| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
A wallet holding leftovers of both eras selects proofs from each, and the two
mints cannot co-sign one melt, so such wallets were stuck for good behind the
"melt them separately" error. Drop the old inputs and melt the new ones. The
old proofs stay unspent at the old mint while the wallet treats them as spent,
so each one is recorded with its keyset, amount, secret hash and whether it
carried DLEQ; they were only redeemable through the recovery path anyway.
Also stop the routing tables from going empty. The hourly refresh is exempt
from the mints' per-ip limiter, so it now seeds the last-good keyset lists the
client-facing /v1/keysets falls back on, and a start that races the mints
coming up retries every 15s rather than waiting out the hour -- an empty old
list makes every old-ecash melt look new and routes it to the wrong mint.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
|
| |
|
|
|
|
|
|
|
|
| |
Keyset fetches counted against the demux's own socket IP at both mints,
so the shared per-IP bucket tripped under load and wallets received an
empty keyset list. Forward the client's key, serve each mint's last-good
list when its upstream fails, and mark the demux's own hourly refresh as
loopback so the mints' limiter exempts it.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
/v1/ws proxy
Forward cf-connecting-ip (or first x-forwarded-for) upstream so the mints' per-IP
rate limiter buckets by the real client instead of demux's socket IP. Partner
hosts that funnel many users through one IP can be listed in whitelist.json with
a pool size; their bucket key rotates across pool synthetic keys for a
proportionally larger allowance. Reloaded every 60s. Also proxy /v1/ws
(subscriptions) through to the new mint.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Melts routed to the retired mint were failing before their proofs were
even read: wallets blind their fee-return change outputs to the current
active keyset, which the old mint doesn't know and rejects outright.
Strip change outputs on that path (recovery melts forfeit change).
Also map the caller's melt quote id to the old mint's re-quoted id so
melt responses and GET status polls report against the id the wallet
knows, and log the connecting IP on the recovery path.
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
|
|
|
|
| |
The old mint's keysets are redeem/melt-only — wallets must never mint or swap
into them. Force active:false in the merged /v1/keysets so mint.coinos.io
advertises a single active sat keyset (the new one) instead of two. The old mint
is panic-locked (mint/swap disabled) regardless; this fixes the client-facing
view a reviewer flagged.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Front the current mint (fresh keys, normal ops) as primary, and transparently
route pre-shutdown ecash melts to the retired panic-mode mint so wallets can melt
old ecash at mint.coinos.io without changing their URL:
- /v1/keysets is the union of both mints' keysets
- /v1/keys/<id> and melt execute route by the keyset owner
- a melt quote is taken on the primary and the invoice remembered, so an
old-keyset melt is re-quoted and executed on the recovery mint (where panic
mode gates blacklisted funds)
- /v1/checkstate is merged across both; CORS added for web wallets
The recovery mint also stands alone at mintrecovery.coinos.io.
|
|
|
- meltguard: out-of-band CLNRest spend limiter (per-melt cap + cumulative
hard-freeze) that sits between the panic-mode mint and the node
- mintdemux: fronts the mint hostname, routing between the retired and current
mint instances after the hostname swap
- gitignore *.bak / *.bak-* so local backups (some hold secrets) never commit
Co-Authored-By: Claude Opus 4.8 <[email protected]>
|
