playbook: deploy tysm canary configs from templates

ansible/inventories/devnet-0/templates/tysm/tysm-hooks.yaml.j2

@@ -0,0 +1,88 @@
+# tysm hook-control config for {{ inventory_hostname }}. ${TYSM_TOKEN} resolves from the
+# beacon container env at load; it must equal the token bad-tysm validates with.
+api:
+  enabled: true
+  listen: "0.0.0.0:8675"
+  auth_token: "${TYSM_TOKEN}"
+  max_activation_duration: "4h"
+  instance_id: "{{ inventory_hostname }}"
+
+discovery:
+  enabled: true
+  bad_tysm_url: "https://bad-tysm.analytics.production.platform.ethpandaops.io"
+  auth_token: "${TYSM_TOKEN}"
+  # Address bad-tysm dials back to reach this node's control API. Reachable only
+  # once 8675 is published on the host and opened in the devnet firewall.
+  self_url: "http://{{ ansible_host }}:8675"
+  name: "{{ inventory_hostname }}"
+  namespace: "{{ ethereum_network_name }}"
+  pod: "{{ inventory_hostname }}"
+  node_name: "{{ inventory_hostname }}"
+  heartbeat_interval: "30s"
+  labels:
+    network: "{{ ethereum_network_name }}"
+    cl: "{{ ethereum_node_cl }}"
+    el: "{{ ethereum_node_el }}"
+
+hook_logging:
+  enabled: true
+  classes: ["validate", "mutate"]
+
+hooks:
+  - name: epbs-mutator
+    enabled: false
+    config:
+      mutationDelayMs: 0
+      logMutationDetails: true
+      topics:
+        execution_payload_bid:
+          enabledStrategies: []
+          mutationProbability: 0.0
+          slotPattern: "*"
+          strategies:
+            drop:
+              applyProbability: 1.0
+            value_inflate:
+              mode: "uint64_max"
+              absolute: 0
+              multiplier: 10.0
+        execution_payload_envelope:
+          enabledStrategies: []
+          mutationProbability: 0.0
+          slotPattern: "*"
+          strategies:
+            withhold:
+              probability: 1.0
+              slotPattern: "*"
+            delay:
+              delayMs: 9500
+              jitterMs: 0
+              applyProbability: 1.0
+            selective_drop:
+              targetPeerRole: ""
+              dropRate: 0.4
+              seed: 42
+            free_option:
+              triggerSource: "unix_socket"
+              socketPath: "/tmp/tysm-mev-trigger.sock"
+              httpURL: ""
+              defaultState: false
+              pollIntervalMs: 100
+        payload_attestation_message:
+          enabledStrategies: []
+          mutationProbability: 0.0
+          slotPattern: "*"
+          strategies:
+            flip_bit:
+              field: "payload_present"
+              targetValue: "false"
+            corrupt_field:
+              field: "beacon_block_root"
+              mode: "random_32"
+            drop:
+              applyProbability: 1.0
+              targetPeerRole: ""
+              targetValidators: []
+            delay:
+              delayMs: 12000
+              applyProbability: 1.0

ansible/inventories/devnet-0/templates/tysm/tysm-xatu-config.yaml.j2

@@ -0,0 +1,16 @@
+# Minimal Xatu config: every tysm beacon requires --xatu-config-file to start.
+# The xatu hook is disabled and this output points at a local no-op address that
+# is never required to connect; devnet events still ship via the xatu-sentry sidecar.
+name: "{{ inventory_hostname }}"
+
+ethereum:
+  network: "{{ ethereum_network_name }}"
+
+outputs:
+  - name: noop
+    type: xatu
+    config:
+      address: localhost:19999
+      tls: false
+      maxQueueSize: 1000
+      batchTimeout: 5s

ansible/playbook.yaml

@@ -85,6 +85,38 @@
     - role: ethpandaops.general.generate_basic_auth_nginx
       tags: [docker_nginx_proxy]
 
+# Hosts running the tysm beacon canary (tysm_enabled in host_vars) need the
+# hook + xatu config files in the prysm datadir before the container starts.
+- hosts: ethereum_node
+  become: true
+  tasks:
+    - name: Deploy tysm config files
+      when: tysm_enabled | default(false)
+      tags: [ethereum, ethereum_node, tysm]
+      block:
+        - name: Add prysm user
+          ansible.builtin.user:
+            name: "{{ prysm_user | default('prysm') }}"
+
+        - name: Create prysm data dir
+          ansible.builtin.file:
+            path: "{{ prysm_datadir | default('/data/prysm') }}"
+            state: directory
+            mode: "0750"
+            owner: "{{ prysm_user | default('prysm') }}"
+            group: "{{ prysm_user | default('prysm') }}"
+
+        - name: Template tysm config files
+          ansible.builtin.template:
+            src: "{{ inventory_dir }}/templates/tysm/{{ item }}.j2"
+            dest: "{{ prysm_datadir | default('/data/prysm') }}/{{ item }}"
+            mode: "0640"
+            owner: "{{ prysm_user | default('prysm') }}"
+            group: "{{ prysm_user | default('prysm') }}"
+          loop:
+            - tysm-hooks.yaml
+            - tysm-xatu-config.yaml
+
 - hosts: ethereum_node
   become: true
   roles: