Initial commit
This commit is contained in:
Yaser
94
docs/QA-troubleshooting.md
Normal file
94
docs/QA-troubleshooting.md
Normal file
@@ -0,0 +1,94 @@
|
||||
<div dir="rtl">
|
||||
|
||||
# Alvand-P — QA و عیبیابی (Fibitex)
|
||||
|
||||
چکلیست عملیاتی برای staging (`beta.fibitex.com`) و لوکال. جزئیات deploy: [`Docs/Fibitex-staging-deploy.md`](../../Docs/Fibitex-staging-deploy.md).
|
||||
|
||||
## قبل از deploy
|
||||
|
||||
- [ ] `git pull` روی `Update2026`
|
||||
- [ ] `bundle install` (در صورت تغییر Gemfile)
|
||||
- [ ] `rake render:config` — **بدون EPERM** روی `config/frontend/shahoo.env.js`
|
||||
- [ ] Vault unsealed — [`scripts/unseal-vault.ps1`](../../scripts/unseal-vault.ps1) یا `rake vault:setup`
|
||||
- [ ] `COMPOSE_FILE` درست (همه composeهای لازم)
|
||||
|
||||
## render:config / EPERM
|
||||
|
||||
| علامت | رفع |
|
||||
|--------|-----|
|
||||
| `shahoo.env.js` directory بهجای فایل | پوشهٔ اشتباه را حذف؛ `rake render:config` دوباره |
|
||||
| EPERM روی Windows | ترمینال admin یا exclude antivirus روی `config/` |
|
||||
| تغییر template اعمال نشد | `rake render:config` نه فقط `restart` |
|
||||
|
||||
## Vault sealed
|
||||
|
||||
<div dir="ltr">
|
||||
|
||||
```bash
|
||||
docker compose exec vault vault status
|
||||
# Sealed → unseal با keys از ops
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
لوکال: `.\scripts\unseal-vault.ps1`
|
||||
|
||||
## Compose logging — recreate نه restart
|
||||
|
||||
`logging:` در compose فقط هنگام **create** کانتینر اعمال میشود.
|
||||
|
||||
<div dir="ltr">
|
||||
|
||||
```bash
|
||||
export COMPOSE_FILE=compose/app.yaml:compose/backend.yaml:compose/gateway.yaml:compose/proxy.yaml:compose/daemons.yaml:compose/frontend.yaml
|
||||
docker compose -p fibitex up -d --force-recreate
|
||||
docker inspect fibitex_peatio_1 --format '{{.HostConfig.LogConfig.Type}} {{.HostConfig.LogConfig.Config}}'
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
## دو stack Carbon موازی
|
||||
|
||||
**هرگز** همزمان `carbon` (legacy path) و `carbon_platform` با `-p carbon` up نکنید — لاگ و دیتا duplicate میشود.
|
||||
|
||||
فقط: `docker compose -p carbon -f docker-compose.prod.yml -f docker-compose.traefik.yml`
|
||||
|
||||
## Smoke tests
|
||||
|
||||
<div dir="ltr">
|
||||
|
||||
```bash
|
||||
curl -sS -o /dev/null -w '%{http_code}\n' https://beta.fibitex.com/
|
||||
curl -sS -o /dev/null -w '%{http_code}\n' https://shahoo.fibitex.com/health
|
||||
docker compose -p fibitex ps
|
||||
bash ~/main-code/scripts/check-docker-log-disk.sh
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
## دیسک / لاگ Docker
|
||||
|
||||
| علامت | اقدام |
|
||||
|--------|--------|
|
||||
| root >85% | `check-docker-log-disk.sh` exit 1 — `sudo truncate-docker-logs.sh` |
|
||||
| لاگ یک کانتینر >100MB | truncate (نیاز sudo) یا `--force-recreate` بعد از log rotation |
|
||||
| cron | `crontab -l` — هر ۶ ساعت → `~/log-disk-check.log` |
|
||||
|
||||
ارجاع: [`Docs/Fibitex-staging-deploy.md`](../../Docs/Fibitex-staging-deploy.md) §۸.۳، [`Docs/07-setup-server.md`](../../Docs/07-setup-server.md) §۶.۲
|
||||
|
||||
## Shahoo / BFF
|
||||
|
||||
- BFF: [`Shahoo-BFF/README.md`](../../Shahoo-BFF/README.md)
|
||||
- E2E: `.\scripts\test-shahoo-e2e.ps1`
|
||||
|
||||
## مستندات مرتبط
|
||||
|
||||
| سند | موضوع |
|
||||
|-----|--------|
|
||||
| [`Docs/Fibitex-staging-deploy.md`](../../Docs/Fibitex-staging-deploy.md) | Deploy staging |
|
||||
| [`Docs/07-setup-server.md`](../../Docs/07-setup-server.md) | Production |
|
||||
| [`Docs/06-setup-local.md`](../../Docs/06-setup-local.md) | لوکال |
|
||||
| [`Docs/troubleshoot-barong-authz.md`](troubleshoot-barong-authz.md) | Barong authz |
|
||||
| [`carbon_platform/Docs/QA-troubleshooting.md`](../../carbon_platform/Docs/QA-troubleshooting.md) | Carbon |
|
||||
|
||||
</div>
|
||||
83
docs/aws-install.md
Normal file
83
docs/aws-install.md
Normal file
@@ -0,0 +1,83 @@
|
||||
# AWS Installation Guide
|
||||
|
||||
## Step 1: Prepare the infrastructure
|
||||
|
||||
Infrastructural requirements for the installation are:
|
||||
|
||||
- An EC2 m5.xlarge **Debian** instance with a 200 GB disk storage
|
||||
- An Elastic Container Registry repository with the baseapp image
|
||||
- A DNS record to point to the machine(e.g. `example.domain.com`)
|
||||
|
||||
Create these resources before starting the installation and provision them with your RSA key to be able to connect to the VM instance using SSH.
|
||||
|
||||
## Step 2: Configure the instance
|
||||
|
||||
Connect to the instance over SSH as a `root`/`admin` user and perform the following steps.
|
||||
|
||||
### Core dependencies
|
||||
|
||||
```bash
|
||||
apt-get update
|
||||
apt-get install -y -q git tmux gnupg2 dirmngr dbus htop curl libmariadbclient-dev-compat build-essential
|
||||
```
|
||||
|
||||
### Docker installation
|
||||
|
||||
```bash
|
||||
curl -fsSL https://get.docker.com/ | bash
|
||||
usermod -a -G docker $USER
|
||||
|
||||
COMPOSE_VERSION="1.23.2"
|
||||
COMPOSE_URL="https://github.com/docker/compose/releases/download/$COMPOSE_VERSION/docker-compose-$(uname -s)-$(uname -m)"
|
||||
|
||||
curl -L "$COMPOSE_URL" -o /usr/local/bin/docker-compose
|
||||
chmod +x /usr/local/bin/docker-compose
|
||||
```
|
||||
|
||||
### User creation
|
||||
|
||||
```bash
|
||||
groupadd app
|
||||
useradd --create-home --home /home/app --shell /bin/bash \
|
||||
--gid app --groups docker,sudo app
|
||||
```
|
||||
|
||||
### Ruby installation
|
||||
|
||||
As the `app` user(`sudo su app`), run:
|
||||
|
||||
```bash
|
||||
gpg2 --keyserver hkp://pool.sks-keyservers.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB
|
||||
curl -sSL https://get.rvm.io | bash -s stable
|
||||
source /home/app/.rvm/scripts/rvm
|
||||
rvm install --quiet-curl 2.6.1
|
||||
rvm use --default 2.6.1
|
||||
gem install bundler
|
||||
```
|
||||
|
||||
## Step 3: Prepare the deployment
|
||||
|
||||
Clone the opendax repo to `/home/app`
|
||||
|
||||
```bash
|
||||
git clone git@git.openware.com:opendax
|
||||
```
|
||||
|
||||
`cd` into the `opendax` directory and prepare `config/app.yml` according to the [README](../README.md).
|
||||
|
||||
When the configuration is ready, run
|
||||
|
||||
```bash
|
||||
bundle install
|
||||
rake render:config
|
||||
rake parity:import && \
|
||||
until rake wallet:create['deposit','http://0.0.0.0:8545','changeme']; do sleep 15; done && \
|
||||
rake wallet:create['hot','http://0.0.0.0:8545','changeme'] && \
|
||||
rake wallet:create['warm','http://0.0.0.0:8545','changeme'] && \
|
||||
rake render:config && \
|
||||
rake service:all && \
|
||||
chmod +x bin/install_webhook
|
||||
./bin/install_webhook
|
||||
```
|
||||
|
||||
After the deployment process is finished, the frontend would be accessible from the domain provided in the configuration.
|
||||
BIN
docs/images/OpenDAX-authorization.png
Normal file
BIN
docs/images/OpenDAX-authorization.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
148
docs/troubleshoot-barong-authz.md
Normal file
148
docs/troubleshoot-barong-authz.md
Normal file
@@ -0,0 +1,148 @@
|
||||
# Troubleshoot barong authorization process and envoy routing
|
||||
|
||||
## Architecture overview
|
||||
|
||||
Before establishing a connection to a microservice (for example ***rango***) envoy verifies the authorization by sending a request to ***barong authz***. Barong authz verifies the cookie (when using the UI) and the HMAC signature (when using API) and returns a signed token (JWT) if everything is valid.
|
||||
|
||||
|
||||
|
||||
|
||||
## Enable envoy debug logs
|
||||
|
||||
To troubleshoot connection problems with a microservice of the stack, you can enable envoy logs to understand in which step the connection problem appears.
|
||||
|
||||
To do so you need to:
|
||||
|
||||
1. Edit *templates/compose/gateway.yaml.erb*
|
||||
|
||||
2. Change *info* by *debug* in the following lines:
|
||||
|
||||
```yaml
|
||||
command: /usr/local/bin/envoy -l debug -c /etc/envoy/envoy.yaml
|
||||
```
|
||||
|
||||
3. Render the configuration files
|
||||
|
||||
```bash
|
||||
rake render:config
|
||||
```
|
||||
|
||||
4. Restart envoy
|
||||
|
||||
```bash
|
||||
docker-compose up -dV gateway
|
||||
```
|
||||
|
||||
5. Finally you can inspect the envoy logs
|
||||
|
||||
```bash
|
||||
docker-compose logs -f --tail 100 gateway
|
||||
```
|
||||
|
||||
Here are the relevant logs:
|
||||
|
||||
1. Initial websocket connection
|
||||
```log
|
||||
gateway_1 | [2020-12-02 07:50:30.169][13][debug][http] [source/common/http/conn_manager_impl.cc:580] [C184][S12609685784760114286] request headers complete (end_stream=false):
|
||||
gateway_1 | ':authority', 'www.app.local'
|
||||
gateway_1 | ':path', '/api/v2/ranger/private/?stream=global.tickers'
|
||||
gateway_1 | ':method', 'GET'
|
||||
gateway_1 | 'user-agent', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36'
|
||||
gateway_1 | 'accept-encoding', 'gzip, deflate'
|
||||
gateway_1 | 'accept-language', 'en-US,en;q=0.9,fr;q=0.8'
|
||||
gateway_1 | 'cache-control', 'no-cache'
|
||||
gateway_1 | 'connection', 'Upgrade'
|
||||
gateway_1 | 'cookie', '_barong_session=4cff598ee40d3d2ec38875ddc904fc46'
|
||||
gateway_1 | 'origin', 'http://www.app.local'
|
||||
gateway_1 | 'pragma', 'no-cache'
|
||||
gateway_1 | 'sec-websocket-key', 'b16LunIyXls4CtNZ1lYWsw=='
|
||||
gateway_1 | 'sec-websocket-extensions', 'permessage-deflate; client_max_window_bits'
|
||||
gateway_1 | 'sec-websocket-version', '13'
|
||||
gateway_1 | 'upgrade', 'websocket'
|
||||
gateway_1 | 'x-forwarded-for', '172.20.0.1'
|
||||
gateway_1 | 'x-forwarded-host', 'www.app.local'
|
||||
gateway_1 | 'x-forwarded-port', '80'
|
||||
gateway_1 | 'x-forwarded-proto', 'ws'
|
||||
gateway_1 | 'x-forwarded-server', '41e065adb32e'
|
||||
gateway_1 | 'x-real-ip', '172.20.0.1'
|
||||
```
|
||||
|
||||
2. Request to Barong authz
|
||||
```log
|
||||
gateway_1 | [2020-12-02 07:50:30.183][13][debug][router] [source/common/router/router.cc:320] [C0][S3254558628791445120] cluster 'barong' match for URL '/api/v2/auth/api/v2/ranger/private/?stream=global.tickers'
|
||||
gateway_1 | [2020-12-02 07:50:30.184][13][debug][router] [source/common/router/router.cc:381] [C0][S3254558628791445120] router decoding headers:
|
||||
gateway_1 | ':method', 'GET'
|
||||
gateway_1 | ':path', '/api/v2/auth/api/v2/ranger/private/?stream=global.tickers'
|
||||
gateway_1 | ':authority', 'www.app.local'
|
||||
gateway_1 | ':scheme', 'http'
|
||||
gateway_1 | 'content-length', '0'
|
||||
gateway_1 | 'x-forwarded-for', '172.20.0.1,172.20.0.8'
|
||||
gateway_1 | 'cookie', '_barong_session=4cff598ee40d3d2ec38875ddc904fc46'
|
||||
gateway_1 | 'user-agent', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36'
|
||||
gateway_1 | 'x-forwarded-host', 'www.app.local'
|
||||
gateway_1 | 'x-forwarded-proto', 'ws'
|
||||
gateway_1 | 'x-envoy-internal', 'true'
|
||||
gateway_1 | 'x-envoy-expected-rq-timeout-ms', '1000'
|
||||
```
|
||||
|
||||
3. Routing the connection to rango
|
||||
|
||||
```log
|
||||
gateway_1 | [2020-12-02 07:50:30.220][13][debug][filter] [source/extensions/filters/http/ext_authz/ext_authz.cc:175] [C186][S2592169017517480399] ext_authz filter accepted the request
|
||||
gateway_1 | [2020-12-02 07:50:30.220][13][debug][router] [source/common/router/router.cc:320] [C186][S2592169017517480399] cluster 'rango' match for URL '/api/v2/ranger/private/?stream=global.tickers'
|
||||
gateway_1 | [2020-12-02 07:50:30.220][13][debug][router] [source/common/router/router.cc:381] [C186][S2592169017517480399] router decoding headers:
|
||||
gateway_1 | ':authority', 'www.app.local'
|
||||
gateway_1 | ':path', '/api/v2/ranger/private/?stream=global.tickers'
|
||||
gateway_1 | ':method', 'GET'
|
||||
gateway_1 | ':scheme', 'http'
|
||||
gateway_1 | 'user-agent', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36'
|
||||
gateway_1 | 'accept-encoding', 'gzip, deflate'
|
||||
gateway_1 | 'accept-language', 'en-US,en;q=0.9,fr;q=0.8'
|
||||
gateway_1 | 'cache-control', 'no-cache'
|
||||
gateway_1 | 'connection', 'Upgrade'
|
||||
gateway_1 | 'cookie', '_barong_session=4cff598ee40d3d2ec38875ddc904fc46'
|
||||
gateway_1 | 'origin', 'http://www.app.local'
|
||||
gateway_1 | 'pragma', 'no-cache'
|
||||
gateway_1 | 'sec-websocket-key', 'tocGzAPK8TACk8zzRX7n3g=='
|
||||
gateway_1 | 'sec-websocket-extensions', 'permessage-deflate; client_max_window_bits'
|
||||
gateway_1 | 'sec-websocket-version', '13'
|
||||
gateway_1 | 'upgrade', 'websocket'
|
||||
gateway_1 | 'x-forwarded-for', '172.20.0.1'
|
||||
gateway_1 | 'x-forwarded-host', 'www.app.local'
|
||||
gateway_1 | 'x-forwarded-port', '80'
|
||||
gateway_1 | 'x-forwarded-proto', 'ws'
|
||||
gateway_1 | 'x-forwarded-server', '41e065adb32e'
|
||||
gateway_1 | 'x-real-ip', '172.20.0.1'
|
||||
gateway_1 | 'content-length', '0'
|
||||
gateway_1 | 'x-envoy-internal', 'true'
|
||||
gateway_1 | 'x-request-id', '5b87e64a-4155-498e-916c-b8b998725a71'
|
||||
gateway_1 | 'x-envoy-expected-rq-timeout-ms', '15000'
|
||||
gateway_1 | ':status', '200'
|
||||
gateway_1 | 'authorization', 'Bearer eyJhbGciOiJSUzI1NiJ9.eyJpYXQiOjE2MDY4OTU0MzAsImV4cCI6MTYwNjg5OTAzMCwic3ViIjoic2Vzc2lvbiIsImlzcyI6ImJhcm9uZyIsImF1ZCI6WyJwZWF0aW8iLCJiYXJvbmciXSwianRpIjoiNTllNGIwNTA3YTgyMGNjMzYzMTIiLCJ1aWQiOiJJRDVGRkE5OERDMjciLCJlbWFpbCI6ImFkbWluQGJhcm9uZy5pbyIsInJvbGUiOiJhZG1pbiIsImxldmVsIjozLCJzdGF0ZSI6ImFjdGl2ZSIsInJlZmVycmFsX2lkIjpudWxsfQ.Br6-yujI5MgU_BktVDYNaEPNtHOMxQZbNS89deQfxNiPPkx6B8ZUDXL9og5DQ6nWBExlHydyPPcCSUvO5BCth_UWiuttY_ldy7TIr_JrXT0td8WN8fq8QadOWFuJ7wvMEklRGVKQmvOrooHNKz_WwcY4xmaSO3SVgQdFSkmt626MOXmo9Wa3nYsL6EafCMe--9PHWop4L-B1w5ndvbGuGLbJaqEktXsudOX0A9Js2sKuHPxSe8QJKN5XwmOFPAWM28-VkaU5cmshMK2CwJaSRhVoL0gIi9VUGpFVVJ1ciD0VHjRfxuFTzph7utRuO_M9N-bweLL8YCCA8RkwlVyuLg'
|
||||
gateway_1 | 'content-type', 'text/html; charset=utf-8'
|
||||
gateway_1 | 'cache-control', 'no-cache'
|
||||
gateway_1 | 'set-cookie', '_barong_session=4cff598ee40d3d2ec38875ddc904fc46; path=/; expires=Thu, 03 Dec 2020 07:50:30 GMT; HttpOnly'
|
||||
gateway_1 | 'x-request-id', '8ff80928-9091-40b0-b6f0-c0b46f8d72fe'
|
||||
gateway_1 | 'x-runtime', '0.031033'
|
||||
gateway_1 | 'vary', 'Origin'
|
||||
gateway_1 | 'transfer-encoding', 'chunked'
|
||||
gateway_1 | 'x-envoy-upstream-service-time', '37'
|
||||
```
|
||||
|
||||
|
||||
## Authz configuration
|
||||
|
||||
In case of authorization problem check the following configuration files:
|
||||
|
||||
1. *config/barong/authz_rules.yml*
|
||||
This file contains the default public endpoints and blocked endpoints.
|
||||
If you have a problem accessing a public endpoint make sure the URL is present in the *rules.pass* section.
|
||||
|
||||
2. *templates/config/barong/seeds.yml.erb*
|
||||
Check the *permissions* section to make sure the role of the user is allowed to access the resource.
|
||||
|
||||
Run the following command to apply the changes:
|
||||
|
||||
```bash
|
||||
rake service:setup
|
||||
```
|
||||
91
docs/ubuntu-install.md
Normal file
91
docs/ubuntu-install.md
Normal file
@@ -0,0 +1,91 @@
|
||||
# Install OpenDax in Ubuntu 18.04
|
||||
|
||||
## Step 1: Install Docker
|
||||
|
||||
To install Docker you will need to do those steps with `sudo` or login as root user with `sudo -i`
|
||||
|
||||
Create a Unix user for holding your application
|
||||
```
|
||||
groupadd app
|
||||
useradd -d /home/app -s `which bash` -g app -m app
|
||||
```
|
||||
|
||||
### Installing from apt-get
|
||||
|
||||
First, update your existing list of packages:
|
||||
|
||||
```
|
||||
apt update
|
||||
```
|
||||
|
||||
Next, install a few prerequisite packages which let apt use packages over HTTPS:
|
||||
|
||||
```
|
||||
apt install apt-transport-https ca-certificates curl software-properties-common
|
||||
```
|
||||
|
||||
Then add the GPG key for the official Docker repository to your system:
|
||||
|
||||
```
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
|
||||
```
|
||||
|
||||
Add the Docker repository to APT sources:
|
||||
|
||||
```
|
||||
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable"
|
||||
```
|
||||
|
||||
Next, update the package database with the Docker packages from the newly added repo:
|
||||
|
||||
```
|
||||
apt update
|
||||
```
|
||||
|
||||
Make sure you are about to install from the Docker repo instead of the default Ubuntu repo:
|
||||
|
||||
Finally, install Docker:
|
||||
|
||||
```
|
||||
apt install docker-ce
|
||||
```
|
||||
|
||||
Docker should now be installed, the daemon started, and the process enabled to start on boot. Check that it's running:
|
||||
|
||||
```
|
||||
systemctl status docker
|
||||
```
|
||||
|
||||
Add your app user into the docker group
|
||||
|
||||
```
|
||||
usermod -aG docker app
|
||||
```
|
||||
|
||||
## Step 2: Install Docker Compose
|
||||
|
||||
Run this command to download the latest version of Docker Compose:
|
||||
|
||||
```
|
||||
curl -L "https://github.com/docker/compose/releases/download/1.23.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
|
||||
|
||||
chmod +x /usr/local/bin/docker-compose
|
||||
```
|
||||
|
||||
## Step 3: Clone OpenDax
|
||||
|
||||
Login to your app user:
|
||||
```
|
||||
su - app
|
||||
```
|
||||
|
||||
Clone opendax repository
|
||||
```
|
||||
cd $HOME
|
||||
git clone https://github.com/rubykube/opendax.git
|
||||
cd opendax
|
||||
```
|
||||
|
||||
## Step 4: Clone your frontend
|
||||
|
||||
Edit config file `config/app.yml`
|
||||
Reference in New Issue
Block a user