feat: Add local development setup

dev/.gitignore

@@ -0,0 +1,4 @@
+.terraform
+.terraform.lock.hcl
+.terraform.tfstate*
+terraform.tfstate*

dev/Makefile

@@ -0,0 +1,16 @@
+REPO:=$(shell git rev-parse --show-toplevel)
+
+create-cluster:
+	k3d cluster create --image rancher/k3s:v1.30.4-k3s1 -v "$(REPO):/charts" \
+					   --k3s-arg "--disable=traefik@server:0" \
+					   --k3s-arg "--disable=servicelb@server:0"
+
+delete-cluster:
+	k3d cluster delete
+
+all: create-cluster init deploy-services deploy
+
+helm-dep-updates:
+	for dir in $$(ls ../charts); do \
+		cd ../charts/$$dir && helm dependency update && cd -; \
+	done

dev/README.md

@@ -0,0 +1,143 @@
+# Charts dev setup
+
+Intended as a local environment to test changes to the charts. Not as a dev backend for the mobile app.
+Currently successfully brings up charts - no guarantee that everything is working as in prod, but enough to do some refactorings or stuff like that.
+
+## Dependencies
+
+### Docker
+* choose the install method for your system https://docs.docker.com/desktop/
+
+### Nix package manager
+* recommended install method using https://github.com/DeterminateSystems/nix-installer
+  ```
+  curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install
+  ```
+
+### direnv >= 2.30.0
+* recommended install method from https://direnv.net/docs/installation.html:
+  ```
+  curl -sfL https://direnv.net/install.sh | bash
+  echo "eval \"\$(direnv hook bash)\"" >> ~/.bashrc
+  source ~/.bashrc
+  ```
+
+## Regtest
+* run in the `dev` folder:
+  ```
+  direnv allow
+  make create-cluster
+  tilt up
+  ```
+
+### Test
+
+#### Forward the ingress nginx controller port:
+* Run and keep open:
+  ```
+  kubectl -n galoy-dev-ingress port-forward --address 0.0.0.0 svc/ingress-nginx-controller 4002:80
+  ```
+#### Test the galoy-api
+
+1. get session token
+    ```
+    curl -ksS 'https://localhost:8080/graphql' -H 'Content-Type: application/json' -H 'Accept: application/json' --data-binary '{"query":"mutation login($input: UserLoginInput!) { userLogin(input: $input) { authToken } }","variables":{"input":{"phone":"+59981730222","code":"111111"}}}' | jq '.data.userLogin.authToken'
+    ```
+
+    Example result:
+    ```
+    "BxTc70FW7gL5MEueAFcxGE08nbWWsytE"
+    ```
+2. query an authenticated endpoint (fill out the `session_token` from above)
+    ```
+    session_token="BxTc70FW7gL5MEueAFcxGE08nbWWsytE"
+    curl -k 'http://localhost:4002/graphql' -H 'Content-Type: application/json' -H 'Accept: application/json' -H "Authorization: bearer ${session_token}" --data-binary '{"query": "{ me { phone } }" }'
+    ```
+    Expected result:
+    ```
+    {"data":{"me":{"phone":"+16505554321"}}}
+    ```
+#### Test the graphql-admin api
+
+1. get session token
+    ```
+    curl -ksS 'http://localhost:4002/admin/graphql' -H 'Content-Type: application/json' -H 'Accept: application/json' --data-binary '{"query":"mutation login($input: UserLoginInput!) { userLogin(input: $input) { authToken } }","variables":{"input":{"phone":"+16505554321","code":"000000"}}}' | jq '.data.userLogin.authToken'
+    ```
+
+    Example result:
+    ```
+    "Beo2lGQZO4nZKzIyZRlVFIQ6jAeo9bNu"
+    ```
+
+#### Test the admin panel
+
+1. port forward the web wallet on 3001
+    ```
+    kubectl -n galoy-dev-addons port-forward  --address 0.0.0.0 svc/admin-panel 3001:3000
+    ```
+2. open http://localhost:3001
+
+## Grafana access
+-
+  ```
+  env=galoy-dev
+
+  the user is: `admin` (https://github.com/bitnami/charts/blob/main/bitnami/grafana/values.yaml#L76)
+
+  # get the password
+  k -n ${env}-monitoring get secrets monitoring-grafana -o jsonpath='{.data.admin-password}' | base64 -d; echo
+
+  # forward the port from the pod
+  k -n ${env}-monitoring port-forward svc/monitoring-grafana 3000:80
+
+  # access Grafana on http://localhost:3000
+  ```
+
+## Port access from a remote computer
+-
+  ```
+  # port forward with ssh
+  localport=3000      # chosen port on the desktop with the web browser
+  user=k3d            # remote user (example)
+  host=192.168.3.170  # the IP address of the server (example)
+
+  ssh -L $localport:127.0.0.1:3000 $user@$host
+
+  # access the service on http://localhost:$localport
+  ```
+
+## Smoketests
+### run the automated run-galoy-smoketest used in github actions
+  ```
+  make run-galoy-smoketest
+  ```
+### to test manually:
+
+* forward the galoy-oathkeeper-proxy
+  ```
+  kubectl -n galoy-dev-galoy port-forward  svc/galoy-oathkeeper-proxy 4455:4455
+  ```
+* run the smoketest from another window (examples from the [galoy-smoketest.sh](/ci/tasks/galoy-smoketest.sh)):
+  ```
+  host=localhost
+  port=4455
+  phone='+59981730222'
+  code='111111'
+
+  # apollo-playground-ui
+  curl -LksSf "${host}:${port}/graphql" \
+    -H 'Accept-Encoding: gzip, deflate, br' -H 'Content-Type: application/json' \
+    -H 'Accept: application/json' -H 'Connection: keep-alive' -H 'DNT: 1' \
+    -H 'Origin: ${host}:${port}' --data-binary \
+    '{"query":"query btcPrice {\n btcPrice {\n base\n currencyUnit\n formattedAmount\n offset\n }\n }","variables":{}}'
+
+  # galoy-backend auth
+  curl -LksSf "${host}:${port}/graphql" -H 'Content-Type: application/json' \
+    -H 'Accept: application/json' --data-binary \
+    "{\"query\":\"mutation login(\$input: UserLoginInput\!) { userLogin(input: \$input) { authToken } }\",\"variables\":{\"input\":{\"phone\":\"${phone}\",\"code\":\"${code}\"}}}"
+  # admin-backend
+  curl -LksSf  "${host}:${port}/admin/graphql" \
+    -H 'Content-Type: application/json' \
+    -H 'Accept: application/json' --data-binary \
+    "{\"query\":\"mutation login(\$input: UserLoginInput\!) { userLogin(input: \$input) { authToken } }\",\"variables\":{\"input\":{\"phone\":\"${phone}\",\"code\":\"${code}\"}}}" \
+  ```

dev/Tiltfile

@@ -0,0 +1,3 @@
+include('./galoy-deps/Tiltfile')
+include('./bitcoin/Tiltfile')
+include('./cala/Tiltfile')

dev/bitcoin/Tiltfile

@@ -0,0 +1,165 @@
+load('ext://helm_resource', 'helm_resource')
+load('ext://namespace', 'namespace_create')
+load('ext://secret', 'secret_from_dict')
+load('../common/Tiltfile', 'helm_release')
+update_settings(k8s_upsert_timeout_secs=120)
+
+name_prefix = 'galoy-dev'
+bitcoin_network = 'regtest'
+bitcoind_rpcpassword = 'rpcpassword'
+bitcoin_namespace = '{}-bitcoin'.format(name_prefix)
+smoketest_namespace = '{}-smoketest'.format(name_prefix)
+
+namespace_create(bitcoin_namespace)
+
+k8s_yaml(secret_from_dict(
+  name='bitcoind-rpcpassword',
+  namespace=bitcoin_namespace,
+  inputs={'password': bitcoind_rpcpassword},
+))
+
+helm_release(
+  "../../charts/bitcoind",
+  name="bitcoind",
+  namespace=bitcoin_namespace,
+  values=['./bitcoind-regtest-values.yml']
+)
+
+k8s_resource(workload='bitcoind', labels='bitcoin')
+
+k8s_yaml(secret_from_dict(
+  name='bitcoind-onchain-rpcpassword',
+  namespace=bitcoin_namespace,
+  inputs={'password': bitcoind_rpcpassword},
+))
+
+k8s_yaml(secret_from_dict(
+  name='bitcoind-signer-descriptor',
+  namespace=bitcoin_namespace,
+  inputs={
+    'descriptor_json_base64': local(
+      "base64 bitcoind_signers_descriptors.json | tr -d '\n\r'"
+    )
+  },
+))
+
+helm_release(
+  '../../charts/bitcoind',
+  name='bitcoind-onchain',
+  namespace=bitcoin_namespace,
+  values=['./bitcoind-regtest-values.yml', './bitcoind-onchain-values.yml']
+)
+
+k8s_resource(workload='bitcoind-onchain', labels='bitcoin')
+
+local_resource(
+  name="bitcoind-block-generator",
+  cmd='./generateBlock.sh',
+  labels="bitcoin",
+  resource_deps=["bitcoind-onchain", "bitcoind"]
+)
+
+# helm_resource(
+#   name="lnd1",
+#   chart="../../charts/lnd",
+#   namespace=bitcoin_namespace,
+#   flags=[
+#     '--values=./lnd-regtest-values.yml',
+#   ],
+#   labels='bitcoin'
+#   # resource_deps=["bitcoind-block-generator"],
+# )
+
+# TODO: uncomment fulcrum when we actually use it
+# helm_resource(
+#   name="fulcrum",
+#   chart="../../charts/fulcrum",
+#   namespace=bitcoin_namespace,
+#   flags=[
+#     '--values=./fulcrum-regtest-values.yml',
+#   ],
+#   labels="bitcoin"
+# )
+
+# k8s_yaml(secret_from_dict(
+#   name='fulcrum-smoketest',
+#   namespace=bitcoin_namespace,
+#   inputs={
+#     'fulcrum_endpoint': 'fulcrum.{}.svc.cluster.local'.format(bitcoin_namespace),
+#     'fulcrum_stats_port': 8080
+#   },
+# ))
+
+k8s_yaml(secret_from_dict(
+  name='bria-smoketest',
+  namespace=bitcoin_namespace,
+  inputs={
+    'key': 'value'
+  },
+))
+
+k8s_yaml(secret_from_dict(
+  name='bria',
+  namespace=bitcoin_namespace,
+  inputs={
+    'pg-con': 'postgres://bria:bria@bria-postgresql:5432/bria',
+    'signer-encryption-key': local('openssl rand -hex 32'),
+  },
+))
+
+helm_release(
+  '../../charts/bria',
+  name='bria',
+  namespace=bitcoin_namespace,
+  values=['./bria-values.yml'],
+  dependency_build=True,
+  add_repos=True
+)
+
+k8s_resource(workload='bria', labels='bitcoin')
+
+# TODO: uncomment mempool when we actually use it
+# helm_resource(
+#   name="mempool",
+#   chart="../../charts/mempool",
+#   namespace=bitcoin_namespace,
+#   flags=[
+#     '--values=./mempool-regtest-values.yml',
+#   ],
+#   labels="bitcoin"
+# )
+
+# k8s_yaml(secret_from_dict(
+#   name='mempool-smoketest',
+#   namespace=smoketest_namespace,
+#   inputs={
+#     'mempool_endpoint': 'mempool.{}.svc.cluster.local'.format(bitcoin_namespace),
+#     'mempool_port': 8999
+#   },
+# ))
+
+# k8s_resource(workload='mempool', labels='bitcoin')
+
+# create bitcoind smoketest secret from snippet above
+k8s_yaml(secret_from_dict(
+  name='bitcoind-smoketest',
+  namespace=smoketest_namespace,
+  inputs={
+    'bitcoind_rpcpassword': bitcoind_rpcpassword,
+    'bitcoind_endpoint': 'bitcoind.{}.svc.cluster.local'.format(bitcoin_namespace),
+    'bitcoind_port': '18443',
+    'bitcoind_user': 'rpcuser',
+    'bitcoind_onchain_rpcpassword': bitcoind_rpcpassword,
+    'bitcoind_onchain_endpoint': 'bitcoind.{}.svc.cluster.local'.format(bitcoin_namespace),
+  }
+))
+
+# create lnd smoketest secret from snippet above
+k8s_yaml(secret_from_dict(
+  name='lnd-smoketest',
+  namespace=smoketest_namespace,
+  inputs={
+    'lnd_api_endpoint': 'lnd1.{}.svc.cluster.local'.format(bitcoin_namespace),
+    'lnd_p2p_endpoint': 'lnd1-p2p.{}.svc.cluster.local'.format(bitcoin_namespace),
+  }
+))

dev/bitcoin/bitcoind-onchain-values.yml

@@ -0,0 +1,3 @@
+descriptor:
+  secretName: bitcoind-signer-descriptor
+  secretKey: descriptor_json_base64

dev/bitcoin/bitcoind-regtest-values.yml

@@ -0,0 +1,25 @@
+global:
+  network: regtest
+  service:
+    ports:
+      rpc: 18443
+
+secrets:
+  create: false
+
+persistence:
+  enabled: false
+
+service:
+  type: ClusterIP
+  ports:
+    zmqpubrawtx: 28333
+    zmqpubrawblock: 28332
+    p2p: 18444
+
+bitcoindCustomConfig:
+  bind: 0.0.0.0
+  rpcbind: 0.0.0.0
+  rpcallowip: 0.0.0.0/0
+  dbcache: 450
+  maxmempool: 300

dev/bitcoin/bitcoind-signet-values.yml

@@ -0,0 +1,25 @@
+global:
+  network: signet
+  service:
+    ports:
+      rpc: 38332
+
+secrets:
+  create: false
+
+persistence:
+  enabled: true
+  accessMode: ReadWriteOnce
+  size: 2Gi
+
+service:
+  type: ClusterIP
+  ports:
+    zmqpubrawtx: 28333
+    zmqpubrawblock: 28332
+    p2p: 38333
+
+bitcoindCustomConfig:
+  bind: 0.0.0.0
+  rpcbind: 0.0.0.0
+  rpcallowip: 0.0.0.0/0

dev/bitcoin/bitcoind_signers_descriptors.json

@@ -0,0 +1 @@
+[{"active":true,"desc":"wpkh([6f2fa1b2/84'/0'/0']tprv8gXB88g1VCScmqPp8WcetpJPRxix24fRJJ6FniYCcCUEFMREDrCfwd34zWXPiY5MW2xp8e1Z6EeBrh74zMSgfQQmTorWtE1zyBtv7yxdcoa/0/*)#88k4937c","timestamp":0},{"active":true,"desc":"wpkh([6f2fa1b2/84'/0'/0']tprv8gXB88g1VCScmqPp8WcetpJPRxix24fRJJ6FniYCcCUEFMREDrCfwd34zWXPiY5MW2xp8e1Z6EeBrh74zMSgfQQmTorWtE1zyBtv7yxdcoa/1/*)#knn5cywq","internal":true,"timestamp":0}]