Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Using Docker secrets #44

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Using Docker secrets #44

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5f78208
Update README.md
Mahmood1717 Jan 19, 2024
61b6c09
Update .env.example
Mahmood1717 Jan 19, 2024
8cca952
Update run.sh
Mahmood1717 Jan 19, 2024
7b2d3d2
Update docker-compose.yml
Mahmood1717 Jan 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,5 +89,5 @@ NODE_PUBLIC_IP_PROVIDER=seeip

# TODO: Operators need to add password to decrypt the above keys
# If you have some special characters in password, make sure to use single quotes
NODE_ECDSA_KEY_PASSWORD=''
NODE_BLS_KEY_PASSWORD=''
NODE_ECDSA_KEY_PASSWORD=/run/secrets/ecdsa_key_password
NODE_BLS_KEY_PASSWORD=/run/secrets/bls_key_password
5 changes: 5 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,11 @@ cp .env.example .env
```
Update the `TODO` sections in the `.env` file given in the root directory of the repository with your own details.:

### Create Docker Secrets
```bash
echo "your_ecdsa_password" | docker secret create ecdsa_key_password -
echo "your_bls_password" | docker secret create bls_key_password -
```
### Create some local folders which are required by EigenDA
```bash
mkdir -p $HOME/.eigenlayer/eigenda/logs
Expand Down
8 changes: 8 additions & 0 deletions docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,9 @@ services:
da-node:
env_file:
- .env
secrets:
- ecdsa_key_password
- bls_key_password
container_name: ${MAIN_SERVICE_NAME}
image: ${MAIN_SERVICE_IMAGE}
ports:
Expand All @@ -36,6 +39,11 @@ services:
- "${NODE_LOG_PATH_HOST}:/app/logs:rw"
- "${NODE_DB_PATH_HOST}:/data/operator/db:rw"
restart: unless-stopped
secrets:
ecdsa_key_password:
external: true
bls_key_password:
external: true
networks:
eigenda:
name: ${NETWORK_NAME}
22 changes: 17 additions & 5 deletions run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,18 @@
# which causes the password to be incorrect.
# To test that try running `docker run --rm --env-file .env busybox /bin/sh -c 'echo $NODE_ECDSA_KEY_PASSWORD'`
# This will output password with single quote. Not sure why this happens.
# Function to read Docker secrets
read_secret() {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

where is this used?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's used to read the content of Docker secrets (ecdsa_key_password and bls_key_password) and pass them to the Docker containers securely.
--volume "ecdsa_key_password:/run/secrets/ecdsa_key_password:ro"
--volume "bls_key_password:/run/secrets/bls_key_password:ro"
These lines in the docker run command mount the Docker secrets into the appropriate paths within the containers. The "read_secret()" function ensures that the contents of these secrets are correctly provided when the script is executed.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok thanks. I will test this and update. thanks for the PR. appreciate it.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok thanks. I will test this and update. thanks for the PR. appreciate it.

hey, Is it passed the test?

secret_name=$1
secret_path="/run/secrets/$secret_name"
if [ -f "$secret_path" ]; then
cat "$secret_path"
else
echo "Error: Secret $secret_name not found."
exit 1
fi
}

optIn() {
socket="$NODE_HOSTNAME":"${NODE_DISPERSAL_PORT}"\;"${NODE_RETRIEVAL_PORT}"
echo "using socket: $socket"
Expand All @@ -16,9 +28,9 @@ optIn() {
--volume "${NODE_ECDSA_KEY_FILE_HOST}":/app/operator_keys/ecdsa_key.json \
--volume "${NODE_BLS_KEY_FILE_HOST}":/app/operator_keys/bls_key.json \
--volume "${NODE_LOG_PATH_HOST}":/app/logs:rw \
--volume "ecdsa_key_password:/run/secrets/ecdsa_key_password:ro" \
--volume "bls_key_password:/run/secrets/bls_key_password:ro" \
ghcr.io/layr-labs/eigenda/opr-nodeplugin:release-0.2.1 \
--ecdsa-key-password "$NODE_ECDSA_KEY_PASSWORD" \
--bls-key-password "$NODE_BLS_KEY_PASSWORD" \
--operation opt-in \
--socket "$socket"
}
Expand All @@ -30,9 +42,9 @@ optOut() {
--volume "${NODE_ECDSA_KEY_FILE_HOST}":/app/operator_keys/ecdsa_key.json \
--volume "${NODE_BLS_KEY_FILE_HOST}":/app/operator_keys/bls_key.json \
--volume "${NODE_LOG_PATH_HOST}":/app/logs:rw \
--volume "ecdsa_key_password:/run/secrets/ecdsa_key_password:ro" \
--volume "bls_key_password:/run/secrets/bls_key_password:ro" \
ghcr.io/layr-labs/eigenda/opr-nodeplugin:release-0.2.1 \
--ecdsa-key-password "$NODE_ECDSA_KEY_PASSWORD" \
--bls-key-password "$NODE_BLS_KEY_PASSWORD" \
--operation opt-out \
--socket "$socket"
}
Expand All @@ -43,4 +55,4 @@ elif [ "$1" = "opt-out" ]; then
optOut
else
echo "Invalid command"
fi
fi