22 KiB
22 KiB
phase, plan, type, wave, depends_on, files_modified, autonomous, requirements, must_haves
| phase | plan | type | wave | depends_on | files_modified | autonomous | requirements | must_haves | ||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 09-botfights-platform-upgrade | 04 | execute | 1 |
|
true |
|
|
Decision IDs map to 09-CONTEXT.md Locked Decisions: D-01 = BOT-01 signer login,
D-02 = BOT-02 unified prompt, D-03 = BOT-03 shared public match endpoint on VPS2,
D-04 = BOT-04 registry/catalog.
Purpose: this is the longest-latency item on the demo path because it needs a DNS record at the registrar and a certificate issuance, neither of which Claude can perform. Starting it in wave 1, in parallel with the app work, is deliberate — if DNS stalls, the fallback (plain HTTP on the public IP and port) is still enough for a cloud bot, and the plan says so explicitly rather than leaving the demo to discover it. Output: a running canonical arena on VPS2, a committed compose file and runbook, a public hostname with a valid certificate, and a recorded decision about what data the arena starts with.
Repos/hosts: compose + runbook are committed in /home/archipelago/Projects/botfight
(git push origin main); the arena itself runs on VPS2 (debian@146.59.87.168, key
~/.ssh/id_ed25519_vps168, docker not podman, passwordless sudo). VPS2 is host infrastructure —
the rootless-podman invariant applies to Archipelago nodes, not to this host.
<execution_context> @$HOME/.claude/gsd-core/workflows/execute-plan.md @$HOME/.claude/gsd-core/templates/summary.md </execution_context>
@.planning/PROJECT.md @.planning/ROADMAP.md @.planning/STATE.md @.planning/phases/09-botfights-platform-upgrade/09-CONTEXT.md @.planning/phases/09-botfights-platform-upgrade/09-RESEARCH.md @.planning/phases/09-botfights-platform-upgrade/09-PATTERNS.md @.planning/phases/09-botfights-platform-upgrade/09-VALIDATION.mdEnvironment facts verified during planning (do not re-derive, do re-check)
| Fact | Value |
|---|---|
| VPS2 access | ssh debian@146.59.87.168 with ~/.ssh/id_ed25519_vps168, passwordless sudo, docker |
| Ports already bound on VPS2 | 22, 80, 81, 443, 2100, 2101, 2222, 3000, 3009, 5355, 7788, 8000, 8092, 8123, 8443, 8444, 9443 — 9100 is free |
| NPM install | container nginx-proxy-manager-app-1, compose dir /home/debian/nginx-proxy-manager, data /home/debian/nginx-proxy-manager/data, admin UI on :81, admin user lfg2025@proton.me |
| Existing NPM proxy-host shape | forward_scheme=http, forward_host=146.59.87.168, forward_port=<port>, ssl_forced=1, allow_websocket_upgrade=1, Let's Encrypt cert (e.g. demo→2100, source→3000, fips→8444) |
| DNS | archipelago-foundation.org on ns29/ns30.domaincontrol.com (GoDaddy). demo./source./fips. resolve to 146.59.87.168. No wildcard — a new subdomain needs a new A record |
| Registry | 146.59.87.168:3000/lfg2025 (Gitea on the same host, so the arena can pull from localhost:3000) |
| Existing arena data on archi-dev-box | /var/lib/archipelago/botfights/botfights.db — 115 bots, 102,440 fights, 351 MB, payments/bets empty |
(1) **Hostname.** Planning recommends `arena.archipelago-foundation.org` — it matches the
established `<name>.archipelago-foundation.org` pattern already used by demo/source/fips/
companion, and it is what plan 09-06 will write into `apps/botfights/manifest.yml` as
`ARENA_UPSTREAM_URL`. Changing it later means re-signing and re-publishing the catalog.
(2) **Starting data.** archi-dev-box's existing BotFights instance holds 115 registered bots and
102,440 fights (351 MB). Once nodes switch to proxy mode, that local database stops being read —
it is preserved on disk, but those 115 fighters vanish from the UI unless the arena starts with
them.
Option A — fresh empty arena. Cleanest and most private; the demo starts with an empty
leaderboard and only bots registered from now on (including the cloud openclaw bot).
Option B — seed the `bots` table only (recommended). Copies the 115 fighter rows (name, ELO,
W/L, avatar, `secret_hash`, `public_key`) into a fresh arena DB and drops the 102k-row fight
history, so the arena is small, the leaderboard looks alive for the demo, and every bot script
that already holds credentials keeps working. It does publish those bot names and nostr pubkeys
on a public server.
Option C — copy the whole 351 MB database, fight history included. Most continuity, largest
surface, and carries `payments`/`bets` tables (both currently empty) onto a public host.
Reversibility: the arena DB is brand new and can be re-seeded or wiped until real users register
against it — so this is reversible today and progressively less so after the demo.
On VPS2 (`ssh debian@146.59.87.168`):
1. `sudo ss -tlnp` and confirm 9100 is still free before binding it.
2. Create `/opt/botfights-arena/`, copy `docker-compose.arena.yml` there as
`docker-compose.yml`, and write `/opt/botfights-arena/.env` containing
`JWT_SECRET=$(openssl rand -hex 32)` with mode 0600. Never print that value into the
transcript, a log, or any file under a git repo.
3. `docker compose up -d`, wait for the container's healthcheck, then verify on the host:
`curl -fsS http://127.0.0.1:9100/api/health` returns `{"status":"ok","name":"botfights"}`.
4. Apply the Task 1 data decision. For the seed options, export from archi-dev-box with a
read-only sqlite connection (the node's app is live — never write to its database), copy the
result to VPS2 over ssh, stop the arena container, place the file as the arena volume's
`botfights.db`, restart, and verify the bot count through `GET /api/bots`. For option A do
nothing beyond letting the app create its own database.
5. Confirm the arena is reachable from off-host on the raw port before any DNS exists:
from archi-dev-box, `curl -fsS http://146.59.87.168:9100/api/health`. If that fails, an OVH
or ufw firewall rule is blocking 9100 — record it in the runbook and note that the plain-HTTP
contingency in Task 3 depends on it.
Write `docs/arena-deployment.md` in the botfight repo covering: the host and directory, the
port, how the secret is generated and where it lives, the exact NPM proxy-host field values, the
DNS record, the seed decision that was taken, how to roll the image tag, and how to tear it
down. NPM routing and the host `.env` are not git-tracked — this file is the only record.
Verify reachability from OFF the VPS: from archi-dev-box, `curl -fsS --max-time 10
http://146.59.87.168:9100/api/health`. If it fails, check and fix host-level firewalling on
VPS2 (`sudo ufw status`, iptables, and note OVH network-level firewall may need the user).
Record the final reachable URL + any firewall change in `docs/arena-deployment.md` and in
09-04-SUMMARY.md — plans 09-05/09-06/09-07 read the arena URL from there.
<threat_model>
Trust Boundaries
| Boundary | Description |
|---|---|
| public internet → nginx-proxy-manager :443 | TLS termination; the only intended public entrance |
| public internet → 146.59.87.168:9100 | The raw container port, reachable while it is bound to all interfaces |
| VPS2 host filesystem → arena container | /opt/botfights-arena/.env carries the JWT signing key |
| arena container → its SQLite volume | The single source of truth for every node's fighters |
STRIDE Threat Register
| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan |
|---|---|---|---|---|---|
| T-09-16 | Information disclosure | credentials over plain HTTP on the raw port | high | accept (user decision 2026-07-30) | User explicitly chose plain HTTP on :9100 over DNS/TLS setup; recorded in runbook with the env-only TLS upgrade path for later |
| T-09-17 | Information disclosure | JWT_SECRET leaking into git, logs or docker inspect transcripts |
high | mitigate | Generated on the host into a 0600 .env outside any repo; the compose file only carries ${JWT_SECRET}; the value is never echoed |
| T-09-18 | Spoofing | forged X-Forwarded-For from a direct caller to :9100 bypassing per-IP limits |
medium | accept | TRUSTED_PROXY is required for the arena to honour those headers and NPM overwrites X-Real-IP for traffic through 443; a direct caller can already choose its own source IP cheaply, so this adds no meaningful capability |
| T-09-19 | Denial of service | anonymous bot-registration flooding the public arena | medium | mitigate | Existing rateLimit(3600_000, 5) on POST /api/bots, now meaningful per real client IP thanks to TRUSTED_PROXY |
| T-09-20 | Information disclosure | seeded bot rows publishing nostr pubkeys to the internet | medium | transfer | Surfaced as an explicit decision (Task 1) with the fresh-database option available; the user owns this choice |
| T-09-21 | Tampering | writing to archi-dev-box's live database while exporting a seed | high | mitigate | Export uses a read-only sqlite URI; the acceptance criteria assert the source file is unmodified |
| T-09-22 | Denial of service | binding a port already in use on a shared host | low | mitigate | 9100 verified free during planning and re-checked before binding |
| </threat_model> |
<success_criteria>
- One canonical arena container runs on VPS2 with a host-generated secret and no payment config.
- Its compose definition and full runbook are committed to the botfight repo.
- The full-copy data seed is live (115 bots visible via /api/bots) and the source DB on archi-dev-box is untouched.
- The arena is internet-reachable at http://146.59.87.168:9100 (user-accepted plain HTTP; TLS is a later env-only upgrade). </success_criteria>