Files
openlaunch/app/scripts/fly-secrets.sh
Kevin Codex 34f0b0407b arc: final review round (live fees, silent skips, unindexed chains)
- Arc gas reserves sized to launch-day fees with margin: the base fee ran
  ~80 gwei plus ~30 gwei tips (measured), four times the 20 gwei floor the
  reserves were sized at, so a first buy right after a launch could have
  failed for gas. Launch reserve 1 USDC, swap reserve 0.2 USDC; blurb updated.
- the single-token holder skip logs an alert and says what stays off; the
  "holds only gas" copy is right where the quote is the gas token
- /api/health flags a configured chain the indexer has never run for; the
  secrets script requires the Arc locker, deploy block and RPC once the Arc
  factory is set, so Arc cannot go live unindexed
- the sync-lag alert threshold is per chain (block times differ ~20x) with
  the global and per-chain env overrides
- LAUNCH_SYNC_CONFIRMATIONS_ARC stays pushable as an override
2026-09-16 21:32:06 +08:00

34 lines
2.6 KiB
Bash
Executable File

#!/usr/bin/env bash
# Stage runtime secrets on Fly for this app, reading EVERY value independently from one env file
# (default ./.env.production — see .env.example for the keys; never committed, never printed).
# DATABASE_URL is set by `fly postgres attach`, the image bucket by `fly storage create` — not here.
# Staged secrets apply on the next `fly deploy`. Re-runnable.
# FLY_APP = Fly app name (default: basebid — the live openlaunch.lol app)
# SECRETS_ENV = file to read (default: .env.production)
# --dry-run = print what would be staged, do not call fly
set -euo pipefail
cd "$(dirname "$0")/.."
APP=${FLY_APP:-basebid}
FILE=${SECRETS_ENV:-.env.production}
DRY=0; [[ "${1:-}" == "--dry-run" ]] && DRY=1
[ -f "$FILE" ] || { echo "missing $FILE — copy .env.example to $FILE and fill in the production values"; exit 1; }
val() { { grep -E "^$1=" "$FILE" || true; } | head -1 | cut -d= -f2- | sed 's/^"//;s/"$//'; }
REQUIRED=(BASE_RPC_URL ROBINHOOD_RPC_URL NEXT_PUBLIC_SITE_URL NEXT_PUBLIC_LAUNCH_FACTORY NEXT_PUBLIC_LAUNCH_LOCKER LAUNCH_DEPLOY_BLOCK NEXT_PUBLIC_LAUNCH_FACTORY_ROBINHOOD NEXT_PUBLIC_LAUNCH_LOCKER_ROBINHOOD LAUNCH_DEPLOY_BLOCK_ROBINHOOD)
# Arc: ARC_RPC_URL (Alchemy) and the contract settings become required once the factory is deployed there; until then the site shows
# Arc as "Coming soon" and the server falls back to the public RPC.
OPTIONAL=(ARC_RPC_URL NEXT_PUBLIC_LAUNCH_FACTORY_ARC NEXT_PUBLIC_LAUNCH_LOCKER_ARC LAUNCH_DEPLOY_BLOCK_ARC BASE_B20_RPC_URL LAUNCH_SYNC_CONFIRMATIONS LAUNCH_SYNC_CONFIRMATIONS_ARC LAUNCH_SYNC_LOOP ADMIN_WALLETS IMAGE_PUBLIC_BASE)
# Once the Arc factory is set, its locker, deploy block and RPC are required too: without the deploy block the indexer never
# runs for Arc and the site would show a chain it does not index.
if [ -n "$(val NEXT_PUBLIC_LAUNCH_FACTORY_ARC)" ]; then REQUIRED+=(NEXT_PUBLIC_LAUNCH_LOCKER_ARC LAUNCH_DEPLOY_BLOCK_ARC ARC_RPC_URL); fi
args=(); missing=()
for k in "${REQUIRED[@]}"; do v=$(val "$k"); if [ -n "$v" ]; then args+=("$k=$v"); echo " staged $k"; else missing+=("$k"); fi; done
for k in "${OPTIONAL[@]}"; do v=$(val "$k"); if [ -n "$v" ]; then args+=("$k=$v"); echo " staged $k"; else echo " skip $k (not set)"; fi; done
if [ ${#missing[@]} -gt 0 ]; then echo "missing required keys in $FILE: ${missing[*]}"; exit 1; fi
if [ $DRY -eq 1 ]; then echo "dry run: ${#args[@]} secrets would be staged on app '$APP' (values not shown)"; exit 0; fi
fly secrets set -a "$APP" --stage "${args[@]}" >/dev/null
echo "done: ${#args[@]} secrets staged on '$APP'. NEXT_PUBLIC_LAUNCH_* are also BUILD args (see the fly.toml header)."