WikiDeck/wikideck
3
0
Fork 1
Code Issues 8 Pull Requests Actions Packages Projects 2 Releases Wiki Activity

Hardened systemd deployment contract for read-only Monero observer

Browse Source
This commit is contained in:
eric
2026-10-22 10:08:15 -04:00
parent 158981e965
commit e835238d05
12 changed files with 170 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/market/custody-db-args.ts
+11 -1
View File
@@ -1,5 +1,6 @@
export const CUSTODY_DB_ACTION_ARGUMENT_COUNTS = {
migrate: 0,
'migrate-mainnet-schema': 0,
'grant-runtime': 1,
'grant-monero-observer-runtime': 1,
'grant-monero-credit-runtime': 1,
@@ -19,11 +20,20 @@ export type CustodyDbAction = keyof typeof CUSTODY_DB_ACTION_ARGUMENT_COUNTS;
export type CustodyDbArguments = { action: CustodyDbAction; argument?: string; extraArgument?: string };
export function assertCustodyDbActionAllowedOnNetwork(action: CustodyDbAction, isMainnet: boolean): void {
if (isMainnet && action !== 'grant-monero-observer-runtime') {
if (action === 'migrate-mainnet-schema' && !isMainnet) {
throw new Error('Mainnet schema migration action requires the mainnet profile');
}
if (isMainnet && action !== 'grant-monero-observer-runtime' && action !== 'migrate-mainnet-schema') {
throw new Error('Only the separately scoped Monero observation-role grant is allowed on mainnet');
}
}
export function assertMainnetSchemaMigrationAcknowledged(action: CustodyDbAction, acknowledgement: string | undefined): void {
if (action === 'migrate-mainnet-schema' && acknowledgement !== 'explicit-schema-migration-only') {
throw new Error('Mainnet schema migration requires explicit schema-migration acknowledgement');
}
}
export function parseCustodyDbArguments(args: readonly string[]): CustodyDbArguments {
const [action, ...values] = args;
if (!action || !Object.hasOwn(CUSTODY_DB_ACTION_ARGUMENT_COUNTS, action)) {
server/market/postgres-config.ts
+1
View File
@@ -10,6 +10,7 @@ async function secretFile(path: string | undefined): Promise<string> {
if (!path) throw new Error('Custody PostgreSQL secret file is required');
const info = await lstat(path);
if (!info.isFile() || info.isSymbolicLink() || info.size > 16384 || info.size === 0) throw new Error('Invalid PostgreSQL secret file');
if (process.platform !== 'win32' && (info.mode & 0o077) !== 0) throw new Error('PostgreSQL secret file permissions are too broad');
return (await readFile(path, 'utf8')).trim();
}
/** No URL logging, no TLS options in a connection string overriding verified transport. */