feat: move faucet account onto the controller where it is safer

packages/deployment/ansible/roles/cosmos-genesis/tasks/main.yml

@@ -1,15 +1,38 @@
-- name: "Check faucet exists"
-  become: yes
-  become_user: "{{ service }}"
-  shell: "ag-cosmos-helper keys show --keyring-backend=test faucet"
-  ignore_errors: true
-  register: faucet_exists
+- name: "Create val.sh"
+  delegate_to: localhost
+  template:
+    src: val.sh.j2
+    dest: "{{ SETUP_HOME + '/val.sh' }"
+    mode: '755'
 
-- name: "Create faucet account for {{ service }}"
-  become: yes
-  become_user: "{{ service }}"
-  shell: "ag-cosmos-helper keys add --keyring-backend=test faucet"
-  when: faucet_exists.rc != 0
+- name: "Create provision.sh"
+  delegate_to: localhost
+  template:
+    src: provision.sh.j2
+    dest: "{{ SETUP_HOME + '/provision.sh' }"
+    mode: '755'
+
+- set_fact:
+    faucet: "{{ lookup('file', SETUP_HOME + '/faucet/address.txt', errors='ignore') }}"
+
+- name: "Create faucet account"
+  delegate_to: localhost
+  shell: "ag-cosmos-helper --home={{ SETUP_HOME + '/faucet' }} --keyring-backend=test keys add faucet < /dev/null"
+  when: not faucet
+
+- name: "Extract faucet address"
+  delegate_to: localhost
+  shell: "ag-cosmos-helper --home={{ SETUP_HOME + '/faucet' }} --keyring-backend=test keys show -a faucet > {{ SETUP_HOME + '/faucet/address.txt' }}"
+  when: not faucet
+
+- set_fact:
+    faucet: "{{ lookup('file', SETUP_HOME + '/faucet/address.txt') }}"
+
+- name: "Set faucet chain params"
+  delegate_to: localhost
+  shell: "ag-cosmos-helper --home={{ SETUP_HOME + '/faucet' }} config chain-id {{ CHAIN_NAME }} && \
+    ag-cosmos-helper --home={{ SETUP_HOME + '/faucet' }} config node tcp://{{ hostvars[STAKER_NODE]['ansible_host'] }}:26657 && \
+    ag-cosmos-helper --home={{ SETUP_HOME + '/faucet' }} config keyring-backend test"
 
 - name: "Check {{ STAKER }}-{{ STAKER_NODE }} exists"
   become: yes
@@ -34,13 +57,12 @@
     - "/home/{{ service }}/.{{ service }}/config/gentx"
     - "/home/{{ service }}/validator-txes.txt"
 
-- name: "Add faucet coins to {{ service }}"
+- name: "Add faucet coins to {{ service }} genesis account"
   become: yes
   become_user: "{{ service }}"
   shell: "\
     {{ service }} add-genesis-account \
-      $(ag-cosmos-helper keys show --keyring-backend=test faucet -a) \
-      {{ STAKER_TOKENS }},{{ BOOTSTRAP_TOKENS }}"
+      {{ faucet }} {{ STAKER_TOKENS }},{{ BOOTSTRAP_TOKENS }}"
   ignore_errors: true
 
 - name: "Add {{ STAKER_AMOUNT }} coins to {{ STAKER }}-{{ STAKER_NODE }}"

packages/deployment/ansible/roles/cosmos-genesis/templates/provision.sh.j2

@@ -0,0 +1,12 @@
+#! /bin/bash
+set -e
+
+thisdir=$(dirname -- "$0")
+
+UNIQUE=$1
+ADDR=$2
+NAME=$3
+
+exec ag-cosmos-helper --home=$thisdir/faucet tx swingset provision-one \
+ --yes --gas=auto --gas-adjustment=1.5 --broadcast-mode=block --from=faucet -- \
+ "$NAME" "$ADDR"

packages/deployment/ansible/roles/cosmos-genesis/templates/val.sh.j2

@@ -0,0 +1,42 @@
+#! /bin/bash
+set -e
+
+thisdir=$(dirname -- "$0")
+MAX_LINES=-1
+
+STAKE=50000000uagstake
+UNIQUE=$1
+ADDR=$2
+NAME=$3
+
+case "$ADDR$NAME" in
+                *\'*) echo 1>&2 'Exploded!'; exit 1 ;;
+        esac
+
+[[ -n $NAME ]] || exit 1
+
+if [[ $UNIQUE != no && $MAX_LINES -ge 0 && $(wc -l $thisdir/cosmos-delegates.txt | sed -e 's/ .*//') -ge $MAX_LINES ]]; then
+        echo "Sorry, we've capped the number of validators at $MAX_LINES"
+        exit 1
+fi
+if [[ $UNIQUE != no ]]; then
+        line=$(grep -e ":$NAME$" $thisdir/cosmos-delegates.txt || true)
+  if [[ -n $line ]]; then
+        echo "$NAME has already tapped the faucet:" 1>&2
+        echo "$line" 1>&2
+        exit 1
+
+  fi
+fi
+if [[ $UNIQUE != no ]]; then
+        line=$(grep -e "^$ADDR:" $thisdir/cosmos-delegates.txt || true)
+        if [[ -n $line ]]; then
+          echo "$ADDR already received a tap:" 1>&2
+          echo "$line" 1>&2
+          exit 1
+        fi
+fi
+
+ag-cosmos-helper --home=$thisdir/faucet -- tx send faucet "$ADDR" "$STAKE"
+sed -i -e "/:$NAME$/d" $thisdir/cosmos-delegates.txt
+echo "$ADDR:$STAKE:$NAME" >> $thisdir/cosmos-delegates.txt

packages/deployment/ansible/roles/cosmos-validators/tasks/main.yml

@@ -2,7 +2,7 @@
   become: yes
   become_user: "{{ service }}"
   delegate_to: "{{ STAKER_NODE }}"
-  shell: "ag-cosmos-helper keys show --keyring-backend=test {{ STAKER }}-{{ inventory_hostname }}"
+  shell: "ag-cosmos-helper keys show --keyring-backend=test -a {{ STAKER }}-{{ inventory_hostname }}"
   ignore_errors: true
   register: staker_exists
 
@@ -15,16 +15,19 @@
     staker: "{{ STAKER }}-{{ inventory_hostname }}"
   when: inventory_hostname != STAKER_NODE and staker_exists.rc != 0
 
-- name: "Transfer {{ STAKER_AMOUNT }} to {{ STAKER }}-*"
+- name: "Check {{ STAKER }}-* exists"
+  become: yes
   become_user: "{{ service }}"
-  become: true
   delegate_to: "{{ STAKER_NODE }}"
+  shell: "ag-cosmos-helper keys show --keyring-backend=test -a {{ STAKER }}-{{ inventory_hostname }}"
+  register: staker_address
+
+- name: "Transfer {{ STAKER_AMOUNT }} to {{ STAKER }}-*"
+  delegate_to: localhost
   shell: "\
-    ag-cosmos-helper tx send --keyring-backend=test \
-      faucet \
-      $(ag-cosmos-helper keys show --keyring-backend=test {{ staker }} -a) \
-      {{ STAKER_AMOUNT }} \
-      --chain-id={{ CHAIN_NAME }} --broadcast-mode=block --yes"
+    ag-cosmos-helper --home={{ SETUP_HOME + '/faucet' }} \
+     tx send faucet {{ staker_address.stdout }} {{ STAKER_AMOUNT }} \
+      --broadcast-mode=block --yes"
   vars:
     staker: "{{ STAKER }}-{{ inventory_hostname }}"
   when: inventory_hostname != STAKER_NODE