Skip to content

fix(abstract-node): restrict Grafana permissions and enforce PostgreSQL restart policy #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
malakasaray-del wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(abstract-node): restrict Grafana permissions and enforce PostgreSQL restart policy #41

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
255 changes: 133 additions & 122 deletions docker/external-node.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,122 +1,133 @@
name: "abstract-${NETWORK}-external-node"
services:
prometheus:
image: prom/prometheus:v2.35.0
volumes:
- prometheus-data:/prometheus
- ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
expose:
- 9090
grafana:
image: grafana/grafana:9.3.6
volumes:
- grafana-data:/var/lib/grafana
- ./grafana/provisioning:/etc/grafana/provisioning
environment:
GF_AUTH_ANONYMOUS_ORG_ROLE: "Admin"
GF_AUTH_ANONYMOUS_ENABLED: "true"
GF_AUTH_DISABLE_LOGIN_FORM: "true"
ports:
- "127.0.0.1:3000:3000"
postgres:
image: "postgres:16"
command: >
postgres
-c max_connections=200
-c log_error_verbosity=terse
-c shared_buffers=2GB
-c effective_cache_size=4GB
-c maintenance_work_mem=1GB
-c checkpoint_completion_target=0.9
-c random_page_cost=1.1
-c effective_io_concurrency=200
-c min_wal_size=4GB
-c max_wal_size=16GB
-c max_worker_processes=16
-c checkpoint_timeout=1800
expose:
- 5430
volumes:
- postgres:/var/lib/postgresql/data
healthcheck:
interval: 1s
timeout: 3s
test:
[
"CMD-SHELL",
'psql -U postgres -c "select exists (select * from pg_stat_activity where datname = ''{{ database_name }}'' and application_name = ''pg_restore'')" | grep -e ".f$$"',
]
environment:
- POSTGRES_PASSWORD=${DB_PASSWORD:-notsecurepassword}
- PGPORT=5430
# Generation of consensus secrets.
# The secrets are generated iff the secrets file doesn't already exist.
generate-secrets:
image: "matterlabs/external-node:${EN_VERSION:-9734bf2-1787057993929}@${EN_DIGEST:-sha256:5dadc06bdf3bb09b7ac508e6761e164bca22fae09860cf8bc57041302f80f40b}"
entrypoint:
[
"/configs/generate_secrets.sh",
"/configs/consensus_secrets.yaml",
]
volumes:
- ./configs:/configs
external-node:
image: "matterlabs/external-node:${EN_VERSION:-9734bf2-1787057993929}@${EN_DIGEST:-sha256:5dadc06bdf3bb09b7ac508e6761e164bca22fae09860cf8bc57041302f80f40b}"
entrypoint: ["/usr/bin/entrypoint.sh"]
restart: always
depends_on:
postgres:
condition: service_healthy
generate-secrets:
condition: service_completed_successfully
ports:
- "127.0.0.1:${EN_HTTP_PORT:-3060}:${EN_HTTP_PORT:-3060}"
- "127.0.0.1:${EN_WS_PORT:-3061}:${EN_WS_PORT:-3061}"
- "127.0.0.1:${EN_HEALTHCHECK_PORT:-3081}:${EN_HEALTHCHECK_PORT:-3081}"
- "127.0.0.1:${EN_PROMETHEUS_PORT:-3322}:${EN_PROMETHEUS_PORT:-3322}"
# Consensus is currently disabled for Abstract
# - "127.0.0.1:${EN_CONSENSUS_PORT:-3054}:${EN_CONSENSUS_PORT:-3054}"
#- "127.0.0.1:${EN_CONSENSUS_DEBUG_PAGE_PORT:-5000}:${EN_CONSENSUS_DEBUG_PAGE_PORT:-5000}"
volumes:
- rocksdb:/db
- ./configs:/configs
expose:
- 3322
environment:
DATABASE_URL: "postgres://postgres:${DB_PASSWORD:-notsecurepassword}@postgres:5430/abstract_local_ext_node"
DATABASE_POOL_SIZE: 10

EN_HTTP_PORT: ${EN_HTTP_PORT:-3060}
EN_WS_PORT: ${EN_WS_PORT:-3061}
EN_HEALTHCHECK_PORT: ${EN_HEALTHCHECK_PORT:-3081}
EN_PROMETHEUS_PORT: ${EN_PROMETHEUS_PORT:-3322}
EN_ETH_CLIENT_URL: ${EN_ETH_CLIENT_URL:-https://eth.drpc.org}
EN_MAIN_NODE_URL: ${EN_MAIN_NODE_URL:-https://api.mainnet.abs.xyz}
EN_L1_CHAIN_ID: ${EN_L1_CHAIN_ID:-1}
EN_L2_CHAIN_ID: ${EN_L2_CHAIN_ID:-2741}
EN_PRUNING_ENABLED: ${EN_PRUNING_ENABLED:-true}

EN_GAS_PRICE_SCALE_FACTOR: "1.5"
EN_ESTIMATE_GAS_SCALE_FACTOR: "1.3"
EN_ESTIMATE_GAS_ACCEPTABLE_OVERESTIMATION: "5000"

EN_STATE_CACHE_PATH: "./db/ext-node/state_keeper"
EN_MERKLE_TREE_PATH: "./db/ext-node/lightweight"
EN_SNAPSHOTS_RECOVERY_ENABLED: ${EN_SNAPSHOTS_RECOVERY_ENABLED:-true}
EN_SNAPSHOTS_OBJECT_STORE_BUCKET_BASE_URL: ${EN_SNAPSHOTS_OBJECT_STORE_BUCKET_BASE_URL:-raas-abstract-mainnet-external-node-snapshots}
EN_SNAPSHOTS_OBJECT_STORE_MODE: "GCSAnonymousReadOnly"
RUST_LOG: ${RUST_LOG:-warn,zksync=info,zksync_core::metadata_calculator=debug,zksync_state=debug,zksync_utils=debug,zksync_web3_decl::client=error}
# Consensus is currently disabled for Abstract
#EN_CONSENSUS_CONFIG_PATH: "/configs/consensus_config.yaml"
#EN_CONSENSUS_SECRETS_PATH: "/configs/consensus_secrets.yaml"
# Statekeeper config for block times
EN_STATE_KEEPER_L2_BLOCK_COMMIT_DEADLINE: ${EN_STATE_KEEPER_L2_BLOCK_COMMIT_DEADLINE:-"200 ms"}
# API configuration for eth_sendRawTransactionSync timeouts
EN_API_SEND_RAW_TX_SYNC_DEFAULT_TIMEOUT_MS: ${EN_API_SEND_RAW_TX_SYNC_DEFAULT_TIMEOUT_MS:-2000}
EN_API_SEND_RAW_TX_SYNC_MAX_TIMEOUT_MS: ${EN_API_SEND_RAW_TX_SYNC_MAX_TIMEOUT_MS:-10000}

volumes:
postgres: {}
rocksdb: {}
prometheus-data: {}
grafana-data: {}
name: "abstract-${NETWORK}-external-node"
services:
prometheus:
image: prom/prometheus:v2.35.0
volumes:
- prometheus-data:/prometheus
- ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
expose:
- 9090
grafana:
image: grafana/grafana:9.3.6
volumes:
- grafana-data:/var/lib/grafana
- ./grafana/provisioning:/etc/grafana/provisioning
environment:
# Anonymous access is enabled and the login form is disabled, so this role is
# granted to every request that reaches Grafana. "Admin" would let anyone with
# access to port 3000 (including anything on the host or an SSH tunnel) create
# datasources, which Grafana proxies server-side and can be abused to reach
# internal endpoints such as the cloud metadata service. "Viewer" still allows
# reading the provisioned dashboards; set GRAFANA_ANONYMOUS_ROLE=Admin to
# restore the previous behaviour if you edit dashboards from the UI.
GF_AUTH_ANONYMOUS_ORG_ROLE: "${GRAFANA_ANONYMOUS_ROLE:-Viewer}"
GF_AUTH_ANONYMOUS_ENABLED: "true"
GF_AUTH_DISABLE_LOGIN_FORM: "true"
ports:
- "127.0.0.1:3000:3000"
postgres:
image: "postgres:16"
# The external node is "restart: always" and depends on postgres being healthy.
# Without a restart policy here, a postgres crash or a host reboot leaves the
# database stopped and the node stuck in a restart loop until manual action.
restart: always
command: >
postgres
-c max_connections=200
-c log_error_verbosity=terse
-c shared_buffers=2GB
-c effective_cache_size=4GB
-c maintenance_work_mem=1GB
-c checkpoint_completion_target=0.9
-c random_page_cost=1.1
-c effective_io_concurrency=200
-c min_wal_size=4GB
-c max_wal_size=16GB
-c max_worker_processes=16
-c checkpoint_timeout=1800
expose:
- 5430
volumes:
- postgres:/var/lib/postgresql/data
healthcheck:
interval: 1s
timeout: 3s
test:
[
"CMD-SHELL",
'psql -U postgres -c "select exists (select * from pg_stat_activity where datname = ''{{ database_name }}'' and application_name = ''pg_restore'')" | grep -e ".f$$"',
]
environment:
- POSTGRES_PASSWORD=${DB_PASSWORD:-notsecurepassword}
- PGPORT=5430
# Generation of consensus secrets.
# The secrets are generated iff the secrets file doesn't already exist.
generate-secrets:
image: "matterlabs/external-node:${EN_VERSION:-9734bf2-1787057993929}@${EN_DIGEST:-sha256:5dadc06bdf3bb09b7ac508e6761e164bca22fae09860cf8bc57041302f80f40b}"
entrypoint:
[
"/configs/generate_secrets.sh",
"/configs/consensus_secrets.yaml",
]
volumes:
- ./configs:/configs
external-node:
image: "matterlabs/external-node:${EN_VERSION:-9734bf2-1787057993929}@${EN_DIGEST:-sha256:5dadc06bdf3bb09b7ac508e6761e164bca22fae09860cf8bc57041302f80f40b}"
entrypoint: ["/usr/bin/entrypoint.sh"]
restart: always
depends_on:
postgres:
condition: service_healthy
generate-secrets:
condition: service_completed_successfully
ports:
- "127.0.0.1:${EN_HTTP_PORT:-3060}:${EN_HTTP_PORT:-3060}"
- "127.0.0.1:${EN_WS_PORT:-3061}:${EN_WS_PORT:-3061}"
- "127.0.0.1:${EN_HEALTHCHECK_PORT:-3081}:${EN_HEALTHCHECK_PORT:-3081}"
- "127.0.0.1:${EN_PROMETHEUS_PORT:-3322}:${EN_PROMETHEUS_PORT:-3322}"
# Consensus is currently disabled for Abstract
# - "127.0.0.1:${EN_CONSENSUS_PORT:-3054}:${EN_CONSENSUS_PORT:-3054}"
#- "127.0.0.1:${EN_CONSENSUS_DEBUG_PAGE_PORT:-5000}:${EN_CONSENSUS_DEBUG_PAGE_PORT:-5000}"
volumes:
- rocksdb:/db
- ./configs:/configs
expose:
- 3322
environment:
DATABASE_URL: "postgres://postgres:${DB_PASSWORD:-notsecurepassword}@postgres:5430/abstract_local_ext_node"
DATABASE_POOL_SIZE: 10

EN_HTTP_PORT: ${EN_HTTP_PORT:-3060}
EN_WS_PORT: ${EN_WS_PORT:-3061}
EN_HEALTHCHECK_PORT: ${EN_HEALTHCHECK_PORT:-3081}
EN_PROMETHEUS_PORT: ${EN_PROMETHEUS_PORT:-3322}
EN_ETH_CLIENT_URL: ${EN_ETH_CLIENT_URL:-https://eth.drpc.org}
EN_MAIN_NODE_URL: ${EN_MAIN_NODE_URL:-https://api.mainnet.abs.xyz}
EN_L1_CHAIN_ID: ${EN_L1_CHAIN_ID:-1}
EN_L2_CHAIN_ID: ${EN_L2_CHAIN_ID:-2741}
EN_PRUNING_ENABLED: ${EN_PRUNING_ENABLED:-true}

EN_GAS_PRICE_SCALE_FACTOR: "1.5"
EN_ESTIMATE_GAS_SCALE_FACTOR: "1.3"
EN_ESTIMATE_GAS_ACCEPTABLE_OVERESTIMATION: "5000"

EN_STATE_CACHE_PATH: "./db/ext-node/state_keeper"
EN_MERKLE_TREE_PATH: "./db/ext-node/lightweight"
EN_SNAPSHOTS_RECOVERY_ENABLED: ${EN_SNAPSHOTS_RECOVERY_ENABLED:-true}
EN_SNAPSHOTS_OBJECT_STORE_BUCKET_BASE_URL: ${EN_SNAPSHOTS_OBJECT_STORE_BUCKET_BASE_URL:-raas-abstract-mainnet-external-node-snapshots}
EN_SNAPSHOTS_OBJECT_STORE_MODE: "GCSAnonymousReadOnly"
RUST_LOG: ${RUST_LOG:-warn,zksync=info,zksync_core::metadata_calculator=debug,zksync_state=debug,zksync_utils=debug,zksync_web3_decl::client=error}
# Consensus is currently disabled for Abstract
#EN_CONSENSUS_CONFIG_PATH: "/configs/consensus_config.yaml"
#EN_CONSENSUS_SECRETS_PATH: "/configs/consensus_secrets.yaml"
# Statekeeper config for block times
EN_STATE_KEEPER_L2_BLOCK_COMMIT_DEADLINE: ${EN_STATE_KEEPER_L2_BLOCK_COMMIT_DEADLINE:-"200 ms"}
# API configuration for eth_sendRawTransactionSync timeouts
EN_API_SEND_RAW_TX_SYNC_DEFAULT_TIMEOUT_MS: ${EN_API_SEND_RAW_TX_SYNC_DEFAULT_TIMEOUT_MS:-2000}
EN_API_SEND_RAW_TX_SYNC_MAX_TIMEOUT_MS: ${EN_API_SEND_RAW_TX_SYNC_MAX_TIMEOUT_MS:-10000}

volumes:
postgres: {}
rocksdb: {}
prometheus-data: {}
grafana-data: {}