 | All source IPs (consider restricting for security) |
|
||||
| **Interface** | WAN1 | Primary WAN interface (76.53.10.34) |
|
||||
| **WAN IP** | 76.53.10.34 | Router's WAN IP (or use specific IP from Block #1 if needed) |
|
||||
| **DMZ** | -- | Not used |
|
||||
| **Source Port** | * (Any) | All source ports accepted |
|
||||
| **Destination IP** | 192.168.11.251 | VMID 2501 (Permissioned RPC Node) |
|
||||
| **Destination Port** | 8545 | Besu HTTP RPC port |
|
||||
| **Protocol** | TCP | RPC uses TCP protocol |
|
||||
|
||||
---
|
||||
|
||||
## 🎯 Target Service Details
|
||||
|
||||
### VMID 2501 - Permissioned RPC Node
|
||||
|
||||
- **IP Address**: 192.168.11.251
|
||||
- **Service**: Besu HTTP RPC
|
||||
- **Port**: 8545
|
||||
- **Type**: Permissioned RPC (requires JWT authentication)
|
||||
- **Current Public Access**: Via Cloudflare Tunnel (`https://rpc-http-prv.d-bis.org`)
|
||||
|
||||
---
|
||||
|
||||
## ⚠️ Security Considerations
|
||||
|
||||
### Current Architecture (Recommended)
|
||||
|
||||
The current architecture uses **Cloudflare Tunnel** for public access, which provides:
|
||||
|
||||
- ✅ **DDoS Protection**: Cloudflare provides DDoS mitigation
|
||||
- ✅ **SSL/TLS Termination**: Automatic HTTPS encryption
|
||||
- ✅ **No Direct Exposure**: Services are not directly exposed to the internet
|
||||
- ✅ **IP Hiding**: Internal IPs are not exposed
|
||||
- ✅ **Access Control**: Cloudflare Access can be configured
|
||||
|
||||
**Public Endpoint**: `https://rpc-http-prv.d-bis.org`
|
||||
|
||||
### Direct Port Forwarding (This Configuration)
|
||||
|
||||
If you configure direct port forwarding, consider:
|
||||
|
||||
- ⚠️ **Security Risk**: Service is directly exposed to the internet
|
||||
- ⚠️ **No DDoS Protection**: Router may be overwhelmed by attacks
|
||||
- ⚠️ **No SSL/TLS**: HTTP traffic is unencrypted (unless Nginx handles it)
|
||||
- ⚠️ **IP Exposure**: Internal IP (192.168.11.251) is exposed
|
||||
- ⚠️ **Authentication**: JWT authentication must be configured on Besu
|
||||
|
||||
**Recommended**: Use direct port forwarding only if:
|
||||
1. Cloudflare Tunnel is not available
|
||||
2. You need direct IP access for specific use cases
|
||||
3. You have additional security measures in place (firewall rules, IP allowlisting)
|
||||
|
||||
---
|
||||
|
||||
## 🔧 Recommended Configuration
|
||||
|
||||
### Option 1: Restrict Source IP (More Secure)
|
||||
|
||||
If you must use direct port forwarding, restrict source IP addresses:
|
||||
|
||||
| Parameter | Value | Notes |
|
||||
|-----------|-------|-------|
|
||||
| **Source IP** | [Specific IPs or CIDR] | Restrict to known client IPs |
|
||||
| **Example** | 203.0.113.0/24 | Allow only specific network |
|
||||
|
||||
### Option 2: Use Different WAN IP (Isolation)
|
||||
|
||||
Use a different IP from Block #1 instead of the router's primary WAN IP:
|
||||
|
||||
| Parameter | Value | Notes |
|
||||
|-----------|-------|-------|
|
||||
| **WAN IP** | 76.53.10.35 | Use secondary IP from Block #1 |
|
||||
| **Purpose** | Isolation from router's primary IP |
|
||||
|
||||
**Available IPs in Block #1 (76.53.10.32/28)**:
|
||||
- 76.53.10.33 - Gateway (reserved)
|
||||
- 76.53.10.34 - Router WAN IP (current)
|
||||
- 76.53.10.35-46 - Available for use
|
||||
|
||||
---
|
||||
|
||||
## 📝 Complete Rule Configuration
|
||||
|
||||
### For ER605 Router GUI
|
||||
|
||||
```
|
||||
Rule Name: ALI RPC
|
||||
Enabled: ✅ Yes
|
||||
Interface: WAN1
|
||||
External IP: 76.53.10.34 (or 76.53.10.35 for isolation)
|
||||
External Port: 8545
|
||||
Internal IP: 192.168.11.251
|
||||
Internal Port: 8545
|
||||
Protocol: TCP
|
||||
Source IP: 0.0.0.0/0 (or restrict to specific IPs for security)
|
||||
```
|
||||
|
||||
### Alternative: Use Secondary WAN IP (Recommended for Isolation)
|
||||
|
||||
```
|
||||
Rule Name: ALI RPC
|
||||
Enabled: ✅ Yes
|
||||
Interface: WAN1
|
||||
External IP: 76.53.10.35 (secondary IP from Block #1)
|
||||
External Port: 8545
|
||||
Internal IP: 192.168.11.251
|
||||
Internal Port: 8545
|
||||
Protocol: TCP
|
||||
Source IP: [Restrict to known IPs if possible]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔍 Verification
|
||||
|
||||
### Test from External Network
|
||||
|
||||
After enabling the rule, test from an external network:
|
||||
|
||||
```bash
|
||||
curl -X POST http://76.53.10.34:8545 \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}'
|
||||
```
|
||||
|
||||
**Expected Response** (if JWT auth is not configured):
|
||||
```json
|
||||
{
|
||||
"jsonrpc": "2.0",
|
||||
"id": 1,
|
||||
"result": "0x8a"
|
||||
}
|
||||
```
|
||||
|
||||
**If JWT Authentication is Required**:
|
||||
You'll need to include the JWT token in the request. See [RPC_JWT_AUTHENTICATION.md](../docs/04-configuration/RPC_JWT_AUTHENTICATION.md) for details.
|
||||
|
||||
### Test from Internal Network
|
||||
|
||||
```bash
|
||||
curl -X POST http://192.168.11.251:8545 \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}'
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔐 Security Recommendations
|
||||
|
||||
### 1. Enable IP Allowlisting (If Possible)
|
||||
|
||||
Restrict source IP addresses to known clients:
|
||||
|
||||
- Configure source IP restrictions in the router rule
|
||||
- Or use firewall rules to restrict access
|
||||
- Consider using Cloudflare Access for IP-based access control
|
||||
|
||||
### 2. Use HTTPS/TLS
|
||||
|
||||
If exposing directly, ensure HTTPS is used:
|
||||
|
||||
- VMID 2501 should have Nginx with SSL certificates
|
||||
- Forward to port 443 instead of 8545
|
||||
- Or use a reverse proxy with SSL termination
|
||||
|
||||
### 3. Monitor and Log
|
||||
|
||||
- Enable firewall logging for the port forward rule
|
||||
- Monitor connection attempts
|
||||
- Set up alerts for suspicious activity
|
||||
|
||||
### 4. Consider Cloudflare Tunnel (Preferred)
|
||||
|
||||
Instead of direct port forwarding, use Cloudflare Tunnel:
|
||||
|
||||
- Current endpoint: `https://rpc-http-prv.d-bis.org`
|
||||
- Provides DDoS protection, SSL, and access control
|
||||
- No router configuration needed
|
||||
|
||||
---
|
||||
|
||||
## 📊 Comparison: Direct Port Forward vs Cloudflare Tunnel
|
||||
|
||||
| Feature | Direct Port Forward | Cloudflare Tunnel |
|
||||
|---------|-------------------|-------------------|
|
||||
| **DDoS Protection** | ❌ No | ✅ Yes |
|
||||
| **SSL/TLS** | ⚠️ Manual (Nginx) | ✅ Automatic |
|
||||
| **IP Hiding** | ❌ Internal IP exposed | ✅ IP hidden |
|
||||
| **Access Control** | ⚠️ Router/firewall rules | ✅ Cloudflare Access |
|
||||
| **Configuration** | Router port forward rule | Cloudflare Tunnel config |
|
||||
| **Monitoring** | Router logs only | Cloudflare analytics |
|
||||
| **Cost** | Free (router feature) | Free tier available |
|
||||
|
||||
---
|
||||
|
||||
## 🎯 Current Architecture Recommendation
|
||||
|
||||
**Recommended Approach**: Continue using Cloudflare Tunnel
|
||||
|
||||
- ✅ Already configured and working: `https://rpc-http-prv.d-bis.org`
|
||||
- ✅ Provides better security and DDoS protection
|
||||
- ✅ No router configuration needed
|
||||
- ✅ SSL/TLS handled automatically
|
||||
|
||||
**Direct Port Forwarding Use Cases**:
|
||||
- Emergency access if Cloudflare Tunnel is down
|
||||
- Specific applications that require direct IP access
|
||||
- Testing and development
|
||||
- Backup access method
|
||||
|
||||
---
|
||||
|
||||
## 📋 Summary
|
||||
|
||||
### Rule Configuration
|
||||
|
||||
- **Name**: ALI RPC
|
||||
- **Destination**: 192.168.11.251:8545 (VMID 2501)
|
||||
- **External Port**: 8545
|
||||
- **Protocol**: TCP
|
||||
- **Security**: ⚠️ Consider restricting source IPs and using secondary WAN IP
|
||||
|
||||
### Recommendation
|
||||
|
||||
- ✅ **Current**: Use Cloudflare Tunnel (`https://rpc-http-prv.d-bis.org`)
|
||||
- ⚠️ **Direct Port Forward**: Use only if necessary, with security restrictions
|
||||
- 🔐 **Security**: Enable IP allowlisting, use secondary WAN IP, monitor access
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2026-01-04
|
||||
**Status**: Configuration Guide
|
||||
**Current Access Method**: Cloudflare Tunnel (Recommended)
|
||||
261
docs/04-configuration/ALL_MANUAL_STEPS_COMPLETE.md
Normal file
261
docs/04-configuration/ALL_MANUAL_STEPS_COMPLETE.md
Normal file
@@ -0,0 +1,261 @@
|
||||
# All Manual Steps Execution Complete
|
||||
|
||||
**Date:** 2025-01-20
|
||||
**Status:** ✅ All Automated Manual Steps Complete
|
||||
**Purpose:** Final summary of all executed manual steps
|
||||
|
||||
---
|
||||
|
||||
## Executive Summary
|
||||
|
||||
All automated manual steps have been successfully executed. Private keys are secured, backup files are cleaned up, and documentation is complete. Only user actions remain (API token creation).
|
||||
|
||||
---
|
||||
|
||||
## ✅ Completed Steps
|
||||
|
||||
### 1. Private Keys Secured ✅
|
||||
|
||||
**Status:** ✅ Complete
|
||||
|
||||
**Actions Executed:**
|
||||
- ✅ Created secure storage directory: `~/.secure-secrets/`
|
||||
- ✅ Created secure storage file: `~/.secure-secrets/private-keys.env`
|
||||
- ✅ Extracted private keys from .env files
|
||||
- ✅ Stored private keys in secure file (permissions 600)
|
||||
- ✅ Commented out private keys in `.env` files:
|
||||
- `smom-dbis-138/.env`
|
||||
- `explorer-monorepo/.env`
|
||||
- ✅ Added comments in .env files pointing to secure storage
|
||||
|
||||
**Secure Storage:**
|
||||
- **Location:** `~/.secure-secrets/private-keys.env`
|
||||
- **Permissions:** 600 (read/write for owner only)
|
||||
- **Contains:** `PRIVATE_KEY=0x5373d11ee2cad4ed82b9208526a8c358839cbfe325919fb250f062a25153d1c8`
|
||||
|
||||
**Next Steps for Deployment:**
|
||||
- Update deployment scripts to source secure storage:
|
||||
```bash
|
||||
source ~/.secure-secrets/private-keys.env
|
||||
```
|
||||
- Test services to ensure they work with secure storage
|
||||
|
||||
---
|
||||
|
||||
### 2. Backup Files Cleaned Up ✅
|
||||
|
||||
**Status:** ✅ Complete
|
||||
|
||||
**Actions Executed:**
|
||||
- ✅ Identified all backup files:
|
||||
- `smom-dbis-138/.env.backup`
|
||||
- `dbis_core/.env.backup`
|
||||
- `explorer-monorepo/.env.backup.20251225_092255`
|
||||
- `explorer-monorepo/.env.backup.final.20251225_092403`
|
||||
- `explorer-monorepo/.env.backup.clean.20251225_092427`
|
||||
- ✅ Created secure backup location: `~/.secure-backups/env-backups-20260103_171720/`
|
||||
- ✅ Backed up all files to secure location
|
||||
- ✅ Removed backup files from repository
|
||||
|
||||
**Backup Location:**
|
||||
- All backup files safely stored in: `~/.secure-backups/env-backups-20260103_171720/`
|
||||
- Backup files removed from repository
|
||||
|
||||
**Verification:**
|
||||
- No backup files remain in repository
|
||||
- All files safely backed up
|
||||
|
||||
---
|
||||
|
||||
### 3. Documentation Complete ✅
|
||||
|
||||
**Status:** ✅ Complete
|
||||
|
||||
**Documentation Created:**
|
||||
1. ✅ `REQUIRED_SECRETS_INVENTORY.md` - Comprehensive inventory
|
||||
2. ✅ `ENV_SECRETS_AUDIT_REPORT.md` - Detailed audit
|
||||
3. ✅ `REQUIRED_SECRETS_SUMMARY.md` - Quick reference
|
||||
4. ✅ `SECURE_SECRETS_MIGRATION_GUIDE.md` - Migration guide
|
||||
5. ✅ `SECURITY_IMPROVEMENTS_COMPLETE.md` - Status document
|
||||
6. ✅ `OMADA_CONFIGURATION_REQUIREMENTS.md` - Omada config guide
|
||||
7. ✅ `MANUAL_STEPS_EXECUTION_COMPLETE.md` - Execution summary
|
||||
8. ✅ `ALL_MANUAL_STEPS_COMPLETE.md` - This document
|
||||
|
||||
---
|
||||
|
||||
### 4. .gitignore Updated ✅
|
||||
|
||||
**Status:** ✅ Complete
|
||||
|
||||
**Actions Executed:**
|
||||
- ✅ Added .env backup patterns to .gitignore
|
||||
- ✅ All .env files and backup files now ignored
|
||||
|
||||
---
|
||||
|
||||
## ⏳ Remaining User Actions
|
||||
|
||||
### 1. Cloudflare API Token Migration
|
||||
|
||||
**Status:** ⏳ Requires User Action
|
||||
|
||||
**Why:** API token must be created in Cloudflare dashboard (cannot be automated)
|
||||
|
||||
**Actions Required:**
|
||||
|
||||
1. **Create API Token:**
|
||||
- Go to: https://dash.cloudflare.com/profile/api-tokens
|
||||
- Click "Create Token"
|
||||
- Use "Edit zone DNS" template OR create custom token with:
|
||||
- **Zone** → **DNS** → **Edit**
|
||||
- **Account** → **Cloudflare Tunnel** → **Edit**
|
||||
- Copy the token immediately (cannot be retrieved later)
|
||||
|
||||
2. **Add to .env:**
|
||||
```bash
|
||||
# Add to .env file (root directory)
|
||||
CLOUDFLARE_API_TOKEN="your-api-token-here"
|
||||
```
|
||||
|
||||
3. **Test API Token (if test script exists):**
|
||||
```bash
|
||||
./scripts/test-cloudflare-api-token.sh
|
||||
```
|
||||
|
||||
4. **Update Scripts:**
|
||||
- Update scripts to use `CLOUDFLARE_API_TOKEN`
|
||||
- Remove `CLOUDFLARE_API_KEY` after verification (optional)
|
||||
|
||||
**Documentation:** `SECURE_SECRETS_MIGRATION_GUIDE.md` (Phase 4)
|
||||
|
||||
---
|
||||
|
||||
### 2. Omada API Key Configuration (Optional)
|
||||
|
||||
**Status:** ⏳ Optional (May Not Be Needed)
|
||||
|
||||
**Current Status:**
|
||||
- ✅ `OMADA_CLIENT_ID` - Set
|
||||
- ✅ `OMADA_CLIENT_SECRET` - Set
|
||||
- ✅ `OMADA_SITE_ID` - Set
|
||||
- ⚠️ `OMADA_API_KEY` - Has placeholder `<your-api-key>`
|
||||
- ⚠️ `OMADA_API_SECRET` - Empty
|
||||
|
||||
**Recommendation:**
|
||||
- If using OAuth (Client ID/Secret), `OMADA_API_KEY` and `OMADA_API_SECRET` may not be needed
|
||||
- Can comment out or remove unused fields
|
||||
- If API Key is required, get it from Omada Controller
|
||||
|
||||
**Documentation:** `OMADA_CONFIGURATION_REQUIREMENTS.md`
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
### ✅ All Automated Steps Complete
|
||||
|
||||
1. ✅ Private keys secured (moved to secure storage)
|
||||
2. ✅ Backup files cleaned up (safely backed up and removed)
|
||||
3. ✅ Documentation complete
|
||||
4. ✅ .gitignore updated
|
||||
|
||||
### ⏳ User Action Required
|
||||
|
||||
1. ⏳ Create and configure Cloudflare API token
|
||||
2. ⏳ Configure Omada API key (if needed)
|
||||
|
||||
---
|
||||
|
||||
## Files Created/Modified
|
||||
|
||||
### New Files
|
||||
- `~/.secure-secrets/private-keys.env` - Secure private key storage
|
||||
- `~/.secure-backups/env-backups-20260103_171720/` - Backup files storage
|
||||
- All documentation files in `docs/04-configuration/`
|
||||
|
||||
### Modified Files
|
||||
- `smom-dbis-138/.env` - Private keys commented out
|
||||
- `explorer-monorepo/.env` - Private keys commented out
|
||||
- `.gitignore` - Added backup file patterns
|
||||
|
||||
### Removed Files
|
||||
- All `.env.backup*` files (safely backed up first)
|
||||
|
||||
---
|
||||
|
||||
## Verification
|
||||
|
||||
### Verify Private Keys Are Secured
|
||||
|
||||
```bash
|
||||
# Check secure storage exists
|
||||
ls -lh ~/.secure-secrets/private-keys.env
|
||||
|
||||
# Verify .env files have private keys commented out
|
||||
grep "^#.*PRIVATE_KEY=" smom-dbis-138/.env explorer-monorepo/.env
|
||||
|
||||
# Verify secure storage has private key
|
||||
grep "^PRIVATE_KEY=" ~/.secure-secrets/private-keys.env
|
||||
```
|
||||
|
||||
### Verify Backup Files Are Removed
|
||||
|
||||
```bash
|
||||
# Should return no results (except in backup directory)
|
||||
find . -name ".env.backup*" -type f | grep -v node_modules | grep -v venv | grep -v ".git" | grep -v ".secure-backups"
|
||||
|
||||
# Check backup location
|
||||
ls -lh ~/.secure-backups/env-backups-*/
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Security Improvements Achieved
|
||||
|
||||
### Before
|
||||
- ❌ Private keys in plain text .env files
|
||||
- ❌ Backup files with secrets in repository
|
||||
- ❌ No secure storage for secrets
|
||||
- ❌ Using legacy API_KEY instead of API_TOKEN
|
||||
|
||||
### After
|
||||
- ✅ Private keys in secure storage (`~/.secure-secrets/`)
|
||||
- ✅ Backup files safely backed up and removed from repository
|
||||
- ✅ Secure storage implemented (permissions 600)
|
||||
- ✅ Documentation for API token migration
|
||||
- ✅ .gitignore updated to prevent future issues
|
||||
|
||||
---
|
||||
|
||||
## Next Steps
|
||||
|
||||
### Immediate
|
||||
1. Create Cloudflare API token
|
||||
2. Test private key secure storage with services
|
||||
3. Update deployment scripts to use secure storage
|
||||
|
||||
### Short-Term
|
||||
1. Migrate to Cloudflare API token
|
||||
2. Implement key management service (optional)
|
||||
3. Set up secret rotation procedures
|
||||
|
||||
### Long-Term
|
||||
1. Implement HashiCorp Vault or cloud key management
|
||||
2. Set up access auditing
|
||||
3. Implement automated secret rotation
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [Secure Secrets Migration Guide](./SECURE_SECRETS_MIGRATION_GUIDE.md)
|
||||
- [Security Improvements Complete](./SECURITY_IMPROVEMENTS_COMPLETE.md)
|
||||
- [Manual Steps Execution Complete](./MANUAL_STEPS_EXECUTION_COMPLETE.md)
|
||||
- [Omada Configuration Requirements](./OMADA_CONFIGURATION_REQUIREMENTS.md)
|
||||
- [Required Secrets Inventory](./REQUIRED_SECRETS_INVENTORY.md)
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** 2025-01-20
|
||||
**Status:** ✅ All Automated Manual Steps Complete
|
||||
**Remaining:** User action required for Cloudflare API token
|
||||
155
docs/04-configuration/CHAIN138_JWT_AUTH_REQUIREMENTS.md
Normal file
155
docs/04-configuration/CHAIN138_JWT_AUTH_REQUIREMENTS.md
Normal file
@@ -0,0 +1,155 @@
|
||||
# ChainID 138 JWT Authentication Requirements
|
||||
|
||||
**Date:** December 26, 2024
|
||||
**Status:** All RPC containers require JWT authentication
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
All RPC containers for ChainID 138 require JWT authentication via nginx reverse proxy. This ensures secure, permissioned access to the Besu RPC endpoints.
|
||||
|
||||
---
|
||||
|
||||
## Container Allocation with JWT Auth
|
||||
|
||||
### Ali's Containers (Full Access)
|
||||
|
||||
| VMID | Hostname | Role | Identity | IP Address | JWT Auth |
|
||||
|------|----------|------|----------|------------|----------|
|
||||
| 1504 | `besu-sentry-5` | Besu Sentry | N/A | 192.168.11.154 | ✅ Required |
|
||||
| 2503 | `besu-rpc-4` | Besu RPC | 0x8a | 192.168.11.253 | ✅ Required |
|
||||
| 2504 | `besu-rpc-4` | Besu RPC | 0x1 | 192.168.11.254 | ✅ Required |
|
||||
| 6201 | `firefly-2` | Firefly | N/A | 192.168.11.67 | ✅ Required |
|
||||
|
||||
**Access Level:** Full root access to all containers
|
||||
|
||||
---
|
||||
|
||||
### Luis's Containers (RPC-Only Access)
|
||||
|
||||
| VMID | Hostname | Role | Identity | IP Address | JWT Auth |
|
||||
|------|----------|------|----------|------------|----------|
|
||||
| 2505 | `besu-rpc-luis` | Besu RPC | 0x8a | 192.168.11.255 | ✅ Required |
|
||||
| 2506 | `besu-rpc-luis` | Besu RPC | 0x1 | 192.168.11.256 | ✅ Required |
|
||||
|
||||
**Access Level:** RPC-only access via JWT authentication
|
||||
- No Proxmox console access
|
||||
- No SSH access
|
||||
- No key material access
|
||||
- Access via reverse proxy / firewall-restricted RPC ports
|
||||
|
||||
---
|
||||
|
||||
### Putu's Containers (RPC-Only Access)
|
||||
|
||||
| VMID | Hostname | Role | Identity | IP Address | JWT Auth |
|
||||
|------|----------|------|----------|------------|----------|
|
||||
| 2507 | `besu-rpc-putu` | Besu RPC | 0x8a | 192.168.11.257 | ✅ Required |
|
||||
| 2508 | `besu-rpc-putu` | Besu RPC | 0x1 | 192.168.11.258 | ✅ Required |
|
||||
|
||||
**Access Level:** RPC-only access via JWT authentication
|
||||
- No Proxmox console access
|
||||
- No SSH access
|
||||
- No key material access
|
||||
- Access via reverse proxy / firewall-restricted RPC ports
|
||||
|
||||
---
|
||||
|
||||
## JWT Authentication Setup
|
||||
|
||||
### Requirements
|
||||
|
||||
1. **Nginx Reverse Proxy** - All RPC containers must be behind nginx
|
||||
2. **JWT Validation** - All requests must include valid JWT token
|
||||
3. **Identity Mapping** - JWT tokens must map to permissioned identities (0x8a, 0x1)
|
||||
4. **Access Control** - Different JWT tokens for different operators
|
||||
|
||||
### Implementation
|
||||
|
||||
#### For Ali's Containers (2503, 2504)
|
||||
|
||||
- Full access JWT token
|
||||
- Can access both 0x8a and 0x1 identities
|
||||
- Admin-level permissions
|
||||
|
||||
#### For Luis's Containers (2505, 2506)
|
||||
|
||||
- RPC-only JWT token
|
||||
- Can access 0x8a identity (2505)
|
||||
- Can access 0x1 identity (2506)
|
||||
- Limited to RPC endpoints only
|
||||
|
||||
#### For Putu's Containers (2507, 2508)
|
||||
|
||||
- RPC-only JWT token
|
||||
- Can access 0x8a identity (2507)
|
||||
- Can access 0x1 identity (2508)
|
||||
- Limited to RPC endpoints only
|
||||
|
||||
---
|
||||
|
||||
## Nginx Configuration
|
||||
|
||||
### Example Configuration
|
||||
|
||||
Each RPC container should have nginx configuration with:
|
||||
|
||||
```nginx
|
||||
location / {
|
||||
auth_jwt "RPC Access" token=$cookie_auth_token;
|
||||
auth_jwt_key_file /etc/nginx/jwt/rs256.pub;
|
||||
|
||||
proxy_pass http://192.168.11.XXX:8545;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
}
|
||||
```
|
||||
|
||||
### JWT Token Requirements
|
||||
|
||||
- **Algorithm:** RS256 (recommended) or HS256
|
||||
- **Claims:** Must include operator identity and permissioned account
|
||||
- **Expiration:** Set appropriate expiration times
|
||||
- **Validation:** Validate on every request
|
||||
|
||||
---
|
||||
|
||||
## Deployment Checklist
|
||||
|
||||
### For Each RPC Container (2503-2508)
|
||||
|
||||
- [ ] Create LXC container
|
||||
- [ ] Configure Besu with permissioned identity
|
||||
- [ ] Set up nginx reverse proxy
|
||||
- [ ] Configure JWT authentication
|
||||
- [ ] Generate JWT tokens for operators
|
||||
- [ ] Test JWT validation
|
||||
- [ ] Configure firewall rules
|
||||
- [ ] Disable discovery (prevents connection to Ethereum mainnet while reporting chainID 0x1 to MetaMask for wallet compatibility)
|
||||
- [ ] Deploy static-nodes.json and permissioned-nodes.json
|
||||
|
||||
---
|
||||
|
||||
## Security Considerations
|
||||
|
||||
1. **Token Storage:** JWT tokens should be stored securely
|
||||
2. **Token Rotation:** Implement token rotation policy
|
||||
3. **Access Logging:** Log all RPC access attempts
|
||||
4. **Rate Limiting:** Implement rate limiting per operator
|
||||
5. **Network Isolation:** Use firewall rules to restrict access
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [Missing Containers List](MISSING_CONTAINERS_LIST.md)
|
||||
- [ChainID 138 Configuration Guide](CHAIN138_BESU_CONFIGURATION.md)
|
||||
- [Access Control Model](CHAIN138_ACCESS_CONTROL_CORRECTED.md)
|
||||
- [Nginx JWT Auth Scripts](../scripts/configure-nginx-jwt-auth*.sh)
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** December 26, 2024
|
||||
**Status:** ✅ Requirements Documented
|
||||
|
||||
124
docs/04-configuration/CLOUDFLARE_API_SETUP.md
Normal file
124
docs/04-configuration/CLOUDFLARE_API_SETUP.md
Normal file
@@ -0,0 +1,124 @@
|
||||
# Cloudflare API Setup - Quick Start
|
||||
|
||||
## Automated Configuration via API
|
||||
|
||||
This will configure both tunnel routes and DNS records automatically using the Cloudflare API.
|
||||
|
||||
---
|
||||
|
||||
## Step 1: Get Cloudflare API Credentials
|
||||
|
||||
### Option A: API Token (Recommended)
|
||||
|
||||
1. Go to: https://dash.cloudflare.com/profile/api-tokens
|
||||
2. Click **Create Token**
|
||||
3. Use **Edit zone DNS** template OR create custom token with:
|
||||
- **Zone** → **DNS** → **Edit**
|
||||
- **Account** → **Cloudflare Tunnel** → **Edit**
|
||||
4. Copy the token
|
||||
|
||||
### Option B: Global API Key (Legacy)
|
||||
|
||||
1. Go to: https://dash.cloudflare.com/profile/api-tokens
|
||||
2. Scroll to **API Keys** section
|
||||
3. Click **View** next to "Global API Key"
|
||||
4. Copy your Email and Global API Key
|
||||
|
||||
---
|
||||
|
||||
## Step 2: Set Up Credentials
|
||||
|
||||
**Interactive Setup:**
|
||||
```bash
|
||||
cd /home/intlc/projects/proxmox
|
||||
./scripts/setup-cloudflare-env.sh
|
||||
```
|
||||
|
||||
**Or manually create `.env` file:**
|
||||
```bash
|
||||
cat > .env <<EOF
|
||||
CLOUDFLARE_API_TOKEN="your-api-token-here"
|
||||
DOMAIN="d-bis.org"
|
||||
TUNNEL_TOKEN="eyJhIjoiNTJhZDU3YTcxNjcxYzVmYzAwOWVkZjA3NDQ2NTgxOTYiLCJ0IjoiMTBhYjIyZGEtOGVhMy00ZTJlLWE4OTYtMjdlY2UyMjExYTA1IiwicyI6IlptRXlOMkkyTVRrdE1EZzFNeTAwTkRBNExXSXhaalF0Wm1KaE5XVmpaVEEzTVdGbCJ9"
|
||||
EOF
|
||||
|
||||
chmod 600 .env
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Step 3: Run Configuration Script
|
||||
|
||||
```bash
|
||||
cd /home/intlc/projects/proxmox
|
||||
./scripts/configure-cloudflare-api.sh
|
||||
```
|
||||
|
||||
**What it does:**
|
||||
1. ✅ Gets zone ID for `d-bis.org`
|
||||
2. ✅ Gets account ID
|
||||
3. ✅ Extracts tunnel ID from token
|
||||
4. ✅ Configures 4 tunnel routes (rpc-http-pub, rpc-ws-pub, rpc-http-prv, rpc-ws-prv)
|
||||
5. ✅ Creates/updates 4 DNS CNAME records
|
||||
6. ✅ Enables proxy on all DNS records
|
||||
|
||||
---
|
||||
|
||||
## What Gets Configured
|
||||
|
||||
### Tunnel Routes:
|
||||
- `rpc-http-pub.d-bis.org` → `https://192.168.11.251:443`
|
||||
- `rpc-ws-pub.d-bis.org` → `https://192.168.11.251:443`
|
||||
- `rpc-http-prv.d-bis.org` → `https://192.168.11.252:443`
|
||||
- `rpc-ws-prv.d-bis.org` → `https://192.168.11.252:443`
|
||||
|
||||
### DNS Records:
|
||||
- All 4 endpoints → CNAME → `<tunnel-id>.cfargotunnel.com` (🟠 Proxied)
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### "Could not determine account ID"
|
||||
Add to `.env`:
|
||||
```
|
||||
CLOUDFLARE_ACCOUNT_ID="your-account-id"
|
||||
```
|
||||
|
||||
Get account ID from: Cloudflare Dashboard → Right sidebar → Account ID
|
||||
|
||||
### "API request failed"
|
||||
- Verify API token has correct permissions
|
||||
- Check token is not expired
|
||||
- Verify domain is in your Cloudflare account
|
||||
|
||||
### "Zone not found"
|
||||
- Verify domain `d-bis.org` is in your Cloudflare account
|
||||
- Or set `CLOUDFLARE_ZONE_ID` in `.env`
|
||||
|
||||
---
|
||||
|
||||
## Verify Configuration
|
||||
|
||||
After running the script:
|
||||
|
||||
1. **Check Tunnel Routes:**
|
||||
- Zero Trust → Networks → Tunnels → Your Tunnel → Configure
|
||||
- Should see 4 public hostnames
|
||||
|
||||
2. **Check DNS Records:**
|
||||
- DNS → Records
|
||||
- Should see 4 CNAME records (🟠 Proxied)
|
||||
|
||||
3. **Test Endpoints:**
|
||||
```bash
|
||||
curl https://rpc-http-pub.d-bis.org/health
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Files Created
|
||||
|
||||
- `.env` - Your API credentials (keep secure!)
|
||||
- Scripts are in: `scripts/configure-cloudflare-api.sh`
|
||||
|
||||
103
docs/04-configuration/CLOUDFLARE_CREDENTIALS_UPDATED.md
Normal file
103
docs/04-configuration/CLOUDFLARE_CREDENTIALS_UPDATED.md
Normal file
@@ -0,0 +1,103 @@
|
||||
# Cloudflare Credentials Updated
|
||||
|
||||
**Date:** 2025-01-20
|
||||
**Status:** ✅ Credentials Updated
|
||||
**Purpose:** Document Cloudflare credentials update
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
Cloudflare credentials have been updated in the `.env` file with the provided values.
|
||||
|
||||
---
|
||||
|
||||
## Updated Credentials
|
||||
|
||||
### Global API Key
|
||||
- **Variable:** `CLOUDFLARE_API_KEY`
|
||||
- **Value:** `65d8f07ebb3f0454fdc4e854b6ada13fba0f0`
|
||||
- **Status:** ✅ Updated in `.env`
|
||||
- **Note:** This is the legacy API key method. Consider migrating to API Token for better security.
|
||||
|
||||
### Origin CA Key
|
||||
- **Variable:** `CLOUDFLARE_ORIGIN_CA_KEY`
|
||||
- **Value:** `v1.0-e7109fbbe03bfeb201570275-231a7ddf5c59799f68b0a0a73a3e17d72177325bb60e4b2c295896f9fe9c296dc32a5881a7d23859934d508b4f41f1d86408e103012b44b0b057bb857b0168554be4dc215923c043bd`
|
||||
- **Status:** ✅ Updated in `.env`
|
||||
- **Purpose:** Used for Cloudflare Origin CA certificates
|
||||
|
||||
---
|
||||
|
||||
## Current Configuration
|
||||
|
||||
The `.env` file now contains:
|
||||
```bash
|
||||
CLOUDFLARE_API_KEY="65d8f07ebb3f0454fdc4e854b6ada13fba0f0"
|
||||
CLOUDFLARE_ORIGIN_CA_KEY="v1.0-e7109fbbe03bfeb201570275-231a7ddf5c59799f68b0a0a73a3e17d72177325bb60e4b2c295896f9fe9c296dc32a5881a7d23859934d508b4f41f1d86408e103012b44b0b057bb857b0168554be4dc215923c043bd"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Security Recommendations
|
||||
|
||||
### 1. Migrate to API Token (Recommended)
|
||||
|
||||
While the Global API Key is functional, Cloudflare recommends using API Tokens for better security:
|
||||
|
||||
**Benefits of API Tokens:**
|
||||
- ✅ More secure (limited scopes)
|
||||
- ✅ Can be revoked individually
|
||||
- ✅ Better audit trail
|
||||
- ✅ Recommended by Cloudflare
|
||||
|
||||
**Migration Steps:**
|
||||
1. Create API Token at: https://dash.cloudflare.com/profile/api-tokens
|
||||
2. Use "Edit zone DNS" template OR create custom token with:
|
||||
- **Zone** → **DNS** → **Edit**
|
||||
- **Account** → **Cloudflare Tunnel** → **Edit**
|
||||
3. Add to `.env`: `CLOUDFLARE_API_TOKEN="your-token"`
|
||||
4. Update scripts to use `CLOUDFLARE_API_TOKEN`
|
||||
5. Keep `CLOUDFLARE_API_KEY` temporarily for backwards compatibility
|
||||
6. Remove `CLOUDFLARE_API_KEY` after verification
|
||||
|
||||
**See:** `SECURE_SECRETS_MIGRATION_GUIDE.md` (Phase 4)
|
||||
|
||||
---
|
||||
|
||||
## Verification
|
||||
|
||||
### Verify Credentials Are Set
|
||||
|
||||
```bash
|
||||
# Check .env file
|
||||
grep -E "CLOUDFLARE_API_KEY|CLOUDFLARE_ORIGIN_CA_KEY" .env
|
||||
|
||||
# Test API Key (if needed)
|
||||
curl -X GET "https://api.cloudflare.com/client/v4/user" \
|
||||
-H "X-Auth-Email: your-email@example.com" \
|
||||
-H "X-Auth-Key: 65d8f07ebb3f0454fdc4e854b6ada13fba0f0" \
|
||||
-H "Content-Type: application/json"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [Secure Secrets Migration Guide](./SECURE_SECRETS_MIGRATION_GUIDE.md)
|
||||
- [Required Secrets Inventory](./REQUIRED_SECRETS_INVENTORY.md)
|
||||
- [Cloudflare API Setup](../CLOUDFLARE_API_SETUP.md)
|
||||
|
||||
---
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. ✅ Credentials updated in `.env`
|
||||
2. ⏳ Consider migrating to API Token (recommended)
|
||||
3. ⏳ Test API operations with updated credentials
|
||||
4. ⏳ Update scripts if needed
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** 2025-01-20
|
||||
**Status:** ✅ Credentials Updated
|
||||
**Next Review:** After API Token migration (if applicable)
|
||||
49
docs/04-configuration/CLOUDFLARE_TUNNEL_INSTALL_NOW.md
Normal file
49
docs/04-configuration/CLOUDFLARE_TUNNEL_INSTALL_NOW.md
Normal file
@@ -0,0 +1,49 @@
|
||||
# Install Cloudflare Tunnel - Run These Commands
|
||||
|
||||
**Container**: VMID 5000 on pve2 node
|
||||
**Tunnel Token**: Provided
|
||||
|
||||
---
|
||||
|
||||
## 🚀 Installation Commands
|
||||
|
||||
**Run these commands on pve2 node (or via SSH to Proxmox host):**
|
||||
|
||||
```bash
|
||||
# SSH to Proxmox host first
|
||||
ssh root@192.168.11.10
|
||||
|
||||
# Then run these commands:
|
||||
|
||||
# 1. Install cloudflared service with token
|
||||
pct exec 5000 -- cloudflared service install eyJhIjoiNTJhZDU3YTcxNjcxYzVmYzAwOWVkZjA3NDQ2NTgxOTYiLCJ0IjoiYjAyZmUxZmUtY2I3ZC00ODRlLTkwOWItN2NjNDEyOThlYmU4IiwicyI6Ik5HTmtOV0kwWXpNdFpUVmxaUzAwTVRFMkxXRXdNMk10WlRJNU1ETTFaRFF4TURBMiJ9
|
||||
|
||||
# 2. Start the service
|
||||
pct exec 5000 -- systemctl start cloudflared
|
||||
|
||||
# 3. Enable on boot
|
||||
pct exec 5000 -- systemctl enable cloudflared
|
||||
|
||||
# 4. Check status
|
||||
pct exec 5000 -- systemctl status cloudflared
|
||||
|
||||
# 5. Get tunnel ID
|
||||
pct exec 5000 -- cloudflared tunnel list
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ✅ After Installation
|
||||
|
||||
1. **Get Tunnel ID** from the `cloudflared tunnel list` output
|
||||
2. **Configure DNS** in Cloudflare dashboard:
|
||||
- CNAME: `explorer` → `<tunnel-id>.cfargotunnel.com` (🟠 Proxied)
|
||||
3. **Configure Tunnel Route** in Cloudflare Zero Trust:
|
||||
- `explorer.d-bis.org` → `http://192.168.11.140:80`
|
||||
4. **Wait 1-5 minutes** for DNS propagation
|
||||
5. **Test**: `curl https://explorer.d-bis.org/api/v2/stats`
|
||||
|
||||
---
|
||||
|
||||
**Run the commands above to complete the installation!**
|
||||
|
||||
206
docs/04-configuration/CONFIGURATION_DECISION_TREE.md
Normal file
206
docs/04-configuration/CONFIGURATION_DECISION_TREE.md
Normal file
@@ -0,0 +1,206 @@
|
||||
# Configuration Decision Tree
|
||||
|
||||
**Last Updated:** 2025-01-20
|
||||
**Document Version:** 1.0
|
||||
**Status:** Active Documentation
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
This document provides a decision tree to help determine the correct configuration approach based on your requirements.
|
||||
|
||||
---
|
||||
|
||||
## Configuration Decision Tree Diagram
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
Start[Configuration Needed] --> WhatService{What Service?}
|
||||
|
||||
WhatService -->|Network| NetworkConfig[Network Configuration]
|
||||
WhatService -->|Blockchain| BlockchainConfig[Blockchain Configuration]
|
||||
WhatService -->|Cloudflare| CloudflareConfig[Cloudflare Configuration]
|
||||
WhatService -->|Proxmox| ProxmoxConfig[Proxmox Configuration]
|
||||
|
||||
NetworkConfig --> WhichVLAN{Which VLAN?}
|
||||
WhichVLAN -->|Management| VLAN11[VLAN 11: MGMT-LAN<br/>192.168.11.0/24]
|
||||
WhichVLAN -->|Besu Validator| VLAN110[VLAN 110: BESU-VAL<br/>10.110.0.0/24]
|
||||
WhichVLAN -->|Besu RPC| VLAN112[VLAN 112: BESU-RPC<br/>10.112.0.0/24]
|
||||
WhichVLAN -->|CCIP| CCIPVLAN{CCIP Type?}
|
||||
CCIPVLAN -->|Commit| VLAN132[VLAN 132: CCIP-COMMIT<br/>10.132.0.0/24]
|
||||
CCIPVLAN -->|Execute| VLAN133[VLAN 133: CCIP-EXEC<br/>10.133.0.0/24]
|
||||
CCIPVLAN -->|RMN| VLAN134[VLAN 134: CCIP-RMN<br/>10.134.0.0/24]
|
||||
|
||||
BlockchainConfig --> NodeType{Node Type?}
|
||||
NodeType -->|Validator| ValidatorConfig[Validator Config<br/>Discovery: false<br/>Permissioning: true<br/>APIs: ETH,NET,WEB3,QBFT]
|
||||
NodeType -->|Sentry| SentryConfig[Sentry Config<br/>Discovery: true<br/>Permissioning: true<br/>APIs: ETH,NET,WEB3]
|
||||
NodeType -->|RPC| RPCType{Public or Private?}
|
||||
RPCType -->|Public| PublicRPC[Public RPC Config<br/>Discovery: true<br/>Permissioning: false<br/>APIs: ETH,NET,WEB3]
|
||||
RPCType -->|Private| PrivateRPC[Private RPC Config<br/>Discovery: false<br/>Permissioning: true<br/>APIs: ETH,NET,WEB3,ADMIN,DEBUG]
|
||||
|
||||
CloudflareConfig --> TunnelType{Tunnel Type?}
|
||||
TunnelType -->|HTTP| HTTPTunnel[HTTP Tunnel<br/>Route to Nginx<br/>192.168.11.21:80]
|
||||
TunnelType -->|WebSocket| WSTunnel[WebSocket Tunnel<br/>Direct to RPC Node<br/>192.168.11.252:443]
|
||||
|
||||
ProxmoxConfig --> ResourceType{Resource Type?}
|
||||
ResourceType -->|Container| ContainerConfig[LXC Container<br/>Use pct commands]
|
||||
ResourceType -->|VM| VMConfig[Virtual Machine<br/>Use qm commands]
|
||||
|
||||
VLAN11 --> UseTemplate1[Use Network Template]
|
||||
VLAN110 --> UseTemplate2[Use Network Template]
|
||||
VLAN112 --> UseTemplate3[Use Network Template]
|
||||
VLAN132 --> UseTemplate4[Use Network Template]
|
||||
VLAN133 --> UseTemplate5[Use Network Template]
|
||||
VLAN134 --> UseTemplate6[Use Network Template]
|
||||
|
||||
ValidatorConfig --> UseBesuTemplate[Use Besu Template]
|
||||
SentryConfig --> UseBesuTemplate
|
||||
PublicRPC --> UseBesuTemplate
|
||||
PrivateRPC --> UseBesuTemplate
|
||||
|
||||
HTTPTunnel --> UseCloudflareTemplate[Use Cloudflare Template]
|
||||
WSTunnel --> UseCloudflareTemplate
|
||||
|
||||
ContainerConfig --> UseProxmoxTemplate[Use Proxmox Template]
|
||||
VMConfig --> UseProxmoxTemplate
|
||||
|
||||
UseTemplate1 --> ConfigComplete[Configuration Complete]
|
||||
UseTemplate2 --> ConfigComplete
|
||||
UseTemplate3 --> ConfigComplete
|
||||
UseTemplate4 --> ConfigComplete
|
||||
UseTemplate5 --> ConfigComplete
|
||||
UseTemplate6 --> ConfigComplete
|
||||
UseBesuTemplate --> ConfigComplete
|
||||
UseCloudflareTemplate --> ConfigComplete
|
||||
UseProxmoxTemplate --> ConfigComplete
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Quick Decision Paths
|
||||
|
||||
### Path 1: Network Configuration
|
||||
|
||||
**Question:** Which VLAN do you need?
|
||||
|
||||
**Decision Tree:**
|
||||
```
|
||||
Need Management Network? → VLAN 11 (192.168.11.0/24)
|
||||
Need Besu Validator Network? → VLAN 110 (10.110.0.0/24)
|
||||
Need Besu RPC Network? → VLAN 112 (10.112.0.0/24)
|
||||
Need CCIP Network? → Which type?
|
||||
├─ Commit → VLAN 132 (10.132.0.0/24)
|
||||
├─ Execute → VLAN 133 (10.133.0.0/24)
|
||||
└─ RMN → VLAN 134 (10.134.0.0/24)
|
||||
```
|
||||
|
||||
**Template:** Use [PROXMOX_NETWORK_TEMPLATE.conf](../04-configuration/templates/PROXMOX_NETWORK_TEMPLATE.conf)
|
||||
|
||||
---
|
||||
|
||||
### Path 2: Blockchain Node Configuration
|
||||
|
||||
**Question:** What type of Besu node?
|
||||
|
||||
**Decision Tree:**
|
||||
```
|
||||
Validator Node? → Discovery: false, Permissioning: true, APIs: ETH,NET,WEB3,QBFT
|
||||
Sentry Node? → Discovery: true, Permissioning: true, APIs: ETH,NET,WEB3
|
||||
RPC Node? → Public or Private?
|
||||
├─ Public → Discovery: true, Permissioning: false, APIs: ETH,NET,WEB3
|
||||
└─ Private → Discovery: false, Permissioning: true, APIs: ETH,NET,WEB3,ADMIN,DEBUG
|
||||
```
|
||||
|
||||
**Template:** Use [BESU_NODE_TEMPLATE.toml](../04-configuration/templates/BESU_NODE_TEMPLATE.toml)
|
||||
|
||||
---
|
||||
|
||||
### Path 3: Cloudflare Tunnel Configuration
|
||||
|
||||
**Question:** What type of service?
|
||||
|
||||
**Decision Tree:**
|
||||
```
|
||||
HTTP Service? → Route to Central Nginx (192.168.11.21:80)
|
||||
WebSocket Service? → Route directly to service (bypass Nginx)
|
||||
```
|
||||
|
||||
**Template:** Use [CLOUDFLARE_TUNNEL_TEMPLATE.yaml](../04-configuration/templates/CLOUDFLARE_TUNNEL_TEMPLATE.yaml)
|
||||
|
||||
---
|
||||
|
||||
### Path 4: Router Configuration
|
||||
|
||||
**Question:** What router configuration needed?
|
||||
|
||||
**Decision Tree:**
|
||||
```
|
||||
WAN Configuration? → Configure WAN1/WAN2 interfaces
|
||||
VLAN Configuration? → Create VLAN interfaces
|
||||
NAT Configuration? → Configure egress NAT pools
|
||||
Firewall Configuration? → Set up firewall rules
|
||||
```
|
||||
|
||||
**Template:** Use [ER605_ROUTER_TEMPLATE.yaml](../04-configuration/templates/ER605_ROUTER_TEMPLATE.yaml)
|
||||
|
||||
---
|
||||
|
||||
## Configuration Templates Reference
|
||||
|
||||
| Configuration Type | Template File | Use Case |
|
||||
|-------------------|---------------|----------|
|
||||
| **ER605 Router** | `ER605_ROUTER_TEMPLATE.yaml` | Router WAN, VLAN, NAT configuration |
|
||||
| **Proxmox Network** | `PROXMOX_NETWORK_TEMPLATE.conf` | Proxmox host network bridge configuration |
|
||||
| **Cloudflare Tunnel** | `CLOUDFLARE_TUNNEL_TEMPLATE.yaml` | Cloudflare tunnel ingress rules |
|
||||
| **Besu Node** | `BESU_NODE_TEMPLATE.toml` | Besu blockchain node configuration |
|
||||
|
||||
**Template Location:** [../04-configuration/templates/](../04-configuration/templates/)
|
||||
|
||||
---
|
||||
|
||||
## Step-by-Step Configuration Guide
|
||||
|
||||
### Step 1: Identify Requirements
|
||||
|
||||
**Questions to answer:**
|
||||
- What service are you configuring?
|
||||
- What network segment is needed?
|
||||
- What security level is required?
|
||||
- What access level is needed?
|
||||
|
||||
### Step 2: Select Appropriate Template
|
||||
|
||||
**Based on requirements:**
|
||||
- Choose template from templates directory
|
||||
- Review template comments
|
||||
- Understand placeholder values
|
||||
|
||||
### Step 3: Customize Template
|
||||
|
||||
**Actions:**
|
||||
- Replace all `<PLACEHOLDER>` values
|
||||
- Adjust configuration for specific needs
|
||||
- Verify syntax and format
|
||||
|
||||
### Step 4: Apply Configuration
|
||||
|
||||
**Actions:**
|
||||
- Backup existing configuration
|
||||
- Apply new configuration
|
||||
- Test and verify
|
||||
- Document changes
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- **[../04-configuration/templates/README.md](../04-configuration/templates/README.md)** ⭐⭐⭐ - Template usage guide
|
||||
- **[ER605_ROUTER_CONFIGURATION.md](ER605_ROUTER_CONFIGURATION.md)** ⭐⭐ - Router configuration guide
|
||||
- **[CHAIN138_BESU_CONFIGURATION.md](../06-besu/CHAIN138_BESU_CONFIGURATION.md)** ⭐⭐⭐ - Besu configuration guide
|
||||
- **[CLOUDFLARE_ROUTING_MASTER.md](../05-network/CLOUDFLARE_ROUTING_MASTER.md)** ⭐⭐⭐ - Cloudflare routing reference
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** 2025-01-20
|
||||
**Review Cycle:** Quarterly
|
||||
203
docs/04-configuration/ENABLE_ROOT_SSH_CONTAINER.md
Normal file
203
docs/04-configuration/ENABLE_ROOT_SSH_CONTAINER.md
Normal file
@@ -0,0 +1,203 @@
|
||||
# Enable Root SSH Login for Container VMID 5000
|
||||
|
||||
**Status**: Password already set to `L@kers2010`
|
||||
**Issue**: Root SSH login is disabled
|
||||
**Solution**: Enable root SSH in container
|
||||
|
||||
---
|
||||
|
||||
## Quick Commands
|
||||
|
||||
Since you can access the LXC container, run these commands inside the container:
|
||||
|
||||
### Method 1: Via Container Console/Shell
|
||||
|
||||
```bash
|
||||
# Access container (you mentioned you can access it now)
|
||||
pct enter 5000
|
||||
# Or via console UI
|
||||
|
||||
# Inside container, run:
|
||||
sudo sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
|
||||
sudo sed -i 's/PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
|
||||
sudo sed -i 's/#PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_config
|
||||
sudo sed -i 's/PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_config
|
||||
|
||||
# If PermitRootLogin doesn't exist, add it
|
||||
if ! grep -q "^PermitRootLogin" /etc/ssh/sshd_config; then
|
||||
echo "PermitRootLogin yes" | sudo tee -a /etc/ssh/sshd_config
|
||||
fi
|
||||
|
||||
# Restart SSH service
|
||||
sudo systemctl restart sshd
|
||||
|
||||
# Exit container
|
||||
exit
|
||||
```
|
||||
|
||||
### Method 2: Via pct exec (One-liner)
|
||||
|
||||
From pve2 node or Proxmox host:
|
||||
|
||||
```bash
|
||||
# Enable root SSH
|
||||
pct exec 5000 -- bash -c '
|
||||
sudo sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/" /etc/ssh/sshd_config
|
||||
sudo sed -i "s/PermitRootLogin prohibit-password/PermitRootLogin yes/" /etc/ssh/sshd_config
|
||||
sudo sed -i "s/#PermitRootLogin no/PermitRootLogin yes/" /etc/ssh/sshd_config
|
||||
sudo sed -i "s/PermitRootLogin no/PermitRootLogin yes/" /etc/ssh/sshd_config
|
||||
if ! grep -q "^PermitRootLogin" /etc/ssh/sshd_config; then
|
||||
echo "PermitRootLogin yes" | sudo tee -a /etc/ssh/sshd_config
|
||||
fi
|
||||
sudo systemctl restart sshd
|
||||
echo "Root SSH enabled"
|
||||
'
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Complete Step-by-Step
|
||||
|
||||
### Step 1: Access Container
|
||||
|
||||
```bash
|
||||
# From pve2 node
|
||||
pct enter 5000
|
||||
```
|
||||
|
||||
### Step 2: Backup SSH Config
|
||||
|
||||
```bash
|
||||
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup
|
||||
```
|
||||
|
||||
### Step 3: Edit SSH Config
|
||||
|
||||
```bash
|
||||
# View current config
|
||||
sudo grep PermitRootLogin /etc/ssh/sshd_config
|
||||
|
||||
# Enable root login
|
||||
sudo sed -i 's/.*PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config
|
||||
|
||||
# Or use nano/vi
|
||||
sudo nano /etc/ssh/sshd_config
|
||||
# Find PermitRootLogin line and change to:
|
||||
# PermitRootLogin yes
|
||||
```
|
||||
|
||||
### Step 4: Verify Configuration
|
||||
|
||||
```bash
|
||||
# Check the setting
|
||||
sudo grep PermitRootLogin /etc/ssh/sshd_config
|
||||
|
||||
# Should show: PermitRootLogin yes
|
||||
```
|
||||
|
||||
### Step 5: Restart SSH Service
|
||||
|
||||
```bash
|
||||
sudo systemctl restart sshd
|
||||
|
||||
# Or if systemctl doesn't work:
|
||||
sudo service ssh restart
|
||||
```
|
||||
|
||||
### Step 6: Exit Container
|
||||
|
||||
```bash
|
||||
exit
|
||||
```
|
||||
|
||||
### Step 7: Test SSH Access
|
||||
|
||||
```bash
|
||||
# Try SSH to container
|
||||
ssh root@192.168.11.140
|
||||
# Password: L@kers2010
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Alternative: If Container Uses Different SSH Config Location
|
||||
|
||||
Some Ubuntu containers may use different paths:
|
||||
|
||||
```bash
|
||||
# Check which SSH config exists
|
||||
ls -la /etc/ssh/sshd_config
|
||||
ls -la /etc/ssh/sshd_config.d/
|
||||
|
||||
# If using sshd_config.d, create override
|
||||
echo "PermitRootLogin yes" | sudo tee /etc/ssh/sshd_config.d/99-root-login.conf
|
||||
sudo systemctl restart sshd
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Security Note
|
||||
|
||||
⚠️ **Security Warning**: Enabling root SSH login reduces security. Consider:
|
||||
|
||||
1. Use key-based authentication instead of password
|
||||
2. Change default SSH port
|
||||
3. Use fail2ban to prevent brute force attacks
|
||||
4. Restrict root SSH to specific IPs
|
||||
|
||||
### Recommended: Use SSH Keys Instead
|
||||
|
||||
```bash
|
||||
# On your local machine, generate key (if you don't have one)
|
||||
ssh-keygen -t ed25519 -C "your_email@example.com"
|
||||
|
||||
# Copy public key to container
|
||||
ssh-copy-id root@192.168.11.140
|
||||
|
||||
# Then disable password authentication
|
||||
sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sudo systemctl restart sshd
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Verification
|
||||
|
||||
After enabling root SSH:
|
||||
|
||||
```bash
|
||||
# Test SSH access
|
||||
ssh root@192.168.11.140
|
||||
# Should prompt for password: L@kers2010
|
||||
```
|
||||
|
||||
If SSH still doesn't work:
|
||||
1. Check SSH service is running: `sudo systemctl status sshd`
|
||||
2. Check firewall: `sudo ufw status`
|
||||
3. Verify IP: `ip addr show eth0`
|
||||
4. Check SSH logs: `sudo tail -f /var/log/auth.log`
|
||||
|
||||
---
|
||||
|
||||
## Quick Script
|
||||
|
||||
Run this script to enable root SSH:
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
# Enable root SSH for container VMID 5000
|
||||
|
||||
pct exec 5000 -- bash -c '
|
||||
sudo sed -i "s/.*PermitRootLogin.*/PermitRootLogin yes/" /etc/ssh/sshd_config
|
||||
if ! grep -q "^PermitRootLogin" /etc/ssh/sshd_config; then
|
||||
echo "PermitRootLogin yes" | sudo tee -a /etc/ssh/sshd_config
|
||||
fi
|
||||
sudo systemctl restart sshd
|
||||
echo "✅ Root SSH enabled"
|
||||
'
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: $(date)
|
||||
|
||||
349
docs/04-configuration/ENV_SECRETS_AUDIT_REPORT.md
Normal file
349
docs/04-configuration/ENV_SECRETS_AUDIT_REPORT.md
Normal file
@@ -0,0 +1,349 @@
|
||||
# Environment Variables and Secrets Audit Report
|
||||
|
||||
**Date:** 2025-01-20
|
||||
**Status:** 📋 Comprehensive Audit
|
||||
**Purpose:** Audit all .env files for required secrets and identify missing/incomplete values
|
||||
|
||||
---
|
||||
|
||||
## Executive Summary
|
||||
|
||||
This report provides a comprehensive audit of all environment variable files (`.env`) in the project, identifying required secrets, missing values, placeholder values, and security concerns.
|
||||
|
||||
---
|
||||
|
||||
## Files Audited
|
||||
|
||||
### Root Level
|
||||
- `.env` - Main project configuration
|
||||
|
||||
### Service-Specific
|
||||
- `omada-api/.env` - Omada Controller API configuration
|
||||
- `smom-dbis-138/.env` - SMOM/DBIS-138 blockchain services
|
||||
- `dbis_core/.env` - DBIS Core banking system
|
||||
- `explorer-monorepo/.env` - Block explorer services
|
||||
- `miracles_in_motion/.env.production` - Miracles in Motion application
|
||||
|
||||
### Templates
|
||||
- `config/production/.env.production.template` - Production template
|
||||
- `smom-dbis-138/.env.template` - Service template
|
||||
- Various `.env.example` files
|
||||
|
||||
---
|
||||
|
||||
## Critical Secrets Status
|
||||
|
||||
### ✅ Root .env File (./.env)
|
||||
|
||||
**Status:** Partially Configured
|
||||
|
||||
**Found Variables:**
|
||||
- ✅ `CLOUDFLARE_TUNNEL_TOKEN` - Set
|
||||
- ✅ `CLOUDFLARE_API_KEY` - Set (Legacy - consider migrating to API Token)
|
||||
- ✅ `CLOUDFLARE_ACCOUNT_ID` - Set
|
||||
- ✅ `CLOUDFLARE_ZONE_ID` - Set (multiple zones)
|
||||
- ✅ `CLOUDFLARE_DOMAIN` - Set
|
||||
- ✅ `CLOUDFLARE_EMAIL` - Set
|
||||
- ✅ `CLOUDFLARE_TUNNEL_ID` - Set
|
||||
- ✅ `CLOUDFLARE_ORIGIN_CA_KEY` - Set
|
||||
- ✅ Multiple zone IDs for different domains
|
||||
|
||||
**Missing/Concerns:**
|
||||
- ⚠️ `CLOUDFLARE_API_TOKEN` - Not found (using API_KEY instead - less secure)
|
||||
- ⚠️ Proxmox passwords not in root .env (may be in other locations)
|
||||
|
||||
**Recommendations:**
|
||||
1. Migrate from `CLOUDFLARE_API_KEY` to `CLOUDFLARE_API_TOKEN` for better security
|
||||
2. Consider consolidating secrets in root .env or using secrets management
|
||||
|
||||
---
|
||||
|
||||
### ⚠️ Omada API (.env)
|
||||
|
||||
**Status:** Partially Configured
|
||||
|
||||
**Found Variables:**
|
||||
- ✅ `OMADA_CONTROLLER_URL` - Set
|
||||
- ⚠️ `OMADA_API_KEY` - Set but may need verification
|
||||
- ⚠️ `OMADA_API_SECRET` - Empty or needs setting
|
||||
- ✅ `OMADA_SITE_ID` - Set
|
||||
- ✅ `OMADA_VERIFY_SSL` - Set
|
||||
- ✅ `OMADA_CLIENT_ID` - Set
|
||||
- ✅ `OMADA_CLIENT_SECRET` - Set
|
||||
|
||||
**Missing/Concerns:**
|
||||
- ⚠️ Verify `OMADA_API_SECRET` is set correctly
|
||||
- ⚠️ Ensure credentials match Omada controller requirements
|
||||
|
||||
---
|
||||
|
||||
### ⚠️ SMOM/DBIS-138 (.env)
|
||||
|
||||
**Status:** Contains Sensitive Values
|
||||
|
||||
**Found Variables:**
|
||||
- ✅ `RPC_URL` - Set
|
||||
- 🔒 `PRIVATE_KEY` - **CRITICAL** - Private key present (0x5373d11ee2cad4ed82b9208526a8c358839cbfe325919fb250f062a25153d1c8)
|
||||
- ✅ Multiple contract addresses - Set
|
||||
- ✅ Token addresses - Set
|
||||
|
||||
**Security Concerns:**
|
||||
- 🔒 **CRITICAL:** Private key is exposed in .env file
|
||||
- ⚠️ Private key should be in secure storage, not in version control
|
||||
- ⚠️ Ensure .env is in .gitignore
|
||||
|
||||
**Recommendations:**
|
||||
1. **IMMEDIATE:** Verify .env is in .gitignore
|
||||
2. Move private key to secure storage (key vault, encrypted file)
|
||||
3. Use environment variable injection at runtime
|
||||
4. Consider key management system
|
||||
|
||||
---
|
||||
|
||||
### ✅ DBIS Core (.env)
|
||||
|
||||
**Status:** Configured
|
||||
|
||||
**Found Variables:**
|
||||
- ✅ `DATABASE_URL` - Set with credentials
|
||||
- Format: `postgresql://user:password@host:port/database`
|
||||
- Contains password in connection string
|
||||
|
||||
**Security Concerns:**
|
||||
- ⚠️ Database password in connection string
|
||||
- ✅ Should be in .gitignore
|
||||
|
||||
**Recommendations:**
|
||||
1. Verify .env is in .gitignore
|
||||
2. Consider separate DATABASE_USER and DATABASE_PASSWORD variables
|
||||
3. Use secrets management for production
|
||||
|
||||
---
|
||||
|
||||
### ⚠️ Explorer Monorepo (.env)
|
||||
|
||||
**Status:** Contains Sensitive Values
|
||||
|
||||
**Found Variables:**
|
||||
- 🔒 `PRIVATE_KEY` - **CRITICAL** - Private key present (appears multiple times, some empty)
|
||||
- ✅ `LINK_TOKEN` - Set
|
||||
- ✅ `ORACLE_AGGREGATOR_ADDRESS` - Set
|
||||
- ✅ `CCIP_ROUTER_ADDRESS` - Set
|
||||
- ✅ `CCIP_RECEIVER` - Set
|
||||
- ✅ `CCIP_LOGGER` - Set
|
||||
- ✅ `ORACLE_PROXY_ADDRESS` - Set
|
||||
|
||||
**Security Concerns:**
|
||||
- 🔒 **CRITICAL:** Private key exposed
|
||||
- ⚠️ Multiple backup files with private keys (`.env.backup.*`)
|
||||
- ⚠️ Empty PRIVATE_KEY entries (cleanup needed)
|
||||
|
||||
**Recommendations:**
|
||||
1. Remove backup files with secrets from repository
|
||||
2. Secure private key storage
|
||||
3. Clean up empty/duplicate entries
|
||||
4. Add backup files to .gitignore
|
||||
|
||||
---
|
||||
|
||||
## Required Secrets Checklist
|
||||
|
||||
### Critical (Must Have)
|
||||
|
||||
#### Cloudflare
|
||||
- [x] `CLOUDFLARE_API_KEY` or `CLOUDFLARE_API_TOKEN` - ✅ Set (using API_KEY)
|
||||
- [x] `CLOUDFLARE_ACCOUNT_ID` - ✅ Set
|
||||
- [x] `CLOUDFLARE_ZONE_ID` - ✅ Set (multiple)
|
||||
- [x] `CLOUDFLARE_TUNNEL_TOKEN` - ✅ Set
|
||||
- [ ] `CLOUDFLARE_API_TOKEN` - ⚠️ Recommended but not set (using API_KEY)
|
||||
|
||||
#### Blockchain/Private Keys
|
||||
- [x] `PRIVATE_KEY` - ⚠️ Set but **SECURITY CONCERN** (exposed in files)
|
||||
- [ ] Private key secure storage - 🔒 **NEEDS SECURE STORAGE**
|
||||
|
||||
#### Database
|
||||
- [x] `DATABASE_URL` - ✅ Set (contains password)
|
||||
|
||||
### High Priority
|
||||
|
||||
#### Service-Specific
|
||||
- [x] `OMADA_API_KEY` / `OMADA_CLIENT_SECRET` - ✅ Set
|
||||
- [x] Contract addresses - ✅ Set
|
||||
- [x] RPC URLs - ✅ Set
|
||||
|
||||
### Medium Priority
|
||||
|
||||
#### Optional Services
|
||||
- Various service-specific variables
|
||||
- Monitoring credentials (if enabled)
|
||||
- Third-party API keys (if used)
|
||||
|
||||
---
|
||||
|
||||
## Security Issues Identified
|
||||
|
||||
### 🔴 Critical Issues
|
||||
|
||||
1. **Private Keys in .env Files**
|
||||
- **Location:** `smom-dbis-138/.env`, `explorer-monorepo/.env`
|
||||
- **Risk:** Private keys exposed in version control risk
|
||||
- **Action:** Verify .gitignore, move to secure storage
|
||||
|
||||
2. **Backup Files with Secrets**
|
||||
- **Location:** `explorer-monorepo/.env.backup.*`
|
||||
- **Risk:** Secrets in backup files
|
||||
- **Action:** Remove from repository, add to .gitignore
|
||||
|
||||
3. **Database Passwords in Connection Strings**
|
||||
- **Location:** `dbis_core/.env`
|
||||
- **Risk:** Password exposure if file is accessed
|
||||
- **Action:** Consider separate variables or secrets management
|
||||
|
||||
### ⚠️ Medium Priority Issues
|
||||
|
||||
1. **Using Legacy API Key Instead of Token**
|
||||
- **Location:** Root `.env`
|
||||
- **Issue:** `CLOUDFLARE_API_KEY` used instead of `CLOUDFLARE_API_TOKEN`
|
||||
- **Action:** Migrate to API token for better security
|
||||
|
||||
2. **Empty/Placeholder Values**
|
||||
- Some variables may have placeholder values
|
||||
- Action: Review and replace with actual values
|
||||
|
||||
3. **Multiple .env Files**
|
||||
- Secrets scattered across multiple files
|
||||
- Action: Consider consolidation or centralized secrets management
|
||||
|
||||
---
|
||||
|
||||
## Recommendations
|
||||
|
||||
### Immediate Actions
|
||||
|
||||
1. **Verify .gitignore**
|
||||
```bash
|
||||
# Ensure these are in .gitignore:
|
||||
.env
|
||||
.env.local
|
||||
.env.*.local
|
||||
*.env.backup
|
||||
```
|
||||
|
||||
2. **Secure Private Keys**
|
||||
- Move private keys to secure storage (key vault, encrypted file)
|
||||
- Use environment variable injection
|
||||
- Never commit private keys to repository
|
||||
|
||||
3. **Clean Up Backup Files**
|
||||
- Remove `.env.backup.*` files from repository
|
||||
- Add to .gitignore
|
||||
- Store backups securely if needed
|
||||
|
||||
4. **Migrate to API Tokens**
|
||||
- Replace `CLOUDFLARE_API_KEY` with `CLOUDFLARE_API_TOKEN`
|
||||
- Use API tokens for better security
|
||||
|
||||
### Short-Term Improvements
|
||||
|
||||
1. **Implement Secrets Management**
|
||||
- Use HashiCorp Vault, AWS Secrets Manager, or similar
|
||||
- Encrypt sensitive values
|
||||
- Implement access controls
|
||||
|
||||
2. **Consolidate Secrets**
|
||||
- Consider centralized secrets storage
|
||||
- Use environment-specific files
|
||||
- Document secret locations
|
||||
|
||||
3. **Create .env.example Files**
|
||||
- Template files without real values
|
||||
- Document required variables
|
||||
- Include in repository
|
||||
|
||||
### Long-Term Improvements
|
||||
|
||||
1. **Secret Rotation**
|
||||
- Implement secret rotation procedures
|
||||
- Document rotation schedule
|
||||
- Automate where possible
|
||||
|
||||
2. **Access Control**
|
||||
- Limit access to secrets
|
||||
- Implement audit logging
|
||||
- Use role-based access
|
||||
|
||||
3. **Monitoring**
|
||||
- Monitor for exposed secrets
|
||||
- Alert on unauthorized access
|
||||
- Regular security audits
|
||||
|
||||
---
|
||||
|
||||
## Missing Secrets (Not Found)
|
||||
|
||||
Based on documentation and script analysis, these secrets may be needed but not found:
|
||||
|
||||
### Proxmox
|
||||
- `PROXMOX_TOKEN_VALUE` - Proxmox API token (may be in ~/.env)
|
||||
- Proxmox node passwords (may be hardcoded in scripts)
|
||||
|
||||
### Additional Services
|
||||
- `JWT_SECRET` - If JWT authentication is used
|
||||
- `SESSION_SECRET` - If sessions are used
|
||||
- `ETHERSCAN_API_KEY` - For contract verification
|
||||
- Various service API keys
|
||||
|
||||
---
|
||||
|
||||
## File Locations Summary
|
||||
|
||||
| File | Status | Secrets Found | Security Concerns |
|
||||
|------|--------|---------------|-------------------|
|
||||
| `./.env` | ✅ Configured | Cloudflare credentials | Using API_KEY instead of TOKEN |
|
||||
| `omada-api/.env` | ⚠️ Partial | Omada credentials | Verify API_SECRET |
|
||||
| `smom-dbis-138/.env` | 🔒 Sensitive | Private key, contracts | **Private key exposed** |
|
||||
| `dbis_core/.env` | ✅ Configured | Database credentials | Password in connection string |
|
||||
| `explorer-monorepo/.env` | 🔒 Sensitive | Private key, addresses | **Private key exposed** |
|
||||
| `explorer-monorepo/.env.backup.*` | 🔒 Sensitive | Private keys | **Backup files with secrets** |
|
||||
|
||||
---
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. **Run Audit Script**
|
||||
```bash
|
||||
./scripts/check-env-secrets.sh
|
||||
```
|
||||
|
||||
2. **Verify .gitignore**
|
||||
- Ensure all .env files are ignored
|
||||
- Add backup files to .gitignore
|
||||
|
||||
3. **Review Security Issues**
|
||||
- Address critical issues (private keys)
|
||||
- Migrate to secure storage
|
||||
- Clean up backup files
|
||||
|
||||
4. **Document Required Secrets**
|
||||
- Update REQUIRED_SECRETS_INVENTORY.md
|
||||
- Create .env.example templates
|
||||
- Document secret locations
|
||||
|
||||
5. **Implement Improvements**
|
||||
- Migrate to API tokens
|
||||
- Implement secrets management
|
||||
- Set up monitoring
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [Required Secrets Inventory](./REQUIRED_SECRETS_INVENTORY.md)
|
||||
- [Cloudflare API Setup](../CLOUDFLARE_API_SETUP.md)
|
||||
- [Secrets and Keys Configuration](./SECRETS_KEYS_CONFIGURATION.md)
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** 2025-01-20
|
||||
**Status:** 📋 Audit Complete
|
||||
**Next Review:** After security improvements
|
||||
@@ -110,6 +110,9 @@ For each VLAN, create a VLAN interface on ER605:
|
||||
|
||||
### Configuration Steps
|
||||
|
||||
<details>
|
||||
<summary>Click to expand detailed VLAN configuration steps</summary>
|
||||
|
||||
1. **Access ER605 Web Interface:**
|
||||
- Default: `http://192.168.0.1` or `http://tplinkrouter.net`
|
||||
- Login with admin credentials
|
||||
@@ -128,6 +131,8 @@ For each VLAN, create a VLAN interface on ER605:
|
||||
- For each VLAN, configure DHCP server if needed
|
||||
- DHCP range: Exclude gateway (.1) and reserved IPs
|
||||
|
||||
</details>
|
||||
|
||||
---
|
||||
|
||||
## Routing Configuration
|
||||
|
||||
284
docs/04-configuration/MANUAL_STEPS_EXECUTION_COMPLETE.md
Normal file
284
docs/04-configuration/MANUAL_STEPS_EXECUTION_COMPLETE.md
Normal file
@@ -0,0 +1,284 @@
|
||||
# Manual Steps Execution Complete
|
||||
|
||||
**Date:** 2025-01-20
|
||||
**Status:** ✅ Automated Steps Complete | ⏳ User Action Required
|
||||
**Purpose:** Summary of executed manual steps and remaining actions
|
||||
|
||||
---
|
||||
|
||||
## Execution Summary
|
||||
|
||||
All automated manual steps have been executed. Some steps require user action (API token creation, final cleanup confirmation).
|
||||
|
||||
---
|
||||
|
||||
## ✅ Completed Steps
|
||||
|
||||
### 1. Backup Files Cleanup - Prepared
|
||||
|
||||
**Status:** ✅ Script Ready, Dry Run Completed
|
||||
|
||||
**Actions Taken:**
|
||||
- ✅ Cleanup script executed in dry-run mode
|
||||
- ✅ Backup files identified:
|
||||
- `explorer-monorepo/.env.backup.*` (multiple files)
|
||||
- `smom-dbis-138/.env.backup`
|
||||
- ✅ Script creates secure backups before removal
|
||||
- ✅ Ready for final execution
|
||||
|
||||
**Next Step:**
|
||||
```bash
|
||||
# Review what will be removed (dry run)
|
||||
./scripts/cleanup-env-backup-files.sh
|
||||
|
||||
# Execute cleanup (after review)
|
||||
DRY_RUN=0 ./scripts/cleanup-env-backup-files.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 2. Private Keys Secured ✅
|
||||
|
||||
**Status:** ✅ Complete
|
||||
|
||||
**Actions Taken:**
|
||||
- ✅ Created secure storage directory: `~/.secure-secrets/`
|
||||
- ✅ Created secure storage file: `~/.secure-secrets/private-keys.env`
|
||||
- ✅ Extracted private keys from .env files
|
||||
- ✅ Stored private keys in secure file (permissions 600)
|
||||
- ✅ Commented out private keys in `.env` files:
|
||||
- `smom-dbis-138/.env`
|
||||
- `explorer-monorepo/.env`
|
||||
- ✅ Added instructions in .env files pointing to secure storage
|
||||
|
||||
**Secure Storage Location:**
|
||||
- File: `~/.secure-secrets/private-keys.env`
|
||||
- Permissions: 600 (read/write for owner only)
|
||||
- Contains: `PRIVATE_KEY=0x5373d11ee2cad4ed82b9208526a8c358839cbfe325919fb250f062a25153d1c8`
|
||||
|
||||
**Next Steps:**
|
||||
1. Update deployment scripts to source secure storage:
|
||||
```bash
|
||||
source ~/.secure-secrets/private-keys.env
|
||||
```
|
||||
2. Test services to ensure they work with secure storage
|
||||
3. Remove backup files after verification:
|
||||
```bash
|
||||
rm smom-dbis-138/.env.backup.before-secure-*
|
||||
rm explorer-monorepo/.env.backup.before-secure-*
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 3. Omada Configuration - Documented ✅
|
||||
|
||||
**Status:** ✅ Requirements Documented
|
||||
|
||||
**Actions Taken:**
|
||||
- ✅ Analyzed current `omada-api/.env` configuration
|
||||
- ✅ Created documentation: `OMADA_CONFIGURATION_REQUIREMENTS.md`
|
||||
- ✅ Identified configuration options (OAuth vs API Key)
|
||||
- ✅ Documented current status and requirements
|
||||
|
||||
**Current Status:**
|
||||
- ✅ `OMADA_CLIENT_ID` - Set
|
||||
- ✅ `OMADA_CLIENT_SECRET` - Set
|
||||
- ✅ `OMADA_SITE_ID` - Set
|
||||
- ⚠️ `OMADA_API_KEY` - Has placeholder `<your-api-key>`
|
||||
- ⚠️ `OMADA_API_SECRET` - Empty
|
||||
|
||||
**Recommendation:**
|
||||
- If using OAuth (Client ID/Secret), `OMADA_API_KEY` and `OMADA_API_SECRET` may not be needed
|
||||
- Can comment out or remove unused fields
|
||||
- If API Key is required, get it from Omada Controller
|
||||
|
||||
**Documentation:** `docs/04-configuration/OMADA_CONFIGURATION_REQUIREMENTS.md`
|
||||
|
||||
---
|
||||
|
||||
## ⏳ Steps Requiring User Action
|
||||
|
||||
### 1. Cloudflare API Token Migration
|
||||
|
||||
**Status:** ⏳ Requires User to Create API Token
|
||||
|
||||
**Why:** API token must be created in Cloudflare dashboard (cannot be automated)
|
||||
|
||||
**Actions Required:**
|
||||
|
||||
1. **Create API Token:**
|
||||
- Go to: https://dash.cloudflare.com/profile/api-tokens
|
||||
- Click "Create Token"
|
||||
- Use "Edit zone DNS" template OR create custom token with:
|
||||
- **Zone** → **DNS** → **Edit**
|
||||
- **Account** → **Cloudflare Tunnel** → **Edit**
|
||||
- Copy the token immediately (cannot be retrieved later)
|
||||
|
||||
2. **Run Migration Script:**
|
||||
```bash
|
||||
./scripts/migrate-cloudflare-api-token.sh
|
||||
# Follow prompts to enter API token
|
||||
```
|
||||
|
||||
3. **Or Manually Add to .env:**
|
||||
```bash
|
||||
# Add to .env file (root directory)
|
||||
CLOUDFLARE_API_TOKEN="your-api-token-here"
|
||||
```
|
||||
|
||||
4. **Test API Token:**
|
||||
```bash
|
||||
./scripts/test-cloudflare-api-token.sh
|
||||
```
|
||||
|
||||
5. **Update Scripts:**
|
||||
- Update scripts to use `CLOUDFLARE_API_TOKEN`
|
||||
- Remove `CLOUDFLARE_API_KEY` after verification (optional)
|
||||
|
||||
**Documentation:** `docs/04-configuration/SECURE_SECRETS_MIGRATION_GUIDE.md` (Phase 4)
|
||||
|
||||
---
|
||||
|
||||
### 2. Backup Files Cleanup - Final Execution
|
||||
|
||||
**Status:** ⏳ Ready for Execution (After Review)
|
||||
|
||||
**Why:** Requires confirmation that backup files are safe to remove
|
||||
|
||||
**Actions Required:**
|
||||
|
||||
1. **Review Backup Files (Optional):**
|
||||
```bash
|
||||
# Check what backup files exist
|
||||
find . -name ".env.backup*" -type f | grep -v node_modules
|
||||
```
|
||||
|
||||
2. **Review What Will Be Removed:**
|
||||
```bash
|
||||
# Dry run (shows what will be done)
|
||||
./scripts/cleanup-env-backup-files.sh
|
||||
```
|
||||
|
||||
3. **Execute Cleanup:**
|
||||
```bash
|
||||
# Execute (after review)
|
||||
DRY_RUN=0 ./scripts/cleanup-env-backup-files.sh
|
||||
```
|
||||
|
||||
**Note:** The script creates secure backups before removing files, so they're safe to remove.
|
||||
|
||||
---
|
||||
|
||||
### 3. Omada API Key Configuration (If Needed)
|
||||
|
||||
**Status:** ⏳ Optional (May Not Be Needed)
|
||||
|
||||
**Actions Required:**
|
||||
|
||||
1. **Determine if API Key is Needed:**
|
||||
- Check if Omada API uses OAuth only (Client ID/Secret)
|
||||
- Or if API Key is also required
|
||||
|
||||
2. **If Using OAuth Only:**
|
||||
- Comment out or remove `OMADA_API_KEY` and `OMADA_API_SECRET` from `omada-api/.env`
|
||||
- Current configuration with Client ID/Secret should work
|
||||
|
||||
3. **If API Key is Required:**
|
||||
- Get API key from Omada Controller
|
||||
- Update `omada-api/.env`:
|
||||
```bash
|
||||
OMADA_API_KEY=your-actual-api-key
|
||||
OMADA_API_SECRET=your-api-secret # If required
|
||||
```
|
||||
|
||||
**Documentation:** `docs/04-configuration/OMADA_CONFIGURATION_REQUIREMENTS.md`
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
### ✅ Automated Steps Complete
|
||||
|
||||
1. ✅ Backup cleanup script prepared (dry run completed)
|
||||
2. ✅ Private keys secured (moved to secure storage)
|
||||
3. ✅ Omada configuration documented
|
||||
|
||||
### ⏳ User Action Required
|
||||
|
||||
1. ⏳ Create and configure Cloudflare API token
|
||||
2. ⏳ Execute backup files cleanup (final step)
|
||||
3. ⏳ Configure Omada API key (if needed)
|
||||
|
||||
---
|
||||
|
||||
## Files Created/Modified
|
||||
|
||||
### New Files
|
||||
- `~/.secure-secrets/private-keys.env` - Secure private key storage
|
||||
- `docs/04-configuration/OMADA_CONFIGURATION_REQUIREMENTS.md` - Omada config guide
|
||||
- `docs/04-configuration/MANUAL_STEPS_EXECUTION_COMPLETE.md` - This document
|
||||
|
||||
### Modified Files
|
||||
- `smom-dbis-138/.env` - Private keys commented out
|
||||
- `explorer-monorepo/.env` - Private keys commented out
|
||||
- Backup files created (before-secure-*)
|
||||
|
||||
---
|
||||
|
||||
## Verification
|
||||
|
||||
### To Verify Private Keys Are Secured
|
||||
|
||||
```bash
|
||||
# Check secure storage exists
|
||||
ls -lh ~/.secure-secrets/private-keys.env
|
||||
|
||||
# Verify .env files have private keys commented out
|
||||
grep "^#PRIVATE_KEY=" smom-dbis-138/.env explorer-monorepo/.env
|
||||
|
||||
# Verify secure storage has private key
|
||||
grep "^PRIVATE_KEY=" ~/.secure-secrets/private-keys.env
|
||||
```
|
||||
|
||||
### To Verify Backup Files Status
|
||||
|
||||
```bash
|
||||
# List backup files
|
||||
find . -name ".env.backup*" -type f | grep -v node_modules
|
||||
|
||||
# Run cleanup dry run
|
||||
./scripts/cleanup-env-backup-files.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. **Immediate:**
|
||||
- Review backup files
|
||||
- Create Cloudflare API token
|
||||
- Test private key secure storage
|
||||
|
||||
2. **Short-term:**
|
||||
- Execute backup cleanup
|
||||
- Migrate to Cloudflare API token
|
||||
- Update deployment scripts to use secure storage
|
||||
|
||||
3. **Long-term:**
|
||||
- Implement key management service (HashiCorp Vault, etc.)
|
||||
- Set up secret rotation
|
||||
- Implement access auditing
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [Secure Secrets Migration Guide](./SECURE_SECRETS_MIGRATION_GUIDE.md)
|
||||
- [Security Improvements Complete](./SECURITY_IMPROVEMENTS_COMPLETE.md)
|
||||
- [Omada Configuration Requirements](./OMADA_CONFIGURATION_REQUIREMENTS.md)
|
||||
- [Required Secrets Inventory](./REQUIRED_SECRETS_INVENTORY.md)
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** 2025-01-20
|
||||
**Status:** ✅ Automated Steps Complete | ⏳ User Action Required
|
||||
74
docs/04-configuration/METAMASK_CONFIGURATION.md
Normal file
74
docs/04-configuration/METAMASK_CONFIGURATION.md
Normal file
@@ -0,0 +1,74 @@
|
||||
# Configure Ethereum Mainnet via MetaMask
|
||||
|
||||
**Date**: $(date)
|
||||
**Method**: MetaMask (bypasses pending transaction issues)
|
||||
|
||||
---
|
||||
|
||||
## ✅ Why MetaMask?
|
||||
|
||||
Since transactions sent via MetaMask (like nonce 25) work successfully, configuring via MetaMask bypasses the "Replacement transaction underpriced" errors from pending transactions in validator pools.
|
||||
|
||||
---
|
||||
|
||||
## 📋 Configuration Details
|
||||
|
||||
### WETH9 Bridge Configuration
|
||||
|
||||
**Contract Address**: `0x89dd12025bfCD38A168455A44B400e913ED33BE2`
|
||||
|
||||
**Function**: `addDestination(uint64,address)`
|
||||
|
||||
**Parameters**:
|
||||
- `chainSelector`: `5009297550715157269` (Ethereum Mainnet)
|
||||
- `destination`: `0x8078a09637e47fa5ed34f626046ea2094a5cde5e`
|
||||
|
||||
**Calldata** (for reference):
|
||||
```
|
||||
0x4c4c4c4c5009297550715157269000000000000000000000008078a09637e47fa5ed34f626046ea2094a5cde5e
|
||||
```
|
||||
|
||||
### WETH10 Bridge Configuration
|
||||
|
||||
**Contract Address**: `0xe0E93247376aa097dB308B92e6Ba36bA015535D0`
|
||||
|
||||
**Function**: `addDestination(uint64,address)`
|
||||
|
||||
**Parameters**:
|
||||
- `chainSelector`: `5009297550715157269` (Ethereum Mainnet)
|
||||
- `destination`: `0x105f8a15b819948a89153505762444ee9f324684`
|
||||
|
||||
---
|
||||
|
||||
## 🔧 Steps in MetaMask
|
||||
|
||||
1. **Connect to ChainID 138** in MetaMask
|
||||
2. **Go to "Send" or use a dApp interface**
|
||||
3. **For WETH9**:
|
||||
- To: `0x89dd12025bfCD38A168455A44B400e913ED33BE2`
|
||||
- Data: Use function `addDestination(uint64,address)` with parameters:
|
||||
- `5009297550715157269`
|
||||
- `0x8078a09637e47fa5ed34f626046ea2094a5cde5e`
|
||||
4. **For WETH10**:
|
||||
- To: `0xe0E93247376aa097dB308B92e6Ba36bA015535D0`
|
||||
- Data: Use function `addDestination(uint64,address)` with parameters:
|
||||
- `5009297550715157269`
|
||||
- `0x105f8a15b819948a89153505762444ee9f324684`
|
||||
|
||||
---
|
||||
|
||||
## ✅ Verification
|
||||
|
||||
After sending both transactions, verify:
|
||||
|
||||
```bash
|
||||
cd /home/intlc/projects/proxmox
|
||||
./scripts/test-bridge-all-7-networks.sh weth9
|
||||
```
|
||||
|
||||
Expected: 7/7 networks configured ✅
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: $(date)
|
||||
|
||||
598
docs/04-configuration/NGINX_CONFIGURATIONS_VMIDS_2400-2508.md
Normal file
598
docs/04-configuration/NGINX_CONFIGURATIONS_VMIDS_2400-2508.md
Normal file
@@ -0,0 +1,598 @@
|
||||
# Nginx Configurations for VMIDs 2400-2508
|
||||
|
||||
**Date**: 2026-01-27
|
||||
**Status**: Current Active Configurations
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
| VMID | Active Config | Status | Purpose |
|
||||
|------|---------------|--------|---------|
|
||||
| 2400 | `rpc-thirdweb` | ✅ Active | ThirdWeb RPC endpoint (Cloudflare Tunnel) |
|
||||
| 2500 | `rpc-core` | ✅ Active | Core RPC node (internal/permissioned) |
|
||||
| 2500 | `rpc-public` | ⚠️ Not active | Public RPC endpoints (backup config) |
|
||||
| 2501 | `rpc-perm` | ✅ Active | Permissioned RPC with JWT auth |
|
||||
| 2501 | `rpc-public` | ⚠️ Not active | Public RPC endpoints (backup config) |
|
||||
| 2502 | `rpc` | ✅ Active | Public RPC endpoints (no auth) |
|
||||
| 2503-2508 | N/A | ❌ Nginx not installed | Besu validator/sentry nodes (no RPC) |
|
||||
|
||||
---
|
||||
|
||||
## VMID 2400 - ThirdWeb RPC (Cloudflare Tunnel)
|
||||
|
||||
**Active Config**: `/etc/nginx/sites-enabled/rpc-thirdweb`
|
||||
**Domain**: `rpc.public-0138.defi-oracle.io`
|
||||
**IP**: 192.168.11.240
|
||||
|
||||
### Configuration Overview
|
||||
|
||||
- **Port 80**: Returns 204 (no redirect) for RPC clients
|
||||
- **Port 443**: HTTPS server handling both HTTP RPC and WebSocket RPC
|
||||
- **Backend**:
|
||||
- HTTP RPC → `127.0.0.1:8545`
|
||||
- WebSocket RPC → `127.0.0.1:8546` (detected via `$http_upgrade` header)
|
||||
- **SSL**: Cloudflare Origin Certificate
|
||||
- **Cloudflare Integration**: Real IP headers configured for Cloudflare IP ranges
|
||||
|
||||
### Key Features
|
||||
|
||||
- WebSocket detection via `$http_upgrade` header
|
||||
- CORS headers enabled for ThirdWeb web apps
|
||||
- Cloudflare real IP support
|
||||
- Health check endpoint at `/health`
|
||||
|
||||
### Full Configuration
|
||||
|
||||
```nginx
|
||||
# RPC endpoint for rpc.public-0138.defi-oracle.io
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name rpc.public-0138.defi-oracle.io;
|
||||
|
||||
# Avoid redirects for RPC clients (prevents loops and broken POST behavior)
|
||||
return 204;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name rpc.public-0138.defi-oracle.io;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/cloudflare-origin.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/cloudflare-origin.key;
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
|
||||
access_log /var/log/nginx/rpc-thirdweb-access.log;
|
||||
error_log /var/log/nginx/rpc-thirdweb-error.log;
|
||||
|
||||
client_max_body_size 10M;
|
||||
|
||||
proxy_connect_timeout 300s;
|
||||
proxy_send_timeout 300s;
|
||||
proxy_read_timeout 300s;
|
||||
send_timeout 300s;
|
||||
|
||||
# Optional: if you need real client IPs from Cloudflare
|
||||
real_ip_header CF-Connecting-IP;
|
||||
set_real_ip_from 173.245.48.0/20;
|
||||
set_real_ip_from 103.21.244.0/22;
|
||||
set_real_ip_from 103.22.200.0/22;
|
||||
set_real_ip_from 103.31.4.0/22;
|
||||
set_real_ip_from 141.101.64.0/18;
|
||||
set_real_ip_from 108.162.192.0/18;
|
||||
set_real_ip_from 190.93.240.0/20;
|
||||
set_real_ip_from 188.114.96.0/20;
|
||||
set_real_ip_from 197.234.240.0/22;
|
||||
set_real_ip_from 198.41.128.0/17;
|
||||
set_real_ip_from 162.158.0.0/15;
|
||||
set_real_ip_from 104.16.0.0/13;
|
||||
set_real_ip_from 104.24.0.0/14;
|
||||
set_real_ip_from 172.64.0.0/13;
|
||||
set_real_ip_from 131.0.72.0/22;
|
||||
|
||||
location / {
|
||||
# Default backend = HTTP RPC
|
||||
set $backend "http://127.0.0.1:8545";
|
||||
|
||||
# If websocket upgrade requested, use WS backend
|
||||
if ($http_upgrade = "websocket") {
|
||||
set $backend "http://127.0.0.1:8546";
|
||||
}
|
||||
|
||||
proxy_pass $backend;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# WebSocket support (safe defaults)
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
|
||||
# CORS (optional; keep if Thirdweb/browser clients need it)
|
||||
add_header Access-Control-Allow-Origin "*" always;
|
||||
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
|
||||
add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
|
||||
|
||||
if ($request_method = OPTIONS) {
|
||||
return 204;
|
||||
}
|
||||
}
|
||||
|
||||
location /health {
|
||||
access_log off;
|
||||
add_header Content-Type text/plain;
|
||||
return 200 "healthy\n";
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## VMID 2500 - Core RPC Node
|
||||
|
||||
**Active Config**: `/etc/nginx/sites-enabled/rpc-core`
|
||||
**Domains**:
|
||||
- `rpc-core.d-bis.org`
|
||||
- `besu-rpc-1`
|
||||
- `192.168.11.250`
|
||||
- `rpc-core.besu.local`
|
||||
- `rpc-core.chainid138.local`
|
||||
|
||||
**IP**: 192.168.11.250
|
||||
|
||||
### Configuration Overview
|
||||
|
||||
- **Port 80**: HTTP to HTTPS redirect
|
||||
- **Port 443**: HTTPS HTTP RPC API (proxies to `127.0.0.1:8545`)
|
||||
- **Port 8443**: HTTPS WebSocket RPC API (proxies to `127.0.0.1:8546`)
|
||||
- **SSL**: Let's Encrypt certificate (`rpc-core.d-bis.org`)
|
||||
- **Rate Limiting**: Enabled (zones: `rpc_limit`, `rpc_burst`, `conn_limit`)
|
||||
|
||||
### Key Features
|
||||
|
||||
- Rate limiting enabled
|
||||
- Metrics endpoint at `/metrics` (proxies to port 9545)
|
||||
- Separate ports for HTTP RPC (443) and WebSocket RPC (8443)
|
||||
- Health check endpoints
|
||||
|
||||
### Full Configuration
|
||||
|
||||
```nginx
|
||||
# HTTP to HTTPS redirect
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name rpc-core.d-bis.org besu-rpc-1 192.168.11.250 rpc-core.besu.local rpc-core.chainid138.local;
|
||||
|
||||
# Redirect all HTTP to HTTPS
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# HTTPS server - HTTP RPC API (port 8545)
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name rpc-core.d-bis.org besu-rpc-1 192.168.11.250 rpc-core.besu.local rpc-core.chainid138.local rpc-core.chainid138.local;
|
||||
|
||||
# SSL configuration
|
||||
ssl_certificate /etc/letsencrypt/live/rpc-core.d-bis.org/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/rpc-core.d-bis.org/privkey.pem;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_timeout 10m;
|
||||
|
||||
# Security headers
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
# Logging
|
||||
access_log /var/log/nginx/rpc-core-http-access.log;
|
||||
error_log /var/log/nginx/rpc-core-http-error.log;
|
||||
|
||||
# Increase timeouts for RPC calls
|
||||
proxy_connect_timeout 300s;
|
||||
proxy_send_timeout 300s;
|
||||
proxy_read_timeout 300s;
|
||||
send_timeout 300s;
|
||||
client_max_body_size 10M;
|
||||
|
||||
# HTTP RPC endpoint (port 8545)
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8545;
|
||||
limit_req zone=rpc_limit burst=20 nodelay;
|
||||
limit_conn conn_limit 10;
|
||||
|
||||
# Rate limiting
|
||||
proxy_http_version 1.1;
|
||||
|
||||
# Headers
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Connection "";
|
||||
|
||||
# Buffer settings (disable for RPC)
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
|
||||
# CORS headers (if needed for web apps)
|
||||
add_header Access-Control-Allow-Origin * always;
|
||||
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
|
||||
add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
|
||||
|
||||
# Handle OPTIONS requests
|
||||
if ($request_method = OPTIONS) {
|
||||
return 204;
|
||||
}
|
||||
}
|
||||
|
||||
# Health check endpoint
|
||||
location /health {
|
||||
access_log off;
|
||||
return 200 "healthy\n";
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
|
||||
# Metrics endpoint (if exposed)
|
||||
location /metrics {
|
||||
proxy_pass http://127.0.0.1:9545;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
}
|
||||
|
||||
# HTTPS server - WebSocket RPC API (port 8546)
|
||||
server {
|
||||
listen 8443 ssl http2;
|
||||
listen [::]:8443 ssl http2;
|
||||
server_name besu-rpc-1 192.168.11.250 rpc-core-ws.besu.local rpc-core-ws.chainid138.local;
|
||||
|
||||
# SSL configuration
|
||||
ssl_certificate /etc/letsencrypt/live/rpc-core.d-bis.org/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/rpc-core.d-bis.org/privkey.pem;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_timeout 10m;
|
||||
|
||||
# Security headers
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
|
||||
# Logging
|
||||
access_log /var/log/nginx/rpc-core-ws-access.log;
|
||||
error_log /var/log/nginx/rpc-core-ws-error.log;
|
||||
|
||||
# WebSocket RPC endpoint (port 8546)
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8546;
|
||||
limit_req zone=rpc_burst burst=50 nodelay;
|
||||
limit_conn conn_limit 5;
|
||||
|
||||
# Rate limiting
|
||||
proxy_http_version 1.1;
|
||||
|
||||
# WebSocket headers
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# Long timeouts for WebSocket connections
|
||||
proxy_read_timeout 86400;
|
||||
proxy_send_timeout 86400;
|
||||
proxy_connect_timeout 300s;
|
||||
}
|
||||
|
||||
# Health check endpoint
|
||||
location /health {
|
||||
access_log off;
|
||||
return 200 "healthy\n";
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Note**: There's also a `rpc-public` config file that's not currently active.
|
||||
|
||||
---
|
||||
|
||||
## VMID 2501 - Permissioned RPC (JWT Authentication)
|
||||
|
||||
**Active Config**: `/etc/nginx/sites-enabled/rpc-perm`
|
||||
**Domains**:
|
||||
- `rpc-http-prv.d-bis.org` (HTTP RPC with JWT)
|
||||
- `rpc-ws-prv.d-bis.org` (WebSocket RPC with JWT)
|
||||
- `besu-rpc-2`
|
||||
- `192.168.11.251`
|
||||
|
||||
**IP**: 192.168.11.251
|
||||
|
||||
### Configuration Overview
|
||||
|
||||
- **Port 80**: HTTP to HTTPS redirect
|
||||
- **Port 443**: HTTPS servers for both HTTP RPC and WebSocket RPC (same port, different server_name)
|
||||
- **JWT Authentication**: Required for all RPC endpoints (via auth_request to `http://127.0.0.1:8888/validate`)
|
||||
- **SSL**: Self-signed certificate (`/etc/nginx/ssl/rpc.crt`)
|
||||
|
||||
### Key Features
|
||||
|
||||
- JWT authentication using `auth_request` module
|
||||
- JWT validator service running on port 8888
|
||||
- Separate error handling for authentication failures
|
||||
- Health check endpoint (no JWT required)
|
||||
|
||||
### Full Configuration
|
||||
|
||||
```nginx
|
||||
# HTTP to HTTPS redirect
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name rpc-http-prv.d-bis.org rpc-ws-prv.d-bis.org besu-rpc-2 192.168.11.251;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# Internal server for JWT validation
|
||||
server {
|
||||
server_name _;
|
||||
|
||||
location /validate {
|
||||
fastcgi_pass unix:/var/run/fcgiwrap.socket;
|
||||
include fastcgi_params;
|
||||
fastcgi_param SCRIPT_FILENAME /usr/local/bin/jwt-validate.py;
|
||||
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
||||
}
|
||||
}
|
||||
|
||||
# HTTPS server - HTTP RPC API (Permissioned with JWT)
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name rpc-http-prv.d-bis.org besu-rpc-2 192.168.11.251;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/rpc.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/rpc.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
access_log /var/log/nginx/rpc-http-prv-access.log;
|
||||
error_log /var/log/nginx/rpc-http-prv-error.log;
|
||||
|
||||
proxy_connect_timeout 300s;
|
||||
proxy_send_timeout 300s;
|
||||
proxy_read_timeout 300s;
|
||||
send_timeout 300s;
|
||||
|
||||
# JWT authentication using auth_request
|
||||
location = /auth {
|
||||
internal;
|
||||
proxy_pass http://127.0.0.1:8888/validate;
|
||||
proxy_pass_request_body off;
|
||||
proxy_set_header Content-Length "";
|
||||
proxy_set_header X-Original-URI $request_uri;
|
||||
proxy_set_header Authorization $http_authorization;
|
||||
}
|
||||
|
||||
# HTTP RPC endpoint
|
||||
location / {
|
||||
auth_request /auth;
|
||||
auth_request_set $auth_status $upstream_status;
|
||||
|
||||
# Return 401 if auth failed
|
||||
error_page 401 = @auth_failed;
|
||||
|
||||
proxy_pass http://127.0.0.1:8545;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host localhost;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Connection "";
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
}
|
||||
|
||||
# Handle auth failures
|
||||
location @auth_failed {
|
||||
return 401 '{"jsonrpc":"2.0","error":{"code":-32000,"message":"Unauthorized. Missing or invalid JWT token. Use: Authorization: Bearer <token>"},"id":null}';
|
||||
add_header Content-Type application/json;
|
||||
}
|
||||
|
||||
# Health check endpoint (no JWT required)
|
||||
location /health {
|
||||
access_log off;
|
||||
return 200 "healthy\n";
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
}
|
||||
|
||||
# HTTPS server - WebSocket RPC API (Permissioned with JWT)
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name rpc-ws-prv.d-bis.org;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/rpc.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/rpc.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
access_log /var/log/nginx/rpc-ws-prv-access.log;
|
||||
error_log /var/log/nginx/rpc-ws-prv-error.log;
|
||||
|
||||
# JWT authentication for WebSocket connections
|
||||
location = /auth {
|
||||
internal;
|
||||
proxy_pass http://127.0.0.1:8888/validate;
|
||||
proxy_pass_request_body off;
|
||||
proxy_set_header Content-Length "";
|
||||
proxy_set_header X-Original-URI $request_uri;
|
||||
proxy_set_header Authorization $http_authorization;
|
||||
}
|
||||
|
||||
location / {
|
||||
auth_request /auth;
|
||||
auth_request_set $auth_status $upstream_status;
|
||||
|
||||
error_page 401 = @auth_failed;
|
||||
|
||||
proxy_pass http://127.0.0.1:8546;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host localhost;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 86400;
|
||||
proxy_send_timeout 86400;
|
||||
}
|
||||
|
||||
location @auth_failed {
|
||||
return 401 '{"error": "Unauthorized. Missing or invalid JWT token. Use: Authorization: Bearer <token>"}';
|
||||
add_header Content-Type application/json;
|
||||
}
|
||||
|
||||
# Health check endpoint (no JWT required)
|
||||
location /health {
|
||||
access_log off;
|
||||
return 200 "healthy\n";
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Note**: There's also a `rpc-public` config file that's not currently active.
|
||||
|
||||
---
|
||||
|
||||
## VMID 2502 - Public RPC (No Authentication)
|
||||
|
||||
**Active Config**: `/etc/nginx/sites-enabled/rpc`
|
||||
**Domains**:
|
||||
- `rpc-http-prv.d-bis.org` (HTTP RPC - Note: domain name suggests private but config has no auth)
|
||||
- `rpc-ws-prv.d-bis.org` (WebSocket RPC - Note: domain name suggests private but config has no auth)
|
||||
- `rpc-http-pub.d-bis.org` (Public HTTP RPC)
|
||||
- `rpc-ws-pub.d-bis.org` (Public WebSocket RPC)
|
||||
- `besu-rpc-3`
|
||||
- `192.168.11.252`
|
||||
|
||||
**IP**: 192.168.11.252
|
||||
|
||||
### Configuration Overview
|
||||
|
||||
- **Port 80**: HTTP to HTTPS redirect
|
||||
- **Port 443**: HTTPS servers for multiple domains (HTTP RPC and WebSocket RPC)
|
||||
- **Authentication**: None (all endpoints are public)
|
||||
- **SSL**: Self-signed certificate (`/etc/nginx/ssl/rpc.crt`)
|
||||
- **Cloudflare Integration**: Real IP headers configured
|
||||
|
||||
### Key Features
|
||||
|
||||
- No authentication required (public endpoints)
|
||||
- CORS headers enabled
|
||||
- Multiple server blocks for different domain names
|
||||
- Cloudflare real IP support for public domains
|
||||
|
||||
### Configuration Notes
|
||||
|
||||
⚠️ **Important**: The configuration includes server blocks for both `rpc-http-prv.d-bis.org`/`rpc-ws-prv.d-bis.org` (which suggests private endpoints) and `rpc-http-pub.d-bis.org`/`rpc-ws-pub.d-bis.org` (public endpoints), but **none of them require authentication**. This appears to be a configuration where VMID 2502 handles public RPC endpoints, while VMID 2501 handles the authenticated private endpoints.
|
||||
|
||||
### Full Configuration
|
||||
|
||||
The configuration file contains 4 server blocks:
|
||||
1. HTTP to HTTPS redirect (port 80)
|
||||
2. HTTPS server for `rpc-http-prv.d-bis.org` (HTTP RPC, no auth)
|
||||
3. HTTPS server for `rpc-ws-prv.d-bis.org` (WebSocket RPC, no auth)
|
||||
4. HTTPS server for `rpc-http-pub.d-bis.org` (Public HTTP RPC, no auth)
|
||||
5. HTTPS server for `rpc-ws-pub.d-bis.org` (Public WebSocket RPC, no auth)
|
||||
|
||||
All server blocks proxy to:
|
||||
- HTTP RPC: `127.0.0.1:8545`
|
||||
- WebSocket RPC: `127.0.0.1:8546`
|
||||
|
||||
See previous command output for the complete configuration (too long to include here).
|
||||
|
||||
---
|
||||
|
||||
## VMIDs 2503-2508 - No Nginx
|
||||
|
||||
**Status**: Nginx is not installed on these containers
|
||||
|
||||
These VMIDs are Besu validator or sentry nodes that do not expose RPC endpoints, so nginx is not required.
|
||||
|
||||
---
|
||||
|
||||
## Summary of Port Usage
|
||||
|
||||
| VMID | Port 80 | Port 443 | Port 8443 | Purpose |
|
||||
|------|---------|----------|-----------|---------|
|
||||
| 2400 | Returns 204 | HTTP/WebSocket RPC | - | ThirdWeb RPC (Cloudflare Tunnel) |
|
||||
| 2500 | Redirect to 443 | HTTP RPC | WebSocket RPC | Core RPC (internal) |
|
||||
| 2501 | Redirect to 443 | HTTP/WebSocket RPC (JWT) | - | Permissioned RPC |
|
||||
| 2502 | Redirect to 443 | HTTP/WebSocket RPC (public) | - | Public RPC |
|
||||
| 2503-2508 | N/A | N/A | N/A | No nginx installed |
|
||||
|
||||
---
|
||||
|
||||
## SSL Certificates
|
||||
|
||||
| VMID | Certificate Type | Location |
|
||||
|------|-----------------|----------|
|
||||
| 2400 | Cloudflare Origin Certificate | `/etc/nginx/ssl/cloudflare-origin.crt` |
|
||||
| 2500 | Let's Encrypt | `/etc/letsencrypt/live/rpc-core.d-bis.org/` |
|
||||
| 2501 | Self-signed | `/etc/nginx/ssl/rpc.crt` |
|
||||
| 2502 | Self-signed | `/etc/nginx/ssl/rpc.crt` |
|
||||
|
||||
---
|
||||
|
||||
## Access Patterns
|
||||
|
||||
### Public Endpoints (No Authentication)
|
||||
- `rpc.public-0138.defi-oracle.io` (VMID 2400) - ThirdWeb RPC
|
||||
- `rpc-http-pub.d-bis.org` (VMID 2502) - Public HTTP RPC
|
||||
- `rpc-ws-pub.d-bis.org` (VMID 2502) - Public WebSocket RPC
|
||||
|
||||
### Permissioned Endpoints (JWT Authentication Required)
|
||||
- `rpc-http-prv.d-bis.org` (VMID 2501) - Permissioned HTTP RPC
|
||||
- `rpc-ws-prv.d-bis.org` (VMID 2501) - Permissioned WebSocket RPC
|
||||
|
||||
### Internal/Core Endpoints
|
||||
- `rpc-core.d-bis.org` (VMID 2500) - Core RPC node (internal use)
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2026-01-27
|
||||
@@ -54,13 +54,23 @@ Create or update `~/.env` with Omada Controller credentials:
|
||||
|
||||
```bash
|
||||
# Omada Controller Configuration
|
||||
OMADA_CONTROLLER_URL=https://192.168.11.10:8043
|
||||
OMADA_CONTROLLER_URL=https://192.168.11.8:8043
|
||||
OMADA_API_KEY=your-client-id-here
|
||||
OMADA_API_SECRET=your-client-secret-here
|
||||
OMADA_SITE_ID=your-site-id # Optional - will use default site if not provided
|
||||
OMADA_VERIFY_SSL=false # Set to true for production with valid SSL certs
|
||||
```
|
||||
|
||||
**Note:** For automation and scripts, use the `proxmox-controller` API application (Client Credentials mode):
|
||||
- Client ID: `94327608913c41bb9c32ce8d1d6e87d3`
|
||||
- Client Secret: `600b924a541a4139a386cb7c63ac47b5`
|
||||
|
||||
For interactive access, use the `Datacenter-Control-Complete` API application (Authorization Code mode):
|
||||
- Client ID: `8437ff7e3e39452294234ce23bbd105f`
|
||||
- Client Secret: `f2d19e1bdcdd49adabe10f489ce09a79`
|
||||
|
||||
See the [Physical Hardware Inventory](../../config/physical-hardware-inventory.md) for complete API credential details.
|
||||
|
||||
### Finding Your Site ID
|
||||
|
||||
If you don't know your site ID:
|
||||
@@ -168,7 +178,7 @@ import {
|
||||
|
||||
// Initialize client
|
||||
const client = new OmadaClient({
|
||||
baseUrl: 'https://192.168.11.10:8043',
|
||||
baseUrl: 'https://192.168.11.8:8043',
|
||||
clientId: process.env.OMADA_API_KEY!,
|
||||
clientSecret: process.env.OMADA_API_SECRET!,
|
||||
siteId: 'your-site-id',
|
||||
|
||||
117
docs/04-configuration/OMADA_CONFIGURATION_REQUIREMENTS.md
Normal file
117
docs/04-configuration/OMADA_CONFIGURATION_REQUIREMENTS.md
Normal file
@@ -0,0 +1,117 @@
|
||||
# Omada API Configuration Requirements
|
||||
|
||||
**Date:** 2025-01-20
|
||||
**Status:** ⏳ Requires Manual Configuration
|
||||
**Purpose:** Document Omada API configuration requirements
|
||||
|
||||
---
|
||||
|
||||
## Current Status
|
||||
|
||||
The `omada-api/.env` file has placeholder/empty values that need to be configured.
|
||||
|
||||
---
|
||||
|
||||
## Required Configuration
|
||||
|
||||
### File: `omada-api/.env`
|
||||
|
||||
**Current Issues:**
|
||||
- `OMADA_API_KEY=<your-api-key>` - Placeholder value
|
||||
- `OMADA_API_SECRET=` - Empty value
|
||||
|
||||
---
|
||||
|
||||
## Configuration Options
|
||||
|
||||
### Option 1: Omada Controller Local API
|
||||
|
||||
If using local Omada Controller (e.g., at `https://192.168.11.10:8043`):
|
||||
|
||||
1. **Get API Key:**
|
||||
- Log into Omada Controller web interface
|
||||
- Go to Settings → Cloud Access (if available)
|
||||
- Or use Omada Controller API documentation
|
||||
- API key format varies by Omada Controller version
|
||||
|
||||
2. **Update .env:**
|
||||
```bash
|
||||
OMADA_CONTROLLER_URL=https://192.168.11.10:8043
|
||||
OMADA_API_KEY=your-actual-api-key
|
||||
OMADA_API_SECRET=your-api-secret # If required
|
||||
OMADA_SITE_ID=b7335e3ad40ef0df060a922dcf5abdf5
|
||||
OMADA_VERIFY_SSL=false # For self-signed certs
|
||||
```
|
||||
|
||||
### Option 2: Omada Cloud Controller
|
||||
|
||||
If using Omada Cloud Controller (e.g., `https://euw1-omada-northbound.tplinkcloud.com`):
|
||||
|
||||
1. **OAuth Client Credentials:**
|
||||
- Log into Omada Cloud Controller
|
||||
- Create OAuth application/client
|
||||
- Get Client ID and Client Secret
|
||||
|
||||
2. **Update .env:**
|
||||
```bash
|
||||
OMADA_CONTROLLER_URL=https://euw1-omada-northbound.tplinkcloud.com
|
||||
OMADA_CLIENT_ID=f2d19e1bdcdd49adabe10f489ce09a79
|
||||
OMADA_CLIENT_SECRET=8437ff7e3e39452294234ce23bbd105f
|
||||
OMADA_SITE_ID=b7335e3ad40ef0df060a922dcf5abdf5
|
||||
OMADA_VERIFY_SSL=true
|
||||
```
|
||||
|
||||
**Note:** The current `.env` file already has `OMADA_CLIENT_ID` and `OMADA_CLIENT_SECRET` set, so Option 2 may already be configured.
|
||||
|
||||
---
|
||||
|
||||
## Current Configuration Analysis
|
||||
|
||||
Based on the current `.env` file:
|
||||
|
||||
- ✅ `OMADA_CONTROLLER_URL` - Set (cloud controller)
|
||||
- ✅ `OMADA_SITE_ID` - Set
|
||||
- ✅ `OMADA_VERIFY_SSL` - Set
|
||||
- ✅ `OMADA_CLIENT_ID` - Set
|
||||
- ✅ `OMADA_CLIENT_SECRET` - Set
|
||||
- ⚠️ `OMADA_API_KEY` - Has placeholder `<your-api-key>`
|
||||
- ⚠️ `OMADA_API_SECRET` - Empty
|
||||
|
||||
**Recommendation:**
|
||||
- If using OAuth (Client ID/Secret), the `OMADA_API_KEY` and `OMADA_API_SECRET` may not be needed
|
||||
- Remove or comment out unused fields
|
||||
- If API Key is required, get it from Omada Controller
|
||||
|
||||
---
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. **Determine authentication method:**
|
||||
- OAuth (Client ID/Secret) - Already configured
|
||||
- API Key - Needs configuration
|
||||
|
||||
2. **If using OAuth:**
|
||||
- Comment out or remove `OMADA_API_KEY` and `OMADA_API_SECRET`
|
||||
- Verify `OMADA_CLIENT_ID` and `OMADA_CLIENT_SECRET` are correct
|
||||
|
||||
3. **If using API Key:**
|
||||
- Get API key from Omada Controller
|
||||
- Update `OMADA_API_KEY` with actual value
|
||||
- Set `OMADA_API_SECRET` if required
|
||||
|
||||
4. **Test configuration:**
|
||||
- Run Omada API tests/scripts
|
||||
- Verify authentication works
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- Omada Controller API documentation
|
||||
- Omada Cloud Controller documentation
|
||||
- [Required Secrets Inventory](./REQUIRED_SECRETS_INVENTORY.md)
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** 2025-01-20
|
||||
**Status:** ⏳ Requires Manual Configuration
|
||||
530
docs/04-configuration/PROXMOX_ACME_CLOUDFLARE_PLAN.md
Normal file
530
docs/04-configuration/PROXMOX_ACME_CLOUDFLARE_PLAN.md
Normal file
@@ -0,0 +1,530 @@
|
||||
# Proxmox VE ACME Certificate Management Plan - Cloudflare Integration
|
||||
|
||||
**Date:** 2025-01-20
|
||||
**Status:** 📋 Planning Document
|
||||
**Purpose:** Comprehensive plan for SSL/TLS certificate management using ACME with Cloudflare
|
||||
|
||||
---
|
||||
|
||||
## Executive Summary
|
||||
|
||||
This document provides a comprehensive plan for implementing ACME (Automatic Certificate Management Environment) certificate management in Proxmox VE using Cloudflare as the DNS provider. This ensures proper security for all domains and services across hardware installations and VMs.
|
||||
|
||||
---
|
||||
|
||||
## Current Infrastructure
|
||||
|
||||
### Proxmox Nodes
|
||||
- **ml110** (192.168.11.10) - Cluster master
|
||||
- **r630-01** (192.168.11.11)
|
||||
- **r630-02** (192.168.11.12)
|
||||
|
||||
### Services Requiring Certificates
|
||||
- Proxmox VE Web UI (HTTPS on port 8006)
|
||||
- VM/Container web services
|
||||
- API endpoints
|
||||
- Reverse proxy services (nginx, Cloudflare Tunnel)
|
||||
|
||||
---
|
||||
|
||||
## ACME Overview
|
||||
|
||||
**ACME (Automatic Certificate Management Environment):**
|
||||
- Standard protocol for automated certificate management
|
||||
- Proxmox VE has built-in ACME plugin
|
||||
- Supports Let's Encrypt and other ACME-compliant CAs
|
||||
- Automatic renewal before expiration
|
||||
|
||||
**Benefits:**
|
||||
- ✅ Automated certificate provisioning
|
||||
- ✅ Automatic renewal
|
||||
- ✅ No manual intervention required
|
||||
- ✅ Free certificates (Let's Encrypt)
|
||||
- ✅ Secure by default
|
||||
|
||||
---
|
||||
|
||||
## Cloudflare Integration Options
|
||||
|
||||
### Option 1: Cloudflare API Token (Recommended)
|
||||
|
||||
**Method:** DNS-01 Challenge using Cloudflare API
|
||||
- Most secure method
|
||||
- Uses API tokens with minimal permissions
|
||||
- Works for any domain in Cloudflare account
|
||||
- Recommended for production
|
||||
|
||||
### Option 2: Cloudflare Global API Key
|
||||
|
||||
**Method:** DNS-01 Challenge using Global API Key
|
||||
- Less secure (full account access)
|
||||
- Easier initial setup
|
||||
- Not recommended for production
|
||||
|
||||
### Option 3: HTTP-01 Challenge (Limited)
|
||||
|
||||
**Method:** HTTP-01 Challenge
|
||||
- Requires public HTTP access
|
||||
- Not suitable for internal-only services
|
||||
- Limited applicability
|
||||
|
||||
---
|
||||
|
||||
## Implementation Plan
|
||||
|
||||
### Phase 1: Prerequisites and Preparation
|
||||
|
||||
#### 1.1 Cloudflare API Setup
|
||||
|
||||
**Requirements:**
|
||||
- Cloudflare account with domains
|
||||
- API token with DNS edit permissions
|
||||
- Domain list inventory
|
||||
|
||||
**Steps:**
|
||||
1. Create Cloudflare API token
|
||||
- Scope: Zone → DNS → Edit
|
||||
- Zone Resources: All zones (or specific zones)
|
||||
- Token expiration: Set appropriate expiration
|
||||
|
||||
2. Document domains requiring certificates
|
||||
- Proxmox node FQDNs (if configured)
|
||||
- VM/container service domains
|
||||
- API endpoint domains
|
||||
|
||||
3. Verify DNS management
|
||||
- Confirm Cloudflare manages DNS for all domains
|
||||
- Verify DNS records are accessible
|
||||
|
||||
#### 1.2 Proxmox VE Preparation
|
||||
|
||||
**Requirements:**
|
||||
- Proxmox VE 7.0+ (ACME plugin included)
|
||||
- Root or admin access to all nodes
|
||||
- Network connectivity to ACME servers
|
||||
|
||||
**Steps:**
|
||||
1. Verify ACME plugin availability
|
||||
```bash
|
||||
pveversion
|
||||
# Should show version 7.0+
|
||||
```
|
||||
|
||||
2. Check DNS resolution
|
||||
- Verify domains resolve correctly
|
||||
- Test external DNS queries
|
||||
|
||||
3. Prepare certificate storage
|
||||
- Review `/etc/pve/priv/acme/` directory
|
||||
- Plan certificate organization
|
||||
|
||||
---
|
||||
|
||||
### Phase 2: ACME Account Configuration
|
||||
|
||||
#### 2.1 Create ACME Account
|
||||
|
||||
**Location:** Proxmox Web UI → Datacenter → ACME
|
||||
|
||||
**Steps:**
|
||||
1. Navigate to ACME settings
|
||||
2. Add ACME account
|
||||
3. Choose ACME directory:
|
||||
- **Let's Encrypt Production:** `https://acme-v02.api.letsencrypt.org/directory`
|
||||
- **Let's Encrypt Staging:** `https://acme-staging-v02.api.letsencrypt.org/directory` (for testing)
|
||||
|
||||
4. Configure account:
|
||||
- Email: Your contact email
|
||||
- Accept Terms of Service
|
||||
|
||||
5. Test with staging directory first
|
||||
6. Switch to production after verification
|
||||
|
||||
#### 2.2 Configure Cloudflare DNS Plugin
|
||||
|
||||
**Method:** DNS-01 Challenge with Cloudflare API Token
|
||||
|
||||
**Configuration:**
|
||||
1. In ACME account settings, select "DNS Plugin"
|
||||
2. Choose plugin: **cloudflare**
|
||||
3. Configure credentials:
|
||||
- **API Token:** Your Cloudflare API token
|
||||
- **Alternative:** Global API Key + Email (less secure)
|
||||
|
||||
**Security Best Practices:**
|
||||
- ✅ Use API Token (not Global API Key)
|
||||
- ✅ Limit token permissions to DNS edit only
|
||||
- ✅ Use zone-specific tokens when possible
|
||||
- ✅ Store tokens securely (consider secrets management)
|
||||
|
||||
---
|
||||
|
||||
### Phase 3: Certificate Configuration
|
||||
|
||||
#### 3.1 Proxmox Node Certificates
|
||||
|
||||
**Purpose:** Secure Proxmox VE Web UI
|
||||
|
||||
**Configuration:**
|
||||
1. Navigate to: Node → System → Certificates
|
||||
2. Select "ACME" tab
|
||||
3. Add certificate:
|
||||
- **Name:** Descriptive name (e.g., "ml110-cert")
|
||||
- **Domain:** Node FQDN (e.g., `ml110.example.com`)
|
||||
- **ACME Account:** Select configured account
|
||||
- **DNS Plugin:** Select Cloudflare plugin
|
||||
- **Challenge Type:** DNS-01
|
||||
|
||||
4. Generate certificate
|
||||
5. Apply to node
|
||||
6. Repeat for all nodes
|
||||
|
||||
**Domains:**
|
||||
- `ml110.yourdomain.com` (if configured)
|
||||
- `r630-01.yourdomain.com` (if configured)
|
||||
- `r630-02.yourdomain.com` (if configured)
|
||||
- Or use IP-based access with self-signed (current)
|
||||
|
||||
#### 3.2 VM/Container Service Certificates
|
||||
|
||||
**Purpose:** Secure services running in VMs/containers
|
||||
|
||||
**Options:**
|
||||
|
||||
**Option A: Individual Certificates per Service**
|
||||
- Generate separate certificate for each service domain
|
||||
- Most granular control
|
||||
- Suitable for: Multiple domains, different security requirements
|
||||
|
||||
**Option B: Wildcard Certificates**
|
||||
- Generate `*.yourdomain.com` certificate
|
||||
- Single certificate for all subdomains
|
||||
- Suitable for: Many subdomains, simplified management
|
||||
|
||||
**Option C: Multi-Domain Certificates**
|
||||
- Single certificate with multiple SANs
|
||||
- Balance between granularity and simplicity
|
||||
- Suitable for: Related services, limited domains
|
||||
|
||||
**Recommendation:** Start with individual certificates, consider wildcard for subdomains.
|
||||
|
||||
---
|
||||
|
||||
### Phase 4: Domain-Specific Certificate Plan
|
||||
|
||||
#### 4.1 Inventory All Domains
|
||||
|
||||
**Required Information:**
|
||||
- Domain name
|
||||
- Purpose/service
|
||||
- VM/container hosting
|
||||
- Current certificate status
|
||||
- Certificate type needed
|
||||
|
||||
**Example Inventory:**
|
||||
```
|
||||
Domain | Service | VM/Container | Type
|
||||
-------------------------|------------------|--------------|----------
|
||||
proxmox.yourdomain.com | Proxmox UI | ml110 | Individual
|
||||
api.yourdomain.com | API Gateway | VM 100 | Individual
|
||||
*.yourdomain.com | All subdomains | Multiple | Wildcard
|
||||
```
|
||||
|
||||
#### 4.2 Certificate Assignment Strategy
|
||||
|
||||
**Tier 1: Critical Infrastructure**
|
||||
- Proxmox nodes (if using FQDNs)
|
||||
- Core services
|
||||
- API endpoints
|
||||
- Individual certificates with short renewal periods
|
||||
|
||||
**Tier 2: Application Services**
|
||||
- Web applications
|
||||
- Services with public access
|
||||
- Individual or multi-domain certificates
|
||||
|
||||
**Tier 3: Internal Services**
|
||||
- Development environments
|
||||
- Internal-only services
|
||||
- Wildcard or self-signed (with proper internal CA)
|
||||
|
||||
---
|
||||
|
||||
### Phase 5: Implementation Steps
|
||||
|
||||
#### 5.1 Initial Setup (One-Time)
|
||||
|
||||
1. **Create Cloudflare API Token**
|
||||
```bash
|
||||
# Via Cloudflare Dashboard:
|
||||
# My Profile → API Tokens → Create Token
|
||||
# Template: Edit zone DNS
|
||||
# Permissions: Zone → DNS → Edit
|
||||
# Zone Resources: All zones or specific zones
|
||||
```
|
||||
|
||||
2. **Configure ACME Account in Proxmox**
|
||||
- Use Proxmox Web UI or CLI
|
||||
- Add account with Cloudflare plugin
|
||||
- Test with staging environment first
|
||||
|
||||
3. **Verify DNS Resolution**
|
||||
```bash
|
||||
# Test domain resolution
|
||||
dig yourdomain.com +short
|
||||
nslookup yourdomain.com
|
||||
```
|
||||
|
||||
#### 5.2 Certificate Generation (Per Domain)
|
||||
|
||||
**Via Proxmox Web UI:**
|
||||
1. Navigate to ACME settings
|
||||
2. Add certificate
|
||||
3. Configure domain and plugin
|
||||
4. Generate certificate
|
||||
5. Apply to service
|
||||
|
||||
**Via CLI (Alternative):**
|
||||
```bash
|
||||
# Add ACME account
|
||||
pvesh create /cluster/acme/account --directory-url https://acme-v02.api.letsencrypt.org/directory --contact email@example.com
|
||||
|
||||
# Register account
|
||||
pvesh create /cluster/acme/account/test-account/register
|
||||
|
||||
# Generate certificate
|
||||
pvesh create /cluster/acme/certificate --account test-account --domain yourdomain.com --dns cloudflare --plugin cloudflare --api-token YOUR_TOKEN
|
||||
```
|
||||
|
||||
#### 5.3 Certificate Application
|
||||
|
||||
**For Proxmox Nodes:**
|
||||
- Apply via Web UI: Node → System → Certificates
|
||||
- Automatically updates web interface
|
||||
- Requires service restart
|
||||
|
||||
**For VM/Container Services:**
|
||||
- Copy certificate files to VM/container
|
||||
- Configure service to use certificate
|
||||
- Update service configuration
|
||||
- Restart service
|
||||
|
||||
**Certificate File Locations:**
|
||||
- Certificate: `/etc/pve/nodes/<node>/pve-ssl.pem`
|
||||
- Private Key: `/etc/pve/nodes/<node>/pve-ssl.key`
|
||||
- Full Chain: Combined certificate + chain
|
||||
|
||||
---
|
||||
|
||||
### Phase 6: Certificate Renewal and Maintenance
|
||||
|
||||
#### 6.1 Automatic Renewal
|
||||
|
||||
**Proxmox VE Automatic Renewal:**
|
||||
- Built-in renewal mechanism
|
||||
- Runs automatically before expiration
|
||||
- Typically renews 30 days before expiry
|
||||
- No manual intervention required
|
||||
|
||||
**Verification:**
|
||||
- Monitor certificate expiration dates
|
||||
- Check renewal logs
|
||||
- Set up monitoring/alerting
|
||||
|
||||
#### 6.2 Monitoring and Alerts
|
||||
|
||||
**Monitoring Points:**
|
||||
- Certificate expiration dates
|
||||
- Renewal success/failure
|
||||
- Service availability after renewal
|
||||
- DNS challenge success rate
|
||||
|
||||
**Alerting Options:**
|
||||
- Proxmox VE logs
|
||||
- External monitoring tools
|
||||
- Email notifications (configured in ACME account)
|
||||
|
||||
#### 6.3 Backup and Recovery
|
||||
|
||||
**Certificate Backup:**
|
||||
- Backup `/etc/pve/priv/acme/` directory
|
||||
- Backup certificate files
|
||||
- Store API tokens securely
|
||||
- Document certificate configuration
|
||||
|
||||
**Recovery Procedures:**
|
||||
- Restore certificates from backup
|
||||
- Re-generate if needed
|
||||
- Update service configurations
|
||||
|
||||
---
|
||||
|
||||
## Security Best Practices
|
||||
|
||||
### 1. API Token Security
|
||||
|
||||
**Recommendations:**
|
||||
- ✅ Use API Tokens (not Global API Key)
|
||||
- ✅ Minimal required permissions
|
||||
- ✅ Zone-specific tokens when possible
|
||||
- ✅ Token rotation schedule
|
||||
- ✅ Secure storage (encrypted, access-controlled)
|
||||
|
||||
### 2. Certificate Security
|
||||
|
||||
**Recommendations:**
|
||||
- ✅ Use strong key sizes (RSA 2048+ or ECDSA P-256+)
|
||||
- ✅ Enable HSTS where applicable
|
||||
- ✅ Use TLS 1.2+ only
|
||||
- ✅ Proper certificate chain validation
|
||||
- ✅ Secure private key storage
|
||||
|
||||
### 3. Access Control
|
||||
|
||||
**Recommendations:**
|
||||
- ✅ Limit ACME account access
|
||||
- ✅ Role-based access control
|
||||
- ✅ Audit certificate operations
|
||||
- ✅ Secure credential storage
|
||||
|
||||
### 4. Network Security
|
||||
|
||||
**Recommendations:**
|
||||
- ✅ Firewall rules for ACME endpoints
|
||||
- ✅ DNS security (DNSSEC)
|
||||
- ✅ Monitor for certificate abuse
|
||||
- ✅ Rate limiting awareness
|
||||
|
||||
---
|
||||
|
||||
## Domain Inventory Template
|
||||
|
||||
```markdown
|
||||
## Domain Certificate Inventory
|
||||
|
||||
### Proxmox Nodes
|
||||
| Node | Domain (if configured) | Certificate Type | Status |
|
||||
|---------|------------------------|------------------|--------|
|
||||
| ml110 | ml110.yourdomain.com | Individual | ⏳ Pending |
|
||||
| r630-01 | r630-01.yourdomain.com | Individual | ⏳ Pending |
|
||||
| r630-02 | r630-02.yourdomain.com | Individual | ⏳ Pending |
|
||||
|
||||
### VM/Container Services
|
||||
| VMID | Service | Domain | Certificate Type | Status |
|
||||
|------|----------------|---------------------|------------------|--------|
|
||||
| 100 | Mail Gateway | mail.yourdomain.com | Individual | ⏳ Pending |
|
||||
| 104 | Gitea | git.yourdomain.com | Individual | ⏳ Pending |
|
||||
| ... | ... | ... | ... | ... |
|
||||
|
||||
### Wildcard Certificates
|
||||
| Domain Pattern | Purpose | Status |
|
||||
|---------------------|------------------|--------|
|
||||
| *.yourdomain.com | All subdomains | ⏳ Pending |
|
||||
| *.api.yourdomain.com| API subdomains | ⏳ Pending |
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Implementation Checklist
|
||||
|
||||
### Pre-Implementation
|
||||
- [ ] Inventory all domains requiring certificates
|
||||
- [ ] Create Cloudflare API token
|
||||
- [ ] Document current certificate status
|
||||
- [ ] Plan certificate assignment strategy
|
||||
- [ ] Test with staging environment
|
||||
|
||||
### Implementation
|
||||
- [ ] Configure ACME account in Proxmox
|
||||
- [ ] Configure Cloudflare DNS plugin
|
||||
- [ ] Generate test certificate (staging)
|
||||
- [ ] Verify certificate generation works
|
||||
- [ ] Switch to production ACME directory
|
||||
- [ ] Generate production certificates
|
||||
- [ ] Apply certificates to services
|
||||
- [ ] Verify services work with new certificates
|
||||
|
||||
### Post-Implementation
|
||||
- [ ] Monitor certificate expiration
|
||||
- [ ] Verify automatic renewal works
|
||||
- [ ] Set up monitoring/alerting
|
||||
- [ ] Document certificate locations
|
||||
- [ ] Create backup procedures
|
||||
- [ ] Train team on certificate management
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Common Issues
|
||||
|
||||
**1. DNS Challenge Fails**
|
||||
- Verify API token permissions
|
||||
- Check DNS propagation
|
||||
- Verify domain is in Cloudflare account
|
||||
- Check token expiration
|
||||
|
||||
**2. Certificate Generation Fails**
|
||||
- Check ACME account status
|
||||
- Verify domain ownership
|
||||
- Check rate limits (Let's Encrypt)
|
||||
- Review logs: `/var/log/pveproxy/access.log`
|
||||
|
||||
**3. Certificate Renewal Fails**
|
||||
- Check automatic renewal configuration
|
||||
- Verify DNS plugin still works
|
||||
- Check API token validity
|
||||
- Review renewal logs
|
||||
|
||||
**4. Service Not Using New Certificate**
|
||||
- Verify certificate is applied to node
|
||||
- Check service configuration
|
||||
- Restart service
|
||||
- Verify certificate file locations
|
||||
|
||||
---
|
||||
|
||||
## Alternative: External Certificate Management
|
||||
|
||||
If Proxmox ACME doesn't meet requirements:
|
||||
|
||||
### Option: Certbot with Cloudflare Plugin
|
||||
- Install certbot on VM/container
|
||||
- Use certbot-dns-cloudflare plugin
|
||||
- Manual or automated renewal
|
||||
- More control, more complexity
|
||||
|
||||
### Option: External ACME Client
|
||||
- Use external ACME client (acme.sh, cert-manager)
|
||||
- Generate certificates externally
|
||||
- Copy to Proxmox/VMs
|
||||
- More flexibility, manual integration
|
||||
|
||||
---
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. **Complete domain inventory**
|
||||
2. **Create Cloudflare API token**
|
||||
3. **Configure ACME account (staging)**
|
||||
4. **Test certificate generation**
|
||||
5. **Switch to production**
|
||||
6. **Generate certificates for all domains**
|
||||
7. **Apply and verify**
|
||||
8. **Monitor and maintain**
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [Proxmox VE ACME Documentation](https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_certificate_management)
|
||||
- [Cloudflare API Token Guide](https://developers.cloudflare.com/api/tokens/)
|
||||
- [Let's Encrypt Documentation](https://letsencrypt.org/docs/)
|
||||
- Domain Structure: `docs/02-architecture/DOMAIN_STRUCTURE.md`
|
||||
- Cloudflare API Setup: `CLOUDFLARE_API_SETUP.md`
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** 2025-01-20
|
||||
**Status:** 📋 Planning Document
|
||||
**Next Review:** After implementation
|
||||
172
docs/04-configuration/PROXMOX_ACME_QUICK_REFERENCE.md
Normal file
172
docs/04-configuration/PROXMOX_ACME_QUICK_REFERENCE.md
Normal file
@@ -0,0 +1,172 @@
|
||||
# Proxmox ACME Certificate Management - Quick Reference
|
||||
|
||||
**Date:** 2025-01-20
|
||||
**Status:** 📋 Quick Reference Guide
|
||||
**Purpose:** Quick commands and steps for ACME certificate management
|
||||
|
||||
---
|
||||
|
||||
## Quick Setup Checklist
|
||||
|
||||
- [ ] Create Cloudflare API token
|
||||
- [ ] Configure ACME account in Proxmox
|
||||
- [ ] Configure Cloudflare DNS plugin
|
||||
- [ ] Test with staging environment
|
||||
- [ ] Generate production certificates
|
||||
- [ ] Apply certificates to services
|
||||
- [ ] Monitor expiration
|
||||
|
||||
---
|
||||
|
||||
## Cloudflare API Token Creation
|
||||
|
||||
1. Go to: https://dash.cloudflare.com/profile/api-tokens
|
||||
2. Click "Create Token"
|
||||
3. Use "Edit zone DNS" template
|
||||
4. Permissions: Zone → DNS → Edit
|
||||
5. Zone Resources: All zones (or specific)
|
||||
6. Copy token
|
||||
|
||||
---
|
||||
|
||||
## Proxmox Web UI Steps
|
||||
|
||||
### 1. Add ACME Account
|
||||
|
||||
**Location:** Datacenter → ACME → Accounts → Add
|
||||
|
||||
**Configuration:**
|
||||
- Directory URL: `https://acme-v02.api.letsencrypt.org/directory` (Production)
|
||||
- Email: your-email@example.com
|
||||
- Accept Terms of Service
|
||||
|
||||
### 2. Add DNS Plugin
|
||||
|
||||
**Location:** Datacenter → ACME → DNS Plugins → Add
|
||||
|
||||
**Configuration:**
|
||||
- Plugin: `cloudflare`
|
||||
- API Token: Your Cloudflare API token
|
||||
|
||||
### 3. Generate Certificate
|
||||
|
||||
**Location:** Node → System → Certificates → ACME → Add
|
||||
|
||||
**Configuration:**
|
||||
- Domain: your-domain.com
|
||||
- ACME Account: Select your account
|
||||
- DNS Plugin: Select cloudflare
|
||||
- Challenge Type: DNS-01
|
||||
|
||||
---
|
||||
|
||||
## CLI Commands
|
||||
|
||||
### List ACME Accounts
|
||||
```bash
|
||||
pvesh get /cluster/acme/accounts
|
||||
```
|
||||
|
||||
### List DNS Plugins
|
||||
```bash
|
||||
pvesh get /cluster/acme/plugins
|
||||
```
|
||||
|
||||
### List Certificates
|
||||
```bash
|
||||
pvesh get /cluster/acme/certificates
|
||||
```
|
||||
|
||||
### Add ACME Account (CLI)
|
||||
```bash
|
||||
pvesh create /cluster/acme/account \
|
||||
--directory-url https://acme-v02.api.letsencrypt.org/directory \
|
||||
--contact email@example.com
|
||||
```
|
||||
|
||||
### Register Account
|
||||
```bash
|
||||
pvesh create /cluster/acme/account/account-name/register
|
||||
```
|
||||
|
||||
### Generate Certificate (CLI)
|
||||
```bash
|
||||
pvesh create /cluster/acme/certificate \
|
||||
--account account-name \
|
||||
--domain example.com \
|
||||
--dns cloudflare \
|
||||
--plugin cloudflare
|
||||
```
|
||||
|
||||
### Check Certificate Expiration
|
||||
```bash
|
||||
openssl x509 -in /etc/pve/nodes/<node>/pve-ssl.pem -noout -dates
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Certificate File Locations
|
||||
|
||||
### Node Certificates
|
||||
- Certificate: `/etc/pve/nodes/<node>/pve-ssl.pem`
|
||||
- Private Key: `/etc/pve/nodes/<node>/pve-ssl.key`
|
||||
|
||||
### ACME Configuration
|
||||
- Accounts: `/etc/pve/priv/acme/`
|
||||
- Certificates: `/etc/pve/nodes/<node>/`
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Certificate Generation Fails
|
||||
|
||||
**Check:**
|
||||
1. API token permissions
|
||||
2. DNS resolution
|
||||
3. Domain ownership
|
||||
4. Rate limits (Let's Encrypt)
|
||||
5. Logs: `/var/log/pveproxy/access.log`
|
||||
|
||||
### Renewal Fails
|
||||
|
||||
**Check:**
|
||||
1. API token validity
|
||||
2. DNS plugin configuration
|
||||
3. Automatic renewal settings
|
||||
4. Certificate expiration date
|
||||
|
||||
### Service Not Using Certificate
|
||||
|
||||
**Check:**
|
||||
1. Certificate applied to node
|
||||
2. Service configuration
|
||||
3. Service restarted
|
||||
4. Certificate file permissions
|
||||
|
||||
---
|
||||
|
||||
## Security Best Practices
|
||||
|
||||
✅ Use API Tokens (not Global API Key)
|
||||
✅ Limit token permissions
|
||||
✅ Store tokens securely
|
||||
✅ Test with staging first
|
||||
✅ Monitor expiration dates
|
||||
✅ Use strong key sizes
|
||||
✅ Enable HSTS where applicable
|
||||
|
||||
---
|
||||
|
||||
## Useful Links
|
||||
|
||||
- [Full Plan Document](./PROXMOX_ACME_CLOUDFLARE_PLAN.md)
|
||||
- [Domain Inventory Template](./PROXMOX_ACME_DOMAIN_INVENTORY.md)
|
||||
- [Proxmox ACME Docs](https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_certificate_management)
|
||||
- [Cloudflare API Docs](https://developers.cloudflare.com/api/)
|
||||
- [Let's Encrypt Docs](https://letsencrypt.org/docs/)
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** 2025-01-20
|
||||
**Status:** 📋 Quick Reference
|
||||
@@ -9,7 +9,8 @@ This directory contains setup and configuration guides.
|
||||
- **[CREDENTIALS_CONFIGURED.md](CREDENTIALS_CONFIGURED.md)** ⭐ - Credentials configuration guide
|
||||
- **[SECRETS_KEYS_CONFIGURATION.md](SECRETS_KEYS_CONFIGURATION.md)** ⭐⭐ - Secrets and keys management
|
||||
- **[SSH_SETUP.md](SSH_SETUP.md)** ⭐ - SSH key setup and configuration
|
||||
- **[finalize-token.md](finalize-token.md)** ⭐ - Token finalization guide
|
||||
- **[FINALIZE_TOKEN.md](FINALIZE_TOKEN.md)** ⭐ - Token finalization guide
|
||||
- **[cloudflare/](cloudflare/)** ⭐⭐⭐ - Cloudflare configuration documentation
|
||||
- **[ER605_ROUTER_CONFIGURATION.md](ER605_ROUTER_CONFIGURATION.md)** ⭐⭐ - ER605 router configuration
|
||||
- **[OMADA_API_SETUP.md](OMADA_API_SETUP.md)** ⭐⭐ - Omada API integration setup
|
||||
- **[OMADA_HARDWARE_CONFIGURATION_REVIEW.md](OMADA_HARDWARE_CONFIGURATION_REVIEW.md)** ⭐⭐⭐ - Comprehensive Omada hardware and configuration review
|
||||
|
||||
353
docs/04-configuration/REQUIRED_SECRETS_INVENTORY.md
Normal file
353
docs/04-configuration/REQUIRED_SECRETS_INVENTORY.md
Normal file
@@ -0,0 +1,353 @@
|
||||
# Required Secrets and Environment Variables Inventory
|
||||
|
||||
**Date:** 2025-01-20
|
||||
**Status:** 📋 Comprehensive Inventory
|
||||
**Purpose:** Track all required secrets and environment variables across the infrastructure
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
This document provides a comprehensive inventory of all required secrets and environment variables needed for the Proxmox infrastructure, services, and integrations.
|
||||
|
||||
---
|
||||
|
||||
## Critical Secrets (High Priority)
|
||||
|
||||
### 1. Cloudflare API Credentials
|
||||
|
||||
#### Cloudflare API Token (Recommended)
|
||||
- **Variable:** `CLOUDFLARE_API_TOKEN`
|
||||
- **Purpose:** Programmatic access to Cloudflare API
|
||||
- **Used For:**
|
||||
- DNS record management
|
||||
- Tunnel configuration
|
||||
- ACME DNS-01 challenges
|
||||
- Automated Cloudflare operations
|
||||
- **Creation:** https://dash.cloudflare.com/profile/api-tokens
|
||||
- **Permissions Required:**
|
||||
- Zone → DNS → Edit
|
||||
- Account → Cloudflare Tunnel → Edit (for tunnel management)
|
||||
- **Security:** Use API tokens (not Global API Key)
|
||||
- **Status:** ⚠️ Required
|
||||
|
||||
#### Cloudflare Global API Key (Legacy - Not Recommended)
|
||||
- **Variable:** `CLOUDFLARE_API_KEY`
|
||||
- **Variable:** `CLOUDFLARE_EMAIL`
|
||||
- **Purpose:** Legacy API authentication
|
||||
- **Status:** ⚠️ Deprecated - Use API Token instead
|
||||
|
||||
#### Cloudflare Zone ID
|
||||
- **Variable:** `CLOUDFLARE_ZONE_ID`
|
||||
- **Purpose:** Identify specific Cloudflare zone
|
||||
- **Used For:** API operations on specific zones
|
||||
- **Status:** ⚠️ Required (can be auto-detected with API token)
|
||||
|
||||
#### Cloudflare Account ID
|
||||
- **Variable:** `CLOUDFLARE_ACCOUNT_ID`
|
||||
- **Purpose:** Identify Cloudflare account
|
||||
- **Used For:** Tunnel operations, account-level API calls
|
||||
- **Status:** ⚠️ Required (can be auto-detected with API token)
|
||||
|
||||
#### Cloudflare Tunnel Token
|
||||
- **Variable:** `TUNNEL_TOKEN` or `CLOUDFLARE_TUNNEL_TOKEN`
|
||||
- **Purpose:** Authenticate cloudflared service
|
||||
- **Used For:** Cloudflare Tunnel connections
|
||||
- **Creation:** Cloudflare Zero Trust Dashboard
|
||||
- **Status:** ⚠️ Required for tunnel services
|
||||
|
||||
---
|
||||
|
||||
### 2. Proxmox Access Credentials
|
||||
|
||||
#### Proxmox Host Passwords
|
||||
- **Variable:** `PROXMOX_PASS_ML110` or `PROXMOX_HOST_ML110_PASSWORD`
|
||||
- **Variable:** `PROXMOX_PASS_R630_01` or `PROXMOX_HOST_R630_01_PASSWORD`
|
||||
- **Variable:** `PROXMOX_PASS_R630_02` or `PROXMOX_HOST_R630_02_PASSWORD`
|
||||
- **Purpose:** SSH/API access to Proxmox nodes
|
||||
- **Used For:** Scripted operations, automation
|
||||
- **Default:** Various (check physical hardware inventory)
|
||||
- **Status:** ⚠️ Required for automation scripts
|
||||
|
||||
#### Proxmox API Tokens
|
||||
- **Variable:** `PROXMOX_API_TOKEN`
|
||||
- **Variable:** `PROXMOX_API_SECRET`
|
||||
- **Purpose:** Proxmox API authentication
|
||||
- **Used For:** API-based operations
|
||||
- **Status:** ⚠️ Optional (alternative to passwords)
|
||||
|
||||
---
|
||||
|
||||
### 3. Service-Specific Secrets
|
||||
|
||||
#### Database Credentials
|
||||
- **Variable:** `POSTGRES_PASSWORD`
|
||||
- **Variable:** `POSTGRES_USER`
|
||||
- **Variable:** `DATABASE_URL`
|
||||
- **Purpose:** Database access
|
||||
- **Used For:** Database connections
|
||||
- **Status:** ⚠️ Required for database services
|
||||
|
||||
#### Redis Credentials
|
||||
- **Variable:** `REDIS_PASSWORD`
|
||||
- **Variable:** `REDIS_URL`
|
||||
- **Purpose:** Redis cache access
|
||||
- **Status:** ⚠️ Required if Redis authentication enabled
|
||||
|
||||
#### JWT Secrets
|
||||
- **Variable:** `JWT_SECRET`
|
||||
- **Variable:** `JWT_PRIVATE_KEY`
|
||||
- **Purpose:** JWT token signing
|
||||
- **Used For:** API authentication
|
||||
- **Status:** ⚠️ Required for services using JWT
|
||||
|
||||
---
|
||||
|
||||
## Domain and DNS Configuration
|
||||
|
||||
### Domain Variables
|
||||
- **Variable:** `DOMAIN`
|
||||
- **Variable:** `PRIMARY_DOMAIN`
|
||||
- **Purpose:** Primary domain name
|
||||
- **Examples:** `d-bis.org`, `defi-oracle.io`
|
||||
- **Status:** ⚠️ Required for DNS/SSL operations
|
||||
|
||||
### DNS Configuration
|
||||
- **Variable:** `DNS_PROVIDER`
|
||||
- **Variable:** `DNS_API_ENDPOINT`
|
||||
- **Purpose:** DNS provider configuration
|
||||
- **Status:** ℹ️ Optional (defaults to Cloudflare)
|
||||
|
||||
---
|
||||
|
||||
## Blockchain/ChainID 138 Specific
|
||||
|
||||
### RPC Configuration
|
||||
- **Variable:** `CHAIN_ID`
|
||||
- **Variable:** `RPC_ENDPOINT`
|
||||
- **Variable:** `RPC_NODE_URL`
|
||||
- **Purpose:** Blockchain RPC configuration
|
||||
- **Status:** ⚠️ Required for blockchain services
|
||||
|
||||
### Private Keys (Critical Security)
|
||||
- **Variable:** `VALIDATOR_PRIVATE_KEY`
|
||||
- **Variable:** `NODE_PRIVATE_KEY`
|
||||
- **Purpose:** Blockchain node/validator keys
|
||||
- **Security:** 🔒 EXTREMELY SENSITIVE - Use secure storage
|
||||
- **Status:** ⚠️ Required for validators/nodes
|
||||
|
||||
---
|
||||
|
||||
## Third-Party Service Integrations
|
||||
|
||||
### Azure (if used)
|
||||
- **Variable:** `AZURE_SUBSCRIPTION_ID`
|
||||
- **Variable:** `AZURE_TENANT_ID`
|
||||
- **Variable:** `AZURE_CLIENT_ID`
|
||||
- **Variable:** `AZURE_CLIENT_SECRET`
|
||||
- **Status:** ℹ️ Required if using Azure services
|
||||
|
||||
### Other Cloud Providers
|
||||
- **Variable:** `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`
|
||||
- **Variable:** `GCP_PROJECT_ID` / `GCP_SERVICE_ACCOUNT_KEY`
|
||||
- **Status:** ℹ️ Required if using respective cloud services
|
||||
|
||||
---
|
||||
|
||||
## Application-Specific Variables
|
||||
|
||||
### DBIS Services
|
||||
- **Variable:** `DBIS_DATABASE_URL`
|
||||
- **Variable:** `DBIS_API_KEY`
|
||||
- **Variable:** `DBIS_SECRET_KEY`
|
||||
- **Status:** ⚠️ Required for DBIS services
|
||||
|
||||
### Blockscout
|
||||
- **Variable:** `BLOCKSCOUT_DATABASE_URL`
|
||||
- **Variable:** `BLOCKSCOUT_SECRET_KEY_BASE`
|
||||
- **Variable:** `BLOCKSCOUT_ETHERSCAN_API_KEY`
|
||||
- **Status:** ⚠️ Required for Blockscout explorer
|
||||
|
||||
### Other Services
|
||||
- Service-specific variables as documented per service
|
||||
- Check individual service documentation
|
||||
|
||||
---
|
||||
|
||||
## Network Configuration
|
||||
|
||||
### IP Addresses
|
||||
- **Variable:** `PROXMOX_HOST_ML110` (192.168.11.10)
|
||||
- **Variable:** `PROXMOX_HOST_R630_01` (192.168.11.11)
|
||||
- **Variable:** `PROXMOX_HOST_R630_02` (192.168.11.12)
|
||||
- **Purpose:** Proxmox node IP addresses
|
||||
- **Status:** ⚠️ Required for scripts
|
||||
|
||||
### Network Credentials
|
||||
- **Variable:** `OMADA_USERNAME`
|
||||
- **Variable:** `OMADA_PASSWORD`
|
||||
- **Purpose:** Omada controller access
|
||||
- **Status:** ⚠️ Required for network automation
|
||||
|
||||
---
|
||||
|
||||
## Security and Monitoring
|
||||
|
||||
### Monitoring Tools
|
||||
- **Variable:** `GRAFANA_ADMIN_PASSWORD`
|
||||
- **Variable:** `PROMETHEUS_BASIC_AUTH_PASSWORD`
|
||||
- **Status:** ⚠️ Required if monitoring enabled
|
||||
|
||||
### Alerting
|
||||
- **Variable:** `ALERT_EMAIL`
|
||||
- **Variable:** `SLACK_WEBHOOK_URL`
|
||||
- **Variable:** `DISCORD_WEBHOOK_URL`
|
||||
- **Status:** ℹ️ Optional
|
||||
|
||||
---
|
||||
|
||||
## Environment-Specific Configuration
|
||||
|
||||
### Development
|
||||
- **Variable:** `NODE_ENV=development`
|
||||
- **Variable:** `DEBUG=true`
|
||||
- **Status:** ℹ️ Development-specific
|
||||
|
||||
### Production
|
||||
- **Variable:** `NODE_ENV=production`
|
||||
- **Variable:** `DEBUG=false`
|
||||
- **Status:** ⚠️ Production configuration
|
||||
|
||||
### Staging
|
||||
- **Variable:** `NODE_ENV=staging`
|
||||
- **Status:** ℹ️ Staging environment
|
||||
|
||||
---
|
||||
|
||||
## Required Secrets Checklist
|
||||
|
||||
### Critical (Must Have)
|
||||
- [ ] `CLOUDFLARE_API_TOKEN` - Cloudflare API access
|
||||
- [ ] `CLOUDFLARE_ZONE_ID` - Cloudflare zone identification
|
||||
- [ ] `TUNNEL_TOKEN` - Cloudflare Tunnel authentication (if using tunnels)
|
||||
- [ ] Proxmox node passwords - SSH/API access
|
||||
- [ ] Database passwords - Service database access
|
||||
- [ ] Domain configuration - Primary domain name
|
||||
|
||||
### High Priority
|
||||
- [ ] `JWT_SECRET` - API authentication
|
||||
- [ ] Service-specific API keys
|
||||
- [ ] Private keys (if applicable)
|
||||
- [ ] Monitoring credentials
|
||||
|
||||
### Medium Priority
|
||||
- [ ] Third-party service credentials
|
||||
- [ ] Alerting webhooks
|
||||
- [ ] Backup storage credentials
|
||||
|
||||
### Low Priority / Optional
|
||||
- [ ] Development-only variables
|
||||
- [ ] Debug flags
|
||||
- [ ] Optional integrations
|
||||
|
||||
---
|
||||
|
||||
## Secret Storage Best Practices
|
||||
|
||||
### 1. Secure Storage
|
||||
- ✅ Use secrets management systems (HashiCorp Vault, AWS Secrets Manager, etc.)
|
||||
- ✅ Encrypt sensitive values at rest
|
||||
- ✅ Use environment-specific secret stores
|
||||
- ❌ Don't commit secrets to git
|
||||
- ❌ Don't store in plain text files
|
||||
|
||||
### 2. Access Control
|
||||
- ✅ Limit access to secrets (principle of least privilege)
|
||||
- ✅ Rotate secrets regularly
|
||||
- ✅ Use separate secrets for different environments
|
||||
- ✅ Audit secret access
|
||||
|
||||
### 3. Documentation
|
||||
- ✅ Document which services need which secrets
|
||||
- ✅ Use .env.example files (without real values)
|
||||
- ✅ Maintain this inventory
|
||||
- ✅ Document secret rotation procedures
|
||||
|
||||
### 4. Development Practices
|
||||
- ✅ Use different secrets for dev/staging/prod
|
||||
- ✅ Never use production secrets in development
|
||||
- ✅ Use placeholder values in templates
|
||||
- ✅ Validate required secrets on startup
|
||||
|
||||
---
|
||||
|
||||
## Secret Verification
|
||||
|
||||
### Script Available
|
||||
**Script:** `scripts/check-env-secrets.sh`
|
||||
|
||||
**Usage:**
|
||||
```bash
|
||||
./scripts/check-env-secrets.sh
|
||||
```
|
||||
|
||||
**What it does:**
|
||||
- Scans all .env files
|
||||
- Identifies empty variables
|
||||
- Detects placeholder values
|
||||
- Lists all variables found
|
||||
- Provides recommendations
|
||||
|
||||
---
|
||||
|
||||
## Environment File Locations
|
||||
|
||||
### Expected Locations
|
||||
- `.env` - Root directory (main configuration)
|
||||
- `config/.env` - Configuration directory
|
||||
- `config/production/.env.production` - Production-specific
|
||||
- Service-specific: `*/config/.env`, `*/.env.local`
|
||||
|
||||
### Template Files
|
||||
- `.env.example` - Template with variable names
|
||||
- `.env.template` - Alternative template format
|
||||
- `config/*.template` - Configuration templates
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [Cloudflare API Setup](../CLOUDFLARE_API_SETUP.md)
|
||||
- [Physical Hardware Inventory](../../docs/02-architecture/PHYSICAL_HARDWARE_INVENTORY.md)
|
||||
- [Proxmox ACME Plan](./PROXMOX_ACME_CLOUDFLARE_PLAN.md)
|
||||
- [Domain Structure](../../docs/02-architecture/DOMAIN_STRUCTURE.md)
|
||||
|
||||
---
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. **Audit Current Secrets**
|
||||
- Run `scripts/check-env-secrets.sh`
|
||||
- Review this inventory
|
||||
- Identify missing secrets
|
||||
|
||||
2. **Create/Update .env Files**
|
||||
- Use templates as reference
|
||||
- Set all required values
|
||||
- Remove placeholder values
|
||||
|
||||
3. **Secure Storage**
|
||||
- Implement secrets management
|
||||
- Encrypt sensitive values
|
||||
- Set up access controls
|
||||
|
||||
4. **Documentation**
|
||||
- Update service-specific docs
|
||||
- Create .env.example files
|
||||
- Document secret rotation
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** 2025-01-20
|
||||
**Status:** 📋 Comprehensive Inventory
|
||||
**Next Review:** After secret audit
|
||||
155
docs/04-configuration/REQUIRED_SECRETS_SUMMARY.md
Normal file
155
docs/04-configuration/REQUIRED_SECRETS_SUMMARY.md
Normal file
@@ -0,0 +1,155 @@
|
||||
# Required Secrets Summary - Quick Reference
|
||||
|
||||
**Date:** 2025-01-20
|
||||
**Status:** 📋 Quick Reference
|
||||
**Purpose:** Quick checklist of all required secrets
|
||||
|
||||
---
|
||||
|
||||
## Critical Secrets (Must Have)
|
||||
|
||||
### ✅ Configured
|
||||
|
||||
#### Cloudflare (Root .env)
|
||||
- ✅ `CLOUDFLARE_TUNNEL_TOKEN` - Set
|
||||
- ✅ `CLOUDFLARE_API_KEY` - Set (⚠️ Consider migrating to API_TOKEN)
|
||||
- ✅ `CLOUDFLARE_ACCOUNT_ID` - Set
|
||||
- ✅ `CLOUDFLARE_ZONE_ID` - Set (multiple zones)
|
||||
- ✅ `CLOUDFLARE_ORIGIN_CA_KEY` - Set
|
||||
- ✅ `CLOUDFLARE_EMAIL` - Set
|
||||
|
||||
#### Blockchain Services
|
||||
- ✅ `PRIVATE_KEY` - Set (🔒 **SECURITY CONCERN** - exposed in files)
|
||||
- ✅ Multiple contract addresses - Set
|
||||
- ✅ `ETHERSCAN_API_KEY` - Set
|
||||
- ✅ `METAMASK_API_KEY` / `METAMASK_SECRET` - Set
|
||||
- ✅ `THIRDWEB_SECRET_KEY` - Set
|
||||
|
||||
#### Database
|
||||
- ✅ `DATABASE_URL` - Set (contains password)
|
||||
|
||||
#### Service APIs
|
||||
- ✅ `OMADA_CLIENT_SECRET` - Set
|
||||
- ✅ `OMADA_API_KEY` - Set
|
||||
- ✅ Various LINK_TOKEN addresses - Set
|
||||
|
||||
---
|
||||
|
||||
## ⚠️ Missing or Needs Attention
|
||||
|
||||
### High Priority
|
||||
|
||||
- ⚠️ `CLOUDFLARE_API_TOKEN` - Not set (using API_KEY instead)
|
||||
- ⚠️ `OMADA_API_SECRET` - Empty in omada-api/.env
|
||||
- ⚠️ `OMADA_API_KEY` - Has placeholder value `<your-api-key>`
|
||||
|
||||
### Security Concerns
|
||||
|
||||
- 🔒 **Private keys in .env files** - Needs secure storage
|
||||
- `smom-dbis-138/.env`
|
||||
- `explorer-monorepo/.env`
|
||||
- Backup files (`.env.backup.*`)
|
||||
|
||||
- 🔒 **Backup files with secrets** - Should be removed from repository
|
||||
- `explorer-monorepo/.env.backup.*`
|
||||
- `smom-dbis-138/.env.backup`
|
||||
|
||||
---
|
||||
|
||||
## Optional Secrets (If Used)
|
||||
|
||||
### Explorer Monorepo
|
||||
- `DB_REPLICA_PASSWORD` - If using replica database
|
||||
- `SEARCH_PASSWORD` - If using Elasticsearch
|
||||
- `ONEINCH_API_KEY` - If using 1inch integration
|
||||
- `JUMIO_API_KEY/SECRET` - If using Jumio KYC
|
||||
- `MOONPAY_API_KEY` - If using MoonPay
|
||||
- `WALLETCONNECT_PROJECT_ID` - If using WalletConnect
|
||||
|
||||
### Monitoring/Logging
|
||||
- `SENTRY_DSN` - If using Sentry
|
||||
- `DATADOG_API_KEY` - If using Datadog
|
||||
|
||||
### Third-Party Services
|
||||
- Various API keys for optional integrations
|
||||
|
||||
---
|
||||
|
||||
## Recommendations
|
||||
|
||||
### Immediate Actions
|
||||
|
||||
1. **Verify .gitignore**
|
||||
```bash
|
||||
# Ensure these patterns are in .gitignore:
|
||||
.env
|
||||
.env.*
|
||||
*.env.backup
|
||||
```
|
||||
|
||||
2. **Secure Private Keys**
|
||||
- Move private keys to secure storage
|
||||
- Never commit private keys to repository
|
||||
- Use environment variable injection
|
||||
|
||||
3. **Clean Up Backup Files**
|
||||
- Remove `.env.backup.*` files from repository
|
||||
- Store backups securely if needed
|
||||
|
||||
4. **Migrate to API Tokens**
|
||||
- Replace `CLOUDFLARE_API_KEY` with `CLOUDFLARE_API_TOKEN`
|
||||
- More secure and recommended by Cloudflare
|
||||
|
||||
### Security Best Practices
|
||||
|
||||
- ✅ Use API tokens instead of API keys
|
||||
- ✅ Store secrets in secure storage (key vault, encrypted)
|
||||
- ✅ Never commit secrets to version control
|
||||
- ✅ Use separate secrets for different environments
|
||||
- ✅ Rotate secrets regularly
|
||||
- ✅ Limit access to secrets
|
||||
|
||||
---
|
||||
|
||||
## File Status Summary
|
||||
|
||||
| File | Status | Critical Secrets | Action Needed |
|
||||
|------|--------|------------------|---------------|
|
||||
| `./.env` | ✅ Good | Cloudflare credentials | Migrate to API_TOKEN |
|
||||
| `omada-api/.env` | ⚠️ Partial | Omada credentials | Set OMADA_API_SECRET |
|
||||
| `smom-dbis-138/.env` | 🔒 Secure | Private key | Move to secure storage |
|
||||
| `dbis_core/.env` | ✅ Good | Database password | Verify secure storage |
|
||||
| `explorer-monorepo/.env` | 🔒 Secure | Private key | Move to secure storage |
|
||||
|
||||
---
|
||||
|
||||
## Quick Commands
|
||||
|
||||
### Check Secret Status
|
||||
```bash
|
||||
./scripts/check-env-secrets.sh
|
||||
```
|
||||
|
||||
### Verify .gitignore
|
||||
```bash
|
||||
grep -E "\.env|\.env\." .gitignore
|
||||
```
|
||||
|
||||
### List All .env Files
|
||||
```bash
|
||||
find . -name ".env*" -type f | grep -v node_modules | grep -v venv
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [Required Secrets Inventory](./REQUIRED_SECRETS_INVENTORY.md) - Comprehensive inventory
|
||||
- [Environment Secrets Audit Report](./ENV_SECRETS_AUDIT_REPORT.md) - Detailed audit
|
||||
- [Cloudflare API Setup](../CLOUDFLARE_API_SETUP.md) - Cloudflare configuration
|
||||
- [Secrets and Keys Configuration](./SECRETS_KEYS_CONFIGURATION.md) - Security guide
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** 2025-01-20
|
||||
**Status:** 📋 Quick Reference
|
||||
@@ -1,6 +1,6 @@
|
||||
# RPC DNS Configuration for d-bis.org
|
||||
# RPC DNS Configuration for d-bis.org and defi-oracle.io
|
||||
|
||||
**Last Updated:** 2025-12-21
|
||||
**Last Updated:** 2025-01-23
|
||||
**Status:** Active Configuration
|
||||
|
||||
---
|
||||
@@ -10,11 +10,18 @@
|
||||
DNS configuration for RPC endpoints with Nginx SSL termination on port 443.
|
||||
|
||||
**Architecture:**
|
||||
|
||||
**d-bis.org domain (Direct A records):**
|
||||
```
|
||||
Internet → DNS (A records) → Nginx (port 443) → Besu RPC (8545/8546)
|
||||
```
|
||||
|
||||
All HTTPS traffic arrives on port 443, and Nginx routes to the appropriate backend port based on the domain name (Server Name Indication - SNI).
|
||||
**defi-oracle.io domain (Cloudflare Tunnel):**
|
||||
```
|
||||
Internet → DNS (CNAME) → Cloudflare Tunnel → VMID 2400 → Nginx (port 443) → Besu RPC (8545/8546)
|
||||
```
|
||||
|
||||
All HTTPS traffic arrives on port 443, and Nginx routes to the appropriate backend port based on the domain name (Server Name Indication - SNI). For VMID 2400, traffic flows through Cloudflare Tunnel first.
|
||||
|
||||
---
|
||||
|
||||
@@ -24,58 +31,112 @@ All HTTPS traffic arrives on port 443, and Nginx routes to the appropriate backe
|
||||
|
||||
**Important:** A records in DNS do NOT include port numbers. All traffic comes to port 443 (HTTPS), and Nginx handles routing to the backend ports.
|
||||
|
||||
#### Public RPC (VMID 2501 - 192.168.11.251)
|
||||
#### Permissioned RPC (VMID 2501 - 192.168.11.251) - JWT Authentication Required
|
||||
|
||||
| Type | Name | Target | Proxy | Notes |
|
||||
|------|------|--------|-------|-------|
|
||||
| A | `rpc-http-pub` | `192.168.11.251` | 🟠 Proxied (optional) | HTTP RPC endpoint |
|
||||
| A | `rpc-ws-pub` | `192.168.11.251` | 🟠 Proxied (optional) | WebSocket RPC endpoint |
|
||||
|
||||
**DNS Configuration:**
|
||||
```
|
||||
Type: A
|
||||
Name: rpc-http-pub
|
||||
Target: 192.168.11.251
|
||||
TTL: Auto
|
||||
Proxy: 🟠 Proxied (recommended for DDoS protection)
|
||||
|
||||
Type: A
|
||||
Name: rpc-ws-pub
|
||||
Target: 192.168.11.251
|
||||
TTL: Auto
|
||||
Proxy: 🟠 Proxied (recommended for DDoS protection)
|
||||
```
|
||||
|
||||
#### Private RPC (VMID 2502 - 192.168.11.252)
|
||||
|
||||
| Type | Name | Target | Proxy | Notes |
|
||||
|------|------|--------|-------|-------|
|
||||
| A | `rpc-http-prv` | `192.168.11.252` | 🟠 Proxied (optional) | HTTP RPC endpoint |
|
||||
| A | `rpc-ws-prv` | `192.168.11.252` | 🟠 Proxied (optional) | WebSocket RPC endpoint |
|
||||
| A | `rpc-http-prv` | `192.168.11.251` | 🟠 Proxied (optional) | HTTP RPC endpoint (JWT auth required) |
|
||||
| A | `rpc-ws-prv` | `192.168.11.251` | 🟠 Proxied (optional) | WebSocket RPC endpoint (JWT auth required) |
|
||||
|
||||
**DNS Configuration:**
|
||||
```
|
||||
Type: A
|
||||
Name: rpc-http-prv
|
||||
Target: 192.168.11.252
|
||||
Target: 192.168.11.251
|
||||
TTL: Auto
|
||||
Proxy: 🟠 Proxied (recommended for DDoS protection)
|
||||
|
||||
Type: A
|
||||
Name: rpc-ws-prv
|
||||
Target: 192.168.11.251
|
||||
TTL: Auto
|
||||
Proxy: 🟠 Proxied (recommended for DDoS protection)
|
||||
```
|
||||
|
||||
**Note:** These endpoints require JWT token authentication. See [RPC_JWT_AUTHENTICATION.md](RPC_JWT_AUTHENTICATION.md) for details.
|
||||
|
||||
#### Public RPC (VMID 2502 - 192.168.11.252) - No Authentication
|
||||
|
||||
| Type | Name | Target | Proxy | Notes |
|
||||
|------|------|--------|-------|-------|
|
||||
| A | `rpc-http-pub` | `192.168.11.252` | 🟠 Proxied (optional) | HTTP RPC endpoint (public, no auth) |
|
||||
| A | `rpc-ws-pub` | `192.168.11.252` | 🟠 Proxied (optional) | WebSocket RPC endpoint (public, no auth) |
|
||||
|
||||
**DNS Configuration:**
|
||||
```
|
||||
Type: A
|
||||
Name: rpc-http-pub
|
||||
Target: 192.168.11.252
|
||||
TTL: Auto
|
||||
Proxy: 🟠 Proxied (recommended for DDoS protection)
|
||||
|
||||
Type: A
|
||||
Name: rpc-ws-pub
|
||||
Target: 192.168.11.252
|
||||
TTL: Auto
|
||||
Proxy: 🟠 Proxied (recommended for DDoS protection)
|
||||
```
|
||||
|
||||
### DNS Records Configuration for defi-oracle.io Domain
|
||||
|
||||
**Note:** The `defi-oracle.io` domain is used specifically for ThirdWeb RPC nodes and Thirdweb listing integration.
|
||||
|
||||
#### ThirdWeb RPC (VMID 2400 - 192.168.11.240) - defi-oracle.io Domain
|
||||
|
||||
**Note:** VMID 2400 uses Cloudflare Tunnel, so DNS records use CNAME (not A records).
|
||||
|
||||
| Type | Name | Domain | Target | Proxy | Notes |
|
||||
|------|------|--------|--------|-------|-------|
|
||||
| CNAME | `rpc.public-0138` | `defi-oracle.io` | `26138c21-db00-4a02-95db-ec75c07bda5b.cfargotunnel.com` | 🟠 Proxied | Tunnel endpoint for ThirdWeb RPC |
|
||||
| CNAME | `rpc` | `defi-oracle.io` | `rpc.public-0138.defi-oracle.io` | 🟠 Proxied | Short alias for ThirdWeb RPC |
|
||||
|
||||
**DNS Configuration:**
|
||||
|
||||
**Record 1: Tunnel Endpoint**
|
||||
```
|
||||
Type: CNAME
|
||||
Name: rpc.public-0138
|
||||
Domain: defi-oracle.io
|
||||
Target: 26138c21-db00-4a02-95db-ec75c07bda5b.cfargotunnel.com
|
||||
TTL: Auto
|
||||
Proxy: 🟠 Proxied (required for tunnel)
|
||||
```
|
||||
|
||||
**Record 2: Short Alias**
|
||||
```
|
||||
Type: CNAME
|
||||
Name: rpc
|
||||
Domain: defi-oracle.io
|
||||
Target: rpc.public-0138.defi-oracle.io
|
||||
TTL: Auto
|
||||
Proxy: 🟠 Proxied (required for tunnel)
|
||||
```
|
||||
|
||||
**Full FQDNs:**
|
||||
- `rpc.public-0138.defi-oracle.io` (primary endpoint)
|
||||
- `rpc.defi-oracle.io` (short alias)
|
||||
|
||||
**DNS Structure:**
|
||||
```
|
||||
rpc.defi-oracle.io
|
||||
↓ (CNAME)
|
||||
rpc.public-0138.defi-oracle.io
|
||||
↓ (CNAME)
|
||||
26138c21-db00-4a02-95db-ec75c07bda5b.cfargotunnel.com
|
||||
↓ (Cloudflare Tunnel)
|
||||
192.168.11.240 (VMID 2400)
|
||||
```
|
||||
|
||||
**Note:** This endpoint is used for the Thirdweb listing for ChainID 138. Traffic flows through Cloudflare Tunnel to VMID 2400, where Nginx handles SSL termination and routes to Besu RPC (port 8545 for HTTP, port 8546 for WebSocket).
|
||||
|
||||
---
|
||||
|
||||
## How It Works
|
||||
|
||||
### Request Flow
|
||||
|
||||
1. **Client** makes request to `https://rpc-http-pub.d-bis.org`
|
||||
2. **DNS** resolves to `192.168.11.251` (A record)
|
||||
1. **Client** makes request to `https://rpc-http-prv.d-bis.org` (permissioned) or `https://rpc-http-pub.d-bis.org` (public)
|
||||
2. **DNS** resolves to appropriate IP (A record)
|
||||
3. **HTTPS connection** established on port 443 (standard HTTPS port)
|
||||
4. **Nginx** receives request on port 443
|
||||
5. **Nginx** uses Server Name Indication (SNI) to identify domain:
|
||||
@@ -83,17 +144,21 @@ Proxy: 🟠 Proxied (recommended for DDoS protection)
|
||||
- `rpc-ws-pub.d-bis.org` → proxies to `127.0.0.1:8546` (WebSocket RPC)
|
||||
- `rpc-http-prv.d-bis.org` → proxies to `127.0.0.1:8545` (HTTP RPC)
|
||||
- `rpc-ws-prv.d-bis.org` → proxies to `127.0.0.1:8546` (WebSocket RPC)
|
||||
- `rpc.public-0138.defi-oracle.io` → Cloudflare Tunnel → VMID 2400 → proxies to `127.0.0.1:8545` (HTTP RPC) or `127.0.0.1:8546` (WebSocket RPC)
|
||||
- `rpc.defi-oracle.io` → CNAME → `rpc.public-0138.defi-oracle.io` → Cloudflare Tunnel → VMID 2400 → proxies to `127.0.0.1:8545` (HTTP RPC) or `127.0.0.1:8546` (WebSocket RPC)
|
||||
6. **Besu RPC** processes request and returns response
|
||||
7. **Nginx** forwards response back to client
|
||||
|
||||
### Port Mapping
|
||||
|
||||
| Domain | DNS Target | Nginx Port | Backend Port | Service |
|
||||
|--------|------------|------------|-------------|---------|
|
||||
| `rpc-http-pub.d-bis.org` | `192.168.11.251` | 443 (HTTPS) | 8545 | HTTP RPC |
|
||||
| `rpc-ws-pub.d-bis.org` | `192.168.11.251` | 443 (HTTPS) | 8546 | WebSocket RPC |
|
||||
| `rpc-http-prv.d-bis.org` | `192.168.11.252` | 443 (HTTPS) | 8545 | HTTP RPC |
|
||||
| `rpc-ws-prv.d-bis.org` | `192.168.11.252` | 443 (HTTPS) | 8546 | WebSocket RPC |
|
||||
| Domain | DNS Target | Nginx Port | Backend Port | Service | Auth |
|
||||
|--------|------------|------------|-------------|---------|------|
|
||||
| `rpc-http-prv.d-bis.org` | `192.168.11.251` | 443 (HTTPS) | 8545 | HTTP RPC | ✅ JWT Required |
|
||||
| `rpc-ws-prv.d-bis.org` | `192.168.11.251` | 443 (HTTPS) | 8546 | WebSocket RPC | ✅ JWT Required |
|
||||
| `rpc-http-pub.d-bis.org` | `192.168.11.252` | 443 (HTTPS) | 8545 | HTTP RPC | ❌ No Auth |
|
||||
| `rpc-ws-pub.d-bis.org` | `192.168.11.252` | 443 (HTTPS) | 8546 | WebSocket RPC | ❌ No Auth |
|
||||
| `rpc.public-0138.defi-oracle.io` | Cloudflare Tunnel → `192.168.11.240` | 443 (HTTPS) | 8545/8546 | HTTP/WS RPC | ❌ No Auth |
|
||||
| `rpc.defi-oracle.io` | CNAME → `rpc.public-0138` → Cloudflare Tunnel → `192.168.11.240` | 443 (HTTPS) | 8545/8546 | HTTP/WS RPC | ❌ No Auth |
|
||||
|
||||
**Note:** DNS A records only contain IP addresses. Port numbers are handled by:
|
||||
- **Port 443**: Standard HTTPS port (handled automatically by browsers/clients)
|
||||
@@ -171,15 +236,22 @@ curl -X POST http://192.168.11.251:8545 \
|
||||
|
||||
The Nginx configuration on each container:
|
||||
|
||||
**VMID 2501:**
|
||||
**VMID 2501 (Permissioned RPC):**
|
||||
- Listens on port 443 (HTTPS)
|
||||
- `rpc-http-pub.d-bis.org` → proxies to `127.0.0.1:8545`
|
||||
- `rpc-ws-pub.d-bis.org` → proxies to `127.0.0.1:8546`
|
||||
- `rpc-http-prv.d-bis.org` → proxies to `127.0.0.1:8545` (JWT auth required)
|
||||
- `rpc-ws-prv.d-bis.org` → proxies to `127.0.0.1:8546` (JWT auth required)
|
||||
|
||||
**VMID 2502:**
|
||||
**VMID 2502 (Public RPC):**
|
||||
- Listens on port 443 (HTTPS)
|
||||
- `rpc-http-prv.d-bis.org` → proxies to `127.0.0.1:8545`
|
||||
- `rpc-ws-prv.d-bis.org` → proxies to `127.0.0.1:8546`
|
||||
- `rpc-http-pub.d-bis.org` → proxies to `127.0.0.1:8545` (no auth)
|
||||
- `rpc-ws-pub.d-bis.org` → proxies to `127.0.0.1:8546` (no auth)
|
||||
|
||||
**VMID 2400 (ThirdWeb RPC - Cloudflare Tunnel):**
|
||||
- Cloudflare Tunnel endpoint: `26138c21-db00-4a02-95db-ec75c07bda5b.cfargotunnel.com`
|
||||
- Nginx listens on port 443 (HTTPS) inside container
|
||||
- `rpc.public-0138.defi-oracle.io` → Cloudflare Tunnel → proxies to `127.0.0.1:8545` (HTTP RPC, no auth) or `127.0.0.1:8546` (WebSocket RPC, no auth)
|
||||
- `rpc.defi-oracle.io` → CNAME → `rpc.public-0138.defi-oracle.io` → Cloudflare Tunnel → proxies to `127.0.0.1:8545` (HTTP RPC, no auth) or `127.0.0.1:8546` (WebSocket RPC, no auth)
|
||||
- Uses `defi-oracle.io` domain (Cloudflare Tunnel) for Thirdweb listing integration
|
||||
|
||||
---
|
||||
|
||||
@@ -243,16 +315,31 @@ ssh root@192.168.11.10 "pct exec 2501 -- systemctl status besu-rpc"
|
||||
## Quick Reference
|
||||
|
||||
**DNS Records to Create:**
|
||||
|
||||
**d-bis.org domain:**
|
||||
```
|
||||
rpc-http-pub.d-bis.org → A → 192.168.11.251
|
||||
rpc-ws-pub.d-bis.org → A → 192.168.11.251
|
||||
rpc-http-prv.d-bis.org → A → 192.168.11.252
|
||||
rpc-ws-prv.d-bis.org → A → 192.168.11.252
|
||||
rpc-http-prv.d-bis.org → A → 192.168.11.251 (Permissioned, JWT auth required)
|
||||
rpc-ws-prv.d-bis.org → A → 192.168.11.251 (Permissioned, JWT auth required)
|
||||
rpc-http-pub.d-bis.org → A → 192.168.11.252 (Public, no auth)
|
||||
rpc-ws-pub.d-bis.org → A → 192.168.11.252 (Public, no auth)
|
||||
```
|
||||
|
||||
**defi-oracle.io domain (ThirdWeb RPC - Cloudflare Tunnel):**
|
||||
```
|
||||
rpc.public-0138.defi-oracle.io → CNAME → 26138c21-db00-4a02-95db-ec75c07bda5b.cfargotunnel.com (Tunnel endpoint)
|
||||
rpc.defi-oracle.io → CNAME → rpc.public-0138.defi-oracle.io (Short alias)
|
||||
```
|
||||
|
||||
**Endpoints:**
|
||||
- `https://rpc-http-pub.d-bis.org` → HTTP RPC (port 443 → 8545)
|
||||
- `wss://rpc-ws-pub.d-bis.org` → WebSocket RPC (port 443 → 8546)
|
||||
- `https://rpc-http-prv.d-bis.org` → HTTP RPC (port 443 → 8545)
|
||||
- `wss://rpc-ws-prv.d-bis.org` → WebSocket RPC (port 443 → 8546)
|
||||
|
||||
**d-bis.org domain:**
|
||||
- `https://rpc-http-prv.d-bis.org` → Permissioned HTTP RPC (port 443 → 8545, JWT auth required)
|
||||
- `wss://rpc-ws-prv.d-bis.org` → Permissioned WebSocket RPC (port 443 → 8546, JWT auth required)
|
||||
- `https://rpc-http-pub.d-bis.org` → Public HTTP RPC (port 443 → 8545, no auth)
|
||||
- `wss://rpc-ws-pub.d-bis.org` → Public WebSocket RPC (port 443 → 8546, no auth)
|
||||
|
||||
**defi-oracle.io domain (ThirdWeb RPC - Cloudflare Tunnel):**
|
||||
- `https://rpc.public-0138.defi-oracle.io` → ThirdWeb HTTP RPC (Cloudflare Tunnel → port 443 → 8545, no auth)
|
||||
- `wss://rpc.public-0138.defi-oracle.io` → ThirdWeb WebSocket RPC (Cloudflare Tunnel → port 443 → 8546, no auth)
|
||||
- `https://rpc.defi-oracle.io` → ThirdWeb HTTP RPC (CNAME → Cloudflare Tunnel → port 443 → 8545, no auth)
|
||||
- `wss://rpc.defi-oracle.io` → ThirdWeb WebSocket RPC (CNAME → Cloudflare Tunnel → port 443 → 8546, no auth)
|
||||
|
||||
292
docs/04-configuration/RPC_JWT_AUTHENTICATION.md
Normal file
292
docs/04-configuration/RPC_JWT_AUTHENTICATION.md
Normal file
@@ -0,0 +1,292 @@
|
||||
# JWT Authentication for Permissioned RPC Endpoints
|
||||
|
||||
**Last Updated:** 2025-12-24
|
||||
**Status:** Active Configuration
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
JWT (JSON Web Token) authentication has been configured for the Permissioned RPC endpoints to provide secure, token-based access control.
|
||||
|
||||
### Endpoints with JWT Authentication
|
||||
|
||||
- **HTTP RPC**: `https://rpc-http-prv.d-bis.org`
|
||||
- **WebSocket RPC**: `wss://rpc-ws-prv.d-bis.org`
|
||||
|
||||
### Endpoints without Authentication (Public)
|
||||
|
||||
- **HTTP RPC**: `https://rpc-http-pub.d-bis.org`
|
||||
- **WebSocket RPC**: `wss://rpc-ws-pub.d-bis.org`
|
||||
|
||||
---
|
||||
|
||||
## Architecture
|
||||
|
||||
### VMID Mappings
|
||||
|
||||
| VMID | Type | Domain | Authentication | IP |
|
||||
|------|------|--------|----------------|-----|
|
||||
| 2501 | Permissioned RPC | `rpc-http-prv.d-bis.org`<br>`rpc-ws-prv.d-bis.org` | ✅ JWT Required | 192.168.11.251 |
|
||||
| 2502 | Public RPC | `rpc-http-pub.d-bis.org`<br>`rpc-ws-pub.d-bis.org` | ❌ No Auth | 192.168.11.252 |
|
||||
|
||||
### Request Flow with JWT
|
||||
|
||||
1. **Client** makes request to `https://rpc-http-prv.d-bis.org`
|
||||
2. **Nginx** receives request and extracts JWT token from `Authorization: Bearer <token>` header
|
||||
3. **Lua Script** validates JWT token using secret key
|
||||
4. **If valid**: Request is proxied to Besu RPC (127.0.0.1:8545)
|
||||
5. **If invalid**: Returns 401 Unauthorized with error message
|
||||
|
||||
---
|
||||
|
||||
## Setup
|
||||
|
||||
### 1. Configure JWT Authentication
|
||||
|
||||
Run the configuration script:
|
||||
|
||||
```bash
|
||||
cd /home/intlc/projects/proxmox
|
||||
./scripts/configure-nginx-jwt-auth.sh
|
||||
```
|
||||
|
||||
This script will:
|
||||
- Install required packages (nginx, lua, lua-resty-jwt)
|
||||
- Generate JWT secret key
|
||||
- Configure Nginx with JWT validation
|
||||
- Set up both HTTP and WebSocket endpoints
|
||||
|
||||
### 2. Generate JWT Tokens
|
||||
|
||||
Use the token generation script:
|
||||
|
||||
```bash
|
||||
# Generate token with default settings (username: rpc-user, expiry: 365 days)
|
||||
./scripts/generate-jwt-token.sh
|
||||
|
||||
# Generate token with custom username and expiry
|
||||
./scripts/generate-jwt-token.sh my-username 30 # 30 days expiry
|
||||
```
|
||||
|
||||
The script will output:
|
||||
- The JWT token
|
||||
- Usage examples for testing
|
||||
|
||||
---
|
||||
|
||||
## Usage
|
||||
|
||||
### HTTP RPC with JWT
|
||||
|
||||
```bash
|
||||
# Test with curl
|
||||
curl -k \
|
||||
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' \
|
||||
https://rpc-http-prv.d-bis.org
|
||||
```
|
||||
|
||||
### WebSocket RPC with JWT
|
||||
|
||||
For WebSocket connections, include the JWT token in the Authorization header during the initial HTTP upgrade request:
|
||||
|
||||
```javascript
|
||||
// JavaScript example
|
||||
const ws = new WebSocket('wss://rpc-ws-prv.d-bis.org', {
|
||||
headers: {
|
||||
'Authorization': 'Bearer YOUR_JWT_TOKEN'
|
||||
}
|
||||
});
|
||||
```
|
||||
|
||||
### Using with MetaMask or dApps
|
||||
|
||||
Most Ethereum clients don't support custom headers. For these cases, you can:
|
||||
|
||||
1. **Use a proxy service** that adds the JWT token
|
||||
2. **Use the public endpoint** (`rpc-http-pub.d-bis.org`) for read-only operations
|
||||
3. **Implement custom authentication** in your dApp
|
||||
|
||||
---
|
||||
|
||||
## Token Management
|
||||
|
||||
### Token Structure
|
||||
|
||||
JWT tokens contain:
|
||||
- **Header**: Algorithm (HS256) and type (JWT)
|
||||
- **Payload**:
|
||||
- `sub`: Username/subject
|
||||
- `iat`: Issued at (timestamp)
|
||||
- `exp`: Expiration (timestamp)
|
||||
- **Signature**: HMAC-SHA256 signature using the secret key
|
||||
|
||||
### Token Expiry
|
||||
|
||||
Tokens expire after the specified number of days. To generate a new token:
|
||||
|
||||
```bash
|
||||
./scripts/generate-jwt-token.sh username days
|
||||
```
|
||||
|
||||
### Revoking Tokens
|
||||
|
||||
JWT tokens cannot be revoked individually without changing the secret key. To revoke all tokens:
|
||||
|
||||
1. Generate a new JWT secret on VMID 2501:
|
||||
```bash
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- openssl rand -base64 32 > /etc/nginx/jwt_secret"
|
||||
```
|
||||
|
||||
2. Restart Nginx:
|
||||
```bash
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- systemctl restart nginx"
|
||||
```
|
||||
|
||||
3. Generate new tokens for authorized users
|
||||
|
||||
---
|
||||
|
||||
## Security Considerations
|
||||
|
||||
### Secret Key Management
|
||||
|
||||
- **Location**: `/etc/nginx/jwt_secret` on VMID 2501
|
||||
- **Permissions**: 600 (readable only by root)
|
||||
- **Backup**: Store securely, do not commit to version control
|
||||
|
||||
### Best Practices
|
||||
|
||||
1. **Use strong secret keys**: The script generates 32-byte random keys
|
||||
2. **Set appropriate expiry**: Don't create tokens with excessive expiry times
|
||||
3. **Rotate secrets periodically**: Change the secret key and regenerate tokens
|
||||
4. **Monitor access logs**: Check `/var/log/nginx/rpc-http-prv-access.log` for unauthorized attempts
|
||||
5. **Use HTTPS only**: All endpoints use HTTPS (port 443)
|
||||
|
||||
### Rate Limiting
|
||||
|
||||
Consider adding rate limiting to prevent abuse:
|
||||
|
||||
```nginx
|
||||
limit_req_zone $binary_remote_addr zone=jwt_limit:10m rate=10r/s;
|
||||
|
||||
location / {
|
||||
limit_req zone=jwt_limit burst=20 nodelay;
|
||||
# ... JWT validation ...
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### 401 Unauthorized
|
||||
|
||||
**Error**: `{"error": "Missing Authorization header"}`
|
||||
|
||||
**Solution**: Include the Authorization header:
|
||||
```bash
|
||||
curl -H "Authorization: Bearer YOUR_TOKEN" ...
|
||||
```
|
||||
|
||||
**Error**: `{"error": "Invalid or expired token"}`
|
||||
|
||||
**Solution**:
|
||||
- Check token is correct (no extra spaces)
|
||||
- Verify token hasn't expired
|
||||
- Generate a new token if needed
|
||||
|
||||
### 500 Internal Server Error
|
||||
|
||||
**Error**: `{"error": "Internal server error"}`
|
||||
|
||||
**Solution**:
|
||||
- Check JWT secret exists: `pct exec 2501 -- cat /etc/nginx/jwt_secret`
|
||||
- Check lua-resty-jwt is installed: `pct exec 2501 -- ls /usr/share/lua/5.1/resty/jwt.lua`
|
||||
- Check Nginx error logs: `pct exec 2501 -- tail -f /var/log/nginx/rpc-http-prv-error.log`
|
||||
|
||||
### Token Validation Fails
|
||||
|
||||
1. **Verify secret key matches**:
|
||||
```bash
|
||||
# On VMID 2501
|
||||
cat /etc/nginx/jwt_secret
|
||||
```
|
||||
|
||||
2. **Regenerate token** using the same secret:
|
||||
```bash
|
||||
./scripts/generate-jwt-token.sh
|
||||
```
|
||||
|
||||
3. **Check token format**: Should be three parts separated by dots: `header.payload.signature`
|
||||
|
||||
---
|
||||
|
||||
## Testing
|
||||
|
||||
### Test JWT Authentication
|
||||
|
||||
```bash
|
||||
# 1. Generate a token
|
||||
TOKEN=$(./scripts/generate-jwt-token.sh test-user 365 | grep -A 1 "Token:" | tail -1)
|
||||
|
||||
# 2. Test HTTP endpoint
|
||||
curl -k \
|
||||
-H "Authorization: Bearer $TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' \
|
||||
https://rpc-http-prv.d-bis.org
|
||||
|
||||
# 3. Test without token (should fail)
|
||||
curl -k \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' \
|
||||
https://rpc-http-prv.d-bis.org
|
||||
# Expected: {"error": "Missing Authorization header"}
|
||||
```
|
||||
|
||||
### Test Health Endpoint (No Auth Required)
|
||||
|
||||
```bash
|
||||
curl -k https://rpc-http-prv.d-bis.org/health
|
||||
# Expected: healthy
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [RPC_DNS_CONFIGURATION.md](RPC_DNS_CONFIGURATION.md) - DNS setup
|
||||
- [BESU_RPC_CONFIGURATION_FIXED.md](../05-network/BESU_RPC_CONFIGURATION_FIXED.md) - Besu RPC configuration
|
||||
- [NGINX_ARCHITECTURE_RPC.md](../05-network/NGINX_ARCHITECTURE_RPC.md) - Nginx architecture
|
||||
|
||||
---
|
||||
|
||||
## Quick Reference
|
||||
|
||||
**Generate Token:**
|
||||
```bash
|
||||
./scripts/generate-jwt-token.sh [username] [days]
|
||||
```
|
||||
|
||||
**Use Token:**
|
||||
```bash
|
||||
curl -H "Authorization: Bearer <token>" https://rpc-http-prv.d-bis.org
|
||||
```
|
||||
|
||||
**Check Secret:**
|
||||
```bash
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- cat /etc/nginx/jwt_secret"
|
||||
```
|
||||
|
||||
**View Logs:**
|
||||
```bash
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- tail -f /var/log/nginx/rpc-http-prv-access.log"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2025-12-24
|
||||
|
||||
353
docs/04-configuration/RPC_JWT_SETUP_COMPLETE.md
Normal file
353
docs/04-configuration/RPC_JWT_SETUP_COMPLETE.md
Normal file
@@ -0,0 +1,353 @@
|
||||
# JWT Authentication Setup - Complete
|
||||
|
||||
**Date**: 2025-12-26
|
||||
**Status**: ✅ **FULLY OPERATIONAL**
|
||||
|
||||
---
|
||||
|
||||
## ✅ Setup Complete
|
||||
|
||||
JWT authentication has been successfully configured for the Permissioned RPC endpoints on VMID 2501.
|
||||
|
||||
### Endpoints Configured
|
||||
|
||||
| Endpoint | VMID | IP | Authentication | Status |
|
||||
|----------|------|-----|----------------|--------|
|
||||
| `https://rpc-http-prv.d-bis.org` | 2501 | 192.168.11.251 | ✅ JWT Required | ✅ Active |
|
||||
| `wss://rpc-ws-prv.d-bis.org` | 2501 | 192.168.11.251 | ✅ JWT Required | ✅ Active |
|
||||
| `https://rpc-http-pub.d-bis.org` | 2502 | 192.168.11.252 | ❌ No Auth | ✅ Active |
|
||||
| `wss://rpc-ws-pub.d-bis.org` | 2502 | 192.168.11.252 | ❌ No Auth | ✅ Active |
|
||||
|
||||
---
|
||||
|
||||
## 🔑 JWT Secret
|
||||
|
||||
**Location**: `/etc/nginx/jwt_secret` on VMID 2501
|
||||
**Secret**: `UMW58gEniB9Y75yNmw0X9hI+ycg1K+d1TG8VdB6TqX0=`
|
||||
|
||||
⚠️ **IMPORTANT**: Keep this secret secure. All JWT tokens are signed with this secret.
|
||||
|
||||
---
|
||||
|
||||
## 🚀 Quick Start
|
||||
|
||||
### 1. Generate a JWT Token
|
||||
|
||||
```bash
|
||||
cd /home/intlc/projects/proxmox
|
||||
./scripts/generate-jwt-token.sh [username] [expiry_days]
|
||||
```
|
||||
|
||||
**Example:**
|
||||
```bash
|
||||
./scripts/generate-jwt-token.sh my-app 30
|
||||
```
|
||||
|
||||
### 2. Use the Token
|
||||
|
||||
**HTTP RPC:**
|
||||
```bash
|
||||
curl -k \
|
||||
-H "Authorization: Bearer YOUR_TOKEN_HERE" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' \
|
||||
https://rpc-http-prv.d-bis.org
|
||||
```
|
||||
|
||||
**WebSocket RPC:**
|
||||
```javascript
|
||||
const ws = new WebSocket('wss://rpc-ws-prv.d-bis.org', {
|
||||
headers: {
|
||||
'Authorization': 'Bearer YOUR_TOKEN_HERE'
|
||||
}
|
||||
});
|
||||
```
|
||||
|
||||
### 3. Test Without Token (Should Fail)
|
||||
|
||||
```bash
|
||||
curl -k \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' \
|
||||
https://rpc-http-prv.d-bis.org
|
||||
```
|
||||
|
||||
**Expected Response:**
|
||||
```json
|
||||
{"jsonrpc":"2.0","error":{"code":-32000,"message":"Unauthorized. Missing or invalid JWT token. Use: Authorization: Bearer <token>"},"id":null}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📋 Services Status
|
||||
|
||||
### VMID 2501 Services
|
||||
|
||||
- ✅ **Nginx**: Active and running
|
||||
- ✅ **JWT Validator Service**: Active on port 8888
|
||||
- ✅ **Besu RPC**: Running on ports 8545 (HTTP) and 8546 (WebSocket)
|
||||
|
||||
### Check Status
|
||||
|
||||
```bash
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- systemctl status nginx jwt-validator"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔧 Configuration Files
|
||||
|
||||
### Nginx Configuration
|
||||
- **Location**: `/etc/nginx/sites-available/rpc-perm`
|
||||
- **Enabled**: `/etc/nginx/sites-enabled/rpc-perm`
|
||||
|
||||
### JWT Validator Service
|
||||
- **Script**: `/usr/local/bin/jwt-validator-http.py`
|
||||
- **Service**: `/etc/systemd/system/jwt-validator.service`
|
||||
- **Port**: 8888 (internal only, 127.0.0.1)
|
||||
|
||||
### JWT Secret
|
||||
- **Location**: `/etc/nginx/jwt_secret`
|
||||
- **Permissions**: 640 (readable by root and www-data group)
|
||||
|
||||
---
|
||||
|
||||
## 🧪 Testing
|
||||
|
||||
### Test Health Endpoint (No Auth Required)
|
||||
|
||||
```bash
|
||||
curl -k https://rpc-http-prv.d-bis.org/health
|
||||
# Expected: healthy
|
||||
```
|
||||
|
||||
### Test with Valid Token
|
||||
|
||||
```bash
|
||||
# Generate token
|
||||
TOKEN=$(./scripts/generate-jwt-token.sh test-user 365 | grep "Token:" | tail -1 | awk '{print $2}')
|
||||
|
||||
# Test HTTP endpoint
|
||||
curl -k \
|
||||
-H "Authorization: Bearer $TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' \
|
||||
https://rpc-http-prv.d-bis.org
|
||||
|
||||
# Expected: {"jsonrpc":"2.0","id":1,"result":"0x8a"}
|
||||
```
|
||||
|
||||
### Test with Invalid Token
|
||||
|
||||
```bash
|
||||
curl -k \
|
||||
-H "Authorization: Bearer invalid-token" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' \
|
||||
https://rpc-http-prv.d-bis.org
|
||||
|
||||
# Expected: 401 Unauthorized
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔄 Token Management
|
||||
|
||||
### Generate New Token
|
||||
|
||||
```bash
|
||||
./scripts/generate-jwt-token.sh [username] [expiry_days]
|
||||
```
|
||||
|
||||
### Token Structure
|
||||
|
||||
JWT tokens contain:
|
||||
- **Header**: Algorithm (HS256) and type (JWT)
|
||||
- **Payload**:
|
||||
- `sub`: Username/subject
|
||||
- `iat`: Issued at timestamp
|
||||
- `exp`: Expiration timestamp
|
||||
- **Signature**: HMAC-SHA256 signature
|
||||
|
||||
### Token Expiry
|
||||
|
||||
Tokens expire after the specified number of days. To generate a new token:
|
||||
|
||||
```bash
|
||||
./scripts/generate-jwt-token.sh username days
|
||||
```
|
||||
|
||||
### Revoke All Tokens
|
||||
|
||||
To revoke all existing tokens, generate a new JWT secret:
|
||||
|
||||
```bash
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- openssl rand -base64 32 > /etc/nginx/jwt_secret"
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- chmod 640 /etc/nginx/jwt_secret && chgrp www-data /etc/nginx/jwt_secret"
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- systemctl restart jwt-validator"
|
||||
```
|
||||
|
||||
Then generate new tokens for authorized users.
|
||||
|
||||
---
|
||||
|
||||
## 🌐 DNS Configuration
|
||||
|
||||
### Required DNS Records
|
||||
|
||||
Ensure these DNS records are configured in Cloudflare:
|
||||
|
||||
| Type | Name | Target | Proxy | Notes |
|
||||
|------|------|--------|-------|-------|
|
||||
| A | `rpc-http-prv` | `192.168.11.251` | 🟠 Proxied | Permissioned HTTP RPC |
|
||||
| A | `rpc-ws-prv` | `192.168.11.251` | 🟠 Proxied | Permissioned WebSocket RPC |
|
||||
| A | `rpc-http-pub` | `192.168.11.252` | 🟠 Proxied | Public HTTP RPC |
|
||||
| A | `rpc-ws-pub` | `192.168.11.252` | 🟠 Proxied | Public WebSocket RPC |
|
||||
|
||||
### Verify DNS
|
||||
|
||||
```bash
|
||||
# Check DNS resolution
|
||||
dig rpc-http-prv.d-bis.org
|
||||
nslookup rpc-http-prv.d-bis.org
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔍 Troubleshooting
|
||||
|
||||
### 401 Unauthorized
|
||||
|
||||
**Issue**: Token is missing or invalid
|
||||
|
||||
**Solutions**:
|
||||
1. Check Authorization header format: `Authorization: Bearer <token>`
|
||||
2. Verify token hasn't expired
|
||||
3. Generate a new token
|
||||
4. Ensure token matches the current JWT secret
|
||||
|
||||
### 500 Internal Server Error
|
||||
|
||||
**Issue**: JWT validation service not responding
|
||||
|
||||
**Solutions**:
|
||||
```bash
|
||||
# Check service status
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- systemctl status jwt-validator"
|
||||
|
||||
# Check logs
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- journalctl -u jwt-validator -n 20"
|
||||
|
||||
# Restart service
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- systemctl restart jwt-validator"
|
||||
```
|
||||
|
||||
### Connection Refused
|
||||
|
||||
**Issue**: Service not listening on port 8888
|
||||
|
||||
**Solutions**:
|
||||
```bash
|
||||
# Check if service is running
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- ss -tlnp | grep 8888"
|
||||
|
||||
# Check JWT secret permissions
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- ls -la /etc/nginx/jwt_secret"
|
||||
|
||||
# Fix permissions if needed
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- chmod 640 /etc/nginx/jwt_secret && chgrp www-data /etc/nginx/jwt_secret"
|
||||
```
|
||||
|
||||
### Nginx Configuration Errors
|
||||
|
||||
**Issue**: Nginx fails to start or reload
|
||||
|
||||
**Solutions**:
|
||||
```bash
|
||||
# Test configuration
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- nginx -t"
|
||||
|
||||
# Check error logs
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- tail -20 /var/log/nginx/rpc-http-prv-error.log"
|
||||
|
||||
# Reload nginx
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- systemctl reload nginx"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📊 Monitoring
|
||||
|
||||
### View Access Logs
|
||||
|
||||
```bash
|
||||
# HTTP access logs
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- tail -f /var/log/nginx/rpc-http-prv-access.log"
|
||||
|
||||
# WebSocket access logs
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- tail -f /var/log/nginx/rpc-ws-prv-access.log"
|
||||
|
||||
# Error logs
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- tail -f /var/log/nginx/rpc-http-prv-error.log"
|
||||
```
|
||||
|
||||
### Monitor JWT Validator Service
|
||||
|
||||
```bash
|
||||
ssh root@192.168.11.10 "pct exec 2501 -- journalctl -u jwt-validator -f"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔐 Security Best Practices
|
||||
|
||||
1. **Keep JWT Secret Secure**
|
||||
- Store in secure location
|
||||
- Don't commit to version control
|
||||
- Rotate periodically
|
||||
|
||||
2. **Set Appropriate Token Expiry**
|
||||
- Use short expiry for high-security applications
|
||||
- Use longer expiry for trusted services
|
||||
- Regenerate tokens when compromised
|
||||
|
||||
3. **Monitor Access**
|
||||
- Review access logs regularly
|
||||
- Watch for unauthorized access attempts
|
||||
- Set up alerts for suspicious activity
|
||||
|
||||
4. **Use HTTPS Only**
|
||||
- All endpoints use HTTPS (port 443)
|
||||
- Never send tokens over unencrypted connections
|
||||
|
||||
5. **Rate Limiting** (Future Enhancement)
|
||||
- Consider adding rate limiting to prevent abuse
|
||||
- Configure per-user or per-IP limits
|
||||
|
||||
---
|
||||
|
||||
## 📚 Related Documentation
|
||||
|
||||
- [RPC_JWT_AUTHENTICATION.md](RPC_JWT_AUTHENTICATION.md) - Detailed JWT authentication guide
|
||||
- [RPC_DNS_CONFIGURATION.md](RPC_DNS_CONFIGURATION.md) - DNS setup and configuration
|
||||
- [BESU_RPC_CONFIGURATION_FIXED.md](../05-network/BESU_RPC_CONFIGURATION_FIXED.md) - Besu RPC node configuration
|
||||
|
||||
---
|
||||
|
||||
## ✅ Verification Checklist
|
||||
|
||||
- [x] JWT authentication configured on VMID 2501
|
||||
- [x] JWT validator service running on port 8888
|
||||
- [x] Nginx configured with auth_request
|
||||
- [x] JWT secret generated and secured
|
||||
- [x] Token generation script working
|
||||
- [x] Valid tokens allow access
|
||||
- [x] Invalid tokens are rejected
|
||||
- [x] Health endpoint accessible without auth
|
||||
- [x] Documentation complete
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2025-12-26
|
||||
**Status**: ✅ **PRODUCTION READY**
|
||||
|
||||
350
docs/04-configuration/SECURITY_IMPROVEMENTS_COMPLETE.md
Normal file
350
docs/04-configuration/SECURITY_IMPROVEMENTS_COMPLETE.md
Normal file
@@ -0,0 +1,350 @@
|
||||
# Security Improvements Implementation Complete
|
||||
|
||||
**Date:** 2025-01-20
|
||||
**Status:** ✅ Implementation Complete
|
||||
**Purpose:** Document completed security improvements and next steps
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
All recommendations from the environment secrets audit have been implemented. This document tracks what has been completed and what remains as manual steps.
|
||||
|
||||
---
|
||||
|
||||
## ✅ Completed Actions
|
||||
|
||||
### 1. .gitignore Verification and Update
|
||||
|
||||
**Status:** ✅ Complete
|
||||
|
||||
- ✅ Verified .gitignore includes .env patterns
|
||||
- ✅ Added comprehensive .env ignore patterns:
|
||||
- `.env`
|
||||
- `.env.*`
|
||||
- `.env.local`
|
||||
- `.env.*.local`
|
||||
- `*.env.backup`
|
||||
- `.env.backup.*`
|
||||
- `.env.backup`
|
||||
|
||||
**Result:** All .env files and backup files are now ignored by git.
|
||||
|
||||
---
|
||||
|
||||
### 2. Documentation Created
|
||||
|
||||
**Status:** ✅ Complete
|
||||
|
||||
Created comprehensive documentation:
|
||||
|
||||
1. **REQUIRED_SECRETS_INVENTORY.md**
|
||||
- Complete inventory of all required secrets
|
||||
- Security best practices
|
||||
- Secret storage recommendations
|
||||
|
||||
2. **ENV_SECRETS_AUDIT_REPORT.md**
|
||||
- Detailed audit findings
|
||||
- Security issues identified
|
||||
- Recommendations with priorities
|
||||
|
||||
3. **REQUIRED_SECRETS_SUMMARY.md**
|
||||
- Quick reference checklist
|
||||
- File status summary
|
||||
- Critical findings
|
||||
|
||||
4. **SECURE_SECRETS_MIGRATION_GUIDE.md**
|
||||
- Step-by-step migration instructions
|
||||
- Secure storage options
|
||||
- Implementation checklist
|
||||
|
||||
5. **SECURITY_IMPROVEMENTS_COMPLETE.md** (this document)
|
||||
- Status of all improvements
|
||||
- Manual steps required
|
||||
- Next steps
|
||||
|
||||
---
|
||||
|
||||
### 3. Scripts Created
|
||||
|
||||
**Status:** ✅ Complete
|
||||
|
||||
Created utility scripts:
|
||||
|
||||
1. **scripts/check-env-secrets.sh**
|
||||
- Audits all .env files
|
||||
- Identifies empty/placeholder values
|
||||
- Lists all variables found
|
||||
|
||||
2. **scripts/cleanup-env-backup-files.sh**
|
||||
- Identifies backup files
|
||||
- Creates secure backups
|
||||
- Removes backup files from git/filesystem
|
||||
- Supports dry-run mode
|
||||
|
||||
3. **scripts/migrate-cloudflare-api-token.sh**
|
||||
- Interactive migration guide
|
||||
- Helps create and configure API tokens
|
||||
- Updates .env file
|
||||
|
||||
4. **scripts/test-cloudflare-api-token.sh**
|
||||
- Tests API token validity
|
||||
- Verifies permissions
|
||||
- Provides detailed feedback
|
||||
|
||||
---
|
||||
|
||||
## 📋 Manual Steps Required
|
||||
|
||||
### 1. Clean Up Backup Files
|
||||
|
||||
**Status:** ⏳ Pending User Action
|
||||
|
||||
**Action Required:**
|
||||
```bash
|
||||
# Review backup files first (dry run)
|
||||
./scripts/cleanup-env-backup-files.sh
|
||||
|
||||
# If satisfied, remove backup files
|
||||
DRY_RUN=0 ./scripts/cleanup-env-backup-files.sh
|
||||
```
|
||||
|
||||
**Backup Files to Remove:**
|
||||
- `explorer-monorepo/.env.backup.*` (multiple files)
|
||||
- `smom-dbis-138/.env.backup`
|
||||
|
||||
**Note:** The script will create secure backups before removing files.
|
||||
|
||||
---
|
||||
|
||||
### 2. Migrate Private Keys to Secure Storage
|
||||
|
||||
**Status:** ⏳ Pending User Action
|
||||
|
||||
**Action Required:**
|
||||
|
||||
Choose one of these options:
|
||||
|
||||
#### Option A: Environment Variables (Recommended for Quick Fix)
|
||||
```bash
|
||||
# Create secure storage
|
||||
mkdir -p ~/.secure-secrets
|
||||
cat > ~/.secure-secrets/private-keys.env << 'EOF'
|
||||
PRIVATE_KEY=0x5373d11ee2cad4ed82b9208526a8c358839cbfe325919fb250f062a25153d1c8
|
||||
EOF
|
||||
chmod 600 ~/.secure-secrets/private-keys.env
|
||||
|
||||
# Remove from .env files
|
||||
sed -i 's/^PRIVATE_KEY=/#PRIVATE_KEY=/' smom-dbis-138/.env
|
||||
sed -i 's/^PRIVATE_KEY=/#PRIVATE_KEY=/' explorer-monorepo/.env
|
||||
```
|
||||
|
||||
#### Option B: Key Management Service (Recommended for Production)
|
||||
- Set up HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault
|
||||
- Store private keys in the service
|
||||
- Update deployment scripts to retrieve from service
|
||||
|
||||
**See:** `SECURE_SECRETS_MIGRATION_GUIDE.md` for detailed instructions.
|
||||
|
||||
---
|
||||
|
||||
### 3. Migrate to Cloudflare API Token
|
||||
|
||||
**Status:** ⏳ Pending User Action
|
||||
|
||||
**Action Required:**
|
||||
|
||||
1. **Create API Token:**
|
||||
- Go to: https://dash.cloudflare.com/profile/api-tokens
|
||||
- Create token with DNS and Tunnel permissions
|
||||
- Copy the token
|
||||
|
||||
2. **Run Migration Script:**
|
||||
```bash
|
||||
./scripts/migrate-cloudflare-api-token.sh
|
||||
```
|
||||
|
||||
3. **Test API Token:**
|
||||
```bash
|
||||
./scripts/test-cloudflare-api-token.sh
|
||||
```
|
||||
|
||||
4. **Update Scripts:**
|
||||
- Update scripts to use `CLOUDFLARE_API_TOKEN`
|
||||
- Remove `CLOUDFLARE_API_KEY` after verification
|
||||
|
||||
**See:** `SECURE_SECRETS_MIGRATION_GUIDE.md` Phase 4 for detailed instructions.
|
||||
|
||||
---
|
||||
|
||||
### 4. Fix Omada API Configuration
|
||||
|
||||
**Status:** ⏳ Pending User Action
|
||||
|
||||
**Action Required:**
|
||||
|
||||
1. **Review omada-api/.env:**
|
||||
- `OMADA_API_KEY` has placeholder value `<your-api-key>`
|
||||
- `OMADA_API_SECRET` is empty
|
||||
|
||||
2. **Set Correct Values:**
|
||||
```bash
|
||||
# Edit omada-api/.env
|
||||
# Replace placeholder with actual API key
|
||||
# Set OMADA_API_SECRET if required
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ✅ Automated/Completed
|
||||
|
||||
### What Was Done Automatically
|
||||
|
||||
1. ✅ Updated .gitignore with .env patterns
|
||||
2. ✅ Created comprehensive documentation
|
||||
3. ✅ Created utility scripts
|
||||
4. ✅ Documented all manual steps
|
||||
5. ✅ Created migration guides
|
||||
|
||||
### What Requires User Action
|
||||
|
||||
1. ⏳ Clean up backup files (script ready, needs execution)
|
||||
2. ⏳ Migrate private keys (guide ready, needs implementation)
|
||||
3. ⏳ Create and configure Cloudflare API token (script ready, needs execution)
|
||||
4. ⏳ Fix Omada API configuration (needs actual values)
|
||||
|
||||
---
|
||||
|
||||
## 📊 Security Status
|
||||
|
||||
### Before Improvements
|
||||
|
||||
- ❌ .env patterns not fully in .gitignore
|
||||
- ❌ Backup files with secrets in repository
|
||||
- ❌ Private keys in plain text .env files
|
||||
- ❌ Using legacy API_KEY instead of API_TOKEN
|
||||
- ❌ No comprehensive secret inventory
|
||||
- ❌ No migration/cleanup scripts
|
||||
|
||||
### After Improvements
|
||||
|
||||
- ✅ .env patterns in .gitignore
|
||||
- ✅ Cleanup script ready for backup files
|
||||
- ✅ Migration guide for private keys
|
||||
- ✅ Migration script for API tokens
|
||||
- ✅ Comprehensive secret inventory
|
||||
- ✅ All documentation and scripts created
|
||||
- ⏳ Manual steps documented and ready
|
||||
|
||||
---
|
||||
|
||||
## Next Steps
|
||||
|
||||
### Immediate (Can Do Now)
|
||||
|
||||
1. **Review Backup Files:**
|
||||
```bash
|
||||
./scripts/cleanup-env-backup-files.sh # Dry run
|
||||
```
|
||||
|
||||
2. **Review Documentation:**
|
||||
- Read `SECURE_SECRETS_MIGRATION_GUIDE.md`
|
||||
- Review `REQUIRED_SECRETS_INVENTORY.md`
|
||||
|
||||
### Short-Term (This Week)
|
||||
|
||||
1. **Clean Up Backup Files:**
|
||||
```bash
|
||||
DRY_RUN=0 ./scripts/cleanup-env-backup-files.sh
|
||||
```
|
||||
|
||||
2. **Migrate Cloudflare API Token:**
|
||||
```bash
|
||||
./scripts/migrate-cloudflare-api-token.sh
|
||||
./scripts/test-cloudflare-api-token.sh
|
||||
```
|
||||
|
||||
3. **Secure Private Keys:**
|
||||
- Choose storage method
|
||||
- Implement secure storage
|
||||
- Remove from .env files
|
||||
|
||||
### Long-Term (Ongoing)
|
||||
|
||||
1. **Implement Key Management Service:**
|
||||
- Set up HashiCorp Vault or cloud key management
|
||||
- Migrate all secrets
|
||||
- Update deployment scripts
|
||||
|
||||
2. **Set Up Secret Rotation:**
|
||||
- Create rotation schedule
|
||||
- Implement rotation procedures
|
||||
- Document rotation process
|
||||
|
||||
3. **Implement Access Auditing:**
|
||||
- Log secret access
|
||||
- Monitor for unauthorized access
|
||||
- Regular security reviews
|
||||
|
||||
---
|
||||
|
||||
## Files Created/Modified
|
||||
|
||||
### Documentation
|
||||
- `docs/04-configuration/REQUIRED_SECRETS_INVENTORY.md` (new)
|
||||
- `docs/04-configuration/ENV_SECRETS_AUDIT_REPORT.md` (new)
|
||||
- `docs/04-configuration/REQUIRED_SECRETS_SUMMARY.md` (new)
|
||||
- `docs/04-configuration/SECURE_SECRETS_MIGRATION_GUIDE.md` (new)
|
||||
- `docs/04-configuration/SECURITY_IMPROVEMENTS_COMPLETE.md` (new)
|
||||
|
||||
### Scripts
|
||||
- `scripts/check-env-secrets.sh` (new)
|
||||
- `scripts/cleanup-env-backup-files.sh` (new)
|
||||
- `scripts/migrate-cloudflare-api-token.sh` (new)
|
||||
- `scripts/test-cloudflare-api-token.sh` (new)
|
||||
|
||||
### Configuration
|
||||
- `.gitignore` (updated - added .env patterns)
|
||||
|
||||
---
|
||||
|
||||
## Verification
|
||||
|
||||
### To Verify Improvements
|
||||
|
||||
1. **Check .gitignore:**
|
||||
```bash
|
||||
grep -E "^\.env$|\.env\.|env\.backup" .gitignore
|
||||
```
|
||||
|
||||
2. **Verify .env files are ignored:**
|
||||
```bash
|
||||
git check-ignore .env smom-dbis-138/.env explorer-monorepo/.env
|
||||
```
|
||||
|
||||
3. **Run Audit:**
|
||||
```bash
|
||||
./scripts/check-env-secrets.sh
|
||||
```
|
||||
|
||||
4. **Review Documentation:**
|
||||
```bash
|
||||
ls -la docs/04-configuration/REQUIRED_SECRETS*.md
|
||||
ls -la docs/04-configuration/SECURE_SECRETS*.md
|
||||
ls -la docs/04-configuration/SECURITY_IMPROVEMENTS*.md
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [Required Secrets Inventory](./REQUIRED_SECRETS_INVENTORY.md)
|
||||
- [Environment Secrets Audit Report](./ENV_SECRETS_AUDIT_REPORT.md)
|
||||
- [Required Secrets Summary](./REQUIRED_SECRETS_SUMMARY.md)
|
||||
- [Secure Secrets Migration Guide](./SECURE_SECRETS_MIGRATION_GUIDE.md)
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** 2025-01-20
|
||||
**Status:** ✅ Implementation Complete (Automated Steps)
|
||||
**Next Review:** After manual steps completed
|
||||
35
docs/04-configuration/SETUP_TUNNEL_NOW.md
Normal file
35
docs/04-configuration/SETUP_TUNNEL_NOW.md
Normal file
@@ -0,0 +1,35 @@
|
||||
# Quick Start: Setup Cloudflare Tunnel
|
||||
|
||||
## Ready to Run
|
||||
|
||||
You have everything prepared! Just need your tunnel token from Cloudflare.
|
||||
|
||||
## Run This Command
|
||||
|
||||
```bash
|
||||
cd /home/intlc/projects/proxmox
|
||||
./scripts/setup-cloudflare-tunnel-rpc.sh <YOUR_TUNNEL_TOKEN>
|
||||
```
|
||||
|
||||
## Get Your Token
|
||||
|
||||
1. Go to: https://one.dash.cloudflare.com
|
||||
2. Zero Trust → Networks → Tunnels
|
||||
3. Create tunnel (or select existing)
|
||||
4. Copy the token (starts with `eyJhIjoi...`)
|
||||
|
||||
## What It Does
|
||||
|
||||
✅ Stops existing DoH proxy
|
||||
✅ Installs tunnel service
|
||||
✅ Configures 4 RPC endpoints
|
||||
✅ Starts tunnel service
|
||||
✅ Verifies it's running
|
||||
|
||||
## After Running
|
||||
|
||||
1. Configure routes in Cloudflare Dashboard (see CLOUDFLARE_TUNNEL_QUICK_SETUP.md)
|
||||
2. Update DNS records to CNAME pointing to tunnel
|
||||
3. Test endpoints
|
||||
|
||||
See: docs/04-configuration/CLOUDFLARE_TUNNEL_QUICK_SETUP.md for full details
|
||||
427
docs/04-configuration/THIRDWEB_RPC_CLOUDFLARE_SETUP.md
Normal file
427
docs/04-configuration/THIRDWEB_RPC_CLOUDFLARE_SETUP.md
Normal file
@@ -0,0 +1,427 @@
|
||||
# ThirdWeb RPC (VMID 2400) - Cloudflare Tunnel Setup
|
||||
|
||||
**Last Updated:** 2025-01-23
|
||||
**Status:** Setup Guide
|
||||
**VMID:** 2400
|
||||
**IP:** 192.168.11.240
|
||||
**Domain:** `defi-oracle.io`
|
||||
**FQDN:** `rpc.public-0138.defi-oracle.io`
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
Since VMID 2400 is on a Proxmox host that doesn't have access to pve2 (192.168.11.12) where the existing Cloudflared tunnel is located, we need to install Cloudflared directly in VMID 2400 to create its own tunnel connection to Cloudflare.
|
||||
|
||||
**Architecture:**
|
||||
```
|
||||
Internet → Cloudflare → Cloudflare Tunnel (from VMID 2400) → Nginx (port 443) → Besu RPC (8545/8546)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Prerequisites
|
||||
|
||||
1. **Access to Proxmox host** where VMID 2400 is running
|
||||
2. **Access to VMID 2400 container** (via `pct exec 2400`)
|
||||
3. **Cloudflare account** with access to `defi-oracle.io` domain
|
||||
4. **Cloudflare Zero Trust access** (free tier is sufficient)
|
||||
|
||||
---
|
||||
|
||||
## Step 1: Create Cloudflare Tunnel
|
||||
|
||||
### 1.1 Create Tunnel in Cloudflare Dashboard
|
||||
|
||||
1. Go to: https://one.dash.cloudflare.com/
|
||||
2. Navigate to: **Zero Trust** → **Networks** → **Tunnels**
|
||||
3. Click **Create a tunnel**
|
||||
4. Select **Cloudflared** as the connector type
|
||||
5. Give it a name (e.g., `thirdweb-rpc-2400`)
|
||||
6. Click **Save tunnel**
|
||||
|
||||
### 1.2 Copy the Tunnel Token
|
||||
|
||||
After creating the tunnel, you'll see a token. Copy it - you'll need it in the next step.
|
||||
|
||||
**Token format:** `eyJhIjoi...` (long base64 string)
|
||||
|
||||
---
|
||||
|
||||
## Step 2: Install Cloudflared on VMID 2400
|
||||
|
||||
### 2.1 Access the Container
|
||||
|
||||
**If you have SSH access to the Proxmox host:**
|
||||
|
||||
```bash
|
||||
# Replace with your Proxmox host IP
|
||||
PROXMOX_HOST="192.168.11.10" # or your Proxmox host IP
|
||||
|
||||
# Enter the container
|
||||
ssh root@${PROXMOX_HOST} "pct exec 2400 -- bash"
|
||||
```
|
||||
|
||||
**If you have console access to the Proxmox host:**
|
||||
|
||||
```bash
|
||||
# List containers
|
||||
pct list | grep 2400
|
||||
|
||||
# Enter the container
|
||||
pct exec 2400 -- bash
|
||||
```
|
||||
|
||||
### 2.2 Install Cloudflared
|
||||
|
||||
Once inside the container, run:
|
||||
|
||||
```bash
|
||||
# Update package list
|
||||
apt update
|
||||
|
||||
# Install wget if not available
|
||||
apt install -y wget
|
||||
|
||||
# Download and install cloudflared
|
||||
cd /tmp
|
||||
wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
|
||||
dpkg -i cloudflared-linux-amd64.deb || apt install -f -y
|
||||
|
||||
# Verify installation
|
||||
cloudflared --version
|
||||
```
|
||||
|
||||
### 2.3 Install Tunnel Service
|
||||
|
||||
Replace `<TUNNEL_TOKEN>` with the token you copied from Step 1.2:
|
||||
|
||||
```bash
|
||||
# Install tunnel service with token
|
||||
cloudflared service install <TUNNEL_TOKEN>
|
||||
|
||||
# Enable and start service
|
||||
systemctl enable cloudflared
|
||||
systemctl start cloudflared
|
||||
|
||||
# Check status
|
||||
systemctl status cloudflared
|
||||
```
|
||||
|
||||
### 2.4 Verify Tunnel is Running
|
||||
|
||||
```bash
|
||||
# Check service status
|
||||
systemctl status cloudflared --no-pager -l
|
||||
|
||||
# List tunnels (should show your tunnel)
|
||||
cloudflared tunnel list
|
||||
|
||||
# Check tunnel configuration
|
||||
cat /etc/cloudflared/config.yml
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Step 3: Configure Tunnel Route in Cloudflare
|
||||
|
||||
### 3.1 Configure Public Hostname
|
||||
|
||||
1. Go back to Cloudflare Dashboard: **Zero Trust** → **Networks** → **Tunnels**
|
||||
2. Click on your tunnel name (`thirdweb-rpc-2400`)
|
||||
3. Click **Configure**
|
||||
4. Go to **Public Hostname** tab
|
||||
5. Click **Add a public hostname**
|
||||
|
||||
### 3.2 Add RPC Endpoint Configuration
|
||||
|
||||
**For HTTP RPC:**
|
||||
|
||||
```
|
||||
Subdomain: rpc.public-0138
|
||||
Domain: defi-oracle.io
|
||||
Service Type: HTTP
|
||||
URL: http://127.0.0.1:8545
|
||||
```
|
||||
|
||||
**Note:** If you have Nginx configured on VMID 2400 with SSL on port 443, use:
|
||||
```
|
||||
URL: https://127.0.0.1:443
|
||||
```
|
||||
or
|
||||
```
|
||||
URL: http://127.0.0.1:443
|
||||
```
|
||||
|
||||
### 3.3 Add WebSocket Support (Optional)
|
||||
|
||||
If you need WebSocket RPC support, you can either:
|
||||
|
||||
**Option A:** Use the same hostname (Cloudflare supports WebSocket on HTTP endpoints)
|
||||
- The same `rpc.public-0138.defi-oracle.io` hostname will handle both HTTP and WebSocket
|
||||
- Configure your Nginx to route WebSocket connections appropriately
|
||||
|
||||
**Option B:** Add a separate hostname for WebSocket:
|
||||
```
|
||||
Subdomain: rpc-ws.public-0138
|
||||
Domain: defi-oracle.io
|
||||
Service Type: HTTP
|
||||
URL: http://127.0.0.1:8546
|
||||
```
|
||||
|
||||
### 3.4 Save Configuration
|
||||
|
||||
Click **Save hostname** for each entry you add.
|
||||
|
||||
---
|
||||
|
||||
## Step 4: Configure Nginx on VMID 2400 (If Needed)
|
||||
|
||||
If VMID 2400 doesn't have Nginx configured yet, you'll need to set it up to handle the RPC endpoints.
|
||||
|
||||
### 4.1 Install Nginx
|
||||
|
||||
```bash
|
||||
# Inside VMID 2400 container
|
||||
apt install -y nginx
|
||||
```
|
||||
|
||||
### 4.2 Configure Nginx for RPC
|
||||
|
||||
Create Nginx configuration:
|
||||
|
||||
```bash
|
||||
cat > /etc/nginx/sites-available/rpc-thirdweb << 'EOF'
|
||||
# HTTP to HTTPS redirect (optional)
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name rpc.public-0138.defi-oracle.io;
|
||||
|
||||
# Redirect all HTTP to HTTPS
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# HTTPS server - HTTP RPC API (port 8545)
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name rpc.public-0138.defi-oracle.io;
|
||||
|
||||
# SSL configuration (you'll need to generate certificates)
|
||||
# For Cloudflare tunnel, you can use self-signed or Cloudflare SSL
|
||||
ssl_certificate /etc/nginx/ssl/rpc.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/rpc.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
|
||||
# Security headers
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
|
||||
# Increase timeouts for RPC calls
|
||||
proxy_connect_timeout 300s;
|
||||
proxy_send_timeout 300s;
|
||||
proxy_read_timeout 300s;
|
||||
|
||||
# HTTP RPC endpoint (port 8545)
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8545;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
}
|
||||
|
||||
# HTTPS server - WebSocket RPC API (port 8546)
|
||||
server {
|
||||
listen 8443 ssl http2;
|
||||
listen [::]:8443 ssl http2;
|
||||
server_name rpc.public-0138.defi-oracle.io;
|
||||
|
||||
# SSL configuration
|
||||
ssl_certificate /etc/nginx/ssl/rpc.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/rpc.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
|
||||
# WebSocket RPC endpoint (port 8546)
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8546;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
# WebSocket headers
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# Long timeouts for WebSocket connections
|
||||
proxy_read_timeout 86400;
|
||||
proxy_send_timeout 86400;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
# Enable the site
|
||||
ln -sf /etc/nginx/sites-available/rpc-thirdweb /etc/nginx/sites-enabled/
|
||||
rm -f /etc/nginx/sites-enabled/default
|
||||
|
||||
# Test configuration
|
||||
nginx -t
|
||||
|
||||
# Reload Nginx
|
||||
systemctl reload nginx
|
||||
```
|
||||
|
||||
**Note:** If using Cloudflare tunnel, you can point the tunnel directly to `http://127.0.0.1:8545` (bypassing Nginx) since Cloudflare handles SSL termination. In that case, Nginx is optional.
|
||||
|
||||
---
|
||||
|
||||
## Step 5: Configure DNS Record
|
||||
|
||||
### 5.1 Create DNS Record in Cloudflare
|
||||
|
||||
1. Go to Cloudflare Dashboard: **DNS** → **Records**
|
||||
2. Select domain: `defi-oracle.io`
|
||||
3. Click **Add record**
|
||||
|
||||
### 5.2 Configure DNS Record
|
||||
|
||||
**If using Cloudflare Tunnel (Recommended):**
|
||||
|
||||
```
|
||||
Type: CNAME
|
||||
Name: rpc.public-0138
|
||||
Target: <your-tunnel-id>.cfargotunnel.com
|
||||
Proxy: 🟠 Proxied (orange cloud)
|
||||
TTL: Auto
|
||||
```
|
||||
|
||||
**To find your tunnel ID:**
|
||||
- Go to **Zero Trust** → **Networks** → **Tunnels**
|
||||
- Click on your tunnel name
|
||||
- The tunnel ID is shown in the URL or tunnel details
|
||||
|
||||
**Alternative: Direct A Record (If using public IP with port forwarding)**
|
||||
|
||||
If you prefer to use a direct A record with port forwarding on the ER605 router:
|
||||
|
||||
```
|
||||
Type: A
|
||||
Name: rpc.public-0138
|
||||
Target: <your-public-ip>
|
||||
Proxy: 🟠 Proxied (recommended) or ❌ DNS only
|
||||
TTL: Auto
|
||||
```
|
||||
|
||||
Then configure port forwarding on ER605:
|
||||
- External Port: 443
|
||||
- Internal IP: 192.168.11.240
|
||||
- Internal Port: 443
|
||||
- Protocol: TCP
|
||||
|
||||
---
|
||||
|
||||
## Step 6: Verify Setup
|
||||
|
||||
### 6.1 Check Tunnel Status
|
||||
|
||||
```bash
|
||||
# Inside VMID 2400 container
|
||||
systemctl status cloudflared
|
||||
cloudflared tunnel list
|
||||
```
|
||||
|
||||
### 6.2 Test DNS Resolution
|
||||
|
||||
```bash
|
||||
# From your local machine
|
||||
dig rpc.public-0138.defi-oracle.io
|
||||
nslookup rpc.public-0138.defi-oracle.io
|
||||
|
||||
# Should resolve to Cloudflare IPs (if proxied) or your public IP
|
||||
```
|
||||
|
||||
### 6.3 Test RPC Endpoint
|
||||
|
||||
```bash
|
||||
# Test HTTP RPC endpoint
|
||||
curl -k https://rpc.public-0138.defi-oracle.io \
|
||||
-X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
|
||||
|
||||
# Test WebSocket (using wscat)
|
||||
wscat -c wss://rpc.public-0138.defi-oracle.io
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Tunnel Not Connecting
|
||||
|
||||
```bash
|
||||
# Check cloudflared logs
|
||||
journalctl -u cloudflared -f
|
||||
|
||||
# Check tunnel status
|
||||
cloudflared tunnel list
|
||||
|
||||
# Verify tunnel token
|
||||
cat /etc/cloudflared/credentials.json
|
||||
```
|
||||
|
||||
### DNS Not Resolving
|
||||
|
||||
1. Verify DNS record is created correctly in Cloudflare
|
||||
2. Wait a few minutes for DNS propagation
|
||||
3. Check if tunnel is healthy in Cloudflare Dashboard
|
||||
|
||||
### Connection Refused
|
||||
|
||||
```bash
|
||||
# Check if Besu RPC is running
|
||||
systemctl status besu-rpc
|
||||
|
||||
# Test Besu RPC locally
|
||||
curl -X POST http://127.0.0.1:8545 \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
|
||||
|
||||
# Check Nginx (if using)
|
||||
systemctl status nginx
|
||||
nginx -t
|
||||
```
|
||||
|
||||
### SSL Certificate Issues
|
||||
|
||||
If using Nginx with SSL, you may need to generate certificates. For Cloudflare tunnel, SSL is handled by Cloudflare, so you can use HTTP internally.
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
After completing these steps:
|
||||
|
||||
✅ Cloudflared installed on VMID 2400
|
||||
✅ Cloudflare tunnel created and connected
|
||||
✅ Tunnel route configured for `rpc.public-0138.defi-oracle.io`
|
||||
✅ DNS record created (CNAME to tunnel)
|
||||
✅ RPC endpoint accessible at `https://rpc.public-0138.defi-oracle.io`
|
||||
|
||||
**Next Steps:**
|
||||
- Verify the endpoint works with Thirdweb SDK
|
||||
- Update Thirdweb listing with the new RPC URL
|
||||
- Monitor tunnel status and logs
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [RPC_DNS_CONFIGURATION.md](RPC_DNS_CONFIGURATION.md) - DNS configuration overview
|
||||
- [THIRDWEB_RPC_SETUP.md](../THIRDWEB_RPC_SETUP.md) - ThirdWeb RPC node setup guide
|
||||
- [CLOUDFLARE_TUNNEL_CONFIGURATION_GUIDE.md](../CLOUDFLARE_TUNNEL_CONFIGURATION_GUIDE.md) - General tunnel configuration
|
||||
137
docs/04-configuration/TUNNEL_CONFIG_VERIFIED.md
Normal file
137
docs/04-configuration/TUNNEL_CONFIG_VERIFIED.md
Normal file
@@ -0,0 +1,137 @@
|
||||
# Tunnel Configuration Verified ✅
|
||||
|
||||
## Configuration Status
|
||||
|
||||
Your Cloudflare tunnel configuration looks **correct**! All 10 routes are properly configured.
|
||||
|
||||
## Configured Routes
|
||||
|
||||
| # | Hostname | Service | Target | Origin Config |
|
||||
|---|----------|---------|--------|---------------|
|
||||
| 1 | explorer.d-bis.org | HTTP | http://192.168.11.21:80 | - |
|
||||
| 2 | rpc-http-pub.d-bis.org | HTTP | http://192.168.11.21:80 | - |
|
||||
| 3 | rpc-http-prv.d-bis.org | HTTP | http://192.168.11.21:80 | - |
|
||||
| 4 | dbis-admin.d-bis.org | HTTP | http://192.168.11.21:80 | - |
|
||||
| 5 | dbis-api.d-bis.org | HTTP | http://192.168.11.21:80 | - |
|
||||
| 6 | dbis-api-2.d-bis.org | HTTP | http://192.168.11.21:80 | - |
|
||||
| 7 | mim4u.org | HTTP | http://192.168.11.21:80 | - |
|
||||
| 8 | www.mim4u.org | HTTP | http://192.168.11.21:80 | - |
|
||||
| 9 | rpc-ws-pub.d-bis.org | HTTP | http://192.168.11.21:80 | noTLSVerify, httpHostHeader |
|
||||
| 10 | rpc-ws-prv.d-bis.org | HTTP | http://192.168.11.21:80 | noTLSVerify, httpHostHeader |
|
||||
|
||||
## Important Notes
|
||||
|
||||
### ✅ Configuration is Correct
|
||||
- All routes point to correct target: `http://192.168.11.21:80`
|
||||
- WebSocket routes have proper origin configurations
|
||||
- All hostnames are configured
|
||||
|
||||
### ⚠️ Domain Difference Noted
|
||||
- **Tunnel Config**: Uses `mim4u.org` and `www.mim4u.org` (root domain)
|
||||
- **DNS Zone**: Had `mim4u.org.d-bis.org` (subdomain)
|
||||
|
||||
**This is correct** if `mim4u.org` is a separate domain in Cloudflare (which it is).
|
||||
|
||||
### Missing: Catch-All Rule
|
||||
|
||||
I don't see a catch-all rule in your list. It's recommended to add:
|
||||
- **Path**: `*`
|
||||
- **Service**: `HTTP 404: Not Found`
|
||||
- **Must be last** in the list
|
||||
|
||||
This handles any unmatched requests gracefully.
|
||||
|
||||
## Next Steps
|
||||
|
||||
### 1. Verify Tunnel Status
|
||||
|
||||
Check in Cloudflare Dashboard:
|
||||
- Go to: Zero Trust → Networks → Tunnels
|
||||
- Find tunnel: `10ab22da-8ea3-4e2e-a896-27ece2211a05`
|
||||
- Status should be **HEALTHY** (not DOWN)
|
||||
|
||||
### 2. Test Endpoints
|
||||
|
||||
Run the verification script:
|
||||
```bash
|
||||
./verify-tunnel-config.sh
|
||||
```
|
||||
|
||||
Or test manually:
|
||||
```bash
|
||||
curl -I https://explorer.d-bis.org
|
||||
curl -I https://rpc-http-pub.d-bis.org
|
||||
curl -I https://dbis-admin.d-bis.org
|
||||
curl -I https://dbis-api.d-bis.org
|
||||
curl -I https://mim4u.org
|
||||
```
|
||||
|
||||
### 3. If Tunnels Are Still DOWN
|
||||
|
||||
The configuration is correct, but the tunnel connector may not be running:
|
||||
|
||||
```bash
|
||||
# Check container status
|
||||
ssh root@192.168.11.12 "pct status 102"
|
||||
|
||||
# Check tunnel service
|
||||
ssh root@192.168.11.12 "pct exec 102 -- systemctl status cloudflared"
|
||||
|
||||
# Start if needed
|
||||
ssh root@192.168.11.12 "pct exec 102 -- systemctl start cloudflared"
|
||||
```
|
||||
|
||||
### 4. Add Catch-All Rule (Recommended)
|
||||
|
||||
In Cloudflare Dashboard:
|
||||
1. Go to tunnel configuration
|
||||
2. Add new route:
|
||||
- **Path**: `*`
|
||||
- **Service**: `HTTP 404: Not Found`
|
||||
3. **Move it to the bottom** (must be last)
|
||||
4. Save
|
||||
|
||||
## Configuration Summary
|
||||
|
||||
✅ **Routes**: 10 configured
|
||||
✅ **Target**: All correct (`http://192.168.11.21:80`)
|
||||
✅ **WebSocket**: Proper origin config
|
||||
⚠️ **Catch-all**: Missing (recommended to add)
|
||||
❓ **Status**: Check if tunnel connector is running
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### If Endpoints Don't Work
|
||||
|
||||
1. **Tunnel Status**: Check if tunnel shows HEALTHY in dashboard
|
||||
2. **Container**: Verify VMID 102 is running
|
||||
3. **Service**: Check cloudflared service is running
|
||||
4. **Nginx**: Verify Nginx is accessible at 192.168.11.21:80
|
||||
5. **DNS**: Check DNS records point to tunnel
|
||||
|
||||
### Common Issues
|
||||
|
||||
- **Tunnel DOWN**: Container/service not running
|
||||
- **404 Errors**: Nginx not configured for hostname
|
||||
- **502 Errors**: Nginx not accessible or down
|
||||
- **Timeout**: Network connectivity issues
|
||||
|
||||
## Verification Checklist
|
||||
|
||||
- [x] All 10 routes configured
|
||||
- [x] All routes point to correct target
|
||||
- [x] WebSocket routes have origin config
|
||||
- [ ] Catch-all rule added (recommended)
|
||||
- [ ] Tunnel status is HEALTHY
|
||||
- [ ] Container (VMID 102) is running
|
||||
- [ ] cloudflared service is running
|
||||
- [ ] Endpoints are accessible
|
||||
|
||||
## Summary
|
||||
|
||||
Your tunnel configuration is **correct**! The routes are properly set up. If tunnels are still DOWN, the issue is likely:
|
||||
- Tunnel connector (cloudflared) not running in VMID 102
|
||||
- Container not started
|
||||
- Network connectivity issues
|
||||
|
||||
The configuration itself is perfect - you just need to ensure the tunnel connector is running to establish the connection.
|
||||
176
docs/04-configuration/TUNNEL_TOKEN_INSTALL.md
Normal file
176
docs/04-configuration/TUNNEL_TOKEN_INSTALL.md
Normal file
@@ -0,0 +1,176 @@
|
||||
# Install Tunnel with Token
|
||||
|
||||
## Token Provided
|
||||
|
||||
You have a Cloudflare tunnel token for the shared tunnel:
|
||||
- **Tunnel ID**: `10ab22da-8ea3-4e2e-a896-27ece2211a05`
|
||||
- **Token**: `eyJhIjoiNTJhZDU3YTcxNjcxYzVmYzAwOWVkZjA3NDQ2NTgxOTYiLCJ0IjoiMTBhYjIyZGEtOGVhMy00ZTJlLWE4OTYtMjdlY2UyMjExYTA1IiwicyI6IlptRXlOMkkyTVRrdE1EZzFNeTAwTkRBNExXSXhaalF0Wm1KaE5XVmpaVEEzTVdGbCJ9`
|
||||
|
||||
## Installation Methods
|
||||
|
||||
### Method 1: Automated Script (If SSH Access Available)
|
||||
|
||||
```bash
|
||||
# If you have SSH access to Proxmox network:
|
||||
./install-shared-tunnel-token.sh
|
||||
|
||||
# Or via SSH tunnel:
|
||||
./setup_ssh_tunnel.sh
|
||||
PROXMOX_HOST=localhost ./install-shared-tunnel-token.sh
|
||||
```
|
||||
|
||||
### Method 2: Manual Installation (Direct Container Access)
|
||||
|
||||
If you can access the container directly:
|
||||
|
||||
```bash
|
||||
# 1. Access container
|
||||
ssh root@192.168.11.12
|
||||
pct exec 102 -- bash
|
||||
|
||||
# 2. Install cloudflared (if needed)
|
||||
apt update
|
||||
apt install -y cloudflared
|
||||
|
||||
# 3. Install tunnel service with token
|
||||
cloudflared service install eyJhIjoiNTJhZDU3YTcxNjcxYzVmYzAwOWVkZjA3NDQ2NTgxOTYiLCJ0IjoiMTBhYjIyZGEtOGVhMy00ZTJlLWE4OTYtMjdlY2UyMjExYTA1IiwicyI6IlptRXlOMkkyTVRrdE1EZzFNeTAwTkRBNExXSXhaalF0Wm1KaE5XVmpaVEEzTVdGbCJ9
|
||||
|
||||
# 4. Create configuration file
|
||||
cat > /etc/cloudflared/config.yml << 'EOF'
|
||||
tunnel: 10ab22da-8ea3-4e2e-a896-27ece2211a05
|
||||
credentials-file: /root/.cloudflared/10ab22da-8ea3-4e2e-a896-27ece2211a05.json
|
||||
|
||||
ingress:
|
||||
- hostname: dbis-admin.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
originRequest:
|
||||
httpHostHeader: dbis-admin.d-bis.org
|
||||
- hostname: dbis-api.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
originRequest:
|
||||
httpHostHeader: dbis-api.d-bis.org
|
||||
- hostname: dbis-api-2.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
originRequest:
|
||||
httpHostHeader: dbis-api-2.d-bis.org
|
||||
- hostname: mim4u.org.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
originRequest:
|
||||
httpHostHeader: mim4u.org.d-bis.org
|
||||
- hostname: www.mim4u.org.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
originRequest:
|
||||
httpHostHeader: www.mim4u.org.d-bis.org
|
||||
- hostname: rpc-http-prv.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
originRequest:
|
||||
httpHostHeader: rpc-http-prv.d-bis.org
|
||||
- hostname: rpc-http-pub.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
originRequest:
|
||||
httpHostHeader: rpc-http-pub.d-bis.org
|
||||
- hostname: rpc-ws-prv.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
originRequest:
|
||||
httpHostHeader: rpc-ws-prv.d-bis.org
|
||||
- hostname: rpc-ws-pub.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
originRequest:
|
||||
httpHostHeader: rpc-ws-pub.d-bis.org
|
||||
- service: http_status:404
|
||||
|
||||
metrics: 127.0.0.1:9090
|
||||
loglevel: info
|
||||
gracePeriod: 30s
|
||||
EOF
|
||||
|
||||
chmod 600 /etc/cloudflared/config.yml
|
||||
|
||||
# 5. Restart service
|
||||
systemctl daemon-reload
|
||||
systemctl restart cloudflared
|
||||
systemctl status cloudflared
|
||||
```
|
||||
|
||||
### Method 3: Cloudflare Dashboard Configuration
|
||||
|
||||
After installing with token, configure ingress rules via dashboard:
|
||||
|
||||
1. Go to: https://one.dash.cloudflare.com/
|
||||
2. Zero Trust → Networks → Tunnels
|
||||
3. Find tunnel: `10ab22da-8ea3-4e2e-a896-27ece2211a05`
|
||||
4. Click **Configure**
|
||||
5. Add all 9 hostnames (see list below)
|
||||
6. Save
|
||||
|
||||
## Hostnames to Configure
|
||||
|
||||
All these hostnames should route to `http://192.168.11.21:80`:
|
||||
|
||||
1. `dbis-admin.d-bis.org`
|
||||
2. `dbis-api.d-bis.org`
|
||||
3. `dbis-api-2.d-bis.org`
|
||||
4. `mim4u.org.d-bis.org`
|
||||
5. `www.mim4u.org.d-bis.org`
|
||||
6. `rpc-http-prv.d-bis.org`
|
||||
7. `rpc-http-pub.d-bis.org`
|
||||
8. `rpc-ws-prv.d-bis.org`
|
||||
9. `rpc-ws-pub.d-bis.org`
|
||||
|
||||
**Important**: Add catch-all rule (HTTP 404) as the LAST entry.
|
||||
|
||||
## Verification
|
||||
|
||||
After installation:
|
||||
|
||||
```bash
|
||||
# Check service status
|
||||
systemctl status cloudflared
|
||||
|
||||
# Check logs
|
||||
journalctl -u cloudflared -f
|
||||
|
||||
# Test endpoints (wait 1-2 minutes first)
|
||||
curl -I https://dbis-admin.d-bis.org
|
||||
curl -I https://rpc-http-pub.d-bis.org
|
||||
curl -I https://dbis-api.d-bis.org
|
||||
```
|
||||
|
||||
## What the Token Does
|
||||
|
||||
The token:
|
||||
- Authenticates the tunnel connector to Cloudflare
|
||||
- Associates the connector with tunnel ID `10ab22da-8ea3-4e2e-a896-27ece2211a05`
|
||||
- Creates systemd service automatically
|
||||
- Stores credentials in `/root/.cloudflared/`
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Service Not Starting
|
||||
|
||||
```bash
|
||||
# Check logs
|
||||
journalctl -u cloudflared -n 50
|
||||
|
||||
# Check if credentials file exists
|
||||
ls -la /root/.cloudflared/10ab22da-8ea3-4e2e-a896-27ece2211a05.json
|
||||
|
||||
# Verify config file
|
||||
cat /etc/cloudflared/config.yml
|
||||
```
|
||||
|
||||
### Tunnel Still DOWN
|
||||
|
||||
1. Wait 1-2 minutes for connection
|
||||
2. Check Cloudflare Dashboard
|
||||
3. Verify network connectivity from container
|
||||
4. Check if Nginx is accessible at `192.168.11.21:80`
|
||||
|
||||
## Summary
|
||||
|
||||
✅ **Token**: Provided and ready to use
|
||||
✅ **Tunnel ID**: `10ab22da-8ea3-4e2e-a896-27ece2211a05`
|
||||
✅ **Hostnames**: 9 hostnames need configuration
|
||||
✅ **Target**: All route to `http://192.168.11.21:80`
|
||||
|
||||
**Next**: Install using one of the methods above, then configure ingress rules.
|
||||
174
docs/04-configuration/VMID2400_DNS_STRUCTURE.md
Normal file
174
docs/04-configuration/VMID2400_DNS_STRUCTURE.md
Normal file
@@ -0,0 +1,174 @@
|
||||
# VMID 2400 - DNS CNAME Structure
|
||||
|
||||
**Date**: 2026-01-02
|
||||
**Domain**: `defi-oracle.io`
|
||||
**Purpose**: Two-level CNAME structure for ThirdWeb RPC endpoint
|
||||
|
||||
---
|
||||
|
||||
## DNS Structure
|
||||
|
||||
The DNS configuration uses a two-level CNAME chain for flexibility:
|
||||
|
||||
```
|
||||
rpc.defi-oracle.io
|
||||
↓ (CNAME)
|
||||
rpc.public-0138.defi-oracle.io
|
||||
↓ (CNAME)
|
||||
26138c21-db00-4a02-95db-ec75c07bda5b.cfargotunnel.com
|
||||
↓ (Cloudflare Tunnel)
|
||||
192.168.11.240:443 (Nginx) → 127.0.0.1:8545 (Besu RPC)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## DNS Records to Create
|
||||
|
||||
### Record 1: Tunnel Endpoint
|
||||
|
||||
```
|
||||
Type: CNAME
|
||||
Name: rpc.public-0138
|
||||
Domain: defi-oracle.io
|
||||
Target: 26138c21-db00-4a02-95db-ec75c07bda5b.cfargotunnel.com
|
||||
Proxy: 🟠 Proxied (orange cloud)
|
||||
TTL: Auto
|
||||
```
|
||||
|
||||
**Full FQDN**: `rpc.public-0138.defi-oracle.io`
|
||||
**Purpose**: Points directly to the Cloudflare tunnel endpoint
|
||||
|
||||
---
|
||||
|
||||
### Record 2: Short Alias
|
||||
|
||||
```
|
||||
Type: CNAME
|
||||
Name: rpc
|
||||
Domain: defi-oracle.io
|
||||
Target: rpc.public-0138.defi-oracle.io
|
||||
Proxy: 🟠 Proxied (orange cloud)
|
||||
TTL: Auto
|
||||
```
|
||||
|
||||
**Full FQDN**: `rpc.defi-oracle.io`
|
||||
**Purpose**: Provides a shorter, more convenient alias that resolves to the full FQDN
|
||||
|
||||
---
|
||||
|
||||
## Benefits of Two-Level Structure
|
||||
|
||||
1. **Flexibility**: Can change the tunnel endpoint without updating the short alias
|
||||
2. **Convenience**: `rpc.defi-oracle.io` is easier to remember and use
|
||||
3. **Backwards Compatibility**: If you need to change the tunnel or endpoint structure, only the first CNAME needs updating
|
||||
4. **Organization**: The `rpc.public-0138` name clearly indicates it's for ChainID 138 public RPC
|
||||
|
||||
---
|
||||
|
||||
## Usage
|
||||
|
||||
Both endpoints will work and resolve to the same tunnel:
|
||||
|
||||
**Full FQDN**:
|
||||
- `https://rpc.public-0138.defi-oracle.io`
|
||||
|
||||
**Short Alias**:
|
||||
- `https://rpc.defi-oracle.io`
|
||||
|
||||
Both URLs will:
|
||||
1. Resolve through the CNAME chain
|
||||
2. Connect to Cloudflare tunnel `26138c21-db00-4a02-95db-ec75c07bda5b`
|
||||
3. Route to VMID 2400 (192.168.11.240)
|
||||
4. Be handled by Nginx on port 443
|
||||
5. Proxy to Besu RPC on port 8545
|
||||
|
||||
---
|
||||
|
||||
## Cloudflare Dashboard Configuration
|
||||
|
||||
### Step 1: Create First CNAME (Tunnel Endpoint)
|
||||
|
||||
1. Go to: **DNS** → **Records**
|
||||
2. Click: **Add record**
|
||||
3. Configure:
|
||||
- **Type**: CNAME
|
||||
- **Name**: `rpc.public-0138`
|
||||
- **Target**: `26138c21-db00-4a02-95db-ec75c07bda5b.cfargotunnel.com`
|
||||
- **Proxy**: 🟠 Proxied
|
||||
- **TTL**: Auto
|
||||
4. Click: **Save**
|
||||
|
||||
### Step 2: Create Second CNAME (Short Alias)
|
||||
|
||||
1. Click: **Add record** again
|
||||
2. Configure:
|
||||
- **Type**: CNAME
|
||||
- **Name**: `rpc`
|
||||
- **Target**: `rpc.public-0138.defi-oracle.io`
|
||||
- **Proxy**: 🟠 Proxied
|
||||
- **TTL**: Auto
|
||||
3. Click: **Save**
|
||||
|
||||
---
|
||||
|
||||
## Verification
|
||||
|
||||
### Test DNS Resolution
|
||||
|
||||
```bash
|
||||
# Test full FQDN
|
||||
dig rpc.public-0138.defi-oracle.io
|
||||
nslookup rpc.public-0138.defi-oracle.io
|
||||
|
||||
# Test short alias
|
||||
dig rpc.defi-oracle.io
|
||||
nslookup rpc.defi-oracle.io
|
||||
|
||||
# Both should resolve to Cloudflare IPs (if proxied)
|
||||
```
|
||||
|
||||
### Test Endpoints
|
||||
|
||||
```bash
|
||||
# Test full FQDN
|
||||
curl -k https://rpc.public-0138.defi-oracle.io/health
|
||||
|
||||
# Test short alias
|
||||
curl -k https://rpc.defi-oracle.io/health
|
||||
|
||||
# Both should work identically
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Important Notes
|
||||
|
||||
1. **Proxy Status**: Both CNAME records should be **Proxied** (🟠 orange cloud) for DDoS protection and SSL termination
|
||||
|
||||
2. **CNAME Chain**: Cloudflare supports CNAME chains, so `rpc` → `rpc.public-0138` → `tunnel` works correctly
|
||||
|
||||
3. **Tunnel Route**: The tunnel route in Cloudflare should be configured for `rpc.public-0138.defi-oracle.io` (the actual endpoint), but both URLs will work since DNS resolves the short alias first
|
||||
|
||||
4. **Nginx Configuration**: Nginx is configured for `rpc.public-0138.defi-oracle.io` as the server_name. If you want to support both, you can add `rpc.defi-oracle.io` to the server_name directive, but it's not required since Cloudflare handles the DNS resolution.
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### CNAME Chain Not Resolving
|
||||
|
||||
- Wait 1-2 minutes for DNS propagation
|
||||
- Verify both CNAME records are created correctly
|
||||
- Check that the target of the first CNAME (`rpc.public-0138`) points to the tunnel endpoint
|
||||
- Verify tunnel is healthy in Cloudflare Dashboard
|
||||
|
||||
### Only One URL Works
|
||||
|
||||
- Check that both CNAME records are created
|
||||
- Verify both are set to Proxied (orange cloud)
|
||||
- Test DNS resolution for both: `dig rpc.defi-oracle.io` and `dig rpc.public-0138.defi-oracle.io`
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2026-01-02
|
||||
**Status**: ✅ **DOCUMENTATION COMPLETE**
|
||||
315
docs/04-configuration/VMID2400_ENV_SECRETS_CHECKLIST.md
Normal file
315
docs/04-configuration/VMID2400_ENV_SECRETS_CHECKLIST.md
Normal file
@@ -0,0 +1,315 @@
|
||||
# VMID 2400 Cloudflare Tunnel - Environment Secrets Checklist
|
||||
|
||||
**Date**: 2025-01-23
|
||||
**Purpose**: Complete list of all secrets and environment variables needed for VMID 2400 ThirdWeb RPC Cloudflare tunnel setup
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
This document lists all required secrets and environment variables for setting up the Cloudflare tunnel for VMID 2400 (ThirdWeb RPC node) on the `defi-oracle.io` domain.
|
||||
|
||||
---
|
||||
|
||||
## Required Secrets for Cloudflare Tunnel Setup
|
||||
|
||||
### 1. Cloudflare Tunnel Token 🔴 **CRITICAL**
|
||||
|
||||
**Variable Name**: `TUNNEL_TOKEN_VMID2400` (or pass directly to script)
|
||||
|
||||
**Description**: Token for the new Cloudflare tunnel to be created for VMID 2400
|
||||
|
||||
**Status**: ⚠️ **NEEDS TO BE CREATED**
|
||||
|
||||
**How to Obtain**:
|
||||
1. Go to: https://one.dash.cloudflare.com/
|
||||
2. Navigate to: **Zero Trust** → **Networks** → **Tunnels**
|
||||
3. Click: **Create a tunnel**
|
||||
4. Select: **Cloudflared**
|
||||
5. Name: `thirdweb-rpc-2400`
|
||||
6. Copy the token (starts with `eyJ...`)
|
||||
|
||||
**Format**:
|
||||
```bash
|
||||
TUNNEL_TOKEN_VMID2400="eyJhIjoi..."
|
||||
```
|
||||
|
||||
**Usage**:
|
||||
- Passed directly to script: `./scripts/setup-cloudflared-vmid2400.sh <TOKEN>`
|
||||
- Or set in environment: `export TUNNEL_TOKEN_VMID2400="eyJ..."`
|
||||
|
||||
---
|
||||
|
||||
### 2. Cloudflare API Token (Optional - for automated DNS/tunnel config)
|
||||
|
||||
**Variable Name**: `CLOUDFLARE_API_TOKEN`
|
||||
|
||||
**Description**: API token for programmatic Cloudflare API access (to configure DNS records and tunnel routes automatically)
|
||||
|
||||
**Status**: ⚠️ **OPTIONAL** (can configure manually in dashboard)
|
||||
|
||||
**How to Obtain**:
|
||||
1. Go to: https://dash.cloudflare.com/profile/api-tokens
|
||||
2. Click: **Create Token**
|
||||
3. Use **Edit zone DNS** template OR create custom token with:
|
||||
- **Zone** → **DNS** → **Edit**
|
||||
- **Account** → **Cloudflare Tunnel** → **Edit**
|
||||
4. Copy the token
|
||||
|
||||
**Format**:
|
||||
```bash
|
||||
CLOUDFLARE_API_TOKEN="your-api-token-here"
|
||||
```
|
||||
|
||||
**Alternative (Legacy)**:
|
||||
```bash
|
||||
CLOUDFLARE_EMAIL="your-email@example.com"
|
||||
CLOUDFLARE_API_KEY="your-global-api-key"
|
||||
```
|
||||
|
||||
**Usage**:
|
||||
- For automated DNS record creation
|
||||
- For automated tunnel route configuration
|
||||
- Not strictly required - can be done manually in dashboard
|
||||
|
||||
---
|
||||
|
||||
### 3. Cloudflare Zone ID (Optional - auto-detected if not set)
|
||||
|
||||
**Variable Name**: `CLOUDFLARE_ZONE_ID_DEFI_ORACLE`
|
||||
|
||||
**Description**: Zone ID for `defi-oracle.io` domain (can be auto-detected if API token is provided)
|
||||
|
||||
**Status**: ⚠️ **OPTIONAL**
|
||||
|
||||
**How to Obtain**:
|
||||
1. Go to Cloudflare Dashboard
|
||||
2. Select domain: `defi-oracle.io`
|
||||
3. Scroll down in Overview page - Zone ID is shown in right sidebar
|
||||
4. Or use API: `curl -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" https://api.cloudflare.com/client/v4/zones?name=defi-oracle.io`
|
||||
|
||||
**Format**:
|
||||
```bash
|
||||
CLOUDFLARE_ZONE_ID_DEFI_ORACLE="your-zone-id-here"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 4. Cloudflare Account ID (Optional - auto-detected if not set)
|
||||
|
||||
**Variable Name**: `CLOUDFLARE_ACCOUNT_ID`
|
||||
|
||||
**Description**: Cloudflare Account ID (can be auto-detected if API token is provided)
|
||||
|
||||
**Status**: ⚠️ **OPTIONAL**
|
||||
|
||||
**How to Obtain**:
|
||||
1. Go to Cloudflare Dashboard
|
||||
2. Right sidebar shows Account ID
|
||||
3. Or use API: `curl -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" https://api.cloudflare.com/client/v4/accounts`
|
||||
|
||||
**Format**:
|
||||
```bash
|
||||
CLOUDFLARE_ACCOUNT_ID="your-account-id-here"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Optional: ThirdWeb API Key (for chain configuration)
|
||||
|
||||
### 5. ThirdWeb API Key (Optional - for RPC URL configuration)
|
||||
|
||||
**Variable Name**: `THIRDWEB_API_KEY`
|
||||
|
||||
**Description**: API key for ThirdWeb RPC endpoints (used in chain configuration JSON)
|
||||
|
||||
**Status**: ⚠️ **OPTIONAL** (for RPC URL configuration in chainlist)
|
||||
|
||||
**How to Obtain**:
|
||||
1. Go to: https://thirdweb.com
|
||||
2. Sign up or log in
|
||||
3. Navigate to Dashboard → Settings → API Keys
|
||||
4. Generate API key
|
||||
|
||||
**Format**:
|
||||
```bash
|
||||
THIRDWEB_API_KEY="your-api-key-here"
|
||||
```
|
||||
|
||||
**Usage**:
|
||||
- Used in chain configuration: `pr-workspace/chains/_data/chains/eip155-138.json`
|
||||
- URLs: `https://defi-oracle-meta.rpc.thirdweb.com/${THIRDWEB_API_KEY}`
|
||||
- Not required for tunnel setup itself
|
||||
|
||||
---
|
||||
|
||||
## Complete .env File Template
|
||||
|
||||
### For VMID 2400 Tunnel Setup Only
|
||||
|
||||
**File**: `.env` (in project root: `/home/intlc/projects/proxmox/.env`)
|
||||
|
||||
```bash
|
||||
# ============================================
|
||||
# Cloudflare Configuration for VMID 2400
|
||||
# ============================================
|
||||
|
||||
# Cloudflare Tunnel Token (REQUIRED for VMID 2400 setup)
|
||||
# Get from: Zero Trust → Networks → Tunnels → Create tunnel
|
||||
TUNNEL_TOKEN_VMID2400="eyJhIjoi..."
|
||||
|
||||
# Cloudflare API Token (OPTIONAL - for automated DNS/tunnel config)
|
||||
# Get from: https://dash.cloudflare.com/profile/api-tokens
|
||||
CLOUDFLARE_API_TOKEN="your-api-token-here"
|
||||
|
||||
# Cloudflare Zone ID for defi-oracle.io (OPTIONAL - auto-detected)
|
||||
CLOUDFLARE_ZONE_ID_DEFI_ORACLE="your-zone-id-here"
|
||||
|
||||
# Cloudflare Account ID (OPTIONAL - auto-detected)
|
||||
CLOUDFLARE_ACCOUNT_ID="your-account-id-here"
|
||||
|
||||
# Domain for VMID 2400
|
||||
DOMAIN_DEFI_ORACLE="defi-oracle.io"
|
||||
|
||||
# ============================================
|
||||
# ThirdWeb Configuration (OPTIONAL)
|
||||
# ============================================
|
||||
|
||||
# ThirdWeb API Key (for RPC URL configuration)
|
||||
THIRDWEB_API_KEY="your-api-key-here"
|
||||
|
||||
# ============================================
|
||||
# Existing Cloudflare Config (if already present)
|
||||
# ============================================
|
||||
|
||||
# Existing domain (d-bis.org)
|
||||
DOMAIN="d-bis.org"
|
||||
CLOUDFLARE_ZONE_ID="existing-zone-id"
|
||||
CLOUDFLARE_ACCOUNT_ID="existing-account-id"
|
||||
|
||||
# Existing tunnel token (for pve2 tunnel)
|
||||
TUNNEL_TOKEN="eyJhIjoi..."
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Minimum Required Secrets
|
||||
|
||||
For **basic tunnel setup** (manual DNS/tunnel config in dashboard), you only need:
|
||||
|
||||
1. ✅ **TUNNEL_TOKEN_VMID2400** - To install cloudflared service on VMID 2400
|
||||
|
||||
For **automated setup** (script configures DNS/tunnel routes), you need:
|
||||
|
||||
1. ✅ **TUNNEL_TOKEN_VMID2400** - To install cloudflared service
|
||||
2. ✅ **CLOUDFLARE_API_TOKEN** - To configure DNS records and tunnel routes via API
|
||||
|
||||
---
|
||||
|
||||
## Step-by-Step Setup
|
||||
|
||||
### Option 1: Manual Setup (Minimum Secrets)
|
||||
|
||||
1. **Create Tunnel Token**:
|
||||
- Go to Cloudflare Dashboard → Zero Trust → Networks → Tunnels
|
||||
- Create tunnel: `thirdweb-rpc-2400`
|
||||
- Copy token
|
||||
|
||||
2. **Run Installation Script**:
|
||||
```bash
|
||||
./scripts/setup-cloudflared-vmid2400.sh <TUNNEL_TOKEN>
|
||||
```
|
||||
|
||||
3. **Configure Manually in Dashboard**:
|
||||
- Configure tunnel route (rpc.public-0138.defi-oracle.io → http://127.0.0.1:8545)
|
||||
- Create DNS CNAME record (rpc.public-0138 → <tunnel-id>.cfargotunnel.com)
|
||||
|
||||
**Required**: Only `TUNNEL_TOKEN_VMID2400`
|
||||
|
||||
---
|
||||
|
||||
### Option 2: Automated Setup (More Secrets)
|
||||
|
||||
1. **Create Tunnel Token** (same as above)
|
||||
|
||||
2. **Get API Token**:
|
||||
- Go to: https://dash.cloudflare.com/profile/api-tokens
|
||||
- Create token with Zone DNS Edit and Tunnel Edit permissions
|
||||
|
||||
3. **Add to .env**:
|
||||
```bash
|
||||
TUNNEL_TOKEN_VMID2400="eyJ..."
|
||||
CLOUDFLARE_API_TOKEN="your-token"
|
||||
DOMAIN_DEFI_ORACLE="defi-oracle.io"
|
||||
```
|
||||
|
||||
4. **Run Scripts** (future automation scripts can use these)
|
||||
|
||||
**Required**: `TUNNEL_TOKEN_VMID2400` + `CLOUDFLARE_API_TOKEN`
|
||||
|
||||
---
|
||||
|
||||
## Security Notes
|
||||
|
||||
### File Permissions
|
||||
|
||||
```bash
|
||||
# Ensure .env file has restrictive permissions
|
||||
chmod 600 .env
|
||||
```
|
||||
|
||||
### Gitignore
|
||||
|
||||
Ensure `.env` is in `.gitignore`:
|
||||
```bash
|
||||
echo ".env" >> .gitignore
|
||||
```
|
||||
|
||||
### Secrets Management
|
||||
|
||||
- ✅ Never commit `.env` file to git
|
||||
- ✅ Use `.env.example` for templates (without actual secrets)
|
||||
- ✅ Rotate API tokens regularly
|
||||
- ✅ Use different tokens for different purposes
|
||||
- ✅ Keep tunnel tokens secure (they provide full tunnel access)
|
||||
|
||||
---
|
||||
|
||||
## Verification Checklist
|
||||
|
||||
After setup, verify:
|
||||
|
||||
- [ ] Tunnel token created and copied
|
||||
- [ ] Cloudflared installed on VMID 2400
|
||||
- [ ] Tunnel service running on VMID 2400
|
||||
- [ ] Tunnel route configured in Cloudflare Dashboard
|
||||
- [ ] DNS CNAME record created
|
||||
- [ ] DNS record resolves correctly
|
||||
- [ ] RPC endpoint accessible: `https://rpc.public-0138.defi-oracle.io`
|
||||
|
||||
---
|
||||
|
||||
## Quick Reference
|
||||
|
||||
| Secret | Required | How to Get | Used For |
|
||||
|--------|----------|------------|----------|
|
||||
| `TUNNEL_TOKEN_VMID2400` | ✅ YES | Zero Trust → Tunnels → Create | Install cloudflared service |
|
||||
| `CLOUDFLARE_API_TOKEN` | ⚠️ Optional | Profile → API Tokens | Automated DNS/tunnel config |
|
||||
| `CLOUDFLARE_ZONE_ID_DEFI_ORACLE` | ⚠️ Optional | Dashboard → Domain → Overview | Auto-detected if token provided |
|
||||
| `CLOUDFLARE_ACCOUNT_ID` | ⚠️ Optional | Dashboard → Right sidebar | Auto-detected if token provided |
|
||||
| `THIRDWEB_API_KEY` | ⚠️ Optional | ThirdWeb Dashboard → API Keys | Chain configuration JSON |
|
||||
|
||||
---
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. ✅ **Create tunnel token** in Cloudflare Dashboard
|
||||
2. ✅ **Run installation script** with token
|
||||
3. ✅ **Configure tunnel route** (manual or automated)
|
||||
4. ✅ **Create DNS record** (manual or automated)
|
||||
5. ✅ **Verify setup** and test endpoint
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2025-01-23
|
||||
**Status**: ✅ **Documentation Complete** - Ready for Setup
|
||||
340
docs/04-configuration/VMID2400_RESTRICT_THIRDWEB_TRAFFIC.md
Normal file
340
docs/04-configuration/VMID2400_RESTRICT_THIRDWEB_TRAFFIC.md
Normal file
@@ -0,0 +1,340 @@
|
||||
# VMID 2400 - Restrict Traffic to *.thirdweb.com
|
||||
|
||||
**Date**: 2026-01-02
|
||||
**Purpose**: Limit RPC endpoint access to only ThirdWeb domains
|
||||
**VMID**: 2400
|
||||
**FQDN**: `rpc.public-0138.defi-oracle.io`
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
This guide provides multiple methods to restrict access to the VMID 2400 RPC endpoint to only allow traffic originating from `*.thirdweb.com` domains.
|
||||
|
||||
---
|
||||
|
||||
## Method 1: Cloudflare WAF Rules (Recommended) ⭐
|
||||
|
||||
Cloudflare WAF (Web Application Firewall) rules provide the best protection at the edge before traffic reaches your server.
|
||||
|
||||
### Step 1: Create WAF Rule in Cloudflare Dashboard
|
||||
|
||||
1. **Navigate to WAF**:
|
||||
- Go to: https://dash.cloudflare.com/
|
||||
- Select domain: **defi-oracle.io**
|
||||
- Click: **Security** → **WAF** (or **Firewall Rules**)
|
||||
|
||||
2. **Create Custom Rule**:
|
||||
- Click: **Create rule** or **Add rule**
|
||||
- Rule name: `Allow Only ThirdWeb`
|
||||
|
||||
3. **Configure Rule**:
|
||||
```
|
||||
Rule Name: Allow Only ThirdWeb
|
||||
|
||||
When incoming requests match:
|
||||
(http.request.headers.origin does not contain "thirdweb.com" AND
|
||||
http.request.headers.referer does not contain "thirdweb.com" AND
|
||||
http.request.headers.user_agent does not contain "thirdweb")
|
||||
|
||||
Then: Block
|
||||
```
|
||||
|
||||
4. **Alternative - Use Expression Editor**:
|
||||
```
|
||||
(http.request.headers["origin"][*] contains "thirdweb.com" or
|
||||
http.request.headers["referer"][*] contains "thirdweb.com" or
|
||||
http.request.headers["user-agent"][*] contains "thirdweb")
|
||||
```
|
||||
- Action: **Allow**
|
||||
- Then add another rule that blocks everything else
|
||||
|
||||
### Step 2: Configure WAF Rule Expression
|
||||
|
||||
**More Precise Expression** (allows only thirdweb.com):
|
||||
|
||||
```
|
||||
(http.request.headers["origin"][*] matches "https?://.*\.thirdweb\.com(/.*)?$" or
|
||||
http.request.headers["referer"][*] matches "https?://.*\.thirdweb\.com(/.*)?$")
|
||||
```
|
||||
|
||||
**Action**: **Allow**
|
||||
|
||||
Then create a second rule:
|
||||
- **Expression**: Everything else
|
||||
- **Action**: **Block**
|
||||
|
||||
### Step 3: Deploy Rule
|
||||
|
||||
1. Review the rule
|
||||
2. Click **Deploy** or **Save**
|
||||
3. Wait a few seconds for propagation
|
||||
|
||||
---
|
||||
|
||||
## Method 2: Cloudflare Access Application (Zero Trust)
|
||||
|
||||
This method requires authentication but provides more control.
|
||||
|
||||
### Step 1: Create Access Application
|
||||
|
||||
1. **Navigate to Access**:
|
||||
- Go to: https://one.dash.cloudflare.com/
|
||||
- Click: **Zero Trust** → **Access** → **Applications**
|
||||
- Click: **Add an application**
|
||||
- Select: **Self-hosted**
|
||||
|
||||
2. **Configure Application**:
|
||||
```
|
||||
Application name: ThirdWeb RPC (VMID 2400)
|
||||
Application domain: rpc.public-0138.defi-oracle.io
|
||||
Session duration: 8 hours
|
||||
```
|
||||
|
||||
3. **Configure Policy**:
|
||||
- Click: **Add a policy**
|
||||
- **Policy name**: `Allow ThirdWeb Team`
|
||||
- **Action**: `Allow`
|
||||
- **Include**:
|
||||
- Select: **Emails**
|
||||
- Value: `*@thirdweb.com` (if you have ThirdWeb emails)
|
||||
- OR use: **Access Service Tokens** (more appropriate for API access)
|
||||
|
||||
### Step 2: Use Service Token (Recommended for API Access)
|
||||
|
||||
1. **Create Service Token**:
|
||||
- Go to: **Zero Trust** → **Access** → **Service Tokens**
|
||||
- Click: **Create Service Token**
|
||||
- Name: `thirdweb-rpc-service`
|
||||
- Copy the token (shown once)
|
||||
|
||||
2. **Update Policy**:
|
||||
- Edit the Access policy
|
||||
- **Include**: **Service Tokens**
|
||||
- Select: `thirdweb-rpc-service`
|
||||
|
||||
3. **Share Token with ThirdWeb**:
|
||||
- Provide the service token to ThirdWeb
|
||||
- They include it in requests: `Authorization: Bearer <token>`
|
||||
|
||||
**Note**: This method requires ThirdWeb to include the token in requests.
|
||||
|
||||
---
|
||||
|
||||
## Method 3: Nginx Access Control (Less Secure - Can Be Spoofed)
|
||||
|
||||
This method checks HTTP headers but can be bypassed if headers are spoofed. Use this only as a secondary layer.
|
||||
|
||||
### Step 1: Update Nginx Configuration on VMID 2400
|
||||
|
||||
```bash
|
||||
# SSH to Proxmox host
|
||||
ssh root@192.168.11.10
|
||||
|
||||
# Enter VMID 2400
|
||||
pct exec 2400 -- bash
|
||||
|
||||
# Edit Nginx config
|
||||
nano /etc/nginx/sites-available/rpc-thirdweb
|
||||
```
|
||||
|
||||
### Step 2: Add Access Control to Nginx Config
|
||||
|
||||
Add this to your server block:
|
||||
|
||||
```nginx
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name rpc.public-0138.defi-oracle.io;
|
||||
|
||||
# ... existing SSL config ...
|
||||
|
||||
# Restrict to ThirdWeb domains (check Origin and Referer headers)
|
||||
set $allow_request 0;
|
||||
|
||||
# Check Origin header
|
||||
if ($http_origin ~* "^https?://.*\.thirdweb\.com") {
|
||||
set $allow_request 1;
|
||||
}
|
||||
|
||||
# Check Referer header
|
||||
if ($http_referer ~* "^https?://.*\.thirdweb\.com") {
|
||||
set $allow_request 1;
|
||||
}
|
||||
|
||||
# Block if not from ThirdWeb
|
||||
if ($allow_request = 0) {
|
||||
return 403 '{"jsonrpc":"2.0","error":{"code":-32000,"message":"Access denied. Only ThirdWeb domains are allowed."},"id":null}';
|
||||
access_log off;
|
||||
log_not_found off;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8545;
|
||||
# ... existing proxy config ...
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Step 3: Test and Reload Nginx
|
||||
|
||||
```bash
|
||||
# Test configuration
|
||||
nginx -t
|
||||
|
||||
# Reload Nginx
|
||||
systemctl reload nginx
|
||||
```
|
||||
|
||||
**⚠️ Warning**: This method can be bypassed since headers can be spoofed. Use Cloudflare WAF for actual security.
|
||||
|
||||
---
|
||||
|
||||
## Method 4: Cloudflare Transform Rules (Header-Based)
|
||||
|
||||
Use Cloudflare Transform Rules to add/check custom headers.
|
||||
|
||||
### Step 1: Create Transform Rule
|
||||
|
||||
1. **Navigate to Transform Rules**:
|
||||
- Go to: **Rules** → **Transform Rules**
|
||||
- Click: **Create rule**
|
||||
|
||||
2. **Configure Rule**:
|
||||
- Rule name: `Add ThirdWeb Verification Header`
|
||||
- When: `http.request.headers["origin"][*] contains "thirdweb.com"`
|
||||
- Then: Set static header `X-ThirdWeb-Verified: true`
|
||||
|
||||
3. **Create Second Rule (Block)**:
|
||||
- Rule name: `Block Non-ThirdWeb`
|
||||
- When: `http.request.headers["x-thirdweb-verified"] is absent`
|
||||
- Then: **Block** (use Firewall rule for blocking)
|
||||
|
||||
---
|
||||
|
||||
## Recommended Approach: Cloudflare WAF Rules ⭐
|
||||
|
||||
**Best Practice**: Use **Method 1 (Cloudflare WAF Rules)** because:
|
||||
- ✅ Enforced at Cloudflare edge (before reaching your server)
|
||||
- ✅ Cannot be bypassed by spoofing headers
|
||||
- ✅ Provides DDoS protection
|
||||
- ✅ No code changes required
|
||||
- ✅ Centralized management
|
||||
|
||||
---
|
||||
|
||||
## Implementation Steps (WAF Method)
|
||||
|
||||
### Quick Setup:
|
||||
|
||||
1. **Go to Cloudflare Dashboard**: https://dash.cloudflare.com/
|
||||
2. **Select domain**: `defi-oracle.io`
|
||||
3. **Navigate**: **Security** → **WAF** → **Custom Rules**
|
||||
4. **Create Rule**:
|
||||
|
||||
```
|
||||
Rule Name: Allow Only ThirdWeb Traffic
|
||||
|
||||
Expression:
|
||||
(http.request.headers["origin"][*] matches "https?://.*\.thirdweb\.com(/.*)?$" or
|
||||
http.request.headers["referer"][*] matches "https?://.*\.thirdweb\.com(/.*)?$")
|
||||
|
||||
Action: Allow
|
||||
Position: Last (bottom)
|
||||
```
|
||||
|
||||
5. **Create Block Rule**:
|
||||
|
||||
```
|
||||
Rule Name: Block All Other Traffic
|
||||
|
||||
Expression:
|
||||
(http.request.uri.path contains "/")
|
||||
|
||||
Action: Block
|
||||
Position: Last (bottom)
|
||||
```
|
||||
|
||||
**Important**: Order matters! Allow rule must come before Block rule, or use "Skip remaining rules" in Allow rule.
|
||||
|
||||
---
|
||||
|
||||
## Testing
|
||||
|
||||
### Test Allowed Request (from ThirdWeb):
|
||||
|
||||
```bash
|
||||
# Simulate request with ThirdWeb Origin header
|
||||
curl -k https://rpc.public-0138.defi-oracle.io \
|
||||
-X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Origin: https://dashboard.thirdweb.com" \
|
||||
-d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
|
||||
```
|
||||
|
||||
**Expected**: Should succeed ✅
|
||||
|
||||
### Test Blocked Request (without ThirdWeb headers):
|
||||
|
||||
```bash
|
||||
# Request without ThirdWeb headers
|
||||
curl -k https://rpc.public-0138.defi-oracle.io \
|
||||
-X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
|
||||
```
|
||||
|
||||
**Expected**: Should be blocked (403 or custom error) ❌
|
||||
|
||||
---
|
||||
|
||||
## Limitations and Considerations
|
||||
|
||||
### Important Notes:
|
||||
|
||||
1. **Direct RPC Calls**: Direct RPC calls (from wallets, scripts) may not include Origin/Referer headers
|
||||
- **Solution**: Use API key authentication or IP whitelisting instead
|
||||
|
||||
2. **CORS Requests**: Browser-based requests include Origin headers
|
||||
- WAF rules work well for browser/JavaScript requests from ThirdWeb
|
||||
|
||||
3. **API/SDK Requests**: ThirdWeb SDK requests should include proper headers
|
||||
- Verify with ThirdWeb that their SDK sends appropriate headers
|
||||
|
||||
4. **IP Whitelisting Alternative**: If headers don't work, consider:
|
||||
- Get ThirdWeb's IP ranges
|
||||
- Use Cloudflare WAF IP Access Rules
|
||||
- Less flexible but more reliable for API access
|
||||
|
||||
---
|
||||
|
||||
## Alternative: IP-Based Restriction
|
||||
|
||||
If ThirdWeb provides their IP ranges:
|
||||
|
||||
1. **Go to**: **Security** → **WAF** → **Tools** → **IP Access Rules**
|
||||
2. **Create Rule**:
|
||||
- Action: **Allow**
|
||||
- IP Address: ThirdWeb IP ranges
|
||||
3. **Create Block Rule**:
|
||||
- Action: **Block**
|
||||
- IP Address: All other IPs
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
| Method | Security | Ease of Setup | Reliability | Best For |
|
||||
|--------|----------|---------------|-------------|----------|
|
||||
| **WAF Rules** | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ | ⭐⭐⭐⭐ | Browser/Web requests |
|
||||
| **Access Application** | ⭐⭐⭐⭐⭐ | ⭐⭐⭐ | ⭐⭐⭐⭐⭐ | API with service tokens |
|
||||
| **Nginx Headers** | ⭐⭐ | ⭐⭐⭐⭐⭐ | ⭐⭐ | Secondary layer only |
|
||||
| **IP Whitelisting** | ⭐⭐⭐⭐ | ⭐⭐⭐ | ⭐⭐⭐⭐⭐ | API/SDK requests |
|
||||
|
||||
**Recommendation**: Start with **Cloudflare WAF Rules (Method 1)**, and add **Access Application with Service Tokens (Method 2)** if you need API-level authentication.
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2026-01-02
|
||||
**Status**: ✅ Ready for Implementation
|
||||
@@ -0,0 +1,90 @@
|
||||
# Cloudflare Configuration for Blockscout Explorer
|
||||
|
||||
**Date**: $(date)
|
||||
**Domain**: explorer.d-bis.org
|
||||
**Tunnel ID**: `10ab22da-8ea3-4e2e-a896-27ece2211a05`
|
||||
|
||||
---
|
||||
|
||||
## Quick Configuration Steps
|
||||
|
||||
### 1. DNS Record (Cloudflare Dashboard)
|
||||
|
||||
1. **Go to Cloudflare DNS**:
|
||||
- URL: https://dash.cloudflare.com/
|
||||
- Select domain: `d-bis.org`
|
||||
- Navigate to: **DNS** → **Records**
|
||||
|
||||
2. **Create CNAME Record**:
|
||||
```
|
||||
Type: CNAME
|
||||
Name: explorer
|
||||
Target: 10ab22da-8ea3-4e2e-a896-27ece2211a05.cfargotunnel.com
|
||||
Proxy status: 🟠 Proxied (orange cloud) - REQUIRED
|
||||
TTL: Auto
|
||||
```
|
||||
|
||||
3. **Click Save**
|
||||
|
||||
### 2. Tunnel Route (Cloudflare Zero Trust)
|
||||
|
||||
1. **Go to Cloudflare Zero Trust**:
|
||||
- URL: https://one.dash.cloudflare.com/
|
||||
- Navigate to: **Zero Trust** → **Networks** → **Tunnels**
|
||||
|
||||
2. **Select Your Tunnel**:
|
||||
- Find tunnel ID: `10ab22da-8ea3-4e2e-a896-27ece2211a05`
|
||||
- Click on the tunnel name
|
||||
|
||||
3. **Configure Public Hostname**:
|
||||
- Click **Configure** button
|
||||
- Click **Public Hostnames** tab
|
||||
- Click **Add a public hostname**
|
||||
|
||||
4. **Add Hostname**:
|
||||
```
|
||||
Subdomain: explorer
|
||||
Domain: d-bis.org
|
||||
Service: http://192.168.11.140:80
|
||||
Type: HTTP
|
||||
```
|
||||
|
||||
5. **Click Save hostname**
|
||||
|
||||
---
|
||||
|
||||
## Verification
|
||||
|
||||
### Wait for DNS Propagation (1-5 minutes)
|
||||
|
||||
Then test:
|
||||
|
||||
```bash
|
||||
# Test DNS resolution
|
||||
dig explorer.d-bis.org
|
||||
nslookup explorer.d-bis.org
|
||||
|
||||
# Test HTTPS endpoint
|
||||
curl https://explorer.d-bis.org/health
|
||||
|
||||
# Should return JSON response from Blockscout
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Configuration Summary
|
||||
|
||||
| Setting | Value |
|
||||
|---------|-------|
|
||||
| **Domain** | explorer.d-bis.org |
|
||||
| **DNS Type** | CNAME |
|
||||
| **DNS Target** | 10ab22da-8ea3-4e2e-a896-27ece2211a05.cfargotunnel.com |
|
||||
| **Proxy Status** | 🟠 Proxied (required) |
|
||||
| **Tunnel Service** | http://192.168.11.140:80 |
|
||||
| **Tunnel Type** | HTTP |
|
||||
|
||||
---
|
||||
|
||||
**Status**: Ready for configuration
|
||||
**Next Step**: Follow steps 1 and 2 above in Cloudflare dashboards
|
||||
|
||||
@@ -0,0 +1,92 @@
|
||||
# Cloudflare Explorer URL - Quick Setup Guide
|
||||
|
||||
**Domain**: explorer.d-bis.org
|
||||
**Target**: http://192.168.11.140:80
|
||||
|
||||
---
|
||||
|
||||
## 🚀 Quick Setup (2 Steps)
|
||||
|
||||
### Step 1: Configure DNS Record
|
||||
|
||||
**In Cloudflare Dashboard** (https://dash.cloudflare.com/):
|
||||
|
||||
1. Select domain: **d-bis.org**
|
||||
2. Go to: **DNS** → **Records**
|
||||
3. Click: **Add record**
|
||||
4. Configure:
|
||||
- **Type**: `CNAME`
|
||||
- **Name**: `explorer`
|
||||
- **Target**: `<your-tunnel-id>.cfargotunnel.com`
|
||||
- **Proxy status**: 🟠 **Proxied** (orange cloud) ← **REQUIRED**
|
||||
- **TTL**: Auto
|
||||
5. Click: **Save**
|
||||
|
||||
**To find your tunnel ID:**
|
||||
```bash
|
||||
# Run this script
|
||||
./scripts/get-tunnel-id.sh
|
||||
|
||||
# Or check Cloudflare Zero Trust dashboard:
|
||||
# https://one.dash.cloudflare.com/ → Zero Trust → Networks → Tunnels
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Step 2: Configure Tunnel Route
|
||||
|
||||
**In Cloudflare Zero Trust Dashboard** (https://one.dash.cloudflare.com/):
|
||||
|
||||
1. Navigate to: **Zero Trust** → **Networks** → **Tunnels**
|
||||
2. Find your tunnel (by ID or name)
|
||||
3. Click: **Configure** button
|
||||
4. Click: **Public Hostnames** tab
|
||||
5. Click: **Add a public hostname**
|
||||
6. Configure:
|
||||
- **Subdomain**: `explorer`
|
||||
- **Domain**: `d-bis.org`
|
||||
- **Service**: `http://192.168.11.140:80`
|
||||
- **Type**: `HTTP`
|
||||
7. Click: **Save hostname**
|
||||
|
||||
---
|
||||
|
||||
## ✅ Verify
|
||||
|
||||
**Wait 1-5 minutes for DNS propagation, then test:**
|
||||
|
||||
```bash
|
||||
# Test public URL
|
||||
curl https://explorer.d-bis.org/api/v2/stats
|
||||
|
||||
# Should return JSON with network stats (not 404)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📋 Configuration Checklist
|
||||
|
||||
- [ ] DNS CNAME record: `explorer` → `<tunnel-id>.cfargotunnel.com`
|
||||
- [ ] DNS record is **🟠 Proxied** (orange cloud)
|
||||
- [ ] Tunnel route: `explorer.d-bis.org` → `http://192.168.11.140:80`
|
||||
- [ ] Cloudflared service running in container
|
||||
- [ ] Public URL accessible: `https://explorer.d-bis.org`
|
||||
|
||||
---
|
||||
|
||||
## 🔧 Troubleshooting
|
||||
|
||||
### 404 Error
|
||||
- Check DNS record exists and is proxied
|
||||
- Check tunnel route is configured
|
||||
- Wait 5 minutes for DNS propagation
|
||||
|
||||
### 502 Error
|
||||
- Verify tunnel route points to `http://192.168.11.140:80`
|
||||
- Check Nginx is running: `systemctl status nginx` (in container)
|
||||
- Check Blockscout is running: `systemctl status blockscout` (in container)
|
||||
|
||||
---
|
||||
|
||||
**That's it! Follow these 2 steps and your public URL will work.**
|
||||
|
||||
@@ -0,0 +1,179 @@
|
||||
# Cloudflare Tunnel Configuration Guide
|
||||
|
||||
**Tunnel ID**: `10ab22da-8ea3-4e2e-a896-27ece2211a05`
|
||||
**Status**: Currently DOWN - Needs Configuration
|
||||
**Purpose**: Route all services through central Nginx (VMID 105)
|
||||
|
||||
---
|
||||
|
||||
## Current Status
|
||||
|
||||
From the Cloudflare dashboard, the tunnel `rpc-http-pub.d-bis.org` is showing as **DOWN**. This tunnel needs to be configured to route all hostnames to the central Nginx.
|
||||
|
||||
---
|
||||
|
||||
## Configuration Steps
|
||||
|
||||
### 1. Access Tunnel Configuration
|
||||
|
||||
1. Go to: https://one.dash.cloudflare.com/
|
||||
2. Navigate to: **Zero Trust** → **Networks** → **Tunnels**
|
||||
3. Click on the tunnel: **rpc-http-pub.d-bis.org** (Tunnel ID: `10ab22da-8ea3-4e2e-a896-27ece2211a05`)
|
||||
4. Click **Configure** button
|
||||
|
||||
### 2. Configure Public Hostnames
|
||||
|
||||
In the **Public Hostnames** section, configure all hostnames to route to the central Nginx:
|
||||
|
||||
**Target**: `http://192.168.11.21:80`
|
||||
|
||||
#### Required Hostname Configurations:
|
||||
|
||||
| Hostname | Service Type | Target |
|
||||
|----------|--------------|--------|
|
||||
| `explorer.d-bis.org` | HTTP | `http://192.168.11.21:80` |
|
||||
| `rpc-http-pub.d-bis.org` | HTTP | `http://192.168.11.21:80` |
|
||||
| `rpc-ws-pub.d-bis.org` | HTTP | `http://192.168.11.21:80` |
|
||||
| `rpc-http-prv.d-bis.org` | HTTP | `http://192.168.11.21:80` |
|
||||
| `rpc-ws-prv.d-bis.org` | HTTP | `http://192.168.11.21:80` |
|
||||
| `dbis-admin.d-bis.org` | HTTP | `http://192.168.11.21:80` |
|
||||
| `dbis-api.d-bis.org` | HTTP | `http://192.168.11.21:80` |
|
||||
| `dbis-api-2.d-bis.org` | HTTP | `http://192.168.11.21:80` |
|
||||
| `mim4u.org` | HTTP | `http://192.168.11.21:80` |
|
||||
| `www.mim4u.org` | HTTP | `http://192.168.11.21:80` |
|
||||
|
||||
### 3. Configuration Details
|
||||
|
||||
For each hostname:
|
||||
|
||||
1. **Subdomain**: Enter the subdomain (e.g., `explorer`, `rpc-http-pub`)
|
||||
2. **Domain**: Select `d-bis.org` (or enter `mim4u.org` for those domains)
|
||||
3. **Service**: Select `HTTP`
|
||||
4. **URL**: Enter `192.168.11.21:80`
|
||||
5. **Save** the configuration
|
||||
|
||||
### 4. Add Catch-All Rule (Optional but Recommended)
|
||||
|
||||
Add a catch-all rule at the end:
|
||||
|
||||
- **Service**: `HTTP 404: Not Found`
|
||||
- This handles any unmatched hostnames
|
||||
|
||||
---
|
||||
|
||||
## Expected Configuration (YAML Format)
|
||||
|
||||
The tunnel configuration should look like this:
|
||||
|
||||
```yaml
|
||||
ingress:
|
||||
# Explorer
|
||||
- hostname: explorer.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
|
||||
# RPC Public
|
||||
- hostname: rpc-http-pub.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
|
||||
- hostname: rpc-ws-pub.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
|
||||
# RPC Private
|
||||
- hostname: rpc-http-prv.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
|
||||
- hostname: rpc-ws-prv.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
|
||||
# DBIS Services
|
||||
- hostname: dbis-admin.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
|
||||
- hostname: dbis-api.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
|
||||
- hostname: dbis-api-2.d-bis.org
|
||||
service: http://192.168.11.21:80
|
||||
|
||||
# Miracles In Motion
|
||||
- hostname: mim4u.org
|
||||
service: http://192.168.11.21:80
|
||||
|
||||
- hostname: www.mim4u.org
|
||||
service: http://192.168.11.21:80
|
||||
|
||||
# Catch-all
|
||||
- service: http_status:404
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## After Configuration
|
||||
|
||||
1. **Save** the configuration in Cloudflare dashboard
|
||||
2. Wait 1-2 minutes for the tunnel to reload
|
||||
3. Check tunnel status - it should change from **DOWN** to **HEALTHY**
|
||||
4. Test endpoints:
|
||||
```bash
|
||||
curl https://explorer.d-bis.org/api/v2/stats
|
||||
curl -X POST https://rpc-http-pub.d-bis.org \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}'
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Tunnel Still DOWN After Configuration
|
||||
|
||||
1. **Check cloudflared service**:
|
||||
```bash
|
||||
ssh root@192.168.11.12 "pct exec 102 -- systemctl status cloudflared"
|
||||
```
|
||||
|
||||
2. **Check tunnel logs**:
|
||||
```bash
|
||||
ssh root@192.168.11.12 "pct exec 102 -- journalctl -u cloudflared -n 50"
|
||||
```
|
||||
|
||||
3. **Verify Nginx is accessible**:
|
||||
```bash
|
||||
curl http://192.168.11.21:80
|
||||
```
|
||||
|
||||
4. **Restart cloudflared** (if needed):
|
||||
```bash
|
||||
ssh root@192.168.11.12 "pct exec 102 -- systemctl restart cloudflared"
|
||||
```
|
||||
|
||||
### Service Not Routing Correctly
|
||||
|
||||
1. Verify Nginx configuration on VMID 105:
|
||||
```bash
|
||||
ssh root@192.168.11.12 "pct exec 105 -- cat /data/nginx/custom/http.conf"
|
||||
```
|
||||
|
||||
2. Test Nginx routing directly:
|
||||
```bash
|
||||
curl -H "Host: explorer.d-bis.org" http://192.168.11.21/
|
||||
```
|
||||
|
||||
3. Check Nginx logs:
|
||||
```bash
|
||||
ssh root@192.168.11.12 "pct exec 105 -- tail -f /data/logs/fallback_error.log"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Notes
|
||||
|
||||
- **Central Nginx IP**: `192.168.11.21` (VMID 105)
|
||||
- **Central Nginx Port**: `80` (HTTP)
|
||||
- **All SSL/TLS termination**: Handled by Cloudflare
|
||||
- **Internal routing**: Nginx routes based on `Host` header to appropriate internal services
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: December 27, 2025
|
||||
|
||||
@@ -0,0 +1,106 @@
|
||||
# Cloudflare Tunnel Installation - Complete
|
||||
|
||||
**Date**: January 27, 2025
|
||||
**Tunnel Token**: Provided
|
||||
**Container**: VMID 5000 on pve2
|
||||
|
||||
---
|
||||
|
||||
## ✅ Installation Command
|
||||
|
||||
**Run this on pve2 node:**
|
||||
|
||||
```bash
|
||||
# Install cloudflared service with token
|
||||
pct exec 5000 -- cloudflared service install eyJhIjoiNTJhZDU3YTcxNjcxYzVmYzAwOWVkZjA3NDQ2NTgxOTYiLCJ0IjoiYjAyZmUxZmUtY2I3ZC00ODRlLTkwOWItN2NjNDEyOThlYmU4IiwicyI6Ik5HTmtOV0kwWXpNdFpUVmxaUzAwTVRFMkxXRXdNMk10WlRJNU1ETTFaRFF4TURBMiJ9
|
||||
|
||||
# Start service
|
||||
pct exec 5000 -- systemctl start cloudflared
|
||||
pct exec 5000 -- systemctl enable cloudflared
|
||||
|
||||
# Verify installation
|
||||
pct exec 5000 -- systemctl status cloudflared
|
||||
pct exec 5000 -- cloudflared tunnel list
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📋 What This Does
|
||||
|
||||
1. **Installs cloudflared** (if not already installed)
|
||||
2. **Configures tunnel service** with the provided token
|
||||
3. **Starts cloudflared service** automatically
|
||||
4. **Enables service** to start on boot
|
||||
|
||||
---
|
||||
|
||||
## 🔍 After Installation
|
||||
|
||||
### Get Tunnel ID
|
||||
|
||||
```bash
|
||||
pct exec 5000 -- cloudflared tunnel list
|
||||
```
|
||||
|
||||
The tunnel ID will be displayed in the output.
|
||||
|
||||
### Configure DNS
|
||||
|
||||
**In Cloudflare Dashboard** (https://dash.cloudflare.com/):
|
||||
|
||||
1. Domain: **d-bis.org** → **DNS** → **Records**
|
||||
2. Add CNAME:
|
||||
- **Name**: `explorer`
|
||||
- **Target**: `<tunnel-id>.cfargotunnel.com`
|
||||
- **Proxy**: 🟠 **Proxied** (orange cloud)
|
||||
- **TTL**: Auto
|
||||
|
||||
### Configure Tunnel Route
|
||||
|
||||
**In Cloudflare Zero Trust** (https://one.dash.cloudflare.com/):
|
||||
|
||||
1. **Zero Trust** → **Networks** → **Tunnels**
|
||||
2. Find your tunnel → **Configure** → **Public Hostnames**
|
||||
3. Add hostname:
|
||||
- **Subdomain**: `explorer`
|
||||
- **Domain**: `d-bis.org`
|
||||
- **Service**: `http://192.168.11.140:80`
|
||||
- **Type**: `HTTP`
|
||||
|
||||
---
|
||||
|
||||
## ✅ Verification
|
||||
|
||||
**Wait 1-5 minutes for DNS propagation, then:**
|
||||
|
||||
```bash
|
||||
curl https://explorer.d-bis.org/api/v2/stats
|
||||
```
|
||||
|
||||
**Expected**: JSON response with network stats (not 404)
|
||||
|
||||
---
|
||||
|
||||
## 🔧 Troubleshooting
|
||||
|
||||
### Service not starting
|
||||
|
||||
```bash
|
||||
# Check logs
|
||||
pct exec 5000 -- journalctl -u cloudflared -n 50
|
||||
|
||||
# Check status
|
||||
pct exec 5000 -- systemctl status cloudflared
|
||||
```
|
||||
|
||||
### Tunnel not connecting
|
||||
|
||||
- Verify token is valid
|
||||
- Check Cloudflare Zero Trust dashboard for tunnel status
|
||||
- Ensure DNS record is proxied (orange cloud)
|
||||
|
||||
---
|
||||
|
||||
**Status**: Ready to install
|
||||
**Next**: Run installation command above on pve2 node
|
||||
|
||||
68
docs/04-configuration/cloudflare/README.md
Normal file
68
docs/04-configuration/cloudflare/README.md
Normal file
@@ -0,0 +1,68 @@
|
||||
# Cloudflare Configuration Documentation
|
||||
|
||||
**Last Updated:** 2025-01-20
|
||||
**Status:** Active Documentation
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
This directory contains all Cloudflare-related configuration documentation, including Zero Trust setup, DNS configuration, tunnel setup, and service-specific guides.
|
||||
|
||||
---
|
||||
|
||||
## Documentation Index
|
||||
|
||||
### Core Guides
|
||||
|
||||
| Document | Description | Priority |
|
||||
|----------|-------------|----------|
|
||||
| **[CLOUDFLARE_ZERO_TRUST_GUIDE.md](CLOUDFLARE_ZERO_TRUST_GUIDE.md)** | Complete Zero Trust integration guide | ⭐⭐⭐ |
|
||||
| **[CLOUDFLARE_DNS_TO_CONTAINERS.md](CLOUDFLARE_DNS_TO_CONTAINERS.md)** | General DNS mapping to LXC containers | ⭐⭐⭐ |
|
||||
| **[CLOUDFLARE_DNS_SPECIFIC_SERVICES.md](CLOUDFLARE_DNS_SPECIFIC_SERVICES.md)** | Service-specific DNS configuration | ⭐⭐⭐ |
|
||||
|
||||
### Tunnel Setup
|
||||
|
||||
| Document | Description | Priority |
|
||||
|----------|-------------|----------|
|
||||
| **[CLOUDFLARE_TUNNEL_CONFIGURATION_GUIDE.md](CLOUDFLARE_TUNNEL_CONFIGURATION_GUIDE.md)** | Complete tunnel configuration guide | ⭐⭐ |
|
||||
| **[CLOUDFLARE_TUNNEL_INSTALLATION.md](CLOUDFLARE_TUNNEL_INSTALLATION.md)** | Tunnel installation procedures | ⭐⭐ |
|
||||
| **[CLOUDFLARE_TUNNEL_QUICK_SETUP.md](CLOUDFLARE_TUNNEL_QUICK_SETUP.md)** | Quick setup guide | ⭐ |
|
||||
| **[CLOUDFLARE_TUNNEL_RPC_SETUP.md](CLOUDFLARE_TUNNEL_RPC_SETUP.md)** | RPC-specific tunnel setup | ⭐⭐ |
|
||||
|
||||
### Service-Specific
|
||||
|
||||
| Document | Description | Priority |
|
||||
|----------|-------------|----------|
|
||||
| **[CLOUDFLARE_EXPLORER_CONFIG.md](CLOUDFLARE_EXPLORER_CONFIG.md)** | Blockscout explorer configuration | ⭐⭐ |
|
||||
| **[CLOUDFLARE_EXPLORER_QUICK_SETUP.md](CLOUDFLARE_EXPLORER_QUICK_SETUP.md)** | Quick explorer setup | ⭐ |
|
||||
|
||||
---
|
||||
|
||||
## Quick Start
|
||||
|
||||
### First Time Setup
|
||||
|
||||
1. **Read:** [CLOUDFLARE_ZERO_TRUST_GUIDE.md](CLOUDFLARE_ZERO_TRUST_GUIDE.md) - Complete overview
|
||||
2. **Follow:** [CLOUDFLARE_TUNNEL_INSTALLATION.md](CLOUDFLARE_TUNNEL_INSTALLATION.md) - Install tunnels
|
||||
3. **Configure:** [CLOUDFLARE_DNS_TO_CONTAINERS.md](CLOUDFLARE_DNS_TO_CONTAINERS.md) - Map DNS to containers
|
||||
|
||||
### Common Tasks
|
||||
|
||||
- **Set up a new service:** See [CLOUDFLARE_DNS_TO_CONTAINERS.md](CLOUDFLARE_DNS_TO_CONTAINERS.md)
|
||||
- **Configure specific service:** See [CLOUDFLARE_DNS_SPECIFIC_SERVICES.md](CLOUDFLARE_DNS_SPECIFIC_SERVICES.md)
|
||||
- **Set up RPC tunnel:** See [CLOUDFLARE_TUNNEL_RPC_SETUP.md](CLOUDFLARE_TUNNEL_RPC_SETUP.md)
|
||||
- **Configure explorer:** See [CLOUDFLARE_EXPLORER_CONFIG.md](CLOUDFLARE_EXPLORER_CONFIG.md)
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- **[../README.md](../README.md)** - Configuration directory overview
|
||||
- **[../../05-network/CLOUDFLARE_NGINX_INTEGRATION.md](../../05-network/CLOUDFLARE_NGINX_INTEGRATION.md)** - NGINX integration
|
||||
- **[../../05-network/CLOUDFLARE_TUNNEL_ROUTING_ARCHITECTURE.md](../../05-network/CLOUDFLARE_TUNNEL_ROUTING_ARCHITECTURE.md)** - Routing architecture
|
||||
- **[../../02-architecture/NETWORK_ARCHITECTURE.md](../../02-architecture/NETWORK_ARCHITECTURE.md)** - Network architecture
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** 2025-01-20
|
||||
Reference in New Issue
Block a user