Chore: Update helm chart with embedded wallet defaults by philipliu · Pull Request #1034 · stellar/stellar-disbursement-platform-backend

philipliu · 2026-02-02T22:36:21Z

What

This updates the helm chart and wizard with defaults for the embedded wallet configuration. Between testnet resets, the wallet Wasm needs to be reuploaded, and the SEP-45 contract needs to be redeployed. I've done so manually right now, but I will add a GH workflow to automate this.

Why

Make embedded wallets easier to set up.

Known limitations

I've only checked that the helm chart can generate a manifest, but I haven't tried deploying it locally on my machine. However, I tested the flow end-to-end in a multitenant setup with the wizard.

Checklist

Title follows SDP-1234: Add new feature or Chore: Refactor package xyz format. The Jira ticket code was included if available.
PR has a focused scope and doesn't mix features with refactoring
Tests are included (if applicable)
CHANGELOG.md is updated (if applicable)
CONFIG/SECRETS changes are updated in helmcharts and deployments (if applicable)
Preview deployment works as expected
Ready for production

stellar-jenkins · 2026-02-02T22:39:16Z

stellar-disbursement-platform-backend-preview is available here:
SDP: https://sdp-backend-pr1034.previews.kube001.services.stellar-ops.com/health
AP: https://sdp-ap-pr1034.previews.kube001.services.stellar-ops.com/health
Frontend: https://sdp-backend-dashboard-pr1034.previews.kube001.services.stellar-ops.com

stellar-jenkins · 2026-02-03T18:19:36Z

stellar-disbursement-platform-backend-preview is available here:
SDP: https://sdp-backend-pr1034.previews.kube001.services.stellar-ops.com/health
AP: https://sdp-ap-pr1034.previews.kube001.services.stellar-ops.com/health
Frontend: https://sdp-backend-dashboard-pr1034.previews.kube001.services.stellar-ops.com

stellar-jenkins · 2026-02-03T19:19:36Z

stellar-disbursement-platform-backend-preview is available here:
SDP: https://sdp-backend-pr1034.previews.kube001.services.stellar-ops.com/health
AP: https://sdp-ap-pr1034.previews.kube001.services.stellar-ops.com/health
Frontend: https://sdp-backend-dashboard-pr1034.previews.kube001.services.stellar-ops.com

stellar-jenkins · 2026-02-03T22:32:27Z

stellar-disbursement-platform-backend-preview is available here:
SDP: https://sdp-backend-pr1034.previews.kube001.services.stellar-ops.com/health
AP: https://sdp-ap-pr1034.previews.kube001.services.stellar-ops.com/health
Frontend: https://sdp-backend-dashboard-pr1034.previews.kube001.services.stellar-ops.com

Copilot

Pull request overview

Updates embedded wallet/SEP-45 configuration defaults across the Helm chart and the sdp-setup wizard to reduce manual setup work (especially around testnet resets and redeployments).

Changes:

Add default embedded-wallet WASM hash and default SEP-45 contract IDs/RPC URLs (network-dependent) in the setup wizard and Helm templates.
Update Helm chart values.yaml annotations/defaults and regenerate chart README content accordingly.
Refresh dev/.env.example with new SEP-45 contract ID / WASM hash defaults and add optional RPC auth header env vars.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tools/sdp-setup/internal/config/env.go	Writes embedded wallet WASM hash and network-specific SEP-45 contract/RPC defaults into generated `.env` files.
helmchart/sdp/values.yaml	Adds a default embedded wallet WASM hash and updates parameter docs around embedded wallet / SEP-45 / RPC settings.
helmchart/sdp/templates/01.3-configmap-tss.yaml	Adds a default testnet RPC URL for TSS when not on pubnet.
helmchart/sdp/templates/01.1-configmap-sdp.yaml	Adds default SEP-45 contract IDs (pubnet vs testnet) and a default testnet RPC URL for SDP core config.
helmchart/sdp/README.md	Regenerated/updated chart documentation to reflect new/updated values documentation.
dev/.env.example	Updates default WASM hash + SEP-45 contract ID and adds optional RPC auth header env vars.

Copilot · 2026-02-03T22:39:20Z

+		"EMBEDDED_WALLETS_WASM_HASH":                 "9b784817dff1620a3e2b223fe1eb8dac56e18980dea9726f692847ccbbd3a853",
 	}

-	if cfg.NetworkType == "pubnet" {
+	switch cfg.NetworkType {


Consider pulling these embedded wallets / SEP-45 defaults (WASM hash, contract IDs, RPC URLs) into named constants (or a single map keyed by network) instead of inline string literals, to reduce the chance of drift and make future updates simpler.

Copilot · 2026-02-03T22:39:21Z

+  RPC_URL: "https://soroban-testnet.stellar.org"
+  {{- end }}
  {{- /*
  {{- /*


There appears to be a duplicated Helm comment opener ({{- /*)—the second one becomes part of the comment body and is confusing. Remove the extra {{- /* line so the comment block matches the pattern used elsewhere.

Suggested change

{{- /*

Copilot · 2026-02-03T22:39:21Z

+  SEP45_CONTRACT_ID: "CALI6JC3MSNDGFRP7Z2OKUEPREHOJRRXKMJEWQDEFZPFGXALA45RAUTH"
+  {{- else }}
+  SEP45_CONTRACT_ID: "CDY4CS2VWHAZOMYVTKUFKGNZKIVFBCXUFNFQ5KSXOTAHKL5H5ZRTAUTH"


Consider moving the default SEP45 contract IDs into chart values (or a helper that reads values) rather than hard-coding them in the template, so updating them after redeployments is less error-prone and defaults/docs can live in one place.

Suggested change

SEP45_CONTRACT_ID: "CALI6JC3MSNDGFRP7Z2OKUEPREHOJRRXKMJEWQDEFZPFGXALA45RAUTH"

{{- else }}

SEP45_CONTRACT_ID: "CDY4CS2VWHAZOMYVTKUFKGNZKIVFBCXUFNFQ5KSXOTAHKL5H5ZRTAUTH"

SEP45_CONTRACT_ID: {{ default "CALI6JC3MSNDGFRP7Z2OKUEPREHOJRRXKMJEWQDEFZPFGXALA45RAUTH" .Values.sdp.sep45ContractIdPubnet | quote }}

{{- else }}

SEP45_CONTRACT_ID: {{ default "CDY4CS2VWHAZOMYVTKUFKGNZKIVFBCXUFNFQ5KSXOTAHKL5H5ZRTAUTH" .Values.sdp.sep45ContractIdTestnet | quote }}

stellar-jenkins · 2026-02-04T03:56:35Z

stellar-disbursement-platform-backend-preview is available here:
SDP: https://sdp-backend-pr1034.previews.kube001.services.stellar-ops.com/health
AP: https://sdp-ap-pr1034.previews.kube001.services.stellar-ops.com/health
Frontend: https://sdp-backend-dashboard-pr1034.previews.kube001.services.stellar-ops.com

stellar-jenkins · 2026-02-04T03:59:45Z

stellar-disbursement-platform-backend-preview is available here:
SDP: https://sdp-backend-pr1034.previews.kube001.services.stellar-ops.com/health
AP: https://sdp-ap-pr1034.previews.kube001.services.stellar-ops.com/health
Frontend: https://sdp-backend-dashboard-pr1034.previews.kube001.services.stellar-ops.com

stellar-jenkins · 2026-02-04T04:05:55Z

stellar-disbursement-platform-backend-preview is available here:
SDP: https://sdp-backend-pr1034.previews.kube001.services.stellar-ops.com/health
AP: https://sdp-ap-pr1034.previews.kube001.services.stellar-ops.com/health
Frontend: https://sdp-backend-dashboard-pr1034.previews.kube001.services.stellar-ops.com

marwen-abid · 2026-02-04T13:54:23Z

  {{- end }}
  {{- end }}
  {{- end }}
+  {{- if eq (include "isPubnet" .) "true" }}


We have one isPubnet check above that populates network specific configurations. We can consider doing it all in one place:

data: {{- if eq (include "isPubnet" .) "true" }} NETWORK_PASSPHRASE: "Public Global Stellar Network ; September 2015" HORIZON_URL: "https://horizon.stellar.org" {{- else }} NETWORK_PASSPHRASE: "Test SDF Network ; September 2015" HORIZON_URL: "https://horizon-testnet.stellar.org" {{- end }}

marwen-abid · 2026-02-04T13:59:45Z

+  {{- else }}
+  SEP45_CONTRACT_ID: "CDY4CS2VWHAZOMYVTKUFKGNZKIVFBCXUFNFQ5KSXOTAHKL5H5ZRTAUTH"
+  {{- end }}
+  {{- if .Values.global.rpcUrl }}


Why not add this in the {{- with .Values.global }} section :

{{- if .rpcUrl }} RPC_URL: {{ .Values.global.rpcUrl | quote }} {{- end }}

marwen-abid · 2026-02-04T14:06:11Z

+  ## @param global.rpcRequestAuthHeaderKey The name of the HTTP header to include when authenticating requests to a protected RPC server.
+  rpcRequestAuthHeaderKey: ""
+  ## @param global.rpcRequestAuthHeaderValue he value of the HTTP header used for authenticating requests to a protected RPC server.
+  rpcRequestAuthHeaderValue: ""


nit: We can organize this differently :

## @extra global.rpc Stellar RPC server configuration for embedded wallets and SEP-45 features. ## @param global.rpcUrl The URL of the Stellar RPC server. When set, templates use this value and enable RPC in the dashboard. ## @param global.rpcRequestAuthHeaderKey The name of the HTTP header to include when authenticating requests to a protected RPC server. ## @param global.rpcRequestAuthHeaderValue he value of the HTTP header used for authenticating requests to a protected RPC server. rpc: url: "" requestAuthHeaderKey: "" requestAuthHeaderValue: ""

That makes a lot more sense 🤦

marwen-abid · 2026-02-04T14:14:04Z

+    {{- $rpcEnabled := false }}
+    {{- if .Values.global.rpcUrl }}
+    {{- $rpcEnabled = true }}
+    {{- end }}


nit: We can extract this to _helpers.tpl

{{/* RPC Enabled - returns true if rpcUrl is configured, false otherwise */}} {{- define "sdp.rpcEnabled" -}} {{- if .Values.global.rpcUrl -}} true {{- else -}} false {{- end -}} {{- end -}}

marwen-abid · 2026-02-04T14:19:48Z

  ## @param tss.configMap.data.DB_MAX_IDLE_CONNS Maximum idle connections retained in the pool.
  ## @param tss.configMap.data.DB_CONN_MAX_IDLE_TIME_SECONDS Close idle connections after N seconds.
  ## @param tss.configMap.data.DB_CONN_MAX_LIFETIME_SECONDS Recycle connections after N seconds.
-  ## @extra tss.configMap.data.RPC_URL The URL of the Stellar RPC server for embedded wallets and SEP-45 features. Required when ENABLE_EMBEDDED_WALLETS or ENABLE_SEP45 is "true".


We should keep these configmaps and secrets documented here as global values don't inform where configs are being used. (E.g. look at global.bridgeIntegration.baseUrl present both there and documented in the configmap.

stellar-jenkins · 2026-02-04T14:58:48Z

stellar-disbursement-platform-backend-preview is available here:
SDP: https://sdp-backend-pr1034.previews.kube001.services.stellar-ops.com/health
AP: https://sdp-ap-pr1034.previews.kube001.services.stellar-ops.com/health
Frontend: https://sdp-backend-dashboard-pr1034.previews.kube001.services.stellar-ops.com

@crazy-max

## Bumps the all-actions group with 2 updates - [docker/login-action](https://github.com/docker/login-action) - [docker/build-push-action](https://github.com/docker/build-push-action) --- ## docker/login-action: 4.2.0 → 4.4.0 ### Release notes (v4.4.0) - Skip empty `registry-auth` secret mask by @crazy-max in #1035 - Bump `@aws-sdk/client-ecr` and `@aws-sdk/client-ecr-public` to 3.1077.0 in #1034 **Full Changelog:** docker/login-action@v4.3.0...v4.4.0 --- ### Release notes (v4.3.0) - Preserve names in esbuild bundle by @crazy-max in #1022 - Bump `@aws-sdk/client-ecr` and `@aws-sdk/client-ecr-public` to 3.1076.0 in #999 and #1030 - Bump `@docker/actions-toolkit` from 0.90.0 to 0.92.0 in #1004 and #1027 - Bump `@sigstore/core` from 3.1.0 to 3.2.1 in #1023 - Bump `@sigstore/verify` from 3.1.0 to 3.1.1 in #1029 - Bump http-proxy-agent and https-proxy-agent to 9.1.0 in #1017 - Bump js-yaml from 4.1.1 to 5.2.0 in #1028 - Bump sigstore from 4.1.0 to 4.1.1 in #1031 - Bump tmp from 0.2.5 to 0.2.7 in #1002 - Bump undici from 6.24.1 to 6.27.0 in #1020 - Bump vite from 7.3.3 to 7.3.6 in #1019 **Full Changelog:** docker/login-action@v4.2.0...v4.3.0 --- ## docker/build-push-action: 7.2.0 → 7.3.0 ### Release notes (v7.3.0) - Preserve names in esbuild bundle by @crazy-max in #1567 - Bump `@docker/actions-toolkit` from 0.90.0 to 0.92.0 in #1545 and #1572 - Bump `@sigstore/core` from 3.1.0 to 3.2.1 in #1568 - Bump js-yaml from 4.1.1 to 4.3.0 in #1566 - Bump tmp from 0.2.5 to 0.2.7 in #1547 - Bump undici from 6.24.1 to 6.27.0 in #1564 - Bump vite from 7.3.2 to 7.3.6 in #1563 **Full Changelog:** docker/build-push-action@v7.2.0...v7.3.0

philipliu had a problem deploying to Internal SEP Tests February 2, 2026 22:36 — with GitHub Actions Error

philipliu had a problem deploying to Receiver Registration - E2E Integration Tests (Stellar) February 2, 2026 22:36 — with GitHub Actions Error

philipliu temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 2, 2026 23:54 — with GitHub Actions Inactive

philipliu temporarily deployed to Internal SEP Tests February 3, 2026 00:21 — with GitHub Actions Inactive

philipliu force-pushed the philip/helm-changes branch from 9f14f94 to c5663eb Compare February 3, 2026 18:16

philipliu temporarily deployed to Internal SEP Tests February 3, 2026 18:16 — with GitHub Actions Inactive

philipliu temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 3, 2026 18:16 — with GitHub Actions Inactive

philipliu changed the base branch from feature/c-accounts to develop February 3, 2026 18:16

philipliu force-pushed the philip/helm-changes branch from c5663eb to 14a21c6 Compare February 3, 2026 19:16

philipliu temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 3, 2026 19:16 — with GitHub Actions Inactive

philipliu temporarily deployed to Internal SEP Tests February 3, 2026 19:16 — with GitHub Actions Inactive

Update helm chart with embedded wallet defaults

3c9ef65

philipliu force-pushed the philip/helm-changes branch from 14a21c6 to 3c9ef65 Compare February 3, 2026 22:29

philipliu temporarily deployed to Internal SEP Tests February 3, 2026 22:29 — with GitHub Actions Inactive

philipliu temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 3, 2026 22:29 — with GitHub Actions Inactive

philipliu marked this pull request as ready for review February 3, 2026 22:30

Copilot AI review requested due to automatic review settings February 3, 2026 22:30

Copilot started reviewing on behalf of philipliu February 3, 2026 22:30 View session

Copilot AI reviewed Feb 3, 2026

View reviewed changes

philipliu commented Feb 4, 2026

View reviewed changes

Comment thread helmchart/sdp/values.yaml Outdated

philipliu temporarily deployed to Internal SEP Tests February 4, 2026 03:53 — with GitHub Actions Inactive

philipliu temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 4, 2026 03:53 — with GitHub Actions Inactive

philipliu force-pushed the philip/helm-changes branch from 770b482 to 4f69129 Compare February 4, 2026 03:56

philipliu temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 4, 2026 03:56 — with GitHub Actions Inactive

philipliu temporarily deployed to Internal SEP Tests February 4, 2026 03:56 — with GitHub Actions Inactive

Move RPC into global

e5253f6

philipliu force-pushed the philip/helm-changes branch from 4f69129 to e5253f6 Compare February 4, 2026 04:03

philipliu temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 4, 2026 04:03 — with GitHub Actions Inactive

philipliu temporarily deployed to Internal SEP Tests February 4, 2026 04:03 — with GitHub Actions Inactive

marwen-abid reviewed Feb 4, 2026

View reviewed changes

PR comments

a90ea76

philipliu temporarily deployed to Internal SEP Tests February 4, 2026 14:55 — with GitHub Actions Inactive

philipliu temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 4, 2026 14:55 — with GitHub Actions Inactive

marwen-abid approved these changes Feb 4, 2026

View reviewed changes

philipliu merged commit 92b16e2 into develop Feb 4, 2026
17 checks passed

philipliu deleted the philip/helm-changes branch February 4, 2026 15:31

Uh oh!

Conversation

philipliu commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Known limitations

Checklist

Uh oh!

stellar-jenkins commented Feb 2, 2026

Uh oh!

stellar-jenkins commented Feb 3, 2026

Uh oh!

stellar-jenkins commented Feb 3, 2026

Uh oh!

stellar-jenkins commented Feb 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

stellar-jenkins commented Feb 4, 2026

Uh oh!

stellar-jenkins commented Feb 4, 2026

Uh oh!

stellar-jenkins commented Feb 4, 2026

Uh oh!

marwen-abid Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

marwen-abid Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

marwen-abid Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

philipliu Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

marwen-abid Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

marwen-abid Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

stellar-jenkins commented Feb 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

philipliu commented Feb 2, 2026 •

edited

Loading