tusk.yml

interpreter: bash -c
name: hoy-chains
usage: |
  automation for managing chains on the hoy cluster
options:
  launchdir:
    usage: >
      Don't set this option. Its a work around for a go-tusk peculiarity
    environment: PWD
  force:
    usage: force operation, deleting previous materials if necessary
    short: f
    type: bool
  bbake:
    default: 'tusk -qf /home/robin/polysensus/ops/benchblock/tusk.yml'

  tuskdir:
    private: true
    usage: "so all tasks can refer to the directory containing this tusk file"
    default:
      command: echo $(pwd)

  context:
    private: true
    default: "hoy-1"

  namespace-prefix:
    private: true # hide for now
    default: "chains-"


tasks:
  chainid:
    usage: "chainid from name"
    args:
      name:
    run:
      - command:
          exec: |
            set -e
            cat <<PYEND | python3
            lexicon = dict(a=0, j=0, s=0, b=1, k=1, t=1, c=2, l=2, u=2, d=3, m=3, v=3, e=4, n=4, w=4, f=6, o=6, x=6, g=7, p=7, y=7, h=8, q=8, z=8, i=9, r=9)
            print(''.join([str(lexicon[ch]) for ch in "${name}"]))
            PYEND

  new:
    usage: "create a new chain"
    options:
      namespace-prefix:
        default: "chains"
        short: "p"
      primary-domain:
        default: "polysensus.io"
      forwardauth-url:
        default: http://auth-traefikforward.hoy-iam-dev.svc.cluster.local:8401
      cluster-name:
        default: "hoy"
      numnodes:
        default: 9
        short: "n"
      profile:
        default: "configs/low-latency.yml"
      # XXX: TODO these need to go in a profile.json
      numcandidates:
        default: 2
      numendorsers:
        default: 5
      committeequorum:
        default: 3
      netrestrict:
        # default is the pod ip (cluster) range for the hoy-dev subnet-dev-1 subnet
        default: "10.2.16.0/20"

    args:
      name:
    run:
      - command:
          exec: |
            set -e
            DIR=$(cd ${launchdir} && cd ${dir} && pwd)

            CHAINID=$(tusk -qf ${tuskdir}/tusk.yml chainid ${name})

            echo "CHAINID: $CHAINID"
            [ -d chains/${name}-$CHAINID ] && ! ${force} && echo "chain dir chains/${name}-$CHAINID exists, refusing to create"

            DOMAIN_SYMBOL=$(echo "${primary-domain}" | tr '.' '-')
            CHAIN_FQDN="${cluster-name}.${primary-domain}"
            CHAIN_FQDN_SYMBOL=$(echo "$CHAIN_FQDN" | tr '.' '-')
            SECURE_TOKEN_SERVICE_FQDN="sts.${cluster-name}.${primary-domain}"
            NODE_PATH="/chains/${name}-$CHAINID/node"
            FORWARDAUTH_URL="${forwardauth-url}$NODE_PATH/exchange"
            NODE_NAMESPACE="${namespace-prefix}-${name}"

            FLUX_DESTDIR="fluxcd/${name}-$CHAINID"
            CHAINDIR="chains/${name}-$CHAINID"

            BOOTNODE0_IP=34.142.43.54
            BOOTNODE0_NODEPORT=31210
            BOOTNODE1_IP=34.142.43.54
            BOOTNODE1_NODEPORT=31213

            BBAKE="${bbake}"
            # Note there is something VERY wierd abot options / args processing
            # with tusk. The error 'task "xxx" requires exactly 2 args, got 1'
            # meanst that one of the options is causing a mis count. *either*
            # on needs a space replacing with an equals --foo bar -> --foo=bar
            # OR we need a --bar=foo to become --bar foo. netrestrict requires
            # a space. the rest all need =. this is clearly bad behaviour in
            # tusk
            ${BBAKE} new \
              --netrestrict ${netrestrict} \
              --init-only \
              --k8s \
              -p=${profile} \
              --chainid=$CHAINID \
              --networkid=$CHAINID \
              --node-namespace=$NODE_NAMESPACE \
              --maxnodes=${numnodes} \
              --numcandidates=${numcandidates} \
              --numendorsers=${numendorsers} \
              --committeequorum=${committeequorum} \
              --sealedsecrets-cert=https://${cluster-name}.${primary-domain}/_/sealed-secrets/v1/cert.pem \
              --apisec \
              --apisec-certname=wild-$CHAIN_FQDN_SYMBOL \
              --apisec-certissuer letsencrypt-prod-primary-dns \
              --apisec-ingresshost=$CHAIN_FQDN \
              --apisec-issuer=https://${SECURE_TOKEN_SERVICE_FQDN} \
              --apisec-nodepath=$NODE_PATH \
              --apisec-tokenex=$FORWARDAUTH_URL \
              --bootnode0-ip=$BOOTNODE0_IP \
              --bootnode0-nodeport=$BOOTNODE0_NODEPORT \
              --bootnode1-ip=$BOOTNODE1_IP \
              --bootnode1-nodeport=$BOOTNODE1_NODEPORT \
              --pyenv=$(pwd)/.local/pyenv \
                $CHAINDIR rrr

            ${BBAKE} rrr --init-only $CHAINDIR

  genesis:
    usage: "generate keys, alpha and genesis document for the initial node set"
    args:
      name:
    run:
      - command:
          exec: |
            set -e

            BBAKE="${bbake}"
            DIR=$(cd ${launchdir} && cd ${dir} && pwd)

            CHAINID=$(tusk -qf ${tuskdir}/tusk.yml chainid ${name})

            FLUX_DESTDIR="fluxcd/${name}-$CHAINID"
            CHAINDIR="chains/${name}-$CHAINID"

            for cmd in gethkeys gethstatic rrralpha rrrinit; do
              ${BBAKE} ${cmd} $CHAINDIR
              echo "Completed: $cmd"
            done

  hydrate:
    usage: |
      generate the node kubernetes manifests. this can update geth command line
      options for the nodes and tweak the consensus parameters (for as long as
      those are available on the cli).

      This command DOES NOT change keys or genesis
    args:
      name:
    run:
      - command:
          exec: |
            set -e

            BBAKE="${bbake}"
            DIR=$(cd ${launchdir} && cd ${dir} && pwd)

            CHAINID=$(tusk -qf ${tuskdir}/tusk.yml chainid ${name})

            FLUX_DESTDIR="fluxcd/${name}-$CHAINID"
            CHAINDIR="chains/${name}-$CHAINID"

            for cmd in clientcfg rrropts gethk8s; do
              ${BBAKE} ${cmd} $CHAINDIR
              echo "Completed: $cmd"
            done

  nodekey:
    usage: |
      get the node private key directly from the cluster
    options:
      node:
        short: "n"
        default: 0
    args:
      name:

    run:
      - command:
          exec: |
            set -e
            NAMESPACE=${namespace-prefix}${name}
            CONTEXT=${context}
            kubectl get secret --context ${CONTEXT} --namespace $NAMESPACE \
              ethnodekey-${node} -o json \
              | jq -r .data.key | base64 -d

  nodewallet:
    usage: |
      get the node wallet directly from the cluster, requries forgers & cast installed

    run:
      - command:
          exec: |
            set -e
            NAMESPACE=${namespace-prefix}${name}
            CONTEXT=${context}
            PRIVATE_KEY=$(kubectl get secret --context $CONTEXT --namespace $NAMESPACE \
              ethnodekey-0 -o json \
              | jq -r .data.key | base64 -d)

            cast wallet address --private-key $PRIVATE_KEY | cut -d ' ' -f2


  resetchanges:
    usage: |
      Undo local (and not committed) changes to the resources
    run:
      - command:
          exec: |
            set -e
            git checkout chains
            git clean -fdx


  reconcile:
    usage: |
      reconcile flux source & kustomization
    run:
      - command:
          exec: |
            set -e
            flux -n flux-system reconcile source git hoy-chains
            flux -n flux-system reconcile kustomization hoy-chains

  fluxseal:
    usage: |
      (re)generate bitnami sealed secrets and related kz manifests for use with gitops and flux

      This DOES NOT need to be run after running hydrate
    args:
      name:
    run:
      - command:
          exec: |
            set -e

            BBAKE="${bbake}"
            DIR=$(cd ${launchdir} && cd ${dir} && pwd)

            CHAINID=$(tusk -qf ${tuskdir}/tusk.yml chainid ${name})

            FLUX_DESTDIR="fluxcd/${name}-$CHAINID"
            CHAINDIR="chains/${name}-$CHAINID"

            ${BBAKE} gethsealedsecrets --destdir=$FLUX_DESTDIR $CHAINDIR

            # Now move the sensitive material to .local
            for i in $(seq 0 $((${numnodes} - 1))); do
              mkdir -p .local/$CHAINDIR/rrr/nodes/node$i
              mv -v $CHAINDIR/rrr/nodes/node$i/key .local/$CHAINDIR/rrr/nodes/node$i
            done

  suspend-cd:
    usage: suspend the automatic fluxcd kustomization reconciliation
    run:
      - command:
          exec: |
            flux suspend kustomization -n flux-system hoy-chains

  resume-cd:
    usage: resume the automatic fluxcd kustomization reconciliation
    run:
      - command:
          exec: |
            flux resume kustomization -n flux-system hoy-chains

  reset-chain:
    usage: |
      bring down the network and delete the persistentvolumeclaim's
    args:
      name:
    run:
      - task: suspend-cd
      - command:
          exec: |
            CHAIN_NAMESPACE=${namespace-prefix}${name}
            for name in $(kubectl get -n $CHAIN_NAMESPACE statefulset -l app.kubernetes.io/part-of=ethnet -o name); do
              kubectl delete -n $CHAIN_NAMESPACE $name
            done
            for name in $(kubectl get -n $CHAIN_NAMESPACE persistentvolumeclaim -l app.kubernetes.io/part-of=ethnet -o name); do
              kubectl delete -n $CHAIN_NAMESPACE $name
            done
      - task: resume-cd