Skip to content

Commit 2431937

Browse files
jclapisjclapis
committed
Merge branch 'add-ip-bind-to-signer' into rate-limit-jwt
2 parents ca0c6e8 + cf39d86 commit 2431937

16 files changed

Lines changed: 108 additions & 108 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -180,11 +180,12 @@ jobs:
180180

181181
- name: Extract binaries
182182
run: |
183-
mkdir -p ./artifacts/bin
183+
mkdir -p ./artifacts/bin/linux_amd64
184+
mkdir -p ./artifacts/bin/linux_arm64
184185
tar -xzf ./artifacts/commit-boost-pbs-${{ github.ref_name }}-linux_x86-64/commit-boost-pbs-${{ github.ref_name }}-linux_x86-64.tar.gz -C ./artifacts/bin
185-
mv ./artifacts/bin/commit-boost-pbs ./artifacts/bin/commit-boost-pbs-linux-amd64
186+
mv ./artifacts/bin/commit-boost-pbs ./artifacts/bin/linux_amd64/commit-boost-pbs
186187
tar -xzf ./artifacts/commit-boost-pbs-${{ github.ref_name }}-linux_arm64/commit-boost-pbs-${{ github.ref_name }}-linux_arm64.tar.gz -C ./artifacts/bin
187-
mv ./artifacts/bin/commit-boost-pbs ./artifacts/bin/commit-boost-pbs-linux-arm64
188+
mv ./artifacts/bin/commit-boost-pbs ./artifacts/bin/linux_arm64/commit-boost-pbs
188189
189190
- name: Set up QEMU
190191
uses: docker/setup-qemu-action@v3
@@ -232,11 +233,12 @@ jobs:
232233

233234
- name: Extract binaries
234235
run: |
235-
mkdir -p ./artifacts/bin
236+
mkdir -p ./artifacts/bin/linux_amd64
237+
mkdir -p ./artifacts/bin/linux_arm64
236238
tar -xzf ./artifacts/commit-boost-signer-${{ github.ref_name }}-linux_x86-64/commit-boost-signer-${{ github.ref_name }}-linux_x86-64.tar.gz -C ./artifacts/bin
237-
mv ./artifacts/bin/commit-boost-signer ./artifacts/bin/commit-boost-signer-linux-amd64
239+
mv ./artifacts/bin/commit-boost-signer ./artifacts/bin/linux_amd64/commit-boost-signer
238240
tar -xzf ./artifacts/commit-boost-signer-${{ github.ref_name }}-linux_arm64/commit-boost-signer-${{ github.ref_name }}-linux_arm64.tar.gz -C ./artifacts/bin
239-
mv ./artifacts/bin/commit-boost-signer ./artifacts/bin/commit-boost-signer-linux-arm64
241+
mv ./artifacts/bin/commit-boost-signer ./artifacts/bin/linux_arm64/commit-boost-signer
240242
241243
- name: Set up QEMU
242244
uses: docker/setup-qemu-action@v3

‎Cargo.lock‎

Lines changed: 11 additions & 11 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ resolver = "2"
55
[workspace.package]
66
edition = "2021"
77
rust-version = "1.83"
8-
version = "0.8.0-rc.1"
8+
version = "0.8.0-rc.2"
99

1010
[workspace.dependencies]
1111
aes = "0.8"
@@ -45,6 +45,7 @@ eyre = "0.6.12"
4545
futures = "0.3.30"
4646
headers = "0.4.0"
4747
indexmap = "2.2.6"
48+
jsonwebtoken = { version = "9.3.1", default-features = false }
4849
lazy_static = "1.5.0"
4950
parking_lot = "0.12.3"
5051
pbkdf2 = "0.12.2"
@@ -72,4 +73,3 @@ typenum = "1.17.0"
7273
unicode-normalization = "0.1.24"
7374
url = { version = "2.5.0", features = ["serde"] }
7475
uuid = { version = "1.8.0", features = ["fast-rng", "serde", "v4"] }
75-
jsonwebtoken = { version = "9.3.1", default-features = false }

‎config.example.toml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,13 @@ url = "http://0xa119589bb33ef52acbb8116832bec2b58fca590fe5c85eac5d3230b44d5bc09f
148148
# Docker image to use for the Signer module.
149149
# OPTIONAL, DEFAULT: ghcr.io/commit-boost/signer:latest
150150
# docker_image = "ghcr.io/commit-boost/signer:latest"
151+
# Host to bind the Signer API server to
152+
# OPTIONAL, DEFAULT: 127.0.0.1
153+
host = "127.0.0.1"
154+
# Port to listen for Signer API calls on
155+
# OPTIONAL, DEFAULT: 20000
156+
port = 20000
157+
151158
# For Remote signer:
152159
# [signer.remote]
153160
# URL of the Web3Signer instance

‎crates/cli/src/docker_init.rs‎

Lines changed: 12 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,16 @@ use std::{
66

77
use cb_common::{
88
config::{
9-
load_optional_env_var, CommitBoostConfig, LogsSettings, ModuleKind, SignerConfig,
10-
SignerType, BUILDER_PORT_ENV, BUILDER_URLS_ENV, CHAIN_SPEC_ENV, CONFIG_DEFAULT, CONFIG_ENV,
11-
DIRK_CA_CERT_DEFAULT, DIRK_CA_CERT_ENV, DIRK_CERT_DEFAULT, DIRK_CERT_ENV,
12-
DIRK_DIR_SECRETS_DEFAULT, DIRK_DIR_SECRETS_ENV, DIRK_KEY_DEFAULT, DIRK_KEY_ENV, JWTS_ENV,
13-
LOGS_DIR_DEFAULT, LOGS_DIR_ENV, METRICS_PORT_ENV, MODULE_ID_ENV, MODULE_JWT_ENV,
14-
PBS_ENDPOINT_ENV, PBS_MODULE_NAME, PROXY_DIR_DEFAULT, PROXY_DIR_ENV,
15-
PROXY_DIR_KEYS_DEFAULT, PROXY_DIR_KEYS_ENV, PROXY_DIR_SECRETS_DEFAULT,
16-
PROXY_DIR_SECRETS_ENV, SIGNER_DEFAULT, SIGNER_DIR_KEYS_DEFAULT, SIGNER_DIR_KEYS_ENV,
17-
SIGNER_DIR_SECRETS_DEFAULT, SIGNER_DIR_SECRETS_ENV, SIGNER_ENDPOINT_ENV,
18-
SIGNER_JWT_SECRET_ENV, SIGNER_KEYS_ENV, SIGNER_MODULE_NAME, SIGNER_URL_ENV,
9+
CommitBoostConfig, LogsSettings, ModuleKind, SignerConfig, SignerType, BUILDER_PORT_ENV,
10+
BUILDER_URLS_ENV, CHAIN_SPEC_ENV, CONFIG_DEFAULT, CONFIG_ENV, DIRK_CA_CERT_DEFAULT,
11+
DIRK_CA_CERT_ENV, DIRK_CERT_DEFAULT, DIRK_CERT_ENV, DIRK_DIR_SECRETS_DEFAULT,
12+
DIRK_DIR_SECRETS_ENV, DIRK_KEY_DEFAULT, DIRK_KEY_ENV, JWTS_ENV, LOGS_DIR_DEFAULT,
13+
LOGS_DIR_ENV, METRICS_PORT_ENV, MODULE_ID_ENV, MODULE_JWT_ENV, PBS_ENDPOINT_ENV,
14+
PBS_MODULE_NAME, PROXY_DIR_DEFAULT, PROXY_DIR_ENV, PROXY_DIR_KEYS_DEFAULT,
15+
PROXY_DIR_KEYS_ENV, PROXY_DIR_SECRETS_DEFAULT, PROXY_DIR_SECRETS_ENV, SIGNER_DEFAULT,
16+
SIGNER_DIR_KEYS_DEFAULT, SIGNER_DIR_KEYS_ENV, SIGNER_DIR_SECRETS_DEFAULT,
17+
SIGNER_DIR_SECRETS_ENV, SIGNER_ENDPOINT_ENV, SIGNER_KEYS_ENV, SIGNER_MODULE_NAME,
18+
SIGNER_URL_ENV,
1919
},
2020
pbs::{BUILDER_API_PATH, GET_STATUS_PATH},
2121
signer::{ProxyStore, SignerLoader, DEFAULT_SIGNER_PORT},
@@ -73,11 +73,7 @@ pub async fn handle_docker_init(config_path: PathBuf, output_dir: PathBuf) -> Re
7373
let mut targets = Vec::new();
7474

7575
// address for signer API communication
76-
let signer_port = if let Some(signer_config) = &cb_config.signer {
77-
signer_config.port
78-
} else {
79-
DEFAULT_SIGNER_PORT
80-
};
76+
let signer_port = cb_config.signer.as_ref().map(|s| s.port).unwrap_or(DEFAULT_SIGNER_PORT);
8177
let signer_server =
8278
if let Some(SignerConfig { inner: SignerType::Remote { url }, .. }) = &cb_config.signer {
8379
url.to_string()
@@ -105,8 +101,7 @@ pub async fn handle_docker_init(config_path: PathBuf, output_dir: PathBuf) -> Re
105101
ModuleKind::Commit => {
106102
let mut ports = vec![];
107103

108-
let jwt_secret = load_optional_env_var(SIGNER_JWT_SECRET_ENV)
109-
.unwrap_or_else(random_jwt_secret);
104+
let jwt_secret = random_jwt_secret();
110105
let jwt_name = format!("CB_JWT_{}", module.id.to_uppercase());
111106

112107
// module ids are assumed unique, so envs dont override each other

‎crates/common/src/config/constants.rs‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,6 @@ pub const SIGNER_JWT_AUTH_FAIL_TIMEOUT_SECONDS_ENV: &str =
4242

4343
/// Comma separated list module_id=jwt_secret
4444
pub const JWTS_ENV: &str = "CB_JWTS";
45-
/// The JWT secret for the signer to validate the modules requests
46-
pub const SIGNER_JWT_SECRET_ENV: &str = "CB_SIGNER_JWT_SECRET";
4745

4846
/// Path to json file with plaintext keys (testing only)
4947
pub const SIGNER_KEYS_ENV: &str = "CB_SIGNER_LOADER_FILE";

‎crates/common/src/config/mux.rs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,10 @@ async fn fetch_lido_registry_keys(
242242
let total_keys =
243243
registry.getTotalSigningKeyCount(node_operator_id).call().await?._0.try_into()?;
244244

245+
if total_keys == 0 {
246+
return Ok(Vec::new());
247+
}
248+
245249
debug!("fetching {total_keys} total keys");
246250

247251
const CALL_BATCH_SIZE: u64 = 250u64;

‎crates/common/src/config/signer.rs‎

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -146,26 +146,22 @@ impl StartSignerConfig {
146146

147147
let jwts = load_jwt_secrets()?;
148148

149-
// Load the server endpoint first from the env var, then the config, and finally
150-
// the defaults
149+
let signer_config = config.signer.ok_or_eyre("Signer config is missing")?;
150+
151+
// Load the server endpoint first from the env var if present, otherwise the
152+
// config
151153
let endpoint = if let Some(endpoint) = load_optional_env_var(SIGNER_ENDPOINT_ENV) {
152154
endpoint.parse()?
153155
} else {
154-
match config.signer {
155-
Some(ref signer) => SocketAddr::from((signer.host, signer.port)),
156-
None => SocketAddr::from((default_host(), DEFAULT_SIGNER_PORT)),
157-
}
156+
SocketAddr::from((signer_config.host, signer_config.port))
158157
};
159158

160159
// Load the JWT auth fail limit the same way
161160
let jwt_auth_fail_limit =
162161
if let Some(limit) = load_optional_env_var(SIGNER_JWT_AUTH_FAIL_LIMIT_ENV) {
163162
limit.parse()?
164163
} else {
165-
match config.signer {
166-
Some(ref signer) => signer.jwt_auth_fail_limit,
167-
None => DEFAULT_JWT_AUTH_FAIL_LIMIT,
168-
}
164+
signer_config.jwt_auth_fail_limit
169165
};
170166

171167
// Load the JWT auth fail timeout the same way
@@ -174,15 +170,10 @@ impl StartSignerConfig {
174170
{
175171
timeout.parse()?
176172
} else {
177-
match config.signer {
178-
Some(ref signer) => signer.jwt_auth_fail_timeout_seconds,
179-
None => DEFAULT_JWT_AUTH_FAIL_TIMEOUT_SECONDS,
180-
}
173+
signer_config.jwt_auth_fail_timeout_seconds
181174
};
182175

183-
let signer = config.signer.ok_or_eyre("Signer config is missing")?.inner;
184-
185-
match signer {
176+
match signer_config.inner {
186177
SignerType::Local { loader, store, .. } => Ok(StartSignerConfig {
187178
chain: config.chain,
188179
loader: Some(loader),

0 commit comments

Comments
 (0)