[submission] Hmy UI

[liszper]

Linked bounty

harmony-one/harmony#2716

My work in progress:
https://github.com/liszper/one-validator-dashboard

Description of the bug, vulnerability, security threat OR the product/tool

Initialize a node with one command, then create your validator from a web-ui hosted by your validator. You have the ability to edit it, collect & restake rewards automatically and use all the common features hmy has.

Steps to reproduce the reported vulnerability OR steps taken to build the product/tool

MVP -> security -> testing -> design -> more features based on requests

I plan to add my auto-SSL web-server to the implementation. (Read more about it here: https://clojure.network/z/singular)

The final setup will be something like this:

run one command on a fresh VPS with a custom password in the command
Configure the DNS of your custom domain (or optionally ask for a free sub-domain provided by us or the Harmony dev team)
Load the site for the first time. The server will generate a TLS with certbot, redirect you and then show a login screen
After the custom password you provided in step 1, the seed phrase will shown to you once.
You request funds from the faucet or deposit ONE
Register your Validator
from this point you will access all the features the dashboard has

Updates for the Harmony node will be provided automatically, but you have to manually update the dashboard with a single confirmation click by default. (optionally you could set it to full-auto too)

Proof of exploitability OR proof of use-case (e.g. screenshot, video, github code source)

I post them on Telegram

Perceived impact to another user or the organization

Game-changer to validators

List of URLs and affected parameters (if applicable)

http://2nd.harmony.validator.zgen.hu:3000

Browser, OS and/or app version used during testing (if applicable)

Any

[mindstyle85]

since this is basically an all in one solution, how about some explanation on how the URL will be generated, just from the instance's public IP itself? And how about more explanation on security issues here and possible alerting mechanism/auto restarts etc.

[sophoah]

I like the proposal especially the fact that it runs locally and doesn't rely on an hosted server to work. Add to it a UI to manage wallet functionality, and i would surely use it :)

[mindstyle85]

one of the problems i see here is that you need at least an SSL connection via which you do the commands on the UI website, otherwise this is not safe at all

[liszper]

I plan to add my auto-SSL web-server to the implementation. (Read more about it here: https://clojure.network/z/singular)

The final setup will be something like this:

1. run one command on a fresh VPS with a custom password in the command
2. Configure the DNS of your custom domain (or optionally ask for a free sub-domain provided by us or the Harmony dev team)
3. Load the site for the first time. The server will generate a TLS with certbot, redirect you and then show a login screen
4. After the custom password you provided in step 1, the seed phrase will shown to you once.
5. You request funds from the faucet or deposit ONE
6. Register your Validator

from this point you will access all the features the dashboard has

Updates for the Harmony node will be provided automatically, but you have to manually update the dashboard with a single confirmation click by default. (optionally you could set it to full-auto too)

[liszper]

We aim to release the first public build in 1-2 months, but less secure and good-looking versions will be available for testing in the coming weeks.

The full roadmap will be probably longer and we aim to maintain the library as well.

[sophoah]

one of the problems i see here is that you need at least an SSL connection via which you do the commands on the UI website, otherwise this is not safe at all

for me I would just do a ssh tunneling and not even opening the UI to external user.

[mindstyle85]

@liszper can you add the additional info into the original post please? the team will want as much info there as possible when they start deciding on projects. thank you!

[liszper]

@liszper can you add the additional info into the original post please? the team will want as much info there as possible when they start deciding on projects. thank you!

Sure, I added it.

[mindstyle85]

@liszper how are we coming along with this?