archway-network/networks

Registry of archway public networks

Archway Networks

This repo contains a registry of Archway protocol based networks, IBC connections to these networks.

Schema files containing the recommended metadata structure can be found in the *.schema.json files located in the root directory. Schemas are still undergoing revision as user needs are surfaced. Optional fields may be added beyond what is contained in the schema files.

Adding new IBC paths

If you are a relayer operator and wish to add a new IBC path connecting to Archway Networks, please follow the below mentioned criteria and create a PR after creating the path.

Requirements for the IBC channel

• Archway client's trusting period should be set to 2/3 of unbonding period e.g. for archway-1 (mainnet) the clients trusting period must be 1209600s
• IBC client for the counter-party chain should also have a trusting period set to exactly 2/3 of the chains unbonding period

Steps to create new IBC paths

We recommend using hermes relayer implementation and use this tutorial to create new paths.

Requesting a new IBC path

If you are a builder on the Archway protocol and/or looking to connect Archway Networks to another chain through IBC, but do not have the expertise or the capacity to operate relayers, you can request the desired IBC relayer from archway community:

• Join Arcwhay Discord
• Use "@Mainnet Validator" or "@Relayer" tag on discord to request a new relay path from within Archway Network operators and partners
  • Suitable channel for such requests: "build-together"
  • You may use the "@Community Mods" discord tag for Archway community moderators and/or the "@DevRel" discord tag for Philabs developer relations team, to ask for help in your search of finding a new relayer partner
• Each relayer connecting the cosmos to Archway networks is eligible for a feegrant to pay for IBC transfer on Archway mainnet. Please check feegrants program below for more details

Monitoring IBC paths

Philabs (on behalf of Archway foundation) is building monitoring tools e.g. relayer_exporter and also leveraging existing tools like chainpulse. These monitoring tools will be used to monitor relayers and IBC paths published on this repo for the following metrics

• Client Expiry
• Total IBC packets transmitted
• Fee paid per packet transmitted
• Redundant packets transmitted
• Stuck packets
• Account balances
  • Philabs operated relayers
  • Foundation feegranter account balance (this account is used to provide feegrants for relayers)
  • External relayers account balances

Feegrants Program

All relayers operating IBC paths connecting to Archway mainnet are eligible for a feegrant to pay for IBC transaction fees on Archway network.

To enable feegrants for your relayer use the following fee granter address and configuration docs for your relayer:

Archway fee granter address: archway1ktka5q3cnsy3ar7qwj2huzz6qj9q4ys7h74l9y

Feegrant selection criteria

• Feegrants programs aims to have availability of maximum 2 to 3 relayers on each published path
• Feegrants will be reviewed based relayer performance and renewed periodically
• Relayer must have local full nodes available for both connecting chains
• Relayer must publish its metadata and signer addresses for both connecting chains. Please use ibc_data_schema.json for schema reference.

Active feegrants

All operators published under _IBC have active feegrants e.g. to see active feegrants for archway <> osmosis path are under operator section of archway-osmosis.json

networks's Issues

fix(iam): Sanitise and mange gsuit permisions and manage gcp permissions in terraform

┆Issue is synchronized with this Jira Task by Unito

feat: Automate CloudDNS into terraform

Currently we have manually managed DNS records in CloudDNS

• archway.tech
• area-52.io

Add infrastructure/dns.tf to manage dns records programatically

┆Issue is synchronized with this Jira Task by Unito

fix: make wireguard instance automatically configure itself

Wireguard base instance now has to be configured manually everytime the instance gets deleted.
It would be good to have cloud-init there to do the following:

• Install packages:
  • wireguard
  • iptables
  • resolvconf
  • qrencode
• Format and automount the disk to /etc/wireguard
• Add these to `/etc/sysctl.d/wg.conf
  • net.ipv4.ip_forward = 1
  • net.ipv6.conf.all.forwarding = 1
• Enable wireguard via systemd : systemdctl enable wg-quick@wg0

┆Issue is synchronized with this Jira Task by Unito

feat(mainnet airdrop): Create automation scripts to extract and process data from blockchain state export

┆Issue is synchronized with this Jira Task by Unito

feature: test and try out Terraform Automation Atlantis

Atlantis is a Terraform PR automation tool that could help us more easily deploy Terraform code
https://www.runatlantis.io/

┆Issue is synchronized with this Jira Task by Unito

feat(ci): Automated upgrade proposals on constantine with new protocol release

Constantine testnetwork must be upgraded through gov proposals.

We need a github action to create these upgrade proposals on constantine with each new release of the archway protocol.

┆Issue is synchronized with this Jira Task by Unito

fix(monitoring): Disable control plane alerts from kube-porometheus-stack

We use GKE as our k8s provider and we do not need to worry about control plane componenets. All control plane related alerts should be disabled in kub-prometheus-stack

┆Issue is synchronized with this Jira Task by Unito

Add swagger interface to constantine-1

feat(ci): Add IBC infrastructure

We need to be able to test IBC transfers across various chains and to be able to do so we need the following infrastructure

• An archive node on cosmoshub public testnetwork. funds can be aquired through https://stakely.io/en/faucet/cosmos-atom
• A full node on osmosis public testnetwork. Fund can be aquired through https://faucet.osmosis.zone/#/
• A new testnetwork operated internally
• Relayers to execute on IBC transactions

┆Issue is synchronized with this Jira Task by Unito

feat(vpn): Restrict infrastructure access only through VPN

Currently our nodes are highly available from the internet and it brings quite a significant security risk.

Enhance the security of the cluster by:

• limitting access to nodes through VPN only
• limiting access to Kubernetes through VPN only
• limiting access to public endpoints like Grafana through VPN only

This requires task #62 to be done first

┆Issue is synchronized with this Jira Task by Unito

feat(monitoring): Route critical severity alerts to slack

All critical alerts should be routed from alertmanager to #eng-alerts channel on slack

┆Issue is synchronized with this Jira Task by Unito

fix: Use archway docker repositories for big-dipper image

Currently archway branded big-dippers are deployed from @drewstaylor personal repository on docker hub docker.io/drewstaylor/bigdipper:1.0.1-archway
[ ] Add CI to release docker image to use archway docker repository.
[ ] Update deploy CI to use archway docker repository

┆Issue is synchronized with this Jira Task by Unito

feature: Create service account for terraform to be used with CI

┆Issue is synchronized with this Jira Task by Unito

Relayer operation is unstable

Relayer operation seems quite unstable -> context

There seems to be multiple issue:

• packets get stuck after a while and the relayer stops relaying until restarted
• ibc client on axelar keep getting expired and chain configs on hermes probably are to blame.

┆Issue is synchronized with this Jira Task by Unito

feat: Build terraform modules for environment setup

Currently all the terraform files are under infrastructure folder

New proposed structure:

• infrastrucure
  • modules
    • environment
  • environments
    • non-prod
      • main.tf
    • prod
      • main.tf
    • xyz-env
      • main.tf

environment module:

• Setup a new project under non-prod or prod folder
• Use shared VPC from non-prod or prod
• Create and configure GKE cluster
• Create and configure apps in GKE cluster

┆Issue is synchronized with this Jira Task by Unito

feat(nodeset): Add DNS configs for nodeset module

Nodeset module should be able to set up Cloud DNS enteries to expose RPC, gRPC and API endpoints.

Proposal:

• nodeset should input two variables for zone and domain
• nodeset should create two records in cloud DNS under the give zone
  A record: *.
  A record:

┆Issue is synchronized with this Jira Task by Unito

spike: Define critical alerts for archway nodes

┆Issue is synchronized with this Jira Task by Unito

feat: automate checks for infrastucture

Currently there is not automated checks for infrastructure which can cause unnecessary problems and security risks.

Tools:

• Terraform
  • tflint
  • terraform fmt
  • tfsec
• Kubernetes
  • kube-score
  • yamllint

Each tool should be run by CI and also be available from Make file or equivalent

┆Issue is synchronized with this Jira Task by Unito

[WIP] monitoring features/fixes

Solves:

• #101

┆Issue is synchronized with this Jira Task by Unito