mirror of
https://github.com/luxfi/node.git
synced 2026-07-27 03:39:39 +00:00
Hanzo AI
b8c12487e1
Blocking (would cause production incidents): - env var prefix: LUX_* → LUXD_* (27 vars). Viper reads only LUXD_*; LUX_* silently ignored → node would start with default config on every env. - admin API enabled + sybil disabled defaults: explicit LUXD_API_ADMIN_ENABLED=false and LUXD_SYBIL_PROTECTION_ENABLED=true in base ConfigMap. - bootstrap peer config absent in new overlays: added LUXD_BOOTSTRAP_IPS / LUXD_BOOTSTRAP_IDS keys to base ConfigMap; overlays/operator populate per-env. Defense-in-depth additions: - ServiceAccount `luxd` with automountServiceAccountToken: false (no API access). - PodDisruptionBudget maxUnavailable=1 (works at 5 → 100 validator scales). - NetworkPolicy: ingress 9631/TCP from any (P2P), 9630/TCP cluster-only (HTTP), 9090/TCP monitoring-namespace only (metrics). - podAntiAffinity preferredDuringScheduling by hostname — spread across nodes. - updateStrategy: OnDelete — operator drains one pod at a time. - podManagementPolicy: Parallel — validators start in any order. Swarm verdict was NO-GO until these fixes. Addresses red critical #1 (admin API), #2 (sybil), high #4 (gateway bypass via direct LB), medium #7 (no NetworkPolicy/RBAC), and scientist blockers on env prefix + bootstrap.
38 lines
865 B
YAML
38 lines
865 B
YAML
services:
|
|
luxd:
|
|
container_name: luxd
|
|
image: ghcr.io/luxfi/node:latest
|
|
restart: unless-stopped
|
|
ports:
|
|
- "9630:9630"
|
|
- "9631:9631"
|
|
volumes:
|
|
- luxd-data:/root/.luxd
|
|
environment:
|
|
LUXD_NETWORK_ID: "3"
|
|
LUXD_HTTP_HOST: "0.0.0.0"
|
|
LUXD_HTTP_PORT: "9630"
|
|
LUXD_STAKING_PORT: "9631"
|
|
LUXD_SYBIL_PROTECTION_ENABLED: "false"
|
|
LUXD_STAKING_ENABLED: "false"
|
|
LUXD_CONSENSUS_SAMPLE_SIZE: "1"
|
|
LUXD_CONSENSUS_QUORUM_SIZE: "1"
|
|
LUXD_LOG_LEVEL: "info"
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-sf", "http://localhost:9630/ext/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 5
|
|
start_period: 60s
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "4"
|
|
memory: 8G
|
|
reservations:
|
|
cpus: "2"
|
|
memory: 4G
|
|
|
|
volumes:
|
|
luxd-data:
|