Merge pull request #51 from input-output-hk/next-2025-08-07

Node 10.6.0 pre-release

Author: johnalotoski

.gitignore

@@ -1,6 +1,6 @@
 /*.cert
 /cloudFormation/
-/.direnv
+/.direnv*
 /.envrc.local
 /.gcroots
 /*.log

.sops.yaml

@@ -4,6 +4,8 @@ keys:
 
   # Misc
   - &misc1-metadata-a-1 age187hd0pffv549vfcmnw5u9yg3fck9e4psesz2xchrklqjqepccd7s6vlkcv
+  - &misc1-wg-a-1 age1ryvlcaajedpnkdyugnre6yysht5ahkn3yrwz48wvywpn2sxwfqtqrc8qmn
+  - &misc1-wg-b-1 age1tsyap098spn8j6nshvc56y4cucfuxr53wcapdy39lxqm8qfuvf7qd60m06
 
   # Preprod
   - &preprod1-bp-a-1 age1zhewzr3r8u4qmu9c5asw0vv9pw9qxvah9y60reu5uggrr8vrd95skhn3q3
@@ -18,25 +20,8 @@ keys:
   - &preview2-bp-b-1 age1jcfeznfkxx2rmeej9f4frvnjqkxdpd9kg56l57nmtamq53802fjq7x2y69
   - &preview3-bp-c-1 age13tc9mjgu7hwfxsa84hq0tcz7eeg9m6f0fmg8gzxwme30pfxf7g4sfk2y0k
 
-  # Private
-  - &private1-bp-a-1 age1pwmcf9nez82glwzk3mfcfyv0wnc4yev8pjhxk43fwgcr3m8yjsesjdfha0
-  - &private1-dbsync-a-1 age1q435aw99zpavtn5ce770jesh3th0ghne8jkt5mse8zscpp5r2ghsark64e
-  - &private1-faucet-a-1 age1lack6chc6czx8t9sc9ayc3wq0du82ne6l8m5h6lwz8zn6rxz5gqqtpz4z2
-  - &private2-bp-b-1 age1wewhhymvzljpgy7v9caud2zmgjt7dsdcluvpq8373ueuj5qv435qgn9xae
-  - &private3-bp-c-1 age1ay9e566ksavc46809vzjzcwlsu06dzr869fdv8qf9p9qu69qva4ssdv4af
-
   # Sanchonet
-  - &sanchonet1-bp-a-1 age1apa4g9hfjaq9kp95utg5jeqm9zmdhylcfsqmekrl0ptg4wjt53fsrfffy9
-  - &sanchonet1-dbsync-a-1 age1d5nc5w5th0qzagqa8xqltye2ttsuazury35pgwymyrnzrdk6zezqznv0ua
-  - &sanchonet1-faucet-a-1 age15cj5hg52ep6ccc4t5xm9ncuf94m2ds4k02lzzvmeykx2z4gc83es5ze452
-  - &sanchonet2-bp-b-1 age10ethn6sqe2fcx03pev0vddteg9jwe7azydq9glj9eyppdkqy855sxv40k9
-  - &sanchonet3-bp-c-1 age1hpyzunphtls4tfk5j4dc4rxg55essxd3ht7fweapumfzqe8h5suq0xa699
-
-  # Shelley-qa
-  - &shelley-qa1-bp-a-1 age1xxu6w2sftwxp5aef9yes20wegwv62pwhg7jzvt60q4ucwl6eyfaskjgqfu
-  - &shelley-qa1-faucet-a-1 age1pcg2a9pzfcl6jwkzchyhlg30nznfaaecjwnpy2am6mhq8kvgf9msudxt5a
-  - &shelley-qa2-bp-b-1 age1pzcdrzm9j4pxar6nx9wu7le95apw7gu4838s22u7evycydcunu3qw7eafy
-  - &shelley-qa3-bp-c-1 age19ulgvpe2wnvmu6tujae0ekn2stz46ntw0n03et4ctjk8nawa25eq6luw8f
+  - &sanchonet1-bp-a-1 age1sxhjqwnuf5duczjv5fwle492jpm7fhwunkwhp6agle6y75yqdeas586aaj
 
   # Mainnet, non-prod testing machines
   - &mainnet1-rel-a-1 age16m0sd0pyme79ds8jd380ctuc23p570djl0rnrp6xt28tce5ltvyql4hdgn
@@ -120,106 +105,40 @@ creation_rules:
       - *sre
       - *preview3-bp-c-1
 
-  # Private specific
-  - path_regex: secrets/groups/private1/deploy/.*govtool-backend.*$
-    key_groups:
-    - age:
-      - *sre
-      - *private1-dbsync-a-1
-
-  - path_regex: secrets/groups/private1/deploy/.*faucet.*$
-    key_groups:
-    - age:
-      - *sre
-      - *private1-faucet-a-1
-
-  - path_regex: secrets/groups/private1/deploy/.*$
-    key_groups:
-    - age:
-      - *sre
-      - *private1-bp-a-1
-
-  - path_regex: secrets/groups/private2/deploy/.*$
-    key_groups:
-    - age:
-      - *sre
-      - *private2-bp-b-1
-
-  - path_regex: secrets/groups/private3/deploy/.*$
-    key_groups:
-    - age:
-      - *sre
-      - *private3-bp-c-1
-
   # Sanchonet specific
-  - path_regex: secrets/groups/sanchonet1/deploy/.*govtool-backend.*$
-    key_groups:
-    - age:
-      - *sre
-      - *sanchonet1-dbsync-a-1
-
-  - path_regex: secrets/groups/sanchonet1/deploy/.*faucet.*$
-    key_groups:
-    - age:
-      - *sre
-      - *sanchonet1-faucet-a-1
-
   - path_regex: secrets/groups/sanchonet1/deploy/.*$
     key_groups:
     - age:
       - *sre
       - *sanchonet1-bp-a-1
 
-  - path_regex: secrets/groups/sanchonet2/deploy/.*$
-    key_groups:
-    - age:
-      - *sre
-      - *sanchonet2-bp-b-1
-
-  - path_regex: secrets/groups/sanchonet3/deploy/.*$
-    key_groups:
-    - age:
-      - *sre
-      - *sanchonet3-bp-c-1
-
-  # Shelley-qa specific
-  - path_regex: secrets/groups/shelley-qa1/deploy/.*faucet.*$
-    key_groups:
-    - age:
-      - *sre
-      - *shelley-qa1-faucet-a-1
-
-  - path_regex: secrets/groups/shelley-qa1/deploy/.*$
-    key_groups:
-    - age:
-      - *sre
-      - *shelley-qa1-bp-a-1
-
-  - path_regex: secrets/groups/shelley-qa2/deploy/.*$
+  # Mainnet non-prod specific
+  - path_regex: secrets/groups/mainnet1/deploy/.*$
     key_groups:
     - age:
       - *sre
-      - *shelley-qa2-bp-b-1
+      - *mainnet1-rel-a-1
 
-  - path_regex: secrets/groups/shelley-qa3/deploy/.*$
+  # Miscellaneous group specific, metadata server
+  - path_regex: secrets/groups/misc1/deploy/.*metadata.*$
     key_groups:
     - age:
       - *sre
-      - *shelley-qa3-bp-c-1
+      - *misc1-metadata-a-1
 
-  # Mainnet non-prod specific
-  - path_regex: secrets/groups/mainnet1/deploy/.*$
+  # Miscellaneous group specific, wireguard tunnel
+  - path_regex: secrets/groups/misc1/deploy/.*wg-a-1.*$
     key_groups:
     - age:
       - *sre
-      - *mainnet1-rel-a-1
+      - *misc1-wg-a-1
 
-  # Miscellaneous group specific
-  - path_regex: secrets/groups/misc1/deploy/.*metadata.*$
+  # Miscellaneous group specific, wireguard tunnel arn
+  - path_regex: secrets/groups/misc1/deploy/.*wg-b-1.*$
     key_groups:
     - age:
       - *sre
-      - *misc1-metadata-a-1
+      - *misc1-wg-b-1
 
   # Temporary buildkite testing
   - path_regex: secrets/buildkite/.*$

Justfile

@@ -112,6 +112,7 @@ checkSshConfig := '''
       | where ($it.machine | str ends-with ".ipv4")
       | rename machine pubIpv4
       | update machine { $in | str replace ".ipv4" "" }
+      | update pubIpv4 { $in | if $in == "unavailable.ipv4" { null } else { $in } }
       | sort-by machine
     )
 
@@ -283,8 +284,17 @@ cardano-testnet isNg *ARGS:
 cf STACKNAME:
   #!/usr/bin/env nu
   mkdir cloudFormation
+  let secretName = (nix eval --raw '.#cardano-parts.cluster.infra.generic.costCenter')
+  let costCenter = (
+    just sops-decrypt-binary secrets/tf/cluster.tfvars
+    | lines
+    | where { |it| $it =~ $secretName }
+    | parse $"($secretName) = \"{secret}\""
+    | get 0.secret
+    | to text
+  )
   nix eval --json '.#cloudFormation.{{STACKNAME}}' | from json | save --force 'cloudFormation/{{STACKNAME}}.json'
-  rain deploy --debug --termination-protection --yes ./cloudFormation/{{STACKNAME}}.json
+  rain deploy --debug --params costCenter=($costCenter) --termination-protection ./cloudFormation/{{STACKNAME}}.json
 
 # Prep dbsync for delegation analysis
 dbsync-prep ENV HOST ACCTS="501":
@@ -400,11 +410,11 @@ dedelegate-pools ENV *IDXS=null:
       --wallet-mnemonic <(just sops-decrypt-binary secrets/envs/{{ENV}}/utxo-keys/faucet.mnemonic) \
       --delegation-index "$i"
 
-    TXID=$(eval "$CARDANO_CLI" latest transaction txid --tx-file tx-deleg-account-$i-restore.txsigned)
+    TXID=$(eval "$CARDANO_CLI" latest transaction txid --tx-file tx-deleg-account-$i-restore.txsigned | jq -r .txhash)
     EXISTS="true"
 
     while [ "$EXISTS" = "true" ]; do
-      EXISTS=$(eval "$CARDANO_CLI" latest query tx-mempool tx-exists $TXID | jq -r .exists)
+      EXISTS=$(eval "$CARDANO_CLI" latest query tx-mempool tx-exists $TXID | jq -r .exists || true)
       if [ "$EXISTS" = "true" ]; then
         echo "Pool de-delegation index $i tx still exists in the mempool, sleeping 5s: $TXID"
       else