chore: observability and security for HTTP gateway

Dockerfile

@@ -194,7 +194,8 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM
     if [[ -z "${SCCACHE_MEMCACHED}" ]] ; then unset SCCACHE_MEMCACHED ; fi ; \
     cargo build \
         --profile "$CARGO_BUILD_PROFILE" \
-        --package drive-abci && \
+        --package drive-abci \
+        --locked && \
     cp /platform/target/*/drive-abci /artifacts/ && \
     if [[ "${RUSTC_WRAPPER}" == "sccache" ]] ; then sccache --show-stats; fi
 

packages/dashmate/README.md

@@ -71,11 +71,11 @@ $ dashmate update
 ║ Drive ABCI       │ dashpay/drive:0.24           │ updated    ║
 ║ Drive Tenderdash │ dashpay/tenderdash:0.11.2    │ up to date ║
 ║ DAPI API         │ dashpay/dapi:0.24            │ updated    ║
-║ DAPI Envoy       │ dashpay/envoy:0.24           │ updated    ║
+║ Gateway          │ dashpay/envoy:0.24           │ updated    ║
 ║ Dashmate Helper  │ dashpay/dashmate-helper:0.24 │ updated    ║
 ╚══════════════════╧══════════════════════════════╧════════════╝
 $ dashmate update --format=json 
-[{"name":"core","title":"Core","updated":false,"image":"dashpay/dashd:19.2.0"},{"name":"drive_abci","title":"Drive ABCI","pulled":false,"image":"dashpay/drive:0.24"},{"name":"drive_tenderdash","title":"Drive Tenderdash","pulled":true,"image":"dashpay/tenderdash:0.11.2"},{"name":"dapi_api","title":"DAPI API","pulled":false,"image":"dashpay/dapi:0.24"},{"name":"dapi_envoy","title":"DAPI Envoy","pulled":false,"image":"dashpay/envoy:0.24"},{"name":"dashmate_helper","title":"Dashmate Helper","pulled":false,"image":"dashpay/dashmate-helper:0.24"}]
+[{"name":"core","title":"Core","updated":false,"image":"dashpay/dashd:19.2.0"},{"name":"drive_abci","title":"Drive ABCI","pulled":false,"image":"dashpay/drive:0.24"},{"name":"drive_tenderdash","title":"Drive Tenderdash","pulled":true,"image":"dashpay/tenderdash:0.11.2"},{"name":"dapi_api","title":"DAPI API","pulled":false,"image":"dashpay/dapi:0.24"},{"name":"gateway","title":"Gateway","pulled":false,"image":"dashpay/envoy:0.24"},{"name":"dashmate_helper","title":"Dashmate Helper","pulled":false,"image":"dashpay/dashmate-helper:0.24"}]
 $ dashmate start
 ```
 
@@ -503,7 +503,7 @@ again all your service configs (dashd.conf, config.toml, etc.), you can issue th
 
 ```bash
 dashmate config render
-Config "testnet" service configs rendered
+"testnet" service configs rendered
 ```
 
 ### Development

packages/dashmate/configs/defaults/getBaseConfigFactory.js

@@ -125,34 +125,85 @@ export default function getBaseConfigFactory(homeDir) {
         indexes: true,
       },
       platform: {
-        dapi: {
-          envoy: {
-            docker: {
-              image: 'dashpay/envoy:1.22.11',
+        gateway: {
+          docker: {
+            image: 'dashpay/envoy:1.30.2-impr.1',
+          },
+          maxConnections: 1000,
+          maxHeapSizeInBytes: 125000000, // 1 Gb
+          upstreams: {
+            driveGrpc: {
+              maxRequests: 100,
             },
-            http: {
+            dapiApi: {
+              maxRequests: 100,
+            },
+            dapiCoreStreams: {
+              maxRequests: 100,
+            },
+            dapiJsonRpc: {
+              maxRequests: 100,
+            },
+          },
+          metrics: {
+            enabled: false,
+            host: '127.0.0.1',
+            port: 9090,
+          },
+          admin: {
+            enabled: false,
+            host: '127.0.0.1',
+            port: 9901,
+          },
+          listeners: {
+            dapiAndDrive: {
+              http2: {
+                maxConcurrentStreams: 10,
+              },
               host: '0.0.0.0',
               port: 443,
-              connectTimeout: '5s',
-              responseTimeout: '15s',
             },
-            rateLimiter: {
-              maxTokens: 300,
-              tokensPerFill: 150,
-              fillInterval: '60s',
-              enabled: true,
+          },
+          log: {
+            level: 'info',
+            accessLogs: [
+              {
+                type: 'stdout',
+                format: 'text',
+                template: null,
+              },
+            ],
+          },
+          rateLimiter: {
+            docker: {
+              image: 'envoyproxy/ratelimit:3fcc3609',
             },
-            ssl: {
+            metrics: {
               enabled: false,
-              provider: 'zerossl',
-              providerConfigs: {
-                zerossl: {
-                  apiKey: null,
-                  id: null,
-                },
+              docker: {
+                image: 'prom/statsd-exporter:v0.26.1',
               },
+              host: '127.0.0.1',
+              port: 9102,
             },
+            unit: 'minute',
+            requestsPerUnit: 150,
+            blacklist: [],
+            whitelist: [],
+            enabled: true,
           },
+          ssl: {
+            enabled: false,
+            provider: 'zerossl',
+            providerConfigs: {
+              zerossl: {
+                apiKey: null,
+                id: null,
+              },
+            },
+          },
+        },
+        dapi: {
           api: {
             docker: {
               image: `dashpay/dapi:${dockerImageVersion}`,
@@ -191,7 +242,7 @@ export default function getBaseConfigFactory(homeDir) {
               enabled: false,
               host: '127.0.0.1',
               port: 6669,
-              retention_secs: 60 * 3,
+              retention: 60 * 3,
             },
             validatorSet: {
               llmqType: 4,
@@ -201,6 +252,11 @@ export default function getBaseConfigFactory(homeDir) {
               dkgInterval: 288,
               llmqSize: 400,
             },
+            metrics: {
+              enabled: false,
+              host: '127.0.0.1',
+              port: 29090,
+            },
             epochTime: 788400,
           },
           tenderdash: {

packages/dashmate/configs/defaults/getLocalConfigFactory.js

@@ -36,17 +36,17 @@ export default function getLocalConfigFactory(getBaseConfig) {
         },
       },
       platform: {
-        dapi: {
-          envoy: {
-            ssl: {
-              provider: SSL_PROVIDERS.SELF_SIGNED,
-            },
-            http: {
+        gateway: {
+          ssl: {
+            provider: SSL_PROVIDERS.SELF_SIGNED,
+          },
+          listeners: {
+            dapiAndDrive: {
               port: 2443,
             },
-            rateLimiter: {
-              enabled: false,
-            },
+          },
+          rateLimiter: {
+            enabled: false,
           },
         },
         drive: {

packages/dashmate/configs/defaults/getTestnetConfigFactory.js

@@ -44,9 +44,9 @@ export default function getTestnetConfigFactory(homeDir, getBaseConfig) {
         },
       },
       platform: {
-        dapi: {
-          envoy: {
-            http: {
+        gateway: {
+          listeners: {
+            dapiAndDrive: {
               port: 1443,
             },
           },

packages/dashmate/configs/getConfigFileMigrationsFactory.js

@@ -57,7 +57,7 @@ export default function getConfigFileMigrationsFactory(homeDir, defaultConfigs)
 
             options.platform.dapi.api.docker.image = base.get('platform.dapi.api.docker.image');
 
-            options.platform.dapi.envoy.docker.image = base.get('platform.dapi.envoy.docker.image');
+            options.platform.gateway.docker.image = base.get('platform.gateway.docker.image');
           });
 
         return configFile;
@@ -106,7 +106,7 @@ export default function getConfigFileMigrationsFactory(homeDir, defaultConfigs)
       '0.24.16': (configFile) => {
         Object.entries(configFile.configs)
           .forEach(([, options]) => {
-            options.platform.dapi.envoy.docker = base.get('platform.dapi.envoy.docker');
+            options.platform.gateway.docker = base.get('platform.gateway.docker');
 
             options.platform.dapi.api.docker.build = base.get('platform.dapi.api.docker.build');
 
@@ -382,7 +382,7 @@ export default function getConfigFileMigrationsFactory(homeDir, defaultConfigs)
 
             options.core.p2p.host = base.get('core.p2p.host');
             options.core.rpc.host = base.get('core.rpc.host');
-            options.platform.dapi.envoy.http.host = base.get('platform.dapi.envoy.http.host');
+            options.platform.dapi.envoy.http.host = '0.0.0.0';
             options.platform.drive.tenderdash.p2p.host = base.get('platform.drive.tenderdash.p2p.host');
             options.platform.drive.tenderdash.rpc.host = base.get('platform.drive.tenderdash.rpc.host');
             options.platform.drive.tenderdash.metrics.host = base.get('platform.drive.tenderdash.metrics.host');
@@ -401,8 +401,8 @@ export default function getConfigFileMigrationsFactory(homeDir, defaultConfigs)
       '0.25.20': (configFile) => {
         Object.entries(configFile.configs)
           .forEach(([name, options]) => {
-            options.platform.dapi.envoy.http.connectTimeout = base.get('platform.dapi.envoy.http.connectTimeout');
-            options.platform.dapi.envoy.http.responseTimeout = base.get('platform.dapi.envoy.http.responseTimeout');
+            options.platform.dapi.envoy.http.connectTimeout = '5s';
+            options.platform.dapi.envoy.http.responseTimeout = '15s';
 
             options.platform.drive.tenderdash.rpc.maxOpenConnections = base.get('platform.drive.tenderdash.rpc.maxOpenConnections');
 
@@ -523,9 +523,92 @@ export default function getConfigFileMigrationsFactory(homeDir, defaultConfigs)
       },
       '1.0.0-dev.12': (configFile) => {
         Object.entries(configFile.configs)
-          .forEach(([, options]) => {
+          .forEach(([name, options]) => {
+            // Update tenderdash config
             options.platform.drive.tenderdash.docker.image = base.get('platform.drive.tenderdash.docker.image');
             options.platform.drive.tenderdash.mempool.maxConcurrentCheckTx = base.get('platform.drive.tenderdash.mempool.maxConcurrentCheckTx');
+
+            // Add metrics to Drive ABCI
+            options.platform.drive.abci.metrics = base.get('platform.drive.abci.metrics');
+
+            // Envoy -> Gateway
+            if (options.platform.dapi.envoy) {
+              options.platform.gateway = lodash.cloneDeep(options.platform.dapi.envoy);
+
+              // add new options
+              options.platform.gateway.maxConnections = base.get('platform.gateway.maxConnections');
+              options.platform.gateway.maxHeapSizeInBytes = base.get('platform.gateway.maxHeapSizeInBytes');
+              options.platform.gateway.metrics = base.get('platform.gateway.metrics');
+              options.platform.gateway.admin = base.get('platform.gateway.admin');
+              options.platform.gateway.upstreams = base.get('platform.gateway.upstreams');
+              options.platform.gateway.log = base.get('platform.gateway.log');
+
+              // http -> listeners
+              options.platform.gateway.listeners = lodash.cloneDeep(
+                base.get('platform.gateway.listeners'),
+              );
+
+              options.platform.gateway.listeners.dapiAndDrive.host = options.platform.dapi.envoy
+                .http.host;
+              options.platform.gateway.listeners.dapiAndDrive.port = options.platform.dapi.envoy
+                .http.port;
+
+              delete options.platform.gateway.http;
+
+              // update rate limiter
+              options.platform.gateway.rateLimiter.docker = base.get('platform.gateway.rateLimiter.docker');
+              options.platform.gateway.rateLimiter.unit = base.get('platform.gateway.rateLimiter.unit');
+              options.platform.gateway.rateLimiter.requestsPerUnit = base.get('platform.gateway.rateLimiter.requestsPerUnit');
+              options.platform.gateway.rateLimiter.blacklist = base.get('platform.gateway.rateLimiter.blacklist');
+              options.platform.gateway.rateLimiter.whitelist = base.get('platform.gateway.rateLimiter.whitelist');
+              options.platform.gateway.rateLimiter.metrics = base.get('platform.gateway.rateLimiter.metrics');
+
+              delete options.platform.gateway.rateLimiter.fillInterval;
+              delete options.platform.gateway.rateLimiter.maxTokens;
+              delete options.platform.gateway.rateLimiter.tokensPerFill;
+
+              // delete envoy
+              delete options.platform.dapi.envoy;
+
+              // update image
+              options.platform.gateway.docker.image = base.get('platform.gateway.docker.image');
+            }
+
+            // rename non conventional field
+            if (options.platform.drive.abci.tokioConsole.retention_secs) {
+              options.platform.drive.abci.tokioConsole.retention = options.platform.drive.abci
+                .tokioConsole.retention_secs;
+              delete options.platform.drive.abci.tokioConsole.retention_secs;
+            }
+
+            // move SSL files
+            if (options.network !== NETWORK_MAINNET) {
+              const filenames = ['private.key', 'bundle.crt', 'bundle.csr', 'csr.pem'];
+
+              for (const filename of filenames) {
+                const oldFilePath = homeDir.joinPath(
+                  name,
+                  'platform',
+                  'dapi',
+                  'envoy',
+                  'ssl',
+                  filename,
+                );
+                const newFilePath = homeDir.joinPath(
+                  name,
+                  'platform',
+                  'gateway',
+                  'ssl',
+                  filename,
+                );
+
+                if (fs.existsSync(oldFilePath)) {
+                  fs.mkdirSync(path.dirname(newFilePath), { recursive: true });
+                  fs.copyFileSync(oldFilePath, newFilePath);
+                  fs.rmSync(oldFilePath, { recursive: true });
+                }
+              }
+            }
           });
 
         return configFile;

packages/dashmate/docker-compose.build.dapi_tx_filter_stream.yml → packages/dashmate/docker-compose.build.dapi_core_streams.yml

@@ -1,7 +1,7 @@
 version: '3.7'
 
 services:
-  dapi_tx_filter_stream:
+  dapi_core_streams:
     build:
       context: ${PLATFORM_DAPI_API_DOCKER_BUILD_CONTEXT:?err}
       dockerfile: ${PLATFORM_DAPI_API_DOCKER_BUILD_DOCKER_FILE:?err}

packages/dashmate/docker-compose.rate_limiter.metrics.yml

@@ -0,0 +1,20 @@
+version: '3.7'
+
+services:
+  gateway_rate_limiter_metrics:
+    image: ${PLATFORM_GATEWAY_RATE_LIMITER_METRICS_DOCKER_IMAGE:?err}
+    labels:
+      org.dashmate.service.title: "Gateway rate limiter metrics exporter"
+    restart: unless-stopped
+    entrypoint: /bin/statsd_exporter
+    command:
+      - "--statsd.mapping-config=/etc/statsd-exporter/config.yaml"
+    networks:
+      - gateway_rate_limiter
+    volumes:
+      - ${DASHMATE_HOME_DIR:?err}/${CONFIG_NAME:?err}/platform/gateway/rate_limiter/statsd_exporter.yaml:/etc/statsd-exporter/config.yaml:ro
+    expose:
+      - 9125
+      - 9125/udp
+    ports:
+      - ${PLATFORM_GATEWAY_RATE_LIMITER_METRICS_HOST:?err}:${PLATFORM_GATEWAY_RATE_LIMITER_METRICS_PORT:?err}:9102