devnet-7: deploy the agent PoW faucet + fix browser faucet gas limit

ansible/inventories/devnet-7/group_vars/all/images.yaml

@@ -33,7 +33,7 @@ default_tooling_images:
   forkmon: skylenet/nodemonitor:darkmode
   forky: ethpandaops/forky:latest
   fauceth: skylenet/fauceth:fix_fee_estimation
-  powfaucet: pk910/powfaucet:v2.5.0
+  powfaucet: pk910/powfaucet:v2-latest # master build: app-default ethTxGasLimit 250000 covers Amsterdam account-creation transfers
   homepage: ethpandaops/ethereum-testnet-homepage:latest
   checkpointz: ethpandaops/checkpointz:gloas-latest
   blockscout: blockscout/blockscout:latest

kubernetes/devnet-7/faucet-agents/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

kubernetes/devnet-7/faucet-agents/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: powfaucet
+  repository: https://ethpandaops.github.io/ethereum-helm-charts
+  version: 1.1.0
+digest: sha256:15e636ee1bc3f6a623f755f35fe468a6743f69c2c34362b493a690fc1e5df50c
+generated: "2026-07-30T14:46:58.185790087+02:00"

kubernetes/devnet-7/faucet-agents/Chart.yaml

@@ -0,0 +1,11 @@
+# Ansible managed. Don't change this file manually. Template info: /vendor/collections/ansible_collections/ethpandaops/general/roles/generate_kubernetes_config/templates/Chart.yaml.j2
+
+apiVersion: v2
+name: faucet-agents
+description: A Helm chart for Kubernetes
+type: application
+version: 0.1.0
+dependencies:
+  - name: powfaucet
+    repository: https://ethpandaops.github.io/ethereum-helm-charts
+    version: 1.1.0

kubernetes/devnet-7/faucet-agents/values.yaml

@@ -0,0 +1,121 @@
+# Ansible managed. Don't change this file manually. Template info: /vendor/collections/ansible_collections/ethpandaops/general/roles/generate_kubernetes_config/templates/powfaucet.yaml.j2
+
+powfaucet:
+  fullnameOverride: powfaucet-agents
+
+  image:
+    repository: ghcr.io/qu0b/powfaucet
+    tag: v2.5.0-agent.5
+    pullPolicy: IfNotPresent
+
+  resources:
+    requests:
+      cpu: 200m
+      memory: 500Mi
+    limits:
+      cpu: 400m
+      memory: 1Gi
+
+  ingress:
+    enabled: true
+
+    className: ingress-nginx-public
+
+    hosts:
+      - host: faucet-agents.glamsterdam-devnet-7.ethpandaops.io
+        paths:
+          - path: /
+            pathType: Prefix
+  httpProxyCount: 2
+
+  faucetTitle: "glamsterdam-devnet-7 Agent Faucet"
+  faucetPrivkey: "<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.faucet_agents_private_key}>"
+  faucetRpcUrl: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-bootnode-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+  faucetRpcEndpoints:
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-bootnode-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "bootnode-1"
+      priority: 10
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-grandine-nethermind-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "grandine-nethermind-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-lighthouse-nethermind-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "lighthouse-nethermind-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-prysm-nethermind-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "prysm-nethermind-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-lodestar-nethermind-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "lodestar-nethermind-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-nimbus-nethermind-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "nimbus-nethermind-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-teku-nethermind-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "teku-nethermind-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-buildoor-teku-nethermind-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "buildoor-teku-nethermind-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-grandine-geth-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "grandine-geth-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-lighthouse-geth-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "lighthouse-geth-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-buildoor-lighthouse-geth-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "buildoor-lighthouse-geth-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-prysm-geth-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "prysm-geth-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-lodestar-geth-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "lodestar-geth-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-nimbus-geth-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "nimbus-geth-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-teku-geth-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "teku-geth-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-grandine-reth-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "grandine-reth-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-lighthouse-reth-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "lighthouse-reth-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-prysm-reth-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "prysm-reth-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-lodestar-reth-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "lodestar-reth-1"
+      priority: 5
+    - url: "https://<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.node_ingress.combined}>@rpc-nimbus-reth-1.srv.glamsterdam-devnet-7.ethpandaops.io"
+      name: "nimbus-reth-1"
+      priority: 5
+  faucetExplorerLink: "https://dora.glamsterdam-devnet-7.ethpandaops.io/tx/{txid}"
+
+  faucetCaptchaEnabled: false
+  faucetCaptchaSitekey: "<path:/secrets/services/services.enc.yaml#hcaptcha | jsonPath {.site_key}>"
+  faucetCaptchaSecret: "<path:/secrets/services/services.enc.yaml#hcaptcha | jsonPath {.secret_key}>"
+
+  # IP-reputation checks make no sense when the faucet is only reached via the
+  # panda proxy (every request carries the proxy's IP), so agents disable it.
+  faucetIpinfoEnabled: false
+
+  # Same reason: behind the proxy all traffic shares one IP, so per-IP
+  # concurrency collapses to one global session. Limit per target address only.
+  faucetConcurrencyByAddrOnly: true
+
+  # And per-IP recurring limits would be one global budget for all agents.
+  faucetRecurringLimitsByAddrOnly: true
+
+  faucetRecurringLimitsAmountWei: 5000000000000000000000 # 5000 ETH
+  faucetMaxDropWei: 500000000000000000000 # 500 ETH
+  faucetPowEnabled: true
+  faucetPowRewardPerHash: 1000000000000000000 # 1 ETH
+  faucetPowDifficulty: 8
+
+
+  extraEnv:
+    - name: FAUCET_ETH_REST_WALLET_KEY
+      value: "<path:/secrets/services/services.enc.yaml#ethereum | jsonPath {.testnets.glamsterdam-devnets.faucet_agents_rest_private_key}>"

kubernetes/devnet-7/faucet/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: powfaucet
   repository: https://ethpandaops.github.io/ethereum-helm-charts
-  version: 1.0.0
-digest: sha256:5ba73a4c822eb4020cf4417ec7f451e29548719a6fd337896b820b6132c7f99f
-generated: "2026-07-14T09:57:21.183530735Z"
+  version: 1.1.0
+digest: sha256:15e636ee1bc3f6a623f755f35fe468a6743f69c2c34362b493a690fc1e5df50c
+generated: "2026-07-30T14:45:58.225719902+02:00"

kubernetes/devnet-7/faucet/Chart.yaml

@@ -8,4 +8,4 @@ version: 0.1.0
 dependencies:
   - name: powfaucet
     repository: https://ethpandaops.github.io/ethereum-helm-charts
-    version: 1.0.0
+    version: 1.1.0

kubernetes/devnet-7/faucet/values.yaml

@@ -5,8 +5,8 @@ powfaucet:
 
   image:
     repository: pk910/powfaucet
-    tag: v2.5.0
-    pullPolicy: IfNotPresent
+    tag: v2-latest
+    pullPolicy: Always
 
   resources:
     requests:
@@ -99,12 +99,22 @@ powfaucet:
       name: "nimbus-reth-1"
       priority: 5
   faucetExplorerLink: "https://dora.glamsterdam-devnet-7.ethpandaops.io/tx/{txid}"
-  faucetTxGasLimit: 100000
 
   faucetCaptchaEnabled: true
   faucetCaptchaSitekey: "<path:/secrets/services/services.enc.yaml#hcaptcha | jsonPath {.site_key}>"
   faucetCaptchaSecret: "<path:/secrets/services/services.enc.yaml#hcaptcha | jsonPath {.secret_key}>"
 
+  # IP-reputation checks make no sense when the faucet is only reached via the
+  # panda proxy (every request carries the proxy's IP), so agents disable it.
+  faucetIpinfoEnabled: true
+
+  # Same reason: behind the proxy all traffic shares one IP, so per-IP
+  # concurrency collapses to one global session. Limit per target address only.
+  faucetConcurrencyByAddrOnly: false
+
+  # And per-IP recurring limits would be one global budget for all agents.
+  faucetRecurringLimitsByAddrOnly: false
+
   faucetRecurringLimitsAmountWei: 5000000000000000000000 # 5000 ETH
   faucetMaxDropWei: 500000000000000000000 # 500 ETH
   faucetPowEnabled: true
@@ -127,3 +137,4 @@ powfaucet:
       - recurring-limits
       - faucet-outflow
 
+