Add network node status endpoint (#181)

* Add network node status endpoint

* Restrict node debug status to loopback

* Avoid admin status port collisions

Author: zjma

.github/workflows/docker.yml

@@ -67,6 +67,10 @@ jobs:
           file: worker-components/network-node/Dockerfile
           push: true
           tags: us-docker.pkg.dev/aptos-registry/docker/ace-node:${{ steps.image_tag.outputs.value }}
+          build-args: |
+            ACE_VERSION=${{ github.event_name == 'push' && github.ref_name || steps.image_tag.outputs.value }}
+            ACE_IMAGE_TAG=${{ steps.image_tag.outputs.value }}
+            ACE_GIT_SHA=${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
 

Cargo.lock

@@ -48,3 +48,6 @@ uuid = { version = "1", features = ["v4"] }
 reqwest = { version = "0.12", features = ["json"] }
 base64 = "0.22"
 futures = "0.3"
+
+[dev-dependencies]
+tower = { version = "0.5", features = ["util"] }

worker-components/network-node/Cargo.toml

@@ -11,6 +11,12 @@ COPY . .
 RUN cargo build --release -p network-node
 
 FROM debian:bookworm-slim
+ARG ACE_VERSION=unknown
+ARG ACE_IMAGE_TAG=unknown
+ARG ACE_GIT_SHA=unknown
+ENV ACE_VERSION=$ACE_VERSION
+ENV ACE_IMAGE_TAG=$ACE_IMAGE_TAG
+ENV ACE_GIT_SHA=$ACE_GIT_SHA
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
 COPY --from=builder /build/target/release/network-node /usr/local/bin/network-node
 ENTRYPOINT ["network-node"]

worker-components/network-node/Dockerfile

@@ -17,12 +17,19 @@ mod outcome;
 mod request;
 mod serve;
 mod shares;
+mod status;
 mod state;
 
 #[cfg(test)]
 mod tests;
 #[cfg(test)]
 mod tests_support;
 
-pub use self::serve::{run_secrets_server, run_user_server};
+pub use self::serve::{
+    run_secrets_admin_server, run_secrets_server, run_user_admin_server, run_user_server,
+};
+pub use self::status::{
+    chain_rpc_dependency_targets, DependencyTarget, NodeStatus, PublicNodeConfig,
+    PublicServerConfig,
+};
 pub use self::state::{AppState, SecretsServerState};

worker-components/network-node/src/http_server/mod.rs

@@ -10,32 +10,74 @@ use axum::{
 use tower_http::cors::CorsLayer;
 
 use super::request::handle_request;
+use super::status::{DebugStatusResponse, PublicStatusResponse};
 use super::state::{AppState, SecretsServerState};
 use crate::secrets::SecretsSnapshotWire;
 use crate::wlog;
 
 /// Spawn the user-request server. Runs until the process exits.
 pub async fn run_user_server(port: u16, state: AppState) {
-    let app = Router::new()
+    serve(port, user_router(state), "http-server (user)").await;
+}
+
+pub async fn run_user_admin_server(port: u16, state: AppState) {
+    serve_loopback(port, user_admin_router(state), "http-server (user-admin)").await;
+}
+
+pub async fn run_secrets_server(port: u16, state: SecretsServerState) {
+    serve(port, secrets_router(state), "http-server (secrets)").await;
+}
+
+pub async fn run_secrets_admin_server(port: u16, state: SecretsServerState) {
+    serve_loopback(
+        port,
+        secrets_admin_router(state),
+        "http-server (secrets-admin)",
+    )
+    .await;
+}
+
+fn user_router(state: AppState) -> Router {
+    Router::new()
         .route("/", post(handle_request))
         .route("/healthz", get(handle_healthz))
+        .route("/status", get(handle_user_status))
         .with_state(state)
-        .layer(CorsLayer::permissive());
-    serve(port, app, "http-server (user)").await;
+        .layer(CorsLayer::permissive())
 }
 
-pub async fn run_secrets_server(port: u16, state: SecretsServerState) {
-    let app = Router::new()
+fn user_admin_router(state: AppState) -> Router {
+    Router::new()
+        .route("/debug/status", get(handle_user_debug_status))
+        .with_state(state)
+}
+
+fn secrets_router(state: SecretsServerState) -> Router {
+    Router::new()
         .route("/secrets", get(handle_get_secrets))
         .route("/healthz", get(handle_secrets_healthz))
-        .with_state(state);
-    serve(port, app, "http-server (secrets)").await;
+        .route("/status", get(handle_secrets_status))
+        .with_state(state)
+}
+
+fn secrets_admin_router(state: SecretsServerState) -> Router {
+    Router::new()
+        .route("/debug/status", get(handle_secrets_debug_status))
+        .with_state(state)
 }
 
 async fn handle_healthz() -> StatusCode {
     StatusCode::OK
 }
 
+async fn handle_user_status(State(state): State<AppState>) -> Json<PublicStatusResponse> {
+    Json(state.status.public_response())
+}
+
+async fn handle_user_debug_status(State(state): State<AppState>) -> Json<DebugStatusResponse> {
+    Json(state.status.debug_response().await)
+}
+
 async fn handle_get_secrets(State(state): State<SecretsServerState>) -> Json<SecretsSnapshotWire> {
     Json(state.local.snapshot_wire().await)
 }
@@ -44,8 +86,27 @@ async fn handle_secrets_healthz() -> StatusCode {
     StatusCode::OK
 }
 
+async fn handle_secrets_status(
+    State(state): State<SecretsServerState>,
+) -> Json<PublicStatusResponse> {
+    Json(state.status.public_response())
+}
+
+async fn handle_secrets_debug_status(
+    State(state): State<SecretsServerState>,
+) -> Json<DebugStatusResponse> {
+    Json(state.status.debug_response().await)
+}
+
 async fn serve(port: u16, app: Router, label: &str) {
-    let addr = format!("0.0.0.0:{}", port);
+    serve_addr(format!("0.0.0.0:{}", port), app, label).await
+}
+
+async fn serve_loopback(port: u16, app: Router, label: &str) {
+    serve_addr(format!("127.0.0.1:{}", port), app, label).await
+}
+
+async fn serve_addr(addr: String, app: Router, label: &str) {
     let listener = match tokio::net::TcpListener::bind(&addr).await {
         Ok(l) => l,
         Err(e) => {
@@ -58,3 +119,106 @@ async fn serve(port: u16, app: Router, label: &str) {
         wlog!("{}: serve error: {}", label, e);
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::{collections::HashMap, sync::Arc};
+
+    use axum::{body::Body, http::Request};
+    use tokio::sync::{RwLock, Semaphore};
+    use tower::ServiceExt;
+    use vss_common::AptosRpc;
+
+    use super::super::status::{NodeStatus, PublicNodeConfig};
+    use super::*;
+    use crate::secrets::{LocalSecrets, SecretsProvider};
+    use crate::ChainRpcConfig;
+
+    fn rpc(label: &str) -> AptosRpc {
+        AptosRpc::new(format!("https://{}.example/v1", label))
+    }
+
+    fn chain_rpc_config() -> ChainRpcConfig {
+        ChainRpcConfig {
+            aptos_mainnet: rpc("mainnet"),
+            aptos_testnet: rpc("testnet"),
+            aptos_localnet: rpc("localnet"),
+            aptos_shelby_private_beta: Some(rpc("shelby")),
+            solana_mainnet_beta: "https://solana-mainnet.example".to_string(),
+            solana_testnet: "https://solana-testnet.example".to_string(),
+            solana_devnet: "https://solana-devnet.example".to_string(),
+            solana_client: reqwest::Client::new(),
+        }
+    }
+
+    fn local_secrets() -> LocalSecrets {
+        LocalSecrets {
+            shares: Arc::new(RwLock::new(HashMap::new())),
+        }
+    }
+
+    fn node_status() -> Arc<NodeStatus> {
+        Arc::new(NodeStatus::new(PublicNodeConfig::new("handler"), Vec::new()))
+    }
+
+    fn app_state() -> AppState {
+        AppState {
+            provider: Arc::new(SecretsProvider::Local(local_secrets())),
+            chain_rpc: Arc::new(chain_rpc_config()),
+            concurrency: Arc::new(Semaphore::new(1)),
+            pke_dk_bytes: Arc::new(Vec::new()),
+            status: node_status(),
+        }
+    }
+
+    fn secrets_state() -> SecretsServerState {
+        SecretsServerState {
+            local: local_secrets(),
+            status: node_status(),
+        }
+    }
+
+    async fn get_status(app: Router, path: &str) -> StatusCode {
+        app.oneshot(
+            Request::builder()
+                .uri(path)
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap()
+        .status()
+    }
+
+    #[tokio::test]
+    async fn public_user_router_does_not_expose_debug_status() {
+        assert_eq!(
+            get_status(user_router(app_state()), "/debug/status").await,
+            StatusCode::NOT_FOUND
+        );
+    }
+
+    #[tokio::test]
+    async fn public_secrets_router_does_not_expose_debug_status() {
+        assert_eq!(
+            get_status(secrets_router(secrets_state()), "/debug/status").await,
+            StatusCode::NOT_FOUND
+        );
+    }
+
+    #[tokio::test]
+    async fn user_admin_router_exposes_debug_status() {
+        assert_eq!(
+            get_status(user_admin_router(app_state()), "/debug/status").await,
+            StatusCode::OK
+        );
+    }
+
+    #[tokio::test]
+    async fn secrets_admin_router_exposes_debug_status() {
+        assert_eq!(
+            get_status(secrets_admin_router(secrets_state()), "/debug/status").await,
+            StatusCode::OK
+        );
+    }
+}

worker-components/network-node/src/http_server/serve.rs

@@ -5,6 +5,7 @@ use std::sync::Arc;
 
 use tokio::sync::Semaphore;
 
+use super::status::NodeStatus;
 use crate::secrets::{LocalSecrets, SecretsProvider};
 use crate::ChainRpcConfig;
 
@@ -15,9 +16,11 @@ pub struct AppState {
     pub chain_rpc: Arc<ChainRpcConfig>,
     pub concurrency: Arc<Semaphore>,
     pub pke_dk_bytes: Arc<Vec<u8>>,
+    pub status: Arc<NodeStatus>,
 }
 
 #[derive(Clone)]
 pub struct SecretsServerState {
     pub local: LocalSecrets,
+    pub status: Arc<NodeStatus>,
 }