Dev hyper aos migration

.github/workflows/release-action.yml

@@ -5,6 +5,7 @@ on:
     branches: main
     tags:
       - v*
+  workflow_dispatch:
 env:
   IMAGE_NAME: staking-rewards-controller
 
@@ -45,20 +46,3 @@ jobs:
 
           docker tag $IMAGE_NAME $IMAGE_ID:${GITHUB_SHA}
           docker push $IMAGE_ID:${GITHUB_SHA}
-
-      - name: Deploy new version
-        env:
-          NOMAD_CACERT: admin-ui-ca.crt
-          NOMAD_TOKEN: ${{ secrets.NOMAD_TOKEN_STAKING_REWARDS_CONTROLLER_DEPLOY }}
-          NOMAD_ADDR: ${{ secrets.NOMAD_ADDR }}
-        run: |
-          curl -L https://releases.hashicorp.com/nomad/1.10.2/nomad_1.10.2_linux_amd64.zip -o nomad.zip
-          unzip nomad.zip
-
-          if grep -q "stage" deploy-vars.json; then
-            sed -i "s/\[\[ .commit_sha \]\]/${GITHUB_SHA}/g" operations/staking-rewards-controller-stage.hcl
-            ./nomad job run operations/staking-rewards-controller-stage.hcl
-          else
-            sed -i "s/\[\[ .commit_sha \]\]/${GITHUB_SHA}/g" operations/staking-rewards-controller-live.hcl
-            ./nomad job run operations/staking-rewards-controller-live.hcl
-          fi

README.md

@@ -149,7 +149,6 @@ addresses, Vault for secrets.
 | --- | --- |
 | `ONIONOO_DETAILS_URI` | Onionoo `/details` endpoint for relay data. **Required for scoring.** |
 | `DETAILS_URI_AUTH` | Optional `Authorization` header value for the details endpoint. |
-| `ANYONE_API_URL` | ANYONE API base URL. |
 
 ### EVM / HODLER contract
 
@@ -165,7 +164,7 @@ addresses, Vault for secrets.
 | --- | --- |
 | `STAKING_REWARDS_PROCESS_ID` | AO process ID for the staking rewards process (`Add-Scores`, `Complete-Round`, `Last-Snapshot`). |
 | `OPERATOR_REGISTRY_PROCESS_ID` | AO process ID for the operator registry (`View-State`). |
-| `CU_URL` | AO Compute Unit URL used by `@permaweb/aoconnect`. |
+| `HB_URL` | Our HyperBEAM node, e.g. `https://hb.anyone.tech`. No default — the service refuses to start without it. |
 
 ### Arweave bundling (ArDrive Turbo)
 

operations/staking-rewards-controller-live.hcl

@@ -1,3 +1,8 @@
+variable "commit_sha" {
+  type        = string
+  description = "The git commit SHA to use for the runtime image tag"
+}
+
 job "staking-rewards-controller-live" {
   datacenters = ["ator-fin"]
   type = "service"
@@ -28,13 +33,13 @@ job "staking-rewards-controller-live" {
       driver = "docker"
       config {
         network_mode = "host"
-        image = "ghcr.io/anyone-protocol/staking-rewards-controller:[[ .commit_sha ]]"
+        image = "ghcr.io/anyone-protocol/staking-rewards-controller:${var.commit_sha}"
         force_pull = true
       }
 
       env {
         IS_LIVE="true"
-        VERSION="[[ .commit_sha ]]"
+        VERSION = var.commit_sha
         REDIS_MODE="sentinel"
         REDIS_MASTER_NAME="operator-checks-live-redis-master"
         ROUND_PERIOD_SECONDS="3600"
@@ -43,17 +48,20 @@ job "staking-rewards-controller-live" {
         NO_COLOR="1"
         MIN_HEALTHY_CONSENSUS_WEIGHT="50"
 
-        CU_URL="https://cu.anyone.tech"
+        # Our own HyperBEAM node — replaces CU_URL (D17). The edge whitelists
+        # `/~meta@1.0` and `^/{contract-pid}`, covering both the `~process@1.0/now/...`
+        # reads and the `~process@1.0/push` writes.
+        HB_URL="https://hb.anyone.tech"
         ONIONOO_REQUEST_TIMEOUT="60000"
         ONIONOO_REQUEST_MAX_REDIRECTS="3"
         IS_LOCAL_LEADER="true"
         CPU_COUNT="1"
         CONSUL_HOST="${NOMAD_IP_http}"
         CONSUL_PORT="8500"
         CONSUL_SERVICE_NAME="staking-rewards-controller-live"
-        BUNDLER_GATEWAY="https://ar.anyone.tech"
-        BUNDLER_NODE="https://upload.ardrive.io"
-        # BUNDLER_NODE="https://ar.anyone.tech/bundler"
+        # Our own node once /~bundler@1.0/tx is edge-allowed + the signer is faff-allow-listed:
+        #   BUNDLER_NODE="https://hb.anyone.tech"
+        BUNDLER_NODE="https://up.arweave.net"
       }
 
       vault {
@@ -89,9 +97,6 @@ job "staking-rewards-controller-live" {
         REDIS_SENTINEL_3_HOST={{ .Address }}
         REDIS_SENTINEL_3_PORT={{ .Port }}
         {{- end }}
-        {{- range service "api-service-live" }}
-        ANYONE_API_URL="http://{{ .Address }}:{{ .Port }}"
-        {{- end }}
         EOH
         destination = "local/config.env"
         env         = true
@@ -102,7 +107,6 @@ job "staking-rewards-controller-live" {
         {{ $allocIndex := env "NOMAD_ALLOC_INDEX" }}
         {{ with secret "kv/live-protocol/staking-rewards-controller-live" }}
         STAKING_REWARDS_CONTROLLER_KEY="{{.Data.data.STAKING_REWARDS_CONTROLLER_KEY}}"
-        BUNDLER_NETWORK="{{.Data.data.BUNDLER_NETWORK}}"
         BUNDLER_CONTROLLER_KEY="{{.Data.data.STAKING_REWARDS_CONTROLLER_KEY}}"
         CONSUL_TOKEN_CONTROLLER_CLUSTER="{{.Data.data.CONSUL_TOKEN_CONTROLLER_CLUSTER}}"
         EVM_JSON_RPC="https://mainnet.infura.io/v3/{{ index .Data.data (print `INFURA_API_KEY_` $allocIndex) }}"

operations/staking-rewards-controller-stage.hcl

@@ -1,3 +1,8 @@
+variable "commit_sha" {
+  type        = string
+  description = "The git commit SHA to use for the runtime image tag"
+}
+
 job "staking-rewards-controller-stage" {
   datacenters = ["ator-fin"]
   type = "service"
@@ -28,31 +33,34 @@ job "staking-rewards-controller-stage" {
       driver = "docker"
       config {
         network_mode = "host"
-        image = "ghcr.io/anyone-protocol/staking-rewards-controller:[[ .commit_sha ]]"
+        image = "ghcr.io/anyone-protocol/staking-rewards-controller:${var.commit_sha}"
         force_pull = true
       }
 
       env {
         IS_LIVE="true"
-        VERSION="[[ .commit_sha ]]"
+        VERSION = var.commit_sha
         REDIS_MODE="sentinel"
         REDIS_MASTER_NAME="operator-checks-stage-redis-master"
         ROUND_PERIOD_SECONDS="900"
         DO_CLEAN="true"
         PORT="${NOMAD_PORT_http}"
         NO_COLOR="1"
         MIN_HEALTHY_CONSENSUS_WEIGHT="50"
-        CU_URL="https://cu-stage.anyone.tech"
+        # Our own HyperBEAM node — replaces CU_URL (D17). The edge whitelists
+        # `/~meta@1.0` and `^/{contract-pid}`, covering both the `~process@1.0/now/...`
+        # reads and the `~process@1.0/push` writes.
+        HB_URL="https://hb-stage.anyone.tech"
         ONIONOO_REQUEST_TIMEOUT="60000"
         ONIONOO_REQUEST_MAX_REDIRECTS="3"
         IS_LOCAL_LEADER="true"
         CPU_COUNT="1"
         CONSUL_HOST="${NOMAD_IP_http}"
         CONSUL_PORT="8500"
         CONSUL_SERVICE_NAME="staking-rewards-controller-stage"
-        BUNDLER_GATEWAY="https://ar.anyone.tech"
-        BUNDLER_NODE="https://upload.ardrive.io"
-        # BUNDLER_NODE="https://ar.anyone.tech/bundler"
+        # Our own node once /~bundler@1.0/tx is edge-allowed + the signer is faff-allow-listed:
+        #   BUNDLER_NODE="https://hb.anyone.tech"
+        BUNDLER_NODE="https://up.arweave.net"
       }
 
       vault {
@@ -88,9 +96,6 @@ job "staking-rewards-controller-stage" {
         REDIS_SENTINEL_3_HOST={{ .Address }}
         REDIS_SENTINEL_3_PORT={{ .Port }}
         {{- end }}
-        {{- range service "api-service-stage" }}
-        ANYONE_API_URL="http://{{ .Address }}:{{ .Port }}"
-        {{- end }}
         EOH
         destination = "local/config.env"
         env         = true
@@ -101,7 +106,6 @@ job "staking-rewards-controller-stage" {
         {{ $allocIndex := env "NOMAD_ALLOC_INDEX" }}
         {{ with secret "kv/stage-protocol/staking-rewards-controller-stage" }}
         STAKING_REWARDS_CONTROLLER_KEY="{{.Data.data.STAKING_REWARDS_CONTROLLER_KEY}}"
-        BUNDLER_NETWORK="{{.Data.data.BUNDLER_NETWORK}}"
         BUNDLER_CONTROLLER_KEY="{{.Data.data.STAKING_REWARDS_CONTROLLER_KEY}}"
         CONSUL_TOKEN_CONTROLLER_CLUSTER="{{.Data.data.CONSUL_TOKEN_CONTROLLER_CLUSTER}}"
         EVM_JSON_RPC="https://sepolia.infura.io/v3/{{ index .Data.data (print `INFURA_API_KEY_` $allocIndex) }}"