Initial commit

lib/tasks/audit.rake

@@ -0,0 +1,22 @@
+namespace :audit do
+  desc 'Print CVE audit commands (run via Docker on this machine)'
+  task :help do
+    puts <<~HELP
+      Fibitex dependency CVE audit — see Docs/10-cve-audit.md
+
+      Ruby (Dena):
+        docker run --rm -v "#{Dir.pwd}/../Dena:/app" -w /app ruby:2.6.6 bash -c "gem install bundler:2.1.4 bundler-audit --no-document && bundle audit check --update"
+
+      Ruby (Dalan):
+        docker run --rm -v "#{Dir.pwd}/../Dalan:/app" -w /app ruby:2.6.6 bash -c "gem install bundler:2.1.4 bundler-audit --no-document && bundle audit check --update"
+
+      OSV (summary):
+        docker run --rm -v "#{Dir.pwd}/../Dena:/src" ghcr.io/google/osv-scanner:latest -L /src/Gemfile.lock
+        docker run --rm -v "#{Dir.pwd}/../Dalan:/src" ghcr.io/google/osv-scanner:latest -L /src/Gemfile.lock
+        docker run --rm -v "#{Dir.pwd}/../Gereh:/src" ghcr.io/google/osv-scanner:latest -L /src/yarn.lock
+
+      Config secrets check:
+        bundle exec rake config:check
+    HELP
+  end
+end

lib/tasks/config.rake

@@ -0,0 +1,47 @@
+namespace :config do
+  desc 'Verify config/app.yml contains no real secrets (safe for git)'
+  task :check do
+    require_relative '../opendax/config_loader'
+
+    raw = YAML.load_file('config/app.yml')
+    leaks = []
+
+    check_value = lambda do |path, value|
+      return if value.nil?
+      return unless value.is_a?(String)
+
+      str = value.strip
+      return if str.empty? || str == 'changeme'
+
+      if str.match?(/\As\.[A-Za-z0-9]{20,}\z/)
+        leaks << "#{path}: looks like a Vault token"
+      elsif path.include?('password') && str != 'changeme'
+        leaks << "#{path}: non-placeholder password"
+      end
+    end
+
+    walk = lambda do |node, prefix|
+      case node
+      when Hash
+        node.each { |k, v| walk.call(v, prefix.empty? ? k.to_s : "#{prefix}.#{k}") }
+      when Array
+        node.each_with_index { |v, i| walk.call(v, "#{prefix}[#{i}]") }
+      else
+        check_value.call(prefix, node)
+      end
+    end
+
+    walk.call(raw, '')
+
+    if leaks.any?
+      puts 'FAIL: config/app.yml may contain secrets:'
+      leaks.each { |l| puts "  - #{l}" }
+      puts 'Move sensitive values to config/app.local.yml or config/app.production.yml'
+      exit 1
+    end
+
+    overlay = Opendax::ConfigLoader.active_overlay
+    puts 'OK: config/app.yml looks safe for git'
+    puts "Active overlay: #{overlay || 'none'}"
+  end
+end

lib/tasks/db.rake

@@ -0,0 +1,32 @@
+namespace :db do
+
+  def mysql_cli
+    return "mysql -u root -h db -P 3306 -pchangeme"
+  end
+
+  desc 'Create database'
+  task :create do
+    sh 'docker-compose run --rm peatio bundle exec rake db:create'
+    sh 'docker-compose run --rm barong bundle exec rake db:create'
+  end
+
+  desc 'Load database dump'
+  task :load => :create do
+    sh %Q{cat data/mysql/peatio_production.sql | docker-compose run --rm db #{mysql_cli} peatio_production}
+    sh %Q{cat data/mysql/barong_production.sql | docker-compose run --rm db #{mysql_cli} barong_production}
+    sh 'docker-compose run --rm peatio bundle exec rake db:migrate'
+    sh 'docker-compose run --rm barong bundle exec rake db:migrate'
+  end
+
+  desc 'Drop all databases'
+  task :drop do
+    sh %q(docker-compose run --rm db /bin/sh -c "mysql -u root -h db -P 3306 -pchangeme -e 'DROP DATABASE peatio_production'")
+    sh %q(docker-compose run --rm db /bin/sh -c "mysql -u root -h db -P 3306 -pchangeme -e 'DROP DATABASE barong_production'")
+    sh %q(docker-compose run --rm db /bin/sh -c "mysql -u root -h db -P 3306 -pchangeme -e 'DROP DATABASE superset'")
+  end
+
+  desc 'Database Console'
+  task :console do
+    sh "docker-compose run --rm db #{mysql_cli}"
+  end
+end

lib/tasks/docker.rake

@@ -0,0 +1,11 @@
+namespace :docker do
+    desc 'Stop all runnning docker contrainers'
+    task :down do
+        sh 'docker-compose down'
+    end
+
+    desc 'Clean up all docker volumes'
+    task :clean do
+        sh 'docker volume prune -f'
+    end
+end

lib/tasks/payload.rake

@@ -0,0 +1,18 @@
+require_relative '../opendax/payload'
+require 'faraday'
+
+namespace :payload do
+  desc 'Generate JWT'
+  task :send, [:service, :image, :url] do |_, args|
+    secret = ENV['WEBHOOK_JWT_SECRET']
+    abort 'WEBHOOK_JWT_SECRET not set' if secret.to_s.empty?
+    coder = Opendax::Payload.new(secret: secret)
+    jwt = coder.generate!(service: args.service, image: args.image)
+    url = "#{args.url}/deploy/#{jwt}"
+    response = Faraday::Connection.new.get(url) do |request|
+      request.options.timeout = 300
+    end
+    pp response.body
+    fail unless response.status == 200
+  end
+end

lib/tasks/render.rake

@@ -0,0 +1,17 @@
+
+require_relative '../opendax/renderer'
+
+namespace :render do
+  desc 'Render configuration and compose files and keys'
+  task :config do
+    if (overlay = Opendax::ConfigLoader.active_overlay)
+      puts "Using config overlay: #{overlay}"
+    else
+      puts 'Using config/app.yml only (no overlay)'
+    end
+
+    renderer = Opendax::Renderer.new
+    renderer.render_keys
+    renderer.render
+  end
+end

lib/tasks/service.rake

@@ -0,0 +1,347 @@
+namespace :service do
+  ENV['APP_DOMAIN'] = @config['app']['domain']
+
+  @switch = Proc.new do |args, start, stop|
+    case args.command
+    when 'start'
+      start.call
+    when 'stop'
+      stop.call
+    when 'restart'
+      stop.call
+      start.call
+    else
+      puts "unknown command #{args.command}"
+    end
+  end
+
+  desc 'Run Traefik (reverse-proxy)'
+  task :proxy, [:command] do |task, args|
+    args.with_defaults(:command => 'start')
+
+    def start
+      puts '----- Starting the proxy -----'
+      File.new('config/acme.json', File::CREAT, 0600) unless File.exist? 'config/acme.json'
+      sh 'docker-compose up -d proxy'
+    end
+
+    def stop
+      puts '----- Stopping the proxy -----'
+      sh 'docker-compose rm -fs proxy'
+    end
+
+    @switch.call(args, method(:start), method(:stop))
+  end
+
+  desc 'Run backend (vault db redis rabbitmq)'
+  task :backend, [:command] do |task, args|
+    args.with_defaults(:command => 'start')
+
+    def start
+      puts '----- Starting dependencies -----'
+      sh 'docker-compose up -d vault db redis rabbitmq'
+      sleep 7 # time for db to start, we can get connection refused without sleeping
+    end
+
+    def stop
+      puts '----- Stopping dependencies -----'
+      sh 'docker-compose rm -fs vault db redis rabbitmq'
+    end
+
+
+    @switch.call(args, method(:start), method(:stop))
+  end
+
+  desc 'Run influxdb'
+  task :influxdb, [:command] do |task, args|
+    args.with_defaults(:command => 'start')
+
+    def start
+      puts '----- Starting influxdb -----'
+      sh 'docker-compose up -d influxdb'
+      puts 'Wait 5 second for influx'
+      sleep(5)
+      sh 'docker-compose exec influxdb bash -c "cat peatio.sql | influx"'
+    end
+
+    def stop
+      puts '----- Stopping influxdb -----'
+      sh 'docker-compose rm -fs influxdb'
+    end
+
+    @switch.call(args, method(:start), method(:stop))
+  end
+
+  desc '[Optional] Run arke-maker'
+  task :arke_maker, [:command] do |task, args|
+    args.with_defaults(:command => 'start')
+
+    def start
+      puts '----- Starting arke -----'
+      sh 'docker-compose up -d arke-maker'
+    end
+
+    def stop
+      puts '----- Stopping arke -----'
+      sh 'docker-compose rm -fs arke-maker'
+    end
+
+    @switch.call(args, method(:start), method(:stop))
+  end
+
+  desc '[Optional] Run daemons (rango, peatio daemons, barong sidekiq)'
+  task :daemons, [:command] do |_task, args|
+    @daemons = %w[rango blockchain cron_job upstream deposit deposit_coin_address withdraw_coin influx_writer barong_sidekiq]
+
+    if @config['finex']['enabled']
+      @daemons |= %w[finex-engine finex-api]
+    else
+      @daemons |= %w[matching order_processor trade_executor]
+    end
+
+    args.with_defaults(:command => 'start')
+
+    def start
+      puts '----- Starting daemons -----'
+      sh "docker-compose up -d #{@daemons.join(' ')}"
+    end
+
+    def stop
+      puts '----- Stopping daemons -----'
+      sh "docker-compose rm -fs #{@daemons.join(' ')}"
+    end
+
+    @switch.call(args, method(:start), method(:stop))
+  end
+
+  desc '[Optional] Run cryptonodes'
+  task :cryptonodes, [:command] do |task, args|
+    args.with_defaults(:command => 'start')
+
+    def start
+      puts '----- Starting cryptonodes -----'
+      sh 'docker-compose up -d parity'
+      if @config['bitcoind']['enabled']
+        sh 'docker-compose up -d bitcoind'
+      end
+    end
+
+    def stop
+      puts '----- Stopping cryptonodes -----'
+      sh 'docker-compose rm -fs parity'
+      if @config['bitcoind']['enabled']
+        sh 'docker-compose rm -fs bitcoind'
+      end
+    end
+
+    @switch.call(args, method(:start), method(:stop))
+  end
+
+  desc 'Run setup hooks for peatio, barong'
+  task :setup, [:command] => ['vault:setup', 'vault:load_policies'] do |task, args|
+    if args.command != 'stop'
+      Rake::Task["render:config"].execute
+      puts '----- Running hooks -----'
+      sh 'docker-compose run --rm peatio bash -c "./bin/link_config && bundle exec rake db:create db:migrate"'
+      sh 'docker-compose run --rm peatio bash -c "./bin/link_config && bundle exec rake db:seed"'
+      sh 'docker-compose run --rm barong bash -c "./bin/init_config && bundle exec rake db:create db:migrate"'
+      sh 'docker-compose run --rm barong bash -c "./bin/link_config && bundle exec rake db:seed"'
+      if ENV.fetch('FIBITEX_SEED_TEST_USERS', 'true') != 'false'
+        puts '----- Seeding test users and balances -----'
+        sh 'docker-compose run --rm barong bash -c "bundle exec rails runner ./lib/seed_test_users.rb"'
+        sh 'docker-compose run --rm peatio bash -c "ruby ./bin/link_config && bundle exec rails runner ./lib/seed_test_balances.rb"'
+      end
+    end
+  end
+
+  desc 'Run mikro app (barong, peatio)'
+  task :app, [:command] => [:backend, :setup] do |task, args|
+    args.with_defaults(:command => 'start')
+
+    def start
+      puts '----- Starting app -----'
+      sh 'docker-compose up -d peatio barong gateway'
+    end
+
+    def stop
+      puts '----- Stopping app -----'
+      sh 'docker-compose rm -fs peatio barong gateway'
+    end
+
+    @switch.call(args, method(:start), method(:stop))
+  end
+
+  desc 'Run the frontend application'
+  task :frontend, [:command] do |task, args|
+    args.with_defaults(:command => 'start')
+
+    def start
+      puts '----- Starting the frontend -----'
+      sh 'docker-compose up -d frontend'
+    end
+
+    def stop
+      puts '----- Stopping the frontend -----'
+      sh 'docker-compose rm -fs frontend'
+    end
+
+    @switch.call(args, method(:start), method(:stop))
+  end
+
+  desc 'Run the tower application'
+  task :AdminTower, [:command] do |task, args|
+    args.with_defaults(:command => 'start')
+
+    def start
+      puts '----- Starting the AdminTower -----'
+      sh 'docker-compose up -d AdminTower'
+    end
+
+    def stop
+      puts '----- Stopping the AdminTower -----'
+      sh 'docker-compose rm -fs AdminTower'
+    end
+
+    @switch.call(args, method(:start), method(:stop))
+  end
+
+  desc 'Run Mailer'
+  task :mailer, [:command] do |task, args|
+    args.with_defaults(:command => 'start')
+
+    def start
+      puts '----- Starting Mailer -----'
+      sh 'docker-compose up -d mailer'
+    end
+
+    def stop
+      puts '----- Stopping Mailer -----'
+      sh 'docker-compose rm -fs mailer'
+    end
+
+    @switch.call(args, method(:start), method(:stop))
+  end
+
+  desc '[Optional] Run monitoring'
+  task :monitoring, [:command] do |task, args|
+    args.with_defaults(:command => 'start')
+
+    def start
+      puts '----- Starting monitoring -----'
+      sh 'docker-compose up -d prometheus'
+      sh 'docker-compose up -d grafana'
+      sh 'docker-compose up -d alertmanager'
+      sh 'docker-compose up -d loki'
+      sh 'docker-compose up -d promtail'
+      sh 'docker-compose up -d scope'
+      sh 'docker-compose up -d node-exporter'
+      sh 'docker-compose up -d cadvisor'
+    end
+
+    def stop
+      puts '----- Stopping monitoring -----'
+      sh 'docker-compose rm -fs prometheus'
+      sh 'docker-compose rm -fs grafana'
+      sh 'docker-compose rm -fs alertmanager'
+      sh 'docker-compose rm -fs loki'
+      sh 'docker-compose rm -fs promtail'
+      sh 'docker-compose rm -fs scope'
+      sh 'docker-compose rm -fs node-exporter'
+      sh 'docker-compose rm -fs cadvisor'
+    end
+
+    @switch.call(args, method(:start), method(:stop))
+  end
+
+  desc '[Optional] Run superset'
+  task :superset, [:command] do |task, args|
+    args.with_defaults(:command => 'start')
+
+    def start
+      conf = @utils['superset']
+      init_params = [
+        '--app', 'superset',
+        '--firstname', 'Admin',
+        '--lastname', 'Superset',
+        '--username', conf['username'],
+        '--email', conf['email'],
+        '--password', conf['password']
+      ].join(' ')
+
+      puts '----- Initializing Superset -----'
+      sh [
+        'docker-compose run --rm superset',
+        'sh -c "',
+        "fabmanager create-admin #{init_params}",
+        '&& superset db upgrade',
+        # '&& superset load_examples',
+        '&& superset init"'
+      ].join(' ')
+
+      puts '----- Starting Superset -----'
+      sh 'docker-compose up -d superset'
+    end
+
+    def stop
+      puts '----- Stopping Superset -----'
+      sh 'docker-compose rm -fs superset'
+    end
+
+    @switch.call(args, method(:start), method(:stop))
+  end
+
+  desc '[Optional] Run Blog'
+  task :blog, [:command] do |task, args|
+    args.with_defaults(:command => 'start')
+
+    def start
+      puts '----- Starting Blog_db -----'
+      sh 'docker-compose up -d blog_db'
+      puts '----- Starting Blog -----'
+      sh 'docker-compose up -d blog'
+    end
+
+    def stop
+      puts '----- Stopping Blog -----'
+      sh 'docker-compose rm -fs blog'
+      puts '----- Stopping Blog_db -----'
+      sh 'docker-compose rm -fs blog_db'
+    end
+
+    @switch.call(args, method(:start), method(:stop))
+  end
+
+
+  desc 'Set up and start all services with dependencies (does not run optional ones)'
+  task :all, [:command] => ['versions:update', 'render:config'] do |task, args|
+    args.with_defaults(:command => 'start')
+
+    def start
+      Rake::Task["service:proxy"].invoke('start')
+      Rake::Task["service:backend"].invoke('start')
+      Rake::Task["service:influxdb"].invoke('start')
+      puts 'Wait 5 second for backend'
+      sleep(5)
+      Rake::Task["service:setup"].invoke('start')
+      Rake::Task["service:app"].invoke('start')
+      Rake::Task["service:frontend"].invoke('start')
+      Rake::Task["service:AdminTower"].invoke('start')
+      Rake::Task["service:mailer"].invoke('start')
+      Rake::Task["service:daemons"].invoke('start')
+    end
+
+    def stop
+      Rake::Task["service:proxy"].invoke('stop')
+      Rake::Task["service:backend"].invoke('stop')
+      Rake::Task["service:influxdb"].invoke('stop')
+      Rake::Task["service:setup"].invoke('stop')
+      Rake::Task["service:app"].invoke('stop')
+      Rake::Task["service:frontend"].invoke('stop')
+      Rake::Task["service:AdminTower"].invoke('stop')
+      Rake::Task["service:mailer"].invoke('stop')
+      Rake::Task["service:daemons"].invoke('stop')
+    end
+
+    @switch.call(args, method(:start), method(:stop))
+  end
+end

lib/tasks/terraform.rake

@@ -0,0 +1,16 @@
+namespace :terraform do
+  desc 'Initialize the Terraform configuration'
+  task :init do
+    Dir.chdir('terraform') { sh 'terraform init' }
+  end
+
+  desc 'Apply the Terraform configuration'
+  task :apply => ['render:config', :init] do
+    Dir.chdir('terraform') { sh 'terraform apply' }
+  end
+
+  desc 'Destroy the Terraform infrastructure'
+  task :destroy do
+    Dir.chdir('terraform') { sh 'terraform destroy' }
+  end
+end

lib/tasks/test_seed.rake

@@ -0,0 +1,15 @@
+namespace :test do
+  desc 'Seed test users (Barong + Peatio balances) for local/test environments'
+  task seed: :environment do
+    if ENV.fetch('FIBITEX_SEED_TEST_USERS', 'true') == 'false'
+      puts 'SKIP test:seed (FIBITEX_SEED_TEST_USERS=false)'
+      next
+    end
+
+    puts '----- Seeding test users (Barong) -----'
+    sh 'docker-compose run --rm barong bash -c "bundle exec rails runner ./lib/seed_test_users.rb"'
+
+    puts '----- Seeding test balances (Peatio) -----'
+    sh 'docker-compose run --rm peatio bash -c "ruby ./bin/link_config && bundle exec rails runner ./lib/seed_test_balances.rb"'
+  end
+end

lib/tasks/toolbox.rake

@@ -0,0 +1,12 @@
+namespace :toolbox do
+  desc 'Run the toolbox'
+  task :run do
+    run_cmd = %w[docker-compose run --rm toolbox run]
+
+    YAML.safe_load(File.read('config/toolbox.yaml'))
+        .transform_keys { |k| '--' << k }
+        .each_pair { |k, v| run_cmd << k << v.to_s }
+
+    sh *run_cmd
+  end
+end

lib/tasks/vault.rake

@@ -0,0 +1,25 @@
+
+require_relative '../opendax/vault'
+
+namespace :vault do
+  desc 'Initialize, unseal and set secrets for Vault'
+  task :setup do
+    vault = Opendax::Vault.new
+    vault_root_token = vault.setup
+    unless vault_root_token.nil?
+      @config["vault"]["root_token"] = vault_root_token
+      File.open(CONFIG_PATH, 'w') { |f| YAML.dump(@config, f) }
+    end
+  end
+
+  task :load_policies do
+    vault = Opendax::Vault.new
+    vault_tokens = vault.load_policies(@config["app"]["name"], @config["vault"]["root_token"])
+    unless vault_tokens.empty?
+      vault_tokens.each do |k, v|
+        @config["vault"][k] = v
+        File.open(CONFIG_PATH, 'w') { |f| YAML.dump(@config, f) }
+      end
+    end
+  end
+end

lib/tasks/vendor.rake

@@ -0,0 +1,11 @@
+namespace :vendor do
+  desc 'Clone the frontend apps repos into vendor/'
+  task :clone do
+    puts '----- Clone the frontend apps repos -----'
+    puts
+    @config['vendor'].each do |name, repo_url|
+      sh "git clone #{repo_url} vendor/#{name}"
+      puts
+    end
+  end
+end

lib/tasks/versions.rake

@@ -0,0 +1,33 @@
+require 'faraday'
+
+namespace :versions do
+  desc 'Fetch global image versions and update config/app.yaml'
+  task :update do
+    unless @config['updateVersions']
+      puts "To enable version updates, set updateVersions to true"
+      next
+    end
+
+    puts "Fetching latest global versions"
+    response = Faraday.get 'https://raw.githubusercontent.com/openware/versions/master/opendax/2-6/versions.yaml'
+
+    if response.status >= 400 || response.status >= 500
+      raise "Error fetching global versions, got #{response.body}"
+    end
+
+    versions = YAML.load(response.body)
+
+    versions.each { |k, v| update_image_tag(k, v['image']['tag']) if @config['images'].key? k }
+
+    File.write(CONFIG_PATH, YAML.dump(@config))
+
+    puts 'Version update complete!'
+  end
+end
+
+def update_image_tag(component, tag)
+  image = @config['images'][component].split(':')
+  image[-1] = tag
+
+  @config['images'][component] = image.join(':')
+end

lib/tasks/wallets.rake

@@ -0,0 +1,20 @@
+require 'faraday'
+require 'json'
+require 'yaml'
+
+namespace :wallet do
+  desc 'Generate ethereum wallet from a cryptonode'
+  task :create, [:kind,:url,:secret] do |_, args|
+    response = Faraday::Connection.new.post(args.url) do |request|
+      request.headers["Content-Type"] = "application/json"
+      request.body = "{\"jsonrpc\":\"2.0\",\"method\":\"personal_newAccount\",\"params\":[\"#{args.secret}\"],\"id\":1}"
+      request.options.timeout = 300
+    end
+    address = JSON.parse(response.body)['result']
+    puts "----- Generating a new #{args.kind} wallet -----", "Address: " + address
+
+    @config['wallets']['eth'].find { |w| w['kind'] == args.kind }.update('address' => address, 'secret' => args.secret)
+
+    File.open(CONFIG_PATH, 'w') {|f| f.write @config.to_yaml }
+  end
+end