DorianandClaude Fable 5
d73f1ab8b7
CI / check (push) Failing after 6m16s
"Connect NWC" was 500ing — server/src/engine/crypto.ts's getKey() throws immediately under NODE_ENV=production when this var is unset. Generated a random 32-byte key directly on the VPS2 host into /opt/botfights-arena/.env (0600, never committed — same pattern as JWT_SECRET), wired the reference into the deployed docker-compose.yml, and restarted. Only enables storing per-user NWC connection strings encrypted at rest — does not enable any actual money movement (BOTFIGHTS_NWC_URL, the arena's own wallet, is still unset and deliberately not touched here). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
73 lines
3.6 KiB
YAML
73 lines
3.6 KiB
YAML
# docker-compose.arena.yml — the CANONICAL public BotFights arena
|
|
#
|
|
# This is the counterpart to docker-compose.yml (the local/dev stack). It runs
|
|
# ONLY the published registry image (no `build:` section — the arena runs exactly
|
|
# what nodes run, never a locally-built variant), with payments deliberately
|
|
# unconfigured and no reverse proxy in front (direct exposure on :9100, so the
|
|
# app's own rate limiter must see the real socket peer IP — see TRUSTED_PROXY note
|
|
# below).
|
|
#
|
|
# Deploy notes live in docs/arena-deployment.md — this file has no secrets. The
|
|
# JWT_SECRET value is generated on the host into /opt/botfights-arena/.env (0600,
|
|
# never committed).
|
|
#
|
|
# Arena-as-relay: this compose file is not special — it is the SAME image any
|
|
# node can run standalone (no ARENA_UPSTREAM_URL) to host its own public arena.
|
|
# The Foundation's VPS2 instance below is just the well-known default rendezvous,
|
|
# not a hardcoded authority. See docs/arena-deployment.md "Hosting your own arena".
|
|
|
|
services:
|
|
botfights-arena:
|
|
image: localhost:3000/lfg2025/botfights:1.2.7
|
|
container_name: botfights-arena
|
|
restart: unless-stopped
|
|
ports:
|
|
- "9100:9100"
|
|
volumes:
|
|
- botfights-arena-data:/app/server/data
|
|
# Explicit override (not just relying on the image's baked-in HEALTHCHECK):
|
|
# the currently published 1.1.0 tag predated the Dockerfile's HEALTHCHECK
|
|
# directive; kept for continuity across image rolls.
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://localhost:9100/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
start_period: 10s
|
|
retries: 3
|
|
environment:
|
|
- NODE_ENV=production
|
|
- PORT=9100
|
|
- FIGHT_LOOP_ENABLED=true
|
|
- PUBLIC_ARENA_URL=https://botfights.archipelago-foundation.org
|
|
# TRUSTED_PROXY=1 since 2026-07-30: the arena now sits behind
|
|
# nginx-proxy-manager at https://botfights.archipelago-foundation.org
|
|
# (Let's Encrypt cert, live). The app trusts X-Forwarded-For from NPM
|
|
# for its per-IP rate limiting instead of the raw socket peer (which
|
|
# would otherwise see every request as coming from NPM's own IP).
|
|
- TRUSTED_PROXY=1
|
|
# Auth — value comes from the host .env, never hardcoded here.
|
|
# Generated on VPS2 with: openssl rand -hex 32 (see docs/arena-deployment.md)
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- BOTFIGHTS_CREATOR_PUBKEYS=${BOTFIGHTS_CREATOR_PUBKEYS:-da5e0c1b646bdb13c2300f805b0ca3e5afe5b052c594ce78bac8978d21c3fa39}
|
|
# Deliberately OMITTED: this instance IS the upstream — never point it at
|
|
# another arena.
|
|
# - ARENA_UPSTREAM_URL=
|
|
# Encrypts stored per-user NWC connection strings at rest (AES-256-GCM,
|
|
# server/src/engine/crypto.ts) — without it, "Connect NWC" 500s
|
|
# immediately (getKey() throws under NODE_ENV=production). Generated on
|
|
# the host into /opt/botfights-arena/.env (0600, never committed),
|
|
# same pattern as JWT_SECRET above.
|
|
- BOTFIGHTS_WALLET_ENCRYPTION_KEY=${BOTFIGHTS_WALLET_ENCRYPTION_KEY}
|
|
# Actual money movement is still deliberately NOT enabled (phase 09
|
|
# CONTEXT.md scope fence: "OUT: Lightning/cashu payment changes" — the
|
|
# encryption key above only lets per-user wallet strings be stored, it
|
|
# doesn't move any funds on its own). A Cashu-based fixed-stake
|
|
# ("winner takes all, 21 sats") entry-fee design is being scoped
|
|
# separately before any of these are set:
|
|
# - BOTFIGHTS_NWC_URL= (the ARENA's OWN wallet — real funds)
|
|
# - BOTFIGHTS_CASHU_MINT_URL=
|
|
# - BOTFIGHTS_DEV_PAYOUT_LNADDRESS=
|
|
|
|
volumes:
|
|
botfights-arena-data:
|