mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-07-26 21:15:40 +00:00
pezkuwichain
80d273ff11
Closes the "backend has zero CI + manual SSH deploy" audit finding for the indexer. Part B — CI-runnable tests (the integration-tests/*.live.test.js need a live chain and are excluded, not stubbed): extract injectable cores (indexer.js: DB+HTTP+decode, no @pezkuwi import; council.js: createApp factory for the council/KYC routes). New node:test suite (19/19, fully offline) — in-memory sqlite, dependency-injected chain stub, an in-memory fake-supabase, and REAL @pezkuwi keyring signatures proving 401 bad-sig / 400 msg-mismatch / 200 valid / 409 dup / 403 non-member / threshold auto-execute. Backend job now runs npm ci + npm test and is in ci-gate (failing tests block merge). Fixed a latent bug: block indexing now awaits each insert (was fire-and-forget forEach). Added runtime deps server.js imported but were missing from package.json (@supabase/supabase-js, pino, pino-http) — server.js could not have `npm ci`-run before. Part C — Dockerfile (non-root, HEALTHCHECK /health, sqlite state on a /data VOLUME kept out of the image) + backend deploy pipeline mirroring the web one: build+push to GHCR, cosign keyless sign + verify, ssh deploy with the DB volume preserved across deploys, /health poll, auto-rollback to previous SHA, same Telegram CEO approval gate, main/tags only, never fork PRs. New secrets documented in backend/DEPLOY.md (BACKEND_VPS_HOST/USER/ SSH_KEY). DB_PATH env (default ./transactions.db) lets prod point at the volume. Note for owner: if server.js (council/KYC bootstrap) is legacy/unused, its newly-added deps can be dropped instead.
23 lines
963 B
Bash
23 lines
963 B
Bash
# ── Indexer service (src/index.js) ──────────────────────────────
|
|
# PezkuwiChain WebSocket endpoint
|
|
WS_ENDPOINT=wss://rpc.pezkuwichain.io
|
|
|
|
# Server port
|
|
PORT=3001
|
|
|
|
# Stateful sqlite DB path. In Docker this is set to /data/transactions.db
|
|
# (a mounted volume). Locally it defaults to ./transactions.db.
|
|
# DB_PATH=/data/transactions.db
|
|
|
|
# ── KYC / council service (src/server.js) ───────────────────────
|
|
# Supabase project (required by server.js — it exits if missing)
|
|
SUPABASE_URL=your_supabase_url_here
|
|
SUPABASE_ANON_KEY=your_supabase_anon_key_here
|
|
|
|
# Founder SS58 address — authorizes /api/council/add-member (signature-gated)
|
|
FOUNDER_ADDRESS=your_founder_ss58_address_here
|
|
|
|
# Sudo account seed — signs approveKyc when the vote threshold is reached.
|
|
# Keep secret; use a dedicated key for KYC approvals only.
|
|
SUDO_SEED=your_seed_phrase_here
|