fix: v5 upgrade

Author: koenmtb1

.environment/mainnet/config.example.json

@@ -11,20 +11,28 @@
     "url": "redis://:dashtec@redis-mainnet:6379"
   },
   "rpc": {
-    "ethereumUrls": "<<SECRET: injected from MAINNET_ETHEREUM_RPC_URL>>"
+    "ethereumUrls": "<<SECRET: injected from MAINNET_ETHEREUM_RPC_URL>>",
+    "consensusUrls": "<<SECRET: injected from MAINNET_L1_CONSENSUS_HOST_URLS>>"
   },
-  "sentinel": {
-    "proxyUrl": "<<SECRET: injected from MAINNET_SENTINEL_PROXY_URL>>"
+  "aztecNode": {
+    "url": "http://aztec-node-mainnet:8080",
+    "image": "aztecprotocol/aztec:5.2.0@sha256:2dd0b84a5a42285762390e38f82a6ba737bfeba6e39df688af7f050dae81a3b0",
+    "network": "mainnet",
+    "p2pPort": 40400,
+    "syncMode": "snapshot",
+    "sentinelHistoryLengthInEpochs": 24,
+    "maxOldSpaceSizeMb": 4096,
+    "memLimit": "8g"
   },
   "contracts": {
-    "rollupAddress": "0x603bb2c05D474794ea97805e8De69bCcFb3bCA12",
-    "governanceAddress": "0x1102471Eb3378FEE427121c9EfcEa452E4B6B75e",
-    "governanceProposerAddress": "0x06Ef1DcF87E419C48B94a331B252819FADbD63ef",
-    "slashingProposerAddress": "0x7a318c3DaA9f21f8fc8238c65755eB0394Fbf189",
-    "slashFactoryAddress": "0x",
-    "gseAddress": "0xa92ecFD0E70c9cd5E5cd76c50Af0F7Da93567a4f",
+    "rollupAddress": "0x0000000000000000000000000000000000000000",
+    "governanceAddress": "0x0000000000000000000000000000000000000000",
+    "governanceProposerAddress": "0x0000000000000000000000000000000000000000",
+    "slashingProposerAddress": "0x0000000000000000000000000000000000000000",
+    "gseAddress": "0x0000000000000000000000000000000000000000",
     "stakingRegistryAddress": "0x042dF8f42790d6943F41C25C2132400fd727f452",
-    "registryAddress": "0x0000000000000000000000000000000000000000"
+    "registryAddress": "0x0000000000000000000000000000000000000000",
+    "_comment": "Discovered by `pnpm env:discover mainnet` from the Aztec node (node_getL1ContractAddresses) plus Rollup.getSlasher()/Slasher.PROPOSER(). stakingRegistryAddress is not part of the Aztec core deployment and must be set by hand."
   },
   "collectors": {
     "validatorStats": {
@@ -56,7 +64,8 @@
   "ponder": {
     "port": 42069,
     "maxHealthcheckDuration": 240,
-    "startBlock": 20000000
+    "startBlock": 0,
+    "_comment": "startBlock is set by `pnpm env:discover mainnet` to the rollup contract deployment block."
   },
   "app": {
     "url": "https://dashtec.xyz",

.environment/mainnet/config.json

@@ -11,20 +11,27 @@
     "url": "redis://:dashtec@redis-mainnet:6379"
   },
   "rpc": {
-    "ethereumUrls": ""
+    "ethereumUrls": "",
+    "consensusUrls": ""
   },
-  "sentinel": {
-    "proxyUrl": ""
+  "aztecNode": {
+    "url": "http://aztec-node-mainnet:8080",
+    "image": "aztecprotocol/aztec:5.2.0@sha256:2dd0b84a5a42285762390e38f82a6ba737bfeba6e39df688af7f050dae81a3b0",
+    "network": "mainnet",
+    "p2pPort": 40400,
+    "syncMode": "snapshot",
+    "sentinelHistoryLengthInEpochs": 24,
+    "maxOldSpaceSizeMb": 4096,
+    "memLimit": "8g"
   },
   "contracts": {
-    "rollupAddress": "0xae2001f7e21d5ecabf6234e9fdd1e76f50f74962",
-    "governanceAddress": "0x1102471Eb3378FEE427121c9EfcEa452E4B6B75e",
-    "governanceProposerAddress": "0x06Ef1DcF87E419C48B94a331B252819FADbD63ef",
-    "slashingProposerAddress": "0xa4a38fD0108C00983E75616b638Ff3321FD26958",
-    "slashFactoryAddress": "0x",
-    "gseAddress": "0xa92ecFD0E70c9cd5E5cd76c50Af0F7Da93567a4f",
+    "rollupAddress": "0x0000000000000000000000000000000000000000",
+    "governanceAddress": "0x0000000000000000000000000000000000000000",
+    "governanceProposerAddress": "0x0000000000000000000000000000000000000000",
+    "slashingProposerAddress": "0x0000000000000000000000000000000000000000",
+    "gseAddress": "0x0000000000000000000000000000000000000000",
     "stakingRegistryAddress": "0x042dF8f42790d6943F41C25C2132400fd727f452",
-    "registryAddress": "0x35b22e09ee0390539439e24f06da43d83f90e298"
+    "registryAddress": "0x0000000000000000000000000000000000000000"
   },
   "collectors": {
     "validatorStats": {
@@ -56,7 +63,7 @@
   "ponder": {
     "port": 42069,
     "maxHealthcheckDuration": 240,
-    "startBlock": 20000000
+    "startBlock": 0
   },
   "app": {
     "url": "https://dashtec.xyz",

.environment/testnet/config.example.json

@@ -11,20 +11,28 @@
     "url": "redis://:dashtec@redis-testnet:6379"
   },
   "rpc": {
-    "ethereumUrls": "<<SECRET: injected from TESTNET_ETHEREUM_RPC_URL>>"
+    "ethereumUrls": "<<SECRET: injected from TESTNET_ETHEREUM_RPC_URL>>",
+    "consensusUrls": "<<SECRET: injected from TESTNET_L1_CONSENSUS_HOST_URLS>>"
   },
-  "sentinel": {
-    "proxyUrl": "<<SECRET: injected from TESTNET_SENTINEL_PROXY_URL>>"
+  "aztecNode": {
+    "url": "http://aztec-node-testnet:8080",
+    "image": "aztecprotocol/aztec:5.2.0@sha256:2dd0b84a5a42285762390e38f82a6ba737bfeba6e39df688af7f050dae81a3b0",
+    "network": "testnet",
+    "p2pPort": 40500,
+    "syncMode": "snapshot",
+    "sentinelHistoryLengthInEpochs": 24,
+    "maxOldSpaceSizeMb": 4096,
+    "memLimit": "6g"
   },
   "contracts": {
-    "rollupAddress": "0xebd99ff0ff6677205509ae73f93d0ca52ac85d67",
-    "governanceAddress": "0x1b5dad737609a548543ce32a71377900b5fd5584",
-    "governanceProposerAddress": "0xef1b0d8aaca52f70323cbb91b0103bce75e9c533",
-    "slashingProposerAddress": "0x1d78c05369d4fd947b90De0B7727737c19636d4D",
-    "slashFactoryAddress": "0xd71673ec4b5d5b468cd48da855a66df0a02cdf3b",
-    "gseAddress": "0xfb243b9112bb65785a4a8edaf32529accf003614",
+    "rollupAddress": "0x0000000000000000000000000000000000000000",
+    "governanceAddress": "0x0000000000000000000000000000000000000000",
+    "governanceProposerAddress": "0x0000000000000000000000000000000000000000",
+    "slashingProposerAddress": "0x0000000000000000000000000000000000000000",
+    "gseAddress": "0x0000000000000000000000000000000000000000",
     "stakingRegistryAddress": "0xa65f52BD0889BbE7DF0cE14709865e3E3bDDbEEa",
-    "registryAddress": "0x0000000000000000000000000000000000000000"
+    "registryAddress": "0x0000000000000000000000000000000000000000",
+    "_comment": "Discovered by `pnpm env:discover testnet` from the Aztec node (node_getL1ContractAddresses) plus Rollup.getSlasher()/Slasher.PROPOSER(). stakingRegistryAddress is not part of the Aztec core deployment and must be set by hand."
   },
   "collectors": {
     "validatorStats": {
@@ -56,7 +64,8 @@
   "ponder": {
     "port": 42069,
     "maxHealthcheckDuration": 240,
-    "startBlock": 9500000
+    "startBlock": 0,
+    "_comment": "startBlock is set by `pnpm env:discover testnet` to the rollup contract deployment block."
   },
   "app": {
     "url": "https://testnet.dashtec.xyz",

.environment/testnet/config.json

@@ -11,20 +11,27 @@
     "url": "redis://:dashtec@redis-testnet:6379"
   },
   "rpc": {
-    "ethereumUrls": ""
+    "ethereumUrls": "",
+    "consensusUrls": ""
   },
-  "sentinel": {
-    "proxyUrl": ""
+  "aztecNode": {
+    "url": "http://aztec-node-testnet:8080",
+    "image": "aztecprotocol/aztec:5.2.0@sha256:2dd0b84a5a42285762390e38f82a6ba737bfeba6e39df688af7f050dae81a3b0",
+    "network": "testnet",
+    "p2pPort": 40500,
+    "syncMode": "snapshot",
+    "sentinelHistoryLengthInEpochs": 24,
+    "maxOldSpaceSizeMb": 4096,
+    "memLimit": "6g"
   },
   "contracts": {
-    "rollupAddress": "0xa0bfb1b494fb49041e5c6e8c2c1be09cd171c6ba",
-    "governanceAddress": "0xcaf7447721447b22cd0076ac7c63877c3afd329f",
-    "governanceProposerAddress": "0x01c7d4ca153748d2377968fef22894cb162e9480",
-    "slashingProposerAddress": "0xf5Aa08D6F331Fed2a0F09229568D9A391D02d387",
-    "slashFactoryAddress": "0x0",
-    "gseAddress": "0xb6a38a51a6c1de9012f9d8ea9745ef957212eaac",
+    "rollupAddress": "0x0000000000000000000000000000000000000000",
+    "governanceAddress": "0x0000000000000000000000000000000000000000",
+    "governanceProposerAddress": "0x0000000000000000000000000000000000000000",
+    "slashingProposerAddress": "0x0000000000000000000000000000000000000000",
+    "gseAddress": "0x0000000000000000000000000000000000000000",
     "stakingRegistryAddress": "0xC6EcC1832c8BF6a41c927BEb4E9ec610FBeDd1C2",
-    "registryAddress": "0xa0bfb1b494fb49041e5c6e8c2c1be09cd171c6ba"
+    "registryAddress": "0x0000000000000000000000000000000000000000"
   },
   "collectors": {
     "validatorStats": {
@@ -56,7 +63,7 @@
   "ponder": {
     "port": 42069,
     "maxHealthcheckDuration": 240,
-    "startBlock": 9500000
+    "startBlock": 0
   },
   "app": {
     "url": "https://testnet.dashtec.xyz",

.github/workflows/deploy.yml

@@ -27,9 +27,17 @@ jobs:
         with:
           oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
           oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
-          # The tailnet ACL must allow `tag:ci` to SSH to the server's tag as
-          # root with `action: accept` (not `check`, which needs interactivity).
-          tags: tag:ci
+          # `tag:dashtec-ci` must exist in the tailnet ACL's tagOwners, and the
+          # ACL must allow it to SSH to `tag:dashtec` as root with
+          # `action: accept` (not `check`, which needs a browser approval).
+          # Both live in foundation-iac/rpc.aztec.foundation/tailscale.tf, which
+          # owns the tailnet ACL singleton for the whole tailnet.
+          #
+          # This was `tag:ci`, which no tagOwner ever granted — the OAuth client
+          # could not mint it, so this step failed on every run and the deploy
+          # never reached Ansible. Renamed to match the `tag:eth-rpc-ci`
+          # convention rather than claim a bare `tag:ci` in a shared tailnet.
+          tags: tag:dashtec-ci
 
       - name: Install Ansible
         run: pipx install --include-deps ansible
@@ -49,11 +57,15 @@ jobs:
         env:
           ANSIBLE_HOST_KEY_CHECKING: "False"
           # Per-network secrets injected into the committed config.json.
+          # L1 execution RPC (Ponder, collectors, Aztec node) and L1 beacon API
+          # (Aztec node only — it fetches the blobs carrying checkpoint data).
+          # There is no *_SENTINEL_PROXY_URL any more: the dashboard now talks to
+          # the Aztec node we run ourselves in docker-compose.
           MAINNET_ETHEREUM_RPC_URL: ${{ secrets.MAINNET_ETHEREUM_RPC_URL }}
-          MAINNET_SENTINEL_PROXY_URL: ${{ secrets.MAINNET_SENTINEL_PROXY_URL }}
+          MAINNET_L1_CONSENSUS_HOST_URLS: ${{ secrets.MAINNET_L1_CONSENSUS_HOST_URLS }}
           MAINNET_SESSION_PASSWORD: ${{ secrets.MAINNET_SESSION_PASSWORD }}
           TESTNET_ETHEREUM_RPC_URL: ${{ secrets.TESTNET_ETHEREUM_RPC_URL }}
-          TESTNET_SENTINEL_PROXY_URL: ${{ secrets.TESTNET_SENTINEL_PROXY_URL }}
+          TESTNET_L1_CONSENSUS_HOST_URLS: ${{ secrets.TESTNET_L1_CONSENSUS_HOST_URLS }}
           TESTNET_SESSION_PASSWORD: ${{ secrets.TESTNET_SESSION_PASSWORD }}
           # OAuth, shared across networks (one app each). IDs are public
           # (variables); secrets are sensitive.

README.md

@@ -9,8 +9,15 @@ Blockchain --> Ponder Indexer --> Materializer --> PostgreSQL --> REST API --> D
                                        ^
                                        |
                               Custom Collectors
+                                       ^
+                                       |
+                       Aztec node (self-hosted, per network)
 ```
 
+dashtec runs its own Aztec node per network rather than depending on an external
+RPC. It serves the `node_*` methods the dashboard needs and is the source of
+truth for which L1 contracts to index — see [docs/aztec-node.md](docs/aztec-node.md).
+
 ## Project Structure
 
 ```
@@ -48,7 +55,12 @@ docker compose --profile mainnet up -d postgres-mainnet redis-mainnet
 
 # Configure environment
 cp .environment/mainnet/config.example.json .environment/mainnet/config.json
-# Edit config.json with your RPC endpoints, contract addresses, etc.
+# Edit config.json: rpc.ethereumUrls (L1 execution) and rpc.consensusUrls (L1 beacon).
+# Leave contracts.* at their zero placeholders — the next step fills them in.
+
+# Start our Aztec node, then discover the contract addresses from it
+docker compose --profile mainnet up -d --wait --wait-timeout 3600 aztec-node-mainnet
+pnpm env:discover mainnet
 
 # Propagate config to all packages
 pnpm env:propagate mainnet
@@ -72,6 +84,7 @@ pnpm turbo typecheck                  # Typecheck everything
 pnpm db:generate                      # Generate Prisma client
 pnpm db:migrate                       # Run database migrations
 pnpm db:studio                        # Open Prisma Studio
+pnpm env:discover <mainnet|testnet>   # Read contract addresses from the Aztec node
 pnpm env:propagate <mainnet|testnet>  # Propagate env config to all packages
 pnpm --filter @dashtec/<pkg> dev      # Dev a single package
 ```

ansible/README.md

@@ -18,19 +18,27 @@ the docker-compose lifecycle — lives here, so it's idempotent and re-runnable.
 | -------- | ------ |
 | `docker` | Install Docker Engine + compose plugin + git + jq (GPG-pinned apt repo) |
 | `repo`   | Clone/update the repo at `repo_version` into `/opt/dashtec` (`force: true`, resetting the committed `config.json` to its clean, secret-free state) |
-| `config` | Assert secrets present, inject secrets into the committed `config.json` (via jq), run `env:propagate` (Node-only, via an ephemeral container), render the root `.env` |
-| `deploy` | `docker compose --profile <network> up -d --build` for each network |
+| `config` | Assert secrets present, inject secrets into the committed `config.json` (via jq), read it back, render the root `.env` |
+| `aztec_node` | Start `aztec-node-<network>` and wait for it to report healthy, then discover the Aztec V5 contract addresses and the rollup's deployment block from it into `config.json` |
+| `deploy` | Run `env:propagate` (Node-only, via an ephemeral container), then `docker compose --profile <network> up -d --build` for each network, then apply DB migrations |
 
 ### Config & secrets model
 
 `.environment/<network>/config.json` is **committed** with all non-secret values
 (addresses, domains, in-cluster DB/Redis URLs, collector tuning) and **empty**
 secret fields. At deploy, the `config` role injects the secrets with `jq`, then
-`env:propagate` fans them into the package `.env` files. The root `.env`'s
-`NEXT_SENTINEL_URL` / `VALIDATOR_STATS_RPC_URL` (+ testnet) are set to
-`SENTINEL_PROXY_URL` (the Aztec node JSON-RPC endpoint). Never commit real secret
+the `aztec_node` role starts our own Aztec node and discovers the V5 contract
+addresses from it, and only then does `env:propagate` fan everything into the
+package `.env` files. The root `.env`'s `NEXT_SENTINEL_URL` /
+`VALIDATOR_STATS_RPC_URL` (+ testnet) point at that node
+(`http://aztec-node-<network>:8080`), and its `AZTEC_NODE_*` variables are what
+the node services in `docker-compose.yml` interpolate. Never commit real secret
 values into `config.json`.
 
+Role order matters: `config` renders the root `.env` (so the node can start),
+`aztec_node` brings the node up and writes `contracts.*` + `ponder.startBlock`
+into `config.json`, `deploy` propagates and starts everything else.
+
 ## CI deployment (default)
 
 Push to `main` (or run the workflow manually) triggers the deploy. The runner:
@@ -46,12 +54,12 @@ Push to `main` (or run the workflow manually) triggers the deploy. The runner:
 | ------ | ------- |
 | `TS_OAUTH_CLIENT_ID`, `TS_OAUTH_SECRET` | Tailscale OAuth client (tagged `tag:ci`) so the runner joins the tailnet |
 | `MAINNET_ETHEREUM_RPC_URL`, `TESTNET_ETHEREUM_RPC_URL` | L1 RPC URLs (contain API keys) → `rpc.ethereumUrls` |
-| `MAINNET_SENTINEL_PROXY_URL`, `TESTNET_SENTINEL_PROXY_URL` | Aztec node base URL → `sentinel.proxyUrl` (also derives the root `.env` sentinel/RPC vars) |
+| `MAINNET_L1_CONSENSUS_HOST_URLS`, `TESTNET_L1_CONSENSUS_HOST_URLS` | L1 beacon-chain API URLs → `rpc.consensusUrls`. Only the Aztec node uses these, to fetch the blobs carrying checkpoint data; an execution RPC will not do |
 | `MAINNET_SESSION_PASSWORD`, `TESTNET_SESSION_PASSWORD` | iron-session password (≥32 chars) |
 | `DISCORD_CLIENT_SECRET` | Discord OAuth secret — **shared across networks** (optional) |
 | `X_CLIENT_SECRET` | X OAuth secret — **shared across networks** (optional) |
 
-> `ETHEREUM_RPC_URL`, `SENTINEL_PROXY_URL`, and `SESSION_PASSWORD` are required
+> `ETHEREUM_RPC_URL`, `L1_CONSENSUS_HOST_URLS`, and `SESSION_PASSWORD` are required
 > per active network; the OAuth secrets are shared and optional (auth is disabled
 > if empty). Register both `dashtec.xyz` and `testnet.dashtec.xyz` redirect URIs
 > on the single Discord/X app, and set the matching `clientId` in each network's
@@ -84,8 +92,8 @@ each with its corresponding `*_CLIENT_SECRET`.
 ```bash
 cd ansible
 # inventory.ini is generated by `terraform apply`; or copy inventory.example.ini
-export MAINNET_ETHEREUM_RPC_URL=... MAINNET_SENTINEL_PROXY_URL=... MAINNET_SESSION_PASSWORD=...
-export TESTNET_ETHEREUM_RPC_URL=... TESTNET_SENTINEL_PROXY_URL=... TESTNET_SESSION_PASSWORD=...
+export MAINNET_ETHEREUM_RPC_URL=... MAINNET_L1_CONSENSUS_HOST_URLS=... MAINNET_SESSION_PASSWORD=...
+export TESTNET_ETHEREUM_RPC_URL=... TESTNET_L1_CONSENSUS_HOST_URLS=... TESTNET_SESSION_PASSWORD=...
 # optional: *_DISCORD_CLIENT_SECRET / *_X_CLIENT_SECRET
 ansible-playbook site.yml
 ```

ansible/group_vars/all/vars.yml

@@ -13,18 +13,30 @@ dashtec_networks:
 
 # Per-network secrets, sourced from the environment (GitHub Actions Secrets in
 # CI, or `export`ed locally). These are injected into the committed config.json
-# at deploy time; NEXT_SENTINEL_URL / VALIDATOR_STATS_RPC_URL in the root .env
-# are set to sentinel_proxy_url (the Aztec node JSON-RPC endpoint).
+# at deploy time.
+#
+# ethereum_rpc_url is the L1 execution-layer RPC, used by Ponder, the custom
+# collectors, and the Aztec node. l1_consensus_urls is the L1 beacon-chain API;
+# only the Aztec node needs it, to fetch the blobs that carry checkpoint data.
+#
+# There is no longer a sentinel_proxy_url: NEXT_SENTINEL_URL and
+# VALIDATOR_STATS_RPC_URL now point at our own aztec-node-<network> container
+# (see .environment/<network>/config.json -> aztecNode.url).
 network_secrets:
   mainnet:
     ethereum_rpc_url: "{{ lookup('env', 'MAINNET_ETHEREUM_RPC_URL') }}"
-    sentinel_proxy_url: "{{ lookup('env', 'MAINNET_SENTINEL_PROXY_URL') }}"
+    l1_consensus_urls: "{{ lookup('env', 'MAINNET_L1_CONSENSUS_HOST_URLS') }}"
     session_password: "{{ lookup('env', 'MAINNET_SESSION_PASSWORD') }}"
   testnet:
     ethereum_rpc_url: "{{ lookup('env', 'TESTNET_ETHEREUM_RPC_URL') }}"
-    sentinel_proxy_url: "{{ lookup('env', 'TESTNET_SENTINEL_PROXY_URL') }}"
+    l1_consensus_urls: "{{ lookup('env', 'TESTNET_L1_CONSENSUS_HOST_URLS') }}"
     session_password: "{{ lookup('env', 'TESTNET_SESSION_PASSWORD') }}"
 
+# How long to wait for a node to answer /status before giving up on contract
+# discovery. A first boot restores from a snapshot and then catches up to the
+# chain tip, which is far slower than a restart with a warm data volume.
+aztec_node_ready_timeout_seconds: 3600
+
 # OAuth config is shared across networks (one Discord/X app with both redirect
 # URIs registered). Optional — auth is disabled if empty. Client IDs are public
 # (GitHub Actions *variables*); client secrets are sensitive (Actions *secrets*).