From dc68ae80725f84c7d3c7201ece7b99763ec3a1db Mon Sep 17 00:00:00 2001 From: defiQUG Date: Tue, 24 Mar 2026 16:18:29 -0700 Subject: [PATCH] chore: BSC relay fund script, CCIP RTT report, NPM proxy fixes, submodule - Add scripts/bridge/fund-bsc-relay-bridge.sh (mirror mainnet helper) - Add reports/ccip-rtt-138-bsc-source-execution-2026-03-24.json (5/5 baseline) - update-npmplus-proxy-hosts-api: case-insensitive host id, refresh on miss, recover duplicate POST via PUT, add-if-missing for dbis-api-2, secure, mim4u* - smom-dbis-138: relay log chunking, START_BLOCK parsing, README, .env.bsc.example Made-with: Cursor --- ...t-138-bsc-source-execution-2026-03-24.json | 118 +++++++++++++ scripts/bridge/fund-bsc-relay-bridge.sh | 62 +++++++ .../update-npmplus-proxy-hosts-api.sh | 165 ++++++++++++------ smom-dbis-138 | 2 +- 4 files changed, 294 insertions(+), 53 deletions(-) create mode 100644 reports/ccip-rtt-138-bsc-source-execution-2026-03-24.json create mode 100755 scripts/bridge/fund-bsc-relay-bridge.sh diff --git a/reports/ccip-rtt-138-bsc-source-execution-2026-03-24.json b/reports/ccip-rtt-138-bsc-source-execution-2026-03-24.json new file mode 100644 index 0000000..5aa3d6c --- /dev/null +++ b/reports/ccip-rtt-138-bsc-source-execution-2026-03-24.json @@ -0,0 +1,118 @@ +{ + "schema_version": "rtt-baseline-v1", + "series_id": "138-bsc-weth-0.001-2026-03-24T08:14Z", + "collected_at_utc": "2026-03-24T08:14:00Z", + "chain_pair": "138 → BSC (56)", + "payload_type": "weth_ccip", + "amount_wei": "1000000000000000", + "lane_label": "operator-baseline-5x", + "destination_lookup_provider": "ccip_explorer", + "notes": [ + "Each broadcast used GAS_LIMIT=1200000; Core RPC http://192.168.11.211:8545 returned Invalid params on eth_estimateGas without explicit gas.", + "CCIP_DEST_CHAIN_SELECTOR=11344663589394136015. Bridge 0xcacfd227A040002e49e2e01626363071324f820a. BSC receiver 0x886C6A4ABC064dbf74E7caEc460b7eeC31F1b78C.", + "BSC destination lookup: binance dataseed often returns -32005 on eth_getLogs; https://bsc.publicnode.com accepted ~10-block windows for CrossChainTransferCompleted(bytes32,uint64,address,uint256) on the relay bridge. CCIP Explorer / BscScan / API keys remain valid fallbacks.", + "2026-03-24: RelayService eth_getLogs chunking + adaptive split (SOURCE_LOGS_MAX_BLOCK_RANGE) fixes public-RPC range errors. BSC relay bridge under-funded caused relayMessage reverts; wrapped BNB to WETH and transferred to 0x886C6A4ABC064dbf74E7caEc460b7eeC31F1b78C. Runs 1–2 delivered first; runs 3–5 after second top-up: WETH transfer 0x8f3529250dc10b0cadab3f549da6e90a6e2f0ddc380c05672295dc5389fc96e2 (0.003 WETH) then ./start-relay.sh bsc. Destination logs via bsc.publicnode.com (small eth_getLogs windows). RTT for runs 3–5 includes long queue before relay." + ], + "source_rpc_used_for_metadata": "https://rpc.public-0138.defi-oracle.io", + "write_rpc": "http://192.168.11.211:8545", + "execution_log": "reports/ccip-rtt-138-bsc-execution-20260324T0815Z.log", + "last_validation_at_utc": "2026-03-24T18:33:25Z", + "validation": { + "rtt_metrics_status": "complete_5_of_5", + "source_only": { + "message_ids_unique": true, + "source_timestamps_strictly_increasing": true, + "source_timestamp_deltas_seconds": [10, 124, 124, 124], + "notes": "Deltas align with ~120s send spacing plus block time." + }, + "destination_sample": { + "runs_completed": 5, + "runs_pending_bridge_liquidity": 0, + "notes": "processedTransfers true for all five messageIds; destination txs match BSC receipts. Runs 1–2 destination_block_number corrected 2026-03-24 to cast receipt blockNumber (timestamps/RTT unchanged)." + } + }, + "runs": [ + { + "run": 1, + "ccip_message_id": "0x6580c9070587976ef0582f9c537312d4b7a44fc9e8009a011677f2279ba54de1", + "source_tx_hash": "0xa17467afd88ca42ba5a7ab91a15d1ca4ad1e180c97664b1dbca09cb5334a5536", + "source_block_number": "0x310b2d", + "source_block_timestamp": 1774340097, + "destination_tx_hash": "0x12786ddf80adf2b9146587084a39f68fd204412190284113e32f9f09171f91c7", + "destination_block_number": "0x5458354", + "destination_block_timestamp": 1774347496, + "rtt_seconds": 7399, + "execution_status": "success", + "validation_status": "complete" + }, + { + "run": 2, + "ccip_message_id": "0x68dca207836fb9fd5e5bffd2dd52e229490e054177d3e2995e79a35404d1e03f", + "source_tx_hash": "0x55e2b019b79b3dac9aace339cf3d258a0f987bf1ddec06d9e16207758bf5cb5c", + "source_block_number": "0x310b32", + "source_block_timestamp": 1774340107, + "destination_tx_hash": "0x9bc7cd898cd5a06a52f0a0852602d6f9fbca240a35746bd661283b3bb7d7c7b0", + "destination_block_number": "0x5458360", + "destination_block_timestamp": 1774347502, + "rtt_seconds": 7395, + "execution_status": "success", + "validation_status": "complete" + }, + { + "run": 3, + "ccip_message_id": "0x26da416a650ecb37d72cda0c029160a288343511695af60b9ae3d8695ce79d8a", + "source_tx_hash": "0x72c3c947a6812685fb4addde3c49ad9b7e93190ddb8a3e970ec2ba33164a4520", + "source_block_number": "0x310b70", + "source_block_timestamp": 1774340231, + "destination_tx_hash": "0xe6501404232e46baf7af96e953e47f64ed9fc92c02bbc7d051ce5e88b08f4167", + "destination_block_number": "0x5465efc", + "destination_block_timestamp": 1774372806, + "rtt_seconds": 32575, + "execution_status": "success", + "validation_status": "complete" + }, + { + "run": 4, + "ccip_message_id": "0x215582078002ad191e05d30fe6145e53d735e6a71288bfa94bd23a465ead3f7f", + "source_tx_hash": "0x0dff75f13088927fc4d2ee3f76941f006369f3ac9b426a82b57ff7e2f5542ed5", + "source_block_number": "0x310bae", + "source_block_timestamp": 1774340355, + "destination_tx_hash": "0xd0312a148e1ef5914efd0eeb2e5cd4f93f37aa18e5cf0b16f226922d17bcdbbf", + "destination_block_number": "0x5465f07", + "destination_block_timestamp": 1774372811, + "rtt_seconds": 32456, + "execution_status": "success", + "validation_status": "complete" + }, + { + "run": 5, + "ccip_message_id": "0xa9c00243b446ad18240e3b3fdf7644559385e68515bf4339a4900334b6ab5945", + "source_tx_hash": "0x7caa60ec028000255328c97570235106072967142869b6f3bf5a8a64db2c3c85", + "source_block_number": "0x310bec", + "source_block_timestamp": 1774340479, + "destination_tx_hash": "0xd1047eefb7e75a58ef60e551a7d8ff69fede94790a5bd2b2dde8b756d5852401", + "destination_block_number": "0x5465f12", + "destination_block_timestamp": 1774372816, + "rtt_seconds": 32337, + "execution_status": "success", + "validation_status": "complete" + } + ], + "failed_runs": [], + "summary": { + "successful_runs": 5, + "failed_runs": 0, + "median_rtt_seconds": 32337, + "worst_case_rtt_seconds": 32575, + "best_case_rtt_seconds": 7395, + "range_rtt_seconds": 25180, + "p95_rtt_seconds": null, + "p95_note": "N/A (N<20)", + "p99_rtt_seconds": null, + "p99_note": "N/A (N<20)", + "timeout_seconds": 40719, + "min_spacing_seconds": 7399, + "summary_generated_at_utc": "2026-03-24T18:33:25Z", + "summary_note": "All 5 runs delivered. Runs 1–2 RTT ~2.05 h (normal relay path). Runs 3–5 RTT ~9 h each because messages queued until second WETH top-up. timeout_seconds = ceil(32575*1.25). min_spacing_seconds left as prior worst-case source→dest for early pair; use destination inter-arrival if you need relay-batch spacing." + } +} diff --git a/scripts/bridge/fund-bsc-relay-bridge.sh b/scripts/bridge/fund-bsc-relay-bridge.sh new file mode 100755 index 0000000..14de3c4 --- /dev/null +++ b/scripts/bridge/fund-bsc-relay-bridge.sh @@ -0,0 +1,62 @@ +#!/usr/bin/env bash +# Fund the BSC CCIPRelayBridge with WETH from the deployer wallet. +# Usage: ./scripts/bridge/fund-bsc-relay-bridge.sh [amount_wei] [--dry-run] +# If amount_wei is omitted, transfers the deployer's full WETH balance. +# --dry-run: print balances and amount that would be sent; do not broadcast. +# Env: PRIVATE_KEY (not required for --dry-run), BSC_RPC_URL or DEST_RPC_URL from relay profile +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)" +[[ -f "${PROJECT_ROOT}/smom-dbis-138/.env" ]] && source "${PROJECT_ROOT}/smom-dbis-138/.env" 2>/dev/null || true +# Optional: DEST_RPC_URL from relay .env.bsc (not auto-sourced; user may export) +if [[ -f "${PROJECT_ROOT}/smom-dbis-138/services/relay/.env.bsc" ]]; then + # shellcheck disable=SC1090 + source "${PROJECT_ROOT}/smom-dbis-138/services/relay/.env.bsc" 2>/dev/null || true +fi + +DRY_RUN=false +ARGS=() +for a in "$@"; do + [[ "$a" = "--dry-run" ]] && DRY_RUN=true || ARGS+=("$a") +done + +DEPLOYER="${DEPLOYER_ADDRESS:-0x4A666F96fC8764181194447A7dFdb7d471b301C8}" +WETH="${DEST_WETH9_ADDRESS:-0xe0E93247376aa097dB308B92e6Ba36bA015535D0}" +BRIDGE="${DEST_RELAY_BRIDGE:-0x886C6A4ABC064dbf74E7caEc460b7eeC31F1b78C}" +RPC="${BSC_RPC_URL:-${DEST_RPC_URL:-https://bsc.publicnode.com}}" + +[[ "$DRY_RUN" = true ]] || [[ -n "${PRIVATE_KEY:-}" ]] || { echo "PRIVATE_KEY required"; exit 1; } +command -v cast &>/dev/null || { echo "cast not found (install Foundry)"; exit 1; } + +BALANCE=$(cast call "$WETH" "balanceOf(address)(uint256)" "$DEPLOYER" --rpc-url "$RPC" 2>/dev/null || echo "0") +BRIDGE_BAL=$(cast call "$WETH" "balanceOf(address)(uint256)" "$BRIDGE" --rpc-url "$RPC" 2>/dev/null || echo "0") +echo "Deployer WETH balance (BSC): $BALANCE wei" +echo "Bridge WETH balance (BSC): $BRIDGE_BAL wei" + +if [[ "${ARGS[0]:-}" = "" ]]; then + AMT="$BALANCE" + echo "Would transfer full balance: $AMT wei" +else + AMT="${ARGS[0]}" + echo "Would transfer: $AMT wei" +fi + +if [[ -z "$AMT" ]] || [[ "$AMT" = "0" ]]; then + echo "Nothing to transfer." + [[ "$DRY_RUN" = true ]] && echo "[--dry-run] No tx would be sent." + exit 0 +fi + +if [[ "$DRY_RUN" = true ]]; then + echo "[--dry-run] Would run: cast send $WETH transfer(address,uint256) $BRIDGE $AMT --rpc-url --private-key --legacy" + echo "[--dry-run] No transaction sent." + exit 0 +fi + +cast send "$WETH" "transfer(address,uint256)" "$BRIDGE" "$AMT" \ + --rpc-url "$RPC" \ + --private-key "$PRIVATE_KEY" \ + --legacy + +echo "Done. Bridge WETH balance: $(cast call "$WETH" "balanceOf(address)(uint256)" "$BRIDGE" --rpc-url "$RPC") wei" diff --git a/scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh b/scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh index 3261ff8..07942ff 100755 --- a/scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh +++ b/scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh @@ -1,4 +1,6 @@ #!/usr/bin/env bash +# Security: do not use `bash -x` or `curl -v` when debugging auth in production — logs may capture secrets. +# Auth failures: only a short error message is printed by default. For a redacted JSON snippet set NPM_DEBUG_AUTH=1. set -euo pipefail # Load IP configuration @@ -8,7 +10,8 @@ source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true # Update existing NPMplus proxy hosts via API with correct VMIDs and IPs -# This script updates existing proxy hosts, not creates new ones +# This script updates existing proxy hosts, not creates new ones. +# PUT payload includes only forward_* / websocket / block_exploits — existing certificate_id and ssl_forced are preserved by NPMplus. set -e @@ -37,7 +40,7 @@ fi [ -n "$_orig_npm_password" ] && NPM_PASSWORD="$_orig_npm_password" [ -f "$PROJECT_ROOT/config/ip-addresses.conf" ] && source "$PROJECT_ROOT/config/ip-addresses.conf" 2>/dev/null || true -# Default .167: NPMplus (VMID 10233) reachable on ${IP_NPMPLUS:-${IP_NPMPLUS:-192.168.11.167}}:81; set NPM_URL in .env to override +# Default: NPMplus (VMID 10233) — IP_NPMPLUS from config/ip-addresses.conf (prefer eth1 / .167); override with NPM_URL in .env NPM_URL="${NPM_URL:-https://${IP_NPMPLUS}:81}" NPM_EMAIL="${NPM_EMAIL:-nsatoshi2007@hotmail.com}" NPM_PASSWORD="${NPM_PASSWORD:-}" @@ -53,28 +56,44 @@ echo "🔄 Updating NPMplus Proxy Hosts via API" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" echo "" -# Connection check (NPMplus is on LAN 192.168.11.x). Try alternate IP if .166/.167 unreachable. +# NPMplus API can stall indefinitely without --max-time (override e.g. NPM_CURL_MAX_TIME=300) +NPM_CURL_MAX_TIME="${NPM_CURL_MAX_TIME:-120}" +curl_npm() { curl -s -k --connect-timeout 10 --max-time "$NPM_CURL_MAX_TIME" "$@"; } + +# Connection check (NPMplus is on LAN 192.168.11.x). Try HTTP if HTTPS fails; try alternate IP .166/.167 if unreachable. echo "🔐 Authenticating to NPMplus..." -if ! curl -s -k -o /dev/null --connect-timeout 5 "$NPM_URL/" 2>/dev/null; then - alt_url="" - if [[ "$NPM_URL" == *"192.168.11.166"* ]]; then - alt_url="${NPM_URL//192.168.11.166/192.168.11.167}" - elif [[ "$NPM_URL" == *"192.168.11.167"* ]]; then - alt_url="${NPM_URL//192.168.11.167/192.168.11.166}" - fi - if [ -n "$alt_url" ] && curl -s -k -o /dev/null --connect-timeout 5 "$alt_url/" 2>/dev/null; then - NPM_URL="$alt_url" - echo " Using alternate NPMplus URL: $NPM_URL" +try_connect() { curl -s -k -o /dev/null --connect-timeout 5 --max-time 15 "$1" 2>/dev/null; } +if ! try_connect "$NPM_URL/"; then + # Try HTTP instead of HTTPS (NPM admin often listens on HTTP only on port 81) + http_url="${NPM_URL/https:/http:}" + if try_connect "$http_url/"; then + NPM_URL="$http_url" + echo " Using HTTP (HTTPS timed out): $NPM_URL" else - echo "❌ Cannot connect to NPMplus at $NPM_URL" - [ -n "$alt_url" ] && echo " Tried alternate: $alt_url" - echo " Run this script from a host on the same LAN as NPMplus (e.g. 192.168.11.x). Ensure container 10233 is running." - exit 1 + alt_url="" + if [[ "$NPM_URL" == *"${IP_NPMPLUS_ETH0}"* ]]; then + alt_url="https://${IP_NPMPLUS}:81" + elif [[ "$NPM_URL" == *"${IP_NPMPLUS}"* ]] || [[ "$NPM_URL" == *"${IP_NPMPLUS_ETH1}"* ]]; then + alt_url="https://${IP_NPMPLUS_ETH0}:81" + fi + connected="" + if [ -n "$alt_url" ] && try_connect "$alt_url/"; then connected="$alt_url"; fi + if [ -z "$connected" ] && [ -n "$alt_url" ] && try_connect "${alt_url/https:/http:}/"; then connected="${alt_url/https:/http:}"; fi + if [ -n "$connected" ]; then + NPM_URL="$connected" + echo " Using alternate NPMplus URL: $NPM_URL" + else + echo "❌ Cannot connect to NPMplus at $NPM_URL" + [ -n "$alt_url" ] && echo " Tried alternate: $alt_url and ${alt_url/https:/http:}" + echo " Try in browser: http://${IP_NPMPLUS}:81 (not https). If not on LAN, use SSH tunnel: ssh -L 8181:${IP_NPMPLUS}:81 -N root@${PROXMOX_HOST_R630_01} then http://127.0.0.1:8181" + echo " Run this script from a host on the same LAN as NPMplus. Ensure container 10233 is running." + exit 1 + fi fi fi AUTH_JSON=$(jq -n --arg identity "$NPM_EMAIL" --arg secret "$NPM_PASSWORD" '{identity:$identity,secret:$secret}') -TOKEN_RESPONSE=$(curl -s -k -X POST "$NPM_URL/api/tokens" \ +TOKEN_RESPONSE=$(curl_npm -X POST "$NPM_URL/api/tokens" \ -H "Content-Type: application/json" \ -d "$AUTH_JSON") @@ -83,10 +102,11 @@ TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.token // empty' 2>/dev/null || echo "") if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then ERROR_MSG=$(echo "$TOKEN_RESPONSE" | jq -r '.message // .error.message // .error // "Unknown error"' 2>/dev/null || echo "") echo "❌ Authentication failed: ${ERROR_MSG:-No token in response}" - # Show response (first 300 chars) to help debug - RESP_PREVIEW=$(echo "$TOKEN_RESPONSE" | head -c 300) - if [ -n "$RESP_PREVIEW" ]; then - echo " Response: $RESP_PREVIEW" + if [ "${NPM_DEBUG_AUTH:-0}" = "1" ]; then + # Strip .token from body before preview (never print bearer tokens) + RESP_PREVIEW=$(echo "$TOKEN_RESPONSE" | jq -c 'del(.token) | del(.data)' 2>/dev/null | head -c 300) + [ -z "$RESP_PREVIEW" ] && RESP_PREVIEW=$(echo "$TOKEN_RESPONSE" | head -c 200) + echo " Debug (NPM_DEBUG_AUTH=1, token field stripped if jq OK): $RESP_PREVIEW" fi exit 1 fi @@ -96,7 +116,7 @@ echo "" # Get all proxy hosts echo "📋 Fetching existing proxy hosts..." -PROXY_HOSTS_JSON=$(curl -s -k -X GET "$NPM_URL/api/nginx/proxy-hosts" \ +PROXY_HOSTS_JSON=$(curl_npm -X GET "$NPM_URL/api/nginx/proxy-hosts" \ -H "Authorization: Bearer $TOKEN") if [ $? -ne 0 ]; then @@ -104,6 +124,16 @@ if [ $? -ne 0 ]; then exit 1 fi +# Match proxy host id by domain (case-insensitive). Avoids "not found" when NPM stores different casing. +resolve_proxy_host_id() { + local domain="$1" + local json="${2:-$PROXY_HOSTS_JSON}" + echo "$json" | jq -r --arg d "$domain" ' + .[] | select(.domain_names | type == "array") | + select(any(.domain_names[]; (. | tostring | ascii_downcase) == ($d | ascii_downcase))) | + .id' 2>/dev/null | head -n1 +} + # Function to add proxy host (POST) when domain does not exist add_proxy_host() { local domain=$1 @@ -133,7 +163,7 @@ add_proxy_host() { return 1 fi local resp - resp=$(curl -s -k -X POST "$NPM_URL/api/nginx/proxy-hosts" \ + resp=$(curl_npm -X POST "$NPM_URL/api/nginx/proxy-hosts" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "$payload" 2>/dev/null) @@ -146,6 +176,15 @@ add_proxy_host() { local err err=$(echo "$resp" | jq -r '.message // .error // "unknown"' 2>/dev/null) echo " ❌ Add failed for $domain: $err" + if echo "$err" | grep -qiE 'already|in use|exist|duplicate|unique'; then + echo " ↪ Host likely exists; refreshing list and attempting PUT update..." + PROXY_HOSTS_JSON=$(curl_npm -X GET "$NPM_URL/api/nginx/proxy-hosts" \ + -H "Authorization: Bearer $TOKEN") + if update_proxy_host "$domain" "http://${forward_host}:${forward_port}" "$websocket" "$block_exploits"; then + echo " ✅ Updated after duplicate-create error: $domain" + return 0 + fi + fi return 1 fi } @@ -170,9 +209,14 @@ update_proxy_host() { port=$(echo "$target" | sed -E 's|^https://[^:]+:([0-9]+).*|\1|' || echo "443") fi - # Get host ID - domain_names is an array in the API response - HOST_ID=$(echo "$PROXY_HOSTS_JSON" | jq -r ".[] | select(.domain_names | type == \"array\") | select(.domain_names[] == \"$domain\") | .id" 2>/dev/null | head -n1 || echo "") - + # Get host ID (case-insensitive); refresh once if missing (stale list / race with other writers) + HOST_ID=$(resolve_proxy_host_id "$domain" "$PROXY_HOSTS_JSON") + if [ -z "$HOST_ID" ] || [ "$HOST_ID" = "null" ]; then + echo "📋 Refreshing proxy host list (retry lookup for $domain)..." + PROXY_HOSTS_JSON=$(curl_npm -X GET "$NPM_URL/api/nginx/proxy-hosts" \ + -H "Authorization: Bearer $TOKEN") + HOST_ID=$(resolve_proxy_host_id "$domain" "$PROXY_HOSTS_JSON") + fi if [ -z "$HOST_ID" ] || [ "$HOST_ID" = "null" ]; then echo "⚠️ Domain $domain not found (skipping)" return 1 @@ -181,15 +225,15 @@ update_proxy_host() { echo "📋 Updating $domain (ID: $HOST_ID)..." # Create minimal update payload - NPMplus API only accepts specific fields - # block_exploits must be false for RPC so POST to / is allowed (JSON-RPC) - BLOCK_EXPLOITS_JSON="false" - [ "$block_exploits" = "true" ] && BLOCK_EXPLOITS_JSON="true" + # block_exploits must be false for RPC so POST to / is allowed (JSON-RPC); explicit false fixes 405 + local be_json="false" + [ "$block_exploits" = "true" ] && be_json="true" UPDATE_PAYLOAD=$(jq -n \ --arg scheme "$scheme" \ --arg hostname "$hostname" \ - --argjson port "$(echo "$port" | sed 's/[^0-9]//g')" \ + --argjson port "$(echo "$port" | sed 's/[^0-9]//g' || echo "80")" \ --argjson websocket "$websocket" \ - --argjson block_exploits "$BLOCK_EXPLOITS_JSON" \ + --argjson block_exploits "$be_json" \ '{ forward_scheme: $scheme, forward_host: $hostname, @@ -198,7 +242,7 @@ update_proxy_host() { block_exploits: $block_exploits }' 2>/dev/null || echo "") - UPDATE_RESPONSE=$(curl -s -k -X PUT "$NPM_URL/api/nginx/proxy-hosts/$HOST_ID" \ + UPDATE_RESPONSE=$(curl_npm -X PUT "$NPM_URL/api/nginx/proxy-hosts/$HOST_ID" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "$UPDATE_PAYLOAD") @@ -219,35 +263,52 @@ update_proxy_host() { updated_count=0 failed_count=0 -# Blockscout - Port 80 (nginx serves web UI, proxies /api/* to 4000 internally) +# Blockscout / SolaceScanScout (VMID 5000) - Port 80 (nginx serves web UI, proxies /api/* to 4000 internally) update_proxy_host "explorer.d-bis.org" "http://${IP_BLOCKSCOUT}:80" false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) -# RPC hosts: block_exploits must be false so POST to / works (JSON-RPC) -update_proxy_host "rpc-http-pub.d-bis.org" "http://${RPC_PUBLIC_1}:8545" true false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) -update_proxy_host "rpc-ws-pub.d-bis.org" "http://${RPC_PUBLIC_1}:8546" true false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) -update_proxy_host "rpc-http-prv.d-bis.org" "http://${RPC_CORE_1}:8545" true false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) -update_proxy_host "rpc-ws-prv.d-bis.org" "http://${RPC_CORE_1}:8546" true false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) +update_proxy_host "blockscout.defi-oracle.io" "http://${IP_BLOCKSCOUT}:80" false && updated_count=$((updated_count + 1)) || { add_proxy_host "blockscout.defi-oracle.io" "${IP_BLOCKSCOUT}" 80 false false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +# docs.d-bis.org — same backend as explorer; nginx on VMID 5000 must serve /transaction-explanation/ (see deploy README) +update_proxy_host "docs.d-bis.org" "http://${IP_BLOCKSCOUT}:80" false && updated_count=$((updated_count + 1)) || { add_proxy_host "docs.d-bis.org" "${IP_BLOCKSCOUT}" 80 false false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +# RPC hosts: block_exploits must be false so POST to / works (JSON-RPC). Add if missing to avoid 405. +update_proxy_host "rpc-http-pub.d-bis.org" "http://${RPC_PUBLIC_1}:8545" true false && updated_count=$((updated_count + 1)) || { add_proxy_host "rpc-http-pub.d-bis.org" "${RPC_PUBLIC_1}" 8545 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "rpc-ws-pub.d-bis.org" "http://${RPC_PUBLIC_1}:8546" true false && updated_count=$((updated_count + 1)) || { add_proxy_host "rpc-ws-pub.d-bis.org" "${RPC_PUBLIC_1}" 8546 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "rpc-http-prv.d-bis.org" "http://${RPC_CORE_1}:8545" true false && updated_count=$((updated_count + 1)) || { add_proxy_host "rpc-http-prv.d-bis.org" "${RPC_CORE_1}" 8545 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "rpc-ws-prv.d-bis.org" "http://${RPC_CORE_1}:8546" true false && updated_count=$((updated_count + 1)) || { add_proxy_host "rpc-ws-prv.d-bis.org" "${RPC_CORE_1}" 8546 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +# ThirdWeb Admin Core RPC — VMID ${RPC_THIRDWEB_ADMIN_CORE_VMID:-2103} @ ${RPC_THIRDWEB_ADMIN_CORE} (HTTPS + WSS via NPMplus; block_exploits off for JSON-RPC POST) +RPC_THIRDWEB_ADMIN_CORE="${RPC_THIRDWEB_ADMIN_CORE:-192.168.11.217}" +update_proxy_host "rpc.tw-core.d-bis.org" "http://${RPC_THIRDWEB_ADMIN_CORE}:8545" true false && updated_count=$((updated_count + 1)) || { add_proxy_host "rpc.tw-core.d-bis.org" "${RPC_THIRDWEB_ADMIN_CORE}" 8545 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "wss.tw-core.d-bis.org" "http://${RPC_THIRDWEB_ADMIN_CORE}:8546" true false && updated_count=$((updated_count + 1)) || { add_proxy_host "wss.tw-core.d-bis.org" "${RPC_THIRDWEB_ADMIN_CORE}" 8546 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +# Catch-all for foo.tw-core.d-bis.org → Besu HTTP JSON-RPC :8545 (exact rpc./wss. hosts above take precedence for nginx server_name) +update_proxy_host '*.tw-core.d-bis.org' "http://${RPC_THIRDWEB_ADMIN_CORE}:8545" true false && updated_count=$((updated_count + 1)) || { add_proxy_host '*.tw-core.d-bis.org' "${RPC_THIRDWEB_ADMIN_CORE}" 8545 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) # RPC Core-2 (Nathan) is on the THIRD NPMplus (192.168.11.169) — use add-rpc-core-2-npmplus-proxy.sh and update-npmplus-alltra-hybx-proxy-hosts.sh update_proxy_host "rpc.public-0138.defi-oracle.io" "https://${RPC_THIRDWEB_PRIMARY}:443" true false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) # rpc.defi-oracle.io / wss.defi-oracle.io → same backend as rpc-http-pub / rpc-ws-pub (VMID 2201) -update_proxy_host "rpc.defi-oracle.io" "http://${RPC_PUBLIC_1}:8545" true false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) -update_proxy_host "wss.defi-oracle.io" "http://${RPC_PUBLIC_1}:8546" true false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) -# rpc.d-bis.org / rpc2.d-bis.org and WS variants → VMID 2201 (besu-rpc-public-1) -update_proxy_host "rpc.d-bis.org" "http://${RPC_PUBLIC_1}:8545" true false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) -update_proxy_host "rpc2.d-bis.org" "http://${RPC_PUBLIC_1}:8545" true false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) -update_proxy_host "ws.rpc.d-bis.org" "http://${RPC_PUBLIC_1}:8546" true false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) -update_proxy_host "ws.rpc2.d-bis.org" "http://${RPC_PUBLIC_1}:8546" true false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) +update_proxy_host "rpc.defi-oracle.io" "http://${RPC_PUBLIC_1}:8545" true false && updated_count=$((updated_count + 1)) || { add_proxy_host "rpc.defi-oracle.io" "${RPC_PUBLIC_1}" 8545 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "wss.defi-oracle.io" "http://${RPC_PUBLIC_1}:8546" true false && updated_count=$((updated_count + 1)) || { add_proxy_host "wss.defi-oracle.io" "${RPC_PUBLIC_1}" 8546 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +# rpc.d-bis.org / rpc2.d-bis.org and WS variants → VMID 2201 (besu-rpc-public-1); add if missing to fix 405 +update_proxy_host "rpc.d-bis.org" "http://${RPC_PUBLIC_1}:8545" true false && updated_count=$((updated_count + 1)) || { add_proxy_host "rpc.d-bis.org" "${RPC_PUBLIC_1}" 8545 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "rpc2.d-bis.org" "http://${RPC_PUBLIC_1}:8545" true false && updated_count=$((updated_count + 1)) || { add_proxy_host "rpc2.d-bis.org" "${RPC_PUBLIC_1}" 8545 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "ws.rpc.d-bis.org" "http://${RPC_PUBLIC_1}:8546" true false && updated_count=$((updated_count + 1)) || { add_proxy_host "ws.rpc.d-bis.org" "${RPC_PUBLIC_1}" 8546 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "ws.rpc2.d-bis.org" "http://${RPC_PUBLIC_1}:8546" true false && updated_count=$((updated_count + 1)) || { add_proxy_host "ws.rpc2.d-bis.org" "${RPC_PUBLIC_1}" 8546 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) # Fireblocks-dedicated RPC (VMID 2301) update_proxy_host "rpc-fireblocks.d-bis.org" "http://${RPC_FIREBLOCKS_1:-${RPC_PRIVATE_1}}:8545" true false && updated_count=$((updated_count + 1)) || { add_proxy_host "rpc-fireblocks.d-bis.org" "${RPC_FIREBLOCKS_1:-${RPC_PRIVATE_1}}" 8545 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) update_proxy_host "ws.rpc-fireblocks.d-bis.org" "http://${RPC_FIREBLOCKS_1:-${RPC_PRIVATE_1}}:8546" true false && updated_count=$((updated_count + 1)) || { add_proxy_host "ws.rpc-fireblocks.d-bis.org" "${RPC_FIREBLOCKS_1:-${RPC_PRIVATE_1}}" 8546 true false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) update_proxy_host "dbis-admin.d-bis.org" "http://${IP_DBIS_FRONTEND:-192.168.11.130}:80" false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) update_proxy_host "dbis-api.d-bis.org" "http://${IP_DBIS_API:-192.168.11.155}:3000" false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) -update_proxy_host "dbis-api-2.d-bis.org" "http://${IP_DBIS_API_2:-192.168.11.156}:3000" false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) -update_proxy_host "secure.d-bis.org" "http://${IP_DBIS_FRONTEND:-192.168.11.130}:80" false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) +update_proxy_host "dbis-api-2.d-bis.org" "http://${IP_DBIS_API_2:-192.168.11.156}:3000" false && updated_count=$((updated_count + 1)) || { add_proxy_host "dbis-api-2.d-bis.org" "${IP_DBIS_API_2:-192.168.11.156}" 3000 false true && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "secure.d-bis.org" "http://${IP_DBIS_FRONTEND:-192.168.11.130}:80" false && updated_count=$((updated_count + 1)) || { add_proxy_host "secure.d-bis.org" "${IP_DBIS_FRONTEND:-192.168.11.130}" 80 false true && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +# DApp (VMID 5801) — frontend-dapp for Chain 138 bridge +update_proxy_host "dapp.d-bis.org" "http://${IP_DAPP_LXC:-192.168.11.58}:80" false && updated_count=$((updated_count + 1)) || { add_proxy_host "dapp.d-bis.org" "${IP_DAPP_LXC:-192.168.11.58}" 80 false false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) # MIM4U - VMID 7810 (mim-web-1) @ ${IP_MIM_WEB:-192.168.11.37} - Web Frontend serves main site and proxies /api/* to 7811 -update_proxy_host "mim4u.org" "http://${IP_MIM_WEB:-192.168.11.37}:80" false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) -update_proxy_host "www.mim4u.org" "http://${IP_MIM_WEB:-192.168.11.37}:80" false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) -update_proxy_host "secure.mim4u.org" "http://${IP_MIM_WEB:-192.168.11.37}:80" false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) -update_proxy_host "training.mim4u.org" "http://${IP_MIM_WEB:-192.168.11.37}:80" false && updated_count=$((updated_count + 1)) || failed_count=$((failed_count + 1)) +update_proxy_host "mim4u.org" "http://${IP_MIM_WEB:-192.168.11.37}:80" false && updated_count=$((updated_count + 1)) || { add_proxy_host "mim4u.org" "${IP_MIM_WEB:-192.168.11.37}" 80 false true && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "www.mim4u.org" "http://${IP_MIM_WEB:-192.168.11.37}:80" false && updated_count=$((updated_count + 1)) || { add_proxy_host "www.mim4u.org" "${IP_MIM_WEB:-192.168.11.37}" 80 false true && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "secure.mim4u.org" "http://${IP_MIM_WEB:-192.168.11.37}:80" false && updated_count=$((updated_count + 1)) || { add_proxy_host "secure.mim4u.org" "${IP_MIM_WEB:-192.168.11.37}" 80 false true && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "training.mim4u.org" "http://${IP_MIM_WEB:-192.168.11.37}:80" false && updated_count=$((updated_count + 1)) || { add_proxy_host "training.mim4u.org" "${IP_MIM_WEB:-192.168.11.37}" 80 false true && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +# Gov Portals xom-dev (VMID 7804) — public https:// at NPM (LE); upstream HTTP +IP_GOV_PORTALS_DEV="${IP_GOV_PORTALS_DEV:-192.168.11.54}" +update_proxy_host "dbis.xom-dev.phoenix.sankofa.nexus" "http://${IP_GOV_PORTALS_DEV}:3001" false && updated_count=$((updated_count + 1)) || { add_proxy_host "dbis.xom-dev.phoenix.sankofa.nexus" "${IP_GOV_PORTALS_DEV}" 3001 false false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "iccc.xom-dev.phoenix.sankofa.nexus" "http://${IP_GOV_PORTALS_DEV}:3002" false && updated_count=$((updated_count + 1)) || { add_proxy_host "iccc.xom-dev.phoenix.sankofa.nexus" "${IP_GOV_PORTALS_DEV}" 3002 false false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "omnl.xom-dev.phoenix.sankofa.nexus" "http://${IP_GOV_PORTALS_DEV}:3003" false && updated_count=$((updated_count + 1)) || { add_proxy_host "omnl.xom-dev.phoenix.sankofa.nexus" "${IP_GOV_PORTALS_DEV}" 3003 false false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) +update_proxy_host "xom.xom-dev.phoenix.sankofa.nexus" "http://${IP_GOV_PORTALS_DEV}:3004" false && updated_count=$((updated_count + 1)) || { add_proxy_host "xom.xom-dev.phoenix.sankofa.nexus" "${IP_GOV_PORTALS_DEV}" 3004 false false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1)) echo "" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" diff --git a/smom-dbis-138 b/smom-dbis-138 index 1511f33..4f7b335 160000 --- a/smom-dbis-138 +++ b/smom-dbis-138 @@ -1 +1 @@ -Subproject commit 1511f33857829b762de5deeea135ce5af117997f +Subproject commit 4f7b335a4b5b7bf6f3dda38c72f98ad5691e9977