fix(crypto): expose monerod sync status

services/bstein-dev-home/backend-deployment.yaml

@@ -123,6 +123,8 @@ spec:
               value: ""
             - name: HTTP_CHECK_TIMEOUT_SEC
               value: "15"
+            - name: MONERO_GET_INFO_URL
+              value: http://monerod.crypto.svc.cluster.local:18084/get_info
             - name: PORTAL_DB_POOL_MIN
               value: "0"
             - name: PORTAL_DB_POOL_MAX

services/crypto/monerod/deployment.yaml

@@ -57,6 +57,9 @@ spec:
           - --rpc-bind-ip=0.0.0.0
           - --rpc-bind-port=18081
           - --confirm-external-bind
+          - --rpc-ssl=disabled
+          - --log-file=/tmp/monerod.log
+          - --max-log-files=2
           - --p2p-bind-ip=0.0.0.0
           - --p2p-bind-port=18080
           - --no-igd
@@ -106,8 +109,45 @@ spec:
         volumeMounts:
         - { name: data, mountPath: /data }
         - { name: tmp,  mountPath: /tmp }
+      - name: status-proxy
+        image: python:3.11-alpine
+        command: ["python", "/app/status_proxy.py"]
+        ports:
+          - { name: status, containerPort: 18084 }
+        env:
+          - name: MONEROD_LOG_FILE
+            value: /tmp/monerod.log
+          - name: MONEROD_STATUS_RPC_TIMEOUT_SEC
+            value: "1.25"
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: status
+          initialDelaySeconds: 2
+          periodSeconds: 10
+          timeoutSeconds: 2
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: status
+          initialDelaySeconds: 10
+          periodSeconds: 20
+          timeoutSeconds: 2
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+          limits:
+            cpu: 100m
+            memory: 128Mi
+        volumeMounts:
+        - { name: tmp, mountPath: /tmp }
+        - { name: status-proxy, mountPath: /app/status_proxy.py, subPath: status_proxy.py }
       volumes:
       - name: data
         persistentVolumeClaim: { claimName: monerod-chain }
       - name: tmp
         emptyDir: {}
+      - name: status-proxy
+        configMap:
+          name: monerod-status-proxy

services/crypto/monerod/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - pvc.yaml
   - cm-release-keys.yaml
+  - status-proxy-configmap.yaml
   - deployment.yaml
   - service.yaml
   - ingress.yaml

services/crypto/monerod/service.yaml

@@ -10,5 +10,6 @@ spec:
   selector: { app: monerod }
   ports:
   - { name: rpc, port: 18081, targetPort: 18081 }
+  - { name: status, port: 18084, targetPort: 18084 }
   - { name: p2p, port: 18080, targetPort: 18080 }
   - { name: zmq, port: 18083, targetPort: 18083 }

services/crypto/monerod/status-proxy-configmap.yaml

@@ -0,0 +1,94 @@
+# services/crypto/monerod/status-proxy-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: monerod-status-proxy
+  namespace: crypto
+data:
+  status_proxy.py: |
+    from __future__ import annotations
+
+    import json
+    import os
+    import re
+    from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+    from urllib import error, request
+
+    LOG_FILE = os.environ.get("MONEROD_LOG_FILE", "/tmp/monerod.log")
+    LISTEN_PORT = int(os.environ.get("MONEROD_STATUS_PORT", "18084"))
+    RPC_TIMEOUT_SEC = float(os.environ.get("MONEROD_STATUS_RPC_TIMEOUT_SEC", "1.25"))
+    RPC_URL = os.environ.get("MONEROD_RPC_URL", "http://127.0.0.1:18081/get_info")
+
+    SYNC_RE = re.compile(r"Synced\s+(\d+)/(\d+).*?(\d+)\s+left")
+    CANDIDATE_RE = re.compile(
+        r"candidate:\s+(\d+)\s+->\s+(\d+).*?node is\s+(\d+)\s+blocks",
+        re.IGNORECASE,
+    )
+
+
+    def _tail_log(path: str, limit: int = 262_144) -> str:
+        try:
+            size = os.path.getsize(path)
+            with open(path, "rb") as handle:
+                handle.seek(max(0, size - limit))
+                return handle.read().decode("utf-8", "ignore")
+        except OSError:
+            return ""
+
+
+    def _sync_from_logs() -> tuple[int, int]:
+        for line in reversed(_tail_log(LOG_FILE).splitlines()):
+            match = SYNC_RE.search(line) or CANDIDATE_RE.search(line)
+            if match:
+                return int(match.group(1)), int(match.group(2))
+        return 0, 0
+
+
+    def _rpc_get_info() -> dict:
+        with request.urlopen(RPC_URL, timeout=RPC_TIMEOUT_SEC) as response:
+            payload = json.loads(response.read().decode("utf-8"))
+        if isinstance(payload, dict):
+            payload.setdefault("rpc_status", "ok")
+            return payload
+        return {"status": "BAD_UPSTREAM", "rpc_status": "bad_upstream"}
+
+
+    def _busy_status() -> dict:
+        height, target_height = _sync_from_logs()
+        return {
+            "nettype": "mainnet",
+            "status": "SYNCING_RPC_BUSY",
+            "height": height,
+            "target_height": target_height,
+            "synchronized": False,
+            "rpc_status": "busy",
+        }
+
+
+    class Handler(BaseHTTPRequestHandler):
+        def _json(self, status: int, payload: dict) -> None:
+            body = json.dumps(payload).encode("utf-8")
+            self.send_response(status)
+            self.send_header("Content-Type", "application/json")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+
+        def do_GET(self) -> None:  # noqa: N802
+            if self.path == "/healthz":
+                self._json(200, {"status": "ok"})
+                return
+            if self.path.split("?", 1)[0] != "/get_info":
+                self._json(404, {"status": "NOT_FOUND"})
+                return
+            try:
+                self._json(200, _rpc_get_info())
+            except (OSError, TimeoutError, ValueError, error.URLError):
+                self._json(200, _busy_status())
+
+        def log_message(self, fmt: str, *args) -> None:
+            return
+
+
+    if __name__ == "__main__":
+        ThreadingHTTPServer(("", LISTEN_PORT), Handler).serve_forever()

services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml

@@ -1,6 +1,7 @@
 # services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml
 # One-off job for gitea/veles-feedback-acl-ensure-2.
-# Purpose: keep Veles testers on the feedback repo without granting source access.
+# Purpose: keep Veles feedback anonymously readable while limiting write access
+# to testers/admins and avoiding source-code repository access.
 apiVersion: batch/v1
 kind: Job
 metadata:

services/gitea/scripts/veles_feedback_acl_ensure.sh

@@ -49,11 +49,41 @@ end $$;
 
 update gitea.team team
 set authorize = 1,
-    includes_all_repositories = true,
+    includes_all_repositories = false,
     can_create_org_repo = false
 from veles_acl_ids ids
 where team.id = ids.team_id;
 
+update gitea."user" org
+set visibility = 0
+from veles_acl_ids ids
+where org.id = ids.org_id;
+
+update gitea.repository repo
+set is_private = false
+from veles_acl_ids ids
+where repo.id = ids.repo_id;
+
+delete from gitea.repo_unit unit
+using veles_acl_ids ids
+where unit.repo_id = ids.repo_id
+  and unit.type in (1, 3, 4, 5, 6, 7, 8, 9, 10);
+
+insert into gitea.repo_unit (repo_id, type, config, created_unix, everyone_access_mode)
+select
+  ids.repo_id,
+  2,
+  '{"EnableTimetracker":false,"AllowOnlyContributorsToTrackTime":true,"EnableDependencies":true}',
+  extract(epoch from now())::bigint,
+  0
+from veles_acl_ids ids
+where not exists (
+  select 1
+  from gitea.repo_unit existing
+  where existing.repo_id = ids.repo_id
+    and existing.type = 2
+);
+
 insert into gitea.team_repo (org_id, team_id, repo_id)
 select ids.org_id, ids.team_id, ids.repo_id
 from veles_acl_ids ids
@@ -67,7 +97,7 @@ where not exists (
 delete from gitea.team_unit unit
 using veles_acl_ids ids
 where unit.team_id = ids.team_id
-  and unit.type in (1, 2, 3, 4, 5, 8, 9, 10);
+  and unit.type in (1, 2, 3, 4, 5, 6, 7, 8, 9, 10);
 
 insert into gitea.team_unit (org_id, team_id, type, access_mode)
 select ids.org_id, ids.team_id, desired.type, desired.access_mode
@@ -79,6 +109,8 @@ cross join (
     (3, 0),
     (4, 0),
     (5, 0),
+    (6, 0),
+    (7, 0),
     (8, 0),
     (9, 0),
     (10, 0)