Node 8.9.0, mithril and topo enhancements

[johnalotoski]

Overview:

• Updates cardano node and cli pre-release (-ng) to 8.9.0 and enables new bootstrapPeers features and compatibility in the topology functions
• Bumps mithril and enhances mithril usability with IOG trusted pool signature verification for clients, mithril verifier service for signers, mithril capability for process-compose and node entrypoint jobs
• Miscellaneous other small improvements, bug fixes and tuning

Details:

• Cardano node and cli -ng variants have been bumped to node tag 8.9.0

• Mithril release and pre-release versions has been bumped to 2408-0

• Adds cardano-node-service-ng for a pre-release variant of the cardano-node nixos service

• Adds a nixosModule profile for cardano-db-sync snapshots:

  # Options are part of: profile-cardano-db-sync-snapshots.nix
  config.services.cardano-db-sync-snapshots.bucket
  config.services.cardano-db-sync-snapshots.blockDiffTolerance
  config.services.cardano-db-sync-snapshots.environmentFile
  config.services.cardano-db-sync-snapshots.group
  config.services.cardano-db-sync-snapshots.prefix
  config.services.cardano-db-sync-snapshots.user
  config.services.cardano-db-sync-snapshots.useSopsSecrets

• Adds a mithril-client snapshot verification option, which requires trusted IOG pool signatures to use mithril state (verifySnapshotSignature default is true):

  # Options are part of profile-cardano-node-group.nix
  config.services.mithril-client.verifyingPools
  config.services.mithril-client.verifySnapshotSignature

• Adds a mithril-signer-verifier service to block producers signing mithril certificates to alert if no recent mithril certificates have been signed

  # Options are part of role-block-producer.nix
  config.services.mithril-signer.useSignerVerifier

• Adds additional fixes and tuning

• Enhances the cardano node topology profile to support easy passing of new topology attributes for bootstrapPeer compatibility, such as trustable localRoots in some options, such as:

  # Options are part of profile-cardano-node-topology.nix
  config.services.cardano-node-topology.extraCfgInfix
  config.services.cardano-node-topology.extraCfgSimple
  config.services.cardano-node-topology.extraCfgSimpleMax
  config.services.cardano-node-topology.extraNodeListProducers
  config.services.cardano-node-topology.extraNodeListPublicProducers
  config.services.cardano-node-topology.extraProducers
  config.services.cardano-node-topology.extraPublicProducers

• Mithril bootstrap capability has been added to process-compose and node entrypoint jobs in addition to nixosConfigurations. Default mithril behavior can be modified by environment variables as needed:

  # Process Compose (example: nix run .#run-process-compose-node-stack):
    # MITHRIL_DISABLE
    # MITHRIL_DISABLE_${env}
    # MITHRIL_SNAPSHOT_DIGEST_${env}
    # MITHRIL_VERIFY_SNAPSHOT_${env}
    # MITHRIL_VERIFYING_POOLS_${env}

  # Entrypoint (example: nix run .#run-cardano-node):
    # UNSTABLE_MITHRIL
    # MITHRIL_SNAPSHOT_DIGEST
    # MITHRIL_VERIFY_SNAPSHOT
    # MITHRIL_VERIFYING_POOLS

• Updates conway era related governance jobs
• Justfile start-node and stop-node recipe now supports mainnet
• Template blockfetch delay alerts were added
• Template dbsync alerts generating no data due to high time resolution were fixed
• Process compose dbsync stack jobs for mainnet, preprod, preview use sancho-4-0-0 tagged dbsync for node 8.9.0 compatibility