From 0cb69fd19b081bbe56393ad4595ba0c764f0d6a0 Mon Sep 17 00:00:00 2001 From: Nina Date: Thu, 5 Feb 2026 14:26:19 +0000 Subject: [PATCH] move pg password to env (#380) --- .env.example | 5 ++++- config.example.yml | 1 - crates/common/src/config.rs | 11 ++++++----- crates/relay/src/api/admin_service.rs | 18 ++++++++---------- crates/relay/src/api/mod.rs | 6 +++--- .../database/postgres/postgres_db_service.rs | 6 ++++-- crates/relay/src/main.rs | 6 ++++-- crates/simulator/src/block_merging/mod.rs | 2 -- crates/simulator/src/block_merging/types.rs | 1 - 9 files changed, 29 insertions(+), 27 deletions(-) diff --git a/.env.example b/.env.example index 472005251..6e83a818b 100644 --- a/.env.example +++ b/.env.example @@ -2,4 +2,7 @@ RUST_LOG=info RUST_BACKTRACE="full" # BLS private key to sign Builder API responses -RELAY_KEY=0x64496d4e301e541a6e1237d6ef13a8f8b8b6cb82be9d8ac90073a833dfc2af11 \ No newline at end of file +RELAY_KEY=0x64496d4e301e541a6e1237d6ef13a8f8b8b6cb82be9d8ac90073a833dfc2af11 + +POSTGRES_PASSWORD=password +ADMIN_TOKEN=test diff --git a/config.example.yml b/config.example.yml index 9e2464f1c..b6f571cfb 100644 --- a/config.example.yml +++ b/config.example.yml @@ -4,7 +4,6 @@ postgres: port: 5432 db_name: postgres user: postgres - password: password region: 0 region_name: "LOCAL" broadcasters: diff --git a/crates/common/src/config.rs b/crates/common/src/config.rs index 102d7dcf1..53de4e46f 100644 --- a/crates/common/src/config.rs +++ b/crates/common/src/config.rs @@ -1,4 +1,4 @@ -use std::{collections::HashSet, fs::File, path::PathBuf}; +use std::{collections::HashSet, env, fs::File, path::PathBuf}; use clap::Parser; use eyre::ensure; @@ -50,7 +50,6 @@ pub struct RelayConfig { pub inclusion_list: Option, pub is_submission_instance: bool, pub is_registration_instance: bool, - pub admin_token: String, #[serde(default)] is_local_dev: bool, /// Cores configuration, recommended to be set for production use @@ -83,7 +82,6 @@ impl RelayConfig { inclusion_list: Default::default(), is_submission_instance: Default::default(), is_registration_instance: Default::default(), - admin_token: Default::default(), is_local_dev: Default::default(), cores: CoresConfig { auctioneer: 1, @@ -169,8 +167,12 @@ pub fn load_config + DeserializeOwned>() -> R { config } +pub fn expect_env_var(env_var: &str) -> String { + env::var(env_var).expect(&format!("{} should be set", env_var)) +} + pub fn load_keypair() -> BlsKeypair { - let signing_key_str = std::env::var("RELAY_KEY").expect("could not find RELAY_KEY in env"); + let signing_key_str = expect_env_var("RELAY_KEY"); let signing_key_bytes = alloy_primitives::hex::decode(signing_key_str).expect("invalid RELAY_KEY bytes"); @@ -189,7 +191,6 @@ pub struct PostgresConfig { pub port: u16, pub db_name: String, pub user: String, - pub password: String, pub region: i16, pub region_name: String, } diff --git a/crates/relay/src/api/admin_service.rs b/crates/relay/src/api/admin_service.rs index 65e419181..826e75d6b 100644 --- a/crates/relay/src/api/admin_service.rs +++ b/crates/relay/src/api/admin_service.rs @@ -1,15 +1,15 @@ use std::{net::SocketAddr, sync::Arc}; use axum::{Extension, Router, http::StatusCode, response::IntoResponse, routing::post}; -use helix_common::{RelayConfig, local_cache::LocalCache}; +use helix_common::local_cache::LocalCache; use tower_http::validate_request::ValidateRequestHeaderLayer; use tracing::{error, info}; -pub async fn run_admin_service(auctioneer: Arc, config: RelayConfig) { +pub async fn run_admin_service(auctioneer: Arc, admin_token: String) { let router = Router::new() .route("/admin/v1/killswitch", post(enable_kill_switch).delete(disable_kill_switch)) .layer(Extension(auctioneer)) - .layer(ValidateRequestHeaderLayer::bearer(&config.admin_token)); + .layer(ValidateRequestHeaderLayer::bearer(&admin_token)); let listener = tokio::net::TcpListener::bind("0.0.0.0:4050").await.unwrap(); match axum::serve(listener, router.into_make_service_with_connect_info::()).await { @@ -39,7 +39,7 @@ async fn disable_kill_switch( mod test { use std::sync::Arc; - use helix_common::{config, local_cache::LocalCache}; + use helix_common::local_cache::LocalCache; use serial_test::serial; use crate::api::admin_service::run_admin_service; @@ -49,9 +49,8 @@ mod test { async fn test_admin_service() { let auctioneer = Arc::new(LocalCache::new_test()); - let mut config = config::RelayConfig::empty_for_test(); - config.admin_token = "test_token".into(); - tokio::spawn(run_admin_service(auctioneer.clone(), config)); + let admin_token = "test_token".into(); + tokio::spawn(run_admin_service(auctioneer.clone(), admin_token)); tokio::time::sleep(std::time::Duration::from_secs(1)).await; // wait for server to start let client = reqwest::Client::new(); @@ -79,9 +78,8 @@ mod test { async fn test_admin_service_unauthorized() { let auctioneer = Arc::new(LocalCache::new_test()); - let mut config = config::RelayConfig::empty_for_test(); - config.admin_token = "test_token".into(); - tokio::spawn(run_admin_service(auctioneer.clone(), config)); + let admin_token = "test_token".into(); + tokio::spawn(run_admin_service(auctioneer.clone(), admin_token)); tokio::time::sleep(std::time::Duration::from_secs(1)).await; // wait for server to start let client = reqwest::Client::new(); diff --git a/crates/relay/src/api/mod.rs b/crates/relay/src/api/mod.rs index 31d5752b9..cd772269e 100644 --- a/crates/relay/src/api/mod.rs +++ b/crates/relay/src/api/mod.rs @@ -2,7 +2,7 @@ use std::sync::Arc; -use helix_common::{RelayConfig, api_provider::ApiProvider, local_cache::LocalCache}; +use helix_common::{api_provider::ApiProvider, local_cache::LocalCache}; pub use service::start_api_service; pub use crate::auctioneer::{BidAdjustor, DefaultBidAdjustor}; @@ -16,8 +16,8 @@ pub mod relay_data; pub mod router; pub mod service; -pub fn start_admin_service(auctioneer: Arc, config: &RelayConfig) { - tokio::spawn(admin_service::run_admin_service(auctioneer, config.clone())); +pub fn start_admin_service(auctioneer: Arc, admin_token: String) { + tokio::spawn(admin_service::run_admin_service(auctioneer, admin_token)); } pub trait Api: Clone + Send + Sync + 'static { diff --git a/crates/relay/src/database/postgres/postgres_db_service.rs b/crates/relay/src/database/postgres/postgres_db_service.rs index 91401aa5c..1628343c1 100644 --- a/crates/relay/src/database/postgres/postgres_db_service.rs +++ b/crates/relay/src/database/postgres/postgres_db_service.rs @@ -23,6 +23,7 @@ use helix_common::{ proposer_api::{GetHeaderParams, ValidatorRegistrationInfo}, }, bid_submission::OptimisticVersion, + expect_env_var, metrics::{CACHE_SIZE, DbMetricRecord}, utils::utcnow_ms, }; @@ -58,6 +59,7 @@ struct PendingBlockSubmissionValue { const BLOCK_SUBMISSION_FIELD_COUNT: usize = 17; const MAINNET_VALIDATOR_COUNT: usize = 1_100_000; static DELIVERED_PAYLOADS_MIG_SLOT: AtomicU64 = AtomicU64::new(0); +const POSTGRES_PASSWORD_ENV_VAR: &'static str = "POSTGRES_PASSWORD"; fn new_validator_set() -> FxHashSet { FxHashSet::with_capacity_and_hasher(MAINNET_VALIDATOR_COUNT, Default::default()) @@ -106,7 +108,7 @@ impl PostgresDatabaseService { cfg.port = Some(relay_config.postgres.port); cfg.dbname = Some(relay_config.postgres.db_name.clone()); cfg.user = Some(relay_config.postgres.user.clone()); - cfg.password = Some(relay_config.postgres.password.clone()); + cfg.password = Some(expect_env_var(POSTGRES_PASSWORD_ENV_VAR)); cfg.manager = Some(ManagerConfig { recycling_method: RecyclingMethod::Fast }); let pool = loop { @@ -129,7 +131,7 @@ impl PostgresDatabaseService { } }; - PostgresDatabaseService { + Self { validator_registration_cache: Arc::new(DashMap::new()), pending_validator_registrations: Arc::new(DashSet::new()), block_submissions_sender: None, diff --git a/crates/relay/src/main.rs b/crates/relay/src/main.rs index 2c90303e7..3efae53b9 100644 --- a/crates/relay/src/main.rs +++ b/crates/relay/src/main.rs @@ -10,7 +10,7 @@ use eyre::eyre; use helix_common::{ RelayConfig, api_provider::DefaultApiProvider, - load_config, load_keypair, + expect_env_var, load_config, load_keypair, local_cache::LocalCache, metrics::start_metrics_server, signing::RelaySigningContext, @@ -30,6 +30,8 @@ use tracing::{error, info}; #[global_allocator] static GLOBAL: Jemalloc = Jemalloc; +const ADMIN_TOKEN_ENV_VAR: &'static str = "ADMIN_TOKEN"; + #[derive(Clone)] struct ApiProd; @@ -112,7 +114,7 @@ async fn run(instance_id: String, config: RelayConfig, keypair: BlsKeypair) -> e let terminating = Arc::new(AtomicBool::default()); - start_admin_service(local_cache.clone(), &config); + start_admin_service(local_cache.clone(), expect_env_var(ADMIN_TOKEN_ENV_VAR)); tokio::spawn(start_api_service::( config.clone(), diff --git a/crates/simulator/src/block_merging/mod.rs b/crates/simulator/src/block_merging/mod.rs index b173b6929..7f5116bea 100644 --- a/crates/simulator/src/block_merging/mod.rs +++ b/crates/simulator/src/block_merging/mod.rs @@ -26,7 +26,6 @@ use reth_ethereum::{ Evm, EvmEnvFor, EvmError, block::{BlockExecutionError, BlockExecutor}, execute::BlockBuilder as RethBlockBuilder, - tx, }, revm::{cached::CachedReads, database::StateProviderDatabase}, }, @@ -41,7 +40,6 @@ use reth_primitives::{GotExpected, Recovered}; use revm::{ DatabaseCommit, DatabaseRef, database::{CacheDB, State}, - interpreter::gas, state::AccountInfo, }; use tracing::{debug, info, warn}; diff --git a/crates/simulator/src/block_merging/types.rs b/crates/simulator/src/block_merging/types.rs index dbefc1ef9..6a7d52381 100644 --- a/crates/simulator/src/block_merging/types.rs +++ b/crates/simulator/src/block_merging/types.rs @@ -9,7 +9,6 @@ use reth_node_builder::ConfigureEvm; use reth_primitives::{NodePrimitives, Recovered}; use serde::{Deserialize, Serialize}; use serde_with::{DisplayFromStr, serde_as}; -use tracing::debug; pub(crate) type SignedTx = <::Primitives as NodePrimitives>::SignedTx; pub(crate) type RecoveredTx = Recovered;