From 2556fea8417bc3c7f755881ceacec2e531d3e934 Mon Sep 17 00:00:00 2001 From: hailin Date: Thu, 4 Dec 2025 21:46:35 -0800 Subject: [PATCH] refactor: separate configuration from code following 12-Factor App principles MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Created .env.example files with comprehensive security warnings - Removed hardcoded IP addresses and credentials from docker-compose files - Made database passwords mandatory (fail-fast on missing config) - Removed Chinese mirror sources from all Dockerfiles - Enhanced deploy.sh scripts with .env validation and auto-creation - Added comprehensive README.md deployment guides - Changed ALLOWED_IPS default to enable cross-server deployment - Updated all docker-compose files to use environment variables ๐Ÿค– Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- backend/api-gateway/.env.example | 60 ++ backend/api-gateway/README.md | 276 +++++++-- backend/api-gateway/deploy.sh | 27 +- .../api-gateway/docker-compose.monitoring.yml | 6 +- backend/api-gateway/docker-compose.yml | 2 +- backend/mpc-system/.env.example | 117 ++-- backend/mpc-system/README.md | 538 ++++++++++++++++++ backend/mpc-system/deploy.sh | 24 +- backend/mpc-system/docker-compose.yml | 67 +-- .../mpc-system/services/account/Dockerfile | 11 +- .../services/message-router/Dockerfile | 11 +- .../services/server-party-api/Dockerfile | 11 +- .../services/server-party/Dockerfile | 11 +- .../services/session-coordinator/Dockerfile | 11 +- 14 files changed, 985 insertions(+), 187 deletions(-) create mode 100644 backend/api-gateway/.env.example create mode 100644 backend/mpc-system/README.md diff --git a/backend/api-gateway/.env.example b/backend/api-gateway/.env.example new file mode 100644 index 00000000..55b166f5 --- /dev/null +++ b/backend/api-gateway/.env.example @@ -0,0 +1,60 @@ +# ============================================================================= +# API Gateway (Kong) - Environment Configuration +# ============================================================================= +# This file contains all environment variables needed for Kong API Gateway. +# +# Setup Instructions: +# 1. Copy this file: cp .env.example .env +# 2. Update values according to your deployment environment +# 3. Start services: ./deploy.sh up +# +# IMPORTANT: In production, change all default passwords and secrets! +# ============================================================================= + +# ============================================================================= +# Kong Database Configuration +# ============================================================================= +# PostgreSQL password for Kong database +# SECURITY: Change this in production! +KONG_PG_PASSWORD=kong_password + +# ============================================================================= +# Kong Admin GUI Configuration +# ============================================================================= +# Admin GUI URL - Update to match your deployment domain +# Examples: +# Development: http://localhost:8002 +# Production: https://admin.yourdomain.com +KONG_ADMIN_GUI_URL=http://localhost:8002 + +# ============================================================================= +# Monitoring Stack Configuration (Optional) +# ============================================================================= +# Grafana Admin Password +# SECURITY: Change this in production! +GRAFANA_ADMIN_PASSWORD=admin123 + +# Grafana Root URL - Update to match your deployment domain +# Examples: +# Development: http://localhost:3030 +# Production: https://monitor.yourdomain.com +GRAFANA_ROOT_URL=http://localhost:3030 + +# Docker network name for monitoring services +# Note: This should match the network created by docker-compose.yml +NETWORK_NAME=api-gateway_rwa-network + +# ============================================================================= +# Backend Services Configuration +# ============================================================================= +# Backend server IP address for connectivity checks +# IMPORTANT: Update this to the actual IP where your microservices are deployed! +# You MUST also update service URLs in kong.yml to match this IP +# Examples: +# Local development: 127.0.0.1 +# Remote server: 192.168.1.111 +# Same server: 127.0.0.1 +# +# Default is example IP - CHANGE THIS to your actual backend server IP! +# If backend is on same server as Kong, use 127.0.0.1 +BACKEND_SERVER_IP=192.168.1.111 diff --git a/backend/api-gateway/README.md b/backend/api-gateway/README.md index e0424369..7f3cb6cb 100644 --- a/backend/api-gateway/README.md +++ b/backend/api-gateway/README.md @@ -1,15 +1,27 @@ -# API Gateway - Kong +# API Gateway - Kong Deployment Guide RWADurian ้กน็›ฎ็š„ API ็ฝ‘ๅ…ณ๏ผŒๅŸบไบŽ Kong ๅฎž็Žฐใ€‚ -## ๅˆ†ๅธƒๅผ้ƒจ็ฝฒๆžถๆž„ +## ็›ฎๅฝ• + +- [ๆžถๆž„ๆฆ‚่งˆ](#ๆžถๆž„ๆฆ‚่งˆ) +- [ๅฟซ้€Ÿๅผ€ๅง‹](#ๅฟซ้€Ÿๅผ€ๅง‹) +- [็Žฏๅขƒ้…็ฝฎ](#็Žฏๅขƒ้…็ฝฎ) +- [้ƒจ็ฝฒๅ‘ฝไปค](#้ƒจ็ฝฒๅ‘ฝไปค) +- [็›‘ๆŽง](#็›‘ๆŽง) +- [็”Ÿไบง็Žฏๅขƒ้ƒจ็ฝฒ](#็”Ÿไบง็Žฏๅขƒ้ƒจ็ฝฒ) +- [ๆ•…้šœๆŽ’้™ค](#ๆ•…้šœๆŽ’้™ค) + +## ๆžถๆž„ๆฆ‚่งˆ + +### ๅˆ†ๅธƒๅผ้ƒจ็ฝฒๆžถๆž„ ``` โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” -โ”‚ ๆœๅŠกๅ™จ 192.168.1.100 (็ฝ‘ๅ…ณๆœๅŠกๅ™จ) โ”‚ +โ”‚ ็ฝ‘ๅ…ณๆœๅŠกๅ™จ โ”‚ โ”‚ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ โ”‚ โ”‚ Nginx โ”‚ โ”‚ Nginx โ”‚ โ”‚ Nginx โ”‚ โ”‚ -โ”‚ โ”‚ rwaadmin:443 โ”‚ โ”‚ rwaapi:443 โ”‚ โ”‚ update:443 โ”‚ โ”‚ +โ”‚ โ”‚ (Admin Web) โ”‚ โ”‚ (API SSL) โ”‚ โ”‚ (Mobile Update) โ”‚ โ”‚ โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ โ”‚ โ”‚ โ”‚ โ”‚ โ”‚ โ”‚ โ–ผ โ–ผ โ–ผ โ”‚ @@ -20,27 +32,19 @@ RWADurian ้กน็›ฎ็š„ API ็ฝ‘ๅ…ณ๏ผŒๅŸบไบŽ Kong ๅฎž็Žฐใ€‚ โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ - ้€š่ฟ‡ๅค–้ƒจ IP (192.168.1.111) ่ฎฟ้—ฎ + ้€š่ฟ‡็ฝ‘็ปœ่ฎฟ้—ฎๅŽ็ซฏๆœๅŠกๅ™จ โ”‚ โ–ผ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” -โ”‚ ๆœๅŠกๅ™จ 192.168.1.111 (ๅŽ็ซฏๆœๅŠกๅ™จ) โ”‚ +โ”‚ ๅŽ็ซฏๆœๅŠกๅ™จ โ”‚ โ”‚ โ”‚ โ”‚ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ โ”‚ โ”‚identity-serviceโ”‚ โ”‚wallet-service โ”‚ โ”‚backup-service โ”‚ โ”‚planting-serviceโ”‚ โ”‚ โ”‚ โ”‚ :3000 โ”‚ โ”‚ :3001 โ”‚ โ”‚ :3002 โ”‚ โ”‚ :3003 โ”‚ โ”‚ โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ โ”‚ โ”‚ -โ”‚ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ -โ”‚ โ”‚referral-serviceโ”‚ โ”‚reward-service โ”‚ โ”‚ mpc-service โ”‚ โ”‚leaderboard โ”‚ โ”‚ -โ”‚ โ”‚ :3004 โ”‚ โ”‚ :3005 โ”‚ โ”‚ :3006 โ”‚ โ”‚ :3007 โ”‚ โ”‚ -โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ +โ”‚ โ”” ... ๆ›ดๅคšๅพฎๆœๅŠก ... โ”‚ โ”‚ โ”‚ -โ”‚ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ -โ”‚ โ”‚reporting-svc โ”‚ โ”‚authorization โ”‚ โ”‚ admin-service โ”‚ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ -โ”‚ โ”‚ :3008 โ”‚ โ”‚ :3009 โ”‚ โ”‚ :3010 โ”‚ โ”‚presence-serviceโ”‚ โ”‚ -โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ :3011 โ”‚ โ”‚ -โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ โ”‚ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ โ”‚ โ”‚ Infrastructure โ”‚ โ”‚ โ”‚ โ”‚ PostgreSQL / Redis / Kafka / Zookeeper โ”‚ โ”‚ @@ -69,14 +73,53 @@ api-gateway/ ## ๅฟซ้€Ÿๅผ€ๅง‹ -### 1. ๅ…ˆๅฏๅŠจๅŽ็ซฏๅพฎๆœๅŠก +### 1. ้…็ฝฎ็Žฏๅขƒๅ˜้‡ + +```bash +cd backend/api-gateway + +# ๅˆ›ๅปบ .env ๆ–‡ไปถ +cp .env.example .env + +# ็ผ–่พ‘ .env ๅนถๆ นๆฎๅฎž้™…็Žฏๅขƒไฟฎๆ”น้…็ฝฎ +nano .env # ๆˆ–ไฝฟ็”จไฝ ๅ–œๆฌข็š„็ผ–่พ‘ๅ™จ +``` + +**้‡่ฆ**: ๅฟ…้กปไฟฎๆ”น `.env` ไธญ็š„ไปฅไธ‹้…็ฝฎ้กน๏ผš + +```bash +# ไฟฎๆ”นๆ•ฐๆฎๅบ“ๅฏ†็ ๏ผˆ็”Ÿไบง็Žฏๅขƒๅฟ…้กป๏ผ‰ +KONG_PG_PASSWORD=your_secure_password_here + +# ๆ›ดๆ–ฐๅŽ็ซฏๆœๅŠกๅ™จ IP๏ผˆๆ นๆฎๅฎž้™…้ƒจ็ฝฒไฟฎๆ”น๏ผ‰ +BACKEND_SERVER_IP=192.168.1.111 # ๆ”นไธบๅฎž้™…ๅŽ็ซฏๆœๅŠกๅ™จIP + +# ๅฆ‚้œ€็›‘ๆŽง๏ผŒไฟฎๆ”น Grafana ้…็ฝฎ +GRAFANA_ADMIN_PASSWORD=secure_password +GRAFANA_ROOT_URL=https://monitor.yourdomain.com +``` + +### 2. ไฟฎๆ”น Kong ่ทฏ็”ฑ้…็ฝฎ + +็ผ–่พ‘ `kong.yml`๏ผŒๆ›ดๆ–ฐๅŽ็ซฏๆœๅŠก็š„ URL๏ผš + +```bash +# ๆ‰น้‡ๆ›ฟๆขๅŽ็ซฏๆœๅŠกๅ™จ IP๏ผˆๅฆ‚ๆžœไธๆ˜ฏ 192.168.1.111๏ผ‰ +sed -i 's/192.168.1.111/YOUR_BACKEND_IP/g' kong.yml +``` + +### 3. ๅ…ˆๅฏๅŠจๅŽ็ซฏๅพฎๆœๅŠก + +**ๅœจๅŽ็ซฏๆœๅŠกๅ™จไธŠ**ๆ‰ง่กŒ๏ผš ```bash cd backend/services ./deploy.sh up ``` -### 2. ๅฏๅŠจ Kong API Gateway +### 4. ๅฏๅŠจ Kong API Gateway + +**ๅœจ็ฝ‘ๅ…ณๆœๅŠกๅ™จไธŠ**ๆ‰ง่กŒ๏ผš ```bash cd backend/api-gateway @@ -84,28 +127,98 @@ chmod +x deploy.sh ./deploy.sh up ``` -### 3. ้…็ฝฎ Nginx + SSL (็”Ÿไบง็Žฏๅขƒ) +### 5. ้ชŒ่ฏ้ƒจ็ฝฒ + +```bash +# ๆฃ€ๆŸฅKong็Šถๆ€ +./deploy.sh status + +# ๅฅๅบทๆฃ€ๆŸฅ +./deploy.sh health + +# ๆŸฅ็œ‹่ทฏ็”ฑ +./deploy.sh routes + +# ๆต‹่ฏ•API +curl http://localhost:8000/api/v1/versions +``` + +### 6. ้…็ฝฎ Nginx + SSL (็”Ÿไบง็Žฏๅขƒ๏ผŒๅฏ้€‰) ```bash cd nginx sudo chmod +x install.sh -sudo ./install.sh +sudo ./install.sh yourdomain.com ``` -## ้ƒจ็ฝฒ่„šๆœฌๅ‘ฝไปค +## ็Žฏๅขƒ้…็ฝฎ + +ๆ‰€ๆœ‰้…็ฝฎ้€š่ฟ‡ `.env` ๆ–‡ไปถ็ฎก็†ใ€‚ๅ‚่€ƒ `.env.example` ไบ†่งฃๆ‰€ๆœ‰ๅฏ็”จ้€‰้กนใ€‚ + +### ็Žฏๅขƒๅ˜้‡่ฏดๆ˜Ž + +| ๅ˜้‡ๅ | ่ฏดๆ˜Ž | ้ป˜่ฎคๅ€ผ | ๆ˜ฏๅฆๅฟ…้œ€ | +|--------|------|--------|----------| +| `KONG_PG_PASSWORD` | Kong ๆ•ฐๆฎๅบ“ๅฏ†็  | `kong_password` | ๆ˜ฏ | +| `KONG_ADMIN_GUI_URL` | ็ฎก็†็•Œ้ขURL | `http://localhost:8002` | ๅฆ | +| `GRAFANA_ADMIN_PASSWORD` | Grafana ็ฎก็†ๅฏ†็  | `admin123` | ๅฆ* | +| `GRAFANA_ROOT_URL` | Grafana ๅ…ฌๅผ€URL | `http://localhost:3030` | ๅฆ* | +| `NETWORK_NAME` | Docker ็ฝ‘็ปœๅ็งฐ | `api-gateway_rwa-network` | ๅฆ | +| `BACKEND_SERVER_IP` | ๅŽ็ซฏๆœๅŠกๅ™จIP | `127.0.0.1` | ๅฆ | + +\* ไป…ๅœจไฝฟ็”จ็›‘ๆŽงๆ—ถ้œ€่ฆ + +### ็”Ÿๆˆๅฎ‰ๅ…จๅฏ†็  + +```bash +# ็”Ÿๆˆๆ•ฐๆฎๅบ“ๅฏ†็  +openssl rand -base64 32 + +# ็”Ÿๆˆ Grafana ๅฏ†็  +openssl rand -base64 24 +``` + +## ้ƒจ็ฝฒๅ‘ฝไปค + +### ๅŸบ็ก€ๆ“ไฝœ ```bash ./deploy.sh up # ๅฏๅŠจ Kong ็ฝ‘ๅ…ณ ./deploy.sh down # ๅœๆญข Kong ็ฝ‘ๅ…ณ ./deploy.sh restart # ้‡ๅฏ Kong ็ฝ‘ๅ…ณ -./deploy.sh logs # ๆŸฅ็œ‹ๆ—ฅๅฟ— -./deploy.sh status # ๆŸฅ็œ‹็Šถๆ€ -./deploy.sh health # ๅฅๅบทๆฃ€ๆŸฅ -./deploy.sh reload # ้‡่ฝฝ Kong ้…็ฝฎ +./deploy.sh logs # ๆŸฅ็œ‹ๆ—ฅๅฟ— (ๅฎžๆ—ถ) +./deploy.sh status # ๆŸฅ็œ‹ๆœๅŠก็Šถๆ€ +``` + +### ้…็ฝฎ็ฎก็† + +```bash +./deploy.sh reload # ้‡่ฝฝ Kong ้…็ฝฎ (ไปŽ kong.yml) +./deploy.sh sync # ๅŒๆญฅ้…็ฝฎๅˆฐๆ•ฐๆฎๅบ“ (ๅŒ reload) +``` + +### ๅฅๅบทๆฃ€ๆŸฅไธŽ็›‘ๆŽง + +```bash +./deploy.sh health # Kong ๅฅๅบทๆฃ€ๆŸฅ ./deploy.sh routes # ๆŸฅ็œ‹ๆ‰€ๆœ‰่ทฏ็”ฑ ./deploy.sh services # ๆŸฅ็œ‹ๆ‰€ๆœ‰ๆœๅŠก ./deploy.sh test # ๆต‹่ฏ• API ่ทฏ็”ฑ -./deploy.sh clean # ๆธ…็†ๅฎนๅ™จๅ’Œๆ•ฐๆฎ +./deploy.sh metrics # ๆŸฅ็œ‹ Prometheus ๆŒ‡ๆ ‡ +``` + +### ็›‘ๆŽงๆ ˆ็ฎก็† + +```bash +./deploy.sh monitoring up # ๅฏๅŠจ Prometheus + Grafana +./deploy.sh monitoring down # ๅœๆญข็›‘ๆŽงๆœๅŠก +./deploy.sh monitoring install [domain] # ๅฎŒๆ•ดๅฎ‰่ฃ… (Nginx+SSL+็›‘ๆŽง) +``` + +### ๆธ…็† + +```bash +./deploy.sh clean # ๆธ…็†ๅฎนๅ™จๅ’Œๆ•ฐๆฎ (่ญฆๅ‘Š๏ผšไผšๅˆ ้™คๆ•ฐๆฎ!) ``` ## API ่ทฏ็”ฑ่กจ @@ -149,75 +262,124 @@ sudo ./install.sh | file-log | ่ฏทๆฑ‚ๆ—ฅๅฟ—่ฎฐๅฝ• | | request-size-limiting | ่ฏทๆฑ‚ๅคงๅฐ้™ๅˆถ (50MB) | +## ็›‘ๆŽง + +### ๅฏๅŠจ็›‘ๆŽงๆ ˆ + +```bash +# ๅฏๅŠจ Prometheus + Grafana +./deploy.sh monitoring up +``` + +### ่ฎฟ้—ฎ็›‘ๆŽงๆœๅŠก + +ๅฏๅŠจๅŽๅฏไปฅ่ฎฟ้—ฎ๏ผš + +- **Grafana**: http://localhost:3030 + - ็”จๆˆทๅ: `admin` + - ๅฏ†็ : ๅœจ `.env` ไธญ้…็ฝฎ (`GRAFANA_ADMIN_PASSWORD`) + +- **Prometheus**: http://localhost:9099 + +- **Kong ๆŒ‡ๆ ‡**: http://localhost:8001/metrics + +### ๆŸฅ็œ‹ๆŒ‡ๆ ‡ + +```bash +# ๅฟซ้€ŸๆŸฅ็œ‹ๅ…ณ้”ฎๆŒ‡ๆ ‡ +./deploy.sh metrics +``` + +### ้…็ฝฎๅ‘Š่ญฆ (ๅฏ้€‰) + +ๅœจ Grafana ไธญๅฏไปฅ้…็ฝฎๅ‘Š่ญฆ่ง„ๅˆ™๏ผŒ็›‘ๆŽง๏ผš +- ่ฏทๆฑ‚็Ž‡ +- ้”™่ฏฏ็Ž‡ (4xx, 5xx) +- ๅปถ่ฟŸ (p50, p95, p99) +- Kong ๅฅๅบท็Šถๆ€ + ## ็”Ÿไบง็Žฏๅขƒ้ƒจ็ฝฒ +### ้ƒจ็ฝฒๅ‰ๆฃ€ๆŸฅๆธ…ๅ• + +- [ ] ไฟฎๆ”น `.env` ไธญ็š„ๆ‰€ๆœ‰้ป˜่ฎคๅฏ†็  +- [ ] ๆ›ดๆ–ฐ `.env` ไธญ็š„ `BACKEND_SERVER_IP` ไธบๅฎž้™…ๅŽ็ซฏๆœๅŠกๅ™จIP +- [ ] ๆ›ดๆ–ฐ `kong.yml` ไธญ็š„ๅŽ็ซฏๆœๅŠกURL (ๆ›ฟๆขIPๅœฐๅ€) +- [ ] ้…็ฝฎ SSL/TLS ่ฏไนฆ (ๅฆ‚ไฝฟ็”จ HTTPS) +- [ ] ่ฎพ็ฝฎ PostgreSQL ๆ•ฐๆฎๅบ“ๅค‡ไปฝ +- [ ] ้…็ฝฎ้˜ฒ็ซๅข™่ง„ๅˆ™ +- [ ] ๅฏ็”จ็›‘ๆŽงๆ ˆ +- [ ] ้…็ฝฎๆ—ฅๅฟ—่šๅˆ + ### ๅˆ†ๅธƒๅผ้ƒจ็ฝฒๆต็จ‹ -**ๆœๅŠกๅ™จ่ง„ๅˆ’:** -- 192.168.1.100: ็ฝ‘ๅ…ณๆœๅŠกๅ™จ (Nginx + Kong + ๅ‰็ซฏ) -- 192.168.1.111: ๅŽ็ซฏๆœๅŠกๅ™จ (ๅพฎๆœๅŠก + ๅŸบ็ก€่ฎพๆ–ฝ) +**ๆœๅŠกๅ™จ่ง„ๅˆ’็คบไพ‹:** +- ๆœๅŠกๅ™จA: ็ฝ‘ๅ…ณๆœๅŠกๅ™จ (Nginx + Kong + ๅ‰็ซฏ) +- ๆœๅŠกๅ™จB: ๅŽ็ซฏๆœๅŠกๅ™จ (ๅพฎๆœๅŠก + ๅŸบ็ก€่ฎพๆ–ฝ) -**ๆญฅ้ชค 1: ๅœจๅŽ็ซฏๆœๅŠกๅ™จ (192.168.1.111) ้ƒจ็ฝฒๅพฎๆœๅŠก** +**ๆญฅ้ชค 1: ๅœจๅŽ็ซฏๆœๅŠกๅ™จ้ƒจ็ฝฒๅพฎๆœๅŠก** ```bash # ๅ…‹้š†ไปฃ็  git clone /opt/rwadurian -cd /opt/rwadurian +cd /opt/rwadurian/backend/services # ้…็ฝฎ็Žฏๅขƒๅ˜้‡ -cp backend/services/.env.example backend/services/.env -# ็ผ–่พ‘ .env ๆ–‡ไปถ +cp .env.example .env +nano .env # ้…็ฝฎ็”Ÿไบง็Žฏๅขƒๅ‚ๆ•ฐ -# ๅฏๅŠจๅŸบ็ก€่ฎพๆ–ฝๅ’ŒๅพฎๆœๅŠก -cd backend/services +# ๅฏๅŠจๆœๅŠก ./deploy.sh up -# ็กฎไฟ้˜ฒ็ซๅข™ๅผ€ๆ”พ็ซฏๅฃ 3000-3011 +# ๅผ€ๆ”พ้˜ฒ็ซๅข™็ซฏๅฃ 3000-3011 (ๆ นๆฎๅฎž้™…ๅพฎๆœๅŠกๆ•ฐ้‡) +sudo ufw allow 3000:3011/tcp ``` -**ๆญฅ้ชค 2: ๅœจ็ฝ‘ๅ…ณๆœๅŠกๅ™จ (192.168.1.100) ้ƒจ็ฝฒ Kong** +**ๆญฅ้ชค 2: ๅœจ็ฝ‘ๅ…ณๆœๅŠกๅ™จ้ƒจ็ฝฒ Kong** ```bash # ๅ…‹้š†ไปฃ็  git clone /opt/rwadurian -cd /opt/rwadurian +cd /opt/rwadurian/backend/api-gateway -# ไฟฎๆ”น kong.yml ไธญ็š„ๅŽ็ซฏๆœๅŠกๅ™จ IP๏ผˆๅฆ‚ๆœ‰ๅ˜ๅŒ–๏ผ‰ -# ้ป˜่ฎค้…็ฝฎไธบ 192.168.1.111 +# ้…็ฝฎ็Žฏๅขƒๅ˜้‡ +cp .env.example .env +nano .env # ้…็ฝฎ BACKEND_SERVER_IP ็ญ‰ๅ‚ๆ•ฐ -# ๅฏๅŠจ Kong API Gateway -cd backend/api-gateway +# ไฟฎๆ”น kong.yml ไธญ็š„ๅŽ็ซฏๆœๅŠกๅ™จๅœฐๅ€ +nano kong.yml # ๆ›ดๆ–ฐๆœๅŠกURLไธญ็š„IPๅœฐๅ€ +# ๆˆ–ไฝฟ็”จ sed: sed -i 's/OLD_IP/NEW_IP/g' kong.yml + +# ๅฏๅŠจ Kong ./deploy.sh up -# ้…็ฝฎ Nginx + SSL -cd nginx -sudo ./install.sh - -# ้ชŒ่ฏ -curl https://rwaapi.szaiai.com/api/v1/versions +# ้ชŒ่ฏ่ฟžๆŽฅ +./deploy.sh health +./deploy.sh test ``` -### ไฟฎๆ”นๅŽ็ซฏๆœๅŠกๅ™จ IP - -ๅฆ‚ๆžœๅŽ็ซฏๆœๅŠกๅ™จ IP ไธๆ˜ฏ 192.168.1.111๏ผŒ้œ€่ฆไฟฎๆ”น `kong.yml`: +**ๆญฅ้ชค 3: ้…็ฝฎ Nginx + SSL (ๅฏ้€‰)** ```bash -# ๆ‰น้‡ๆ›ฟๆข IP ๅœฐๅ€ -sed -i 's/192.168.1.111/YOUR_BACKEND_IP/g' kong.yml +cd nginx +sudo ./install.sh yourdomain.com + +# ้ชŒ่ฏHTTPS +curl https://yourdomain.com/api/v1/versions ``` ### ๆœๅŠกไพ่ต–ๅ…ณ็ณป ``` -ๅŽ็ซฏๆœๅŠกๅ™จ (192.168.1.111): +ๅŽ็ซฏๆœๅŠกๅ™จ: 1. Infrastructure (PostgreSQL, Redis, Kafka) โ†“ - 2. Application Services (identity, wallet, admin, etc.) + 2. Application Services (ๅพฎๆœๅŠก) -็ฝ‘ๅ…ณๆœๅŠกๅ™จ (192.168.1.100): - 3. Kong API Gateway (้€š่ฟ‡ IP ่ฎฟ้—ฎๅŽ็ซฏ) +็ฝ‘ๅ…ณๆœๅŠกๅ™จ: + 3. Kong API Gateway (้€š่ฟ‡็ฝ‘็ปœ่ฎฟ้—ฎๅŽ็ซฏ) โ†“ - 4. Nginx (SSL ็ปˆ็ป“) + 4. Nginx (SSL ็ปˆ็ป“, ๅฏ้€‰) ``` ## ็ฎก็†ๅ‘ฝไปค diff --git a/backend/api-gateway/deploy.sh b/backend/api-gateway/deploy.sh index aa2841d6..fe2bc9f5 100644 --- a/backend/api-gateway/deploy.sh +++ b/backend/api-gateway/deploy.sh @@ -25,6 +25,12 @@ YELLOW='\033[1;33m' BLUE='\033[0;34m' NC='\033[0m' +# ๆ—ฅๅฟ—ๅ‡ฝๆ•ฐ +log_info() { echo -e "${BLUE}[INFO]${NC} $1"; } +log_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; } +log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; } +log_error() { echo -e "${RED}[ERROR]${NC} $1"; } + # ้กน็›ฎไฟกๆฏ PROJECT_NAME="rwa-api-gateway" KONG_ADMIN_URL="http://localhost:8001" @@ -36,11 +42,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" # ๅˆ‡ๆขๅˆฐ่„šๆœฌๆ‰€ๅœจ็›ฎๅฝ• cd "$SCRIPT_DIR" -# ๆ—ฅๅฟ—ๅ‡ฝๆ•ฐ -log_info() { echo -e "${BLUE}[INFO]${NC} $1"; } -log_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; } -log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; } -log_error() { echo -e "${RED}[ERROR]${NC} $1"; } +# ๅŠ ่ฝฝ็Žฏๅขƒๅ˜้‡ +if [ -f ".env" ]; then + log_info "Loading environment from .env file" + set -a + source .env + set +a +elif [ -f ".env.example" ]; then + log_warn ".env file not found!" + log_warn "Creating .env from .env.example..." + cp .env.example .env + log_error "Please edit .env file to configure your environment, then run again" + exit 1 +else + log_error "Neither .env nor .env.example found!" + exit 1 +fi # ๆฃ€ๆŸฅ Docker check_docker() { diff --git a/backend/api-gateway/docker-compose.monitoring.yml b/backend/api-gateway/docker-compose.monitoring.yml index db59357b..4cf9d6db 100644 --- a/backend/api-gateway/docker-compose.monitoring.yml +++ b/backend/api-gateway/docker-compose.monitoring.yml @@ -34,10 +34,10 @@ services: container_name: rwa-grafana environment: - GF_SECURITY_ADMIN_USER=admin - - GF_SECURITY_ADMIN_PASSWORD=admin123 + - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-admin123} - GF_USERS_ALLOW_SIGN_UP=false # ๅๅ‘ไปฃ็†ๆ”ฏๆŒ - - GF_SERVER_ROOT_URL=https://monitor.szaiai.com + - GF_SERVER_ROOT_URL=${GRAFANA_ROOT_URL:-http://localhost:3030} - GF_SERVER_SERVE_FROM_SUB_PATH=false volumes: - grafana_data:/var/lib/grafana @@ -59,4 +59,4 @@ volumes: networks: rwa-network: external: true - name: api-gateway_rwa-network + name: ${NETWORK_NAME:-api-gateway_rwa-network} diff --git a/backend/api-gateway/docker-compose.yml b/backend/api-gateway/docker-compose.yml index 9b71b89b..bd3775ca 100644 --- a/backend/api-gateway/docker-compose.yml +++ b/backend/api-gateway/docker-compose.yml @@ -67,7 +67,7 @@ services: KONG_PROXY_ERROR_LOG: /dev/stderr KONG_ADMIN_ERROR_LOG: /dev/stderr KONG_ADMIN_LISTEN: 0.0.0.0:8001 - KONG_ADMIN_GUI_URL: http://localhost:8002 + KONG_ADMIN_GUI_URL: ${KONG_ADMIN_GUI_URL:-http://localhost:8002} ports: - "8000:8000" # Proxy HTTP - "8443:8443" # Proxy HTTPS diff --git a/backend/mpc-system/.env.example b/backend/mpc-system/.env.example index f7b22dec..d7bfb874 100644 --- a/backend/mpc-system/.env.example +++ b/backend/mpc-system/.env.example @@ -1,52 +1,93 @@ -# MPC-System ็Žฏๅขƒๅ˜้‡้…็ฝฎ -# ้ƒจ็ฝฒไฝ็ฝฎ: 192.168.1.100 (Nginx + MPC ๆœๅŠกๅ™จ) +# ============================================================================= +# MPC System - Environment Configuration +# ============================================================================= +# This file contains all environment variables needed for MPC System deployment. # -# ไฝฟ็”จๆ–นๆณ•: -# 1. ๅคๅˆถๆญคๆ–‡ไปถ: cp .env.example .env -# 2. ไฟฎๆ”นไธบๅฎž้™…็”Ÿไบง็Žฏๅขƒ็š„ๅ€ผ -# 3. ๅฏๅŠจ: docker compose up -d +# Setup Instructions: +# 1. Copy this file: cp .env.example .env +# 2. Update ALL values according to your production environment +# 3. Generate secure random keys for secrets (see instructions below) +# 4. Start services: ./deploy.sh up +# +# IMPORTANT: This file contains examples only! +# In production, you MUST: +# - Change ALL passwords and keys to secure random values +# - Update ALLOWED_IPS to match your actual backend server IP +# - Keep the .env file secure and NEVER commit it to version control +# ============================================================================= -# ============================================ -# ็Žฏๅขƒๆ ‡่ฏ† -# ============================================ +# ============================================================================= +# Environment Identifier +# ============================================================================= +# Options: development, staging, production ENVIRONMENT=production -# ============================================ -# PostgreSQL ๆ•ฐๆฎๅบ“ -# ============================================ +# ============================================================================= +# PostgreSQL Database Configuration +# ============================================================================= +# Database user (can keep default or customize) POSTGRES_USER=mpc_user -POSTGRES_PASSWORD=your_secure_postgres_password_here -# ============================================ -# Redis ็ผ“ๅญ˜ -# ============================================ -# ็•™็ฉบ่กจ็คบไธ้œ€่ฆๅฏ†็  (ๅ†…้ƒจ็ฝ‘็ปœ) +# Database password +# SECURITY: Generate a strong password in production! +# Example command: openssl rand -base64 32 +POSTGRES_PASSWORD=change_this_to_secure_postgres_password + +# ============================================================================= +# Redis Cache Configuration +# ============================================================================= +# Redis password (leave empty if Redis is only accessible within Docker network) +# For production, consider setting a password for defense in depth +# Example command: openssl rand -base64 24 REDIS_PASSWORD= -# ============================================ -# RabbitMQ ๆถˆๆฏ้˜Ÿๅˆ— -# ============================================ +# ============================================================================= +# RabbitMQ Message Broker Configuration +# ============================================================================= +# RabbitMQ user (can keep default or customize) RABBITMQ_USER=mpc_user -RABBITMQ_PASSWORD=your_secure_rabbitmq_password_here -# ============================================ -# JWT ้…็ฝฎ -# ============================================ -# JWT ็ญพๅๅฏ†้’ฅ (่‡ณๅฐ‘ 32 ๅญ—็ฌฆ) -JWT_SECRET_KEY=your_super_secure_jwt_secret_key_at_least_32_characters +# RabbitMQ password +# SECURITY: Generate a strong password in production! +# Example command: openssl rand -base64 32 +RABBITMQ_PASSWORD=change_this_to_secure_rabbitmq_password -# ============================================ -# ๅŠ ๅฏ†้…็ฝฎ -# ============================================ -# ไธปๅŠ ๅฏ†ๅฏ†้’ฅ (64 ไฝๅๅ…ญ่ฟ›ๅˆถๅญ—็ฌฆ = 256 ไฝๅฏ†้’ฅ) -# ็”จไบŽๅŠ ๅฏ†ๅญ˜ๅ‚จ็š„ๅฏ†้’ฅๅˆ†็‰‡ +# ============================================================================= +# JWT Configuration +# ============================================================================= +# JWT signing secret key (minimum 32 characters) +# SECURITY: Generate a strong random key in production! +# Example command: openssl rand -base64 48 +JWT_SECRET_KEY=change_this_jwt_secret_key_to_random_value_min_32_chars + +# ============================================================================= +# Cryptography Configuration +# ============================================================================= +# Master encryption key for encrypting stored key shares +# MUST be exactly 64 hexadecimal characters (256-bit key) +# SECURITY: Generate a secure random key in production! +# Example command: openssl rand -hex 32 +# WARNING: If you lose this key, encrypted shares cannot be recovered! CRYPTO_MASTER_KEY=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef -# ============================================ -# API ๅฎ‰ๅ…จ้…็ฝฎ -# ============================================ -# API ่ฎค่ฏๅฏ†้’ฅ (ไธŽๅŽ็ซฏๆœๅŠกๅ™จ็š„ mpc-service ้…็ฝฎไธ€่‡ด) -MPC_API_KEY=your_very_secure_api_key_at_least_32_characters +# ============================================================================= +# API Security Configuration +# ============================================================================= +# API authentication key for server-to-server communication +# This key must match the MPC_API_KEY in your backend mpc-service configuration +# SECURITY: Generate a strong random key and keep it synchronized! +# Example command: openssl rand -base64 48 +MPC_API_KEY=change_this_api_key_to_match_your_mpc_service_config -# ๅ…่ฎธ่ฎฟ้—ฎ็š„ IP ๅœฐๅ€ (ๅŽ็ซฏๆœๅŠกๅ™จ) -ALLOWED_IPS=192.168.1.111 +# Allowed IP addresses (comma-separated list) +# Only these IPs can access the MPC system APIs +# IMPORTANT: In production, restrict this to your actual backend server IP(s)! +# Examples: +# Single IP: ALLOWED_IPS=192.168.1.111 +# Multiple IPs: ALLOWED_IPS=192.168.1.111,192.168.1.112 +# Local only: ALLOWED_IPS=127.0.0.1 +# Allow all: ALLOWED_IPS= (empty, relies on API_KEY auth only - NOT RECOMMENDED for production) +# +# Default allows all IPs (protected by API_KEY authentication) +# SECURITY WARNING: Change this in production to specific backend server IP(s)! +ALLOWED_IPS= diff --git a/backend/mpc-system/README.md b/backend/mpc-system/README.md new file mode 100644 index 00000000..29acada0 --- /dev/null +++ b/backend/mpc-system/README.md @@ -0,0 +1,538 @@ +# MPC System Deployment Guide + +Multi-Party Computation (MPC) system for secure threshold signature scheme (TSS) implementation in the RWADurian project. + +## Table of Contents + +- [Overview](#overview) +- [Architecture](#architecture) +- [Quick Start](#quick-start) +- [Configuration](#configuration) +- [Deployment Commands](#deployment-commands) +- [Services](#services) +- [Security](#security) +- [Troubleshooting](#troubleshooting) +- [Production Deployment](#production-deployment) + +## Overview + +The MPC system implements a 2-of-3 threshold signature scheme where: +- 3 server parties hold key shares +- At least 2 parties are required to generate signatures +- User shares are generated dynamically and returned to the calling service +- All shares are encrypted using AES-256-GCM + +### Key Features + +- **Threshold Cryptography**: 2-of-3 TSS for enhanced security +- **Distributed Architecture**: Services communicate via gRPC and WebSocket +- **Secure Storage**: AES-256-GCM encryption for all stored shares +- **API Authentication**: API key and IP-based access control +- **Session Management**: Coordinated multi-party computation sessions + +## Architecture + +``` +โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” +โ”‚ MPC System โ”‚ +โ”‚ โ”‚ +โ”‚ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ +โ”‚ โ”‚ Account Service โ”‚ โ”‚ Server Party API โ”‚ โ”‚ +โ”‚ โ”‚ (Port 4000) โ”‚ โ”‚ (Port 8083) โ”‚ โ”‚ +โ”‚ โ”‚ External API โ”‚ โ”‚ User Share Gen โ”‚ โ”‚ +โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ +โ”‚ โ”‚ โ”‚ โ”‚ +โ”‚ โ–ผ โ–ผ โ”‚ +โ”‚ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ +โ”‚ โ”‚ Session โ”‚โ—„โ”€โ”€โ”€โ”€โ”€โ”€โ–บโ”‚ Message Router โ”‚ โ”‚ +โ”‚ โ”‚ Coordinator โ”‚ โ”‚ (Port 8082) โ”‚ โ”‚ +โ”‚ โ”‚ (Port 8081) โ”‚ โ”‚ WebSocket โ”‚ โ”‚ +โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ +โ”‚ โ”‚ โ”‚ โ”‚ +โ”‚ โ–ผ โ–ผ โ”‚ +โ”‚ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ +โ”‚ โ”‚ Server Parties (3 instances) โ”‚ โ”‚ +โ”‚ โ”‚ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ โ”‚ +โ”‚ โ”‚ โ”‚ Party 1 โ”‚ โ”‚ Party 2 โ”‚ โ”‚ Party 3 โ”‚ โ”‚ โ”‚ +โ”‚ โ”‚ โ”‚ (TSS) โ”‚ โ”‚ (TSS) โ”‚ โ”‚ (TSS) โ”‚ โ”‚ โ”‚ +โ”‚ โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ โ”‚ +โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ +โ”‚ โ”‚ +โ”‚ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ +โ”‚ โ”‚ Infrastructure Services โ”‚ โ”‚ +โ”‚ โ”‚ PostgreSQL โ”‚ Redis โ”‚ RabbitMQ โ”‚ โ”‚ +โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ +โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ + โ”‚ + โ”‚ Network Access + โ–ผ + โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” + โ”‚ Backend Services โ”‚ + โ”‚ mpc-service (caller) โ”‚ + โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ +``` + +## Quick Start + +### Prerequisites + +- **Docker** (version 20.10+) +- **Docker Compose** (version 2.0+) +- **Network Access** from backend services +- **Ports Available**: 4000, 8081, 8082, 8083 + +### 1. Initial Setup + +```bash +cd backend/mpc-system + +# Create environment configuration +cp .env.example .env + +# Edit configuration for your environment +nano .env +``` + +### 2. Configure Environment + +Edit `.env` and update the following **REQUIRED** values: + +```bash +# Database password (REQUIRED) +POSTGRES_PASSWORD=your_secure_postgres_password + +# RabbitMQ password (REQUIRED) +RABBITMQ_PASSWORD=your_secure_rabbitmq_password + +# JWT secret key (REQUIRED, min 32 chars) +JWT_SECRET_KEY=your_jwt_secret_key_at_least_32_characters + +# Master encryption key (REQUIRED, exactly 64 hex chars) +# WARNING: If you lose this, encrypted shares cannot be recovered! +CRYPTO_MASTER_KEY=$(openssl rand -hex 32) + +# API key for server-to-server auth (REQUIRED) +# Must match the MPC_API_KEY in your backend mpc-service config +MPC_API_KEY=your_api_key_matching_mpc_service + +# Allowed IPs (REQUIRED - update to actual backend server IP!) +ALLOWED_IPS=192.168.1.111 +``` + +### 3. Deploy Services + +```bash +# Start all services +./deploy.sh up + +# Check status +./deploy.sh status + +# View logs +./deploy.sh logs +``` + +### 4. Verify Deployment + +```bash +# Health check +./deploy.sh health + +# Test API +./deploy.sh test-api +``` + +## Configuration + +All configuration is managed through `.env` file. See `.env.example` for complete documentation. + +### Critical Environment Variables + +| Variable | Description | Required | Example | +|----------|-------------|----------|---------| +| `POSTGRES_PASSWORD` | Database password | Yes | `openssl rand -base64 32` | +| `RABBITMQ_PASSWORD` | Message broker password | Yes | `openssl rand -base64 32` | +| `JWT_SECRET_KEY` | JWT signing key (โ‰ฅ32 chars) | Yes | `openssl rand -base64 48` | +| `CRYPTO_MASTER_KEY` | AES-256 key (64 hex chars) | Yes | `openssl rand -hex 32` | +| `MPC_API_KEY` | API authentication key | Yes | `openssl rand -base64 48` | +| `ALLOWED_IPS` | Comma-separated allowed IPs | Yes | `192.168.1.111,192.168.1.112` | +| `ENVIRONMENT` | Environment name | No | `production` (default) | +| `REDIS_PASSWORD` | Redis password | No | Leave empty for internal network | + +### Generating Secure Keys + +```bash +# PostgreSQL & RabbitMQ passwords +openssl rand -base64 32 + +# JWT Secret Key +openssl rand -base64 48 + +# Master Encryption Key (MUST be exactly 64 hex characters) +openssl rand -hex 32 + +# API Key +openssl rand -base64 48 +``` + +### Configuration Checklist + +Before deploying to production: + +- [ ] Change all default passwords +- [ ] Generate secure `CRYPTO_MASTER_KEY` and back it up securely +- [ ] Set `MPC_API_KEY` to match backend mpc-service configuration +- [ ] Update `ALLOWED_IPS` to actual backend server IP(s) +- [ ] Backup `.env` file to secure location (NOT in git!) + +## Deployment Commands + +### Basic Operations + +```bash +./deploy.sh up # Start all services +./deploy.sh down # Stop all services +./deploy.sh restart # Restart all services +./deploy.sh logs [svc] # View logs (all or specific service) +./deploy.sh status # Show service status +./deploy.sh health # Health check all services +``` + +### Build Commands + +```bash +./deploy.sh build # Build Docker images +./deploy.sh build-no-cache # Rebuild without cache +``` + +### Service Management + +```bash +# Infrastructure only +./deploy.sh infra up # Start postgres, redis, rabbitmq +./deploy.sh infra down # Stop infrastructure + +# MPC services only +./deploy.sh mpc up # Start MPC services +./deploy.sh mpc down # Stop MPC services +./deploy.sh mpc restart # Restart MPC services +``` + +### Debugging + +```bash +./deploy.sh logs-tail [service] # Last 100 log lines +./deploy.sh shell [service] # Open shell in container +./deploy.sh test-api # Test Account Service API +``` + +### Cleanup + +```bash +# WARNING: This removes all data! +./deploy.sh clean +``` + +## Services + +### External Services (Exposed Ports) + +| Service | Port | Protocol | Purpose | +|---------|------|----------|---------| +| account-service | 4000 | HTTP | Main API for backend integration | +| session-coordinator | 8081 | HTTP/gRPC | Session coordination | +| message-router | 8082 | WebSocket/gRPC | Message routing | +| server-party-api | 8083 | HTTP | User share generation | + +### Internal Services + +| Service | Purpose | +|---------|---------| +| server-party-1 | TSS party 1 (stores server shares) | +| server-party-2 | TSS party 2 (stores server shares) | +| server-party-3 | TSS party 3 (stores server shares) | +| postgres | Database for session/account data | +| redis | Cache and temporary data | +| rabbitmq | Message broker for inter-service communication | + +### Service Dependencies + +``` +Infrastructure Services (postgres, redis, rabbitmq) + โ†“ +Session Coordinator & Message Router + โ†“ +Server Parties (1, 2, 3) & Server Party API + โ†“ +Account Service (external API) +``` + +## Security + +### Access Control + +1. **IP Whitelisting**: Only IPs in `ALLOWED_IPS` can access the API +2. **API Key Authentication**: Requires valid `MPC_API_KEY` header +3. **Network Isolation**: Services communicate within Docker network + +### Data Protection + +1. **Encryption at Rest**: All shares encrypted with AES-256-GCM +2. **Master Key**: `CRYPTO_MASTER_KEY` must be securely stored and backed up +3. **Secure Transport**: Use HTTPS/TLS for external communication + +### Best Practices + +- **Never commit `.env` to version control** +- **Backup `CRYPTO_MASTER_KEY` to multiple secure locations** +- **Rotate API keys regularly** +- **Use strong passwords (min 32 chars)** +- **Restrict database ports (don't expose to internet)** +- **Monitor failed authentication attempts** +- **Enable audit logging** + +### Key Backup + +```bash +# Backup master key (CRITICAL!) +echo "CRYPTO_MASTER_KEY=$(grep CRYPTO_MASTER_KEY .env | cut -d= -f2)" > master_key.backup + +# Store securely (encrypted USB, password manager, vault) +# NEVER store in plaintext on the server +``` + +## Troubleshooting + +### Services won't start + +```bash +# Check logs +./deploy.sh logs + +# Check specific service +./deploy.sh logs postgres + +# Common issues: +# 1. Ports already in use +# 2. .env file missing or misconfigured +# 3. Database initialization failed +``` + +### Database connection errors + +```bash +# Check postgres health +docker compose ps postgres + +# View postgres logs +./deploy.sh logs postgres + +# Restart infrastructure +./deploy.sh infra down +./deploy.sh infra up +``` + +### API returns 403 Forbidden + +```bash +# Check ALLOWED_IPS configuration +grep ALLOWED_IPS .env + +# Verify caller's IP is in the list +# Update .env and restart: +./deploy.sh restart +``` + +### API returns 401 Unauthorized + +```bash +# Verify MPC_API_KEY matches between: +# 1. This system's .env +# 2. Backend mpc-service configuration + +# Check API key +grep MPC_API_KEY .env + +# Restart after updating +./deploy.sh restart +``` + +### Keygen or signing fails + +```bash +# Check all server parties are healthy +./deploy.sh health + +# View server party logs +./deploy.sh logs server-party-1 +./deploy.sh logs server-party-2 +./deploy.sh logs server-party-3 + +# Check message router +./deploy.sh logs message-router + +# Restart MPC services +./deploy.sh mpc restart +``` + +### Lost master encryption key + +**CRITICAL**: If `CRYPTO_MASTER_KEY` is lost, encrypted shares cannot be recovered! + +Prevention: +- Backup key immediately after generation +- Store in multiple secure locations +- Use enterprise key management system in production + +## Production Deployment + +### Pre-Deployment Checklist + +- [ ] Generate all secure keys and passwords +- [ ] Backup `CRYPTO_MASTER_KEY` to secure locations +- [ ] Configure `ALLOWED_IPS` for actual backend server +- [ ] Sync `MPC_API_KEY` with backend mpc-service +- [ ] Set up database backups +- [ ] Configure log aggregation +- [ ] Set up monitoring and alerts +- [ ] Document recovery procedures +- [ ] Test disaster recovery + +### Deployment Steps + +**Step 1: Prepare Environment** + +```bash +# On MPC server +git clone /opt/rwadurian +cd /opt/rwadurian/backend/mpc-system + +# Configure environment +cp .env.example .env +nano .env # Set all required values + +# Generate and backup keys +openssl rand -hex 32 > master_key.txt +# Copy to secure storage, then delete: +# rm master_key.txt +``` + +**Step 2: Deploy Services** + +```bash +# Build images +./deploy.sh build + +# Start services +./deploy.sh up + +# Verify all healthy +./deploy.sh health +``` + +**Step 3: Configure Firewall** + +```bash +# Allow backend server to access MPC ports +sudo ufw allow from to any port 4000 +sudo ufw allow from to any port 8081 +sudo ufw allow from to any port 8082 +sudo ufw allow from to any port 8083 + +# Deny all other external access +sudo ufw default deny incoming +sudo ufw enable +``` + +**Step 4: Test Integration** + +```bash +# From backend server, test API access +curl -H "X-API-Key: YOUR_MPC_API_KEY" \ + http://:4000/health +``` + +### Monitoring + +Monitor these metrics: + +- Service health status +- API request rate and latency +- Failed authentication attempts +- Database connection pool usage +- RabbitMQ queue depths +- Key generation/signing success rates + +### Backup Strategy + +```bash +# Database backup (daily) +docker compose exec postgres pg_dump -U mpc_user mpc_system > backup_$(date +%Y%m%d).sql + +# Configuration backup +tar -czf config_backup_$(date +%Y%m%d).tar.gz .env kong.yml + +# Encryption key backup (secure storage only!) +``` + +### Disaster Recovery + +1. **Service Failure**: Restart affected service using `./deploy.sh restart` +2. **Database Corruption**: Restore from latest backup +3. **Key Loss**: If `CRYPTO_MASTER_KEY` lost, all encrypted shares are unrecoverable +4. **Full System Recovery**: Redeploy from backups, restore database + +### Performance Tuning + +```yaml +# docker-compose.yml - adjust resources +services: + session-coordinator: + deploy: + resources: + limits: + cpus: '2' + memory: 2G +``` + +## API Reference + +### Account Service API (Port 4000) + +```bash +# Health check +curl http://localhost:4000/health + +# Create account (keygen) +curl -X POST http://localhost:4000/api/v1/accounts \ + -H "X-API-Key: YOUR_MPC_API_KEY" \ + -H "Content-Type: application/json" \ + -d '{"user_id": "user123"}' + +# Sign transaction +curl -X POST http://localhost:4000/api/v1/accounts/{account_id}/sign \ + -H "X-API-Key: YOUR_MPC_API_KEY" \ + -H "Content-Type: application/json" \ + -d '{"message": "tx_hash"}' +``` + +### Server Party API (Port 8083) + +```bash +# Generate user share +curl -X POST http://localhost:8083/api/v1/shares/generate \ + -H "X-API-Key: YOUR_MPC_API_KEY" \ + -H "Content-Type: application/json" \ + -d '{"session_id": "session123"}' +``` + +## Getting Help + +- Check logs: `./deploy.sh logs` +- Health check: `./deploy.sh health` +- View commands: `./deploy.sh help` +- Review `.env.example` for configuration options + +## License + +Copyright ยฉ 2024 RWADurian. All rights reserved. diff --git a/backend/mpc-system/deploy.sh b/backend/mpc-system/deploy.sh index 22f0a442..e3da2c0c 100644 --- a/backend/mpc-system/deploy.sh +++ b/backend/mpc-system/deploy.sh @@ -2,8 +2,13 @@ # ============================================================================= # MPC System - Deployment Script # ============================================================================= -# ้ƒจ็ฝฒไฝ็ฝฎ: 192.168.1.100 (Nginx + MPC ๆœๅŠกๅ™จ) -# ๅฏนๅค–็ซฏๅฃ: 4000 (Account Service HTTP) - ไพ› mpc-service ่ฐƒ็”จ +# This script manages the MPC System Docker services +# +# External Ports: +# 4000 - Account Service HTTP API +# 8081 - Session Coordinator API +# 8082 - Message Router WebSocket +# 8083 - Server Party API (user share generation) # ============================================================================= set -e @@ -25,14 +30,21 @@ cd "$SCRIPT_DIR" # Load environment if [ -f ".env" ]; then - export $(cat .env | grep -v '^#' | xargs) -elif [ -f ".env.production" ]; then - export $(cat .env.production | grep -v '^#' | xargs) + log_info "Loading environment from .env file" + set -a + source .env + set +a +elif [ ! -f ".env" ] && [ -f ".env.example" ]; then + log_warn ".env file not found. Creating from .env.example" + log_warn "Please edit .env and configure for your environment!" + cp .env.example .env + log_error "Please configure .env file and run again" + exit 1 fi # Core services list CORE_SERVICES="postgres redis rabbitmq" -MPC_SERVICES="session-coordinator message-router server-party-1 server-party-2 server-party-3 account-service" +MPC_SERVICES="session-coordinator message-router server-party-1 server-party-2 server-party-3 server-party-api account-service" ALL_SERVICES="$CORE_SERVICES $MPC_SERVICES" case "$1" in diff --git a/backend/mpc-system/docker-compose.yml b/backend/mpc-system/docker-compose.yml index b8554ce4..33ed63dc 100644 --- a/backend/mpc-system/docker-compose.yml +++ b/backend/mpc-system/docker-compose.yml @@ -1,12 +1,18 @@ +# ============================================================================= # MPC-System Docker Compose Configuration -# ้ƒจ็ฝฒไฝ็ฝฎ: 192.168.1.100 (Nginx + MPC ๆœๅŠกๅ™จ) -# ็”จ้€”: TSS ๅฏ†้’ฅ็”Ÿๆˆใ€็ญพๅๆœๅŠก +# ============================================================================= +# Purpose: TSS (Threshold Signature Scheme) key generation and signing service # -# ๅฏๅŠจๅ‘ฝไปค: -# ็”Ÿไบง็Žฏๅขƒ: docker compose --env-file .env.production up -d -# ๅผ€ๅ‘็Žฏๅขƒ: docker compose up -d +# Usage: +# Development: docker compose up -d +# Production: docker compose --env-file .env up -d # -# ๅฏนๅค–็ซฏๅฃ: 4000 (Account Service HTTP) - ไพ› mpc-service (192.168.1.111:3001) ่ฐƒ็”จ +# External Ports: +# 4000 - Account Service HTTP API (accessed by backend mpc-service) +# 8081 - Session Coordinator API (accessed by backend mpc-service) +# 8082 - Message Router WebSocket (accessed by backend mpc-service) +# 8083 - Server Party API (accessed by backend mpc-service for user share generation) +# ============================================================================= services: # ============================================ @@ -20,7 +26,7 @@ services: environment: POSTGRES_DB: mpc_system POSTGRES_USER: ${POSTGRES_USER:-mpc_user} - POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-mpc_secret_password} + POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in .env} volumes: - postgres-data:/var/lib/postgresql/data - ./migrations:/docker-entrypoint-initdb.d:ro @@ -59,7 +65,7 @@ services: container_name: mpc-rabbitmq environment: RABBITMQ_DEFAULT_USER: ${RABBITMQ_USER:-mpc_user} - RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD:-mpc_rabbit_password} + RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD:?RABBITMQ_PASSWORD must be set in .env} RABBITMQ_DEFAULT_VHOST: / volumes: - rabbitmq-data:/var/lib/rabbitmq @@ -87,8 +93,7 @@ services: dockerfile: services/session-coordinator/Dockerfile container_name: mpc-session-coordinator ports: - # ๅฏนๅค–ๆšด้œฒ็ซฏๅฃ 8081๏ผŒไพ› mpc-service ่ฐƒ็”จ - - "8081:8080" + - "8081:8080" # HTTP API for external access environment: MPC_SERVER_GRPC_PORT: 50051 MPC_SERVER_HTTP_PORT: 8080 @@ -96,7 +101,7 @@ services: MPC_DATABASE_HOST: postgres MPC_DATABASE_PORT: 5432 MPC_DATABASE_USER: ${POSTGRES_USER:-mpc_user} - MPC_DATABASE_PASSWORD: ${POSTGRES_PASSWORD:-mpc_secret_password} + MPC_DATABASE_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set} MPC_DATABASE_DBNAME: mpc_system MPC_DATABASE_SSLMODE: disable MPC_REDIS_HOST: redis @@ -105,7 +110,7 @@ services: MPC_RABBITMQ_HOST: rabbitmq MPC_RABBITMQ_PORT: 5672 MPC_RABBITMQ_USER: ${RABBITMQ_USER:-mpc_user} - MPC_RABBITMQ_PASSWORD: ${RABBITMQ_PASSWORD:-mpc_rabbit_password} + MPC_RABBITMQ_PASSWORD: ${RABBITMQ_PASSWORD:?RABBITMQ_PASSWORD must be set} MPC_JWT_SECRET_KEY: ${JWT_SECRET_KEY} MPC_JWT_ISSUER: mpc-system depends_on: @@ -132,8 +137,7 @@ services: dockerfile: services/message-router/Dockerfile container_name: mpc-message-router ports: - # ๅฏนๅค–ๆšด้œฒ็ซฏๅฃ 8082๏ผŒไพ› mpc-service WebSocket ่ฟžๆŽฅ - - "8082:8080" + - "8082:8080" # WebSocket for external connections environment: MPC_SERVER_GRPC_PORT: 50051 MPC_SERVER_HTTP_PORT: 8080 @@ -141,13 +145,13 @@ services: MPC_DATABASE_HOST: postgres MPC_DATABASE_PORT: 5432 MPC_DATABASE_USER: ${POSTGRES_USER:-mpc_user} - MPC_DATABASE_PASSWORD: ${POSTGRES_PASSWORD:-mpc_secret_password} + MPC_DATABASE_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set} MPC_DATABASE_DBNAME: mpc_system MPC_DATABASE_SSLMODE: disable MPC_RABBITMQ_HOST: rabbitmq MPC_RABBITMQ_PORT: 5672 MPC_RABBITMQ_USER: ${RABBITMQ_USER:-mpc_user} - MPC_RABBITMQ_PASSWORD: ${RABBITMQ_PASSWORD:-mpc_rabbit_password} + MPC_RABBITMQ_PASSWORD: ${RABBITMQ_PASSWORD:?RABBITMQ_PASSWORD must be set} depends_on: postgres: condition: service_healthy @@ -181,7 +185,7 @@ services: MPC_DATABASE_HOST: postgres MPC_DATABASE_PORT: 5432 MPC_DATABASE_USER: ${POSTGRES_USER:-mpc_user} - MPC_DATABASE_PASSWORD: ${POSTGRES_PASSWORD:-mpc_secret_password} + MPC_DATABASE_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set} MPC_DATABASE_DBNAME: mpc_system MPC_DATABASE_SSLMODE: disable SESSION_COORDINATOR_ADDR: session-coordinator:50051 @@ -218,7 +222,7 @@ services: MPC_DATABASE_HOST: postgres MPC_DATABASE_PORT: 5432 MPC_DATABASE_USER: ${POSTGRES_USER:-mpc_user} - MPC_DATABASE_PASSWORD: ${POSTGRES_PASSWORD:-mpc_secret_password} + MPC_DATABASE_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set} MPC_DATABASE_DBNAME: mpc_system MPC_DATABASE_SSLMODE: disable SESSION_COORDINATOR_ADDR: session-coordinator:50051 @@ -255,7 +259,7 @@ services: MPC_DATABASE_HOST: postgres MPC_DATABASE_PORT: 5432 MPC_DATABASE_USER: ${POSTGRES_USER:-mpc_user} - MPC_DATABASE_PASSWORD: ${POSTGRES_PASSWORD:-mpc_secret_password} + MPC_DATABASE_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set} MPC_DATABASE_DBNAME: mpc_system MPC_DATABASE_SSLMODE: disable SESSION_COORDINATOR_ADDR: session-coordinator:50051 @@ -280,9 +284,9 @@ services: restart: unless-stopped # ============================================ - # Server Party API - ็”จๆˆท Share ็”ŸๆˆๆœๅŠก - # ็ซฏๅฃ 8083: ไพ› mpc-service ่ฐƒ็”จ๏ผŒ็”Ÿๆˆ็”จๆˆท็š„ share ๅนถ่ฟ”ๅ›ž - # ไธŽๅ…ถไป– server-party ไธๅŒ๏ผŒๆญคๆœๅŠกไธๅญ˜ๅ‚จ share๏ผŒ่€Œๆ˜ฏ็›ดๆŽฅ่ฟ”ๅ›ž็ป™่ฐƒ็”จๆ–น + # Server Party API - User Share Generation Service + # Unlike other server-party services, this one returns shares to the caller + # instead of storing them internally # ============================================ server-party-api: build: @@ -290,8 +294,7 @@ services: dockerfile: services/server-party-api/Dockerfile container_name: mpc-server-party-api ports: - # ๅฏนๅค–ๆšด้œฒ็ซฏๅฃ 8083๏ผŒไพ› mpc-service ่ฐƒ็”จ็”Ÿๆˆ็”จๆˆท share - - "8083:8080" + - "8083:8080" # HTTP API for user share generation environment: MPC_SERVER_HTTP_PORT: 8080 MPC_SERVER_ENVIRONMENT: ${ENVIRONMENT:-production} @@ -316,8 +319,8 @@ services: restart: unless-stopped # ============================================ - # Account Service - ๅฏนๅค– API ๅ…ฅๅฃ - # ็ซฏๅฃ 4000: ไพ› mpc-service (192.168.1.111:3001) ่ฐƒ็”จ + # Account Service - External API Entry Point + # Main HTTP API for backend mpc-service integration # ============================================ account-service: build: @@ -325,8 +328,7 @@ services: dockerfile: services/account/Dockerfile container_name: mpc-account-service ports: - # ๅฏนๅค–ๆšด้œฒ็ซฏๅฃ 4000๏ผŒไพ›ๅŽ็ซฏๆœๅŠกๅ™จ (192.168.1.111) ็š„ mpc-service ่ฐƒ็”จ - - "4000:8080" + - "4000:8080" # HTTP API for external access environment: MPC_SERVER_GRPC_PORT: 50051 MPC_SERVER_HTTP_PORT: 8080 @@ -334,7 +336,7 @@ services: MPC_DATABASE_HOST: postgres MPC_DATABASE_PORT: 5432 MPC_DATABASE_USER: ${POSTGRES_USER:-mpc_user} - MPC_DATABASE_PASSWORD: ${POSTGRES_PASSWORD:-mpc_secret_password} + MPC_DATABASE_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set} MPC_DATABASE_DBNAME: mpc_system MPC_DATABASE_SSLMODE: disable MPC_REDIS_HOST: redis @@ -343,13 +345,14 @@ services: MPC_RABBITMQ_HOST: rabbitmq MPC_RABBITMQ_PORT: 5672 MPC_RABBITMQ_USER: ${RABBITMQ_USER:-mpc_user} - MPC_RABBITMQ_PASSWORD: ${RABBITMQ_PASSWORD:-mpc_rabbit_password} + MPC_RABBITMQ_PASSWORD: ${RABBITMQ_PASSWORD:?RABBITMQ_PASSWORD must be set} MPC_COORDINATOR_URL: session-coordinator:50051 MPC_JWT_SECRET_KEY: ${JWT_SECRET_KEY} # API ่ฎค่ฏๅฏ†้’ฅ (ไธŽ mpc-service ้…็ฝฎ็š„ MPC_API_KEY ไธ€่‡ด) MPC_API_KEY: ${MPC_API_KEY} - # ๅ…่ฎธ็š„ๆฅๆบ IP (ๅŽ็ซฏๆœๅŠกๅ™จ) - ALLOWED_IPS: ${ALLOWED_IPS:-192.168.1.111} + # Allowed source IPs (backend servers) + # Empty default = allow all (protected by API_KEY). Set in .env for production! + ALLOWED_IPS: ${ALLOWED_IPS:-} depends_on: postgres: condition: service_healthy diff --git a/backend/mpc-system/services/account/Dockerfile b/backend/mpc-system/services/account/Dockerfile index f90d2d4d..e70acc6c 100644 --- a/backend/mpc-system/services/account/Dockerfile +++ b/backend/mpc-system/services/account/Dockerfile @@ -1,15 +1,11 @@ # Build stage FROM golang:1.21-alpine AS builder -# Use Aliyun mirror for Alpine packages (China acceleration) -RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories - RUN apk add --no-cache git ca-certificates -# Set Go proxy for China -ARG GOPROXY=https://goproxy.cn,https://goproxy.io,direct +# Set Go proxy (can be overridden with --build-arg GOPROXY=...) +ARG GOPROXY=https://proxy.golang.org,direct ENV GOPROXY=${GOPROXY} -ENV GOSUMDB=sum.golang.google.cn WORKDIR /app @@ -26,9 +22,6 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \ # Final stage FROM alpine:3.18 -# Use Aliyun mirror for Alpine packages (China acceleration) -RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories - RUN apk --no-cache add ca-certificates curl RUN adduser -D -s /bin/sh mpc diff --git a/backend/mpc-system/services/message-router/Dockerfile b/backend/mpc-system/services/message-router/Dockerfile index 2ab5be2b..2ab31071 100644 --- a/backend/mpc-system/services/message-router/Dockerfile +++ b/backend/mpc-system/services/message-router/Dockerfile @@ -1,15 +1,11 @@ # Build stage FROM golang:1.21-alpine AS builder -# Use Aliyun mirror for Alpine packages (China acceleration) -RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories - RUN apk add --no-cache git ca-certificates -# Set Go proxy for China -ARG GOPROXY=https://goproxy.cn,https://goproxy.io,direct +# Set Go proxy (can be overridden with --build-arg GOPROXY=...) +ARG GOPROXY=https://proxy.golang.org,direct ENV GOPROXY=${GOPROXY} -ENV GOSUMDB=sum.golang.google.cn WORKDIR /app @@ -26,9 +22,6 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \ # Final stage FROM alpine:3.18 -# Use Aliyun mirror for Alpine packages (China acceleration) -RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories - RUN apk --no-cache add ca-certificates curl RUN adduser -D -s /bin/sh mpc diff --git a/backend/mpc-system/services/server-party-api/Dockerfile b/backend/mpc-system/services/server-party-api/Dockerfile index 09e1adf5..d88506e9 100644 --- a/backend/mpc-system/services/server-party-api/Dockerfile +++ b/backend/mpc-system/services/server-party-api/Dockerfile @@ -1,15 +1,11 @@ # Build stage FROM golang:1.21-alpine AS builder -# Use Aliyun mirror for Alpine packages (China acceleration) -RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories - RUN apk add --no-cache git ca-certificates -# Set Go proxy for China -ARG GOPROXY=https://goproxy.cn,https://goproxy.io,direct +# Set Go proxy (can be overridden with --build-arg GOPROXY=...) +ARG GOPROXY=https://proxy.golang.org,direct ENV GOPROXY=${GOPROXY} -ENV GOSUMDB=sum.golang.google.cn WORKDIR /app @@ -26,9 +22,6 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \ # Final stage FROM alpine:3.18 -# Use Aliyun mirror for Alpine packages (China acceleration) -RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories - RUN apk --no-cache add ca-certificates curl RUN adduser -D -s /bin/sh mpc diff --git a/backend/mpc-system/services/server-party/Dockerfile b/backend/mpc-system/services/server-party/Dockerfile index c2b2a5f0..e5f21032 100644 --- a/backend/mpc-system/services/server-party/Dockerfile +++ b/backend/mpc-system/services/server-party/Dockerfile @@ -1,15 +1,11 @@ # Build stage FROM golang:1.21-alpine AS builder -# Use Aliyun mirror for Alpine packages (China acceleration) -RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories - RUN apk add --no-cache git ca-certificates -# Set Go proxy for China -ARG GOPROXY=https://goproxy.cn,https://goproxy.io,direct +# Set Go proxy (can be overridden with --build-arg GOPROXY=...) +ARG GOPROXY=https://proxy.golang.org,direct ENV GOPROXY=${GOPROXY} -ENV GOSUMDB=sum.golang.google.cn WORKDIR /app @@ -26,9 +22,6 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \ # Final stage FROM alpine:3.18 -# Use Aliyun mirror for Alpine packages (China acceleration) -RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories - RUN apk --no-cache add ca-certificates curl RUN adduser -D -s /bin/sh mpc diff --git a/backend/mpc-system/services/session-coordinator/Dockerfile b/backend/mpc-system/services/session-coordinator/Dockerfile index d8c17735..bbf335c8 100644 --- a/backend/mpc-system/services/session-coordinator/Dockerfile +++ b/backend/mpc-system/services/session-coordinator/Dockerfile @@ -1,16 +1,12 @@ # Build stage FROM golang:1.21-alpine AS builder -# Use Aliyun mirror for Alpine packages (China acceleration) -RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories - # Install dependencies RUN apk add --no-cache git ca-certificates -# Set Go proxy for China (use GOPROXY env from build args if provided) -ARG GOPROXY=https://goproxy.cn,https://goproxy.io,direct +# Set Go proxy (can be overridden with --build-arg GOPROXY=...) +ARG GOPROXY=https://proxy.golang.org,direct ENV GOPROXY=${GOPROXY} -ENV GOSUMDB=sum.golang.google.cn # Set working directory WORKDIR /app @@ -33,9 +29,6 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \ # Final stage FROM alpine:3.18 -# Use Aliyun mirror for Alpine packages (China acceleration) -RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories - # Install ca-certificates and curl for HTTPS and health check RUN apk --no-cache add ca-certificates curl