Observer integration step

2026-10-23 10:20:58 -04:00
parent bd3d36a7e1
commit 216a419c0b
7 changed files with 161 additions and 45 deletions
@@ -129,9 +129,76 @@ services:
    pids_limit: 32
    mem_limit: 128m
    restart: "no"
+  pilot-observer:
+    image: wikideck:private-pilot
+    profiles: ["pilot-observer"]
+    build:
+      context: .
+      target: runtime
+      args:
+        WIKIDECK_NETWORK: pilot
+    entrypoint: [node, --experimental-strip-types, scripts/pilot-monero-observe-once.ts]
+    environment:
+      WIKIDECK_NETWORK: pilot
+      WIKIDECK_PILOT_MODE: private-mock-only
+      WIKIDECK_PILOT_CUSTODY_OPERATIONS: pilot-observation-only-no-credit
+      WIKIDECK_PILOT_CUSTODIAN_ID: "${WIKIDECK_PILOT_CUSTODIAN_ID:-}"
+      WIKIDECK_MONERO_WALLET_GENERATION_ID: "${WIKIDECK_MONERO_WALLET_GENERATION_ID:-}"
+      WIKIDECK_MONERO_WALLET_FINGERPRINT: "${WIKIDECK_MONERO_WALLET_FINGERPRINT:-}"
+      WIKIDECK_PILOT_OBSERVER_PG_URL_FILE: /run/secrets/pilot-observer-db-url
+      WIKIDECK_PILOT_OBSERVER_PG_CA_FILE: /run/secrets/pilot-observer-db-ca.crt
+      WIKIDECK_MONERO_WALLET_RPC_CONFIG_FILE: /run/monero/wallet-rpc.json
+      WIKIDECK_MONERO_MTLS_CONFIG_FILE: /run/monero/mtls.json
+      WIKIDECK_PILOT_OBSERVER_MAX_BLOCKS: "${WIKIDECK_PILOT_OBSERVER_MAX_BLOCKS:-5000}"
+      WIKIDECK_PILOT_OBSERVER_OVERLAP: "${WIKIDECK_PILOT_OBSERVER_OVERLAP:-100}"
+    volumes:
+      - type: bind
+        source: "${WIKIDECK_PILOT_OBSERVER_PG_URL_HOST:-./private/monero-pilot/observer-db-url}"
+        target: /run/secrets/pilot-observer-db-url
+        read_only: true
+        bind: {create_host_path: false}
+      - type: bind
+        source: "${WIKIDECK_PILOT_OBSERVER_PG_CA_HOST:-./private/monero-pilot/observer-db-ca.crt}"
+        target: /run/secrets/pilot-observer-db-ca.crt
+        read_only: true
+        bind: {create_host_path: false}
+      - type: bind
+        source: "${WIKIDECK_PILOT_OBSERVER_WALLET_CONFIG_HOST:-./private/monero-pilot/wallet-rpc.json}"
+        target: /run/monero/wallet-rpc.json
+        read_only: true
+        bind: {create_host_path: false}
+      - type: bind
+        source: "${WIKIDECK_PILOT_OBSERVER_MTLS_CONFIG_HOST:-./private/monero-pilot/mtls.json}"
+        target: /run/monero/mtls.json
+        read_only: true
+        bind: {create_host_path: false}
+      - type: bind
+        source: "${WIKIDECK_PILOT_OBSERVER_CLIENT_CERT_HOST:-./private/monero-pilot/observer-client.crt}"
+        target: /run/secrets/observer-client.crt
+        read_only: true
+        bind: {create_host_path: false}
+      - type: bind
+        source: "${WIKIDECK_PILOT_OBSERVER_CLIENT_KEY_HOST:-./private/monero-pilot/observer-client.key}"
+        target: /run/secrets/observer-client.key
+        read_only: true
+        bind: {create_host_path: false}
+      - type: bind
+        source: "${WIKIDECK_PILOT_OBSERVER_GATEWAY_CA_HOST:-./private/monero-pilot/gateway-ca.crt}"
+        target: /run/secrets/observer-gateway-ca.crt
+        read_only: true
+        bind: {create_host_path: false}
+    networks: [observer-egress]
+    read_only: true
+    tmpfs: ["/tmp:mode=1777,size=16m,noexec,nosuid"]
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    pids_limit: 32
+    mem_limit: 256m
+    restart: "no"
 networks:
  financial: {internal: true}
  web: {}
+  observer-egress: {}
 volumes:
  pg-data:
  pg-admin: