zaragoza444
54ca9bea3b
Some checks failed
CI/CD Pipeline / Solidity Contracts (push) Failing after 52s
CI/CD Pipeline / Security Scanning (push) Successful in 2m40s
CI/CD Pipeline / Lint and Format (push) Failing after 49s
CI/CD Pipeline / Terraform Validation (push) Failing after 24s
CI/CD Pipeline / Kubernetes Validation (push) Successful in 27s
Deploy ChainID 138 / Deploy ChainID 138 (push) Has been cancelled
Validation / validate-genesis (push) Has been cancelled
Validation / validate-terraform (push) Has been cancelled
Validation / validate-kubernetes (push) Has been cancelled
Verify Deployment / Verify Deployment (push) Has been cancelled
Validation / validate-smart-contracts (push) Failing after 14s
Validation / validate-security (push) Failing after 1m20s
Validation / validate-documentation (push) Failing after 18s
Add canonical btc-l1-ledger config, /btc/contracts API, Python chain138-oracle service, and production deploy scripts so secure.omdnl.org can serve live cBTC, DODO, and PMM pool addresses with headroom-aware mint gating. Co-authored-by: Cursor <cursoragent@cursor.com>
256 lines
11 KiB
Bash
256 lines
11 KiB
Bash
#!/usr/bin/env bash
|
||
# OMNL Bank — production deploy on server (128-chain, Office 24)
|
||
set -euo pipefail
|
||
|
||
REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}"
|
||
BRANCH="${OMNL_BANK_BRANCH:-main}"
|
||
LOG_DIR="${OMNL_BANK_LOG_DIR:-$HOME/omnl-bank/logs}"
|
||
ENV_FILE="${OMNL_BANK_ENV:-$REPO_DIR/.env}"
|
||
SKIP_GIT_PULL="${OMNL_SKIP_GIT_PULL:-0}"
|
||
DEPLOY_DOTENV_LIB="${REPO_DIR}/scripts/lib/deployment/dotenv.sh"
|
||
|
||
log() { echo "[$(date -Iseconds)] $*"; }
|
||
|
||
mkdir -p "$LOG_DIR"
|
||
|
||
if ! git -C "$REPO_DIR" rev-parse --git-dir >/dev/null 2>&1; then
|
||
log "Cloning smom-dbis-138..."
|
||
git clone "https://gitea.d-bis.org/d-bis/smom-dbis-138.git" "$REPO_DIR"
|
||
fi
|
||
|
||
cd "$REPO_DIR"
|
||
if [[ "$SKIP_GIT_PULL" == "1" ]]; then
|
||
log "Skipping git fetch/checkout/pull (OMNL_SKIP_GIT_PULL=1); building current working tree."
|
||
else
|
||
log "Pull latest ($BRANCH)..."
|
||
git fetch origin
|
||
git checkout "$BRANCH"
|
||
git pull --ff-only origin "$BRANCH"
|
||
fi
|
||
|
||
log "Generate 128-chain registry..."
|
||
node scripts/generate-omnl-128-chains.mjs
|
||
|
||
export SETTLEMENT_MIDDLEWARE_CONFIG="${SETTLEMENT_MIDDLEWARE_CONFIG:-$REPO_DIR/config/settlement-middleware.production.v1.json}"
|
||
export DBIS_EXCHANGE_CONFIG="${DBIS_EXCHANGE_CONFIG:-$REPO_DIR/config/dbis-exchange.production.v1.json}"
|
||
export OMNL_SUPPORTED_CHAINS_CONFIG="${OMNL_SUPPORTED_CHAINS_CONFIG:-$REPO_DIR/config/omnl-supported-chains.v1.json}"
|
||
export OMNL_M2_TOKEN_REGISTRY="${OMNL_M2_TOKEN_REGISTRY:-$REPO_DIR/config/omnl-m2-token-registry.v1.json}"
|
||
|
||
if [[ -f "$ENV_FILE" && "$(grep -c $'\r' "$ENV_FILE" 2>/dev/null || true)" -gt 0 ]]; then
|
||
log "Normalizing CRLF line endings in $ENV_FILE"
|
||
tr -d '\r' <"$ENV_FILE" >"${ENV_FILE}.lf" && mv "${ENV_FILE}.lf" "$ENV_FILE"
|
||
chmod 600 "$ENV_FILE"
|
||
fi
|
||
|
||
if [[ -f "$DEPLOY_DOTENV_LIB" ]]; then
|
||
# Reuse the shared loader so repo .env values are loaded first and smom-dbis-138/.env backfills only missing keys.
|
||
export ENV_FILE
|
||
export PROJECT_ROOT="$REPO_DIR"
|
||
# shellcheck disable=SC1090
|
||
source "$DEPLOY_DOTENV_LIB"
|
||
load_deployment_env --repo-root "$REPO_DIR"
|
||
elif [ -f "$ENV_FILE" ]; then
|
||
set -a
|
||
set +u
|
||
# shellcheck disable=SC1090
|
||
source "$ENV_FILE"
|
||
set -u
|
||
set +a
|
||
fi
|
||
|
||
if [[ -f "$ENV_FILE" ]] && ! grep -q '^OMNL_SUPER_ADMIN_OFFICE24_KEY=' "$ENV_FILE" 2>/dev/null; then
|
||
log "Generating four super-admin API keys..."
|
||
bash "$REPO_DIR/scripts/deployment/seed-omnl-super-admin-keys.sh"
|
||
set -a
|
||
set +u
|
||
# shellcheck disable=SC1090
|
||
source "$ENV_FILE"
|
||
set -u
|
||
set +a
|
||
fi
|
||
|
||
if [[ -f "$ENV_FILE" ]]; then
|
||
# omdnl.org LXCs (5820–5824) reuse super-admin keys from d-bis.org twins (5826–5828 / 5825).
|
||
declare -A PORTAL_AUTH_SOURCE=(
|
||
[5820]=5826 [5821]=5827 [5822]=5827 [5823]=5828 [5824]=5825
|
||
[5825]=5825 [5826]=5826 [5827]=5827 [5828]=5828
|
||
)
|
||
for CTID in 5820 5821 5822 5823 5824 5825 5826 5827 5828; do
|
||
AUTH_SRC="${PORTAL_AUTH_SOURCE[$CTID]}"
|
||
bash "$REPO_DIR/scripts/deployment/generate-portal-nginx-auth-snippet.sh" \
|
||
"$CTID" "$REPO_DIR/deploy/nginx/omnl-portal-auth-${CTID}.conf.inc" "$AUTH_SRC" || true
|
||
done
|
||
bash "$REPO_DIR/scripts/deployment/generate-portal-nginx-auth-snippet.sh" \
|
||
5827 "$REPO_DIR/deploy/nginx/omnl-portal-auth-current.conf.inc" 5827 || true
|
||
if [[ -f "$REPO_DIR/deploy/nginx/omnl-portal-auth-current.conf.inc" ]]; then
|
||
sudo cp "$REPO_DIR/deploy/nginx/omnl-portal-auth-current.conf.inc" /etc/nginx/omnl-portal-auth-current.conf.inc 2>/dev/null || \
|
||
cp "$REPO_DIR/deploy/nginx/omnl-portal-auth-current.conf.inc" "$REPO_DIR/deploy/nginx/omnl-portal-auth-current.conf.inc" 2>/dev/null || true
|
||
sudo nginx -t 2>/dev/null && sudo systemctl reload nginx 2>/dev/null || true
|
||
fi
|
||
fi
|
||
|
||
build_pkg() {
|
||
local dir="$1"
|
||
log "Building $dir..."
|
||
cd "$REPO_DIR/$dir"
|
||
NODE_ENV=development npm install --no-fund --no-audit
|
||
npm run build
|
||
}
|
||
|
||
for dir in packages/integration-foundation packages/settlement-core \
|
||
services/token-aggregation services/settlement-middleware services/dbis-exchange \
|
||
services/btc-intake services/swift-listener; do
|
||
if [[ "$dir" == "services/swift-listener" ]]; then
|
||
build_pkg "$dir" || log "WARN: swift-listener build skipped — SWIFT inbound may use existing dist"
|
||
else
|
||
build_pkg "$dir"
|
||
fi
|
||
done
|
||
|
||
log "Building frontend..."
|
||
cd "$REPO_DIR/frontend-dapp"
|
||
export VITE_TOKEN_AGGREGATION_URL="${VITE_TOKEN_AGGREGATION_URL:-/api/v1}"
|
||
export VITE_SETTLEMENT_MIDDLEWARE_URL="${VITE_SETTLEMENT_MIDDLEWARE_URL:-/settlement}"
|
||
export VITE_DBIS_EXCHANGE_URL="${VITE_DBIS_EXCHANGE_URL:-/exchange}"
|
||
export VITE_ECOSYSTEM="${VITE_ECOSYSTEM:-omnl}"
|
||
export VITE_ENABLE_Z_WALLET="${VITE_ENABLE_Z_WALLET:-false}"
|
||
unset VITE_RPC_URL_900002 VITE_Z_CHAIN_EXPLORER_URL VITE_Z_ECOSYSTEM_URL
|
||
# Never embed operator API keys in production frontend — nginx injects server-side.
|
||
unset VITE_OMNL_API_KEY
|
||
if command -v pnpm >/dev/null 2>&1; then
|
||
pnpm install --frozen-lockfile 2>/dev/null || pnpm install
|
||
VITE_ECOSYSTEM=omnl pnpm run build:omnl
|
||
else
|
||
npm install
|
||
VITE_ECOSYSTEM=omnl npm run build:omnl
|
||
fi
|
||
|
||
start_svc() {
|
||
local name="$1"
|
||
local dir="$2"
|
||
local port="$3"
|
||
local cmd="$4"
|
||
log "Starting $name on :$port"
|
||
cd "$REPO_DIR/$dir"
|
||
pkill -f "smom-dbis-138/$dir" 2>/dev/null || true
|
||
fuser -k "${port}/tcp" 2>/dev/null || true
|
||
sleep 1
|
||
nohup env \
|
||
SETTLEMENT_MIDDLEWARE_CONFIG="$SETTLEMENT_MIDDLEWARE_CONFIG" \
|
||
DBIS_EXCHANGE_CONFIG="$DBIS_EXCHANGE_CONFIG" \
|
||
OMNL_SUPPORTED_CHAINS_CONFIG="$OMNL_SUPPORTED_CHAINS_CONFIG" \
|
||
OMNL_M2_TOKEN_REGISTRY="$OMNL_M2_TOKEN_REGISTRY" \
|
||
OMNL_API_KEY="${OMNL_API_KEY:-${OMNL_SUPER_ADMIN_SECURE_KEY:-}}" \
|
||
OMNL_SUPER_ADMIN_OFFICE24_KEY="${OMNL_SUPER_ADMIN_OFFICE24_KEY:-}" \
|
||
OMNL_SUPER_ADMIN_EXCHANGE_KEY="${OMNL_SUPER_ADMIN_EXCHANGE_KEY:-}" \
|
||
OMNL_SUPER_ADMIN_SECURE_KEY="${OMNL_SUPER_ADMIN_SECURE_KEY:-}" \
|
||
OMNL_SUPER_ADMIN_FOREX_KEY="${OMNL_SUPER_ADMIN_FOREX_KEY:-}" \
|
||
OMNL_PORTAL_INTERNAL_SECRET="${OMNL_PORTAL_INTERNAL_SECRET:-}" \
|
||
OMNL_CUSTOMER_API_KEYS="${OMNL_CUSTOMER_API_KEYS:-}" \
|
||
OMNL_CUSTOMER_SECURITY_PRODUCTION="${OMNL_CUSTOMER_SECURITY_PRODUCTION:-1}" \
|
||
OMNL_BANK_ROOT="$REPO_DIR" \
|
||
OMNL_FINERACT_BASE_URL="${OMNL_FINERACT_BASE_URL:-${FINERACT_BASE_URL:-}}" \
|
||
OMNL_FINERACT_TENANT="${OMNL_FINERACT_TENANT:-${FINERACT_TENANT:-omnl}}" \
|
||
OMNL_FINERACT_USER="${OMNL_FINERACT_USER:-}" \
|
||
OMNL_FINERACT_USERNAME="${OMNL_FINERACT_USERNAME:-}" \
|
||
OMNL_FINERACT_PASSWORD="${OMNL_FINERACT_PASSWORD:-}" \
|
||
OMNL_PUBLIC_MONEY_SUPPLY="${OMNL_PUBLIC_MONEY_SUPPLY:-1}" \
|
||
DATABASE_URL="${DATABASE_URL:-}" \
|
||
SETTLEMENT_ALLOW_HYBX_PRODUCTION="${SETTLEMENT_ALLOW_HYBX_PRODUCTION:-1}" \
|
||
SETTLEMENT_ALLOW_CHAIN_MINT_EXECUTE="${SETTLEMENT_ALLOW_CHAIN_MINT_EXECUTE:-1}" \
|
||
OMNL_ALLOW_CHAIN_MINT_EXECUTE="${OMNL_ALLOW_CHAIN_MINT_EXECUTE:-1}" \
|
||
TOKEN_AGGREGATION_URL="${TOKEN_AGGREGATION_URL:-http://127.0.0.1:3000}" \
|
||
HYBX_MIFOS_FINERACT_SIDECAR_URL="${HYBX_MIFOS_FINERACT_SIDECAR_URL:-}" \
|
||
SWIFT_LISTENER_URL="${SWIFT_LISTENER_URL:-http://127.0.0.1:8788}" \
|
||
RPC_URL_138="${RPC_URL_138:-${CHAIN_138_RPC_URL:-}}" \
|
||
CHAIN_138_RPC_URL="${CHAIN_138_RPC_URL:-${RPC_URL_138:-}}" \
|
||
CHAIN_900002_RPC_URL="${CHAIN_900002_RPC_URL:-}" \
|
||
AZURE_OPENAI_ENDPOINT="${AZURE_OPENAI_ENDPOINT:-}" \
|
||
AZURE_OPENAI_API_KEY="${AZURE_OPENAI_API_KEY:-}" \
|
||
AZURE_OPENAI_DEPLOYMENT="${AZURE_OPENAI_DEPLOYMENT:-}" \
|
||
AZURE_OPENAI_API_VERSION="${AZURE_OPENAI_API_VERSION:-2024-02-15-preview}" \
|
||
OMNL_MINT_OPERATOR_PRIVATE_KEY="${OMNL_MINT_OPERATOR_PRIVATE_KEY:-}" \
|
||
OMNL_REQUIRE_LIVE_BTC_PRICE="${OMNL_REQUIRE_LIVE_BTC_PRICE:-1}" \
|
||
OMNL_BTC_LEDGER_CONFIG="${OMNL_BTC_LEDGER_CONFIG:-$REPO_DIR/config/btc-l1-ledger-1000.chain138.v1.json}" \
|
||
CBTC_ADDRESS_138="${CBTC_ADDRESS_138:-}" \
|
||
BTC_L1_RECIPIENT_ADDRESS="${BTC_L1_RECIPIENT_ADDRESS:-}" \
|
||
BTC_EXISTING_MINT_HOLDER="${BTC_EXISTING_MINT_HOLDER:-}" \
|
||
DODO_PMM_INTEGRATION="${DODO_PMM_INTEGRATION:-${CHAIN_138_DODO_PMM_INTEGRATION:-}}" \
|
||
CHAIN138_POOL_CBTC_CUSDT="${CHAIN138_POOL_CBTC_CUSDT:-}" \
|
||
CHAIN138_POOL_CBTC_CUSDC="${CHAIN138_POOL_CBTC_CUSDC:-}" \
|
||
CHAIN138_POOL_CBTC_CXAUC="${CHAIN138_POOL_CBTC_CXAUC:-}" \
|
||
CHAIN138_ORACLE_URL="${CHAIN138_ORACLE_URL:-http://127.0.0.1:3500}" \
|
||
RESERVE_SYSTEM="${RESERVE_SYSTEM:-}" \
|
||
ORACLE_PROXY_ADDRESS="${ORACLE_PROXY_ADDRESS:-}" \
|
||
ORACLE_AGGREGATOR_ADDRESS="${ORACLE_AGGREGATOR_ADDRESS:-${AGGREGATOR_ADDRESS:-}}" \
|
||
PRICE_FEED_KEEPER_ADDRESS="${PRICE_FEED_KEEPER_ADDRESS:-}" \
|
||
BITCOIND_RPC_URL="${BITCOIND_RPC_URL:-}" \
|
||
BITCOIND_RPC_USER="${BITCOIND_RPC_USER:-}" \
|
||
BITCOIND_RPC_PASS="${BITCOIND_RPC_PASS:-}" \
|
||
BTC_NETWORK="${BTC_NETWORK:-mainnet}" \
|
||
BTC_RESERVE_ADDRESSES="${BTC_RESERVE_ADDRESSES:-}" \
|
||
BTC_CONFIRMATIONS_REQUIRED="${BTC_CONFIRMATIONS_REQUIRED:-6}" \
|
||
BTC_MAX_OUTSTANDING_SATS="${BTC_MAX_OUTSTANDING_SATS:-}" \
|
||
SETTLEMENT_MIDDLEWARE_URL="${SETTLEMENT_MIDDLEWARE_URL:-http://127.0.0.1:3011}" \
|
||
bash -c "$cmd" >"$LOG_DIR/$name.log" 2>&1 &
|
||
echo $! >"$LOG_DIR/$name.pid"
|
||
}
|
||
|
||
start_svc token-aggregation services/token-aggregation 3000 "npm run start"
|
||
sleep 2
|
||
start_svc settlement-middleware services/settlement-middleware 3011 "npm run start"
|
||
sleep 2
|
||
start_svc dbis-exchange services/dbis-exchange 3012 "npm run start"
|
||
sleep 2
|
||
|
||
if [[ "${OMNL_BTC_INTAKE_START:-1}" == "1" ]] && [[ -n "${BITCOIND_RPC_URL:-}" ]]; then
|
||
log "Starting btc-intake..."
|
||
start_svc btc-intake services/btc-intake 3013 "npm run start"
|
||
sleep 2
|
||
fi
|
||
|
||
if [[ "${OMNL_SWIFT_LISTENER_START:-1}" == "1" ]]; then
|
||
log "Starting SWIFT listener..."
|
||
bash "$REPO_DIR/scripts/deployment/start-swift-listener-production.sh" || log "WARN: SWIFT listener start failed"
|
||
fi
|
||
|
||
FRONTEND_PORT="${OMNL_BANK_FRONTEND_PORT:-3002}"
|
||
pkill -f "serve -s.*$FRONTEND_PORT" 2>/dev/null || true
|
||
cd "$REPO_DIR/frontend-dapp"
|
||
nohup npx --yes serve -s dist -l "$FRONTEND_PORT" >"$LOG_DIR/frontend.log" 2>&1 &
|
||
echo $! >"$LOG_DIR/frontend.pid"
|
||
|
||
sleep 5
|
||
log "Health checks..."
|
||
curl -sf "http://127.0.0.1:3011/api/v1/settlement/health" | head -c 200 || true
|
||
echo
|
||
curl -sf "http://127.0.0.1:3011/api/v1/settlement/money-supply/public" | head -c 400 || true
|
||
echo
|
||
curl -sf "http://127.0.0.1:3012/api/v1/exchange/health" | head -c 200 || true
|
||
echo
|
||
if [[ "${OMNL_BTC_INTAKE_START:-1}" == "1" ]] && [[ -n "${BITCOIND_RPC_URL:-}" ]]; then
|
||
curl -sf "http://127.0.0.1:3013/health" | head -c 200 || log "WARN: btc-intake :3013 not reachable"
|
||
echo
|
||
fi
|
||
curl -sf -o /dev/null -w "frontend=%{http_code}\n" "http://127.0.0.1:$FRONTEND_PORT/central-bank"
|
||
curl -sf -o /dev/null -w "hub=%{http_code}\n" "http://127.0.0.1:$FRONTEND_PORT/hub"
|
||
curl -sf "http://127.0.0.1:8788/health" 2>/dev/null | head -c 80 || log "WARN: SWIFT listener :8788 not reachable"
|
||
|
||
if [[ -n "${DATABASE_URL:-}" ]] && [[ "${SEED_SUPER_ADMIN_USERS:-1}" == "1" ]]; then
|
||
log "Seeding super-admin control-panel users..."
|
||
node "$REPO_DIR/scripts/deployment/seed-omnl-super-admin-users.mjs" --stop-services >"$LOG_DIR/super-admin-seed.log" 2>&1 || log "WARN: super-admin seed failed — see $LOG_DIR/super-admin-seed.log"
|
||
start_svc token-aggregation services/token-aggregation 3000 "npm run start"
|
||
sleep 2
|
||
start_svc settlement-middleware services/settlement-middleware 3011 "npm run start"
|
||
sleep 2
|
||
start_svc dbis-exchange services/dbis-exchange 3012 "npm run start"
|
||
sleep 2
|
||
fi
|
||
|
||
log "OMNL Bank deploy complete"
|
||
bash "$REPO_DIR/scripts/deployment/sync-guosmm-notices.sh" || log "WARN: GUOSMM sync check failed"
|
||
log " Central Bank: http://127.0.0.1:$FRONTEND_PORT/central-bank"
|
||
log " Office 24: http://127.0.0.1:$FRONTEND_PORT/office-24"
|
||
log " DBIS Trade: http://127.0.0.1:$FRONTEND_PORT/trade"
|
||
log " 128 chains: http://127.0.0.1:3011/api/v1/settlement/chains"
|