WIP: Inomurko/vault integration

.github/workflows/deploy2aws-integration.yml

@@ -26,13 +26,12 @@ jobs:
       run: |
             cd ops_omgx
             ./cfn-devenv.sh stop --stack-name integration
-            ./cfn-devenv.sh restart --stack-name integration --service-name l1-proxy
-            ./cfn-devenv.sh restart --stack-name integration --service-name deployer
+            ./cfn-devenv.sh stop --stack-name integration-replica
 
     - name: Update All other services
       run: |
             cd ops_omgx
-            rm -rf cloudformation/deployer-rinkeby.yaml
+            rm -rf cloudformation/deployer-rinkeby.yaml cloudformation/dummy-transaction.yaml cloudformation/omgx-monitor.yaml
             ./cfn-devenv.sh update --stack-name integration --secret-name ${{ github.event.inputs.secretname }} --deploy-tag ${{ github.sha }}
-            cd cloudformation
-            aws cloudformation update-stack --stack-name integration-l1l2test --capabilities CAPABILITY_NAMED_IAM --template-body=file://04-l1-l2-test-scheduled-ecs-task.yaml --region us-east-1 --parameters ParameterKey=SecretName,ParameterValue=${{ github.event.inputs.secretname }}
+            ./cfn-devenv.sh restart --stack-name integration
+            ./cfn-devenv.sh restart --stack-name integration-replica

.github/workflows/omgx-publish-develop.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches:
       - 'develop'
-      - 'mm/dtl-deployer-combined'
+      - 'inomurko/vault-integration'
 
 jobs:
 
@@ -61,17 +61,16 @@ jobs:
         working-directory: ./ops
         run: |
            ./scripts/build-ci.sh
-
       - name: Rename and retag the optimism images
         working-directory: ./ops
         run: |
           for i in $(docker images --format "{{.Repository}}:{{.Tag}}" | grep omgx); do
-            docker image tag "$i" omgx/$(echo $i | awk -F'/' '{print $2}' | awk -F':' '{print $1}'):latest
+            docker image tag "$i" omgx/$(echo $i | awk -F'/' '{print $2}' | awk -F':' '{print $1}'):${{ github.sha }}
           done
 
           for i in $(docker images --format "{{.Repository}}:{{.Tag}}" | grep ethereumoptimism); do
-            docker image tag "$i" omgx/$(echo $i | awk -F'/' '{print $2}' | awk -F':' '{print $1}'):latest
-            docker image tag "$i" omgx/$(echo $i | awk -F'/' '{print $2}' | awk -F':' '{print $1}'):latest
+            docker image tag "$i" omgx/$(echo $i | awk -F'/' '{print $2}' | awk -F':' '{print $1}'):${{ github.sha }}
+            docker image tag "$i" omgx/$(echo $i | awk -F'/' '{print $2}' | awk -F':' '{print $1}'):${{ github.sha }}
           done
           docker images
 
@@ -104,3 +103,28 @@ jobs:
           github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
           label: ${{ needs.start-runner.outputs.label }}
           ec2-instance-id: ${{ needs.start-runner.outputs.ec2-instance-id }}
+
+  push2aws:
+    needs: stop-runner
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Configure AWS credentials
+      uses: aws-actions/configure-aws-credentials@v1
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        aws-region: us-east-1
+
+    - name: Login to Docker Hub
+      uses: docker/login-action@v1
+      with:
+        username: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_SECRET }}
+
+    - name: Build and push docker images to AWS
+      run: |
+            cd ops_omgx
+            rm -rf cloudformation/deployer-rinkeby.yaml cloudformation/dummy-transaction.yaml cloudformation/omgx-monitor.yaml cloudformation/blockexplorer-blockscout.yaml cloudformation/transaction-monitor.yaml
+            ./cfn-devenv.sh push2aws --from-tag ${{ github.sha }} --deploy-tag ${{ github.sha }}

.github/workflows/vault.yml

@@ -0,0 +1,110 @@
+name: Vault tests
+
+
+on:
+  push:
+    paths:
+      - 'packages/omgx/immutability/**'
+    branches:
+      - 'master'
+      - 'develop'
+      - '*rc'
+      - 'regenesis/*'
+  pull_request:
+    paths:
+      - 'packages/omgx/immutability/**'
+    branches:
+      - 'master'
+      - 'develop'
+      - '*rc'
+      - 'regenesis/*'
+  workflow_dispatch:
+
+defaults:
+  run:
+    working-directory: ./ops
+
+jobs:
+  start-runner:
+    name: Start self-hosted EC2 runner
+    runs-on: ubuntu-latest
+    outputs:
+      label: ${{ steps.start-ec2-runner.outputs.label }}
+      ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id }}
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+      - name: Start EC2 runner
+        id: start-ec2-runner
+        uses: machulav/ec2-github-runner@v2
+        with:
+          mode: start
+          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+          ec2-image-id: ami-00b46fa1102c70ff2
+          ec2-instance-type: t2.xlarge
+          subnet-id: subnet-905870ae
+          security-group-id: sg-0855631d714870b32
+
+  vault_tests:
+    needs: start-runner
+    runs-on: ${{ needs.start-runner.outputs.label }}
+    env:
+      DATA_DIR: "vault/data/immutability/config"
+    steps:
+    - uses: actions/checkout@v2
+    - name: Run vault and execute tests
+      working-directory: ./ops
+      run: |
+        mkdir -p $DATA_DIR
+        sudo chown -R 100:1000 $DATA_DIR && sudo chmod -R 777 $DATA_DIR
+        RUN_TEST=true TEST=true docker-compose -f docker-compose.yml -f ../packages/omgx/immutability/docker/docker-compose-vault-test.yml up -d --build builder l1_chain deployer vault
+
+    - name: Building logs
+      working-directory: ./ops
+      run: |
+        sleep 60s
+        docker-compose -f docker-compose.yml -f ../packages/omgx/immutability/docker/docker-compose-vault-test.yml logs
+
+    - name: Wait for Vault
+      working-directory: ./ops
+      run: |
+        while [ $(docker-compose -f docker-compose.yml -f ../packages/omgx/immutability/docker/docker-compose-vault-test.yml logs | grep -c "Done with tests.") -ne 1 ];
+        do
+            sleep 1
+            echo "Waiting for Vault..."
+        done
+        echo "Vault has executed tests"
+        docker-compose -f docker-compose.yml -f ../packages/omgx/immutability/docker/docker-compose-vault-test.yml logs
+
+    - name: Test validation
+      working-directory: ./ops
+      run: exit $(docker-compose -f docker-compose.yml -f ../packages/omgx/immutability/docker/docker-compose-vault-test.yml logs | grep -c "DID NOT PASS THE REQUIRED TEST")
+
+    - name: Build the services
+      working-directory: ./ops
+      run: ./scripts/build-ci.sh
+
+    - name: Bring the stack up
+      working-directory: ./ops
+      run: |
+        docker-compose -f docker-compose.yml -f ../packages/omgx/immutability/docker/docker-compose-vault-test.yml down
+        rm -rf vault/
+        docker-compose -f docker-compose.yml -f ../packages/omgx/immutability/docker/docker-compose-vault-test.yml up -d
+
+    - name: Wait for the Sequencer node
+      working-directory: ./ops
+      run: ./scripts/wait-for-sequencer.sh
+
+    - name: Start background logging
+      working-directory: ./ops
+      run: docker-compose -f docker-compose.yml logs --follow &
+
+    - name: Run the integration tests
+      working-directory: ./ops
+      run: docker-compose run integration_tests
+
+

.gitignore

@@ -42,6 +42,9 @@ env-mainnet.yml
 
 .serverless
 
+ops/vault/data
+append-sequencer-batch.hcl
+append-state-batch-proposer.hcl
 # subgraph
 build
 generated

ops/docker-compose-nobuild.yml

@@ -209,3 +209,18 @@ services:
     environment:
       GAS_PRICE_ORACLE_ETHEREUM_HTTP_URL: http://l2geth:8545
       GAS_PRICE_ORACLE_PRIVATE_KEY: "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80"
+
+  vault:
+    image: omgx/vault
+    deploy:
+       replicas: 0
+    ports:
+      - "127.0.0.1:8200:8200"
+    volumes:
+      - "/tmp/vault_auth:/vault/config:rw"
+    entrypoint:
+      - "/bin/sh"
+      - -ec
+      - |
+        sleep 2
+        /vault/vault.sh

ops/docker-compose.yml

@@ -339,52 +339,6 @@ services:
       L2_CHAINID: 31338 #unfortunately, elsewhere the L2_CHAINID is called CHAIN_ID
       << : *integration_pk
 
-  # good idea, but never actually used?
-  # # and, tests for all the OMGX-specific services
-  # omgx_test_contracts:
-  #   image: omgx/builder
-  #   deploy:
-  #     replicas: 0
-  #   build:
-  #     context: ..
-  #     dockerfile: ./ops/docker/Dockerfile.monorepo
-  #   entrypoint:
-  #     - "/bin/sh"
-  #     - -ecx
-  #     - |
-  #       cd /optimism/packages/omgx/contracts
-  #       yarn test:integration
-  #   environment:
-  #     L1_NODE_WEB3_URL: http://l1_chain:8545
-  #     L2_NODE_WEB3_URL: http://l2geth:8545
-  #     URL: http://deployer:8081/addresses.json
-  #     OMGX_URL: http://omgx_deployer:8079/addresses.json
-  #     TEST_PRIVATE_KEY_1: "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80"
-  #     TEST_PRIVATE_KEY_2: "0x8b3a350cf5c34c9194ca85829a2df0ec3153be0318b5e2d3348e872092edffba"
-  #     TEST_PRIVATE_KEY_3: "0x92db14e403b83dfe3df233f83dfa3a0d7096f21ca9b0d6d6b8d88b2b4ec1564e"
-
-  # omgx_test_relayer:
-  #   image: omgx/builder
-  #   deploy:
-  #     replicas: 0
-  #   build:
-  #     context: ..
-  #     dockerfile: ./ops/docker/Dockerfile.monorepo
-  #   entrypoint:
-  #     - "/bin/sh"
-  #     - -ecx
-  #     - |
-  #       cd /optimism/packages/omgx/message-relayer-fast
-  #       yarn test:integration
-  #   environment:
-  #     L1_NODE_WEB3_URL: http://l1_chain:8545
-  #     L2_NODE_WEB3_URL: http://l2geth:8545
-  #     URL: http://deployer:8081/addresses.json
-  #     OMGX_URL: http://omgx_deployer:8079/addresses.json
-  #     TEST_PRIVATE_KEY_1: "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80"
-  #     TEST_PRIVATE_KEY_2: "0x8b3a350cf5c34c9194ca85829a2df0ec3153be0318b5e2d3348e872092edffba"
-  #     TEST_PRIVATE_KEY_3: "0x92db14e403b83dfe3df233f83dfa3a0d7096f21ca9b0d6d6b8d88b2b4ec1564e"
-
   # gas price system
   gas_oracle:
     depends_on:

packages/omgx/immutability/Dockerfile → ops/docker/Dockerfile.omgx_vault

@@ -10,14 +10,17 @@ RUN apk update && apk add git openssh gcc musl-dev linux-headers
 
 WORKDIR /app
 
-COPY go.mod .
-COPY go.sum .
+COPY packages/omgx/immutability/go.mod .
+COPY packages/omgx/immutability/go.sum .
+COPY packages/omgx/immutability/config/vault.hcl .
 
 # Get deps - will also be cached if we won't change mod/sum
 RUN go version
 RUN go mod download
 
-COPY  / .
+COPY ./ops/scripts/vault.sh .
+
+COPY packages/omgx/immutability/ .
 RUN mkdir -p /app/bin \
     && CGO_ENABLED=1 GOOS=linux go build -a -i -o /app/bin/immutability-eth-plugin . \
     && sha256sum -b /app/bin/immutability-eth-plugin > /app/bin/SHA256SUMS
@@ -29,7 +32,7 @@ FROM vault:latest
 # we pass epoch time so it always upgrades
 ARG always_upgrade
 RUN echo ${always_upgrade} > /dev/null && apk update && apk upgrade
-RUN apk add bash openssl jq
+RUN apk add bash openssl jq curl
 USER vault
 WORKDIR /vault
 RUN mkdir -p /vault/ca \
@@ -39,4 +42,8 @@ RUN mkdir -p /vault/ca \
 # Install the plugin.
 COPY --from=build /app/bin/immutability-eth-plugin /vault/plugins/immutability-eth-plugin
 COPY --from=build /app/bin/SHA256SUMS /vault/plugins/SHA256SUMS
+COPY --from=build /app/vault.sh /vault/vault.sh
+COPY --from=build /app/vault.hcl /vault/config/
+COPY --from=build /app/vault.hcl /vault/vault.hcl
+COPY ./ops/scripts/provision_vault.sh .
 HEALTHCHECK CMD nc -zv 127.0.0.1 8900 || exit 1