svatantrya
0eff7a649a
- Add WELIST_PING_SIG_VERSION (1 legacy, 2 canonical JSON); default 1
- Sign WELIST-PING-V2\n + compact sorted JSON covering url, chain, height,
median_time, last_block_hash, info, base_fee, version and sig_version
- Fetch info/base_fee/version from the local /{chain}/info endpoint and sign them
- Fall back to null metadata on fetch failure; skip the fetch for onion URLs
- Normalize the advertised URL and bound metadata to match the WeTime service
- Activate v2 in bal-pusher.sh and document the TXT record setup
- Add unit tests for canonical payloads, URL normalization, metadata and onion detection
Includes previously uncommitted local deployment hardening:
- pg-server.sh configurable loopback bind address, volume and recreate handling
- .env loading in bal-server.sh and bal-pusher.sh
- second bal-server/bal-pusher development scripts
72 lines
2.8 KiB
Plaintext
72 lines
2.8 KiB
Plaintext
# Gitea API Token for releases
|
|
# Get this from your gitea settings: https://bitcoin-after.life/gitea/user-settings/applications
|
|
# DO NOT commit the real token to git!
|
|
# This file is in .gitignore and should not be committed to git
|
|
GITEA_API_TOKEN=your_gitea_api_token_here
|
|
# If a token was ever committed, revoke it and set a new one via the environment.
|
|
|
|
# === bal-server ===
|
|
# !!! WARNING: Never bind to 0.0.0.0 in production. Use 127.0.0.1 and place
|
|
# Nginx with TLS in front. Direct exposure will leak transaction data !!!
|
|
RUST_LOG=info
|
|
BAL_SERVER_DB_FILE=/var/bal/bal.db
|
|
BAL_SERVER_BIND_ADDRESS=127.0.0.1
|
|
BAL_SERVER_BIND_PORT=9137
|
|
BAL_SERVER_INFO="BAL server production"
|
|
BAL_SERVER_PUB_KEY_PATH=/var/bal/public_key.pem
|
|
|
|
BAL_SERVER_BITCOIN_ADDRESS="your_bitcoin_or_xpub_address"
|
|
BAL_SERVER_BITCOIN_FIXED_FEE=50000
|
|
|
|
# Actix Web DoS Protection Settings
|
|
BAL_SERVER_ACTIX_MAX_BODY_SIZE=1048576
|
|
BAL_SERVER_ACTIX_TIMEOUT_SECS=5
|
|
BAL_SERVER_ACTIX_PUSHTXS_PER_SEC=1
|
|
BAL_SERVER_ACTIX_PUSHTXS_BURST=3
|
|
BAL_SERVER_ACTIX_SEARCHTX_PER_SEC=5
|
|
BAL_SERVER_ACTIX_SEARCHTX_BURST=10
|
|
BAL_SERVER_ACTIX_INFO_PER_SEC=20
|
|
BAL_SERVER_ACTIX_INFO_BURST=30
|
|
BAL_SERVER_ACTIX_DEFAULT_PER_SEC=50
|
|
BAL_SERVER_ACTIX_DEFAULT_BURST=100
|
|
BAL_SERVER_ACTIX_WORKERS=4
|
|
BAL_SERVER_ACTIX_MAX_CONNECTIONS=100
|
|
|
|
# === PostgreSQL (optional; used by pg-server.sh) ===
|
|
# pg-server.sh requires BAL_PG_PASSWORD to be set; never commit a real password.
|
|
BAL_PG_PASSWORD=change_me
|
|
BAL_PG_USER=bal
|
|
BAL_PG_DB=baldb
|
|
# Docker volume that stores the database, so the container can be recreated
|
|
# without losing data.
|
|
BAL_PG_VOLUME=bal-pg-data
|
|
# Interface on which the container publishes port 5432. Keep 127.0.0.1 so the
|
|
# database listens on loopback only; 0.0.0.0 would expose it on every interface.
|
|
BAL_PG_BIND_ADDR=127.0.0.1
|
|
|
|
# === bal-pusher ===
|
|
BAL_SERVER_DB_FILE=/var/bal/bal.db
|
|
BAL_PUSHER_BITCOIN_DIR=/home/bal/.bitcoin
|
|
BAL_PUSHER_SEND_STATS=false
|
|
BAL_SERVER_URL=http://127.0.0.1:9137
|
|
SSL_KEY_PATH=/var/bal/private_key.pem
|
|
WELIST_SERVER_URL=https://welist.bitcoin-after.life
|
|
# Sign WeTime pings with the v2 canonical JSON scheme. Requires a DNSSEC-
|
|
# validated `_welist-key.<host>` TXT record (or a v3 onion address). Omit or
|
|
# set to 1 for the legacy scheme.
|
|
WELIST_PING_SIG_VERSION=2
|
|
|
|
# ZMQ endpoints per network (default: localhost only)
|
|
BAL_PUSHER_BITCOIN_ZMQ_HASHBLOCK=tcp://127.0.0.1:28332
|
|
BAL_PUSHER_REGTEST_ZMQ_HASHBLOCK=tcp://127.0.0.1:23332
|
|
BAL_PUSHER_TESTNET_ZMQ_HASHBLOCK=tcp://127.0.0.1:24332
|
|
BAL_PUSHER_TESTNET4_ZMQ_HASHBLOCK=tcp://127.0.0.1:22332
|
|
BAL_PUSHER_SIGNET_ZMQ_HASHBLOCK=tcp://127.0.0.1:21332
|
|
|
|
# RPC endpoints per network (default: localhost only)
|
|
BAL_PUSHER_BITCOIN_RPC_URL=http://127.0.0.1:8332
|
|
BAL_PUSHER_REGTEST_RPC_URL=http://127.0.0.1:18443
|
|
BAL_PUSHER_TESTNET_RPC_URL=http://127.0.0.1:18332
|
|
BAL_PUSHER_TESTNET4_RPC_URL=http://127.0.0.1:48332
|
|
BAL_PUSHER_SIGNET_RPC_URL=http://127.0.0.1:38332
|