Resources for marlowe: db(-sync), creds, nodes

input-output-hk · Nov 30, 2022 · dcc4736 · dcc4736
1 parent 37ebf44
commit dcc4736
Show file tree

Hide file tree

Showing 15 changed files with 19,871 additions and 3,870 deletions.
diff --git a/flake.lock b/flake.lock
diff --git a/flake.nix b/flake.nix
@@ -6,9 +6,7 @@
     data-merge.follows = "std/dmerge";
     # --- Bitte Stack ----------------------------------------------
     bitte.url = "github:input-output-hk/bitte";
-    # bitte.url = "path:/home/jlotoski/work/iohk/bitte-wt/bitte";
     bitte-cells.url = "github:input-output-hk/bitte-cells";
-    # bitte-cells.url = "path:/home/jlotoski/work/iohk/bitte-cells-wt/bitte-cells";
     # --------------------------------------------------------------
     # --- Auxiliary Nixpkgs ----------------------------------------
     # nixpkgs.follows = "bitte/nixpkgs";
@@ -22,7 +20,7 @@
     };
     nix-inclusive.url = "github:input-output-hk/nix-inclusive";
     # --------------------------------------------------------------
-    nixpkgs-vector.url = "github:NixOS/nixpkgs/30d3d79b7d3607d56546dd2a6b49e156ba0ec634";
+    cardano-world.url = "github:input-output-hk/cardano-world";
     tullia.url = "github:input-output-hk/tullia";
   };
 
@@ -47,6 +45,7 @@
         (functions "library")
         (installables "packages")
         (functions "hydrationProfile")
+        (functions "hydrationProfiles")
         (runnables "jobs")
         (devshells "devshells")
 
@@ -72,8 +71,7 @@
         }
     )
     {
-      patroni = bitte.lib.mkNomadJobs "patroni" nomadEnvs;
-      tempo = bitte.lib.mkNomadJobs "tempo" nomadEnvs;
+      infra = bitte.lib.mkNomadJobs "infra" nomadEnvs;
     }
     (inputs.tullia.fromStd {
       actions = inputs.std.harvest inputs.self ["cloud" "actions"];

diff --git a/nix/cloud/constants.nix b/nix/cloud/constants.nix
@@ -2,30 +2,24 @@
   inputs,
   cell,
 }: let
+in rec {
   # Metadata
   # -----------------------------------------------------------------------
   baseDomain = "dapps.aws.iohkdev.io";
-in rec {
+
   # App Component Import Parameterization
   # -----------------------------------------------------------------------
-  args = {
-    patroni = {
-      namespace = "patroni";
-      domain = "${baseDomain}";
-      nodeClass = "patroni";
-      datacenters = ["eu-central-1"];
-    };
-
-    tempo = {
-      namespace = "tempo";
+  namespaces = {
+    infra = {
+      namespace = "infra";
       domain = "${baseDomain}";
-      nodeClass = "tempo";
-      datacenters = ["eu-central-1"];
+      nodeClass = "infra";
+      datacenters = ["us-east-1" "eu-central-1"];
     };
   };
 
   patroni = let
-    inherit (args.patroni) namespace;
+    inherit (namespaces.infra) namespace;
   in rec {
     # App constants
     WALG_S3_PREFIX = "s3://iohk-dapps-world/backups/${namespace}/walg";
@@ -37,7 +31,7 @@ in rec {
   };
 
   tempo = let
-    inherit (args.tempo) namespace;
+    inherit (namespaces.tempo) namespace;
   in rec {
     # Job mod constants
     tempoMods.scaling = 1;

diff --git a/nix/cloud/hydrationProfile.nix b/nix/cloud/hydrationProfile.nix
@@ -2,19 +2,25 @@
   inputs,
   cell,
 }: let
-  inherit (inputs) bitte-cells;
+  inherit (inputs) bitte-cells cardano-world cells;
+  inherit (cells) marlowe;
+  inherit (cardano-world) cardano;
 in {
   # Bitte Hydrate Module
   # -----------------------------------------------------------------------
 
   default = {
     lib,
     bittelib,
+    config,
     ...
   }: {
     imports = [
-      (bitte-cells.patroni.hydrationProfiles.hydrate-cluster ["patroni"])
-      (bitte-cells.tempo.hydrationProfiles.hydrate-cluster ["tempo"])
+      (bitte-cells.patroni.hydrationProfiles.hydrate-cluster ["infra"])
+      (bitte-cells.tempo.hydrationProfiles.hydrate-cluster ["infra"])
+      cardano.hydrationProfiles.workload-policies-cardano
+      cardano.hydrationProfiles.workload-policies-db-sync
+      marlowe.hydrationProfiles.workload-policies-marlowe-runtime
     ];
 
     # NixOS-level hydration
@@ -25,8 +31,7 @@ in {
 
       adminNames = ["parthiv.seetharaman"];
       # adminGithubTeamNames = lib.mkForce [ "non-existent-team" ];
-      developerGithubNames = ["shlevy"];
-      developerGithubTeamNames = [];
+      developerGithubTeamNames = ["marlowe" "plutus-core" "plutus-tools"];
       domain = "dapps.aws.iohkdev.io";
       kms = "arn:aws:kms:us-east-1:677160962006:key/e8ccc1e3-c590-42f9-bda3-f7a55dcd787c";
       s3Bucket = "iohk-dapps-world";
@@ -35,8 +40,8 @@ in {
 
     services = {
       nomad.namespaces = {
-        patroni = {description = "patroni";};
-        tempo = {description = "tempo";};
+        infra = {description = "Common services";};
+        marlowe = {description = "marlowe services";};
       };
     };
 
@@ -75,12 +80,14 @@ in {
           };
         };
 
-        consul.developer = {
-          service_prefix."*" = {
-            policy = "write";
-          };
-          key_prefix."test" = {
-            policy = "write";
+        consul = {
+          developer = {
+            service_prefix."*" = {
+              policy = "write";
+            };
+            key_prefix."test" = {
+              policy = "write";
+            };
           };
         };
 
@@ -119,7 +126,7 @@ in {
             quota.policy = "read";
             node.policy = "read";
             host_volume."*".policy = "write";
-            namespace."test" = {
+            namespace."marlowe" = {
               policy = "write";
               capabilities = [
                 "submit-job"
@@ -208,8 +215,6 @@ in {
     };
 
     # application state (terraform)
-    # --------------
-    /*
     tf.hydrate-app.configuration = let
       vault' = {
         dir = ./. + "/kv/vault";
@@ -228,6 +233,5 @@ in {
         # inherit (consul) consul_keys;
       };
     };
-    */
   };
 }
diff --git a/nix/cloud/kv/vault/.sops.yaml b/nix/cloud/kv/vault/.sops.yaml
@@ -1,3 +1,7 @@
 creation_rules:
   - path_regex: patroni/*
     hc_vault_transit_uri: "https://vault.dapps.aws.iohkdev.io/v1/sops/keys/ops"
+  - path_regex: db-sync/*
+    hc_vault_transit_uri: "https://vault.dapps.aws.iohkdev.io/v1/sops/keys/ops"
+  - path_regex: chainseek/*
+    hc_vault_transit_uri: "https://vault.dapps.aws.iohkdev.io/v1/sops/keys/ops"
diff --git a/nix/cloud/kv/vault/chainseek/mainnet.enc.yaml b/nix/cloud/kv/vault/chainseek/mainnet.enc.yaml
@@ -0,0 +1,18 @@
+pgUser: ENC[AES256_GCM,data:XqzCRCHAphT0r+/5NbWOqg8=,iv:nt/AbcZ83eSMlCj0wQJ9AB/TTqmG7FmzK/dDYXK3iKg=,tag:vN+UMiAA85UMw/7kv7IhqQ==,type:str]
+pgPass: ENC[AES256_GCM,data:+0YsvKQZ8kHn3fap4LXpbrjzHXynDJ/zdks6OB7lceo=,iv:xM27ii0+5kLaPZpijesbfMfG092WISYMatWemSdD9tQ=,tag:ovE0RwlwQysdPzS3RdsH5w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault:
+        - vault_address: https://vault.dapps.aws.iohkdev.io
+          engine_path: sops
+          key_name: ops
+          created_at: "2022-11-19T00:44:43Z"
+          enc: vault:v1:z+T7ucMhfpjGNtGA71YKL6L/rDlFEsuKFIHfvdR/fPl9Pe++Mlnz4yrXhaW19p9h0zwPkb/na5Y0XCOq
+    age: []
+    lastmodified: "2022-11-19T00:44:43Z"
+    mac: ENC[AES256_GCM,data:3sCF+vWzJixwp0mjvZEfJ3nkevBzuKE/kH53EecnrNcmuuqSn4HtzalYsoGbFisFhRFSMoj7nZmSCJJaXq2W9dDIP3EA3h9wby2UMjgW7hJw5HftJO9VXw2lLzcWsfb6VTv6zhD8TMuG7NWVrooba5FWCyp2/LCwwUxO1CK2Zyk=,iv:1v90cheCpo8C7r39tKKuTXpsjy8uEgJVXozMsVl6zqI=,tag:uC4JEFREYkU6zksUYKF6Yw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
diff --git a/nix/cloud/kv/vault/chainseek/preprod.enc.yaml b/nix/cloud/kv/vault/chainseek/preprod.enc.yaml
@@ -0,0 +1,18 @@
+pgUser: ENC[AES256_GCM,data:QZRjs22Zf5v4HzQ5DHFnN1Q=,iv:ySo+5jd8KTjjj/eghNwbIdv8JwqJ2fToRAhqexHf7YU=,tag:7TI0TKJHUJSnSLNaxdfJxg==,type:str]
+pgPass: ENC[AES256_GCM,data:TzyQ7MCQKIPvz7sXDt+eo67aRm1EF7XsnIjfPE2u6P8=,iv:BcBWM1eSUbZ4aU5tWM0eUhGhGNTnp51a8yYXAQqkHZM=,tag:/huowrnSYJ1aN5FUcSgZIw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault:
+        - vault_address: https://vault.dapps.aws.iohkdev.io
+          engine_path: sops
+          key_name: ops
+          created_at: "2022-11-19T00:44:53Z"
+          enc: vault:v1:G99Cf/BkmociUpl9Yn/Ee2AG5vb1VyE/i0qkqiYPiWy2BaqOqYWhIvGKeWyjdRCFi6gxCe2Fh/8OfkBR
+    age: []
+    lastmodified: "2022-11-19T00:44:55Z"
+    mac: ENC[AES256_GCM,data:Eh3QdkkphIW6Vpv/0FuGT4ran33y00UNNrxkKv9yCi3JPbIQSX8eqO/s9wnJKZdKUWy06QpF3hcOvmUZbct7BZ3kLmp1uRNhkiFW3MPCX0Ua2O+MXElkwsrsh8eRI7GNwZS8cuFPm9VTkEWwqTXidWbrq38rMQCY+xooLONBeEM=,iv:byC0axeE03UvR6mfsxERZJ72gc6OamDkhHH/9nZdVN0=,tag:7wRGXY9SJ3wtLuRfV395UA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
diff --git a/nix/cloud/kv/vault/chainseek/preview.enc.yaml b/nix/cloud/kv/vault/chainseek/preview.enc.yaml
@@ -0,0 +1,18 @@
+pgUser: ENC[AES256_GCM,data:+gdtMvAYVbXslqqW1S3m4CE=,iv:c1k9zxCZ3gh1rKPXkwBxdJd7uCOcF44QPhJpLTmUqmo=,tag:AiXoALQfuQ6/l5Y3LPzKcA==,type:str]
+pgPass: ENC[AES256_GCM,data:VvRHGL1e8nt8Gj43UA+efor7sD6U8l/qLzVZoTvQzsg=,iv:4/88VHKIKg1se5mIxYukSSDa92YwFUKZ/vBk+LsHxl0=,tag:oUyByg8MOIWsxrMDm3j6ng==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault:
+        - vault_address: https://vault.dapps.aws.iohkdev.io
+          engine_path: sops
+          key_name: ops
+          created_at: "2022-11-19T00:45:01Z"
+          enc: vault:v1:rROu7x+PbkisSLW+lrxDZ4cEIsR99vJBMUpPoDS2d5Y2JnoGIBhNxGLbMEKfV9rcM1+tp1AGWOTUg3D1
+    age: []
+    lastmodified: "2022-11-19T00:45:01Z"
+    mac: ENC[AES256_GCM,data:foDKnpVA4PNePM0nKFq+/RGP3CS8Ils847fFBJ7dR6GVkMgSQFEuKYnX7E3P8GRwb5jIE3gIyfIXv456XAdrHxRWLaYkbkq1acITlMnc8YhiPNBWKQR0eSunuE6PT+VPxhsZRyUyGLlMoqJE6Z8pc0BhgiZ2o6NyZWHBihUqpww=,iv:Z4a72cmre0B1yd0KSruYRs5LnzRGiVzDcqr0o8M7nIQ=,tag:ZBOw+1yy7Ix3WYm+Hvzq6A==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
diff --git a/nix/cloud/kv/vault/db-sync/mainnet.enc.yaml b/nix/cloud/kv/vault/db-sync/mainnet.enc.yaml
@@ -0,0 +1,18 @@
+pgUser: ENC[AES256_GCM,data:kJ/R3oYRQRNYTkW4/J0=,iv:X81vHiXWfHXs6D3Get8lrvH034Sv2hAwYwRrveri/Jo=,tag:b7R/6hToxxmsXoLGTg64gA==,type:str]
+pgPass: ENC[AES256_GCM,data:a5Yr22ooV2aa6JBCaARMujO87R18ROEB3znEZV04aaI=,iv:IHu6LBSX7x/bmZONiiMOuDVY7m7OKS5IyaGknBozrwY=,tag:ONAyUUr4AzWL0lIDDFGBYQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault:
+        - vault_address: https://vault.dapps.aws.iohkdev.io
+          engine_path: sops
+          key_name: ops
+          created_at: "2022-11-19T00:21:07Z"
+          enc: vault:v1:6Pf7r810/Pxe5bQbuDjk7Grh1zQwtPbxGpTKYEFAUb6gOcKKd5+0wtC8e573JeC0tn5bY0jqF8k1h6Pf
+    age: []
+    lastmodified: "2022-11-19T00:21:08Z"
+    mac: ENC[AES256_GCM,data:NMQGNDhlqatzMYykcBubkFeYDa3kFsA+jNK6GNnOOAIt3uRd9tOh14b06QPGhZkPJlCWNxClRdyPMPq8yoOcv4jLA/dZfhCQodd+LWnnfwgQIAFpXOqw/W01LaOgRj2G8HTbzz/s1uEZMVPgdpDeZ52M1Erm4ZOE0DuxFO85ZM4=,iv:mpAjXQmOIYLFhhQNyY5rfcn0aje/52gbC1f+7D3nXXo=,tag:GwSzmmVn+g3/xV8DHBXSIw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
diff --git a/nix/cloud/kv/vault/db-sync/preprod.enc.yaml b/nix/cloud/kv/vault/db-sync/preprod.enc.yaml
@@ -0,0 +1,18 @@
+pgUser: ENC[AES256_GCM,data:AGFsU337hhErNi0DjgA=,iv:ktrWBy3mx93z3onRegI06x1v4EGh20BQ1SYqhnwW9bE=,tag:T5B8TGhotlD4sxzWHSKrYw==,type:str]
+pgPass: ENC[AES256_GCM,data:neVm6kObYxDW0KojWXF50chC2jxKqSHTWp+9QGgECmY=,iv:dBCNjrmIsMiIiyF0pDn/u1d59l17wjCp7rDycs6qxuM=,tag:tScnYujLoodZGUYBmzXwAg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault:
+        - vault_address: https://vault.dapps.aws.iohkdev.io
+          engine_path: sops
+          key_name: ops
+          created_at: "2022-11-19T00:16:06Z"
+          enc: vault:v1:Yf9OoDeVZyp732wbrFqt+XDvYVGWPu48mGKyU1T213l++c19rS+ko6IdHFwjX+pB7LWu5SKGxIKAyswT
+    age: []
+    lastmodified: "2022-11-19T00:16:07Z"
+    mac: ENC[AES256_GCM,data:ppC0ET/kKqU58Z/AjRHHrLzE0uDJRhf/1baonTdlM5YhHZGlczDk8dgGOUO0mMwVVmIKL9wChFRWQFRnls9tr6SwB0mvV3KgIztgNmQNuMqtcFyYkk3FvYUZP6IGCocp4ncn53klEfJpr21CmopaRfPO3duDYVnDlJH1PnVhdSE=,iv:BsLnEpPXuhUkhJpAUYBkxksiB5LJs5S1dN5OpbVICEM=,tag:TakeUq+62SljU/7conZHrg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
diff --git a/nix/cloud/kv/vault/db-sync/preview.enc.yaml b/nix/cloud/kv/vault/db-sync/preview.enc.yaml
@@ -0,0 +1,18 @@
+pgUser: ENC[AES256_GCM,data:Yghfy6LX3InbWIAkXbc=,iv:gXwAJAuo4CxrzXua9ZIX0fxCgoWp3p8C1NKesvA7MyM=,tag:7zxX3dp6nTUJsWC8vqWR8Q==,type:str]
+pgPass: ENC[AES256_GCM,data:CKsWb0vpifYM0pdrHGL+fwnKiT+mr1jYMTsevo9hqTI=,iv:8MvuE7JpU4tGqIHF/VT+osWU4v/3tiiMg17LKw09r88=,tag:4ohhDzqBEXCZOF1QeTwAaw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault:
+        - vault_address: https://vault.dapps.aws.iohkdev.io
+          engine_path: sops
+          key_name: ops
+          created_at: "2022-11-19T00:18:40Z"
+          enc: vault:v1:/AdhVjeI28Iq5tBGZKGxDl4kIMkHak/i5ExZwZLbYewjcaoM7qeCNNtJdxi0YhtzURHWdH4cNqNGRnxn
+    age: []
+    lastmodified: "2022-11-19T00:18:41Z"
+    mac: ENC[AES256_GCM,data:dtvc5ac+ShbtDbDWZ185RsxG26p7N/15jJ43jz1Dljy6wCtPUrotmOiZ2CQy6tf2niaUDrJwX6xAn3nBF13ZYspNJUaZs2SzfGHWw653NQED68F24KaYi8pARn91cyFL5xlt9Z+EusWL0Sxjj6Ecrl0SUQBXVNf4dwhHoWm5wB8=,iv:JgXe4W+hBrsREX9iBVpALXeNNB7CcfohwyqKAu0Giew=,tag:jz+svUx+k/8dXmvR3Ggqvg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
diff --git a/nix/cloud/kv/vault/patroni/infra.enc.yaml b/nix/cloud/kv/vault/patroni/infra.enc.yaml
@@ -0,0 +1,26 @@
+#ENC[AES256_GCM,data:qbpCRjApos3RHuIEnvDx,iv:AoijTGhpaqns0yYZ3HxsSOVTIyE9o/mLzFbwF5jZHe4=,tag:wu27T8frElUEmO0EKH3wGg==,type:comment]
+#ENC[AES256_GCM,data:OWb0pWny1u1JqAObRnJkBEF0tOsOBIYv8h7+e7BX0ihfRuIMDIb7k/AzBL7jNsY=,iv:yoCAFWHXxUa7IUawrMvtawfvW6nSeO66D5N6lf/Kl9E=,tag:4RsHGrnq1RoPDFt0BhsZ5w==,type:comment]
+patroniApi: ENC[AES256_GCM,data:Fc09,iv:AlSg0SO1PDnSfcrk8oHjX55O3WhXk4Pj70NuIlLm89I=,tag:UyH/v2SiKraWUwoZEYUeYA==,type:str]
+patroniApiPass: ENC[AES256_GCM,data:IAMYeUdts+KYiMaoBN3wv76jtYG4iAs/oTmplCjFa5A=,iv:0wT3kSKyjGeG9szBMz4oi91Ej10pFnt/kcGJ1dbjr5k=,tag:b0DHlPNJcontdpT82MmCcw==,type:str]
+patroniRepl: ENC[AES256_GCM,data:ZGv+RQ==,iv:qszQA30RX4ZiF1OGAf4HMkeEl3mMoAHyPfVXmD+Ps0s=,tag:aZiyFdrF9SmKFhAMHwkXpg==,type:str]
+patroniReplPass: ENC[AES256_GCM,data:6sZsnOB1vLr7r9DEzCxXdEfPA1P23HCdaWxaI58Q2hU=,iv:6gCjT+lzBfLmIKLdrXwXsnxHguqVC9QNqSFQgQ8wQBY=,tag:Gx8avh7C3VpNyRU3ZOAt6g==,type:str]
+patroniRewind: ENC[AES256_GCM,data:uAip1H/I,iv:oHfigFSAjixa9cYUy7WufX6M/qrcopr+NUoKxB9F9Rs=,tag:VaFO6oMW69x/TYu9A62iXA==,type:str]
+patroniRewindPass: ENC[AES256_GCM,data:YMDVa/CLYYx9biVplsHsSpc3+8gRNWelyEgPozKVrvQ=,iv:jHTjUUoa3P+dNK7fNw5Ub1rB/Fqh0z1ubbehXsDtiFE=,tag:2JoWi/j63azNV55wjuaCUw==,type:str]
+patroniSuper: ENC[AES256_GCM,data:Sx7f,iv:kIsYx52jxCsGtZ/iV/F/7yL/ZHl37scmje6sA53mcMY=,tag:xW0Hs6GZ5fTb3N7YN78zLQ==,type:str]
+patroniSuperPass: ENC[AES256_GCM,data:5r8yiLGsMztvN0WqnGTgt8IuSvnvRX62ROMOAUMUcfY=,iv:3DAzsLpnysVV8prNrl0qy0URn0dLwfEnCiZoZXZQwwA=,tag:yoCWHY63e372G6CPx5NVHQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault:
+        - vault_address: https://vault.dapps.aws.iohkdev.io
+          engine_path: sops
+          key_name: ops
+          created_at: "2022-11-18T04:22:03Z"
+          enc: vault:v1:+RyguA4f5hYV38ARnufDYxfF7iVY1zI5KGuKZXTctG/MfKidURHeAQ4ZxPXevxOV9BuHjTw1CI2ZTRys
+    age: []
+    lastmodified: "2022-11-18T04:22:03Z"
+    mac: ENC[AES256_GCM,data:tHznJqcYN1QT9TmT2tcnfDzPHM4/7u2CCHNvE52Go5RfZ9+36TC3C5RcN/A/2MGQfGCN7Fgykz+vnKEhq+XTrc7TsQWkKOmXICVGWiPXWU6tF/DUQtgG7QI+aPejuIIIuvtkYwSMacwJqHxEJUx6ZN+638UmXj/tlkgqP2mhpNk=,iv:nLgUK43hiMWxmSb3VNCC+zxnSJOhxsUyVfe9jXLtfxc=,tag:+ImiaYl/ZNRM7s1IViWjjw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3