From 6cb6a9678491054a9973411b35b354bfbfef9837 Mon Sep 17 00:00:00 2001 From: swrup Date: Tue, 12 May 2026 04:10:43 +0200 Subject: [PATCH] add --postgres-password cmdline arg + `make keys` --- .gitignore | 2 +- GNUmakefile | 19 +++++++++--- default/assets/mte.conf | 47 ++++++++++++++--------------- default/master_offline_private_key | Bin 32 -> 0 bytes src/config.ml | 4 --- src/env.ml | 1 + src/mte.ml | 31 ++++++++++++++++--- src/mte_device.ml | 3 +- test/management.sh | 16 +++++++--- tools/offline.ml | 12 +++----- tools/offline_impl.ml | 2 +- 11 files changed, 84 insertions(+), 53 deletions(-) delete mode 100644 default/master_offline_private_key diff --git a/.gitignore b/.gitignore index 3adc2256..b66b38c4 100644 --- a/.gitignore +++ b/.gitignore @@ -2,4 +2,4 @@ _build _dbinit_sql vendors assets -secmod.fat +keys diff --git a/GNUmakefile b/GNUmakefile index af5de323..7acecb82 100644 --- a/GNUmakefile +++ b/GNUmakefile @@ -1,4 +1,4 @@ -storage=secmod.fat +storage=./keys/secmod.fat service=tap0 setup-switch: @@ -15,12 +15,22 @@ clean: rm -rf _build/ rm -rf vendors/ -assets: - @cp -r default/assets ./ +keys: + @mkdir -p keys + @dune exec tools/offline.exe -- generate-eddsa-key --output ./keys/master + @read -sp "Enter postgres password: " POSTGRES_PASSWORD; \ + echo; \ + printf $${POSTGRES_PASSWORD} > ./keys/postgres_password secmod.fat: mfat make --sectors=2048 $(storage) +assets: + @cp -r default/assets ./ + +config: + @sed "s/%%MASTER_PUBLIC_KEY%%/$$(cat ./keys/master.pub)/" -i assets/mte.conf + src/manifest.json: @dune exec src/mte.exe > src/manifest.json @@ -29,4 +39,5 @@ build: vendors @dune build --workspace dune-workspace.solo5 src/mte.exe run: build - @solo5-hvt --block:storage=$(storage) --net:service=$(service) -- ./_build/solo5/src/mte.exe + @solo5-hvt --block:storage=$(storage) --net:service=$(service) -- ./_build/solo5/src/mte.exe \ + --postgres-password=$$(cat ./keys/postgres_password) diff --git a/default/assets/mte.conf b/default/assets/mte.conf index 9a5ffcec..5af941ea 100644 --- a/default/assets/mte.conf +++ b/default/assets/mte.conf @@ -7,28 +7,6 @@ fractional_normal_digits= 2 fractional_trailing_zero_digits= 2 alt_unit_names= "{"0":"ク","3":"kク"}" -[exchange] -currency = KUDOS -currency_round_unit = KUDOS:0.01 -db = postgres -attribute_encryption_key = "deadbeef" -port = 3434 -bind_to = localhost -master_public_key = "SJ0NYND22VQP3MP7FM754RDX8HCKVWAXTHY9SQNBTPRJZ2SPM2S0" -stefan_abs = KUDOS:0.00 -stefan_log = KUDOS:0.00 -stefan_lin = 0.00 -aggregator_idle_sleep_interval = "1 hour" -closer_idle_sleep_interval = "1 hour" -transfer_idle_sleep_interval = "1 hour" -wirewatch_idle_sleep_interval = "1 hour" -signkey_legal_duration = "1 year" -max_keys_caching = "4 weeks" -enable_kyc = NO -terms_etag = "0" -privacy_etag = "0" -base_url = "http://10.0.0.2:3434/" - [exchangedb] idle_reserve_expiration_time = "1 year 2 weeks 3 hours 4 minutes 5 seconds" legal_reserve_expiration_time = "1 year" @@ -36,9 +14,6 @@ aggregator_shift = "1 year" max_aml_program_runtime = "1 year" default_purse_limit = 9999 -[exchangedb-postgres] -config = "pgx://mte:hunter2@10.0.0.1:5432/taler-exchange" - [taler-exchange-secmod-rsa] lookahead_sign = "1 year" overlap_duration = "1 hour" @@ -74,3 +49,25 @@ fee_refund= KUDOS:0.00 cipher= RSA rsa_keysize= 2048 age_restricted= NO + +[exchange] +currency = KUDOS +currency_round_unit = KUDOS:0.01 +db = postgres +stefan_abs = KUDOS:0.00 +stefan_log = KUDOS:0.00 +stefan_lin = 0.00 +aggregator_idle_sleep_interval = "1 hour" +closer_idle_sleep_interval = "1 hour" +transfer_idle_sleep_interval = "1 hour" +wirewatch_idle_sleep_interval = "1 hour" +signkey_legal_duration = "1 year" +max_keys_caching = "4 weeks" +enable_kyc = NO +terms_etag = "0" +privacy_etag = "0" +bind_to = 10.0.0.2 +port = 3434 +base_url = "http://10.0.0.2/" +attribute_encryption_key = "deadbeef" +master_public_key = "%%MASTER_PUBLIC_KEY%%" diff --git a/default/master_offline_private_key b/default/master_offline_private_key deleted file mode 100644 index 739df00753dec0a45457613e2fa155040b7b1640..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 32 ocmeBTT_Rt)l0mH8LojFl=5=BInT@*|pKCD8z4+JNTQJuH0MexmUjP6A diff --git a/src/config.ml b/src/config.ml index 28fc01eb..279915a0 100644 --- a/src/config.ml +++ b/src/config.ml @@ -62,10 +62,6 @@ module Exchangedb = struct let default_purse_limit = get "default_purse_limit" |> int end -module Exchangedb_postgres = struct - let config = get config ~section:"exchangedb-postgres" ~field:"config" |> uri -end - module Currency = struct type t = { enabled: [ `YES | `NO ]; diff --git a/src/env.ml b/src/env.ml index d93b4e4e..34e0343b 100644 --- a/src/env.ml +++ b/src/env.ml @@ -4,4 +4,5 @@ type t = { tcp: Mnet.TCP.state; dns: Mnet_dns.t; fs: Fat.t; + db_uri: Uri.t; } diff --git a/src/mte.ml b/src/mte.ml index c2f21c82..5ef72da0 100644 --- a/src/mte.ml +++ b/src/mte.ml @@ -50,10 +50,9 @@ let routes = module RNG = Mirage_crypto_rng.Fortuna -let t0 = Mkernel.clock_monotonic () - -let () = +let run postgres_password = let ( let@ ) finally fn = Fun.protect ~finally fn in + let t0 = Mkernel.clock_monotonic () in Log_reporter.setup ~t0; let rng = let rng () = Mirage_crypto_rng_mkernel.initialize (module RNG) in @@ -81,6 +80,30 @@ let () = Vifu.Devices.[ Mte_device.sm_eddsa; Mte_device.sm_rsa; Mte_device.pool ] in let handlers = [ Mte_handler.not_implemented_route ] in - let env = { Env.sw; stack; tcp; dns; fs } in + let env = + let db_uri = + Uri.of_string + @@ Fmt.str "pgx://mte:%s@10.0.0.1:5432/taler-exchange" postgres_password + in + { Env.sw; stack; tcp; dns; fs; db_uri } + in Logs.info (fun m -> m "Starting MTE server"); Vifu.run ~cfg ~devices ~handlers tcp routes env + +open Cmdliner + +(* todo: tls *) +let postgres_password = + let doc = "PostgreSQL password." in + let open Arg in + required & opt (some string) None & info [ "postgres-password" ] ~doc + +let term = + let open Term in + const run $ postgres_password + +let cmd = + let info = Cmd.info "blame" in + Cmd.v info term + +let () = Cmd.(exit @@ eval cmd) diff --git a/src/mte_device.ml b/src/mte_device.ml index 3398534a..8a02eeaa 100644 --- a/src/mte_device.ml +++ b/src/mte_device.ml @@ -9,9 +9,8 @@ let sm_rsa = Vifu.Device.v ~name:"secmod-rsa" ~finally [] f let pool : (Env.t, Pg.pool) Vifu.Device.device = - let f { Env.sw; stack; tcp; dns; fs= _ } = + let f { Env.sw; stack; tcp; dns; db_uri; fs= _ } = Logs.info (fun m -> m "Connecting to database"); - let db_uri = Config.Exchangedb_postgres.config in let post_connect conn = Pg.preflight conn in match Caqti_mnet.connect_pool ~post_connect ~sw stack tcp dns db_uri with | Error e -> diff --git a/test/management.sh b/test/management.sh index 6437e1ae..defa3bb0 100755 --- a/test/management.sh +++ b/test/management.sh @@ -4,14 +4,20 @@ set -e a="/tmp/a.json" b="/tmp/b.json" - -url="http://10.0.0.2:3434" -auditor_pub="A17JXR3E6J4CXDPYT7S1H25PGJ3ABS26TQ38654QCX0TB59RPMF0" -master_key="./default/master_offline_private_key" zero_kudos="KUDOS:0.0" -# TODO launch mte.exe and kill it a then end with its PID +url="http://10.0.0.2:3434" +if [ ! -d ./keys ]; then + echo "./keys folder not found" + exit 1 +fi +master_key="./keys/master" +#auditor_pub=$(cat "./keys/auditor_0.pub") +auditor_pub="BQCHC907487KZD5BYD7S8AV2RY8Z5QZSJQVM4JJ8VBH17SPET2BG" + + +# TODO launch mte.exe and kill it a then end with its PID mte-offline-tool() { dune exec mte-offline-tool -- "$@" > /dev/null } diff --git a/tools/offline.ml b/tools/offline.ml index d4cf4bd0..f52e6e49 100644 --- a/tools/offline.ml +++ b/tools/offline.ml @@ -85,10 +85,8 @@ let url = let doc = "url" in Arg.(required & opt (some string) None & info [ "url" ] ~doc) -let setup_cmd = - let doc = - "Generate offline master keys, write private and public key to file" - in +let generate_eddsa_key_cmd = + let doc = "Generate a Ed25519 key pair" in let output = let doc = "private key output file" in Arg.(required & opt (some filepath) None & info [ "o"; "output" ] ~doc) @@ -100,11 +98,11 @@ let setup_cmd = in Arg.(value & opt (some filepath) None & info [ "output-pubkey" ] ~doc) in - Cmd.make (Cmd.info "setup" ~doc) + Cmd.make (Cmd.info "generate-eddsa-key" ~doc) @@ let+ output = output and+ output_pubkey = output_pubkey in let output_pubkey = Option.value ~default:(output ^ ".pub") output_pubkey in - setup ~output ~output_pubkey + generate_eddsa_key ~output ~output_pubkey let download_cmd = let doc = @@ -333,7 +331,7 @@ let cli = in Cmd.group info [ - setup_cmd; + generate_eddsa_key_cmd; download_cmd; sign_cmd; upload_cmd; diff --git a/tools/offline_impl.ml b/tools/offline_impl.ml index 362c5f6c..fbd403f7 100644 --- a/tools/offline_impl.ml +++ b/tools/offline_impl.ml @@ -201,7 +201,7 @@ let upload ~input ~url = % ("@" ^ input) % url) -let setup ~output ~output_pubkey = +let generate_eddsa_key ~output ~output_pubkey = Result.unwrap_err @@ let priv, pub = Mirage_crypto_ec.Ed25519.generate () in