Update base containers (#355)

* Update to Node18

* Update to latest stable lighthouse

Former-commit-id: a335ccde3a

.gitea/workflows/publish.yml

@@ -0,0 +1,46 @@
+name: Publish
+
+on:
+  push:
+    branches:
+      - main
+      - publish-test
+
+jobs:
+  publish:
+    name: "Build and publish"
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Clone project repository"
+        uses: actions/checkout@v3
+      - name: "Get build info"
+        id: build-info
+        run: |
+          build_tag=$(./scripts/create_build_tag_file.sh)
+          echo "build-tag=v${build_tag}" >> $GITHUB_OUTPUT
+      - name: "Install Python"
+        uses: cerc-io/setup-python@v4
+        with:
+          python-version: '3.8'
+      - name: "Print Python version"
+        run: python3 --version
+      - name: "Install shiv"
+        run: pip install shiv
+      - name: "Build local shiv package"
+        id: build
+        run: |
+          ./scripts/build_shiv_package.sh
+          result_code=$?
+          echo "package-file=$(ls ./package/*)" >> $GITHUB_OUTPUT
+          exit $result_code
+      - name: "Stage artifact file"
+        run: |
+          cp ${{ steps.build.outputs.package-file }} ./laconic-so
+      - name: "Create release"
+        uses: cerc-io/action-gh-release@gitea-v1
+        with:
+          tag_name: ${{ steps.build-info.outputs.build-tag }}
+          # On the publish test branch, mark our release as a draft
+          # Hack using endsWith to workaround Gitea sometimes sending "publish-test" vs "refs/heads/publish-test"
+          draft: ${{ endsWith('publish-test', github.ref ) }}
+          files: ./laconic-so

.gitea/workflows/test.yml

@@ -0,0 +1,29 @@
+name: Test
+
+on:
+  pull_request:
+    branches: '*'
+  push:
+    branches: '*'
+
+jobs:
+  test:
+    name: "Run basic test suite"
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Clone project repository"
+        uses: actions/checkout@v3
+      - name: "Install Python"
+        uses: cerc-io/setup-python@v4
+        with:
+          python-version: '3.8'
+      - name: "Print Python version"
+        run: python3 --version
+      - name: "Install shiv"
+        run: pip install shiv
+      - name: "Generate build version file"
+        run: ./scripts/create_build_tag_file.sh
+      - name: "Build local shiv package"
+        run: ./scripts/build_shiv_package.sh
+      - name: "Run smoke tests"
+        run: ./tests/smoke-test/run-smoke-test.sh

.github/workflows/publish.yml

@@ -0,0 +1,46 @@
+name: Publish
+
+on:
+  push:
+    branches:
+      - main
+      - publish-test
+
+jobs:
+  publish:
+    name: "Build and publish"
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Clone project repository"
+        uses: actions/checkout@v3
+      - name: "Get build info"
+        id: build-info
+        run: |
+          build_tag=$(./scripts/create_build_tag_file.sh)
+          echo "build-tag=v${build_tag}" >> $GITHUB_OUTPUT
+      - name: "Install Python"
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.8'
+      - name: "Print Python version"
+        run: python3 --version
+      - name: "Install shiv"
+        run: pip install shiv
+      - name: "Build local shiv package"
+        id: build
+        run: |
+          ./scripts/build_shiv_package.sh
+          result_code=$?
+          echo "package-file=$(ls ./package/*)" >> $GITHUB_OUTPUT
+          exit $result_code
+      - name: "Stage artifact file"
+        run: |
+          cp ${{ steps.build.outputs.package-file }} ./laconic-so
+      - name: "Create release"
+        uses: softprops/action-gh-release@v1
+        with:
+          tag_name: ${{ steps.build-info.outputs.build-tag }}
+          # On the publish test branch, mark our release as a draft
+          # Hack using endsWith to workaround Gitea sometimes sending "publish-test" vs "refs/heads/publish-test"
+          draft: ${{ endsWith('publish-test', github.ref ) }}
+          files: ./laconic-so

.github/workflows/test.yml

@@ -0,0 +1,29 @@
+name: Test
+
+on:
+  pull_request:
+    branches: '*'
+  push:
+    branches: '*'
+
+jobs:
+  test:
+    name: "Run basic test suite"
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Clone project repository"
+        uses: actions/checkout@v3
+      - name: "Install Python"
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.8'
+      - name: "Print Python version"
+        run: python3 --version
+      - name: "Install shiv"
+        run: pip install shiv
+      - name: "Generate build version file"
+        run: ./scripts/create_build_tag_file.sh
+      - name: "Build local shiv package"
+        run: ./scripts/build_shiv_package.sh
+      - name: "Run smoke tests"
+        run: ./tests/smoke-test/run-smoke-test.sh

.gitignore

@@ -5,4 +5,5 @@ laconic-so
 laconic_stack_orchestrator.egg-info
 __pycache__
 *~
-
+package
+app/data/build_tag.txt

README.md

@@ -6,13 +6,18 @@ Stack Orchestrator allows building and deployment of a Laconic Stack on a single
 
 ## Install
 
+**To get started quickly** on a fresh Ubuntu instance (e.g, Digital Ocean); [try this script](./scripts/quick-install-ubuntu.sh). **WARNING:** always review scripts prior to running them so that you know what is happening on your machine.
+
+For any other installation, follow along below and **adapt these instructions based on the specifics of your system.**
+
+
 Ensure that the following are already installed:
 
-- [Python3](https://wiki.python.org/moin/BeginnersGuide/Download)
-- [Docker](https://docs.docker.com/get-docker/) 
-- [Docker Compose](https://docs.docker.com/compose/install/)
+- [Python3](https://wiki.python.org/moin/BeginnersGuide/Download): `python3 --version` >= `3.8.10` (the Python3 shipped in Ubuntu 20+ is good to go)
+- [Docker](https://docs.docker.com/get-docker/): `docker --version` >= `20.10.21`
+- [jq](https://stedolan.github.io/jq/download/): `jq --version` >= `1.5`
 
-Note: if installing docker-compose via package manager (as opposed to Docker Desktop), you must [install the plugin](https://docs.docker.com/compose/install/linux/#install-the-plugin-manually), e.g., on Linux:
+Note: if installing docker-compose via package manager on Linux (as opposed to Docker Desktop), you must [install the plugin](https://docs.docker.com/compose/install/linux/#install-the-plugin-manually), e.g. :
 
 ```bash
 mkdir -p ~/.docker/cli-plugins
@@ -20,39 +25,27 @@ curl -SL https://github.com/docker/compose/releases/download/v2.11.2/docker-comp
 chmod +x ~/.docker/cli-plugins/docker-compose
 ```
 
-Next, download the latest release from [this page](https://github.com/cerc-io/stack-orchestrator/tags), into a suitable directory (e.g. `~/bin`):
+Next decide on a directory where you would like to put the stack-orchestrator program. Typically this would be 
+a "user" binary directory such as `~/bin` or perhaps `/usr/local/laconic` or possibly just the current working directory.
+
+Now, having selected that directory, download the latest release from [this page](https://github.com/cerc-io/stack-orchestrator/tags) into it (we're using `~/bin` below for concreteness but edit to suit if you selected a different directory). Also be sure that the destination directory exists and is writable:
 
 ```bash
 curl -L -o ~/bin/laconic-so https://github.com/cerc-io/stack-orchestrator/releases/latest/download/laconic-so
 ```
 
-Give it permissions:
+Give it execute permissions:
 ```bash
 chmod +x ~/bin/laconic-so
 ```
 
 Ensure `laconic-so` is on the [`PATH`](https://unix.stackexchange.com/a/26059)
 
-Verify operation:
+Verify operation (your version will probably be different, just check here that you see some version outut and not an error):
 
 ```
-laconic-so --help
-Usage: python -m laconic-so [OPTIONS] COMMAND [ARGS]...
-
-  Laconic Stack Orchestrator
-
-Options:
-  --quiet
-  --verbose
-  --dry-run
-  --local-stack
-  -h, --help     Show this message and exit.
-
-Commands:
-  build-containers    build the set of containers required for a complete...
-  build-npms          build the set of npm packages required for a...  
-  deploy-system       deploy a stack
-  setup-repositories  git clone the set of repositories required to build...
+laconic-so version
+Version: v1.0.27-7831078
 ```
 
 ## Usage
@@ -64,25 +57,25 @@ Three sub-commands: `setup-repositories`, `build-containers` and `deploy-system`
 Clone the set of git repositories necessary to build a system:
 
 ```bash
-laconic-so --verbose setup-repositories --include cerc-io/go-ethereum,cerc-io/ipld-eth-db,cerc-io/ipld-eth-server,cerc-io/watcher-ts
+laconic-so --stack erc20 setup-repositories
 ```
 
-This will default to `~/cerc` or - if set - the environment variable `CERC_REPO_BASE_DIR`
+This will default to cloning git reposiories into: `~/cerc` or - if set - the environment variable `CERC_REPO_BASE_DIR`
 
 ### Build Containers
 
 Build the set of docker container images required to run a system. It takes around 10 minutes to build all the containers from scratch.
 
 ```bash
-laconic-so --verbose build-containers --include cerc/go-ethereum,cerc/go-ethereum-foundry,cerc/ipld-eth-db,cerc/ipld-eth-server,cerc/watcher-erc20
+laconic-so --stack erc20 build-containers
 ```
 
 ### Deploy System
 
-Uses `docker-compose` to deploy a system (with most recently built container images).
+Uses `docker compose` to deploy a system (with most recently built container images).
 
 ```bash
-laconic-so --verbose deploy-system --include ipld-eth-db,go-ethereum-foundry,ipld-eth-server,watcher-erc20 up
+laconic-so --stack erc20 deploy-system up
 ```
 
 Check out he GraphQL playground here: [http://localhost:3002/graphql](http://localhost:3002/graphql)
@@ -92,14 +85,15 @@ See the [erc20 watcher demo](/app/data/stacks/erc20) to continue further.
 ### Cleanup
 
 ```bash
-laconic-so --verbose deploy-system --include ipld-eth-db,go-ethereum-foundry,ipld-eth-server,watcher-erc20 down
+laconic-so --stack erc20 deploy-system down
 ```
 
 ## Contributing
 
-See the [CONTRIBUTING.md](.github/CONTRIBUTING.md) for developer mode install.
+See the [CONTRIBUTING.md](/docs/CONTRIBUTING.md) for developer mode install.
 
 ## Platform Support
 
 Native aarm64 is _not_ currently supported. x64 emulation on ARM64 macos should work (not yet tested).
 
+

app/base.py

@@ -0,0 +1,71 @@
+# Copyright © 2022, 2023 Cerc
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http:#www.gnu.org/licenses/>.
+
+import os
+from abc import ABC, abstractmethod
+from .deploy_system import get_stack_status
+
+
+def get_stack(config, stack):
+    if stack == "package-registry":
+        return package_registry_stack(config, stack)
+    else:
+        return base_stack(config, stack)
+
+
+class base_stack(ABC):
+
+    def __init__(self, config, stack):
+        self.config = config
+        self.stack = stack
+
+    @abstractmethod
+    def ensure_available(self):
+        pass
+
+    @abstractmethod
+    def get_url(self):
+        pass
+
+
+class package_registry_stack(base_stack):
+
+    def ensure_available(self):
+        self.url = "<no registry url set>"
+        # Check if we were given an external registry URL
+        url_from_environment = os.environ.get("CERC_NPM_REGISTRY_URL")
+        if url_from_environment:
+            if self.config.verbose:
+                print(f"Using package registry url from CERC_NPM_REGISTRY_URL: {url_from_environment}")
+            self.url = url_from_environment
+        else:
+            # Otherwise we expect to use the local package-registry stack
+            # First check if the stack is up
+            registry_running = get_stack_status(self.config, "package-registry")
+            if registry_running:
+                # If it is available, get its mapped port and construct its URL
+                if self.config.debug:
+                    print("Found local package registry stack is up")
+                # TODO: get url from deploy-stack
+                self.url = "http://gitea.local:3000/api/packages/cerc-io/npm/"
+            else:
+                # If not, print a message about how to start it and return fail to the caller
+                print("ERROR: The package-registry stack is not running, and no external registry specified with CERC_NPM_REGISTRY_URL")
+                print("ERROR: Start the local package registry with: laconic-so --stack package-registry deploy-system up")
+                return False
+        return True
+
+    def get_url(self):
+        return self.url

app/build_containers.py

@@ -1,4 +1,4 @@
-# Copyright © 2022 Cerc
+# Copyright © 2022, 2023 Cerc
 
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as published by
@@ -21,12 +21,13 @@
 # TODO: display the available list of containers; allow re-build of either all or specific containers
 
 import os
+import sys
 from decouple import config
 import subprocess
 import click
 import importlib.resources
 from pathlib import Path
-from .util import include_exclude_check
+from .util import include_exclude_check, get_parsed_stack_config
 
 # TODO: find a place for this
 #    epilog="Config provided either in .env or settings.ini or env vars: CERC_REPO_BASE_DIR (defaults to ~/cerc)"
@@ -35,14 +36,19 @@ from .util import include_exclude_check
 @click.command()
 @click.option('--include', help="only build these containers")
 @click.option('--exclude', help="don\'t build these containers")
+@click.option("--force-rebuild", is_flag=True, default=False, help="Override dependency checking -- always rebuild")
+@click.option("--extra-build-args", help="Supply extra arguments to build")
 @click.pass_context
-def command(ctx, include, exclude):
+def command(ctx, include, exclude, force_rebuild, extra_build_args):
     '''build the set of containers required for a complete stack'''
 
     quiet = ctx.obj.quiet
     verbose = ctx.obj.verbose
     dry_run = ctx.obj.dry_run
+    debug = ctx.obj.debug
     local_stack = ctx.obj.local_stack
+    stack = ctx.obj.stack
+    continue_on_error = ctx.obj.continue_on_error
 
     # See: https://stackoverflow.com/questions/25389095/python-get-path-of-root-project-structure
     container_build_dir = Path(__file__).absolute().parent.joinpath("data", "container-build")
@@ -62,17 +68,33 @@ def command(ctx, include, exclude):
     # See: https://stackoverflow.com/a/20885799/1701505
     from . import data
     with importlib.resources.open_text(data, "container-image-list.txt") as container_list_file:
-        containers = container_list_file.read().splitlines()
+        all_containers = container_list_file.read().splitlines()
+
+    containers_in_scope = []
+    if stack:
+        stack_config = get_parsed_stack_config(stack)
+        containers_in_scope = stack_config['containers']
+    else:
+        containers_in_scope = all_containers
 
     if verbose:
-        print(f'Containers: {containers}')
+        print(f'Containers: {containers_in_scope}')
+        if stack:
+            print(f"Stack: {stack}")
 
     # TODO: make this configurable
     container_build_env = {
-        "CERC_NPM_URL": "http://gitea.local:3000/api/packages/cerc-io/npm/",
-        "CERC_NPM_AUTH_TOKEN": config("CERC_NPM_AUTH_TOKEN", default="<token-not-supplied>"),
-        "CERC_REPO_BASE_DIR": dev_root_path
+        "CERC_NPM_REGISTRY_URL": config("CERC_NPM_REGISTRY_URL", default="http://gitea.local:3000/api/packages/cerc-io/npm/"),
+        "CERC_NPM_AUTH_TOKEN": config("CERC_NPM_AUTH_TOKEN", default=""),
+        "CERC_REPO_BASE_DIR": dev_root_path,
+        "CERC_CONTAINER_BASE_DIR": container_build_dir,
+        "CERC_HOST_UID": f"{os.getuid()}",
+        "CERC_HOST_GID": f"{os.getgid()}",
+        "DOCKER_BUILDKIT": "0"
     }
+    container_build_env.update({"CERC_SCRIPT_DEBUG": "true"} if debug else {})
+    container_build_env.update({"CERC_FORCE_REBUILD": "true"} if force_rebuild else {})
+    container_build_env.update({"CERC_CONTAINER_EXTRA_BUILD_ARGS": extra_build_args} if extra_build_args else {})
 
     def process_container(container):
         if not quiet:
@@ -91,17 +113,24 @@ def command(ctx, include, exclude):
             # Check if we have a repo for this container. If not, set the context dir to the container-build subdir
             repo_full_path = os.path.join(dev_root_path, repo_dir)
             repo_dir_or_build_dir = repo_dir if os.path.exists(repo_full_path) else build_dir
-            build_command = os.path.join(container_build_dir, "default-build.sh") + f" {container} {repo_dir_or_build_dir}"
+            build_command = os.path.join(container_build_dir, "default-build.sh") + f" {container}:local {repo_dir_or_build_dir}"
         if not dry_run:
             if verbose:
-                print(f"Executing: {build_command}")
+                print(f"Executing: {build_command} with environment: {container_build_env}")
             build_result = subprocess.run(build_command, shell=True, env=container_build_env)
-            # TODO: check result in build_result.returncode
-            print(f"Result is: {build_result}")
+            if verbose:
+                print(f"Return code is: {build_result.returncode}")
+            if build_result.returncode != 0:
+                print(f"Error running build for {container}")
+                if not continue_on_error:
+                    print("FATAL Error: container build failed and --continue-on-error not set, exiting")
+                    sys.exit(1)
+                else:
+                    print("****** Container Build Error, continuing because --continue-on-error is set")
         else:
             print("Skipped")
 
-    for container in containers:
+    for container in containers_in_scope:
         if include_exclude_check(container, include, exclude):
             process_container(container)
         else:

app/build_npms.py

@@ -1,4 +1,4 @@
-# Copyright © 2022 Cerc
+# Copyright © 2022, 2023 Cerc
 
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as published by
@@ -19,17 +19,24 @@
 # CERC_REPO_BASE_DIR defaults to ~/cerc
 
 import os
+import sys
+from shutil import rmtree, copytree
 from decouple import config
 import click
 import importlib.resources
-from python_on_whales import docker
-from .util import include_exclude_check
+from python_on_whales import docker, DockerException
+from .base import get_stack
+from .util import include_exclude_check, get_parsed_stack_config
+
+builder_js_image_name = "cerc/builder-js:local"
 
 @click.command()
 @click.option('--include', help="only build these packages")
 @click.option('--exclude', help="don\'t build these packages")
+@click.option("--force-rebuild", is_flag=True, default=False, help="Override existing target package version check -- force rebuild")
+@click.option("--extra-build-args", help="Supply extra arguments to build")
 @click.pass_context
-def command(ctx, include, exclude):
+def command(ctx, include, exclude, force_rebuild, extra_build_args):
     '''build the set of npm packages required for a complete stack'''
 
     quiet = ctx.obj.quiet
@@ -37,6 +44,23 @@ def command(ctx, include, exclude):
     dry_run = ctx.obj.dry_run
     local_stack = ctx.obj.local_stack
     debug = ctx.obj.debug
+    stack = ctx.obj.stack
+    continue_on_error = ctx.obj.continue_on_error
+
+    _ensure_prerequisites()
+
+    # build-npms depends on having access to a writable package registry
+    # so we check here that it is available
+    package_registry_stack = get_stack(ctx.obj, "package-registry")
+    registry_available = package_registry_stack.ensure_available()
+    if not registry_available:
+        print("FATAL: no npm registry available for build-npms command")
+        sys.exit(1)
+    npm_registry_url = package_registry_stack.get_url()
+    npm_registry_url_token = config("CERC_NPM_AUTH_TOKEN", default=None)
+    if not npm_registry_url_token:
+        print("FATAL: CERC_NPM_AUTH_TOKEN is not defined")
+        sys.exit(1)
 
     if local_stack:
         dev_root_path = os.getcwd()[0:os.getcwd().rindex("stack-orchestrator")]
@@ -44,49 +68,104 @@ def command(ctx, include, exclude):
     else:
         dev_root_path = os.path.expanduser(config("CERC_REPO_BASE_DIR", default="~/cerc"))
 
-    if not quiet:
+    build_root_path = os.path.join(dev_root_path, "build-trees")
+
+    if verbose:
         print(f'Dev Root is: {dev_root_path}')
 
     if not os.path.isdir(dev_root_path):
         print('Dev root directory doesn\'t exist, creating')
+        os.makedirs(dev_root_path)
+    if not os.path.isdir(dev_root_path):
+        print('Build root directory doesn\'t exist, creating')
+        os.makedirs(build_root_path)
 
     # See: https://stackoverflow.com/a/20885799/1701505
     from . import data
     with importlib.resources.open_text(data, "npm-package-list.txt") as package_list_file:
-        packages = package_list_file.read().splitlines()
+        all_packages = package_list_file.read().splitlines()
+
+    packages_in_scope = []
+    if stack:
+        stack_config = get_parsed_stack_config(stack)
+        # TODO: syntax check the input here
+        packages_in_scope = stack_config['npms']
+    else:
+        packages_in_scope = all_packages
 
     if verbose:
-        print(f'Packages: {packages}')
+        print(f'Packages: {packages_in_scope}')
 
     def build_package(package):
         if not quiet:
             print(f"Building npm package: {package}")
         repo_dir = package
         repo_full_path = os.path.join(dev_root_path, repo_dir)
-        # TODO: make the npm registry url configurable.
-        build_command = ["sh", "-c", "cd /workspace && build-npm-package-local-dependencies.sh http://gitea.local:3000/api/packages/cerc-io/npm/"]
+        # Copy the repo and build that to avoid propagating JS tooling file changes back into the cloned repo
+        repo_copy_path = os.path.join(build_root_path, repo_dir)
+        # First delete any old build tree
+        if os.path.isdir(repo_copy_path):
+            if verbose:
+                print(f"Deleting old build tree: {repo_copy_path}")
+            if not dry_run:
+                rmtree(repo_copy_path)
+        # Now copy the repo into the build tree location
+        if verbose:
+            print(f"Copying build tree from: {repo_full_path} to: {repo_copy_path}")
+        if not dry_run:
+            copytree(repo_full_path, repo_copy_path)
+        build_command = ["sh", "-c", f"cd /workspace && build-npm-package-local-dependencies.sh {npm_registry_url}"]
         if not dry_run:
             if verbose:
                 print(f"Executing: {build_command}")
-            envs = {"CERC_NPM_AUTH_TOKEN": os.environ["CERC_NPM_AUTH_TOKEN"]} | ({"CERC_SCRIPT_DEBUG": "true"} if debug else {})
-            build_result = docker.run("cerc/builder-js",
-                                      remove=True,
-                                      interactive=True,
-                                      tty=True,
-                                      user=f"{os.getuid()}:{os.getgid()}",
-                                      envs=envs,
-                                      add_hosts=[("gitea.local", "host-gateway")],
-                                      volumes=[(repo_full_path, "/workspace")],
-                                      command=build_command
-                                      )
-            # TODO: check result in build_result.returncode
-            print(f"Result is: {build_result}")
+            # Originally we used the PEP 584 merge operator:
+            # envs = {"CERC_NPM_AUTH_TOKEN": npm_registry_url_token} | ({"CERC_SCRIPT_DEBUG": "true"} if debug else {})
+            # but that isn't available in Python 3.8 (default in Ubuntu 20) so for now we use dict.update:
+            envs = {"CERC_NPM_AUTH_TOKEN": npm_registry_url_token,
+                    "LACONIC_HOSTED_CONFIG_FILE": "config-hosted.yml" # Convention used by our web app packages
+                    }
+            envs.update({"CERC_SCRIPT_DEBUG": "true"} if debug else {})
+            envs.update({"CERC_FORCE_REBUILD": "true"} if force_rebuild else {})
+            envs.update({"CERC_CONTAINER_EXTRA_BUILD_ARGS": extra_build_args} if extra_build_args else {})
+            try:
+                docker.run(builder_js_image_name,
+                           remove=True,
+                           interactive=True,
+                           tty=True,
+                           user=f"{os.getuid()}:{os.getgid()}",
+                           envs=envs,
+                           # TODO: detect this host name in npm_registry_url rather than hard-wiring it
+                           add_hosts=[("gitea.local", "host-gateway")],
+                           volumes=[(repo_copy_path, "/workspace")],
+                           command=build_command
+                           )
+                # Note that although the docs say that build_result should contain
+                # the command output as a string, in reality it is always the empty string.
+                # Since we detect errors via catching exceptions below, we can safely ignore it here.
+            except DockerException as e:
+                print(f"Error executing build for {package} in container:\n {e}")
+                if not continue_on_error:
+                    print("FATAL Error: build failed and --continue-on-error not set, exiting")
+                    sys.exit(1)
+                else:
+                    print("****** Build Error, continuing because --continue-on-error is set")
+
         else:
             print("Skipped")
 
-    for package in packages:
+    for package in packages_in_scope:
         if include_exclude_check(package, include, exclude):
             build_package(package)
         else:
             if verbose:
                 print(f"Excluding: {package}")
+
+
+def _ensure_prerequisites():
+    # Check that the builder-js container is available and
+    # Tell the user how to build it if not
+    images = docker.image.list(builder_js_image_name)
+    if len(images) == 0:
+        print(f"FATAL: builder image: {builder_js_image_name} is required but was not found")
+        print("Please run this command to create it: laconic-so --stack build-support build-containers")
+        sys.exit(1)

app/data/compose/docker-compose-fixturenet-eth-metrics.yml

@@ -0,0 +1,23 @@
+version: "3.2"
+services:
+  prometheus:
+    restart: always
+    image: prom/prometheus
+    depends_on:
+      fixturenet-eth-geth-1:
+        condition: service_healthy
+    volumes:
+      - ../config/fixturenet-eth-metrics/prometheus/etc:/etc/prometheus
+    ports:
+      - "9090"
+  grafana:
+    restart: always
+    image: grafana/grafana
+    environment:
+      - GF_SECURITY_ADMIN_PASSWORD=changeme6325
+    volumes:
+      - ../config/fixturenet-eth-metrics/grafana/etc/provisioning/dashboards:/etc/grafana/provisioning/dashboards
+      - ../config/fixturenet-eth-metrics/grafana/etc/provisioning/datasources:/etc/grafana/provisioning/datasources
+      - ../config/fixturenet-eth-metrics/grafana/etc/dashboards:/etc/grafana/dashboards
+    ports:
+      - "3000"

app/data/compose/docker-compose-fixturenet-eth.yml

@@ -8,6 +8,8 @@ services:
     environment:
       RUN_BOOTNODE: "true"
     image: cerc/fixturenet-eth-geth:local
+    volumes:
+      - fixturenet_eth_bootnode_geth_data:/root/ethdata
     ports:
       - "9898"
       - "30303"
@@ -20,9 +22,13 @@ services:
       CERC_REMOTE_DEBUG: "true"
       CERC_RUN_STATEDIFF: "detect"
       CERC_STATEDIFF_DB_NODE_ID: 1
+      CERC_SCRIPT_DEBUG: ${CERC_SCRIPT_DEBUG}
     env_file:
       - ../config/fixturenet-eth/fixturenet-eth.env
     image: cerc/fixturenet-eth-geth:local
+    volumes:
+      - fixturenet_geth_accounts:/opt/testnet/build/el
+      - fixturenet_eth_geth_1_data:/root/ethdata
     healthcheck:
       test: ["CMD", "nc", "-v", "localhost", "8545"]
       interval: 30s
@@ -49,12 +55,16 @@ services:
     image: cerc/fixturenet-eth-geth:local
     depends_on:
       - fixturenet-eth-bootnode-geth
+    volumes:
+      - fixturenet_eth_geth_2_data:/root/ethdata
 
   fixturenet-eth-bootnode-lighthouse:
     hostname: fixturenet-eth-bootnode-lighthouse
     environment:
       RUN_BOOTNODE: "true"
     image: cerc/fixturenet-eth-lighthouse:local
+    volumes:
+      - fixturenet_eth_bootnode_lighthouse_data:/opt/testnet/build/cl
 
   fixturenet-eth-lighthouse-1:
     hostname: fixturenet-eth-lighthouse-1
@@ -71,6 +81,8 @@ services:
       ETH1_ENDPOINT: "http://fixturenet-eth-geth-1:8545"
       EXECUTION_ENDPOINT: "http://fixturenet-eth-geth-1:8551"
     image: cerc/fixturenet-eth-lighthouse:local
+    volumes:
+      - fixturenet_eth_lighthouse_1_data:/opt/testnet/build/cl
     depends_on:
       fixturenet-eth-bootnode-lighthouse:
         condition: service_started
@@ -78,7 +90,7 @@ services:
         condition: service_healthy
     ports:
       - "8001"
-  
+
   fixturenet-eth-lighthouse-2:
     hostname: fixturenet-eth-lighthouse-2
     healthcheck:
@@ -95,8 +107,19 @@ services:
       EXECUTION_ENDPOINT: "http://fixturenet-eth-geth-2:8551"
       LIGHTHOUSE_GENESIS_STATE_URL: "http://fixturenet-eth-lighthouse-1:8001/eth/v2/debug/beacon/states/0"
     image: cerc/fixturenet-eth-lighthouse:local
+    volumes:
+      - fixturenet_eth_lighthouse_2_data:/opt/testnet/build/cl
     depends_on:
       fixturenet-eth-bootnode-lighthouse:
         condition: service_started
       fixturenet-eth-geth-2:
         condition: service_healthy
+
+volumes:
+  fixturenet_geth_accounts:
+  fixturenet_eth_bootnode_geth_data:
+  fixturenet_eth_geth_1_data:
+  fixturenet_eth_geth_2_data:
+  fixturenet_eth_bootnode_lighthouse_data:
+  fixturenet_eth_lighthouse_1_data:
+  fixturenet_eth_lighthouse_2_data:

app/data/compose/docker-compose-fixturenet-laconic-console.yml

@@ -0,0 +1,8 @@
+services:
+  laconic-console:
+    restart: unless-stopped
+    image: cerc/laconic-console-host:local
+    environment:
+      - LACONIC_HOSTED_ENDPOINT=${LACONIC_HOSTED_ENDPOINT:-http://localhost}
+    ports:
+      - "80"

app/data/compose/docker-compose-fixturenet-laconicd.yml

@@ -5,17 +5,22 @@ services:
     image: cerc/laconicd:local
     command: ["sh", "/docker-entrypoint-scripts.d/create-fixturenet.sh"]
     volumes:
-      # TODO: look at folding this script into the container
+      # TODO: look at folding these scripts into the container
       - ../config/fixturenet-laconicd/create-fixturenet.sh:/docker-entrypoint-scripts.d/create-fixturenet.sh
+      - ../config/fixturenet-laconicd/export-mykey.sh:/docker-entrypoint-scripts.d/export-mykey.sh
+      - ../config/fixturenet-laconicd/export-myaddress.sh:/docker-entrypoint-scripts.d/export-myaddress.sh
     # TODO: determine which of the ports below is really needed
     ports:
       - "6060"
       - "26657"
       - "26656"
-      - "9473"
+      - "9473:9473"
       - "8545"
       - "8546"
       - "9090"
       - "9091"
       - "1317"
-
+  cli:
+    image: cerc/laconic-registry-cli:local
+    volumes:
+      - ../config/fixturenet-laconicd/registry-cli-config-template.yml:/registry-cli-config-template.yml

app/data/compose/docker-compose-fixturenet-optimism.yml

@@ -0,0 +1,133 @@
+version: '3.7'
+
+services:
+  # Generates and funds the accounts required when setting up the L2 chain (outputs to volume l2_accounts)
+  # Creates / updates the configuration for L1 contracts deployment
+  # Deploys the L1 smart contracts (outputs to volume l1_deployment)
+  fixturenet-optimism-contracts:
+    hostname: fixturenet-optimism-contracts
+    image: cerc/optimism-contracts:local
+    env_file:
+      - ../config/fixturenet-optimism/l1-params.env
+    environment:
+      CERC_SCRIPT_DEBUG: ${CERC_SCRIPT_DEBUG}
+      CERC_L1_CHAIN_ID: ${CERC_L1_CHAIN_ID}
+      CERC_L1_RPC: ${CERC_L1_RPC}
+      CERC_L1_ADDRESS: ${CERC_L1_ADDRESS}
+      CERC_L1_PRIV_KEY: ${CERC_L1_PRIV_KEY}
+      CERC_L1_ADDRESS_2: ${CERC_L1_ADDRESS_2}
+      CERC_L1_PRIV_KEY_2: ${CERC_L1_PRIV_KEY_2}
+    # Waits for L1 endpoint to be up before running the script
+    command: |
+      "./wait-for-it.sh -h ${CERC_L1_HOST:-$${DEFAULT_CERC_L1_HOST}} -p ${CERC_L1_PORT:-$${DEFAULT_CERC_L1_PORT}} -s -t 60 -- ./run.sh"
+    volumes:
+      - ../config/wait-for-it.sh:/app/packages/contracts-bedrock/wait-for-it.sh
+      - ../container-build/cerc-optimism-contracts/hardhat-tasks/verify-contract-deployment.ts:/app/packages/contracts-bedrock/tasks/verify-contract-deployment.ts
+      - ../container-build/cerc-optimism-contracts/hardhat-tasks/rekey-json.ts:/app/packages/contracts-bedrock/tasks/rekey-json.ts
+      - ../container-build/cerc-optimism-contracts/hardhat-tasks/send-balance.ts:/app/packages/contracts-bedrock/tasks/send-balance.ts
+      - ../config/fixturenet-optimism/optimism-contracts/update-config.js:/app/packages/contracts-bedrock/update-config.js
+      - ../config/fixturenet-optimism/optimism-contracts/run.sh:/app/packages/contracts-bedrock/run.sh
+      - fixturenet_geth_accounts:/geth-accounts:ro
+      - l2_accounts:/l2-accounts
+      - l1_deployment:/app/packages/contracts-bedrock
+    extra_hosts:
+    - "host.docker.internal:host-gateway"
+
+  # Generates the config files required for L2 (outputs to volume l2_config)
+  op-node-l2-config-gen:
+    image: cerc/optimism-op-node:local
+    depends_on:
+      fixturenet-optimism-contracts:
+        condition: service_completed_successfully
+    env_file:
+      - ../config/fixturenet-optimism/l1-params.env
+    environment:
+      CERC_SCRIPT_DEBUG: ${CERC_SCRIPT_DEBUG}
+      CERC_L1_RPC: ${CERC_L1_RPC}
+    volumes:
+      - ../config/fixturenet-optimism/generate-l2-config.sh:/app/generate-l2-config.sh
+      - l1_deployment:/contracts-bedrock:ro
+      - l2_config:/app
+    command: ["sh", "/app/generate-l2-config.sh"]
+    extra_hosts:
+    - "host.docker.internal:host-gateway"
+
+  # Initializes and runs the L2 execution client  (outputs to volume l2_geth_data)
+  op-geth:
+    image: cerc/optimism-l2geth:local
+    depends_on:
+      op-node-l2-config-gen:
+        condition: service_started
+    volumes:
+      - ../config/fixturenet-optimism/run-op-geth.sh:/run-op-geth.sh
+      - l2_config:/op-node:ro
+      - l2_accounts:/l2-accounts:ro
+      - l2_geth_data:/datadir
+    entrypoint: "sh"
+    command: "/run-op-geth.sh"
+    ports:
+      - "0.0.0.0:8545:8545"
+    healthcheck:
+      test: ["CMD", "nc", "-vz", "localhost:8545"]
+      interval: 30s
+      timeout: 10s
+      retries: 10
+      start_period: 10s
+
+  # Runs the L2 consensus client (Sequencer node)
+  op-node:
+    image: cerc/optimism-op-node:local
+    depends_on:
+      op-geth:
+        condition: service_healthy
+    env_file:
+      - ../config/fixturenet-optimism/l1-params.env
+    environment:
+      CERC_SCRIPT_DEBUG: ${CERC_SCRIPT_DEBUG}
+      CERC_L1_RPC: ${CERC_L1_RPC}
+    volumes:
+      - ../config/fixturenet-optimism/run-op-node.sh:/app/run-op-node.sh
+      - l2_config:/op-node-data:ro
+      - l2_accounts:/l2-accounts:ro
+    command: ["sh", "/app/run-op-node.sh"]
+    ports:
+      - "0.0.0.0:8547:8547"
+    healthcheck:
+      test: ["CMD", "nc", "-vz", "localhost:8547"]
+      interval: 30s
+      timeout: 10s
+      retries: 10
+      start_period: 10s
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+
+  # Runs the batcher (takes transactions from the Sequencer and publishes them to L1)
+  op-batcher:
+    image: cerc/optimism-op-batcher:local
+    depends_on:
+      op-node:
+        condition: service_healthy
+      op-geth:
+        condition: service_healthy
+    env_file:
+      - ../config/fixturenet-optimism/l1-params.env
+    environment:
+      CERC_SCRIPT_DEBUG: ${CERC_SCRIPT_DEBUG}
+      CERC_L1_RPC: ${CERC_L1_RPC}
+    volumes:
+      - ../config/wait-for-it.sh:/wait-for-it.sh
+      - ../config/fixturenet-optimism/run-op-batcher.sh:/run-op-batcher.sh
+      - l2_accounts:/l2-accounts:ro
+    entrypoint: ["sh", "-c"]
+    # Waits for L1 endpoint to be up before running the batcher
+    command: |
+      "/wait-for-it.sh -h ${CERC_L1_HOST:-$${DEFAULT_CERC_L1_HOST}} -p ${CERC_L1_PORT:-$${DEFAULT_CERC_L1_PORT}} -s -t 60 -- /run-op-batcher.sh"
+    extra_hosts:
+    - "host.docker.internal:host-gateway"
+
+volumes:
+  fixturenet_geth_accounts:
+  l1_deployment:
+  l2_accounts:
+  l2_config:
+  l2_geth_data:

app/data/compose/docker-compose-foundry.yml

@@ -0,0 +1,8 @@
+# Add-on pod to include foundry tooling within a fixturenet
+services:
+  foundry:
+    image: cerc/foundry:local
+    command: ["while :; do sleep 600; done"]
+    volumes:
+      - ../config/foundry/foundry.toml:/foundry.toml
+      - ./foundry/workspace:/workspace

app/data/compose/docker-compose-go-ethereum-foundry.yml

@@ -8,7 +8,7 @@ services:
         condition: service_healthy
     image: cerc/go-ethereum-foundry:local
     healthcheck:
-      test: ["CMD", "nc", "-v", "localhost", "8545"]
+      test: ["CMD", "nc", "-vz", "localhost", "8545"]
       interval: 30s
       timeout: 3s
       retries: 10

app/data/compose/docker-compose-ipld-eth-server.yml

@@ -20,16 +20,24 @@ services:
       DATABASE_USER: "vdbm"
       DATABASE_PASSWORD: "password"
       ETH_CHAIN_ID: 99
-      ETH_FORWARD_ETH_CALLS: $eth_forward_eth_calls
-      ETH_PROXY_ON_ERROR: $eth_proxy_on_error
-      ETH_HTTP_PATH: $eth_http_path
+      ETH_FORWARD_ETH_CALLS: "false"
+      ETH_FORWARD_GET_STORAGE_AT: "false"
+      ETH_PROXY_ON_ERROR: "false"
+      METRICS: "true"
+      PROM_HTTP: "true"
+      PROM_HTTP_ADDR: "0.0.0.0"
+      PROM_HTTP_PORT: "8090"
+      LOGRUS_LEVEL: "debug"
+      CERC_REMOTE_DEBUG: "true"
     volumes:
       - type: bind
         source: ../config/ipld-eth-server/chain.json
         target: /tmp/chain.json
     ports:
-      - "127.0.0.1:8081:8081"
-      - "127.0.0.1:8082:8082"
+      - "8081"
+      - "8082"
+      - "8090"
+      - "40000"
     healthcheck:
       test: ["CMD", "nc", "-v", "localhost", "8081"]
       interval: 20s

app/data/compose/docker-compose-keycloak.yml

@@ -29,9 +29,17 @@ services:
         condition: service_healthy
   keycloak-nginx:
     image: nginx:1.23-alpine
+    restart: always
     volumes:
       - ../config/keycloak/nginx:/etc/nginx/conf.d
     ports:
       - 80
     depends_on:
       - keycloak
+  keycloak-nginx-prometheus-exporter:
+    image: nginx/nginx-prometheus-exporter
+    restart: always
+    environment:
+      - SCRAPE_URI=http://keycloak-nginx:80/stub_status
+    depends_on:
+      - keycloak-nginx

app/data/compose/docker-compose-kubo.yml

@@ -0,0 +1,13 @@
+version: "3.2"
+# See: https://docs.ipfs.tech/install/run-ipfs-inside-docker/#set-up
+services:
+  ipfs:
+    image: ipfs/kubo:master-2023-02-20-714a968
+    restart: always
+    volumes:
+      - ./ipfs/import:/import
+      - ./ipfs/data:/data/ipfs
+    ports:
+      - "8080"
+      - "4001"
+      - "5001"

app/data/compose/docker-compose-mobymask-app.yml

@@ -0,0 +1,42 @@
+version: '3.2'
+
+services:
+  # Builds and serves the MobyMask react-app
+  mobymask-app:
+    restart: unless-stopped
+    image: cerc/mobymask-ui:local
+    env_file:
+      - ../config/watcher-mobymask-v2/mobymask-params.env
+    environment:
+      CERC_SCRIPT_DEBUG: ${CERC_SCRIPT_DEBUG}
+      CERC_CHAIN_ID: ${CERC_CHAIN_ID}
+      CERC_DEPLOYED_CONTRACT: ${CERC_DEPLOYED_CONTRACT}
+      CERC_APP_WATCHER_URL: ${CERC_APP_WATCHER_URL}
+      CERC_RELAY_NODES: ${CERC_RELAY_NODES}
+    working_dir: /scripts
+    # Waits for watcher server to be up before app build
+    # Required when running with watcher stack to get deployed contract address
+    command:
+      - sh
+      - -c
+      - ./wait-for-it.sh -h ${CERC_WATCHER_HOST:-$${DEFAULT_CERC_WATCHER_HOST}} -p ${CERC_WATCHER_PORT:-$${DEFAULT_CERC_WATCHER_PORT}} -s -t 0 -- ./mobymask-app-start.sh
+    volumes:
+      - ../config/wait-for-it.sh:/scripts/wait-for-it.sh
+      - ../config/watcher-mobymask-v2/mobymask-app-start.sh:/scripts/mobymask-app-start.sh
+      - peers_ids:/peers
+      - mobymask_deployment:/server
+    ports:
+      - "0.0.0.0:3002:80"
+    healthcheck:
+      test: ["CMD", "nc", "-v", "localhost", "80"]
+      interval: 20s
+      timeout: 5s
+      retries: 15
+      start_period: 10s
+    shm_size: '1GB'
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+
+volumes:
+  mobymask_deployment:
+  peers_ids:

app/data/compose/docker-compose-peer-test-app.yml

@@ -0,0 +1,33 @@
+version: '3.2'
+
+services:
+  peer-test-app:
+    # Builds and serves the peer-test react-app
+    image: cerc/react-peer:local
+    working_dir: /scripts
+    env_file:
+      - ../config/watcher-mobymask-v2/mobymask-params.env
+    environment:
+      CERC_SCRIPT_DEBUG: ${CERC_SCRIPT_DEBUG}
+      CERC_RELAY_NODES: ${CERC_RELAY_NODES}
+    command:
+      - sh
+      - -c
+      - ./wait-for-it.sh -h ${CERC_WATCHER_HOST:-$${DEFAULT_CERC_WATCHER_HOST}} -p ${CERC_WATCHER_PORT:-$${DEFAULT_CERC_WATCHER_PORT}} -s -t 0 -- ./test-app-start.sh
+    volumes:
+      - ../config/wait-for-it.sh:/scripts/wait-for-it.sh
+      - ../config/watcher-mobymask-v2/test-app-start.sh:/scripts/test-app-start.sh
+      - peers_ids:/peers
+    ports:
+      - "0.0.0.0:3003:80"
+    healthcheck:
+      test: ["CMD", "nc", "-v", "localhost", "80"]
+      interval: 20s
+      timeout: 5s
+      retries: 15
+      start_period: 10s
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+
+volumes:
+  peers_ids:

app/data/compose/docker-compose-prometheus-grafana.yml

@@ -1,21 +0,0 @@
-version: "3.2"
-services:
-  # If you want prometheus to work, you must update the following file in the ops repo locally.
-  # localhost:6060 --> go-ethereum:6060
-  prometheus:
-    restart: always
-    user: "987"
-    image: prom/prometheus
-    volumes:
-      - ${cerc_ops}/metrics/etc:/etc/prometheus
-      - ./prometheus-data:/prometheus
-    ports:
-      - "127.0.0.1:9090:9090"
-  grafana:
-    restart: always
-    user: "472"
-    image: grafana/grafana
-    volumes:
-      - ./grafana-data:/var/lib/grafana
-    ports:
-      - "127.0.0.1:3000:3000"

app/data/compose/docker-compose-test.yml

@@ -3,3 +3,5 @@ services:
   test:
     image: cerc/test-container:local
     restart: always
+    ports:
+      - "80"

app/data/compose/docker-compose-watcher-erc20.yml

@@ -39,7 +39,7 @@ services:
       - "0.0.0.0:3002:3001"
       - "0.0.0.0:9002:9001"
     healthcheck:
-      test: ["CMD", "nc", "-v", "localhost", "3002"]
+      test: ["CMD", "nc", "-vz", "localhost", "3001"]
       interval: 20s
       timeout: 5s
       retries: 15

app/data/compose/docker-compose-watcher-mobymask-v2.yml

@@ -0,0 +1,138 @@
+version: '3.2'
+
+services:
+  # Starts the PostgreSQL database for watcher
+  mobymask-watcher-db:
+    restart: unless-stopped
+    image: postgres:14-alpine
+    environment:
+      - POSTGRES_USER=vdbm
+      - POSTGRES_MULTIPLE_DATABASES=mobymask-watcher,mobymask-watcher-job-queue
+      - POSTGRES_EXTENSION=mobymask-watcher-job-queue:pgcrypto
+      - POSTGRES_PASSWORD=password
+    volumes:
+      - ../config/postgresql/multiple-postgressql-databases.sh:/docker-entrypoint-initdb.d/multiple-postgressql-databases.sh
+      - mobymask_watcher_db_data:/var/lib/postgresql/data
+    ports:
+      - "0.0.0.0:15432:5432"
+    healthcheck:
+      test: ["CMD", "nc", "-v", "localhost", "5432"]
+      interval: 20s
+      timeout: 5s
+      retries: 15
+      start_period: 10s
+
+  # Deploys the MobyMask contract and generates an invite link
+  # Deployment is skipped if CERC_DEPLOYED_CONTRACT env is set
+  mobymask:
+    image: cerc/mobymask:local
+    working_dir: /app/packages/server
+    env_file:
+      - ../config/watcher-mobymask-v2/optimism-params.env
+      - ../config/watcher-mobymask-v2/mobymask-params.env
+    environment:
+      CERC_SCRIPT_DEBUG: ${CERC_SCRIPT_DEBUG}
+      ENV: "PROD"
+      CERC_L2_GETH_RPC: ${CERC_L2_GETH_RPC}
+      CERC_PRIVATE_KEY_DEPLOYER: ${CERC_PRIVATE_KEY_DEPLOYER}
+      CERC_MOBYMASK_APP_BASE_URI: ${CERC_MOBYMASK_APP_BASE_URI}
+      CERC_DEPLOYED_CONTRACT: ${CERC_DEPLOYED_CONTRACT}
+    # Waits for L2 Optimism Geth and Node servers to be up before deploying contract
+    command:
+      - sh
+      - -c
+      - |
+        ./wait-for-it.sh -h ${CERC_L2_GETH_HOST:-$${DEFAULT_CERC_L2_GETH_HOST}} -p ${CERC_L2_GETH_PORT:-$${DEFAULT_CERC_L2_GETH_PORT}} -s -t 0 && \
+        ./wait-for-it.sh -h ${CERC_L2_NODE_HOST:-$${DEFAULT_CERC_L2_NODE_HOST}} -p ${CERC_L2_NODE_PORT:-$${DEFAULT_CERC_L2_NODE_PORT}} -s -t 0 && \
+        ./deploy-and-generate-invite.sh
+    volumes:
+      - ../config/wait-for-it.sh:/app/packages/server/wait-for-it.sh
+      - ../config/watcher-mobymask-v2/secrets-template.json:/app/packages/server/secrets-template.json
+      - ../config/watcher-mobymask-v2/deploy-and-generate-invite.sh:/app/packages/server/deploy-and-generate-invite.sh
+      - mobymask_deployment:/app/packages/server
+      - fixturenet_geth_accounts:/geth-accounts:ro
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+
+  # Creates peer-id files if they don't exist
+  peer-ids-gen:
+    image: cerc/watcher-ts:local
+    restart: on-failure
+    environment:
+      CERC_SCRIPT_DEBUG: ${CERC_SCRIPT_DEBUG}
+    working_dir: /app/packages/peer
+    command: ["sh", "generate-peer-ids.sh"]
+    volumes:
+      - ../config/watcher-mobymask-v2/generate-peer-ids.sh:/app/packages/peer/generate-peer-ids.sh
+      - peers_ids:/peer-ids
+
+  # Starts the mobymask-v2-watcher server
+  mobymask-watcher-server:
+    image: cerc/watcher-mobymask-v2:local
+    restart: unless-stopped
+    depends_on:
+      mobymask-watcher-db:
+        condition: service_healthy
+      peer-ids-gen:
+        condition: service_completed_successfully
+      mobymask:
+        condition: service_completed_successfully
+    env_file:
+      - ../config/watcher-mobymask-v2/optimism-params.env
+      - ../config/watcher-mobymask-v2/mobymask-params.env
+    environment:
+      CERC_SCRIPT_DEBUG: ${CERC_SCRIPT_DEBUG}
+      CERC_L2_GETH_RPC: ${CERC_L2_GETH_RPC}
+      CERC_PRIVATE_KEY_PEER: ${CERC_PRIVATE_KEY_PEER}
+      CERC_RELAY_PEERS: ${CERC_RELAY_PEERS}
+      CERC_RELAY_ANNOUNCE_DOMAIN: ${CERC_RELAY_ANNOUNCE_DOMAIN}
+      CERC_ENABLE_PEER_L2_TXS: ${CERC_ENABLE_PEER_L2_TXS}
+      CERC_DEPLOYED_CONTRACT: ${CERC_DEPLOYED_CONTRACT}
+    command: ["sh", "start-server.sh"]
+    volumes:
+      - ../config/watcher-mobymask-v2/watcher-config-template.toml:/app/environments/watcher-config-template.toml
+      - ../config/watcher-mobymask-v2/start-server.sh:/app/start-server.sh
+      - peers_ids:/app/peers
+      - mobymask_deployment:/server
+      - fixturenet_geth_accounts:/geth-accounts:ro
+    # Expose GQL, metrics and relay node ports
+    ports:
+      - "0.0.0.0:3001:3001"
+      - "0.0.0.0:9001:9001"
+      - "0.0.0.0:9090:9090"
+    healthcheck:
+      test: ["CMD", "busybox", "nc", "localhost", "9090"]
+      interval: 20s
+      timeout: 5s
+      retries: 15
+      start_period: 5s
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+
+  # Container to run peer tests
+  peer-tests:
+    image: cerc/watcher-ts:local
+    restart: on-failure
+    depends_on:
+      mobymask-watcher-server:
+        condition: service_healthy
+      peer-ids-gen:
+        condition: service_completed_successfully
+    environment:
+      CERC_SCRIPT_DEBUG: ${CERC_SCRIPT_DEBUG}
+    working_dir: /app/packages/peer
+    command:
+      - sh
+      - -c
+      - |
+        ./set-tests-env.sh && \
+        tail -f /dev/null
+    volumes:
+      - ../config/watcher-mobymask-v2/set-tests-env.sh:/app/packages/peer/set-tests-env.sh
+      - peers_ids:/peer-ids
+
+volumes:
+  mobymask_watcher_db_data:
+  peers_ids:
+  mobymask_deployment:
+  fixturenet_geth_accounts:

app/data/config/fixturenet-eth-metrics/grafana/etc/provisioning/dashboards/dashboards.yml

@@ -0,0 +1,9 @@
+apiVersion: 1
+
+providers:
+  - name: dashboards
+    type: file
+    updateIntervalSeconds: 10
+    options:
+      path: /etc/grafana/dashboards
+      foldersFromFilesStructure: true

app/data/config/fixturenet-eth-metrics/grafana/etc/provisioning/datasources/prometheus.yml

@@ -0,0 +1,19 @@
+apiVersion: 1
+
+datasources:
+  - id: 1
+    uid: jZUuGao4k
+    orgId: 1
+    name: Prometheus
+    type: prometheus
+    typeName: Prometheus
+    typeLogoUrl: public/app/plugins/datasource/prometheus/img/prometheus_logo.svg
+    access: proxy
+    url: http://prometheus:9090
+    user: ""
+    database: ""
+    basicAuth: false
+    isDefault: true
+    jsonData:
+      httpMethod: POST
+    readOnly: false

app/data/config/fixturenet-eth-metrics/prometheus/etc/prometheus.yml

@@ -0,0 +1,34 @@
+global:
+  scrape_interval: 5s
+  evaluation_interval: 15s
+
+scrape_configs:
+  # ipld-eth-server
+  - job_name: 'ipld-eth-server'
+    metrics_path: /metrics
+    scrape_interval: 5s
+    static_configs:
+    - targets: ['ipld-eth-server:8090']
+
+  # geth
+  - job_name: 'geth'
+    metrics_path: /debug/metrics/prometheus
+    scheme: http
+    static_configs:
+    - targets: ['fixturenet-eth-geth-1:6060']
+
+  # nginx
+  - job_name: 'nginx'
+    scrape_interval: 5s
+    metrics_path: /metrics
+    scheme: http
+    static_configs:
+      - targets: ['keycloak-nginx-prometheus-exporter:9113']
+
+  # keycloak
+  - job_name: 'keycloak'
+    scrape_interval: 5s
+    metrics_path: /auth/realms/cerc/metrics
+    scheme: http
+    static_configs:
+      - targets: ['keycloak:8080']

app/data/config/fixturenet-eth/fixturenet-eth.env

@@ -19,3 +19,5 @@ CERC_STATEDIFF_DB_USER="vdbm"
 CERC_STATEDIFF_DB_PASSWORD="password"
 CERC_STATEDIFF_DB_GOOSE_MIN_VER=23
 CERC_STATEDIFF_DB_LOG_STATEMENTS="false"
+
+CERC_GETH_VMODULE="statediff/*=5,rpc/*=5"

app/data/config/fixturenet-laconicd/create-fixturenet.sh

@@ -1,8 +1,8 @@
-#!/bin/sh
-
-# Originally from: https://github.com/cerc-io/laconicd/blob/main/init.sh
-# TODO: fold this back into the laconicd repo
+#!/bin/bash
 
+# TODO: this file is now an unmodified copy of cerc-io/laconicd/init.sh
+# so we should have a mechanism to bundle it inside the container rather than link from here
+# at deploy time.
 
 KEY="mykey"
 CHAINID="laconic_9000-1"
@@ -10,7 +10,7 @@ MONIKER="localtestnet"
 KEYRING="test"
 KEYALGO="eth_secp256k1"
 LOGLEVEL="info"
-# to trace evm
+# trace evm
 TRACE="--trace"
 # TRACE=""
 
@@ -28,7 +28,7 @@ laconicd config chain-id $CHAINID
 # if $KEY exists it should be deleted
 laconicd keys add $KEY --keyring-backend $KEYRING --algo $KEYALGO
 
-# Set moniker and chain-id for laconic (Moniker can be anything, chain-id must be an integer)
+# Set moniker and chain-id for Ethermint (Moniker can be anything, chain-id must be an integer)
 laconicd init $MONIKER --chain-id $CHAINID
 
 # Change parameter token denominations to aphoton
@@ -37,28 +37,28 @@ cat $HOME/.laconicd/config/genesis.json | jq '.app_state["crisis"]["constant_fee
 cat $HOME/.laconicd/config/genesis.json | jq '.app_state["gov"]["deposit_params"]["min_deposit"][0]["denom"]="aphoton"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
 cat $HOME/.laconicd/config/genesis.json | jq '.app_state["mint"]["params"]["mint_denom"]="aphoton"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
 # Custom modules
-cat $HOME/.laconicd/config/genesis.json | jq '.app_state["nameservice"]["params"]["record_rent"]["denom"]="aphoton"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
-cat $HOME/.laconicd/config/genesis.json | jq '.app_state["nameservice"]["params"]["authority_rent"]["denom"]="aphoton"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
-cat $HOME/.laconicd/config/genesis.json | jq '.app_state["nameservice"]["params"]["authority_auction_commit_fee"]["denom"]="aphoton"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
-cat $HOME/.laconicd/config/genesis.json | jq '.app_state["nameservice"]["params"]["authority_auction_reveal_fee"]["denom"]="aphoton"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
-cat $HOME/.laconicd/config/genesis.json | jq '.app_state["nameservice"]["params"]["authority_auction_minimum_bid"]["denom"]="aphoton"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
+cat $HOME/.laconicd/config/genesis.json | jq '.app_state["registry"]["params"]["record_rent"]["denom"]="aphoton"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
+cat $HOME/.laconicd/config/genesis.json | jq '.app_state["registry"]["params"]["authority_rent"]["denom"]="aphoton"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
+cat $HOME/.laconicd/config/genesis.json | jq '.app_state["registry"]["params"]["authority_auction_commit_fee"]["denom"]="aphoton"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
+cat $HOME/.laconicd/config/genesis.json | jq '.app_state["registry"]["params"]["authority_auction_reveal_fee"]["denom"]="aphoton"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
+cat $HOME/.laconicd/config/genesis.json | jq '.app_state["registry"]["params"]["authority_auction_minimum_bid"]["denom"]="aphoton"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
 
-if [[ "$TEST_NAMESERVICE_EXPIRY" == "true" ]]; then
+if [[ "$TEST_REGISTRY_EXPIRY" == "true" ]]; then
   echo "Setting timers for expiry tests."
 
-  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["nameservice"]["params"]["record_rent_duration"]="60s"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
-  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["nameservice"]["params"]["authority_grace_period"]="60s"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
-  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["nameservice"]["params"]["authority_rent_duration"]="60s"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
+  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["registry"]["params"]["record_rent_duration"]="60s"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
+  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["registry"]["params"]["authority_grace_period"]="60s"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
+  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["registry"]["params"]["authority_rent_duration"]="60s"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
 fi
 
 if [[ "$TEST_AUCTION_ENABLED" == "true" ]]; then
   echo "Enabling auction and setting timers."
 
-  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["nameservice"]["params"]["authority_auction_enabled"]=true' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
-  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["nameservice"]["params"]["authority_rent_duration"]="60s"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
-  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["nameservice"]["params"]["authority_grace_period"]="300s"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
-  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["nameservice"]["params"]["authority_auction_commits_duration"]="60s"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
-  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["nameservice"]["params"]["authority_auction_reveals_duration"]="60s"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
+  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["registry"]["params"]["authority_auction_enabled"]=true' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
+  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["registry"]["params"]["authority_rent_duration"]="60s"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
+  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["registry"]["params"]["authority_grace_period"]="300s"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
+  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["registry"]["params"]["authority_auction_commits_duration"]="60s"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
+  cat $HOME/.laconicd/config/genesis.json | jq '.app_state["registry"]["params"]["authority_auction_reveals_duration"]="60s"' > $HOME/.laconicd/config/tmp_genesis.json && mv $HOME/.laconicd/config/tmp_genesis.json $HOME/.laconicd/config/genesis.json
 fi
 
 # increase block time (?)

app/data/config/fixturenet-laconicd/export-myaddress.sh

@@ -0,0 +1,2 @@
+#!/bin/sh
+laconicd keys show mykey | grep address | cut -d ' ' -f 3

app/data/config/fixturenet-laconicd/export-mykey.sh

@@ -0,0 +1,2 @@
+#!/bin/sh
+echo y | laconicd keys export mykey --unarmored-hex --unsafe

app/data/config/fixturenet-laconicd/registry-cli-config-template.yml

@@ -0,0 +1,9 @@
+services:
+  cns:
+    restEndpoint: 'http://laconicd:1317'
+    gqlEndpoint: 'http://laconicd:9473/api'
+    userKey: REPLACE_WITH_MYKEY
+    bondId:
+    chainId: laconic_9000-1
+    gas: 250000
+    fees: 200000aphoton

app/data/config/fixturenet-optimism/generate-l2-config.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+set -e
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+  set -x
+fi
+
+CERC_L1_RPC="${CERC_L1_RPC:-${DEFAULT_CERC_L1_RPC}}"
+
+# Check existing config if it exists
+if [ -f /app/jwt.txt ] && [ -f /app/rollup.json ]; then
+  echo "Found existing L2 config, cross-checking with L1 deployment config"
+
+  SOURCE_L1_CONF=$(cat /contracts-bedrock/deploy-config/getting-started.json)
+  EXP_L1_BLOCKHASH=$(echo "$SOURCE_L1_CONF" | jq -r '.l1StartingBlockTag')
+  EXP_BATCHER=$(echo "$SOURCE_L1_CONF" | jq -r '.batchSenderAddress')
+
+  GEN_L2_CONF=$(cat /app/rollup.json)
+  GEN_L1_BLOCKHASH=$(echo "$GEN_L2_CONF" | jq -r '.genesis.l1.hash')
+  GEN_BATCHER=$(echo "$GEN_L2_CONF" | jq -r '.genesis.system_config.batcherAddr')
+
+  if [ "$EXP_L1_BLOCKHASH" = "$GEN_L1_BLOCKHASH" ] && [ "$EXP_BATCHER" = "$GEN_BATCHER" ]; then
+    echo "Config cross-checked, exiting"
+    exit 0
+  fi
+
+  echo "Existing L2 config doesn't match the L1 deployment config, please clear L2 config volume before starting"
+  exit 1
+fi
+
+op-node genesis l2 \
+  --deploy-config /contracts-bedrock/deploy-config/getting-started.json \
+  --deployment-dir /contracts-bedrock/deployments/getting-started/ \
+  --outfile.l2 /app/genesis.json \
+  --outfile.rollup /app/rollup.json \
+  --l1-rpc $CERC_L1_RPC
+
+openssl rand -hex 32 > /app/jwt.txt

app/data/config/fixturenet-optimism/l1-params.env

@@ -0,0 +1,14 @@
+# Defaults
+
+# L1 endpoint
+DEFAULT_CERC_L1_CHAIN_ID=1212
+DEFAULT_CERC_L1_RPC="http://fixturenet-eth-geth-1:8545"
+DEFAULT_CERC_L1_HOST="fixturenet-eth-geth-1"
+DEFAULT_CERC_L1_PORT=8545
+
+# Credentials for accounts on L1 to send balance to Optimism Proxy contract from
+# (enables them to do transactions on L2)
+DEFAULT_CERC_L1_ADDRESS=
+DEFAULT_CERC_L1_PRIV_KEY=
+DEFAULT_CERC_L1_ADDRESS_2=
+DEFAULT_CERC_L1_PRIV_KEY_2=

app/data/config/fixturenet-optimism/optimism-contracts/run.sh

@@ -0,0 +1,128 @@
+#!/bin/bash
+set -e
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+  set -x
+fi
+
+CERC_L1_CHAIN_ID="${CERC_L1_CHAIN_ID:-${DEFAULT_CERC_L1_CHAIN_ID}}"
+CERC_L1_RPC="${CERC_L1_RPC:-${DEFAULT_CERC_L1_RPC}}"
+
+CERC_L1_ADDRESS="${CERC_L1_ADDRESS:-${DEFAULT_CERC_L1_ADDRESS}}"
+CERC_L1_PRIV_KEY="${CERC_L1_PRIV_KEY:-${DEFAULT_CERC_L1_PRIV_KEY}}"
+CERC_L1_ADDRESS_2="${CERC_L1_ADDRESS_2:-${DEFAULT_CERC_L1_ADDRESS_2}}"
+CERC_L1_PRIV_KEY_2="${CERC_L1_PRIV_KEY_2:-${DEFAULT_CERC_L1_PRIV_KEY_2}}"
+
+echo "Using L1 RPC endpoint ${CERC_L1_RPC}"
+
+IMPORT_1="import './verify-contract-deployment'"
+IMPORT_2="import './rekey-json'"
+IMPORT_3="import './send-balance'"
+
+# Append mounted tasks to tasks/index.ts file if not present
+if ! grep -Fxq "$IMPORT_1" tasks/index.ts; then
+  echo "$IMPORT_1" >> tasks/index.ts
+  echo "$IMPORT_2" >> tasks/index.ts
+  echo "$IMPORT_3" >> tasks/index.ts
+fi
+
+# Update the chainId in the hardhat config
+sed -i "/getting-started/ {n; s/.*chainId.*/      chainId: $CERC_L1_CHAIN_ID,/}" hardhat.config.ts
+
+# Exit if a deployment already exists (on restarts)
+# Note: fixturenet-eth-geth currently starts fresh on a restart
+if [ -d "deployments/getting-started" ]; then
+  echo "Deployment directory deployments/getting-started found, checking SystemDictator deployment"
+
+  # Read JSON file into variable
+  SYSTEM_DICTATOR_DETAILS=$(cat deployments/getting-started/SystemDictator.json)
+
+  # Parse JSON into variables
+  SYSTEM_DICTATOR_ADDRESS=$(echo "$SYSTEM_DICTATOR_DETAILS" | jq -r '.address')
+  SYSTEM_DICTATOR_TXHASH=$(echo "$SYSTEM_DICTATOR_DETAILS" | jq -r '.transactionHash')
+
+  if yarn hardhat verify-contract-deployment --contract "${SYSTEM_DICTATOR_ADDRESS}" --transaction-hash "${SYSTEM_DICTATOR_TXHASH}"; then
+    echo "Deployment verfication successful, exiting"
+    exit 0
+  else
+    echo "Deployment verfication failed, please clear L1 deployment volume before starting"
+    exit 1
+  fi
+fi
+
+# Generate the L2 account addresses
+yarn hardhat rekey-json --output /l2-accounts/keys.json
+
+# Read JSON file into variable
+KEYS_JSON=$(cat /l2-accounts/keys.json)
+
+# Parse JSON into variables
+ADMIN_ADDRESS=$(echo "$KEYS_JSON" | jq -r '.Admin.address')
+ADMIN_PRIV_KEY=$(echo "$KEYS_JSON" | jq -r '.Admin.privateKey')
+PROPOSER_ADDRESS=$(echo "$KEYS_JSON" | jq -r '.Proposer.address')
+BATCHER_ADDRESS=$(echo "$KEYS_JSON" | jq -r '.Batcher.address')
+SEQUENCER_ADDRESS=$(echo "$KEYS_JSON" | jq -r '.Sequencer.address')
+
+# Read the private key of L1 accounts
+if [ -f /geth-accounts/accounts.csv ]; then
+  echo "Using L1 account credentials from the mounted volume"
+  CERC_L1_ADDRESS=$(head -n 1 /geth-accounts/accounts.csv | cut -d ',' -f 2)
+  CERC_L1_PRIV_KEY=$(head -n 1 /geth-accounts/accounts.csv | cut -d ',' -f 3)
+  CERC_L1_ADDRESS_2=$(awk -F, 'NR==2{print $(NF-1)}' /geth-accounts/accounts.csv)
+  CERC_L1_PRIV_KEY_2=$(awk -F, 'NR==2{print $NF}' /geth-accounts/accounts.csv)
+else
+  echo "Using L1 account credentials from env"
+fi
+
+# Select a finalized L1 block as the starting point for roll ups
+until FINALIZED_BLOCK=$(cast block finalized --rpc-url "$CERC_L1_RPC"); do
+    echo "Waiting for a finalized L1 block to exist, retrying after 10s"
+    sleep 10
+done
+
+L1_BLOCKNUMBER=$(echo "$FINALIZED_BLOCK" | awk '/number/{print $2}')
+L1_BLOCKHASH=$(echo "$FINALIZED_BLOCK" | awk '/hash/{print $2}')
+L1_BLOCKTIMESTAMP=$(echo "$FINALIZED_BLOCK" | awk '/timestamp/{print $2}')
+
+echo "Selected L1 block ${L1_BLOCKNUMBER} as the starting block for roll ups"
+
+# Send balances to the above L2 addresses
+yarn hardhat send-balance --to "${ADMIN_ADDRESS}" --amount 2 --private-key "${CERC_L1_PRIV_KEY}" --network getting-started
+yarn hardhat send-balance --to "${PROPOSER_ADDRESS}" --amount 5 --private-key "${CERC_L1_PRIV_KEY}" --network getting-started
+yarn hardhat send-balance --to "${BATCHER_ADDRESS}" --amount 1000 --private-key "${CERC_L1_PRIV_KEY}" --network getting-started
+
+echo "Balances sent to L2 accounts"
+
+# Update the deployment config
+sed -i 's/"l2OutputOracleStartingTimestamp": TIMESTAMP/"l2OutputOracleStartingTimestamp": '"$L1_BLOCKTIMESTAMP"'/g' deploy-config/getting-started.json
+jq --arg chainid "$CERC_L1_CHAIN_ID" '.l1ChainID = ($chainid | tonumber)' deploy-config/getting-started.json > tmp.json && mv tmp.json deploy-config/getting-started.json
+
+node update-config.js deploy-config/getting-started.json "$ADMIN_ADDRESS" "$PROPOSER_ADDRESS" "$BATCHER_ADDRESS" "$SEQUENCER_ADDRESS" "$L1_BLOCKHASH"
+
+echo "Updated the deployment config"
+
+# Create a .env file
+echo "L1_RPC=$CERC_L1_RPC" > .env
+echo "PRIVATE_KEY_DEPLOYER=$ADMIN_PRIV_KEY" >> .env
+
+echo "Deploying the L1 smart contracts, this will take a while..."
+
+# Deploy the L1 smart contracts
+yarn hardhat deploy --network getting-started
+
+echo "Deployed the L1 smart contracts"
+
+# Read Proxy contract's JSON and get the address
+PROXY_JSON=$(cat deployments/getting-started/Proxy__OVM_L1StandardBridge.json)
+PROXY_ADDRESS=$(echo "$PROXY_JSON" | jq -r '.address')
+
+# Send balance to the above Proxy contract in L1 for reflecting balance in L2
+# First account
+yarn hardhat send-balance --to "${PROXY_ADDRESS}" --amount 1 --private-key "${CERC_L1_PRIV_KEY}" --network getting-started
+# Second account
+yarn hardhat send-balance --to "${PROXY_ADDRESS}" --amount 1 --private-key "${CERC_L1_PRIV_KEY_2}" --network getting-started
+
+echo "Balance sent to Proxy L2 contract"
+echo "Use following accounts for transactions in L2:"
+echo "${CERC_L1_ADDRESS}"
+echo "${CERC_L1_ADDRESS_2}"
+echo "Done"

app/data/config/fixturenet-optimism/optimism-contracts/update-config.js

@@ -0,0 +1,36 @@
+const fs = require('fs')
+
+// Get the command-line argument
+const configFile = process.argv[2]
+const adminAddress = process.argv[3]
+const proposerAddress = process.argv[4]
+const batcherAddress = process.argv[5]
+const sequencerAddress = process.argv[6]
+const blockHash = process.argv[7]
+
+// Read the JSON file
+const configData = fs.readFileSync(configFile)
+const configObj = JSON.parse(configData)
+
+// Update the finalSystemOwner property with the ADMIN_ADDRESS value
+configObj.finalSystemOwner =
+  configObj.portalGuardian =
+  configObj.controller =
+  configObj.l2OutputOracleChallenger =
+  configObj.proxyAdminOwner =
+  configObj.baseFeeVaultRecipient =
+  configObj.l1FeeVaultRecipient =
+  configObj.sequencerFeeVaultRecipient =
+  configObj.governanceTokenOwner =
+    adminAddress
+
+configObj.l2OutputOracleProposer = proposerAddress
+
+configObj.batchSenderAddress = batcherAddress
+
+configObj.p2pSequencerAddress = sequencerAddress
+
+configObj.l1StartingBlockTag = blockHash
+
+// Write the updated JSON object back to the file
+fs.writeFileSync(configFile, JSON.stringify(configObj, null, 2))

app/data/config/fixturenet-optimism/run-op-batcher.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+set -e
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+  set -x
+fi
+
+CERC_L1_RPC="${CERC_L1_RPC:-${DEFAULT_CERC_L1_RPC}}"
+
+# Get BACTHER_KEY from keys.json
+BATCHER_KEY=$(jq -r '.Batcher.privateKey' /l2-accounts/keys.json | tr -d '"')
+
+cleanup() {
+    echo "Signal received, cleaning up..."
+    kill ${batcher_pid}
+
+    wait
+    echo "Done"
+}
+trap 'cleanup' INT TERM
+
+op-batcher \
+  --l2-eth-rpc=http://op-geth:8545 \
+  --rollup-rpc=http://op-node:8547 \
+  --poll-interval=1s \
+  --sub-safety-margin=6 \
+  --num-confirmations=1 \
+  --safe-abort-nonce-too-low-count=3 \
+  --resubmission-timeout=30s \
+  --rpc.addr=0.0.0.0 \
+  --rpc.port=8548 \
+  --rpc.enable-admin \
+  --max-channel-duration=1 \
+  --target-l1-tx-size-bytes=2048 \
+  --l1-eth-rpc=$CERC_L1_RPC \
+  --private-key=$BATCHER_KEY \
+  &
+
+batcher_pid=$!
+wait $batcher_pid

app/data/config/fixturenet-optimism/run-op-geth.sh

@@ -0,0 +1,90 @@
+#!/bin/sh
+set -e
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+  set -x
+fi
+
+# TODO: Add in container build or use other tool
+echo "Installing jq"
+apk update && apk add jq
+
+# Get SEQUENCER key from keys.json
+SEQUENCER_KEY=$(jq -r '.Sequencer.privateKey' /l2-accounts/keys.json | tr -d '"')
+
+# Initialize op-geth if datadir/geth not found
+if [ -f /op-node/jwt.txt ] && [ -d datadir/geth ]; then
+  echo "Found existing datadir, checking block signer key"
+
+  BLOCK_SIGNER_KEY=$(cat datadir/block-signer-key)
+
+  if [ "$SEQUENCER_KEY" = "$BLOCK_SIGNER_KEY" ]; then
+    echo "Sequencer and block signer keys match, skipping initialization"
+  else
+    echo "Sequencer and block signer keys don't match, please clear L2 geth data volume before starting"
+    exit 1
+  fi
+else
+  echo "Initializing op-geth"
+
+  mkdir -p datadir
+  echo "pwd" > datadir/password
+  echo $SEQUENCER_KEY > datadir/block-signer-key
+
+  geth account import --datadir=datadir --password=datadir/password datadir/block-signer-key
+
+  while [ ! -f "/op-node/jwt.txt" ]
+  do
+    echo "Config files not created. Checking after 5 seconds."
+    sleep 5
+  done
+
+  echo "Config files created by op-node, proceeding with the initialization..."
+
+  geth init --datadir=datadir /op-node/genesis.json
+  echo "Node Initialized"
+fi
+
+SEQUENCER_ADDRESS=$(jq -r '.Sequencer.address' /l2-accounts/keys.json | tr -d '"')
+echo "SEQUENCER_ADDRESS: ${SEQUENCER_ADDRESS}"
+
+cleanup() {
+    echo "Signal received, cleaning up..."
+    kill ${geth_pid}
+
+    wait
+    echo "Done"
+}
+trap 'cleanup' INT TERM
+
+# Run op-geth
+geth \
+  --datadir ./datadir \
+  --http \
+  --http.corsdomain="*" \
+  --http.vhosts="*" \
+  --http.addr=0.0.0.0 \
+  --http.api=web3,debug,eth,txpool,net,engine \
+  --ws \
+  --ws.addr=0.0.0.0 \
+  --ws.port=8546 \
+  --ws.origins="*" \
+  --ws.api=debug,eth,txpool,net,engine \
+  --syncmode=full \
+  --gcmode=full \
+  --nodiscover \
+  --maxpeers=0 \
+  --networkid=42069 \
+  --authrpc.vhosts="*" \
+  --authrpc.addr=0.0.0.0 \
+  --authrpc.port=8551 \
+  --authrpc.jwtsecret=/op-node/jwt.txt \
+  --rollup.disabletxpoolgossip=true \
+  --password=./datadir/password \
+  --allow-insecure-unlock \
+  --mine \
+  --miner.etherbase=$SEQUENCER_ADDRESS \
+  --unlock=$SEQUENCER_ADDRESS \
+  &
+
+geth_pid=$!
+wait $geth_pid

app/data/config/fixturenet-optimism/run-op-node.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+set -e
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+  set -x
+fi
+
+CERC_L1_RPC="${CERC_L1_RPC:-${DEFAULT_CERC_L1_RPC}}"
+
+# Get SEQUENCER KEY from keys.json
+SEQUENCER_KEY=$(jq -r '.Sequencer.privateKey' /l2-accounts/keys.json | tr -d '"')
+
+op-node \
+  --l2=http://op-geth:8551 \
+  --l2.jwt-secret=/op-node-data/jwt.txt \
+  --sequencer.enabled \
+  --sequencer.l1-confs=3 \
+  --verifier.l1-confs=3 \
+  --rollup.config=/op-node-data/rollup.json \
+  --rpc.addr=0.0.0.0 \
+  --rpc.port=8547 \
+  --p2p.disable \
+  --rpc.enable-admin \
+  --p2p.sequencer.key=$SEQUENCER_KEY \
+  --l1=$CERC_L1_RPC \
+  --l1.rpckind=any

app/data/config/foundry/foundry.toml

@@ -0,0 +1,2 @@
+[profile.default]
+eth-rpc-url = "http://fixturenet-eth-geth-1:8545"

app/data/config/keycloak/nginx/keycloak_proxy.conf

@@ -20,16 +20,19 @@ server {
         proxy_pass  http://fixturenet-eth-geth-1:8545;
     }
 
-### ipld-eth-server
+## ipld-eth-server
 #    location ~ ^/ipld/eth/([^/]*)$ {
 #        set $apiKey $1;
 #        if ($apiKey = '') {
 #          set $apiKey $http_X_API_KEY;
 #        }
 #        auth_request /auth;
+#        auth_request_set $user_id $sent_http_x_user_id;
 #        proxy_buffering off;
 #        rewrite /.*$ / break;
 #        proxy_pass  http://ipld-eth-server:8081;
+#        proxy_set_header X-Original-Remote-Addr $remote_addr;
+#        proxy_set_header X-User-Id $user_id;
 #    }
 #
 #    location ~ ^/ipld/gql/([^/]*)$ {
@@ -42,14 +45,14 @@ server {
 #        rewrite /.*$ / break;
 #        proxy_pass  http://ipld-eth-server:8082;
 #    }
-#
-### lighthouse
-#    location /beacon/ {
-#        set $apiKey $http_X_API_KEY;
-#        auth_request /auth;
-#        proxy_buffering off;
-#        proxy_pass  http://fixturenet-eth-lighthouse-1:8001/;
-#    }
+
+## lighthouse
+    location /beacon/ {
+        set $apiKey $http_X_API_KEY;
+        auth_request /auth;
+        proxy_buffering off;
+        proxy_pass  http://fixturenet-eth-lighthouse-1:8001/;
+    }
 
     location = /auth {
         internal;
@@ -63,7 +66,7 @@ server {
         proxy_set_header X-Original-Host $host;
     }
 
-#    location = /basic_status {
-#        stub_status;
-#    }
+    location = /stub_status {
+        stub_status;
+    }
 }

app/data/config/wait-for-it.sh

@@ -0,0 +1,182 @@
+#!/usr/bin/env bash
+# Use this script to test if a given TCP host/port are available
+
+WAITFORIT_cmdname=${0##*/}
+
+echoerr() { if [[ $WAITFORIT_QUIET -ne 1 ]]; then echo "$@" 1>&2; fi }
+
+usage()
+{
+    cat << USAGE >&2
+Usage:
+    $WAITFORIT_cmdname host:port [-s] [-t timeout] [-- command args]
+    -h HOST | --host=HOST       Host or IP under test
+    -p PORT | --port=PORT       TCP port under test
+                                Alternatively, you specify the host and port as host:port
+    -s | --strict               Only execute subcommand if the test succeeds
+    -q | --quiet                Don't output any status messages
+    -t TIMEOUT | --timeout=TIMEOUT
+                                Timeout in seconds, zero for no timeout
+    -- COMMAND ARGS             Execute command with args after the test finishes
+USAGE
+    exit 1
+}
+
+wait_for()
+{
+    if [[ $WAITFORIT_TIMEOUT -gt 0 ]]; then
+        echoerr "$WAITFORIT_cmdname: waiting $WAITFORIT_TIMEOUT seconds for $WAITFORIT_HOST:$WAITFORIT_PORT"
+    else
+        echoerr "$WAITFORIT_cmdname: waiting for $WAITFORIT_HOST:$WAITFORIT_PORT without a timeout"
+    fi
+    WAITFORIT_start_ts=$(date +%s)
+    while :
+    do
+        if [[ $WAITFORIT_ISBUSY -eq 1 ]]; then
+            nc -z $WAITFORIT_HOST $WAITFORIT_PORT
+            WAITFORIT_result=$?
+        else
+            (echo -n > /dev/tcp/$WAITFORIT_HOST/$WAITFORIT_PORT) >/dev/null 2>&1
+            WAITFORIT_result=$?
+        fi
+        if [[ $WAITFORIT_result -eq 0 ]]; then
+            WAITFORIT_end_ts=$(date +%s)
+            echoerr "$WAITFORIT_cmdname: $WAITFORIT_HOST:$WAITFORIT_PORT is available after $((WAITFORIT_end_ts - WAITFORIT_start_ts)) seconds"
+            break
+        fi
+        sleep 1
+    done
+    return $WAITFORIT_result
+}
+
+wait_for_wrapper()
+{
+    # In order to support SIGINT during timeout: http://unix.stackexchange.com/a/57692
+    if [[ $WAITFORIT_QUIET -eq 1 ]]; then
+        timeout $WAITFORIT_BUSYTIMEFLAG $WAITFORIT_TIMEOUT $0 --quiet --child --host=$WAITFORIT_HOST --port=$WAITFORIT_PORT --timeout=$WAITFORIT_TIMEOUT &
+    else
+        timeout $WAITFORIT_BUSYTIMEFLAG $WAITFORIT_TIMEOUT $0 --child --host=$WAITFORIT_HOST --port=$WAITFORIT_PORT --timeout=$WAITFORIT_TIMEOUT &
+    fi
+    WAITFORIT_PID=$!
+    trap "kill -INT -$WAITFORIT_PID" INT
+    wait $WAITFORIT_PID
+    WAITFORIT_RESULT=$?
+    if [[ $WAITFORIT_RESULT -ne 0 ]]; then
+        echoerr "$WAITFORIT_cmdname: timeout occurred after waiting $WAITFORIT_TIMEOUT seconds for $WAITFORIT_HOST:$WAITFORIT_PORT"
+    fi
+    return $WAITFORIT_RESULT
+}
+
+# process arguments
+while [[ $# -gt 0 ]]
+do
+    case "$1" in
+        *:* )
+        WAITFORIT_hostport=(${1//:/ })
+        WAITFORIT_HOST=${WAITFORIT_hostport[0]}
+        WAITFORIT_PORT=${WAITFORIT_hostport[1]}
+        shift 1
+        ;;
+        --child)
+        WAITFORIT_CHILD=1
+        shift 1
+        ;;
+        -q | --quiet)
+        WAITFORIT_QUIET=1
+        shift 1
+        ;;
+        -s | --strict)
+        WAITFORIT_STRICT=1
+        shift 1
+        ;;
+        -h)
+        WAITFORIT_HOST="$2"
+        if [[ $WAITFORIT_HOST == "" ]]; then break; fi
+        shift 2
+        ;;
+        --host=*)
+        WAITFORIT_HOST="${1#*=}"
+        shift 1
+        ;;
+        -p)
+        WAITFORIT_PORT="$2"
+        if [[ $WAITFORIT_PORT == "" ]]; then break; fi
+        shift 2
+        ;;
+        --port=*)
+        WAITFORIT_PORT="${1#*=}"
+        shift 1
+        ;;
+        -t)
+        WAITFORIT_TIMEOUT="$2"
+        if [[ $WAITFORIT_TIMEOUT == "" ]]; then break; fi
+        shift 2
+        ;;
+        --timeout=*)
+        WAITFORIT_TIMEOUT="${1#*=}"
+        shift 1
+        ;;
+        --)
+        shift
+        WAITFORIT_CLI=("$@")
+        break
+        ;;
+        --help)
+        usage
+        ;;
+        *)
+        echoerr "Unknown argument: $1"
+        usage
+        ;;
+    esac
+done
+
+if [[ "$WAITFORIT_HOST" == "" || "$WAITFORIT_PORT" == "" ]]; then
+    echoerr "Error: you need to provide a host and port to test."
+    usage
+fi
+
+WAITFORIT_TIMEOUT=${WAITFORIT_TIMEOUT:-15}
+WAITFORIT_STRICT=${WAITFORIT_STRICT:-0}
+WAITFORIT_CHILD=${WAITFORIT_CHILD:-0}
+WAITFORIT_QUIET=${WAITFORIT_QUIET:-0}
+
+# Check to see if timeout is from busybox?
+WAITFORIT_TIMEOUT_PATH=$(type -p timeout)
+WAITFORIT_TIMEOUT_PATH=$(realpath $WAITFORIT_TIMEOUT_PATH 2>/dev/null || readlink -f $WAITFORIT_TIMEOUT_PATH)
+
+WAITFORIT_BUSYTIMEFLAG=""
+if [[ $WAITFORIT_TIMEOUT_PATH =~ "busybox" ]]; then
+    WAITFORIT_ISBUSY=1
+    # Check if busybox timeout uses -t flag
+    # (recent Alpine versions don't support -t anymore)
+    if timeout &>/dev/stdout | grep -q -e '-t '; then
+        WAITFORIT_BUSYTIMEFLAG="-t"
+    fi
+else
+    WAITFORIT_ISBUSY=0
+fi
+
+if [[ $WAITFORIT_CHILD -gt 0 ]]; then
+    wait_for
+    WAITFORIT_RESULT=$?
+    exit $WAITFORIT_RESULT
+else
+    if [[ $WAITFORIT_TIMEOUT -gt 0 ]]; then
+        wait_for_wrapper
+        WAITFORIT_RESULT=$?
+    else
+        wait_for
+        WAITFORIT_RESULT=$?
+    fi
+fi
+
+if [[ $WAITFORIT_CLI != "" ]]; then
+    if [[ $WAITFORIT_RESULT -ne 0 && $WAITFORIT_STRICT -eq 1 ]]; then
+        echoerr "$WAITFORIT_cmdname: strict mode, refusing to execute subprocess"
+        exit $WAITFORIT_RESULT
+    fi
+    exec "${WAITFORIT_CLI[@]}"
+else
+    exit $WAITFORIT_RESULT
+fi

app/data/config/watcher-mobymask-v2/deploy-and-generate-invite.sh

@@ -0,0 +1,75 @@
+#!/bin/sh
+set -e
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+  set -x
+fi
+
+CERC_L2_GETH_RPC="${CERC_L2_GETH_RPC:-${DEFAULT_CERC_L2_GETH_RPC}}"
+CERC_PRIVATE_KEY_DEPLOYER="${CERC_PRIVATE_KEY_DEPLOYER:-${DEFAULT_CERC_PRIVATE_KEY_DEPLOYER}}"
+
+CERC_MOBYMASK_APP_BASE_URI="${CERC_MOBYMASK_APP_BASE_URI:-${DEFAULT_CERC_MOBYMASK_APP_BASE_URI}}"
+CERC_DEPLOYED_CONTRACT="${CERC_DEPLOYED_CONTRACT:-${DEFAULT_CERC_DEPLOYED_CONTRACT}}"
+
+echo "Using L2 RPC endpoint ${CERC_L2_GETH_RPC}"
+
+if [ -f /geth-accounts/accounts.csv ]; then
+  echo "Using L1 private key from the mounted volume"
+  # Read the private key of L1 account to deploy contract
+  CERC_PRIVATE_KEY_DEPLOYER=$(head -n 1 /geth-accounts/accounts.csv | cut -d ',' -f 3)
+else
+  echo "Using CERC_PRIVATE_KEY_DEPLOYER from env"
+fi
+
+# Set the private key
+jq --arg privateKey "$CERC_PRIVATE_KEY_DEPLOYER" '.privateKey = $privateKey' secrets-template.json > secrets.json
+
+# Set the RPC URL
+jq --arg rpcUrl "$CERC_L2_GETH_RPC" '.rpcUrl = $rpcUrl' secrets.json > secrets_updated.json && mv secrets_updated.json secrets.json
+
+# Set the MobyMask app base URI
+jq --arg baseURI "$CERC_MOBYMASK_APP_BASE_URI" '.baseURI = $baseURI' secrets.json > secrets_updated.json && mv secrets_updated.json secrets.json
+
+export RPC_URL="${CERC_L2_GETH_RPC}"
+
+# Check if CERC_DEPLOYED_CONTRACT environment variable set to skip contract deployment
+if [ -n "$CERC_DEPLOYED_CONTRACT" ]; then
+  echo "CERC_DEPLOYED_CONTRACT is set to '$CERC_DEPLOYED_CONTRACT'"
+  echo "Exiting without deploying contract"
+  exit 0
+fi
+
+# Check and exit if a deployment already exists (on restarts)
+if [ -f ./config.json ]; then
+  echo "config.json already exists, checking the contract deployment"
+
+  # Read JSON file
+  DEPLOYMENT_DETAILS=$(cat config.json)
+  CONTRACT_ADDRESS=$(echo "$DEPLOYMENT_DETAILS" | jq -r '.address')
+
+  cd ../hardhat
+  if yarn verifyDeployment --network optimism --contract "${CONTRACT_ADDRESS}"; then
+    echo "Deployment verfication successful"
+    cd ../server
+  else
+    echo "Deployment verfication failed, please clear MobyMask deployment volume before starting"
+    exit 1
+  fi
+fi
+
+# Wait until balance for deployer account is updated
+cd ../hardhat
+while true; do
+  ACCOUNT_BALANCE=$(yarn balance --network optimism "$CERC_PRIVATE_KEY_DEPLOYER" | grep ETH)
+
+  if [ "$ACCOUNT_BALANCE" != "0.0 ETH" ]; then
+    echo "Account balance updated: $ACCOUNT_BALANCE"
+    break # exit the loop
+  fi
+
+  echo "Account balance not updated: $ACCOUNT_BALANCE"
+  echo "Checking after 2 seconds"
+  sleep 2
+done
+
+cd ../server
+npm run deployAndGenerateInvite

app/data/config/watcher-mobymask-v2/generate-peer-ids.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+set -e
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+  set -x
+fi
+
+# Check for peer ids in ./peers folder, create if not present
+if [ -f /peer-ids/relay-id.json ]; then
+  echo "Using peer id for relay node from the mounted volume"
+else
+  echo "Creating a new peer id for relay node"
+  yarn create-peer -f /peer-ids/relay-id.json
+fi
+
+if [ -f /peer-ids/peer-id.json ]; then
+  echo "Using peer id for peer node from the mounted volume"
+else
+  echo "Creating a new peer id for peer node"
+  yarn create-peer -f /peer-ids/peer-id.json
+fi

app/data/config/watcher-mobymask-v2/mobymask-app-start.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -e
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+  set -x
+fi
+
+CERC_CHAIN_ID="${CERC_CHAIN_ID:-${DEFAULT_CERC_CHAIN_ID}}"
+CERC_DEPLOYED_CONTRACT="${CERC_DEPLOYED_CONTRACT:-${DEFAULT_CERC_DEPLOYED_CONTRACT}}"
+CERC_RELAY_NODES="${CERC_RELAY_NODES:-${DEFAULT_CERC_RELAY_NODES}}"
+CERC_APP_WATCHER_URL="${CERC_APP_WATCHER_URL:-${DEFAULT_CERC_APP_WATCHER_URL}}"
+
+# If not set (or []), check the mounted volume for relay peer id
+if [ -z "$CERC_RELAY_NODES" ] || [ "$CERC_RELAY_NODES" = "[]" ]; then
+  echo "CERC_RELAY_NODES not provided, taking from the mounted volume"
+  CERC_RELAY_NODES="[\"/ip4/127.0.0.1/tcp/9090/ws/p2p/$(jq -r '.id' /peers/relay-id.json)\"]"
+fi
+
+echo "Using CERC_RELAY_NODES $CERC_RELAY_NODES"
+
+# Use config from mounted volume if available (when running web-app along with watcher stack)
+if [ -f /server/config.json ]; then
+  echo "Taking config for deployed contract from mounted volume"
+
+  # Get deployed contract address and chain id
+  CERC_DEPLOYED_CONTRACT=$(jq -r '.address' /server/config.json | tr -d '"')
+  CERC_CHAIN_ID=$(jq -r '.chainId' /server/config.json)
+else
+  echo "Taking deployed contract details from env"
+fi
+
+# Use yq to create config.yml with environment variables
+yq -n ".address = env(CERC_DEPLOYED_CONTRACT)" > /config/config.yml
+yq ".watcherUrl = env(CERC_APP_WATCHER_URL)" -i /config/config.yml
+yq ".chainId = env(CERC_CHAIN_ID)" -i /config/config.yml
+yq ".relayNodes = strenv(CERC_RELAY_NODES)" -i /config/config.yml
+
+/scripts/start-serving-app.sh

app/data/config/watcher-mobymask-v2/mobymask-params.env

@@ -0,0 +1,28 @@
+# Defaults
+
+# Watcher endpoint
+DEFAULT_CERC_WATCHER_HOST="mobymask-watcher-server"
+DEFAULT_CERC_WATCHER_PORT=3001
+DEFAULT_CERC_APP_WATCHER_URL="http://localhost:3001"
+
+# Set of relay peers to connect to from the relay node
+DEFAULT_CERC_RELAY_PEERS=[]
+
+# Domain to be used in the relay node's announce address
+DEFAULT_CERC_RELAY_ANNOUNCE_DOMAIN=
+
+# Base URI for mobymask-app (used for generating invite)
+DEFAULT_CERC_MOBYMASK_APP_BASE_URI="http://127.0.0.1:3002/#"
+
+# Set to false for disabling watcher peer to send txs to L2
+DEFAULT_CERC_ENABLE_PEER_L2_TXS=true
+
+# Set deployed MobyMask contract address to avoid deploying contract in stack
+# mobymask-app will use this contract address in config if run separately
+DEFAULT_CERC_DEPLOYED_CONTRACT=
+
+# Chain ID is used by mobymask web-app for txs
+DEFAULT_CERC_CHAIN_ID=42069
+
+# Set of relay nodes to be used by web-apps
+DEFAULT_CERC_RELAY_NODES=[]

app/data/config/watcher-mobymask-v2/optimism-params.env

@@ -0,0 +1,13 @@
+# Defaults
+
+# L2 endpoints
+DEFAULT_CERC_L2_GETH_RPC="http://op-geth:8545"
+DEFAULT_CERC_L2_GETH_HOST="op-geth"
+DEFAULT_CERC_L2_GETH_PORT=8545
+
+DEFAULT_CERC_L2_NODE_HOST="op-node"
+DEFAULT_CERC_L2_NODE_PORT=8547
+
+# Credentials for accounts to perform txs on L2
+DEFAULT_CERC_PRIVATE_KEY_DEPLOYER=
+DEFAULT_CERC_PRIVATE_KEY_PEER=

app/data/config/watcher-mobymask-v2/secrets-template.json

@@ -0,0 +1,5 @@
+{
+    "rpcUrl": "",
+    "privateKey": "",
+    "baseURI": ""
+}

app/data/config/watcher-mobymask-v2/set-tests-env.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+set -e
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+  set -x
+fi
+
+CERC_RELAY_MULTIADDR="/dns4/mobymask-watcher-server/tcp/9090/ws/p2p/$(jq -r '.id' /peer-ids/relay-id.json)"
+
+# Write the relay node's multiaddr to /app/packages/peer/.env for running tests
+echo "RELAY=\"$CERC_RELAY_MULTIADDR\"" > ./.env

app/data/config/watcher-mobymask-v2/start-server.sh

@@ -0,0 +1,50 @@
+#!/bin/sh
+set -e
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+  set -x
+fi
+
+CERC_L2_GETH_RPC="${CERC_L2_GETH_RPC:-${DEFAULT_CERC_L2_GETH_RPC}}"
+CERC_PRIVATE_KEY_PEER="${CERC_PRIVATE_KEY_PEER:-${DEFAULT_CERC_PRIVATE_KEY_PEER}}"
+
+CERC_RELAY_PEERS="${CERC_RELAY_PEERS:-${DEFAULT_CERC_RELAY_PEERS}}"
+CERC_RELAY_ANNOUNCE_DOMAIN="${CERC_RELAY_ANNOUNCE_DOMAIN:-${DEFAULT_CERC_RELAY_ANNOUNCE_DOMAIN}}"
+CERC_ENABLE_PEER_L2_TXS="${CERC_ENABLE_PEER_L2_TXS:-${DEFAULT_CERC_ENABLE_PEER_L2_TXS}}"
+CERC_DEPLOYED_CONTRACT="${CERC_DEPLOYED_CONTRACT:-${DEFAULT_CERC_DEPLOYED_CONTRACT}}"
+
+echo "Using L2 RPC endpoint ${CERC_L2_GETH_RPC}"
+
+CERC_RELAY_MULTIADDR="/dns4/mobymask-watcher-server/tcp/9090/ws/p2p/$(jq -r '.id' /app/peers/relay-id.json)"
+
+# Use contract address from environment variable or set from config.json in mounted volume
+if [ -n "$CERC_DEPLOYED_CONTRACT" ]; then
+  CONTRACT_ADDRESS="${CERC_DEPLOYED_CONTRACT}"
+else
+  # Assign deployed contract address from server config (created by mobymask container after deploying contract)
+  CONTRACT_ADDRESS=$(jq -r '.address' /server/config.json | tr -d '"')
+fi
+
+if [ -f /geth-accounts/accounts.csv ]; then
+  echo "Using L1 private key from the mounted volume"
+  # Read the private key of L1 account for sending txs from peer
+  CERC_PRIVATE_KEY_PEER=$(awk -F, 'NR==2{print $NF}' /geth-accounts/accounts.csv)
+else
+  echo "Using CERC_PRIVATE_KEY_PEER from env"
+fi
+
+# Read in the config template TOML file and modify it
+WATCHER_CONFIG_TEMPLATE=$(cat environments/watcher-config-template.toml)
+WATCHER_CONFIG=$(echo "$WATCHER_CONFIG_TEMPLATE" | \
+  sed -E "s|REPLACE_WITH_CERC_RELAY_PEERS|${CERC_RELAY_PEERS}|g; \
+          s/REPLACE_WITH_CERC_RELAY_ANNOUNCE_DOMAIN/${CERC_RELAY_ANNOUNCE_DOMAIN}/g; \
+          s|REPLACE_WITH_CERC_RELAY_MULTIADDR|${CERC_RELAY_MULTIADDR}|g; \
+          s/REPLACE_WITH_CERC_ENABLE_PEER_L2_TXS/${CERC_ENABLE_PEER_L2_TXS}/g; \
+          s/REPLACE_WITH_CERC_PRIVATE_KEY_PEER/${CERC_PRIVATE_KEY_PEER}/g; \
+          s/REPLACE_WITH_CONTRACT_ADDRESS/${CONTRACT_ADDRESS}/g; \
+          s|REPLACE_WITH_CERC_L2_GETH_RPC_ENDPOINT|${CERC_L2_GETH_RPC}| ")
+
+# Write the modified content to a new file
+echo "$WATCHER_CONFIG" > environments/local.toml
+
+echo 'yarn server'
+yarn server

app/data/config/watcher-mobymask-v2/test-app-config.json

@@ -0,0 +1,6 @@
+{
+  "relayNodes": [],
+  "peer": {
+    "enableDebugInfo": true
+  }
+}

app/data/config/watcher-mobymask-v2/test-app-start.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+set -e
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+  set -x
+fi
+
+CERC_RELAY_NODES="${CERC_RELAY_NODES:-${DEFAULT_CERC_RELAY_NODES}}"
+
+# If not set (or []), check the mounted volume for relay peer id
+if [ -z "$CERC_RELAY_NODES" ] || [ "$CERC_RELAY_NODES" = "[]" ]; then
+  echo "CERC_RELAY_NODES not provided, taking from the mounted volume"
+  CERC_RELAY_NODES="[\"/ip4/127.0.0.1/tcp/9090/ws/p2p/$(jq -r '.id' /peers/relay-id.json)\"]"
+fi
+
+echo "Using CERC_RELAY_NODES $CERC_RELAY_NODES"
+
+# Use yq to create config.yml with environment variables
+yq -n ".relayNodes = strenv(CERC_RELAY_NODES)" > /config/config.yml
+
+/scripts/start-serving-app.sh

app/data/config/watcher-mobymask-v2/watcher-config-template.toml

@@ -0,0 +1,76 @@
+[server]
+  host = "0.0.0.0"
+  port = 3001
+  kind = "lazy"
+
+  # Checkpointing state.
+  checkpointing = true
+
+  # Checkpoint interval in number of blocks.
+  checkpointInterval = 2000
+
+  # Enable state creation
+  enableState = true
+
+  # Boolean to filter logs by contract.
+  filterLogs = true
+
+  # Max block range for which to return events in eventsInRange GQL query.
+  # Use -1 for skipping check on block range.
+  maxEventsBlockRange = -1
+
+  [server.p2p]
+    enableRelay = true
+    enablePeer = true
+
+    [server.p2p.relay]
+      host = "0.0.0.0"
+      port = 9090
+      relayPeers = REPLACE_WITH_CERC_RELAY_PEERS
+      peerIdFile = './peers/relay-id.json'
+      announce = 'REPLACE_WITH_CERC_RELAY_ANNOUNCE_DOMAIN'
+      enableDebugInfo = true
+
+    [server.p2p.peer]
+      relayMultiaddr = 'REPLACE_WITH_CERC_RELAY_MULTIADDR'
+      pubSubTopic = 'mobymask'
+      peerIdFile = './peers/peer-id.json'
+      enableDebugInfo = true
+      enableL2Txs = REPLACE_WITH_CERC_ENABLE_PEER_L2_TXS
+
+      [server.p2p.peer.l2TxsConfig]
+        privateKey = 'REPLACE_WITH_CERC_PRIVATE_KEY_PEER'
+        contractAddress = 'REPLACE_WITH_CONTRACT_ADDRESS'
+
+[metrics]
+  host = "0.0.0.0"
+  port = 9000
+  [metrics.gql]
+    port = 9001
+
+[database]
+  type = "postgres"
+  host = "mobymask-watcher-db"
+  port = 5432
+  database = "mobymask-watcher"
+  username = "vdbm"
+  password = "password"
+  synchronize = true
+  logging = false
+
+[upstream]
+  [upstream.ethServer]
+    gqlApiEndpoint = "http://ipld-eth-server:8083/graphql"
+    rpcProviderEndpoint = "REPLACE_WITH_CERC_L2_GETH_RPC_ENDPOINT"
+    blockDelayInMilliSecs = 60000
+
+  [upstream.cache]
+    name = "requests"
+    enabled = false
+    deleteOnStart = false
+
+[jobQueue]
+  dbConnectionString = "postgres://vdbm:password@mobymask-watcher-db/mobymask-watcher-job-queue"
+  maxCompletionLagInSecs = 300
+  jobDelayInMilliSecs = 100
+  eventsInBatch = 50

app/data/container-build/build-base.sh

@@ -0,0 +1,13 @@
+# source'ed into container build scripts to do generic command setup
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+    echo "Build environment variables:"
+    env
+fi
+build_command_args=""
+if [[ ${CERC_FORCE_REBUILD} == "true" ]]; then
+    build_command_args="${build_command_args} --no-cache"
+fi
+if [[ -n "$CERC_CONTAINER_EXTRA_BUILD_ARGS" ]]; then
+    build_command_args="${build_command_args} ${CERC_CONTAINER_EXTRA_BUILD_ARGS}"
+fi

app/data/container-build/cerc-act-runner-task-executor/build.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Build a local version of the task executor for act-runner
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+docker build -t cerc/act-runner-task-executor:local -f ${CERC_REPO_BASE_DIR}/hosting/gitea/Dockerfile.task-executor ${build_command_args} ${SCRIPT_DIR}

app/data/container-build/cerc-act-runner/build.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+# Build a local version of the act-runner image
+# TODO: enhance the default build code path to cope with this container (repo has an _ which needs to be converted to - in the image tag)
+docker build -t cerc/act-runner:local -f ${CERC_REPO_BASE_DIR}/act_runner/Dockerfile ${build_command_args} ${CERC_REPO_BASE_DIR}/act_runner

app/data/container-build/cerc-builder-gerbil/Dockerfile

@@ -0,0 +1,31 @@
+# From: https://github.com/vyzo/gerbil/blob/master/docker/Dockerfile
+FROM gerbil/ubuntu
+
+# Install the Solidity compiler (latest stable version)
+# and guile
+# and libsecp256k1-dev
+RUN apt-get update && export DEBIAN_FRONTEND=noninteractive && export DEBCONF_NOWARNINGS="yes" && \
+    apt-get install -y software-properties-common && \
+    add-apt-repository ppa:ethereum/ethereum && \
+    apt-get update && \
+    apt-get install -y solc && \
+    apt-get install -y guile-3.0 && \
+    apt-get install -y libsecp256k1-dev && \
+    apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+RUN mkdir /scripts
+COPY install-dependencies.sh /scripts
+
+# Override the definition of GERBIL_PATH in the base image, but
+# is safe because (at present) no gerbil packages are installed in the base image
+# We do this in order to allow a set of pre-installed packages from the container
+# to be used with an arbitrary, potentially different set of projects bind mounted
+# at /src
+ENV GERBIL_PATH=/.gerbil
+RUN bash /scripts/install-dependencies.sh
+
+# Needed to prevent git from raging about /src
+RUN git config --global --add safe.directory /src
+
+COPY entrypoint.sh /scripts
+ENTRYPOINT ["/scripts/entrypoint.sh"]

app/data/container-build/cerc-builder-gerbil/README.md

@@ -0,0 +1,21 @@
+## Gerbil Scheme Builder
+
+This container is designed to be used as a simple "build runner" environment for building and running Scheme projects using Gerbil and gerbil-ethereum. Its primary purpose is to allow build/test/run of gerbil code without the need to install and configure all the necessary prerequisites and dependencies on the host system.
+
+### Usage
+
+First build the container with:
+
+```
+$ laconic-so build-containers --include cerc/builder-gerbil
+```
+
+Now, assuming a gerbil project located at `~/projects/my-project`, run bash in the container mounting the project with:
+
+```
+$ docker run -it -v $HOME/projects/my-project:/src cerc/builder-gerbil:latest bash
+root@7c4124bb09e3:/src#
+```
+
+Now gerbil commands can be run.
+

app/data/container-build/cerc-builder-gerbil/entrypoint.sh

@@ -0,0 +1,2 @@
+#!/bin/sh
+exec "$@"

app/data/container-build/cerc-builder-gerbil/install-dependencies.sh

@@ -0,0 +1,16 @@
+DEPS=(github.com/fare/gerbil-utils
+      github.com/fare/gerbil-poo
+      github.com/fare/gerbil-crypto
+      github.com/fare/gerbil-persist
+      github.com/fare/gerbil-ethereum
+      github.com/drewc/gerbil-swank
+      github.com/drewc/drewc-r7rs-swank
+      github.com/drewc/smug-gerbil
+      github.com/drewc/ftw
+      github.com/vyzo/gerbil-libp2p
+      ) ;
+for i in ${DEPS[@]} ; do
+  echo "Installing gerbil package: $i"
+  gxpkg install $i
+  gxpkg build $i
+done

app/data/container-build/cerc-builder-js/Dockerfile

@@ -1,14 +1,37 @@
 # Originally from: https://github.com/devcontainers/images/blob/main/src/javascript-node/.devcontainer/Dockerfile
+# Which depends on: https://github.com/nodejs/docker-node/blob/main/Dockerfile-debian.template
 # [Choice] Node.js version (use -bullseye variants on local arm64/Apple Silicon): 18, 16, 14, 18-bullseye, 16-bullseye, 14-bullseye, 18-buster, 16-buster, 14-buster
-ARG VARIANT=16-bullseye
+ARG VARIANT=18-bullseye
 FROM node:${VARIANT}
 
+# Set these args to change the uid/gid for the base container's "node" user to match that of the host user (so bind mounts work as expected).
+ARG CERC_HOST_UID=1000
+ARG CERC_HOST_GID=1000
+# Make these values available at runtime to allow a consistency check.
+ENV HOST_UID=${CERC_HOST_UID}
+ENV HOST_GID=${CERC_HOST_GID}
+
 ARG USERNAME=node
 ARG NPM_GLOBAL=/usr/local/share/npm-global
 
 # Add NPM global to PATH.
 ENV PATH=${NPM_GLOBAL}/bin:${PATH}
 
+SHELL ["/bin/bash", "-c"]
+
+RUN \
+    # Don't switch container uid/gid if the host uid/gid is 1000 (which means it's already correct),
+    # or root (which won't work anyway) or <= 100 (which also won't work).
+    if [[ ${CERC_HOST_GID} -ne 1000 && ${CERC_HOST_GID} -ne 0 && ${CERC_HOST_GID} -gt 100 ]]; then \
+        groupmod -g ${CERC_HOST_GID} ${USERNAME}; \
+    fi \
+    && if [[ ${CERC_HOST_UID} -ne 1000 && ${CERC_HOST_UID} -ne 0 && ${CERC_HOST_UID} -gt 100 ]]; then \
+        usermod -u ${CERC_HOST_UID} -g ${CERC_HOST_GID} ${USERNAME} && chown ${CERC_HOST_UID}:${CERC_HOST_GID} /home/${USERNAME}; \
+    fi
+
+# Prevents npm from printing version warnings
+ENV NPM_CONFIG_UPDATE_NOTIFIER=false
+
 RUN \
     # Configure global npm install location, use group to adapt to UID/GID changes
     if ! cat /etc/group | grep -e "^npm:" > /dev/null 2>&1; then groupadd -r npm; fi \
@@ -39,6 +62,7 @@ RUN mkdir /scripts
 COPY build-npm-package.sh /scripts
 COPY yarn-local-registry-fixup.sh /scripts
 COPY build-npm-package-local-dependencies.sh /scripts
+COPY check-uid.sh /scripts
 ENV PATH="${PATH}:/scripts"
 
 COPY entrypoint.sh .

app/data/container-build/cerc-builder-js/build-npm-package-local-dependencies.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # Usage: build-npm-package-local-dependencies.sh <registry-url> <publish-with-this-version>
 # Runs build-npm-package.sh after first fixing up yarn.lock to use a local
-# npm registry for all packages in a spcific scope (currently @cerc-io)
+# npm registry for all packages in a specific scope (currently @cerc-io, @lirewine and @muknsys)
 if [ -n "$CERC_SCRIPT_DEBUG" ]; then
     set -x
 fi
@@ -13,20 +13,25 @@ if [[ -z "${CERC_NPM_AUTH_TOKEN}" ]]; then
     echo "CERC_NPM_AUTH_TOKEN is not set" >&2
     exit 1
 fi
+# Exit on error
+set -e
 local_npm_registry_url=$1
 package_publish_version=$2
-# TODO: make this a paramater and allow a list of scopes
-npm_scope_for_local="@cerc-io"
-# We need to configure the local registry 
-npm config set ${npm_scope_for_local}:registry ${local_npm_registry_url}
-npm config set -- ${local_npm_registry_url}:_authToken ${CERC_NPM_AUTH_TOKEN}
-# Find the set of dependencies from the specified scope
-mapfile -t dependencies_from_scope < <(cat package.json | jq -r '.dependencies | with_entries(if (.key|test("^'${npm_scope_for_local}'/.*$")) then ( {key: .key, value: .value } ) else empty end ) | keys[]')
-echo "Fixing up dependencies"
-for package in "${dependencies_from_scope[@]}"
+# If we need to handle an additional scope, add it to the list below:
+npm_scopes_to_handle=("@cerc-io" "@lirewine" "@muknsys")
+for npm_scope_for_local in ${npm_scopes_to_handle[@]}
 do
-    echo "Fixing up package ${package}"
-    yarn-local-registry-fixup.sh $package ${local_npm_registry_url}
+    # We need to configure the local registry
+    npm config set ${npm_scope_for_local}:registry ${local_npm_registry_url}
+    npm config set -- ${local_npm_registry_url}:_authToken ${CERC_NPM_AUTH_TOKEN}
+    # Find the set of dependencies from the specified scope
+    mapfile -t dependencies_from_scope < <(cat package.json | jq -r '.dependencies | with_entries(if (.key|test("^'${npm_scope_for_local}'/.*$")) then ( {key: .key, value: .value } ) else empty end ) | keys[]')
+    echo "Fixing up dependencies in scope ${npm_scope_for_local}"
+    for package in "${dependencies_from_scope[@]}"
+    do
+        echo "Fixing up package ${package}"
+        yarn-local-registry-fixup.sh $package ${local_npm_registry_url}
+    done
 done
 echo "Running build"
 build-npm-package.sh ${local_npm_registry_url} ${package_publish_version}

app/data/container-build/cerc-builder-js/build-npm-package.sh

@@ -17,17 +17,29 @@ if [[ $# -eq 2 ]]; then
 else
     package_publish_version=$( cat package.json | jq -r .version )
 fi
+# Exit on error
+set -e
 # Get the name of this package from package.json since we weren't passed that
 package_name=$( cat package.json | jq -r .name )
 local_npm_registry_url=$1
-npm config set @lirewine:registry ${local_npm_registry_url}
 npm config set @cerc-io:registry ${local_npm_registry_url}
-npm config set -- ${local_npm_registry_url}:_authToken ${CERC_NPM_AUTH_TOKEN}
+npm config set @lirewine:registry ${local_npm_registry_url}
+npm config set @muknsys:registry ${local_npm_registry_url}
+# Workaround bug in npm unpublish where it needs the url to be of the form //<foo> and not http://<foo>
+local_npm_registry_url_fixed=$( echo ${local_npm_registry_url} | sed -e 's/^http[s]\{0,1\}://')
+npm config set -- ${local_npm_registry_url_fixed}:_authToken ${CERC_NPM_AUTH_TOKEN}
 # First check if the version of this package we're trying to build already exists in the registry
-package_exists=$( yarn info --json ${package_name}@${package_publish_version} | jq -r .data.dist.tarball )
+package_exists=$( yarn info --json ${package_name}@${package_publish_version} 2>/dev/null | jq -r .data.dist.tarball )
 if [[ ! -z "$package_exists" && "$package_exists" != "null" ]]; then
-    echo "${package_publish_version} of ${package_name} already exists in the registry, skipping build"
-    exit 0
+    echo "${package_publish_version} of ${package_name} already exists in the registry"
+    if [[ ${CERC_FORCE_REBUILD} == "true" ]]; then
+        # Attempt to unpublish the existing package
+        echo "NOTE: unpublishing existing package version since force rebuild is enabled"
+        npm unpublish --force ${package_name}@${package_publish_version}
+    else
+        echo "skipping build since target version already exists"
+        exit 0
+    fi
 fi
 echo "Build and publish ${package_name} version ${package_publish_version}"
 yarn install

app/data/container-build/cerc-builder-js/check-uid.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Make the container usable for uid/gid != 1000
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
+current_uid=$(id -u)
+current_gid=$(id -g)
+# Don't check if running as root
+if [[ ${current_uid} == 0 ]]; then
+    exit 0
+fi
+# Check the current uid/gid vs the uid/gid used to build the container.
+# We do this because both bind mounts and npm tooling require the uid/gid to match.
+if [[ ${current_gid} != ${HOST_GID} ]]; then
+    echo "Warning: running with gid: ${current_gid} which is not the gid for which this container was built (${HOST_GID})"
+    exit 0
+fi
+if [[ ${current_uid} != ${HOST_UID} ]]; then
+    echo "Warning: running with gid: ${current_uid} which is not the uid for which this container was built (${HOST_UID})"
+    exit 0
+fi

app/data/container-build/cerc-builder-js/entrypoint.sh

@@ -1,2 +1,3 @@
 #!/bin/sh
+/scripts/check-uid.sh
 exec "$@"

app/data/container-build/cerc-builder-js/yarn-local-registry-fixup.sh

@@ -14,14 +14,24 @@ if [[ $# -ne 2 ]]; then
     echo "Illegal number of parameters" >&2
     exit 1
 fi
+# Exit on error
+set -e
 target_package=$1
 local_npm_registry_url=$2
-# TODO: use jq rather than sed here:
-versioned_target_package=$(grep ${target_package} package.json | sed -e 's#[[:space:]]\{1,\}\"\('${target_package}'\)\":[[:space:]]\{1,\}\"\(.*\)\",#\1@\2#' )
+# Extract the actual version pinned in yarn.lock
+# See: https://stackoverflow.com/questions/60454251/how-to-know-the-version-of-currently-installed-package-from-yarn-lock
+versioned_target_package=$(yarn list --pattern ${target_package} --depth=0 --json --non-interactive --no-progress | jq -r '.data.trees[].name')
 # Use yarn info to get URL checksums etc from the new registry
 yarn_info_output=$(yarn info --json $versioned_target_package 2>/dev/null)
-# Code below parses out the values we need
+# First check if the target version actually exists. 
+# If it doesn't exist there will be no .data.dist.tarball element,
+# and jq will output the string "null"
 package_tarball=$(echo $yarn_info_output | jq -r .data.dist.tarball)
+if [[ $package_tarball == "null" ]]; then
+    echo "FATAL: Target package version ($versioned_target_package) not found" >&2
+    exit 1
+fi
+# Code below parses out the values we need
 # When running inside a container, the registry can return a URL with the wrong host name due to proxying
 # so we need to check if that has happened and fix the URL if so.
 if ! [[ "${package_tarball}" =~ ^${local_npm_registry_url}.* ]]; then
@@ -33,6 +43,7 @@ package_integrity=$(echo $yarn_info_output | jq -r .data.dist.integrity)
 package_shasum=$(echo $yarn_info_output | jq -r .data.dist.shasum)
 package_resolved=${package_tarball}#${package_shasum}
 # Some strings need to be escaped so they work when passed to sed later
+escaped_package_integrity=$(printf '%s\n' "$package_integrity" | sed -e 's/[\/&]/\\&/g')
 escaped_package_resolved=$(printf '%s\n' "$package_resolved" | sed -e 's/[\/&]/\\&/g')
 escaped_target_package=$(printf '%s\n' "$target_package" | sed -e 's/[\/&]/\\&/g')
 if [ -n "$CERC_SCRIPT_VERBOSE" ]; then
@@ -44,4 +55,4 @@ fi
 # Use magic sed regex to replace the values in yarn.lock
 # Note: yarn.lock is not json so we can not use jq for this
 sed -i -e '/^\"'${escaped_target_package}'.*\":$/ , /^\".*$/ s/^\([[:space:]]\{1,\}resolved \).*$/\1'\"${escaped_package_resolved}\"'/' yarn.lock
-sed -i -e '/^\"'${escaped_target_package}'.*\":$/ , /^\".*$/ s/^\([[:space:]]\{1,\}integrity \).*$/\1'${package_integrity}'/' yarn.lock
+sed -i -e '/^\"'${escaped_target_package}'.*\":$/ , /^\".*$/ s/^\([[:space:]]\{1,\}integrity \).*$/\1'${escaped_package_integrity}'/' yarn.lock

app/data/container-build/cerc-eth-probe/build.sh

@@ -1,3 +1,4 @@
 #!/usr/bin/env bash
 # Build cerc/eth-probe
-docker build -t cerc/eth-probe:local ${CERC_REPO_BASE_DIR}/eth-probe
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+docker build -t cerc/eth-probe:local ${build_command_args} ${CERC_REPO_BASE_DIR}/eth-probe

app/data/container-build/cerc-eth-statediff-fill-service/build.sh

@@ -1,3 +1,4 @@
 #!/usr/bin/env bash
 # Build cerc/eth-statediff-fill-service
-docker build -t cerc/eth-statediff-fill-service:local ${CERC_REPO_BASE_DIR}/eth-statediff-fill-service
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+docker build -t cerc/eth-statediff-fill-service:local ${build_command_args} ${CERC_REPO_BASE_DIR}/eth-statediff-fill-service

app/data/container-build/cerc-eth-statediff-service/build.sh

@@ -1,3 +1,4 @@
 #!/usr/bin/env bash
 # Build cerc/eth-statediff-service
-docker build -t cerc/eth-statediff-service:local ${CERC_REPO_BASE_DIR}/eth-statediff-service
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+docker build -t cerc/eth-statediff-service:local ${build_command_args} ${CERC_REPO_BASE_DIR}/eth-statediff-service

app/data/container-build/cerc-fixturenet-eth-geth/Dockerfile

@@ -22,6 +22,6 @@ COPY run-el.sh /opt/testnet/run.sh
 RUN cd /opt/testnet && make genesis-el
 
 COPY --from=geth  /usr/local/bin/geth /usr/local/bin/
-RUN geth init /opt/testnet/build/el/geth.json && rm -f ~/.ethereum/geth/nodekey
+RUN geth --datadir ~/ethdata init /opt/testnet/build/el/geth.json && rm -f ~/ethdata/geth/nodekey
 
 ENTRYPOINT ["/opt/testnet/run.sh"]

app/data/container-build/cerc-fixturenet-eth-geth/build.sh

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 # Build cerc/fixturenet-eth-geth
 
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 
-docker build -t cerc/fixturenet-eth-geth:local -f ${SCRIPT_DIR}/Dockerfile $SCRIPT_DIR
+docker build -t cerc/fixturenet-eth-geth:local -f ${SCRIPT_DIR}/Dockerfile ${build_command_args} $SCRIPT_DIR

app/data/container-build/cerc-fixturenet-eth-geth/genesis/accounts/import_keys.sh

@@ -12,6 +12,6 @@ for line in `cat ../build/el/accounts.csv`; do
 
   echo ""
   echo "$ADDRESS"
-  geth account import --password .pw.$$ .key.$$
+  geth account import --datadir=~/ethdata --password .pw.$$ .key.$$
   rm -f .pw.$$ .key.$$
 done

app/data/container-build/cerc-fixturenet-eth-geth/run-el.sh

@@ -1,5 +1,9 @@
 #!/bin/bash
 
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+    set -x
+fi
+
 ETHERBASE=`cat /opt/testnet/build/el/accounts.csv | head -1 | cut -d',' -f2`
 NETWORK_ID=`cat /opt/testnet/el/el-config.yaml | grep 'chain_id' | awk '{ print $2 }'`
 NETRESTRICT=`ip addr | grep inet | grep -v '127.0' | awk '{print $2}'`
@@ -14,21 +18,41 @@ if [ "true" == "$CERC_REMOTE_DEBUG" ] && [ -x "/usr/local/bin/dlv" ]; then
     START_CMD="/usr/local/bin/dlv --listen=:40000 --headless=true --api-version=2 --accept-multiclient exec /usr/local/bin/geth --continue --"
 fi
 
+# See https://linuxconfig.org/how-to-propagate-a-signal-to-child-processes-from-a-bash-script
+cleanup() {
+    echo "Signal received, cleaning up..."
+
+    # Kill the child process first (CERC_REMOTE_DEBUG=true uses dlv which starts geth as a child process)
+    pkill -P ${geth_pid}
+    sleep 2
+    kill $(jobs -p)
+
+    wait
+    echo "Done"
+}
+trap 'cleanup' SIGINT SIGTERM
+
 if [ "true" == "$RUN_BOOTNODE" ]; then
     $START_CMD \
+       --datadir=~/ethdata \
       --nodekeyhex="${BOOTNODE_KEY}" \
       --nodiscover \
       --ipcdisable \
       --networkid=${NETWORK_ID} \
-      --netrestrict="${NETRESTRICT}"
+      --netrestrict="${NETRESTRICT}" \
+      &
+
+    geth_pid=$!
 else
     cd /opt/testnet/accounts
     ./import_keys.sh
-    
+
     echo -n "$JWT" > /opt/testnet/build/el/jwtsecret
 
     if [ "$CERC_RUN_STATEDIFF" == "detect" ] && [ -n "$CERC_STATEDIFF_DB_HOST" ]; then
-      if [ -n "$(dig $CERC_STATEDIFF_DB_HOST +short)" ]; then
+      dig_result=$(dig $CERC_STATEDIFF_DB_HOST +short)
+      dig_status_code=$?
+      if [[ $dig_status_code = 0 && -n $dig_result ]]; then
         echo "Statediff DB at $CERC_STATEDIFF_DB_HOST"
         CERC_RUN_STATEDIFF="true"
       else
@@ -62,21 +86,28 @@ else
       --statediff.db.port=$CERC_STATEDIFF_DB_PORT \
       --statediff.db.user=$CERC_STATEDIFF_DB_USER \
       --statediff.db.logstatements=${CERC_STATEDIFF_DB_LOG_STATEMENTS:-false} \
+      --statediff.db.copyfrom=${CERC_STATEDIFF_DB_COPY_FROM:-true} \
       --statediff.waitforsync=true \
       --statediff.writing=true"
     fi
 
     $START_CMD \
+      --datadir=~/ethdata \
       --bootnodes="${ENODE}" \
       --allow-insecure-unlock \
       --http \
       --http.addr="0.0.0.0" \
       --http.vhosts="*" \
-      --http.api="eth,web3,net,admin,personal,debug,statediff" \
+      --http.api="${CERC_GETH_HTTP_APIS:-eth,web3,net,admin,personal,debug,statediff}" \
       --http.corsdomain="*" \
       --authrpc.addr="0.0.0.0" \
       --authrpc.vhosts="*" \
       --authrpc.jwtsecret="/opt/testnet/build/el/jwtsecret" \
+      --ws \
+      --ws.addr="0.0.0.0" \
+      --ws.origins="*" \
+      --ws.api="${CERC_GETH_WS_APIS:-eth,web3,net,admin,personal,debug,statediff}" \
+      --http.corsdomain="*" \
       --networkid="${NETWORK_ID}" \
       --netrestrict="${NETRESTRICT}" \
       --gcmode archive \
@@ -89,5 +120,10 @@ else
       --metrics.addr="0.0.0.0" \
       --verbosity=${CERC_GETH_VERBOSITY:-3} \
       --vmodule="${CERC_GETH_VMODULE:-statediff/*=5}" \
-      --miner.etherbase="${ETHERBASE}" ${STATEDIFF_OPTS}
+      --miner.etherbase="${ETHERBASE}" ${STATEDIFF_OPTS} \
+      &
+
+    geth_pid=$!
 fi
+
+wait $geth_pid

app/data/container-build/cerc-fixturenet-eth-lighthouse/Dockerfile

@@ -27,4 +27,8 @@ RUN cd /opt/testnet && make genesis-cl
 # Work around some bugs in lcli where the default path is always used.
 RUN mkdir -p /root/.lighthouse && cd /root/.lighthouse && ln -s /opt/testnet/build/cl/testnet
 
+RUN mkdir -p /scripts
+COPY scripts/status-internal.sh /scripts
+COPY scripts/status.sh /scripts
+
 ENTRYPOINT ["/opt/testnet/run.sh"]

app/data/container-build/cerc-fixturenet-eth-lighthouse/build.sh

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 # Build cerc/fixturenet-eth-lighthouse
 
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 
-docker build -t cerc/fixturenet-eth-lighthouse:local -f ${SCRIPT_DIR}/Dockerfile $SCRIPT_DIR
+docker build -t cerc/fixturenet-eth-lighthouse:local -f ${SCRIPT_DIR}/Dockerfile ${build_command_args} $SCRIPT_DIR

app/data/container-build/cerc-fixturenet-eth-lighthouse/genesis/cl/beacon_node.sh

@@ -19,9 +19,9 @@ http_port=8001
 authrpc_port=8551
 
 exec lighthouse \
-  --debug-level $DEBUG_LEVEL \
   bn \
   $SUBSCRIBE_ALL_SUBNETS \
+  --debug-level $DEBUG_LEVEL \
   --boot-nodes "$ENR" \
   --datadir $data_dir \
   --testnet-dir $TESTNET_DIR \
@@ -38,4 +38,5 @@ exec lighthouse \
   --execution-jwt $JWTSECRET \
   --terminal-total-difficulty-override $ETH1_TTD \
   --suggested-fee-recipient $SUGGESTED_FEE_RECIPIENT \
-  --target-peers $((BN_COUNT - 1))
+  --target-peers $((BN_COUNT - 1)) \
+  --http-allow-sync-stalled \

app/data/container-build/cerc-fixturenet-eth-lighthouse/genesis/cl/bootnode.sh

@@ -21,14 +21,22 @@ if [ ! -f "$DATADIR/bootnode/enr.dat" ]; then
     --udp-port $BOOTNODE_PORT \
     --tcp-port $BOOTNODE_PORT \
     --genesis-fork-version $GENESIS_FORK_VERSION \
-    --output-dir $DATADIR/bootnode
+    --output-dir $DATADIR/bootnode-temp
 
-    bootnode_enr=`cat $DATADIR/bootnode/enr.dat`
-    echo "- $bootnode_enr" > $TESTNET_DIR/boot_enr.yaml
-    
-    echo "Generated bootnode enr and written to $TESTNET_DIR/boot_enr.yaml"
+  # Output ENR to a temp dir and mv as "lcli generate-bootnode-enr" will not overwrite an empty dir (mounted volume)
+  mkdir -p $DATADIR/bootnode
+  mv $DATADIR/bootnode-temp/* $DATADIR/bootnode
+  rm -r $DATADIR/bootnode-temp
+
+  echo "Generated bootnode enr"
+else
+  echo "Found existing bootnode enr"
 fi
 
+bootnode_enr=`cat $DATADIR/bootnode/enr.dat`
+echo "- $bootnode_enr" > $TESTNET_DIR/boot_enr.yaml
+echo "Written bootnode enr to $TESTNET_DIR/boot_enr.yaml"
+
 exec lighthouse boot_node \
     --testnet-dir $TESTNET_DIR \
     --port $BOOTNODE_PORT \

app/data/container-build/cerc-fixturenet-eth-lighthouse/genesis/cl/reset_genesis_time.sh

@@ -16,4 +16,4 @@ lcli \
   $TESTNET_DIR/genesis.ssz \
   $NOW
 
-echo "Reset genesis time to now ($NOW)"
+echo "Reset genesis time to ($NOW)"

app/data/container-build/cerc-fixturenet-eth-lighthouse/genesis/cl/validator_client.sh

@@ -21,9 +21,9 @@ while getopts "pd:" flag; do
 done
 
 exec lighthouse \
-  --debug-level $DEBUG_LEVEL \
   vc \
   $BUILDER_PROPOSALS \
+  --debug-level $DEBUG_LEVEL \
   --validators-dir $DATADIR/node_$NODE_NUMBER/validators \
   --secrets-dir $DATADIR/node_$NODE_NUMBER/secrets \
   --testnet-dir $TESTNET_DIR \

app/data/container-build/cerc-fixturenet-eth-lighthouse/run-cl.sh

@@ -1,12 +1,25 @@
 #!/bin/bash
 
-if [ "true" == "$RUN_BOOTNODE" ]; then 
+# See https://linuxconfig.org/how-to-propagate-a-signal-to-child-processes-from-a-bash-script
+cleanup() {
+    echo "Signal received, cleaning up..."
+    kill $(jobs -p)
+
+    wait
+    echo "Done"
+}
+trap 'cleanup' SIGINT SIGTERM
+
+if [ "true" == "$RUN_BOOTNODE" ]; then
     cd /opt/testnet/build/cl
     python3 -m http.server 3000 &
 
 
     cd /opt/testnet/cl
-    ./bootnode.sh 2>&1 | tee /var/log/lighthouse_bootnode.log
+    ./bootnode.sh 2>&1 | tee /var/log/lighthouse_bootnode.log &
+    bootnode_pid=$!
+
+    wait $bootnode_pid
 else
     while [ 1 -eq 1 ]; do
       echo "Waiting on geth ..."
@@ -25,7 +38,12 @@ else
     cd /opt/testnet/cl
 
     if [ -z "$LIGHTHOUSE_GENESIS_STATE_URL" ]; then
-        ./reset_genesis_time.sh
+        # Check if beacon node data exists to avoid resetting genesis time on a restart
+        if [ -d /opt/testnet/build/cl/node_"$NODE_NUMBER"/beacon ]; then
+            echo "Skipping genesis time reset"
+        else
+            ./reset_genesis_time.sh
+        fi
     else
         while [ 1 -eq 1 ]; do
             echo "Waiting on Genesis time ..."
@@ -54,10 +72,9 @@ else
     echo -n "$JWT" > $JWTSECRET
 
     ./beacon_node.sh 2>&1 | tee /var/log/lighthouse_bn.log &
-    lpid=$!
+    beacon_pid=$!
     ./validator_client.sh 2>&1 | tee /var/log/lighthouse_vc.log &
-    vpid=$!
+    validator_pid=$!
 
-    wait $lpid $vpid
+    wait $beacon_pid $validator_pid
 fi
-

app/data/container-build/cerc-fixturenet-eth-lighthouse/scripts/status-internal.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Wrapper to facilitate using status.sh inside the container
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+    set -x
+fi
+export LIGHTHOUSE_BASE_URL="http://fixturenet-eth-lighthouse-1:8001"
+export GETH_BASE_URL="http://fixturenet-eth-geth-1:8545"
+# See: https://stackoverflow.com/a/246128/1701505
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+$SCRIPT_DIR/status.sh

app/data/container-build/cerc-fixturenet-eth-lighthouse/scripts/status.sh

@@ -1,5 +1,7 @@
-#!/bin/bash
-
+#!/usr/bin/env bash
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+    set -x
+fi
 STATUSES=("geth to generate DAG" "beacon phase0" "beacon altair" "beacon bellatrix pre-merge" "beacon bellatrix merge")
 STATUS=0
 
@@ -7,18 +9,22 @@ STATUS=0
 LIGHTHOUSE_BASE_URL=${LIGHTHOUSE_BASE_URL}
 GETH_BASE_URL=${GETH_BASE_URL}
 
+# TODO: Docker commands below should be replaced by some interface into stack orchestrator
+# or some execution environment-neutral mechanism.
 if [ -z "$LIGHTHOUSE_BASE_URL" ]; then
-  LIGHTHOUSE_PORT=`docker ps -f "name=fixturenet-eth-lighthouse-1-1" --format "{{.Ports}}" | head -1 | cut -d':' -f2 | cut -d'-' -f1`
+  LIGHTHOUSE_CONTAINER=`docker ps -q -f "name=fixturenet-eth-lighthouse-1-1"`
+  LIGHTHOUSE_PORT=`docker port $LIGHTHOUSE_CONTAINER 8001 | cut -d':' -f2`
   LIGHTHOUSE_BASE_URL="http://localhost:${LIGHTHOUSE_PORT}"
 fi
 
 if [ -z "$GETH_BASE_URL" ]; then
-  GETH_PORT=`docker ps -f "name=fixturenet-eth-geth-1-1" --format "{{.Ports}}" | head -1 | cut -d':' -f2 | cut -d'-' -f1`
+  GETH_CONTAINER=`docker ps -q -f "name=fixturenet-eth-geth-1-1"`
+  GETH_PORT=`docker port $GETH_CONTAINER 8545 | cut -d':' -f2`
   GETH_BASE_URL="http://localhost:${GETH_PORT}"
 fi
 
 function inc_status() {
-  echo " DONE!"
+  echo " done"
   STATUS=$((STATUS + 1))
   if [ $STATUS -lt ${#STATUSES[@]} ]; then
     echo -n "Waiting for ${STATUSES[$STATUS]}..."

app/data/container-build/cerc-foundry/build.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# Build a local version of the foundry-rs/foundry image
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+docker build -t cerc/foundry:local -f ${CERC_REPO_BASE_DIR}/foundry/Dockerfile-debian ${build_command_args} ${CERC_REPO_BASE_DIR}/foundry

app/data/container-build/cerc-go-ethereum-foundry/Dockerfile

@@ -1,7 +1,9 @@
-FROM ghcr.io/foundry-rs/foundry
+# Note: cerc/foundry is Debian based
+FROM cerc/foundry:local
+
+RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+    && apt-get -y install --no-install-recommends jq curl netcat
 
-RUN apk update ; apk add --no-cache --allow-untrusted ca-certificates curl bash git jq
-RUN apk add --no-cache --upgrade grep
 WORKDIR /root
 
 ARG GENESIS_FILE_PATH=genesis.json

app/data/container-build/cerc-go-ethereum-foundry/build.sh

@@ -1,7 +1,9 @@
 #!/usr/bin/env bash
 # Build cerc/go-ethereum-foundry
 
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+
 # See: https://stackoverflow.com/a/246128/1701505
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 
-docker build -t cerc/go-ethereum-foundry:local --build-arg GENESIS_FILE_PATH=genesis-automine.json ${SCRIPT_DIR}
+docker build -t cerc/go-ethereum-foundry:local --build-arg GENESIS_FILE_PATH=genesis-automine.json ${build_command_args} ${SCRIPT_DIR}

app/data/container-build/cerc-go-ethereum/build.sh

@@ -1,3 +1,4 @@
 #!/usr/bin/env bash
 # Build cerc/go-ethereum
-docker build -t cerc/go-ethereum:local ${CERC_REPO_BASE_DIR}/go-ethereum
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+docker build -t cerc/go-ethereum:local ${build_command_args} ${CERC_REPO_BASE_DIR}/go-ethereum

app/data/container-build/cerc-ipld-eth-beacon-db/build.sh

@@ -1,3 +1,4 @@
 #!/usr/bin/env bash
 # Build cerc/ipld-eth-beacon-db
-docker build -t cerc/ipld-eth-beacon-db:local ${CERC_REPO_BASE_DIR}/ipld-eth-beacon-db
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+docker build -t cerc/ipld-eth-beacon-db:local ${build_command_args} ${build_command_args} ${CERC_REPO_BASE_DIR}/ipld-eth-beacon-db

app/data/container-build/cerc-ipld-eth-beacon-indexer/build.sh

@@ -1,3 +1,4 @@
 #!/usr/bin/env bash
 # Build cerc/ipld-eth-beacon-indexer
-docker build -t cerc/ipld-eth-beacon-indexer:local ${CERC_REPO_BASE_DIR}/ipld-eth-beacon-indexer
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+docker build -t cerc/ipld-eth-beacon-indexer:local ${build_command_args} ${CERC_REPO_BASE_DIR}/ipld-eth-beacon-indexer

app/data/container-build/cerc-ipld-eth-db/build.sh

@@ -1,3 +1,4 @@
 #!/usr/bin/env bash
 # Build cerc/ipld-eth-db
-docker build -t cerc/ipld-eth-db:local ${CERC_REPO_BASE_DIR}/ipld-eth-db
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+docker build -t cerc/ipld-eth-db:local ${build_command_args} ${CERC_REPO_BASE_DIR}/ipld-eth-db

app/data/container-build/cerc-ipld-eth-server/build.sh

@@ -1,3 +1,4 @@
 #!/usr/bin/env bash
 # Build cerc/ipld-eth-server
-docker build -t cerc/ipld-eth-server:local ${CERC_REPO_BASE_DIR}/ipld-eth-server
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+docker build -t cerc/ipld-eth-server:local ${build_command_args} ${CERC_REPO_BASE_DIR}/ipld-eth-server

app/data/container-build/cerc-keycloak/Dockerfile

@@ -1,4 +1,4 @@
 FROM quay.io/keycloak/keycloak:20.0
 WORKDIR /opt/keycloak/providers
 RUN curl -L https://github.com/aerogear/keycloak-metrics-spi/releases/download/2.5.3/keycloak-metrics-spi-2.5.3.jar --output keycloak-metrics-spi.jar
-RUN curl -L https://github.com/cerc-io/keycloak-api-key-demo/releases/download/v0.1/api-key-module-0.1.jar --output api-key-module.jar
+RUN curl -L https://github.com/cerc-io/keycloak-api-key-demo/releases/download/v0.3/api-key-module-0.3.jar --output api-key-module.jar

app/data/container-build/cerc-keycloak/build.sh

@@ -2,7 +2,9 @@
 #
 #Build cerc/keycloack
 
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+
 # See: https://stackoverflow.com/a/246128/1701505
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 
-docker build -t cerc/keycloak:local ${SCRIPT_DIR}
+docker build -t cerc/keycloak:local ${build_command_args} ${SCRIPT_DIR}

app/data/container-build/cerc-laconic-console-host/Dockerfile

@@ -0,0 +1,69 @@
+# Originally from: https://github.com/devcontainers/images/blob/main/src/javascript-node/.devcontainer/Dockerfile
+# [Choice] Node.js version (use -bullseye variants on local arm64/Apple Silicon): 18, 16, 14, 18-bullseye, 16-bullseye, 14-bullseye, 18-buster, 16-buster, 14-buster
+ARG VARIANT=18-bullseye
+FROM node:${VARIANT}
+
+ARG USERNAME=node
+ARG NPM_GLOBAL=/usr/local/share/npm-global
+
+# This container pulls npm packages from a local registry configured via these env vars
+ARG CERC_NPM_REGISTRY_URL
+ARG CERC_NPM_AUTH_TOKEN
+
+# Add NPM global to PATH.
+ENV PATH=${NPM_GLOBAL}/bin:${PATH}
+# Prevents npm from printing version warnings
+ENV NPM_CONFIG_UPDATE_NOTIFIER=false
+
+RUN \
+    # Configure global npm install location, use group to adapt to UID/GID changes
+    if ! cat /etc/group | grep -e "^npm:" > /dev/null 2>&1; then groupadd -r npm; fi \
+    && usermod -a -G npm ${USERNAME} \
+    && umask 0002 \
+    && mkdir -p ${NPM_GLOBAL} \
+    && touch /usr/local/etc/npmrc \
+    && chown ${USERNAME}:npm ${NPM_GLOBAL} /usr/local/etc/npmrc \
+    && chmod g+s ${NPM_GLOBAL} \
+    && npm config -g set prefix ${NPM_GLOBAL} \
+    && su ${USERNAME} -c "npm config -g set prefix ${NPM_GLOBAL}" \
+    # Install eslint
+    && su ${USERNAME} -c "umask 0002 && npm install -g eslint" \
+    && npm cache clean --force > /dev/null 2>&1
+
+# [Optional] Uncomment this section to install additional OS packages.
+RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+    && apt-get -y install --no-install-recommends jq
+
+# [Optional] Uncomment if you want to install an additional version of node using nvm
+# ARG EXTRA_NODE_VERSION=10
+# RUN su node -c "source /usr/local/share/nvm/nvm.sh && nvm install ${EXTRA_NODE_VERSION}"
+
+# We do this to get a yq binary from the published container, for the correct architecture we're building here
+COPY --from=docker.io/mikefarah/yq:latest /usr/bin/yq /usr/local/bin/yq
+
+RUN mkdir -p /scripts
+COPY ./apply-webapp-config.sh /scripts
+COPY ./start-serving-app.sh /scripts
+
+# [Optional] Uncomment if you want to install more global node modules
+# RUN su node -c "npm install -g <your-package-list-here>"
+
+# Configure the local npm registry
+RUN npm config set @cerc-io:registry ${CERC_NPM_REGISTRY_URL} \
+    && npm config set @lirewine:registry ${CERC_NPM_REGISTRY_URL} \
+    && npm config set -- ${CERC_NPM_REGISTRY_URL}:_authToken ${CERC_NPM_AUTH_TOKEN}
+
+RUN mkdir -p /config
+COPY ./config.yml /config
+
+# Install simple web server for now (use nginx perhaps later)
+RUN yarn global add http-server
+
+# Globally install the payload web app package
+RUN yarn global add @cerc-io/console-app
+
+# Expose port for http
+EXPOSE 80
+
+# Default command sleeps forever so docker doesn't kill it
+CMD ["/scripts/start-serving-app.sh"]

app/data/container-build/cerc-laconic-console-host/apply-webapp-config.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+    set -x
+fi
+if [[ $# -ne 2 ]]; then
+    echo "Illegal number of parameters" >&2
+    exit 1
+fi
+config_file_name=$1
+webapp_files_dir=$2
+if ! [[ -f ${config_file_name} ]]; then
+    echo "Config file ${config_file_name} does not exist" >&2
+    exit 1
+fi
+if ! [[ -d ${webapp_files_dir} ]]; then
+    echo "Webapp directory ${webapp_files_dir} does not exist" >&2
+    exit 1
+fi
+# First some magic using yq to translate our yaml config file into an array of key value pairs like:
+# LACONIC_HOSTED_CONFIG_<path-through-objects>=<value>
+readarray -t config_kv_pair_array < <( yq '.. | select(length > 2) | ([path | join("_"), .] | join("=") )' ${config_file_name} | sed 's/^/LACONIC_HOSTED_CONFIG_/' )
+declare -p config_kv_pair_array
+# Then iterate over that kv array making the template substitution in our web app files
+for kv_pair_string in "${config_kv_pair_array[@]}"
+do
+    kv_pair=(${kv_pair_string//=/ })
+    template_string_to_replace=${kv_pair[0]}
+    template_value_to_substitute=${kv_pair[1]}
+    template_value_to_substitute_expanded=${template_value_to_substitute//LACONIC_HOSTED_ENDPOINT/${LACONIC_HOSTED_ENDPOINT}}
+    # Run find and sed to do the substitution of one variable over all files
+    # See: https://stackoverflow.com/a/21479607/1701505
+    echo "Substituting: ${template_string_to_replace} = ${template_value_to_substitute_expanded}"
+    # Note: we do not escape our strings, on the expectation they do not container the '#' char.
+    find ${webapp_files_dir} -type f -exec sed -i 's#'${template_string_to_replace}'#'${template_value_to_substitute_expanded}'#g' {} +
+done

app/data/container-build/cerc-laconic-console-host/build.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Build cerc/laconic-registry-cli
+
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+
+# See: https://stackoverflow.com/a/246128/1701505
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+docker build -t cerc/laconic-console-host:local ${build_command_args} -f ${SCRIPT_DIR}/Dockerfile \
+  --add-host gitea.local:host-gateway \
+  --build-arg CERC_NPM_AUTH_TOKEN --build-arg CERC_NPM_REGISTRY_URL ${SCRIPT_DIR}

app/data/container-build/cerc-laconic-console-host/config.yml

@@ -0,0 +1,6 @@
+# Config for laconic-console running in a fixturenet with laconicd
+
+services:
+  wns:
+    server: 'LACONIC_HOSTED_ENDPOINT:9473/api'
+    webui: 'LACONIC_HOSTED_ENDPOINT:9473/console'

app/data/container-build/cerc-laconic-console-host/start-serving-app.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+if [ -n "$CERC_SCRIPT_DEBUG" ]; then
+    set -x
+fi
+# TODO: Don't hard wire this:
+webapp_files_dir=/usr/local/share/.config/yarn/global/node_modules/@cerc-io/console-app/dist/production
+/scripts/apply-webapp-config.sh /config/config.yml ${webapp_files_dir}
+http-server -p 80 ${webapp_files_dir}

app/data/container-build/cerc-laconic-registry-cli/Dockerfile

@@ -1,17 +1,19 @@
 # Originally from: https://github.com/devcontainers/images/blob/main/src/javascript-node/.devcontainer/Dockerfile
 # [Choice] Node.js version (use -bullseye variants on local arm64/Apple Silicon): 18, 16, 14, 18-bullseye, 16-bullseye, 14-bullseye, 18-buster, 16-buster, 14-buster
-ARG VARIANT=16-bullseye
+ARG VARIANT=18-bullseye
 FROM node:${VARIANT}
 
 ARG USERNAME=node
 ARG NPM_GLOBAL=/usr/local/share/npm-global
 
 # This container pulls npm packages from a local registry configured via these env vars
-ARG CERC_NPM_URL
+ARG CERC_NPM_REGISTRY_URL
 ARG CERC_NPM_AUTH_TOKEN
 
 # Add NPM global to PATH.
 ENV PATH=${NPM_GLOBAL}/bin:${PATH}
+# Prevents npm from printing version warnings
+ENV NPM_CONFIG_UPDATE_NOTIFIER=false
 
 RUN \
     # Configure global npm install location, use group to adapt to UID/GID changes
@@ -40,18 +42,22 @@ RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
 # RUN su node -c "npm install -g <your-package-list-here>"
 
 # Configure the local npm registry
-RUN npm config set @lirewine:registry ${CERC_NPM_URL} \
-    && npm config set @cerc-io:registry ${CERC_NPM_URL} \
-    && npm config set @lirewine:registry ${CERC_NPM_URL} \
-    && npm config set -- ${CERC_NPM_URL}:_authToken ${CERC_NPM_AUTH_TOKEN}
+RUN npm config set @cerc-io:registry ${CERC_NPM_REGISTRY_URL} \
+    && npm config set @lirewine:registry ${CERC_NPM_REGISTRY_URL} \
+    && npm config set -- ${CERC_NPM_REGISTRY_URL}:_authToken ${CERC_NPM_AUTH_TOKEN}
 
 # TODO: the image at this point could be made a base image for several different CLI images
 # that install different Node-based CLI commands
 
-# DEBUG, remove
-RUN yarn info @cerc-io/laconic-registry-cli
-
 # Globally install the cli package
 RUN yarn global add @cerc-io/laconic-registry-cli
 
-ENTRYPOINT ["laconic"]
+# Add scripts
+RUN mkdir /scripts
+ENV PATH="${PATH}:/scripts"
+COPY ./create-demo-records.sh /scripts
+COPY ./import-key.sh /scripts
+COPY ./import-address.sh /scripts
+
+# Default command sleeps forever so docker doesn't kill it
+CMD ["sh", "-c", "while :; do sleep 600; done"]