Runtime deployment detection for fund-moving defaults.
Money-moving code fails closed in production. "Production" here means running
as a deployed OTP release: mix release sets RELEASE_NAME in the boot
environment and it survives into the running node, unlike Mix.env/0, which
is not available at runtime in a release. Development, tests, and mix run do
not set it, so their behaviour is unchanged.
Override with config :raxol_payments, :deployment, :production | :development
or the RAXOL_PAYMENTS_DEPLOYMENT env var ("production" / "development") --
primarily so tests can exercise the production path.
Summary
Functions
Raise in production when this node participates in plain (non-TLS) Erlang
distribution. Call at boot in a fund-moving deployment so a misconfigured
cluster halts instead of exposing the wallet over cookie-only distribution.
Override with RAXOL_ALLOW_INSECURE_DISTRIBUTION=true (or
config :raxol_payments, :allow_insecure_distribution, true).
Raise in production when a signing node also exposes the interactive REPL.
True when Erlang distribution is disabled or running over TLS.
True when running as a deployed release (or forced via override).
Functions
@spec assert_distribution_secure!() :: :ok
Raise in production when this node participates in plain (non-TLS) Erlang
distribution. Call at boot in a fund-moving deployment so a misconfigured
cluster halts instead of exposing the wallet over cookie-only distribution.
Override with RAXOL_ALLOW_INSECURE_DISTRIBUTION=true (or
config :raxol_payments, :allow_insecure_distribution, true).
@spec assert_signing_isolated!() :: :ok
Raise in production when a signing node also exposes the interactive REPL.
Evaluating code on a node that holds signing keys is a capability-escape
surface (see Raxol.REPL.Sandbox): keep the REPL and the wallet on separate
nodes. A deployment that exposes the REPL sets RAXOL_REPL_EXPOSED=true (or
config :raxol_payments, :repl_exposed, true); a signing deployment calls
this at boot to refuse that co-location.
@spec distribution_tls?() :: boolean()
True when Erlang distribution is disabled or running over TLS.
A distributed node on the default cookie transport is reachable by any node
that holds the cookie and can invoke any exported function or read any ETS
table, so a signing node must run distribution over -proto_dist inet_tls
(per-node certs), not a shared magic cookie.
@spec production?() :: boolean()
True when running as a deployed release (or forced via override).
Fund-moving defaults (require_policy, require_checkpoint, the env-var
wallet) key off this to fail closed in production while staying permissive in
development and tests.