Geomys Trastevere CT Log Server Public Configuration

This is the live public configuration for the Geomys Trastevere CT Log Server, a Sunlight instance.

See also the public playbooks.

/etc/sunlight/sunlight.yaml

listen:
  - "213.171.190.243:443"
  - "[2001:4b7e:a002::c1]:443"
acme:
  hosts:
    - trastevere.sunlight.geomys.org
  cache: /var/db/sunlight/autocert/
checkpoints: /tank/shared/checkpoints.db
logs:
  - shortname: trastevere2026h2
    inception: 2026-07-27
    period: 200
    submissionprefix: https://trastevere2026h2.sunlight.geomys.org
    monitoringprefix: https://trastevere2026h2.skylight.geomys.org
    secret: /tank/enc/trastevere2026h2.seed.bin
    cache: /tank/logs/trastevere2026h2/cache.db
    poolsize: 750
    localdirectory: /tank/logs/trastevere2026h2/data
    notafterstart: 2026-07-01T00:00:00Z
    notafterlimit: 2027-01-01T00:00:00Z
  - shortname: trastevere2027h1
    inception: 2026-07-27
    period: 200
    submissionprefix: https://trastevere2027h1.sunlight.geomys.org
    monitoringprefix: https://trastevere2027h1.skylight.geomys.org
    secret: /tank/enc/trastevere2027h1.seed.bin
    cache: /tank/logs/trastevere2027h1/cache.db
    poolsize: 750
    localdirectory: /tank/logs/trastevere2027h1/data
    notafterstart: 2027-01-01T00:00:00Z
    notafterlimit: 2027-07-01T00:00:00Z
  - shortname: trastevere2027h2
    inception: 2026-07-27
    period: 200
    submissionprefix: https://trastevere2027h2.sunlight.geomys.org
    monitoringprefix: https://trastevere2027h2.skylight.geomys.org
    secret: /tank/enc/trastevere2027h2.seed.bin
    cache: /tank/logs/trastevere2027h2/cache.db
    poolsize: 750
    localdirectory: /tank/logs/trastevere2027h2/data
    notafterstart: 2027-07-01T00:00:00Z
    notafterlimit: 2028-01-01T00:00:00Z
  - shortname: trastevere2028h1
    inception: 2026-07-27
    period: 200
    submissionprefix: https://trastevere2028h1.sunlight.geomys.org
    monitoringprefix: https://trastevere2028h1.skylight.geomys.org
    secret: /tank/enc/trastevere2028h1.seed.bin
    cache: /tank/logs/trastevere2028h1/cache.db
    poolsize: 750
    localdirectory: /tank/logs/trastevere2028h1/data
    notafterstart: 2028-01-01T00:00:00Z
    notafterlimit: 2028-07-01T00:00:00Z
  - shortname: trastevere2028h2
    inception: 2026-07-27
    period: 200
    submissionprefix: https://trastevere2028h2.sunlight.geomys.org
    monitoringprefix: https://trastevere2028h2.skylight.geomys.org
    secret: /tank/enc/trastevere2028h2.seed.bin
    cache: /tank/logs/trastevere2028h2/cache.db
    poolsize: 750
    localdirectory: /tank/logs/trastevere2028h2/data
    notafterstart: 2028-07-01T00:00:00Z
    notafterlimit: 2029-01-01T00:00:00Z

/etc/sunlight/sunlight-staging.yaml

listen:
  - "213.171.190.245:443"
  - "[2001:4b7e:a002::c3]:443"
acme:
  hosts:
    - loreto.sunlight.geomys.org
  cache: /var/db/sunlight/autocert-staging/
checkpoints: /tank/shared/checkpoints.db
logs:
  - shortname: loreto2026h2
    inception: 2026-07-27
    period: 200
    submissionprefix: https://loreto2026h2.sunlight.geomys.org
    monitoringprefix: https://loreto2026h2.skylight.geomys.org
    ccadbroots: testing
    extraroots: /etc/sunlight/extra-roots-staging.pem
    secret: /tank/enc/loreto2026h2.seed.bin
    cache: /tank/logs/loreto2026h2/cache.db
    poolsize: 750
    localdirectory: /tank/logs/loreto2026h2/data
    notafterstart: 2026-07-01T00:00:00Z
    notafterlimit: 2027-01-01T00:00:00Z
  - shortname: loreto2027h1
    inception: 2026-07-27
    period: 200
    submissionprefix: https://loreto2027h1.sunlight.geomys.org
    monitoringprefix: https://loreto2027h1.skylight.geomys.org
    ccadbroots: testing
    extraroots: /etc/sunlight/extra-roots-staging.pem
    secret: /tank/enc/loreto2027h1.seed.bin
    cache: /tank/logs/loreto2027h1/cache.db
    poolsize: 750
    localdirectory: /tank/logs/loreto2027h1/data
    notafterstart: 2027-01-01T00:00:00Z
    notafterlimit: 2027-07-01T00:00:00Z
  - shortname: loreto2027h2
    inception: 2026-07-27
    period: 200
    submissionprefix: https://loreto2027h2.sunlight.geomys.org
    monitoringprefix: https://loreto2027h2.skylight.geomys.org
    ccadbroots: testing
    extraroots: /etc/sunlight/extra-roots-staging.pem
    secret: /tank/enc/loreto2027h2.seed.bin
    cache: /tank/logs/loreto2027h2/cache.db
    poolsize: 750
    localdirectory: /tank/logs/loreto2027h2/data
    notafterstart: 2027-07-01T00:00:00Z
    notafterlimit: 2028-01-01T00:00:00Z
  - shortname: loreto2028h1
    inception: 2026-07-27
    period: 200
    submissionprefix: https://loreto2028h1.sunlight.geomys.org
    monitoringprefix: https://loreto2028h1.skylight.geomys.org
    ccadbroots: testing
    extraroots: /etc/sunlight/extra-roots-staging.pem
    secret: /tank/enc/loreto2028h1.seed.bin
    cache: /tank/logs/loreto2028h1/cache.db
    poolsize: 750
    localdirectory: /tank/logs/loreto2028h1/data
    notafterstart: 2028-01-01T00:00:00Z
    notafterlimit: 2028-07-01T00:00:00Z
  - shortname: loreto2028h2
    inception: 2026-07-27
    period: 200
    submissionprefix: https://loreto2028h2.sunlight.geomys.org
    monitoringprefix: https://loreto2028h2.skylight.geomys.org
    ccadbroots: testing
    extraroots: /etc/sunlight/extra-roots-staging.pem
    secret: /tank/enc/loreto2028h2.seed.bin
    cache: /tank/logs/loreto2028h2/cache.db
    poolsize: 750
    localdirectory: /tank/logs/loreto2028h2/data
    notafterstart: 2028-07-01T00:00:00Z
    notafterlimit: 2029-01-01T00:00:00Z

/etc/sunlight/skylight.yaml

listen:
  - "213.171.190.244:443"
  - "[2001:4b7e:a002::c2]:443"
acme:
  hosts:
    - trastevere.skylight.geomys.org
  cache: /var/db/sunlight/skylight/
logsjsonprefix: https://trastevere.skylight.geomys.org
homeredirect: https://trastevere.sunlight.geomys.org
operatorname: Geomys

logs:
  - shortname: trastevere2026h2
    monitoringprefix: https://trastevere2026h2.skylight.geomys.org
    localdirectory: /tank/logs/trastevere2026h2/data
  - shortname: trastevere2027h1
    monitoringprefix: https://trastevere2027h1.skylight.geomys.org
    localdirectory: /tank/logs/trastevere2027h1/data
  - shortname: trastevere2027h2
    monitoringprefix: https://trastevere2027h2.skylight.geomys.org
    localdirectory: /tank/logs/trastevere2027h2/data
  - shortname: trastevere2028h1
    monitoringprefix: https://trastevere2028h1.skylight.geomys.org
    localdirectory: /tank/logs/trastevere2028h1/data
  - shortname: trastevere2028h2
    monitoringprefix: https://trastevere2028h2.skylight.geomys.org
    localdirectory: /tank/logs/trastevere2028h2/data

  - shortname: loreto2026h2
    monitoringprefix: https://loreto2026h2.skylight.geomys.org
    localdirectory: /tank/logs/loreto2026h2/data
    staging: true
  - shortname: loreto2027h1
    monitoringprefix: https://loreto2027h1.skylight.geomys.org
    localdirectory: /tank/logs/loreto2027h1/data
    staging: true
  - shortname: loreto2027h2
    monitoringprefix: https://loreto2027h2.skylight.geomys.org
    localdirectory: /tank/logs/loreto2027h2/data
    staging: true
  - shortname: loreto2028h1
    monitoringprefix: https://loreto2028h1.skylight.geomys.org
    localdirectory: /tank/logs/loreto2028h1/data
    staging: true
  - shortname: loreto2028h2
    monitoringprefix: https://loreto2028h2.skylight.geomys.org
    localdirectory: /tank/logs/loreto2028h2/data
    staging: true

/usr/local/bin/debug

#!/bin/bash
set -euo pipefail

unit_flag="skylight"

display_help() {
    echo "Usage: debug [-u unit] {useragents|ips|keylog={on|off}|logs={on|off}|port}"
}

while getopts "u:h" opt; do
    case ${opt} in
        u )
            unit_flag=$OPTARG
            ;;
        h )
            display_help >&2
            exit 0
            ;;
        \? )
            echo "Invalid option: -$OPTARG" >&2
            display_help >&2
            exit 1
            ;;
        : )
            echo "Option -$OPTARG requires an argument" >&2
            display_help >&2
            exit 1
            ;;
    esac
done

shift $((OPTIND - 1))

if [ "$#" -ne 1 ]; then
    echo "Exactly one positional argument is required" >&2
    display_help >&2
    exit 1
fi

PID=$(systemctl show "$unit_flag" --property MainPID | cut -d'=' -f2)
if [ -z "$PID" ] || [ "$PID" = "0" ]; then
    echo "Unit $unit_flag is not running" >&2
    exit 1
fi
PORT=$(ss -tulnp | grep "pid=$PID," | awk '{print $5}' | grep 127.0.0.1) || true
if [ -z "$PORT" ]; then
    echo "No port found for unit $unit_flag" >&2
    exit 1
fi

case $1 in
    useragents )
        curl -s "$PORT/debug/heavyhitter/useragents"
        ;;
    ips )
        curl -s "$PORT/debug/heavyhitter/ips"
        ;;
    keylog=on )
        curl -s -X POST "$PORT/debug/keylog/on"
        ;;
    keylog=off )
        curl -s -X POST "$PORT/debug/keylog/off"
        ;;
    logs=on )
        curl -s -X POST "$PORT/debug/logs/on"
        ;;
    logs=off )
        curl -s -X POST "$PORT/debug/logs/off"
        ;;
    port )
    	echo "$PORT"
    	;;
    * )
        echo "Invalid argument: $1" >&2
        display_help >&2
        exit 1
        ;;
esac

/etc/systemd/system/sunlight.service

[Unit]
Description=Sunlight Certificate Transparency Log
After=network-online.target tank-enc.mount
Wants=network-online.target
StartLimitIntervalSec=0

[Service]
ExecStart=/usr/local/bin/sunlight -c /etc/sunlight/sunlight.yaml
ExecReload=kill -HUP $MAINPID
StandardOutput=append:/var/log/sunlight.jsonl
StandardError=journal
Restart=always
RestartSteps=20
RestartSec=1ms
RestartMaxDelaySec=10s

[Install]
WantedBy=tank-enc.mount

/etc/systemd/system/sunlight-staging.service

[Unit]
Description=Sunlight Certificate Transparency Log (staging)
After=network-online.target tank-enc.mount
Wants=network-online.target
StartLimitIntervalSec=0

[Service]
ExecStart=/usr/local/bin/sunlight-staging -c /etc/sunlight/sunlight-staging.yaml
ExecReload=kill -HUP $MAINPID
StandardOutput=append:/var/log/sunlight-staging.jsonl
StandardError=journal
Restart=always
RestartSteps=20
RestartSec=1ms
RestartMaxDelaySec=10s

[Install]
WantedBy=tank-enc.mount

/etc/systemd/system/skylight.service

[Unit]
Description=Sunlight Certificate Transparency Log (read path)
After=network-online.target
Wants=network-online.target
StartLimitIntervalSec=0

[Service]
ExecStart=/usr/local/bin/skylight -c /etc/sunlight/skylight.yaml
StandardOutput=append:/var/log/skylight.jsonl
StandardError=journal
Restart=always
RestartSteps=20
RestartSec=1ms
RestartMaxDelaySec=10s

[Install]
WantedBy=multi-user.target

/etc/systemd/system/partial-aftersun.service

[Unit]
Description=Clean up partial tiles

[Service]
Type=oneshot
ExecStart=/usr/local/bin/partial-aftersun -c /etc/sunlight/sunlight.yaml
# HetrixTools heartbeat: trastevere partial-aftersun
ExecStartPost=/usr/bin/curl --retry 3 --retry-delay 1 -m 15 https://sm.hetrixtools.net/hb/?s=fe7ca32bf25794f97c7b73c8a5e96d17
StandardOutput=append:/var/log/partial-aftersun.jsonl
StandardError=journal

/etc/systemd/system/partial-aftersun.timer

[Unit]
Description=Periodically run partial tiles cleanup while Sunlight is running
RefuseManualStart=yes
PartOf=sunlight.service

[Timer]
OnActiveSec=5s
OnUnitActiveSec=5m

[Install]
WantedBy=sunlight.service

/etc/systemd/system/partial-aftersun-staging.service

[Unit]
Description=Clean up partial tiles (staging)

[Service]
Type=oneshot
ExecStart=/usr/local/bin/partial-aftersun -c /etc/sunlight/sunlight-staging.yaml
# HetrixTools heartbeat: loreto partial-aftersun
ExecStartPost=/usr/bin/curl --retry 3 --retry-delay 1 -m 15 https://sm.hetrixtools.net/hb/?s=f207297f6f0214e7aeb8a5738a16c06c
StandardOutput=append:/var/log/partial-aftersun-staging.jsonl
StandardError=journal

/etc/systemd/system/partial-aftersun-staging.timer

[Unit]
Description=Periodically run partial tiles cleanup while Sunlight is running (staging)
RefuseManualStart=yes
PartOf=sunlight-staging.service

[Timer]
OnActiveSec=5s
OnUnitActiveSec=5m

[Install]
WantedBy=sunlight-staging.service

/etc/systemd/system/public-config.service

[Unit]
Description=https://github.com/FiloSottile/mostly-harmless/tree/main/public-config
After=network-online.target
Wants=network-online.target
Before=caddy.service
StartLimitIntervalSec=0

[Service]
ExecStart=/usr/local/bin/public-config -name trastevere
DynamicUser=true
Restart=always
RestartSteps=20
RestartSec=1ms
RestartMaxDelaySec=10s

[Install]
WantedBy=multi-user.target

/etc/logrotate.d/jsonl

/var/log/*.jsonl {
    daily
    rotate 10
    copytruncate
    compress
    delaycompress
    notifempty
    missingok
}

/etc/caddy/Caddyfile

config.trastevere.sunlight.geomys.org:443 {
	bind 213.171.190.246 [2001:4b7e:a002::c4]
	reverse_proxy localhost:8080
}

/etc/systemd/system/caddy.service.d/override.conf

[Unit]
StartLimitIntervalSec=0

[Service]
Restart=always
RestartSteps=20
RestartSec=1ms
RestartMaxDelaySec=10s

/usr/local/bin/zfs-textfile

#!/bin/sh
set -eu
out=/var/lib/prometheus/node-exporter/zfs.prom
tmp=$(mktemp "$out.XXXXXX")
{
  echo '# TYPE zfs_dataset_referenced_bytes gauge'
  echo '# TYPE zfs_dataset_logicalreferenced_bytes gauge'
  echo '# TYPE zfs_dataset_available_bytes gauge'
  zfs list -Hp -r -o name,referenced,logicalreferenced,available tank/logs \
    | awk '{
        printf "zfs_dataset_referenced_bytes{dataset=\"%s\"} %s\n",        $1, $2
        printf "zfs_dataset_logicalreferenced_bytes{dataset=\"%s\"} %s\n", $1, $3
        printf "zfs_dataset_available_bytes{dataset=\"%s\"} %s\n",         $1, $4
      }'
} > "$tmp"
chmod 0644 "$tmp"
mv "$tmp" "$out"

/etc/systemd/system/zfs-textfile.service

[Unit]
Description=Write ZFS dataset metrics for node_exporter textfile collector

[Service]
Type=oneshot
ExecStart=/usr/local/bin/zfs-textfile
TimeoutStartSec=30s

/etc/systemd/system/zfs-textfile.timer

[Unit]
Description=Run zfs-textfile every minute

[Timer]
OnBootSec=30s
OnUnitActiveSec=60s
AccuracySec=1s

[Install]
WantedBy=timers.target