feat(sol): add agave-backed dlob hot path for canary

environments/sol/trade-infra/README.md

@@ -0,0 +1,25 @@
+# trade-infra
+
+Shared host-backed services for the `sol` cluster.
+
+## Purpose
+
+- Expose host services into `k3s` through stable service names in namespace `trade-infra`.
+- Keep host access paths reproducible in Git instead of relying on manual `kubectl` history.
+- Provide cluster DNS names for:
+  - `Postgres`
+  - `Redis`
+  - `agave` RPC
+  - `agave` websocket
+  - `agave` Yellowstone gRPC
+
+## Operator Flow
+
+From the repository root:
+
+```bash
+./environments/sol/trade-infra/scripts/prepare-sol-agave-access.sh
+kubectl apply -k environments/sol/trade-infra
+```
+
+`prepare-sol-agave-access.sh` installs host-level socket proxies on `sol` so pods can reach the private validator endpoints through the host IP `149.50.96.162`.

environments/sol/trade-infra/agave-grpc-host-endpointslice.yaml

@@ -0,0 +1,15 @@
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: agave-grpc-host-sol
+  namespace: trade-infra
+  labels:
+    kubernetes.io/service-name: agave-grpc-host
+addressType: IPv4
+ports:
+  - name: grpc
+    protocol: TCP
+    port: 10000
+endpoints:
+  - addresses:
+      - 149.50.96.162

environments/sol/trade-infra/agave-grpc-host-service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: agave-grpc-host
+  namespace: trade-infra
+spec:
+  ports:
+    - name: grpc
+      port: 10000
+      targetPort: 10000

environments/sol/trade-infra/agave-rpc-host-endpointslice.yaml

@@ -0,0 +1,15 @@
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: agave-rpc-host-sol
+  namespace: trade-infra
+  labels:
+    kubernetes.io/service-name: agave-rpc-host
+addressType: IPv4
+ports:
+  - name: rpc
+    protocol: TCP
+    port: 8899
+endpoints:
+  - addresses:
+      - 149.50.96.162

environments/sol/trade-infra/agave-rpc-host-service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: agave-rpc-host
+  namespace: trade-infra
+spec:
+  ports:
+    - name: rpc
+      port: 8899
+      targetPort: 8899

environments/sol/trade-infra/agave-ws-host-endpointslice.yaml

@@ -0,0 +1,15 @@
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: agave-ws-host-sol
+  namespace: trade-infra
+  labels:
+    kubernetes.io/service-name: agave-ws-host
+addressType: IPv4
+ports:
+  - name: ws
+    protocol: TCP
+    port: 8900
+endpoints:
+  - addresses:
+      - 149.50.96.162

environments/sol/trade-infra/agave-ws-host-service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: agave-ws-host
+  namespace: trade-infra
+spec:
+  ports:
+    - name: ws
+      port: 8900
+      targetPort: 8900

environments/sol/trade-infra/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: trade-infra
+
+resources:
+  - namespace.yaml
+  - postgres-host-service.yaml
+  - postgres-host-endpointslice.yaml
+  - redis-host-service.yaml
+  - redis-host-endpointslice.yaml
+  - agave-rpc-host-service.yaml
+  - agave-rpc-host-endpointslice.yaml
+  - agave-ws-host-service.yaml
+  - agave-ws-host-endpointslice.yaml
+  - agave-grpc-host-service.yaml
+  - agave-grpc-host-endpointslice.yaml

environments/sol/trade-infra/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: trade-infra

environments/sol/trade-infra/postgres-host-endpointslice.yaml

@@ -0,0 +1,15 @@
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: postgres-host-sol
+  namespace: trade-infra
+  labels:
+    kubernetes.io/service-name: postgres-host
+addressType: IPv4
+ports:
+  - name: postgres
+    protocol: TCP
+    port: 5432
+endpoints:
+  - addresses:
+      - 149.50.96.162

environments/sol/trade-infra/postgres-host-service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres-host
+  namespace: trade-infra
+spec:
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: 5432

environments/sol/trade-infra/redis-host-endpointslice.yaml

@@ -0,0 +1,15 @@
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: redis-host-sol
+  namespace: trade-infra
+  labels:
+    kubernetes.io/service-name: redis-host
+addressType: IPv4
+ports:
+  - name: redis
+    protocol: TCP
+    port: 6379
+endpoints:
+  - addresses:
+      - 149.50.96.162

environments/sol/trade-infra/redis-host-service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis-host
+  namespace: trade-infra
+spec:
+  ports:
+    - name: redis
+      port: 6379
+      targetPort: 6379

environments/sol/trade-infra/scripts/prepare-sol-agave-access.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TARGET_HOST="${TARGET_HOST:-mevnode}"
+HOST_IP="${HOST_IP:-149.50.96.162}"
+POD_CIDR="${POD_CIDR:-10.42.0.0/24}"
+
+ssh_target() {
+  ssh -o StrictHostKeyChecking=no "$TARGET_HOST" "$@"
+}
+
+install_unit() {
+  local unit_path="$1"
+  ssh_target "sudo tee ${unit_path} >/dev/null"
+}
+
+cat <<EOF | install_unit /etc/systemd/system/agave-rpc-k3s.socket
+[Unit]
+Description=Expose Agave RPC on host IP for k3s pods
+
+[Socket]
+ListenStream=${HOST_IP}:8899
+NoDelay=true
+
+[Install]
+WantedBy=sockets.target
+EOF
+
+cat <<'EOF' | install_unit /etc/systemd/system/agave-rpc-k3s.service
+[Unit]
+Description=Proxy Agave RPC from host IP to localhost
+
+[Service]
+ExecStart=/lib/systemd/systemd-socket-proxyd 127.0.0.1:8899
+PrivateNetwork=no
+EOF
+
+cat <<EOF | install_unit /etc/systemd/system/agave-ws-k3s.socket
+[Unit]
+Description=Expose Agave websocket on host IP for k3s pods
+
+[Socket]
+ListenStream=${HOST_IP}:8900
+NoDelay=true
+
+[Install]
+WantedBy=sockets.target
+EOF
+
+cat <<'EOF' | install_unit /etc/systemd/system/agave-ws-k3s.service
+[Unit]
+Description=Proxy Agave websocket from host IP to localhost
+
+[Service]
+ExecStart=/lib/systemd/systemd-socket-proxyd 127.0.0.1:8900
+PrivateNetwork=no
+EOF
+
+cat <<EOF | install_unit /etc/systemd/system/agave-grpc-k3s.socket
+[Unit]
+Description=Expose Agave Yellowstone gRPC on host IP for k3s pods
+
+[Socket]
+ListenStream=${HOST_IP}:10000
+NoDelay=true
+
+[Install]
+WantedBy=sockets.target
+EOF
+
+cat <<'EOF' | install_unit /etc/systemd/system/agave-grpc-k3s.service
+[Unit]
+Description=Proxy Agave Yellowstone gRPC from host IP to WireGuard IP
+
+[Service]
+ExecStart=/lib/systemd/systemd-socket-proxyd 10.91.0.1:10000
+PrivateNetwork=no
+EOF
+
+ssh_target "sudo systemctl daemon-reload"
+ssh_target "sudo systemctl enable --now agave-rpc-k3s.socket agave-ws-k3s.socket agave-grpc-k3s.socket"
+
+ensure_ufw_rule() {
+  local port="$1"
+  local comment="$2"
+  if ! ssh_target "sudo ufw status numbered | grep -Fq '${port}/tcp on cni0'"; then
+    ssh_target "sudo ufw allow in on cni0 from ${POD_CIDR} to any port ${port} proto tcp comment '${comment}' >/dev/null"
+  fi
+}
+
+ensure_ufw_rule 8899 k3s-pods-agave-rpc
+ensure_ufw_rule 8900 k3s-pods-agave-ws
+ensure_ufw_rule 10000 k3s-pods-agave-grpc
+
+ssh_target "sudo systemctl status --no-pager agave-rpc-k3s.socket agave-ws-k3s.socket agave-grpc-k3s.socket | sed -n '1,80p'"
+ssh_target "sudo ss -ltnp | egrep ':(8899|8900|10000)\\b' | sed -n '1,40p'"