feat(infra): deploy protocol configuration reader on-chain parameters

.github/workflows/actions/deploy-terraform-infrastructure/action.yml

@@ -125,6 +125,19 @@ inputs:
   mithril_era_reader_secret_key:
     description: Mithril era reader secret key (onlye for test networks).
     required: false
+  mithril_protocol_configuration_reader_adapter_type:
+    description: Mithril protocol configuration reader adapter type.
+    required: false
+    default: "cardano-chain"
+  mithril_protocol_configuration_reader_address_url:
+    description: Mithril protocol configuration reader address location.
+    required: true
+  mithril_protocol_configuration_reader_verification_key_url:
+    description: Mithril protocol configuration reader verification key url.
+    required: true
+  mithril_protocol_configuration_reader_secret_key:
+    description: Mithril protocol configuration reader secret key (only for test networks).
+    required: false
   mithril_aggregator_signed_entity_types:
     description: Mithril aggregator signed entity types parameters (discriminants names in an ordered comma separated list).
     required: false
@@ -300,6 +313,10 @@ runs:
           mithril_era_reader_address_url                                                = "${{ inputs.mithril_era_reader_address_url }}"
           mithril_era_reader_verification_key_url                                       = "${{ inputs.mithril_era_reader_verification_key_url }}"
           mithril_era_reader_secret_key                                                 = "${{ inputs.mithril_era_reader_secret_key }}"
+          mithril_protocol_configuration_reader_adapter_type                            = "${{ inputs.mithril_protocol_configuration_reader_adapter_type }}"
+          mithril_protocol_configuration_reader_address_url                             = "${{ inputs.mithril_protocol_configuration_reader_address_url }}"
+          mithril_protocol_configuration_reader_verification_key_url                    = "${{ inputs.mithril_protocol_configuration_reader_verification_key_url }}"
+          mithril_protocol_configuration_reader_secret_key                              = "${{ inputs.mithril_protocol_configuration_reader_secret_key }}"
           mithril_aggregator_signed_entity_types                                        = "${{ inputs.mithril_aggregator_signed_entity_types }}"
           mithril_aggregator_aggregate_signature_type                                   = "${{ inputs.mithril_aggregator_aggregate_signature_type }}"
           mithril_aggregator_cdn_cname                                                  = "${{ inputs.mithril_aggregator_cdn_cname }}"

.github/workflows/ci.yml

@@ -815,6 +815,9 @@ jobs:
           mithril_era_reader_address_url: ${{ vars.ERA_READER_ADDRESS_URL }}
           mithril_era_reader_verification_key_url: ${{ vars.ERA_READER_VERIFICATION_KEY_URL }}
           mithril_era_reader_secret_key: ${{ secrets.ERA_READER_SECRET_KEY }}
+          mithril_protocol_configuration_reader_address_url: ${{ vars.PROTOCOL_CONFIGURATION_READER_ADDRESS_URL }}
+          mithril_protocol_configuration_reader_verification_key_url: ${{ vars.PROTOCOL_CONFIGURATION_READER_VERIFICATION_KEY_URL }}
+          mithril_protocol_configuration_reader_secret_key: ${{ secrets.PROTOCOL_CONFIGURATION_READER_SECRET_KEY }}
           mithril_aggregator_signed_entity_types: ${{ vars.AGGREGATOR_SIGNED_ENTITY_TYPES }}
           mithril_aggregator_aggregate_signature_type: ${{ vars.AGGREGATOR_AGGREGATE_SIGNATURE_TYPE }}
           mithril_aggregator_cdn_cname: ${{ vars.AGGREGATOR_CDN_CNAME }}

.github/workflows/pre-release.yml

@@ -292,6 +292,9 @@ jobs:
           mithril_era_reader_address_url: ${{ vars.ERA_READER_ADDRESS_URL }}
           mithril_era_reader_verification_key_url: ${{ vars.ERA_READER_VERIFICATION_KEY_URL }}
           mithril_era_reader_secret_key: ${{ secrets.ERA_READER_SECRET_KEY }}
+          mithril_protocol_configuration_reader_address_url: ${{ vars.PROTOCOL_CONFIGURATION_READER_ADDRESS_URL }}
+          mithril_protocol_configuration_reader_verification_key_url: ${{ vars.PROTOCOL_CONFIGURATION_READER_VERIFICATION_KEY_URL }}
+          mithril_protocol_configuration_reader_secret_key: ${{ secrets.PROTOCOL_CONFIGURATION_READER_SECRET_KEY }}
           mithril_aggregator_signed_entity_types: ${{ vars.AGGREGATOR_SIGNED_ENTITY_TYPES }}
           mithril_aggregator_aggregate_signature_type: ${{ vars.AGGREGATOR_AGGREGATE_SIGNATURE_TYPE }}
           mithril_aggregator_cdn_cname: ${{ vars.AGGREGATOR_CDN_CNAME }}

.github/workflows/release.yml

@@ -215,6 +215,8 @@ jobs:
           mithril_genesis_verification_key_url: ${{ vars.GENESIS_VERIFICATION_KEY_URL }}
           mithril_era_reader_address_url: ${{ vars.ERA_READER_ADDRESS_URL }}
           mithril_era_reader_verification_key_url: ${{ vars.ERA_READER_VERIFICATION_KEY_URL }}
+          mithril_protocol_configuration_reader_address_url: ${{ vars.PROTOCOL_CONFIGURATION_READER_ADDRESS_URL }}
+          mithril_protocol_configuration_reader_verification_key_url: ${{ vars.PROTOCOL_CONFIGURATION_READER_VERIFICATION_KEY_URL }}
           mithril_aggregator_signed_entity_types: ${{ vars.AGGREGATOR_SIGNED_ENTITY_TYPES }}
           mithril_aggregator_aggregate_signature_type: ${{ vars.AGGREGATOR_AGGREGATE_SIGNATURE_TYPE }}
           mithril_aggregator_cdn_cname: ${{ vars.AGGREGATOR_CDN_CNAME }}

.github/workflows/test-deploy-network.yml

@@ -170,6 +170,9 @@ jobs:
           mithril_era_reader_address_url: ${{ vars.ERA_READER_ADDRESS_URL }}
           mithril_era_reader_verification_key_url: ${{ vars.ERA_READER_VERIFICATION_KEY_URL }}
           mithril_era_reader_secret_key: ${{ secrets.ERA_READER_SECRET_KEY }}
+          mithril_protocol_configuration_reader_address_url: ${{ vars.PROTOCOL_CONFIGURATION_READER_ADDRESS_URL }}
+          mithril_protocol_configuration_reader_verification_key_url: ${{ vars.PROTOCOL_CONFIGURATION_READER_VERIFICATION_KEY_URL }}
+          mithril_protocol_configuration_reader_secret_key: ${{ secrets.PROTOCOL_CONFIGURATION_READER_SECRET_KEY }}
           mithril_aggregator_signed_entity_types: ${{ vars.AGGREGATOR_SIGNED_ENTITY_TYPES }}
           mithril_aggregator_aggregate_signature_type: ${{ vars.AGGREGATOR_AGGREGATE_SIGNATURE_TYPE }}
           mithril_aggregator_cdn_cname: ${{ vars.AGGREGATOR_CDN_CNAME }}

mithril-infra/assets/docker/docker-compose-aggregator-base.yaml

@@ -77,6 +77,7 @@ services:
       - SERVER_PORT=8080
       - ERA_READER_ADAPTER_TYPE=${ERA_READER_ADAPTER_TYPE}
       - ERA_READER_ADAPTER_PARAMS=${ERA_READER_ADAPTER_PARAMS}
+      - PROTOCOL_CONFIGURATION_READER_ADAPTER_CONFIG=${PROTOCOL_CONFIGURATION_READER_ADAPTER_CONFIG}
       - ANCILLARY_FILES_SIGNER_CONFIG=${ANCILLARY_FILES_SIGNER_CONFIG}
       - BLOCKFROST_PARAMETERS=${BLOCKFROST_PARAMETERS}
       - ALLOW_UNPARSABLE_BLOCK=${ALLOW_UNPARSABLE_BLOCK}

mithril-infra/assets/docker/docker-compose-signer-base.yaml

@@ -20,6 +20,7 @@ services:
       - CARDANO_CLI_PATH=/app/bin/cardano-cli
       - ERA_READER_ADAPTER_TYPE=${ERA_READER_ADAPTER_TYPE}
       - ERA_READER_ADAPTER_PARAMS=${ERA_READER_ADAPTER_PARAMS}
+      - PROTOCOL_CONFIGURATION_READER_ADAPTER_CONFIG=${PROTOCOL_CONFIGURATION_READER_ADAPTER_CONFIG}
       - ENABLE_METRICS_SERVER=${ENABLE_METRICS_SERVER}
       - METRICS_SERVER_IP=${METRICS_SERVER_IP}
       - METRICS_SERVER_PORT=${METRICS_SERVER_PORT}

mithril-infra/assets/docker/docker-compose-signer-cardano-bundle-bp-override.yaml

@@ -13,6 +13,7 @@ services:
       - AGGREGATOR_ENDPOINT=${AGGREGATOR_ENDPOINT}
       - ERA_READER_ADAPTER_TYPE=${ERA_READER_ADAPTER_TYPE}
       - ERA_READER_ADAPTER_PARAMS=${ERA_READER_ADAPTER_PARAMS}
+      - PROTOCOL_CONFIGURATION_READER_ADAPTER_CONFIG=${PROTOCOL_CONFIGURATION_READER_ADAPTER_CONFIG}
     volumes:
       - ../data/${NETWORK}/mithril-signer-${SIGNER_ID}/cardano/db/block-producer:/data/db
       - ../data/${NETWORK}/mithril-signer-${SIGNER_ID}/mithril:/data/mithril

mithril-infra/assets/docker/docker-compose-signer-cardano-bundle-passive-override.yaml

@@ -12,6 +12,7 @@ services:
       - AGGREGATOR_ENDPOINT=${AGGREGATOR_ENDPOINT}
       - ERA_READER_ADAPTER_TYPE=${ERA_READER_ADAPTER_TYPE}
       - ERA_READER_ADAPTER_PARAMS=${ERA_READER_ADAPTER_PARAMS}
+      - PROTOCOL_CONFIGURATION_READER_ADAPTER_CONFIG=${PROTOCOL_CONFIGURATION_READER_ADAPTER_CONFIG}
     volumes:
       - ../data/${NETWORK}/mithril-signer-${SIGNER_ID}/cardano/db/passive:/data/db
       - ../data/${NETWORK}/mithril-signer-${SIGNER_ID}/mithril:/data/mithril

mithril-infra/assets/infra.version

@@ -1,2 +1,2 @@
-0.5.20
+0.5.21
 

mithril-infra/configuration/testing-preview/protocol-config.addr

@@ -0,0 +1 @@
+addr_test1qzzngukkj9ydjemqjlgfn42sevy2xnvauay46weushlpuq9thd4ray00csjssf4sxftv04xeequ3xfx72nujg9y4d5ysgkxxlh

mithril-infra/configuration/testing-preview/protocol-config.vkey

@@ -0,0 +1 @@
+5b35352c3232382c3134342c38372c3133382c3133362c34382c382c31342c3138372c38352c3134382c39372c3233322c3235352c3232392c33382c3234342c3234372c3230342c3139382c31332c33312c3232322c32352c3136342c35322c3130322c39312c3132302c3230382c3134375d

mithril-infra/mithril.aggregator.tf

@@ -155,26 +155,32 @@ EOT
       "export SNAPSHOT_COMPRESSION_ALGORITHM=${var.mithril_aggregator_snapshot_compression_algorithm}",
       "export ZSTANDARD_PARAMETERS__LEVEL=${var.mithril_aggregator_zstandard_parameters_level}",
       "export ZSTANDARD_PARAMETERS__NUMBER_OF_WORKERS=${var.mithril_aggregator_zstandard_parameters_workers}",
-      "export GENESIS_VERIFICATION_KEY=$(wget -q -O - ${var.mithril_genesis_verification_key_url})",
+      "export GENESIS_VERIFICATION_KEY=\"$(wget -q -O - '${var.mithril_genesis_verification_key_url}')\"",
       "export GENESIS_SECRET_KEY='${var.mithril_genesis_secret_key}'",
       "export PROTOCOL_PARAMETERS__K='${var.mithril_protocol_parameters.k}'",
       "export PROTOCOL_PARAMETERS__M='${var.mithril_protocol_parameters.m}'",
       "export PROTOCOL_PARAMETERS__PHI_F='${var.mithril_protocol_parameters.phi_f}'",
       "export CHAIN_OBSERVER_TYPE='${var.mithril_aggregator_chain_observer_type}'",
       "export ERA_READER_ADAPTER_TYPE='${var.mithril_era_reader_adapter_type}'",
       <<-EOT
-ERA_READER_ADAPTER_PARAMS=$(jq -nc --arg address $(wget -q -O - ${var.mithril_era_reader_address_url}) --arg verification_key $(wget -q -O - ${var.mithril_era_reader_verification_key_url}) '{"address": $address, "verification_key": $verification_key}')
-export ERA_READER_ADAPTER_PARAMS=$ERA_READER_ADAPTER_PARAMS
+ERA_READER_ADAPTER_PARAMS=$(jq -nc --arg address "$(wget -q -O - '${var.mithril_era_reader_address_url}')" --arg verification_key "$(wget -q -O - '${var.mithril_era_reader_verification_key_url}')" '{"address": $address, "verification_key": $verification_key}')
+export ERA_READER_ADAPTER_PARAMS="$ERA_READER_ADAPTER_PARAMS"
 EOT
       ,
       "export ERA_READER_SECRET_KEY='${var.mithril_era_reader_secret_key}'",
       <<-EOT
+PROTOCOL_CONFIGURATION_READER_ADAPTER_CONFIG=$(jq -nc --arg type '${var.mithril_protocol_configuration_reader_adapter_type}' --arg address "$(wget -q -O - '${var.mithril_protocol_configuration_reader_address_url}')" --arg verification_key "$(wget -q -O - '${var.mithril_protocol_configuration_reader_verification_key_url}')" '{"type": $type, "address": $address, "verification_key": $verification_key}')
+export PROTOCOL_CONFIGURATION_READER_ADAPTER_CONFIG="$PROTOCOL_CONFIGURATION_READER_ADAPTER_CONFIG"
+EOT
+      ,
+      "export PROTOCOL_CONFIGURATION_READER_SECRET_KEY='${var.mithril_protocol_configuration_reader_secret_key}'",
+      <<-EOT
 export ANCILLARY_FILES_SIGNER_TYPE=${var.mithril_aggregator_ancillary_signer_type}
 if [ "$ANCILLARY_FILES_SIGNER_TYPE" = "secret-key" ]; then
-  export ANCILLARY_FILES_SIGNER_CONFIG=$(jq -nc --arg secret_key ${var.mithril_aggregator_ancillary_signer_secret_key} '{"type": "secret-key", "secret_key": $secret_key}')
+  export ANCILLARY_FILES_SIGNER_CONFIG=$(jq -nc --arg secret_key '${var.mithril_aggregator_ancillary_signer_secret_key}' '{"type": "secret-key", "secret_key": $secret_key}')
 fi
 if [ "$ANCILLARY_FILES_SIGNER_TYPE" = "gcp-kms" ]; then
-  export ANCILLARY_FILES_SIGNER_CONFIG=$(jq -nc --arg resource_name ${var.mithril_aggregator_ancillary_signer_gcp_kms_resource_name} '{"type": "gcp-kms", "resource_name": $resource_name, "credentials_json_env_var": "GOOGLE_APPLICATION_CREDENTIALS_GCP_KMS_JSON"}')
+  export ANCILLARY_FILES_SIGNER_CONFIG=$(jq -nc --arg resource_name '${var.mithril_aggregator_ancillary_signer_gcp_kms_resource_name}' '{"type": "gcp-kms", "resource_name": $resource_name, "credentials_json_env_var": "GOOGLE_APPLICATION_CREDENTIALS_GCP_KMS_JSON"}')
   export GOOGLE_APPLICATION_CREDENTIALS_GCP_KMS_JSON='${local.mithril_aggregator_ancillary_signer_gcp_kms_credentials}'
 fi
 EOT

mithril-infra/mithril.signer.tf

@@ -215,8 +215,13 @@ EOT
       "export SIGNER_DMQ_BLOCK_PRODUCER_PORT=${local.mithril_signers_dmq_block_producer_port[each.key]}",
       "export ERA_READER_ADAPTER_TYPE='${var.mithril_era_reader_adapter_type}'",
       <<-EOT
-ERA_READER_ADAPTER_PARAMS=$(jq -nc --arg address $(wget -q -O - ${var.mithril_era_reader_address_url}) --arg verification_key $(wget -q -O - ${var.mithril_era_reader_verification_key_url}) '{"address": $address, "verification_key": $verification_key}')
-export ERA_READER_ADAPTER_PARAMS=$ERA_READER_ADAPTER_PARAMS
+ERA_READER_ADAPTER_PARAMS=$(jq -nc --arg address "$(wget -q -O - '${var.mithril_era_reader_address_url}')" --arg verification_key "$(wget -q -O - '${var.mithril_era_reader_verification_key_url}')" '{"address": $address, "verification_key": $verification_key}')
+export ERA_READER_ADAPTER_PARAMS="$ERA_READER_ADAPTER_PARAMS"
+EOT
+      ,
+      <<-EOT
+PROTOCOL_CONFIGURATION_READER_ADAPTER_CONFIG=$(jq -nc --arg type '${var.mithril_protocol_configuration_reader_adapter_type}' --arg address "$(wget -q -O - '${var.mithril_protocol_configuration_reader_address_url}')" --arg verification_key "$(wget -q -O - '${var.mithril_protocol_configuration_reader_verification_key_url}')" '{"type": $type, "address": $address, "verification_key": $verification_key}')
+export PROTOCOL_CONFIGURATION_READER_ADAPTER_CONFIG="$PROTOCOL_CONFIGURATION_READER_ADAPTER_CONFIG"
 EOT
       ,
       "export AGGREGATOR_RELAY_LISTEN_PORT='${local.mithril_aggregator_relay_mithril_listen_port}'",

mithril-infra/output.tf

@@ -3,19 +3,22 @@ output "google_project" {
 }
 
 output "mithril_aggregator_endpoint" {
-  value = local.mithril_aggregator_endpoint_url
+  value     = local.mithril_aggregator_endpoint_url
+  sensitive = true
 }
 
 output "mithril_signers_endpoint_url" {
   value = local.mithril_signers_endpoint_url
 }
 
 output "prometheus_endpoint_url" {
-  value = local.prometheus_endpoint_url
+  value     = local.prometheus_endpoint_url
+  sensitive = true
 }
 
 output "loki_endpoint_url" {
-  value = local.loki_endpoint_url
+  value     = local.loki_endpoint_url
+  sensitive = true
 }
 
 output "storage_bucket" {

mithril-infra/variables.tf

@@ -382,6 +382,7 @@ variable "mithril_aggregator_auth_username" {
 variable "mithril_aggregator_auth_password" {
   type        = string
   description = "The password for authentication on the mithril aggregator"
+  sensitive   = true
   default     = ""
 }
 
@@ -416,6 +417,7 @@ variable "mithril_aggregator_ancillary_signer_type" {
 variable "mithril_aggregator_ancillary_signer_secret_key" {
   type        = string
   description = "The secret key used to sign ancillary files (used with mithril_aggregator_ancillary_signer_type='secret-key')"
+  sensitive   = true
   default     = ""
 }
 
@@ -428,6 +430,7 @@ variable "mithril_aggregator_ancillary_signer_gcp_kms_resource_name" {
 variable "mithril_aggregator_ancillary_signer_gcp_kms_credentials" {
   type        = string
   description = "The JSON credentials to access GCP KMS base64 encoded (used with mithril_aggregator_ancillary_signer_type='gcp-kms')"
+  sensitive   = true
   default     = ""
 }
 
@@ -446,6 +449,7 @@ variable "prometheus_auth_username" {
 variable "prometheus_auth_password" {
   type        = string
   description = "The password for authentication on local prometheus endpoint"
+  sensitive   = true
   default     = ""
 }
 
@@ -464,6 +468,7 @@ variable "prometheus_ingest_username" {
 variable "prometheus_ingest_password" {
   type        = string
   description = "The password to ingest on remote prometheus endpoint"
+  sensitive   = true
   default     = ""
 }
 
@@ -476,6 +481,7 @@ variable "loki_auth_username" {
 variable "loki_auth_password" {
   type        = string
   description = "The password for authentication on local loki endpoint"
+  sensitive   = true
   default     = ""
 }
 
@@ -494,6 +500,7 @@ variable "loki_ingest_username" {
 variable "loki_ingest_password" {
   type        = string
   description = "The password to ingest on remote loki endpoint"
+  sensitive   = true
   default     = ""
 }
 
@@ -512,6 +519,7 @@ variable "mithril_genesis_verification_key_url" {
 variable "mithril_genesis_secret_key" {
   type        = string
   description = "The Mithril genesis secret key used by the aggregator to bootstrap a genesis certificate (test only)"
+  sensitive   = true
 }
 
 variable "mithril_protocol_parameters" {
@@ -548,6 +556,32 @@ variable "mithril_era_reader_verification_key_url" {
 variable "mithril_era_reader_secret_key" {
   type        = string
   description = "The Mithril genesis secret key used by the aggregator to generate an era marker payload TxDatum file (test only)"
+  sensitive   = true
+  default     = ""
+}
+
+variable "mithril_protocol_configuration_reader_adapter_type" {
+  type        = string
+  description = "The Mithril protocol configuration reader adapter used to read the protocol configuration markers"
+  default     = "cardano-chain"
+}
+
+variable "mithril_protocol_configuration_reader_address_url" {
+  type        = string
+  description = "The url of the Mithril protocol configuration reader address used to query the on chain Utxo containing the protocol configuration markers payload"
+  default     = ""
+}
+
+variable "mithril_protocol_configuration_reader_verification_key_url" {
+  type        = string
+  description = "The url of the Mithril protocol configuration reader verification key used to verify a protocol configuration markers payload"
+  default     = ""
+}
+
+variable "mithril_protocol_configuration_reader_secret_key" {
+  type        = string
+  description = "The Mithril protocol configuration reader secret key used by the aggregator to generate a protocol configuration markers payload TxDatum file (test only)"
+  sensitive   = true
   default     = ""
 }