secure private key delivery from web3 wallet to Sovryn Node (arbitrary project in Akash). Suggest unified approach to secure secrets in Akash deployments
3. Create wallet in RSK blockchain and export keys
To trade on Sovryn, you will need to set up a Web3 wallet that is compatible with the RSK chain (Rootstock).
Testnet Wallet setup
3.1 Go to the Metamask website and download the latest version of the Metamask Wallet extension.
3.2 Install and have the Metamask extension active in your browser.
3.3 Open Metamask and register on it. (Do not forget to save your recovery phrase!)
3.4 Click the circle in the upper right of the wallet → Settings → Networks → click the Add Network button and enter the following RSK Network settings.
3.7 Save your public key from Metamask and export your private key: → Account → Account Details → Export private key. That will be your credentials of the liquidator/rollover/arbitrage wallets credentials
docker run -p 3000:3000 [DockerHub account name]/[DockerHub repo name]:latest
sarasioux found that Akash may have cache issues during image rebuild/application redeploy. Use proper tagging to avoid such issues and to make sure you deploy proper version of your application.
5.5 Login to DockerHub with AccessKey and push your image
A private key is a sophisticated form of cryptography that allows a user to access their cryptocurrency.
Original Sovryn Node repository keeps private key [or private key password] in a clear text format in accounts.js file (or in *.yml file EVN section).
The following guidline aims to protect private key using HashiCorp Vault. The wrapped secret can be unwrapped using the single-use wrapping token. Even the user or the system created the initial token won’t see the original value.
Key principles are:
Avoid storing crypto wallet private key in a repo and in an image
Try to avoid using long lived Vault access tokens in a running Akash container
We use Vault’s cubbyhole response wrapping approach where the initial token is stored in the cubbyhole secrets engine. The wrapped secret can be unwrapped using the single-use wrapping token. Even the user or the system created the initial token won’t see the original value. The wrapping token is short-lived and can be revoked just like any other tokens so that the risk of unauthorized access can be minimized.
All secrets are namespaced under your token. If that token expires or is revoked, all the secrets in its cubbyhole are revoked as well.
It is not possible to reach into another token’s cubbyhole even as the root user. This is an important difference between the cubbyhole and the key/value secrets engine. The secrets in the key/value secrets engine are accessible to any token for as long as its policy allows it.
Benefits of using the response wrapping:
It provides cover by ensuring that the value being transmitted across the wire is not the actual secret. It’s a reference to the secret.
It provides malfeasance detection by ensuring that only a single party can ever unwrap the token and see what’s inside
Define environment variables, authenticate and create new access token.
#!/bin/bash
# Export env variables for Vault
export VAULT_ADDR="https://vault-cluster.vault.[VAULT PUBLIC ADDRESS].aws.hashicorp.cloud:8200"
export VAULT_NAMESPACE="admin"
# Login via admin token
vault login [VAULT ADMIN TOKEN]
# Create a policy for the node
cat << EOF > node-policy.hcl
path "secret/data/dev" {
capabilities = [ "read" ]
}
EOF
vault policy write node-policy node-policy.hcl
# Enable key/value v2 secrets engine at secret/ if it's not enabled already
vault secrets enable -path=secret kv-v2
# Write some secret at secret/dev
vault kv put secret/dev private="my-private-data"
# Generating one-time token that'll be used on a node
ONETIME_TOKEN=`vault token create -use-limit=2 | grep -w token | awk '{print $2}'`
# Generating wrapping token that'll be used for retrieving the secret
WRAPPING_TOKEN=`vault token create -policy=node-policy -wrap-ttl=300 | grep -w "wrapping_token:" | awk '{print $2}'`
# Store wrapping token in a cubbyhole storage using newly generated token that'll expire in the next one use
VAULT_TOKEN="$ONETIME_TOKEN" vault write cubbyhole/private/access-token token="$WRAPPING_TOKEN"
# Copy this token to a node to get wrapping token
echo "Use this token on a node: $ONETIME_TOKEN"
