mirror of
https://gitlab.com/pezkuwichain/pezkuwi-sdk.git
synced 2026-10-27 22:19:54 +00:00
Satoshi Qazi Muhammed
eb821b2ff5
Renewing the automation key's spending allowance always needs 3-of-5 multisig approval regardless, so having this bot hold one signer's (Noter's) private key on a VPS to auto-submit one of those three signatures was never actually saving a real step - the other two signers still had to sign manually every time. Once pwap-web shipped a real multisig operations UI (and now wallet-android's Bridge screen too), the bot's only remaining job is to detect a low allowance and notify all 5 signers via Telegram - they each sign with their own wallet through one of pwap-web, pezbridge-sign.pex.mom, or the wallet app directly. Noter's mnemonic was removed from the VPS entirely (shred -u) after this rewrite was deployed and verified. Also adds gen_automation_key.rs (one-off key generation helper) and the updated systemd unit with LoadCredential removed.
54 lines
1.8 KiB
Desktop File
54 lines
1.8 KiB
Desktop File
[Unit]
|
|
Description=PezbridgeBot - USDT bridge automation-key allowance renewal notifier (holds no key)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=pezbridgebot
|
|
Group=pezbridgebot
|
|
WorkingDirectory=/opt/pezbridgebot/data
|
|
ExecStart=/opt/pezbridgebot/bin/pezbridge-bot
|
|
Environment=PEZBRIDGE_CONFIG=/opt/pezbridgebot/bin/pezbridge_bot_config.json
|
|
Environment=RUST_LOG=info
|
|
EnvironmentFile=/etc/pezbridgebot/telegram_token.env
|
|
Restart=on-failure
|
|
RestartSec=10
|
|
|
|
# --- Hardening ---
|
|
# Deployed 2026-07-13 on NEW-10 (89.116.25.180), simplified 2026-07-14: this process used to
|
|
# also hold Noter's (Validator_04's) mnemonic via LoadCredential so it could automate 1-of-3
|
|
# required signatures. That stopped being worth the risk once pwap-web shipped a real signing
|
|
# UI (any of the 5 signers can now approve directly with their own wallet extension at
|
|
# /multisig/pending) - the bot-held key only ever saved "2 humans click instead of 3", not
|
|
# enough to justify a private key living on a server. Noter's mnemonic was removed from this
|
|
# host entirely; this unit now only reads chain state and sends Telegram messages - it has no
|
|
# LoadCredential, no signing capability, and nothing worth exfiltrating. The hardening below is
|
|
# kept anyway as good baseline practice, not because there's a key to protect anymore.
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictSUIDSGID=yes
|
|
RemoveIPC=yes
|
|
LockPersonality=yes
|
|
RestrictRealtime=yes
|
|
RestrictNamespaces=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallFilter=@system-service
|
|
SystemCallArchitectures=native
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
ReadWritePaths=/opt/pezbridgebot/data
|
|
UMask=0077
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|