deploy_network.sh

#!/usr/bin/env bash
set -euo pipefail

# Resolve repo root and script directory for reliable relative paths
REPO_ROOT="$(git rev-parse --show-toplevel)"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

source "${REPO_ROOT}/ci3/source"

# Basic logging helpers
log() { echo "[INFO]  $(date -Is) - $*"; }
err() { echo "[ERROR] $(date -Is) - $*" >&2; }
die() { err "$*"; exit 1; }

# Wrapper for denoise with k8s context injection
k8s_denoise() {
  "${SCRIPT_DIR}/k8s_enriched_denoise" "${NAMESPACE}" "$1"
}

tf_str() {
  local value="${1:-}"
  local default_value="${2:-null}"
  if [[ -n "$value" ]]; then
    value="${value//\\/\\\\}"  # escape backslashes first
    value="${value//\"/\\\"}"  # then escape double quotes
    echo "\"${value}\""
  else
    echo "$default_value"
  fi
}

append_optional_tfvar() {
  local file="$1"
  local name="$2"
  local type="${3:-raw}"

  if [[ -z "${!name+x}" ]]; then
    return
  fi

  if [[ -z "${!name}" ]]; then
    return
  fi

  if [[ "${type}" == "string" ]]; then
    printf '%s = %s\n' "${name}" "$(tf_str "${!name}")" >> "${file}"
  else
    printf '%s = %s\n' "${name}" "${!name}" >> "${file}"
  fi
}

# We want to separate out these logs.
export DENOISE=1
########################
# TIMING INSTRUMENTATION
########################
# Capture deployment timings for CI benchmarks
DEPLOY_START_TIME=$(date +%s)
declare -A STAGE_TIMINGS

########################
# GLOBAL VARIABLES
########################
NAMESPACE=${NAMESPACE} # required
CLUSTER=${CLUSTER:-kind}
RESOURCE_PROFILE=${RESOURCE_PROFILE:?RESOURCE_PROFILE must be set by the environment}
BASE_STATE_PATH="${CLUSTER}/${NAMESPACE}"

# Don't try and retrieve contract addresses, instead allow deployed infra to read from network config
USE_NETWORK_CONFIG=${USE_NETWORK_CONFIG:-false}

# Allow this deployment's consensus-critical env vars to diverge from the generated network defaults that the
# aztec entrypoint enforces for a known NETWORK. Networks that intentionally override those defaults (e.g.
# devnet's 36s slots) set this to true in their env file; left unset it stays empty so enforcement is loud.
ALLOW_OVERRIDING_NETWORK_CONFIG=${ALLOW_OVERRIDING_NETWORK_CONFIG:-}

# GCP variables, unused if running on kind
GCP_PROJECT_ID=${GCP_PROJECT_ID:-testnet-440309}
GCP_REGION=${GCP_REGION:-us-west1-a}

########################
# ETHEREUM / DEVNET VARIABLES
########################
DESTROY_ETH_DEVNET=${DESTROY_ETH_DEVNET:-false}
CREATE_ETH_DEVNET=${CREATE_ETH_DEVNET:-false}
ETHEREUM_CHAIN_ID=${ETHEREUM_CHAIN_ID:-1337}
ETHEREUM_BLOCK_TIME=${ETHEREUM_BLOCK_TIME:-12}
ETHEREUM_GAS_LIMIT=${ETHEREUM_GAS_LIMIT:-100000000}
LABS_INFRA_MNEMONIC=${LABS_INFRA_MNEMONIC:-test test test test test test test test test test test junk}
LABS_INFRA_INDICES=${LABS_INFRA_INDICES:-0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,1000}

########################
# ROLLUP VARIABLES
########################
CREATE_ROLLUP_CONTRACTS=${CREATE_ROLLUP_CONTRACTS:-true}
SPONSORED_FPC=${SPONSORED_FPC:-false}
TEST_ACCOUNTS=${TEST_ACCOUNTS:-false}
REAL_VERIFIER=${REAL_VERIFIER:-true}


########################
# AZTEC INFRA VARIABLES
########################
DESTROY_AZTEC_INFRA=${DESTROY_AZTEC_INFRA:-false}
CREATE_AZTEC_INFRA=${CREATE_AZTEC_INFRA:-true}
ROLLUP_VERSION=${ROLLUP_VERSION:-}

LABS_INFRA_MNEMONIC=${LABS_INFRA_MNEMONIC:-test test test test test test test test test test test junk}
ROLLUP_DEPLOYMENT_PRIVATE_KEY=${ROLLUP_DEPLOYMENT_PRIVATE_KEY:-$(cast wallet private-key --mnemonic "$LABS_INFRA_MNEMONIC" --mnemonic-index 0)}

VALIDATOR_MNEMONIC_START_INDEX=${VALIDATOR_MNEMONIC_START_INDEX:-1}
VALIDATORS_PER_NODE=${VALIDATORS_PER_NODE:-12}
VALIDATOR_REPLICAS=${VALIDATOR_REPLICAS:-4}
VALIDATOR_PUBLISHER_MNEMONIC_START_INDEX=${VALIDATOR_PUBLISHER_MNEMONIC_START_INDEX:-5000}
VALIDATOR_PUBLISHERS_PER_REPLICA=${VALIDATOR_PUBLISHERS_PER_REPLICA:-4}
VALIDATOR_HA_REPLICAS=${VALIDATOR_HA_REPLICAS:-0}
VALIDATOR_HA_REPLICA_COUNT=${VALIDATOR_HA_REPLICA_COUNT:-}
VALIDATOR_HA_OLD_DUTIES_MAX_AGE_H=${VALIDATOR_HA_OLD_DUTIES_MAX_AGE_H:-24}

# Max node count: max of primary (VALIDATOR_REPLICAS) and HA pod counts
# Determines how many attester keys and addresses to generate
EFFECTIVE_HA_COUNT=${VALIDATOR_HA_REPLICA_COUNT:-$VALIDATOR_REPLICAS}
if [[ $VALIDATOR_HA_REPLICAS -gt 0 ]]; then
  MAX_VALIDATOR_NODES=$(( VALIDATOR_REPLICAS > EFFECTIVE_HA_COUNT ? VALIDATOR_REPLICAS : EFFECTIVE_HA_COUNT ))
else
  MAX_VALIDATOR_NODES=$VALIDATOR_REPLICAS
fi

# Compute VALIDATOR_INDICES from max node count if not explicitly set
TOTAL_ATTESTERS=$((MAX_VALIDATOR_NODES * VALIDATORS_PER_NODE))
VALIDATOR_INDICES=${VALIDATOR_INDICES:-$(seq "$VALIDATOR_MNEMONIC_START_INDEX" $((VALIDATOR_MNEMONIC_START_INDEX + TOTAL_ATTESTERS - 1)) | tr '\n' ',' | sed 's/,$//')}
PROVER_PUBLISHER_MNEMONIC_START_INDEX=${PROVER_PUBLISHER_MNEMONIC_START_INDEX:-8000}
PUBLISHERS_PER_PROVER=${PUBLISHERS_PER_PROVER:-1}
PROVER_REAL_PROOFS=${REAL_VERIFIER:-true}

PROVER_AGENT_POLL_INTERVAL_MS=${PROVER_AGENT_POLL_INTERVAL_MS:-1000}

STORE_SNAPSHOT_URL_TF=""
if [[ -n "${STORE_SNAPSHOT_URL:-}" ]]; then
  STORE_SNAPSHOT_URL_TF="\"$STORE_SNAPSHOT_URL\""
else
  STORE_SNAPSHOT_URL_TF="null"
fi

PROVER_FAILED_PROOF_STORE=${PROVER_FAILED_PROOF_STORE:-}
SEQ_MIN_TX_PER_BLOCK=${SEQ_MIN_TX_PER_BLOCK:-1}
SEQ_MAX_TX_PER_BLOCK=${SEQ_MAX_TX_PER_BLOCK:-null}
SEQ_MAX_TX_PER_CHECKPOINT=${SEQ_MAX_TX_PER_CHECKPOINT:-8}
P2P_MAX_PENDING_TX_COUNT=${P2P_MAX_PENDING_TX_COUNT:-null}
SEQ_PER_BLOCK_ALLOCATION_MULTIPLIER=${SEQ_PER_BLOCK_ALLOCATION_MULTIPLIER:-null}
SEQ_BLOCK_DURATION_MS=${SEQ_BLOCK_DURATION_MS:-}
SEQ_L1_PUBLISHING_TIME_ALLOWANCE_IN_SLOT=${SEQ_L1_PUBLISHING_TIME_ALLOWANCE_IN_SLOT:-}
SEQ_BUILD_CHECKPOINT_IF_EMPTY=${SEQ_BUILD_CHECKPOINT_IF_EMPTY:-}
AZTEC_EPOCHS_LAG=${AZTEC_EPOCHS_LAG:-}
SEQ_SKIP_CHECKPOINT_PUBLISH_PERCENT=${SEQ_SKIP_CHECKPOINT_PUBLISH_PERCENT:-0}
PROVER_REPLICAS=${PROVER_REPLICAS:-4}
PROVER_ENABLED=${PROVER_ENABLED:-true}
PROVER_AGENT_KEDA_ENABLED=${PROVER_AGENT_KEDA_ENABLED:-false}
PROVER_AGENT_KEDA_MIN_REPLICAS=${PROVER_AGENT_KEDA_MIN_REPLICAS:-0}
PROVER_AGENT_KEDA_MAX_REPLICAS=${PROVER_AGENT_KEDA_MAX_REPLICAS:-$PROVER_REPLICAS}
PROVER_AGENT_KEDA_SCALING_BANDS=${PROVER_AGENT_KEDA_SCALING_BANDS:-[]}
PROVER_AGENT_KEDA_PROMETHEUS_SERVER_ADDRESS=${PROVER_AGENT_KEDA_PROMETHEUS_SERVER_ADDRESS:-}
if [[ "$PROVER_ENABLED" == "true" && "$PROVER_AGENT_KEDA_ENABLED" == "true" && -z "$PROVER_AGENT_KEDA_PROMETHEUS_SERVER_ADDRESS" ]]; then
  die "PROVER_AGENT_KEDA_ENABLED=true requires PROVER_AGENT_KEDA_PROMETHEUS_SERVER_ADDRESS. Set it explicitly, for example via GCP secret replacement."
fi
PROVER_AGENT_REPLICA_CAPACITY=$([[ "$PROVER_ENABLED" == "true" ]] && echo "$PROVER_AGENT_KEDA_MAX_REPLICAS" || echo 0)
PROVER_AGENTS_PER_PROVER=${PROVER_AGENTS_PER_PROVER:-1}
R2_ACCESS_KEY_ID=${R2_ACCESS_KEY_ID:-}
R2_SECRET_ACCESS_KEY=${R2_SECRET_ACCESS_KEY:-}

OTEL_COLLECTOR_ENDPOINT=${OTEL_COLLECTOR_ENDPOINT:-}
OTEL_COLLECT_INTERVAL_MS=${OTEL_COLLECT_INTERVAL_MS:-}
OTEL_EXPORT_TIMEOUT_MS=${OTEL_EXPORT_TIMEOUT_MS:-}
DEPLOY_INTERNAL_BOOTNODE=${DEPLOY_INTERNAL_BOOTNODE:-}

BOT_RESOURCE_PROFILE=${BOT_RESOURCE_PROFILE:-${RESOURCE_PROFILE}}
BOT_TRANSFERS_MNEMONIC_START_INDEX=${BOT_TRANSFERS_MNEMONIC_START_INDEX:-7000}
BOT_SWAPS_MNEMONIC_START_INDEX=${BOT_SWAPS_MNEMONIC_START_INDEX:-7100}
BOT_CROSS_CHAIN_MNEMONIC_START_INDEX=${BOT_CROSS_CHAIN_MNEMONIC_START_INDEX:-7200}
BOT_TRANSFERS_REPLICAS=${BOT_TRANSFERS_REPLICAS:-0}
BOT_SWAPS_REPLICAS=${BOT_SWAPS_REPLICAS:-0}
BOT_CROSS_CHAIN_REPLICAS=${BOT_CROSS_CHAIN_REPLICAS:-0}
BOT_TRANSFERS_TX_INTERVAL_SECONDS=${BOT_TRANSFERS_TX_INTERVAL_SECONDS:-60}
BOT_SWAPS_TX_INTERVAL_SECONDS=${BOT_SWAPS_TX_INTERVAL_SECONDS:-60}
BOT_CROSS_CHAIN_TX_INTERVAL_SECONDS=${BOT_CROSS_CHAIN_TX_INTERVAL_SECONDS:-10}
BOT_TRANSFERS_FOLLOW_CHAIN=${BOT_TRANSFERS_FOLLOW_CHAIN:-NONE}
BOT_SWAPS_FOLLOW_CHAIN=${BOT_SWAPS_FOLLOW_CHAIN:-NONE}
BOT_CROSS_CHAIN_FOLLOW_CHAIN=${BOT_CROSS_CHAIN_FOLLOW_CHAIN:-PENDING}
BOT_TRANSFERS_PXE_SYNC_CHAIN_TIP=${BOT_TRANSFERS_PXE_SYNC_CHAIN_TIP:-checkpointed}
BOT_SWAPS_PXE_SYNC_CHAIN_TIP=${BOT_SWAPS_PXE_SYNC_CHAIN_TIP:-checkpointed}
BOT_CROSS_CHAIN_PXE_SYNC_CHAIN_TIP=${BOT_CROSS_CHAIN_PXE_SYNC_CHAIN_TIP:-checkpointed}

RPC_REPLICAS=${RPC_REPLICAS:-1}
FULL_NODE_REPLICAS=${FULL_NODE_REPLICAS:-0}
FISHERMAN_MNEMONIC_START_INDEX=${FISHERMAN_MNEMONIC_START_INDEX:-1}

RPC_RESOURCE_PROFILE=${RPC_RESOURCE_PROFILE:-${RESOURCE_PROFILE}}

FULL_NODE_RESOURCE_PROFILE=${FULL_NODE_RESOURCE_PROFILE:-${RESOURCE_PROFILE}}

P2P_BOOTSTRAP_RESOURCE_PROFILE=${P2P_BOOTSTRAP_RESOURCE_PROFILE:-${RESOURCE_PROFILE}}
VALIDATOR_RESOURCE_PROFILE=${VALIDATOR_RESOURCE_PROFILE:-${RESOURCE_PROFILE}}
PROVER_RESOURCE_PROFILE=${PROVER_RESOURCE_PROFILE:-${RESOURCE_PROFILE}}

PROVER_NODE_DISABLE_PROOF_PUBLISH=${PROVER_NODE_DISABLE_PROOF_PUBLISH:-false}
P2P_TX_POOL_DELETE_TXS_AFTER_REORG=${P2P_TX_POOL_DELETE_TXS_AFTER_REORG:-false}

PROVER_TEST_DELAY_TYPE=${PROVER_TEST_DELAY_TYPE:-"fixed"}
PROVER_TEST_VERIFICATION_DELAY_MS=${PROVER_TEST_VERIFICATION_DELAY_MS:-10}

DEBUG_P2P_INSTRUMENT_MESSAGES=${DEBUG_P2P_INSTRUMENT_MESSAGES:-false}

PROVER_AGENT_INCLUDE_METRICS=${PROVER_AGENT_INCLUDE_METRICS:-}
FULL_NODE_INCLUDE_METRICS=${FULL_NODE_INCLUDE_METRICS:-}
FISHERMAN_REPLICAS=${FISHERMAN_REPLICAS:-0}

LOG_LEVEL=${LOG_LEVEL:-info}
FISHERMAN_LOG_LEVEL=${FISHERMAN_LOG_LEVEL:-${LOG_LEVEL}}

BLOB_ALLOW_EMPTY_SOURCES=${BLOB_ALLOW_EMPTY_SOURCES:-false}

# Blob filestore configuration
BLOB_FILE_STORE_UPLOAD_URL_TF=""
if [[ -n "${BLOB_FILE_STORE_UPLOAD_URL:-}" ]]; then
  BLOB_FILE_STORE_UPLOAD_URL_TF="\"$BLOB_FILE_STORE_UPLOAD_URL\""
else
  BLOB_FILE_STORE_UPLOAD_URL_TF="null"
fi

# TX filestore configuration
TX_FILE_STORE_ENABLED=${TX_FILE_STORE_ENABLED:-false}
TX_FILE_STORE_URL_TF=""
if [[ -n "${TX_FILE_STORE_URL:-}" ]]; then
  TX_FILE_STORE_URL_TF="\"$TX_FILE_STORE_URL\""
else
  TX_FILE_STORE_URL_TF="null"
fi
TX_COLLECTION_FILE_STORE_URLS=${TX_COLLECTION_FILE_STORE_URLS:-}

P2P_GOSSIPSUB_D=${P2P_GOSSIPSUB_D:-6}
P2P_GOSSIPSUB_DLO=${P2P_GOSSIPSUB_DLO:-4}
P2P_GOSSIPSUB_DHI=${P2P_GOSSIPSUB_DHI:-12}

P2P_DROP_TX_CHANCE=${P2P_DROP_TX_CHANCE:-0}

# Chaos mesh scenarios values file (e.g., "network-requirements.yaml")
# If set, the experiment is installed after Aztec infra, rules are injected,
# then all pods are restarted so they come up clean with partition rules active.
# Requires the chaos mesh operator to already be running (see deploy_chaos_mesh.sh).
CHAOS_MESH_SCENARIOS_FILE=${CHAOS_MESH_SCENARIOS_FILE:-}

# Compute validator addresses (skip if no validators)
if [[ $VALIDATOR_REPLICAS -gt 0 ]]; then
  VALIDATOR_ADDRESSES=$(echo "$VALIDATOR_INDICES" | tr ',' '\n' | xargs -I{} cast wallet address --mnemonic "$LABS_INFRA_MNEMONIC" --mnemonic-index {} | tr '\n' ',' | sed 's/,$//')
  log "VALIDATOR_ADDRESSES: ${VALIDATOR_ADDRESSES}"
else
  VALIDATOR_ADDRESSES=""
  log "VALIDATOR_ADDRESSES: (none - no validators)"
fi

# Compute and include publisher indices in prefunding list
# Uses env overrides when provided, otherwise falls back to values.yaml defaults
# Total publishers = sum of pods across all releases × publishers per replica
# Primary has VALIDATOR_REPLICAS pods, each HA release has EFFECTIVE_HA_COUNT pods
if [[ $VALIDATOR_HA_REPLICAS -gt 0 ]]; then
  TOTAL_VALIDATOR_PUBLISHERS=$(( (VALIDATOR_REPLICAS + VALIDATOR_HA_REPLICAS * EFFECTIVE_HA_COUNT) * VALIDATOR_PUBLISHERS_PER_REPLICA ))
else
  TOTAL_VALIDATOR_PUBLISHERS=$(( VALIDATOR_REPLICAS * VALIDATOR_PUBLISHERS_PER_REPLICA ))
fi

if (( TOTAL_VALIDATOR_PUBLISHERS > 0 )); then
  VALIDATOR_PUBLISHER_RANGE=$(seq "$VALIDATOR_PUBLISHER_MNEMONIC_START_INDEX" $((VALIDATOR_PUBLISHER_MNEMONIC_START_INDEX + TOTAL_VALIDATOR_PUBLISHERS - 1)) | tr '\n' ',' | sed 's/,$//')
  # Append validator publisher indices to prefund list
  LABS_INFRA_INDICES="${LABS_INFRA_INDICES},${VALIDATOR_PUBLISHER_RANGE}"
fi

# Add prover publishers to prefunding list
TOTAL_PROVER_PUBLISHERS=$((PROVER_AGENT_REPLICA_CAPACITY * PUBLISHERS_PER_PROVER))

if (( TOTAL_PROVER_PUBLISHERS > 0 )); then
  PROVER_PUBLISHER_RANGE=$(seq "$PROVER_PUBLISHER_MNEMONIC_START_INDEX" $((PROVER_PUBLISHER_MNEMONIC_START_INDEX + TOTAL_PROVER_PUBLISHERS - 1)) | tr '\n' ',' | sed 's/,$//')
  # Append prover publisher indices to prefund list
  LABS_INFRA_INDICES="${LABS_INFRA_INDICES},${PROVER_PUBLISHER_RANGE}"
fi

# Add bot L1 accounts to prefunding list
if (( BOT_TRANSFERS_REPLICAS > 0 )); then
  BOT_TRANSFERS_RANGE=$(seq "$BOT_TRANSFERS_MNEMONIC_START_INDEX" $((BOT_TRANSFERS_MNEMONIC_START_INDEX + BOT_TRANSFERS_REPLICAS - 1)) | tr '\n' ',' | sed 's/,$//')
  LABS_INFRA_INDICES="${LABS_INFRA_INDICES},${BOT_TRANSFERS_RANGE}"
fi

if (( BOT_SWAPS_REPLICAS > 0 )); then
  BOT_SWAPS_RANGE=$(seq "$BOT_SWAPS_MNEMONIC_START_INDEX" $((BOT_SWAPS_MNEMONIC_START_INDEX + BOT_SWAPS_REPLICAS - 1)) | tr '\n' ',' | sed 's/,$//')
  LABS_INFRA_INDICES="${LABS_INFRA_INDICES},${BOT_SWAPS_RANGE}"
fi

if (( BOT_CROSS_CHAIN_REPLICAS > 0 )); then
  BOT_CROSS_CHAIN_RANGE=$(seq "$BOT_CROSS_CHAIN_MNEMONIC_START_INDEX" $((BOT_CROSS_CHAIN_MNEMONIC_START_INDEX + BOT_CROSS_CHAIN_REPLICAS - 1)) | tr '\n' ',' | sed 's/,$//')
  LABS_INFRA_INDICES="${LABS_INFRA_INDICES},${BOT_CROSS_CHAIN_RANGE}"
fi

# Ensure docker image provided (not needed for pure teardowns)
if [[ -z "${AZTEC_DOCKER_IMAGE:-}" && ("${CREATE_AZTEC_INFRA:-}" == "true" || "${CREATE_ROLLUP_CONTRACTS:-}" == "true") ]]; then
  die "AZTEC_DOCKER_IMAGE is not set"
fi

K8S_CLUSTER_CONTEXT=$(kubectl config current-context)

if [[ "${DESTROY_NAMESPACE:-}" == "true" ]]; then
  "${SCRIPT_DIR}/network_teardown.sh"
fi

# Drop any stale terraform state locks left behind by a prior crashed run —
# an ungraceful exit (OOM, spot eviction, CI timeout) leaves a `.tflock` GCS
# object that poisons every future run for the same namespace. Only runs for
# ephemeral namespaces (DESTROY_NAMESPACE=true) on a GCS backend, and only
# touches state under this namespace's prefix, so it cannot affect production.
if [[ "${DESTROY_NAMESPACE:-false}" == "true" && "${CLUSTER}" != "kind" ]]; then
  log "Clearing any stale terraform state locks under gs://aztec-terraform/${BASE_STATE_PATH}/"
  for module in deploy-eth-devnet deploy-rollup-contracts deploy-aztec-infra; do
    gcloud storage rm --quiet "gs://aztec-terraform/${BASE_STATE_PATH}/${module}/terraform.tfstate/default.tflock" 2>/dev/null || true
  done
fi

# Create the namespace if it doesn't exist
kubectl get namespace "${NAMESPACE}" >/dev/null 2>&1 || kubectl create namespace "${NAMESPACE}"

# Start k8s enricher in background with per-pod cache logging.
# The enricher spawns a cache_log process per pod, each with its own CI link.
K8S_ENRICHER_PID=""
node --experimental-strip-types --no-warnings "${SCRIPT_DIR}/k8s_enricher.ts" "${NAMESPACE}" --cache-log &
K8S_ENRICHER_PID=$!

cleanup_enricher() {
  if [[ -n "${K8S_ENRICHER_PID:-}" ]]; then
    kill "${K8S_ENRICHER_PID}" 2>/dev/null || true
    wait "${K8S_ENRICHER_PID}" 2>/dev/null || true
  fi
}
trap cleanup_enricher EXIT

# DRY helper to init/plan/apply/destroy a terraform module
tf_run() {
  local dir="$1"
  local destroy_flag="$2"
  local create_flag="$3"

  terraform -chdir="${dir}" init -reconfigure
  if [[ "${destroy_flag}" == "true" ]]; then
    terraform -chdir="${dir}" destroy -auto-approve
  fi
  if [[ "${create_flag}" == "true" ]]; then
    terraform -chdir="${dir}" plan -out=tfplan
    terraform -chdir="${dir}" apply tfplan
  fi
}
export -f tf_run

# -------------------------------------------------------
# Optionally deploy Ethereum devnet; otherwise use env URLs
# -------------------------------------------------------
CSV_RPC_URLS=""
L1_RPC_URLS_JSON="[]"
L1_CONSENSUS_HOST_URLS_JSON="[]"
L1_CONSENSUS_HOST_API_KEYS_JSON="[]"
L1_CONSENSUS_HOST_API_KEY_HEADERS_JSON="[]"

if [[ "${CREATE_ETH_DEVNET}" == "true" ]]; then
  log "CREATE_ETH_DEVNET=true - deploying Ethereum devnet"
  ETH_DEVNET_START=$(date +%s)

  DEPLOY_ETH_DEVNET_DIR="${SCRIPT_DIR}/../terraform/deploy-eth-devnet"
  cat > "${DEPLOY_ETH_DEVNET_DIR}/terraform.tfvars" << EOF
project = "${GCP_PROJECT_ID}"
region = "${GCP_REGION}"
K8S_CLUSTER_CONTEXT = "${K8S_CLUSTER_CONTEXT}"
RELEASE_PREFIX = "${NAMESPACE}"
NAMESPACE = "${NAMESPACE}"
ETH_DEVNET_VALUES = "eth-devnet.yaml"
MNEMONIC = "${LABS_INFRA_MNEMONIC}"
CHAIN_ID = "${ETHEREUM_CHAIN_ID}"
BLOCK_TIME = ${ETHEREUM_BLOCK_TIME}
GAS_LIMIT = ${ETHEREUM_GAS_LIMIT}
PREFUNDED_MNEMONIC_INDICES = "${LABS_INFRA_INDICES}"
RESOURCE_PROFILE = "${RESOURCE_PROFILE}"
USE_LOAD_BALANCERS = ${USE_LOAD_BALANCERS:-false}
EOF

  "${SCRIPT_DIR}/override_terraform_backend.sh" "${DEPLOY_ETH_DEVNET_DIR}" "${CLUSTER}" "${BASE_STATE_PATH}/deploy-eth-devnet"
  k8s_denoise "tf_run "${DEPLOY_ETH_DEVNET_DIR}" "${DESTROY_ETH_DEVNET}" "${CREATE_ETH_DEVNET}""

  L1_RPC_URL=$(terraform -chdir="${DEPLOY_ETH_DEVNET_DIR}" output -raw eth_execution_rpc_url)
  L1_CONSENSUS_HOST_URL=$(terraform -chdir="${DEPLOY_ETH_DEVNET_DIR}" output -raw eth_beacon_api_url)
  STAGE_TIMINGS[eth_devnet]=$(($(date +%s) - ETH_DEVNET_START))
  [[ -n "${L1_RPC_URL}" ]] || die "Failed to fetch eth_execution_rpc_url"
  [[ -n "${L1_CONSENSUS_HOST_URL}" ]] || die "Failed to fetch eth_beacon_api_url"

  # For downstream modules
  CSV_RPC_URLS="${L1_RPC_URL}"
  L1_RPC_URLS_JSON="[\"${L1_RPC_URL}\"]"
  L1_CONSENSUS_HOST_URLS_JSON="[\"${L1_CONSENSUS_HOST_URL}\"]"
  # These can be null
  # L1_CONSENSUS_HOST_API_KEYS_JSON=
  # L1_CONSENSUS_HOST_API_KEY_HEADERS_JSON=
else
  log "CREATE_ETH_DEVNET=false - using environment-provided Ethereum endpoints"

  # Expect ETHEREUM_RPC_URLS (JSON array), and consensus host arrays and keys
  if [[ -z "${ETHEREUM_RPC_URLS:-}" ]]; then
    die "ETHEREUM_RPC_URLS is not set (expected JSON array, e.g. [\"https://...\"])"
  fi

  CSV_RPC_URLS=$(echo "${ETHEREUM_RPC_URLS}" | jq -r 'join(",")')

  L1_RPC_URLS_JSON="${ETHEREUM_RPC_URLS}"
  L1_CONSENSUS_HOST_URLS_JSON="${ETHEREUM_CONSENSUS_HOST_URLS:-[]}"
  L1_CONSENSUS_HOST_API_KEYS_JSON="${ETHEREUM_CONSENSUS_HOST_API_KEYS:-[]}"
  L1_CONSENSUS_HOST_API_KEY_HEADERS_JSON="${ETHEREUM_CONSENSUS_HOST_API_KEY_HEADERS:-[]}"
fi

# -------------------------------
# Deploy rollup contracts
# -------------------------------

if [[ "${VERIFY_CONTRACTS:-}" == "true" && "${ETHEREUM_CHAIN_ID}" == "1337" ]]; then
  die "Cannot verify contracts deployed to eth-devnet"
fi

# Check for ETHERSCAN_API_KEY when VERIFY_CONTRACTS is enabled
# Contract verification happens automatically in the yarn-project code when on mainnet/sepolia
# and ETHERSCAN_API_KEY is set. This check ensures we fail early if verification is expected.
if [[ "${VERIFY_CONTRACTS:-}" == "true" && "${CREATE_ROLLUP_CONTRACTS}" == "true" && -z "${ETHERSCAN_API_KEY:-}" ]]; then
  die "Error: ETHERSCAN_API_KEY is not set but VERIFY_CONTRACTS=true. Contract verification requires an Etherscan API key. Set ETHERSCAN_API_KEY environment variable."
fi

ROLLUP_CONTRACTS_START=$(date +%s)
DEPLOY_ROLLUP_CONTRACTS_DIR="${SCRIPT_DIR}/../terraform/deploy-rollup-contracts"
"${SCRIPT_DIR}/override_terraform_backend.sh" "${DEPLOY_ROLLUP_CONTRACTS_DIR}" "${CLUSTER}" "${BASE_STATE_PATH}/deploy-rollup-contracts"

# Handle ETHERSCAN_API_KEY - only set when deploying or redeploying contracts
if [[ "${VERIFY_CONTRACTS:-}" == "true" && "${CREATE_ROLLUP_CONTRACTS}" == "true" ]]; then
  ETHERSCAN_API_KEY_TF="\"${ETHERSCAN_API_KEY:-}\""
else
  ETHERSCAN_API_KEY_TF=null
fi

cat > "${DEPLOY_ROLLUP_CONTRACTS_DIR}/terraform.tfvars" << EOF
K8S_CLUSTER_CONTEXT = "${K8S_CLUSTER_CONTEXT}"
NAMESPACE = "${NAMESPACE}"
AZTEC_DOCKER_IMAGE = "${AZTEC_DOCKER_IMAGE}"
L1_RPC_URLS = "${CSV_RPC_URLS}"
PRIVATE_KEY = "${ROLLUP_DEPLOYMENT_PRIVATE_KEY}"
L1_CHAIN_ID = "${ETHEREUM_CHAIN_ID}"
VALIDATORS = "${VALIDATOR_ADDRESSES}"
SPONSORED_FPC = ${SPONSORED_FPC}
TEST_ACCOUNTS = ${TEST_ACCOUNTS}
REAL_VERIFIER = ${REAL_VERIFIER}
AZTEC_LAG_IN_EPOCHS_FOR_VALIDATOR_SET = ${AZTEC_LAG_IN_EPOCHS_FOR_VALIDATOR_SET:-null}
AZTEC_LAG_IN_EPOCHS_FOR_RANDAO = ${AZTEC_LAG_IN_EPOCHS_FOR_RANDAO:-null}
AZTEC_SLOT_DURATION = ${AZTEC_SLOT_DURATION:-null}
AZTEC_EPOCH_DURATION = ${AZTEC_EPOCH_DURATION:-null}
AZTEC_TARGET_COMMITTEE_SIZE = ${AZTEC_TARGET_COMMITTEE_SIZE:-null}
AZTEC_PROOF_SUBMISSION_EPOCHS = ${AZTEC_PROOF_SUBMISSION_EPOCHS:-null}
AZTEC_ACTIVATION_THRESHOLD = ${AZTEC_ACTIVATION_THRESHOLD:-null}
AZTEC_EJECTION_THRESHOLD = ${AZTEC_EJECTION_THRESHOLD:-null}
AZTEC_LOCAL_EJECTION_THRESHOLD = ${AZTEC_LOCAL_EJECTION_THRESHOLD:-null}
AZTEC_SLASHING_QUORUM = ${AZTEC_SLASHING_QUORUM:-null}
AZTEC_SLASHING_ROUND_SIZE = ${AZTEC_SLASHING_ROUND_SIZE:-null}
AZTEC_SLASHING_ROUND_SIZE_IN_EPOCHS = ${AZTEC_SLASHING_ROUND_SIZE_IN_EPOCHS:-null}
AZTEC_SLASHING_LIFETIME_IN_ROUNDS = ${AZTEC_SLASHING_LIFETIME_IN_ROUNDS:-null}
AZTEC_SLASHING_EXECUTION_DELAY_IN_ROUNDS = ${AZTEC_SLASHING_EXECUTION_DELAY_IN_ROUNDS:-null}
AZTEC_SLASHING_VETOER = ${AZTEC_SLASHING_VETOER:-null}
AZTEC_SLASHING_OFFSET_IN_ROUNDS = ${AZTEC_SLASHING_OFFSET_IN_ROUNDS:-null}
AZTEC_SLASH_AMOUNT_SMALL = ${AZTEC_SLASH_AMOUNT_SMALL:-null}
AZTEC_SLASH_AMOUNT_MEDIUM = ${AZTEC_SLASH_AMOUNT_MEDIUM:-null}
AZTEC_SLASH_AMOUNT_LARGE = ${AZTEC_SLASH_AMOUNT_LARGE:-null}
AZTEC_SLASHER_ENABLED = ${AZTEC_SLASHER_ENABLED:-null}
AZTEC_GOVERNANCE_PROPOSER_QUORUM = ${AZTEC_GOVERNANCE_PROPOSER_QUORUM:-null}
AZTEC_GOVERNANCE_PROPOSER_ROUND_SIZE = ${AZTEC_GOVERNANCE_PROPOSER_ROUND_SIZE:-null}
AZTEC_GOVERNANCE_VOTING_DURATION = ${AZTEC_GOVERNANCE_VOTING_DURATION:-null}
AZTEC_MANA_TARGET = ${AZTEC_MANA_TARGET:-null}
AZTEC_PROVING_COST_PER_MANA = ${AZTEC_PROVING_COST_PER_MANA:-null}
AZTEC_EXIT_DELAY_SECONDS = ${AZTEC_EXIT_DELAY_SECONDS:-null}
ETHERSCAN_API_KEY = ${ETHERSCAN_API_KEY_TF}
NETWORK = $(tf_str "${NETWORK:-}")
ALLOW_OVERRIDING_NETWORK_CONFIG = $(tf_str "${ALLOW_OVERRIDING_NETWORK_CONFIG:-}")
JOB_NAME = "deploy-rollup-contracts"
JOB_BACKOFF_LIMIT = 3
JOB_TTL_SECONDS_AFTER_FINISHED = 3600
EOF

# Check terraform state for existing contract addresses
# This avoids redeploying contracts when the k8s job has been cleaned up by TTL
k8s_denoise "terraform -chdir=${DEPLOY_ROLLUP_CONTRACTS_DIR} init -reconfigure >/dev/null"
EXISTING_REGISTRY=$(terraform -chdir="${DEPLOY_ROLLUP_CONTRACTS_DIR}" output -raw registry_address 2>/dev/null | grep -E '^0x[a-fA-F0-9]{40}$' || true)

if [[ "${USE_NETWORK_CONFIG:-false}" == "true" ]]; then
    log "Using network configuration, skipping contracts deployment"
else
  if [[ -n "${EXISTING_REGISTRY}" && "${CREATE_ROLLUP_CONTRACTS}" != "true" ]]; then
    log "Contracts already deployed (registry=${EXISTING_REGISTRY}), skipping deployment"
  else
    if [[ "${CREATE_ROLLUP_CONTRACTS}" == "true" ]]; then
      log "CREATE_ROLLUP_CONTRACTS=true, destroying existing deployment"
      k8s_denoise "terraform -chdir="${DEPLOY_ROLLUP_CONTRACTS_DIR}" destroy -auto-approve"
    fi
    k8s_denoise "terraform -chdir=${DEPLOY_ROLLUP_CONTRACTS_DIR} plan -out=tfplan"
    k8s_denoise "terraform -chdir=${DEPLOY_ROLLUP_CONTRACTS_DIR} apply tfplan"
  fi
fi

STAGE_TIMINGS[rollup_contracts]=$(($(date +%s) - ROLLUP_CONTRACTS_START))
log "Rollup contracts ready"

if [[ "${USE_NETWORK_CONFIG:-false}" != "true" ]]; then
  REGISTRY_ADDRESS=$(terraform -chdir="${DEPLOY_ROLLUP_CONTRACTS_DIR}" output -raw registry_address)
  FEE_ASSET_HANDLER_ADDRESS=$(terraform -chdir="${DEPLOY_ROLLUP_CONTRACTS_DIR}" output -raw fee_asset_handler_address)

  [[ -n "${REGISTRY_ADDRESS}" ]] || die "Failed to fetch registry_address"
  [[ -n "${FEE_ASSET_HANDLER_ADDRESS}" ]] || die "Failed to fetch fee_asset_handler_address"
  log "Contract addresses: registry=${REGISTRY_ADDRESS}, fee_asset_handler=${FEE_ASSET_HANDLER_ADDRESS}"
else
  REGISTRY_ADDRESS="${REGISTRY_ADDRESS:-}"
  FEE_ASSET_HANDLER_ADDRESS="${FEE_ASSET_HANDLER_ADDRESS:-}"
fi


# -------------------------------
# Generate admin API key
# -------------------------------
# Generate a fresh key on every deploy; the hash goes to validators and the
# raw key is stored as a K8s Secret for the test runner to retrieve later.
# The raw key is never logged.
ADMIN_API_KEY=$(openssl rand -hex 32)
ADMIN_API_KEY_HASH=$(printf '%s' "$ADMIN_API_KEY" | sha256sum | cut -d' ' -f1)
kubectl create secret generic aztec-admin-api-key \
  --from-literal=key="$ADMIN_API_KEY" \
  --namespace "${NAMESPACE}" \
  --dry-run=client -o yaml | kubectl apply -f -
unset ADMIN_API_KEY

# -------------------------------
# Deploy Aztec infra
# -------------------------------
AZTEC_INFRA_START=$(date +%s)
DEPLOY_AZTEC_INFRA_DIR="${SCRIPT_DIR}/../terraform/deploy-aztec-infra"
"${SCRIPT_DIR}/override_terraform_backend.sh" "${DEPLOY_AZTEC_INFRA_DIR}" "${CLUSTER}" "${BASE_STATE_PATH}/deploy-aztec-infra"

# Gate NodePort based on cluster (true for kind, false for GKE)
if [[ "${CLUSTER}" == "kind" ]]; then
  P2P_NODEPORT_ENABLED=true
  P2P_PUBLIC_IP=false
  P2P_HOSTPORT_ENABLED=${P2P_HOSTPORT_ENABLED:-false}
else
  P2P_NODEPORT_ENABLED=false
  P2P_PUBLIC_IP=${P2P_PUBLIC_IP:-true}
  P2P_HOSTPORT_ENABLED=${P2P_HOSTPORT_ENABLED:-true}
fi

cat > "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" << EOF
K8S_CLUSTER_CONTEXT = "${K8S_CLUSTER_CONTEXT}"
RELEASE_PREFIX = "${NAMESPACE}"
NAMESPACE = "${NAMESPACE}"
GCP_PROJECT_ID = "${GCP_PROJECT_ID}"
GCP_REGION = "${GCP_REGION}"
R2_ACCESS_KEY_ID="${R2_ACCESS_KEY_ID}"
R2_SECRET_ACCESS_KEY="${R2_SECRET_ACCESS_KEY}"
P2P_BOOTSTRAP_RESOURCE_PROFILE = "${P2P_BOOTSTRAP_RESOURCE_PROFILE}"
VALIDATOR_RESOURCE_PROFILE = "${VALIDATOR_RESOURCE_PROFILE}"
PROVER_RESOURCE_PROFILE = "${PROVER_RESOURCE_PROFILE}"
RPC_RESOURCE_PROFILE = "${RPC_RESOURCE_PROFILE}"
FULL_NODE_RESOURCE_PROFILE = "${FULL_NODE_RESOURCE_PROFILE}"
AZTEC_DOCKER_IMAGE = "${AZTEC_DOCKER_IMAGE}"
PROVER_AGENT_DOCKER_IMAGE = "${PROVER_AGENT_DOCKER_IMAGE:-$AZTEC_DOCKER_IMAGE}"
VALIDATOR_HA_DOCKER_IMAGE = "${VALIDATOR_HA_DOCKER_IMAGE:-}"
SPONSORED_FPC = ${SPONSORED_FPC}
TEST_ACCOUNTS = ${TEST_ACCOUNTS}
L1_CHAIN_ID = "${ETHEREUM_CHAIN_ID}"
L1_RPC_URLS = ${L1_RPC_URLS_JSON}
L1_CONSENSUS_HOST_URLS = ${L1_CONSENSUS_HOST_URLS_JSON}
L1_CONSENSUS_HOST_API_KEYS = ${L1_CONSENSUS_HOST_API_KEYS_JSON:-null}
L1_CONSENSUS_HOST_API_KEY_HEADERS = ${L1_CONSENSUS_HOST_API_KEY_HEADERS_JSON:-null}
REGISTRY_CONTRACT_ADDRESS = "${REGISTRY_ADDRESS}"
ROLLUP_VERSION = "${ROLLUP_VERSION}"
FEE_ASSET_HANDLER_CONTRACT_ADDRESS = "${FEE_ASSET_HANDLER_ADDRESS}"
VALIDATOR_MNEMONIC = "${LABS_INFRA_MNEMONIC}"
VALIDATOR_MNEMONIC_START_INDEX = ${VALIDATOR_MNEMONIC_START_INDEX}
VALIDATOR_PUBLISHER_MNEMONIC_START_INDEX = ${VALIDATOR_PUBLISHER_MNEMONIC_START_INDEX}
VALIDATORS_PER_NODE = ${VALIDATORS_PER_NODE}
VALIDATOR_REPLICAS = ${VALIDATOR_REPLICAS}
VALIDATOR_PUBLISHERS_PER_REPLICA = ${VALIDATOR_PUBLISHERS_PER_REPLICA}
VALIDATOR_COINBASE = $(tf_str "${VALIDATOR_COINBASE:-}")
VALIDATOR_HA_REPLICAS = ${VALIDATOR_HA_REPLICAS}
VALIDATOR_HA_REPLICA_COUNT = ${VALIDATOR_HA_REPLICA_COUNT:-null}
VALIDATOR_HA_OLD_DUTIES_MAX_AGE_H = ${VALIDATOR_HA_OLD_DUTIES_MAX_AGE_H}
SEQ_MIN_TX_PER_BLOCK = ${SEQ_MIN_TX_PER_BLOCK}
SEQ_MAX_TX_PER_BLOCK = ${SEQ_MAX_TX_PER_BLOCK}
SEQ_MAX_TX_PER_CHECKPOINT = ${SEQ_MAX_TX_PER_CHECKPOINT}
P2P_MAX_PENDING_TX_COUNT = ${P2P_MAX_PENDING_TX_COUNT}
SEQ_PER_BLOCK_ALLOCATION_MULTIPLIER = ${SEQ_PER_BLOCK_ALLOCATION_MULTIPLIER}
SEQ_BLOCK_DURATION_MS = ${SEQ_BLOCK_DURATION_MS:-null}
SEQ_L1_PUBLISHING_TIME_ALLOWANCE_IN_SLOT = ${SEQ_L1_PUBLISHING_TIME_ALLOWANCE_IN_SLOT:-null}
SEQ_BUILD_CHECKPOINT_IF_EMPTY = ${SEQ_BUILD_CHECKPOINT_IF_EMPTY:-null}
AZTEC_EPOCHS_LAG = ${AZTEC_EPOCHS_LAG:-null}
SEQ_SKIP_CHECKPOINT_PUBLISH_PERCENT = ${SEQ_SKIP_CHECKPOINT_PUBLISH_PERCENT}
PROVER_MNEMONIC = "${LABS_INFRA_MNEMONIC}"
PROVER_PUBLISHER_MNEMONIC_START_INDEX = ${PROVER_PUBLISHER_MNEMONIC_START_INDEX}
PROVER_PUBLISHERS_PER_PROVER = ${PUBLISHERS_PER_PROVER}
SENTINEL_ENABLED = ${SENTINEL_ENABLED:-null}
OFFENSE_COLLECTION_ENABLED = ${OFFENSE_COLLECTION_ENABLED:-null}
SLASH_INACTIVITY_TARGET_PERCENTAGE = ${SLASH_INACTIVITY_TARGET_PERCENTAGE:-null}
SLASH_INACTIVITY_PENALTY = ${SLASH_INACTIVITY_PENALTY:-null}
SLASH_DATA_WITHHOLDING_PENALTY = ${SLASH_DATA_WITHHOLDING_PENALTY:-null}
SLASH_DATA_WITHHOLDING_TOLERANCE_SLOTS = ${SLASH_DATA_WITHHOLDING_TOLERANCE_SLOTS:-null}
SLASH_PROPOSE_INVALID_ATTESTATIONS_PENALTY = ${SLASH_PROPOSE_INVALID_ATTESTATIONS_PENALTY:-null}
SLASH_DUPLICATE_PROPOSAL_PENALTY = ${SLASH_DUPLICATE_PROPOSAL_PENALTY:-null}
SLASH_DUPLICATE_ATTESTATION_PENALTY = ${SLASH_DUPLICATE_ATTESTATION_PENALTY:-null}
SLASH_PROPOSE_DESCENDANT_OF_CHECKPOINT_WITH_INVALID_ATTESTATIONS_PENALTY = ${SLASH_PROPOSE_DESCENDANT_OF_CHECKPOINT_WITH_INVALID_ATTESTATIONS_PENALTY:-null}
SLASH_ATTEST_INVALID_CHECKPOINT_PROPOSAL_PENALTY = ${SLASH_ATTEST_INVALID_CHECKPOINT_PROPOSAL_PENALTY:-null}
SLASH_UNKNOWN_PENALTY = ${SLASH_UNKNOWN_PENALTY:-null}
SLASH_INVALID_BLOCK_PENALTY = ${SLASH_INVALID_BLOCK_PENALTY:-null}
SLASH_INVALID_CHECKPOINT_PROPOSAL_PENALTY = ${SLASH_INVALID_CHECKPOINT_PROPOSAL_PENALTY:-null}
SLASH_OFFENSE_EXPIRATION_ROUNDS = ${SLASH_OFFENSE_EXPIRATION_ROUNDS:-null}
SLASH_MAX_PAYLOAD_SIZE = ${SLASH_MAX_PAYLOAD_SIZE:-null}
OTEL_COLLECTOR_ENDPOINT = "${OTEL_COLLECTOR_ENDPOINT}"
OTEL_COLLECT_INTERVAL_MS = ${OTEL_COLLECT_INTERVAL_MS:-null}
OTEL_EXPORT_TIMEOUT_MS = ${OTEL_EXPORT_TIMEOUT_MS:-null}
DEPLOY_INTERNAL_BOOTNODE = ${DEPLOY_INTERNAL_BOOTNODE:-true}
PROVER_REAL_PROOFS = ${PROVER_REAL_PROOFS}
TRANSACTIONS_DISABLED = ${TRANSACTIONS_DISABLED:-null}
NETWORK = $(tf_str "${NETWORK:-}")
ALLOW_OVERRIDING_NETWORK_CONFIG = $(tf_str "${ALLOW_OVERRIDING_NETWORK_CONFIG:-}")
AZTEC_SLOT_DURATION = ${AZTEC_SLOT_DURATION:-null}
AZTEC_EPOCH_DURATION = ${AZTEC_EPOCH_DURATION:-null}
STORE_SNAPSHOT_URL = ${STORE_SNAPSHOT_URL_TF}
BOT_RESOURCE_PROFILE = "${BOT_RESOURCE_PROFILE}"
BOT_MNEMONIC = "${LABS_INFRA_MNEMONIC}"
BOT_TRANSFERS_MNEMONIC_START_INDEX = ${BOT_TRANSFERS_MNEMONIC_START_INDEX}
BOT_TRANSFERS_REPLICAS = ${BOT_TRANSFERS_REPLICAS}
BOT_TRANSFERS_TX_INTERVAL_SECONDS = ${BOT_TRANSFERS_TX_INTERVAL_SECONDS}
BOT_TRANSFERS_FOLLOW_CHAIN = "${BOT_TRANSFERS_FOLLOW_CHAIN}"
BOT_SWAPS_MNEMONIC_START_INDEX = ${BOT_SWAPS_MNEMONIC_START_INDEX}
BOT_SWAPS_REPLICAS = ${BOT_SWAPS_REPLICAS}
BOT_SWAPS_TX_INTERVAL_SECONDS = ${BOT_SWAPS_TX_INTERVAL_SECONDS}
BOT_SWAPS_FOLLOW_CHAIN = "${BOT_SWAPS_FOLLOW_CHAIN}"
BOT_CROSS_CHAIN_MNEMONIC_START_INDEX = ${BOT_CROSS_CHAIN_MNEMONIC_START_INDEX}
BOT_CROSS_CHAIN_REPLICAS = ${BOT_CROSS_CHAIN_REPLICAS}
BOT_CROSS_CHAIN_TX_INTERVAL_SECONDS = ${BOT_CROSS_CHAIN_TX_INTERVAL_SECONDS}
BOT_CROSS_CHAIN_FOLLOW_CHAIN = "${BOT_CROSS_CHAIN_FOLLOW_CHAIN}"
BOT_TRANSFERS_PXE_SYNC_CHAIN_TIP = "${BOT_TRANSFERS_PXE_SYNC_CHAIN_TIP}"
BOT_SWAPS_PXE_SYNC_CHAIN_TIP = "${BOT_SWAPS_PXE_SYNC_CHAIN_TIP}"
BOT_CROSS_CHAIN_PXE_SYNC_CHAIN_TIP = "${BOT_CROSS_CHAIN_PXE_SYNC_CHAIN_TIP}"
BOT_TRANSFERS_L2_PRIVATE_KEY = "${BOT_TRANSFERS_L2_PRIVATE_KEY:-0xcafe01}"
BOT_SWAPS_L2_PRIVATE_KEY = "${BOT_SWAPS_L2_PRIVATE_KEY:-0xcafe02}"
BOT_CROSS_CHAIN_L2_PRIVATE_KEY = "${BOT_CROSS_CHAIN_L2_PRIVATE_KEY:-0xcafe03}"

PROVER_AGENTS_PER_PROVER = ${PROVER_AGENTS_PER_PROVER}
PROVER_AGENT_POLL_INTERVAL_MS = ${PROVER_AGENT_POLL_INTERVAL_MS}
PROVER_AGENT_KEDA_ENABLED = ${PROVER_AGENT_KEDA_ENABLED:-false}
PROVER_AGENT_KEDA_PROMETHEUS_SERVER_ADDRESS = "${PROVER_AGENT_KEDA_PROMETHEUS_SERVER_ADDRESS:-}"
PROVER_AGENT_KEDA_MIN_REPLICAS = ${PROVER_AGENT_KEDA_MIN_REPLICAS:-0}
PROVER_AGENT_KEDA_MAX_REPLICAS = ${PROVER_AGENT_KEDA_MAX_REPLICAS:-$PROVER_REPLICAS}
PROVER_AGENT_KEDA_SCALING_BANDS = ${PROVER_AGENT_KEDA_SCALING_BANDS:-[]}
PROVER_AGENT_KEDA_POLLING_INTERVAL_SECONDS = ${PROVER_AGENT_KEDA_POLLING_INTERVAL_SECONDS:-30}
PROVER_AGENT_KEDA_COOLDOWN_PERIOD_SECONDS = ${PROVER_AGENT_KEDA_COOLDOWN_PERIOD_SECONDS:-300}

RPC_REPLICAS = ${RPC_REPLICAS:-1}
FISHERMAN_REPLICAS = ${FISHERMAN_REPLICAS}
FISHERMAN_MNEMONIC = "${LABS_INFRA_MNEMONIC}"
FISHERMAN_MNEMONIC_START_INDEX = ${FISHERMAN_MNEMONIC_START_INDEX}

FULL_NODE_REPLICAS = ${FULL_NODE_REPLICAS:-1}

PROVER_FAILED_PROOF_STORE = "${PROVER_FAILED_PROOF_STORE}"
L1_TX_FAILED_STORE = "${L1_TX_FAILED_STORE:-}"
PROVER_PROOF_STORE = "${PROVER_PROOF_STORE:-}"
PROVER_BROKER_DEBUG_REPLAY_ENABLED = ${PROVER_BROKER_DEBUG_REPLAY_ENABLED:-false}
PROVER_REPLICAS = ${PROVER_REPLICAS}
PROVER_ENABLED = ${PROVER_ENABLED}

PROVER_TEST_DELAY_TYPE = "${PROVER_TEST_DELAY_TYPE}"
PROVER_TEST_VERIFICATION_DELAY_MS = ${PROVER_TEST_VERIFICATION_DELAY_MS}

PROVER_NODE_DISABLE_PROOF_PUBLISH = ${PROVER_NODE_DISABLE_PROOF_PUBLISH}
P2P_TX_POOL_DELETE_TXS_AFTER_REORG = ${P2P_TX_POOL_DELETE_TXS_AFTER_REORG}
VALIDATOR_L1_PRIORITY_FEE_BUMP_PERCENTAGE = ${VALIDATOR_L1_PRIORITY_FEE_BUMP_PERCENTAGE:-null}
VALIDATOR_L1_PRIORITY_FEE_RETRY_BUMP_PERCENTAGE = ${VALIDATOR_L1_PRIORITY_FEE_RETRY_BUMP_PERCENTAGE:-null}
PROVER_L1_PRIORITY_FEE_BUMP_PERCENTAGE = ${PROVER_L1_PRIORITY_FEE_BUMP_PERCENTAGE:-null}
PROVER_L1_PRIORITY_FEE_RETRY_BUMP_PERCENTAGE = ${PROVER_L1_PRIORITY_FEE_RETRY_BUMP_PERCENTAGE:-null}
BLOB_ALLOW_EMPTY_SOURCES = ${BLOB_ALLOW_EMPTY_SOURCES:-false}
BLOB_FILE_STORE_UPLOAD_URL = ${BLOB_FILE_STORE_UPLOAD_URL_TF}
BLOB_FILE_STORE_URLS = "${BLOB_FILE_STORE_URLS:-}"
TX_FILE_STORE_ENABLED = ${TX_FILE_STORE_ENABLED}
TX_FILE_STORE_URL = ${TX_FILE_STORE_URL_TF}
TX_COLLECTION_FILE_STORE_URLS = "${TX_COLLECTION_FILE_STORE_URLS}"
DEBUG_P2P_INSTRUMENT_MESSAGES = ${DEBUG_P2P_INSTRUMENT_MESSAGES:-false}

PROVER_AGENT_INCLUDE_METRICS = "${PROVER_AGENT_INCLUDE_METRICS-null}"
FULL_NODE_INCLUDE_METRICS = "${FULL_NODE_INCLUDE_METRICS-null}"

LOG_LEVEL = $(tf_str "$LOG_LEVEL")
FISHERMAN_LOG_LEVEL = $(tf_str "$FISHERMAN_LOG_LEVEL")

WS_NUM_HISTORIC_CHECKPOINTS = ${WS_NUM_HISTORIC_CHECKPOINTS:-null}

P2P_PUBLIC_IP = ${P2P_PUBLIC_IP}
P2P_NODEPORT_ENABLED = ${P2P_NODEPORT_ENABLED}
P2P_HOSTPORT_ENABLED = ${P2P_HOSTPORT_ENABLED}

PROVER_AGENT_PROOF_TYPES = ${PROVER_AGENT_PROOF_TYPES:-[]}
DEBUG_FORCE_TX_PROOF_VERIFICATION = ${DEBUG_FORCE_TX_PROOF_VERIFICATION:-false}

WAIT_FOR_PROVER_DEPLOY = ${WAIT_FOR_PROVER_DEPLOY:-null}
ADMIN_API_KEY_HASH = "${ADMIN_API_KEY_HASH}"
EOF

append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_ENABLED
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_HOSTS
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_API_KEY_SECRET_NAMES
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_ALLOW_ANONYMOUS
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_ANONYMOUS_RATE_LIMIT_MINUTE
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_API_KEY_HEADER_NAME string
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_KONG_NAMESPACE string
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_KONG_HELM_RELEASE_NAME string
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_KONG_HELM_CHART_VERSION string
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_KONG_INGRESS_CLASS string
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_KONG_PROXY_SERVICE_TYPE string
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_KONG_PROXY_SERVICE_ANNOTATIONS
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_KONG_EXTRA_HELM_VALUES
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_KONG_SERVICE_MONITOR_ENABLED
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_KONG_OTEL_METRICS_GCP_SECRET_NAME string
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_EXTERNAL_SECRET_STORE_NAME string
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_EXTERNAL_SECRET_STORE_KIND string
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_EXTERNAL_SECRET_REFRESH_INTERVAL string
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" PROVER_NODE_RPC_GATEWAY_ENABLED
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" PROVER_NODE_RPC_GATEWAY_HOSTS
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" PROVER_NODE_RPC_GATEWAY_PATH string
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" PROVER_NODE_RPC_GATEWAY_STRIP_PATH
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" PROVER_NODE_RPC_GATEWAY_API_KEY_SECRET_NAMES
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_CREATE_DNS
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_DNS_ZONE_NAME string
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_DNS_TTL
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_FRONTEND_ENABLED
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_FRONTEND_STATIC_IP_ENABLED
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_FRONTEND_STATIC_IP_NAME string
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_FRONTEND_ALLOW_HTTP
append_optional_tfvar "${DEPLOY_AZTEC_INFRA_DIR}/terraform.tfvars" RPC_GATEWAY_GCP_MANAGED_CERTIFICATE_ENABLED

k8s_denoise "tf_run "${DEPLOY_AZTEC_INFRA_DIR}" "${DESTROY_AZTEC_INFRA}" "${CREATE_AZTEC_INFRA}""
STAGE_TIMINGS[aztec_infra]=$(($(date +%s) - AZTEC_INFRA_START))
log "Deployed aztec infra"

# -------------------------------------------------------
# Optionally install chaos mesh scenarios after Aztec infra
# -------------------------------------------------------
# Chaos Mesh resolves pod selectors at experiment creation time, so the target
# pods must already exist. The chaos-daemon injects iptables DROP rules into
# each matched pod's network namespace. For partition experiments, this
# immediately blocks packets between the partitioned pods, causing existing
# TCP connections to timeout and preventing new ones from forming.
#
# IMPORTANT: Do NOT restart pods after chaos injection. Chaos Mesh does not
# automatically re-inject rules into recreated pods, leaving them unpartitioned.
if [[ -n "${CHAOS_MESH_SCENARIOS_FILE}" ]]; then
  CHAOS_SCENARIOS_DIR="${SCRIPT_DIR}/../aztec-chaos-scenarios"
  log "Installing chaos mesh scenarios from ${CHAOS_MESH_SCENARIOS_FILE}"
  helm upgrade --install network-shaping "${CHAOS_SCENARIOS_DIR}" \
    --namespace "${NAMESPACE}" \
    --values "${CHAOS_SCENARIOS_DIR}/values/${CHAOS_MESH_SCENARIOS_FILE}" \
    --set "global.targetNamespace=${NAMESPACE}" \
    --wait --timeout=5m
  log "Chaos mesh scenarios installed, waiting for rules to be injected..."

  # Wait for all NetworkChaos experiments to have their rules injected.
  # The AllInjected condition confirms iptables rules are active on every matched pod.
  CHAOS_WAIT_TIMEOUT=120
  CHAOS_WAITED=0
  while true; do
    NOT_INJECTED=$(kubectl get networkchaos -n "${NAMESPACE}" -o jsonpath='{range .items[*]}{.status.conditions[?(@.type=="AllInjected")].status}{"\n"}{end}' 2>/dev/null | grep -c "False" || true)
    if [[ "${NOT_INJECTED}" -eq 0 ]]; then
      log "All chaos mesh rules injected"
      break
    fi
    if [[ "${CHAOS_WAITED}" -ge "${CHAOS_WAIT_TIMEOUT}" ]]; then
      log "WARNING: Timed out waiting for chaos mesh injection after ${CHAOS_WAIT_TIMEOUT}s (${NOT_INJECTED} experiments not yet injected)"
      break
    fi
    sleep 5
    CHAOS_WAITED=$((CHAOS_WAITED + 5))
  done
  log "Chaos mesh partition active — existing connections will break as packets are dropped"
fi

# Calculate total deployment time
DEPLOY_END_TIME=$(date +%s)
TOTAL_DEPLOY_TIME=$((DEPLOY_END_TIME - DEPLOY_START_TIME))

# Output benchmark JSON for CI benchmarks
mkdir -p "${SCRIPT_DIR}/../bench-out"
BENCH_OUTPUT="${SCRIPT_DIR}/../bench-out/network_deploy.bench.json"

# Build benchmark JSON array
BENCH_JSON='['
BENCH_JSON+='{"name": "ci/network_deploy/total", "value": '"${TOTAL_DEPLOY_TIME}"', "unit": "seconds"}'

if [[ -n "${STAGE_TIMINGS[eth_devnet]:-}" ]]; then
  BENCH_JSON+=',{"name": "ci/network_deploy/eth_devnet", "value": '"${STAGE_TIMINGS[eth_devnet]}"', "unit": "seconds"}'
fi

BENCH_JSON+=',{"name": "ci/network_deploy/rollup_contracts", "value": '"${STAGE_TIMINGS[rollup_contracts]}"', "unit": "seconds"}'
BENCH_JSON+=',{"name": "ci/network_deploy/aztec_infra", "value": '"${STAGE_TIMINGS[aztec_infra]}"', "unit": "seconds"}'
BENCH_JSON+=']'

echo "${BENCH_JSON}" | jq '.' > "${BENCH_OUTPUT}"
log "Benchmark JSON written to ${BENCH_OUTPUT}"

log "Total deployment time: ${TOTAL_DEPLOY_TIME} seconds"