2ro
33c5ee568f
ci / fmt / clippy / test (push) Has been cancelled
Production has run GP_NYM=off for over a day: GoblinPay already reaches its relays over clearnet, which is the end state the ecosystem's Nym → Tor move aims for. This removes the now-dead ported Nym client and its plumbing. Pure subtraction — the code path that remains is exactly the one already running live, so there is no behavior change beyond "GoblinPay still boots and still moves money." Per TOR-MIGRATION-PLAN.md. Removed: - crates/gp-nostr/src/nym/ (mod, transport, nymproc, dns — 599 lines). - smolmix + hickory-proto (and the nym-only rand) deps from gp-nostr, and their transitive tree from Cargo.lock. - GP_NYM config plumbing (gp-core config: field, parse, default, summary), the opts.nym service branch, the main.rs warm-up wiring, and the admin dashboard Nym row. - The nym leg of the CI sibling-checkout gate (.github + .gitea), the `COPY nym` / sibling mentions in Dockerfile/compose/install.sh, and the GP_NYM copy in README, .env.example, and the three connector docs. GoblinPay does not gain a Tor transport of its own: it is receive-only infrastructure, and the sender privacy that matters rides the paying customer's own Goblin Wallet. Content encryption (NIP-44 in a NIP-59 gift-wrap) and the slatepack (grin1) path are untouched. The optional onion-dialing and relay-list trim the plan flags are left for the owner.
90 lines
2.8 KiB
YAML
90 lines
2.8 KiB
YAML
# A full, self-contained GoblinPay till: the server, its BUNDLED relay, and an
|
|
# auto-HTTPS reverse proxy.
|
|
#
|
|
# cd deploy
|
|
# cp .env.example .env # then edit it (domain, tokens)
|
|
# mkdir -p secrets # drop the mounted-secret files in here
|
|
# docker compose up -d
|
|
#
|
|
# gives you:
|
|
# - gp-server : the GoblinPay payment server (this repo)
|
|
# - relay : a stock nostr-rs-relay, the bundled relay GP_RELAY_MODE=bundled
|
|
# points at (so no third-party relay is needed)
|
|
# - caddy : auto-TLS reverse proxy terminating HTTPS for both
|
|
#
|
|
# Set GP_DOMAIN in .env to your own domain BEFORE bringing it up: Caddy obtains
|
|
# a certificate for it, so DNS must already point at this host.
|
|
#
|
|
# NOTE on the build context: gp-server's Nostr path depends on the sibling
|
|
# crate nip44/ (see deploy/Dockerfile), so the build context is the workspace
|
|
# parent (`../..`) that holds GoblinPay and nip44.
|
|
|
|
services:
|
|
gp-server:
|
|
build:
|
|
context: ../..
|
|
dockerfile: GoblinPay/deploy/Dockerfile
|
|
image: goblinpay:latest
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
environment:
|
|
# Bundled relay (default mode). GP_BUNDLED_RELAY_URL is BOTH dialed by the
|
|
# server and advertised to payers in the nprofile, so it must be the
|
|
# relay's PUBLIC url (payers connect here); the server reaches it back
|
|
# through Caddy.
|
|
GP_RELAY_MODE: bundled
|
|
GP_BUNDLED_RELAY_URL: ${GP_BUNDLED_RELAY_URL:-wss://relay.${GP_DOMAIN}}
|
|
GP_PUBLIC_URL: ${GP_PUBLIC_URL:-https://${GP_DOMAIN}}
|
|
GP_BIND: 0.0.0.0:8080
|
|
GP_DB_PATH: /data/goblinpay.db
|
|
GP_DATA_DIR: /data/gp-data
|
|
# Money/identity secrets come from mounted files (never the image/env):
|
|
GP_MNEMONIC_FILE: /run/secrets/gp_mnemonic
|
|
GP_WALLET_PASSWORD_FILE: /run/secrets/gp_wallet_password
|
|
GP_NCRYPTSEC_FILE: /run/secrets/gp_ncryptsec
|
|
volumes:
|
|
- gp-data:/data
|
|
- ./secrets:/run/secrets:ro
|
|
expose:
|
|
- "8080"
|
|
depends_on:
|
|
- relay
|
|
|
|
relay:
|
|
image: scsibug/nostr-rs-relay:latest
|
|
restart: unless-stopped
|
|
volumes:
|
|
- ./relay/nostr-rs-relay.toml:/usr/src/app/config.toml:ro
|
|
- relay-data:/usr/src/app/db
|
|
expose:
|
|
- "7777"
|
|
# Bound the relay's footprint so an unauthenticated flood cannot starve the
|
|
# till or proxy on the same host.
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 512M
|
|
cpus: "1.0"
|
|
|
|
caddy:
|
|
image: caddy:2
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- gp-server
|
|
- relay
|
|
environment:
|
|
GP_DOMAIN: ${GP_DOMAIN:-pay.example}
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- caddy-data:/data
|
|
- caddy-config:/config
|
|
|
|
volumes:
|
|
gp-data:
|
|
relay-data:
|
|
caddy-data:
|
|
caddy-config:
|