fix: sync staging ops with main (#5017)

connext · Oct 16, 2023 · ecbc10b · ecbc10b
1 parent 951667e
commit ecbc10b
Show file tree

Hide file tree

Showing 37 changed files with 354 additions and 463 deletions.
diff --git a/ops/README.md b/ops/README.md
@@ -1,7 +1,7 @@
 ## AWS Infrastructure
 
 This folder contains all the code necessary to deploy a sequencer and router server to a highly-available
-ecs cluster, with required dependencies. Namely:
+ecs cluster, with its required dependencies. Namely:
 
 - Fully configured load balancing, port forwarding, and TLS
 - Autoscaling with ECS on [Fargate](https://aws.amazon.com/fargate/)

diff --git a/ops/env/testnet/core/secrets.prod.json b/ops/env/testnet/core/secrets.prod.json
@@ -1,9 +1,9 @@
 {
 	"goerli_alchemy_key_0": "ENC[AES256_GCM,data:Owj2W0HXZ8eT1NWQNAmg2X3lykNb4m1hcYyQ7X0TaEc=,iv:dSU2ek6pGWNHTCaYDvVKuurTDlnq+TsZtQ/2FJq/xHw=,tag:tS7e8SWcpCo7lxFckqwFMA==,type:str]",
 	"goerli_alchemy_key_1": "ENC[AES256_GCM,data:aHBsbLDrIu2JfR13pIziTRYTE6kGMwToboIYp9K8U3c=,iv:OvM6yWKwgYzj2ChBF2BVbDUwJC/WewdntXCxR2cofzY=,tag:WZMleETIKWrZowsdzZOOsg==,type:str]",
-	"optgoerli_alchemy_key_0": "ENC[AES256_GCM,data:+NEFwFd97974EAwMxF3ctjUpGf4EMWRy8aXIAeCPIaw=,iv:jiz3YBLnX4wYFSCj/qj/Gep4RYYZZtb974vP/gymcDE=,tag:t/lP1O9f2Q5VYtgNtIjduw==,type:str]",
+	"optgoerli_alchemy_key_0": "ENC[AES256_GCM,data:Rcy+YLf1BaHp+4IdpylsX9CZN+xgHC2GotFKpXgQwys=,iv:2hti9Xi5OVcluqu5HxPrRcAx4/b2ICZHui3dWREnCbY=,tag:MSIglSjG/00za1K4XhjW6Q==,type:str]",
 	"optgoerli_alchemy_key_1": "ENC[AES256_GCM,data:IKvEQW3u/ShLXgt90ZyvbwSgaoWSVjNKucefr1ZUOks=,iv:KNkyaDV+MoVJ4GmQDwxn/drHeTNXAtJ+IdXkh5r1UxY=,tag:7stNWMB0nmWqOrqZwsOENw==,type:str]",
-	"arbgoerli_alchemy_key_0": "ENC[AES256_GCM,data:FznvthayCWL5gQrBs4GSyRkZrXg1fAXTpuvHoZ0Brmw=,iv:h/Ln5MiegVXtUgCWB65hwfCVhRht9cr2Fw4QbUO4ZPg=,tag:r1ueHnIDTKcQBxVRmirvfg==,type:str]",
+	"arbgoerli_alchemy_key_0": "ENC[AES256_GCM,data:DzcWQbZI0vkf1VRdAZqaalCecYOedSbYyfW7livMY2g=,iv:7P9KrTDmNrD36HbALYsjTNQr3oMkZqxY57f8rzWq6PY=,tag:72I+op1utGFaLjwJHJ83pQ==,type:str]",
 	"arbgoerli_alchemy_key_1": "ENC[AES256_GCM,data:AoJEiPuHviI14XuFJP7/GFTbEd5UfLHXq3OefHwV3BQ=,iv:tvvt76MHKvXcsVOl+Lk2t6PjazzhS/tBXbVWuJ1JL8w=,tag:KS9pom1Fz9o7DLsPuxLrRQ==,type:str]",
 	"mumbai_alchemy_key_0": "ENC[AES256_GCM,data:VolMxEjn8+QnY13VzDpEWenyv1CBjvyjcLMb1l/xlrw=,iv:BWvw9p/3JYsLpqdszm5JIasoxjypghjaff/BJ2QIOtM=,tag:M/AN6XyOJoAL7/RNWy7SuQ==,type:str]",
 	"blast_key": "ENC[AES256_GCM,data:aOV48KWCE0L4tjHc+Tdt4oQBFGbTRKeb+2DMFI4Y7LGjYNke,iv:wv3W/M2ZKTFpj28WAUZIvPKOc4kvsWqabDd+qoVTdg4=,tag:gWHQBWTVIjT0PymIHOROnQ==,type:str]",
@@ -36,8 +36,8 @@
 		"azure_kv": null,
 		"hc_vault": null,
 		"age": null,
-		"lastmodified": "2023-06-20T08:53:00Z",
-		"mac": "ENC[AES256_GCM,data:03ff0KH7+dCzZrc/SHwl4DdInbZ5ArBveoDKQRRWStKX8r5aYxoVNGVLRv5GtJvg/sWRBodUxJfpXXr/C2N2TseMAbCcFeQz23LmJgQwljSvq9hC33Seupf5MUl0EX1+ibFkpLAmxYyhTKCiLMKNh7GvjTKxF6jt5CcOW+b1RyI=,iv:g9XXrnV7+SCwJT87RzIIGa+woRlhpLTAnUq46mCGfZk=,tag:8/1fuUCINRamsbQRpKyXTQ==,type:str]",
+		"lastmodified": "2023-10-12T18:16:36Z",
+		"mac": "ENC[AES256_GCM,data:74+Bo9rq93wtubj0aXcJUwNQB+KrSDllG4HurDeqyW2mt+kkOQckWmnZmdyK9DqNvLCp+h33dp3IiJHz+ijHWrfAku3uQCSg2x/0GNNFxEH1+/SReXriP+XaVZ81CuWYgcLEqOOi7EVWl8TTBhpwBpS3QHcP4MQ6M3xX3ebBux0=,iv:jsRaEk85OzJAtT5ArvgCdCVBlPn84PhrBkU+kujq85w=,tag:rJs0Ak7ulVgheQnoh3R+XQ==,type:str]",
 		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.7.3"

diff --git a/ops/env/testnet/core/secrets.staging.json b/ops/env/testnet/core/secrets.staging.json
@@ -1,29 +1,25 @@
 {
+	"optgoerli_alchemy_key_0": "ENC[AES256_GCM,data:k1qUWsq8/E0RPCsjOwdv50q36b3wch73xgxTdm8mEbI=,iv:hCcTxDpm3HGETyzZ4jLtoMlYPVotQVf2647KRQwVHes=,tag:m9LqGTMbvzQa74j2aVW1lA==,type:str]",
+	"optgoerli_alchemy_key_1": "ENC[AES256_GCM,data:hW5uu+SLwb50rSLv9YdCKnk79MEhyqP2vxELQPc5/zg=,iv:xHCBKpARqPGrjt5ZAJO7PJEQGLVRIKFfI90ahnOqAmI=,tag:EcTWFj2TIshthXYjNYCjYg==,type:str]",
 	"goerli_alchemy_key_0": "ENC[AES256_GCM,data:/wISWZUmSGM3ltN4h9rxDGUnhf9kgc6VW51zl6Wu7Z8=,iv://fHe2qY8Qjl7f0qGa02lOLjccC9HyNNVeCe5NOilIM=,tag:Ei98lvqXj3MudX/dHPEfQg==,type:str]",
 	"goerli_alchemy_key_1": "ENC[AES256_GCM,data:dMUjnDXoer4TRSR/YBQ5MIs/FUuSjRILAaLWp08hj1c=,iv:z1ZD+HYfeVdujaAmFWQTL9vmF52GAB9p8iEBna9RWHw=,tag:nQE8qQgIU3asER0b3iWmng==,type:str]",
-	"optgoerli_alchemy_key_0": "ENC[AES256_GCM,data:mXcL4RU5T49CD3g4jQQA6AMGSupcFO+RknKYDYI4fBo=,iv:jPPyIcLzqyibmIZWvSUBabkH16kP32QhKpbFytIrpVI=,tag:1lw7dR9FxDCvS+2PVbsZcg==,type:str]",
-	"optgoerli_alchemy_key_1": "ENC[AES256_GCM,data:hW5uu+SLwb50rSLv9YdCKnk79MEhyqP2vxELQPc5/zg=,iv:xHCBKpARqPGrjt5ZAJO7PJEQGLVRIKFfI90ahnOqAmI=,tag:EcTWFj2TIshthXYjNYCjYg==,type:str]",
-	"arbgoerli_alchemy_key_0": "ENC[AES256_GCM,data:Bqq7QPW2TUVdlppYdxdV//Vbdca9cTyIAwnhqlVduCw=,iv:tuAnhM5QSOh06zrkBPAwgNB1agAZwFhW13FCyM03/LQ=,tag:iKFPbTBTKkZUmiI6eKBBkQ==,type:str]",
+	"arbgoerli_alchemy_key_0": "ENC[AES256_GCM,data:68ITTHB2K4ENYUserZiFLp5spE8vqPEr7VhKAGTPQy4=,iv:5qIXaTVycbJBVCwlq768qhWv5MLoyV0RabMLqQ3KwHk=,tag:dd6ubCahF9UiAS4klBY5lQ==,type:str]",
 	"arbgoerli_alchemy_key_1": "ENC[AES256_GCM,data:RkENJZPkuPT/Lb4sfY/1IUGdpGYWZ167acoWVWjP0ww=,iv:rznmPAbXaujoUUc/9L1Y7RwJ7TDxRKXWjiUvTRm0DBE=,tag:HFX0K5oEW88BOtHq/Na47g==,type:str]",
-	"mumbai_alchemy_key_0": "ENC[AES256_GCM,data:3roireSflhY69Nc7a7iN7vZl3XOlfSGUcoXXQUM6Q9o=,iv:p/vwiWYAuU/kW287lHAmzQTL/6eaUAQhbvVyhF7M+js=,tag:ta+HAca5ohMizSmD5Tapuw==,type:str]",
 	"blast_key": "ENC[AES256_GCM,data:hpLxIagHQcTrTTGjLh92R+7/R8KvWHy45eCV1vYkfdYve4Dr,iv:tM11VtOjKc+KHpd0PEkgmcLK0lEw4fI2y7CQYLE+afY=,tag:cdhEzbUnkTd7z09DcUP01Q==,type:str]",
-	"infura_key": "ENC[AES256_GCM,data:SCBjO1DDN/bk8t1+ET7TXANbhgoaKYnXhkoVdXVraBY=,iv:5FkRlSFgEXa/6JKcaiU50x1s7OKmTvJ2A8E4mLiT7jw=,tag:STmv7wfTZig5Js9PtJbSGw==,type:str]",
 	"admin_token_router": "ENC[AES256_GCM,data:0wnIxq6DHe0=,iv:Mwb4AXNF5l2mFXJZ7emfRLRg3bZZWk0j9UtgqYOyL2Q=,tag:JGBJron0GZVRIp75/Lx98A==,type:str]",
 	"admin_token_relayer": "ENC[AES256_GCM,data:FW0wINsA/+n4+J5w,iv:TK+ajUjvRJ5dTcXcnbIc5JNh6PW9UXnHc2Pu8fYEfx8=,tag:z3PVS01IUt/2PLVEhZuYqA==,type:str]",
 	"router_web3_signer_private_key": "ENC[AES256_GCM,data:FAhI5hUlOE9as4/tdFrI07B+MC1YvyZWn1kW5K/16+eYUWc4RhAORmWaE0gRWvoufRVt/ORHRErK8Rh09WNIDYWE,iv:DIwSCl0PeAPUEe94MI2og9x/FvFxKZKAw2VDVWkrDqw=,tag:/L09atM1jSssXig+Ar6CUA==,type:str]",
 	"sequencer_web3_signer_private_key": "ENC[AES256_GCM,data:Pr/XG1/mYaEUjnYS93u//07l0BQhm5rYRPoora0ueLxA4i6azJcyGYDwYUR+k27vz0SkrCwwO1D+LsxUWuC5lW3D,iv:zbrZb89ONwyL0w0fCs4N58QMuK8Y4kAXE3CwpW7nxuo=,tag:Zrbtz+RfBr6vKpnIwmenFQ==,type:str]",
 	"rmq_mgt_password": "ENC[AES256_GCM,data:7Vd3omH0cn3ucGGxmX2G,iv:iODSARAiWiJmhAc4XxsQjtj4mXmWOXYyFGX7if52zWY=,tag:qwQzyHgf6aKzXGV1Khew1g==,type:str]",
 	"dd_api_key": "ENC[AES256_GCM,data:nxtkHnCTowSHV2Tykj/ZUgLTqo5b75BnFwFAKQwJgFc=,iv:+50W3/jCdUTdvytBMaCd4zTQ1Yj9/4B/r4scCnSG9GM=,tag:G/C8wcG7gPBG0d4TC8hHoQ==,type:str]",
-	"gelato_api_key": "ENC[AES256_GCM,data:V6V1pEP6dcVAaIE/0zITEbb4L+45ArJNrAHKeSnKFPRrh+jwhoKR4SL/bOE=,iv:JZF3p5R834ah+a4gjiPhX8yG4ejDKlgFlqWn7sUgb4w=,tag:aI+RW007Bgl6+Ire92G8DQ==,type:str]",
+	"gelato_api_key": "ENC[AES256_GCM,data:8i+pK7EdyJBD25ly8N5gmNAZP/t7pOtq/bftTooZScZJ9CfPs76b5HGiCL4=,iv:GTbSZR9jwfkC/5e44qDeQaw708hiPsE4BbWz7GOv62M=,tag:IB68U48ZaPXm80GuP6T2Hg==,type:str]",
 	"postgres_password": "ENC[AES256_GCM,data:T5qV9VwiICMS7DxYOyTN,iv:7C9qKO7gE8RDF+F8QvXzUKr7/odpQl2Pl0PaEvE41Yc=,tag:WLVdJBudoSfR7mt7KQ38vw==,type:str]",
 	"discord_webhook_key": "ENC[AES256_GCM,data:dapCWM7pfnOyapCFKegHj5dPBftlOjHD3QCgAaERsXiRIsTSSpT5MqOLuMJ5r/Zq7ez8JzJO536Y1QftbMZVz+NWFGOmJRqszvE9xFFjnirRLQTlVJUXNQ==,iv:CAbEIRTxkaf51G5SSmlrJcawqws7GdFiqEw46EHvBes=,tag:/TssqwqPjkHW0q2lAqKi4g==,type:str]",
 	"telegram_api_key": "ENC[AES256_GCM,data:k4eMYvbGI27VrUDkK6oeFjeuLbRPg+9YrxfeAJJ92fbiD/HRC/1Sz//gOBkSrQ==,iv:4lYSd8V+itGRM/BRCtYaOmV8zGE3kYW35dTkQ9ijp3A=,tag:Hs8TY3QqO9+uklnxJCnvsA==,type:str]",
 	"telegram_chat_id": "ENC[AES256_GCM,data:IRmgaW8Zy/fCpDML/bg=,iv:grrERw9Upfbfzo88jXVWg47ybza0bXDwMiXoLiQ0oVI=,tag:9m6RAJdDNKMpgM83qZcGeA==,type:str]",
 	"betteruptime_api_key": "ENC[AES256_GCM,data:xJ/0QQozmfVedcNK2ZDmgjyVWQ+HDT1b,iv:wa4oOgvLeHi8C0X6vNIhhQuqDS8r1R9wRPMxWhKTscg=,tag:7BdsxpKjtoByUv/LTslDMQ==,type:str]",
 	"relayer_web3_signer_private_key": "ENC[AES256_GCM,data:wRSzd7JmCfXc6925dQjqyjXEIi2yACitVxKAdtNoK1vmties3LZ/7VQgHSngfneLmFDpbV43A5buU4wVnAFkTwMC,iv:OwPp02yQr3WCMGCp5fK0ksWXg8U6YmATapH529lDurA=,tag:gLg2gmT5G91325oug/nkvA==,type:str]",
 	"watcher_web3_signer_private_key": "ENC[AES256_GCM,data:g/8wZFvwuZeCq8pnnhNVt/UTNe5Fcnf2of7Ts8yEvRwR8AgVT5sR1GIpB1XrTqsHqSN8XOOyurLvwJXyFGkpUGMY,iv:9Qbxq6FJMbJIy9BAW2pA7GRq/nq1+YCVi+v90b0+/84=,tag:xD1AuxLPSEONP5gvfTOHJQ==,type:str]",
-	"linea_node": "ENC[AES256_GCM,data:P0vDWrBM+SlPbtSzdC/hRcjz4ClurVRGTIU=,iv:KAMr1IRv2mvEeXNgu7qT0wL2wDLy/rUpNXeW1pomJBw=,tag:REAj5TpcoHD4I7dS1VVjaw==,type:str]",
-	"optgoerli_alchemy_key_for_lh": "ENC[AES256_GCM,data:rSFyCLjXeBX9eXuxCA9eZ+eXaISmCFDZwzx/LlFyWoM=,iv:AFnmspH6VWoGhzZnFebVrcQscjhkXledbPAuCGRWy4k=,tag:vWssSwP3R1ye/ja1WKHhCw==,type:str]",
 	"sops": {
 		"kms": [
 			{
@@ -37,8 +33,8 @@
 		"azure_kv": null,
 		"hc_vault": null,
 		"age": null,
-		"lastmodified": "2023-10-12T18:10:24Z",
-		"mac": "ENC[AES256_GCM,data:YcLs2iBxe1D1GQb15vcy2k2LKy4gTxEYGIwxpfILIvbZApygBwqFx7sTSAdRd2fmS4BqT+mO7zqPbGCqINv+QH/bQB0KUXaQSks+2oe0G/Rs8UOq9XWi6SU15+JJY6OqQ1qoSqALyQ87ME2OZcbgMdjDRj70lT6+3zd8xV2Xoo8=,iv:cBTNs+hFCarWz9A/QJO2IFAh06E9ktTOAt/TEm4MLRc=,tag:MwrRlxqR1kOPcNHCW3T/aw==,type:str]",
+		"lastmodified": "2023-01-30T09:37:19Z",
+		"mac": "ENC[AES256_GCM,data:0gMMVf7AmF1bXwqNBcs4AprVXQ0WH8dXWN5/7Bjfvj93bwdkfpxtKmguMqMLZGPb9RvqB9KssfbuwDdwNNn4XBEoBEyhhdc+JTLEuuzUAhherK4ADrpCiNaF/qRxoKLLbxXOAiOjB47nbjajY+3Jm6MInsyPX3DPccJBxsANeqc=,iv:rl4OAIqMMHJLzIqlVO+drHcWbLRgxiBErcmczHcUIgg=,tag:0RET/h14fJ9hwV8sNmXKcg==,type:str]",
 		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.7.3"

diff --git a/ops/infra/.terraform-version b/ops/infra/.terraform-version
@@ -1 +1 @@
-1.5.7
+1.5.7
diff --git a/ops/infra/outputs.tf b/ops/infra/outputs.tf
@@ -1,4 +1,7 @@
-
 output "ecr_admin_role" {
   value = module.iam.execution_role_arn
 }
+
+output "vpc_flow_logs_role" {
+  value = module.iam.vpc_flow_logs_role_arn
+}
diff --git a/ops/mainnet/prod/backend/.terraform-version b/ops/mainnet/prod/backend/.terraform-version
@@ -1 +1 @@
-1.5.7
+1.5.7
diff --git a/ops/mainnet/prod/backend/main.tf b/ops/mainnet/prod/backend/main.tf
@@ -121,7 +121,6 @@ module "postgrest" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
   lb_subnets               = module.network.public_subnets
   internal_lb              = false
   docker_image             = "postgrest/postgrest:v10.0.0.20221011"
@@ -150,7 +149,6 @@ module "sdk-server" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
   lb_subnets               = module.network.public_subnets
   internal_lb              = false
   docker_image             = var.full_image_name_sdk_server
@@ -304,7 +302,4 @@ module "ecs" {
   environment             = var.environment
   domain                  = var.domain
   ecs_cluster_name_prefix = "nxtp-ecs"
-  vpc_id                  = module.network.vpc_id
-  private_subnets         = module.network.private_subnets
-  public_subnets          = module.network.public_subnets
 }
diff --git a/ops/mainnet/prod/core/.terraform-version b/ops/mainnet/prod/core/.terraform-version
@@ -1 +1 @@
-1.5.7
+1.5.7
diff --git a/ops/mainnet/prod/core/config.tf b/ops/mainnet/prod/core/config.tf
@@ -337,7 +337,6 @@ locals {
       processor        = "https://betteruptime.com/api/v1/heartbeat/${var.lighthouse_processor_heartbeat}"
       propagate        = "https://betteruptime.com/api/v1/heartbeat/${var.lighthouse_propagate_heartbeat}"
       sendOutboundRoot = "https://betteruptime.com/api/v1/heartbeat/${var.lighthouse_send_outbound_root_heartbeat}"
-      propose          = "https://betteruptime.com/api/v1/heartbeat/${var.lighthouse_propose_heartbeat}"
     }
     hubDomain = "6648936"
     proverBatchSize = {

diff --git a/ops/mainnet/prod/core/main.tf b/ops/mainnet/prod/core/main.tf
@@ -34,7 +34,6 @@ module "router_subscriber" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
   lb_subnets               = module.network.public_subnets
   internal_lb              = false
   docker_image             = var.full_image_name_router_subscriber
@@ -64,7 +63,6 @@ module "router_publisher" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
   lb_subnets               = module.network.public_subnets
   internal_lb              = false
   docker_image             = var.full_image_name_router_publisher
@@ -94,7 +92,6 @@ module "router_executor" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
   lb_subnets               = module.network.public_subnets
   internal_lb              = false
   docker_image             = var.full_image_name_router_executor
@@ -124,8 +121,7 @@ module "router_web3signer" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
-  lb_subnets               = module.network.public_subnets
+  lb_subnets               = module.network.private_subnets
   docker_image             = "ghcr.io/connext/web3signer:latest"
   container_family         = "router-web3signer"
   health_check_path        = "/upcheck"
@@ -167,7 +163,6 @@ module "sequencer_server" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
   lb_subnets               = module.network.public_subnets
   docker_image             = var.full_image_name_sequencer_server
   container_family         = "sequencer"
@@ -196,7 +191,6 @@ module "sequencer_publisher" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
   lb_subnets               = module.network.public_subnets
   docker_image             = var.full_image_name_sequencer_publisher
   container_family         = "sequencer-publisher"
@@ -236,7 +230,6 @@ module "sequencer_subscriber" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
   lb_subnets               = module.network.public_subnets
   internal_lb              = false
   docker_image             = var.full_image_name_sequencer_subscriber
@@ -278,8 +271,7 @@ module "sequencer_web3signer" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
-  lb_subnets               = module.network.public_subnets
+  lb_subnets               = module.network.private_subnets
   docker_image             = "ghcr.io/connext/web3signer:latest"
   container_family         = "sequencer-web3signer"
   health_check_path        = "/upcheck"
@@ -311,7 +303,7 @@ module "lighthouse_prover_cron" {
   timeout                = 300
   memory_size            = 10240
   lambda_in_vpc          = true
-  private_subnets        = module.network.private_subnets
+  subnet_ids             = module.network.private_subnets
   lambda_security_groups = flatten([module.network.allow_all_sg, module.network.ecs_task_sg])
 
 }
@@ -327,7 +319,6 @@ module "lighthouse_prover_subscriber" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
   lb_subnets               = module.network.public_subnets
   internal_lb              = false
   docker_image             = var.full_image_name_lighthouse_prover_subscriber
@@ -395,19 +386,6 @@ module "lighthouse_sendoutboundroot_cron" {
   memory_size         = 2048
 }
 
-module "lighthouse_propose_cron" {
-  source              = "../../../modules/lambda"
-  ecr_repository_name = "nxtp-lighthouse"
-  docker_image_tag    = var.lighthouse_image_tag
-  container_family    = "lighthouse-propose"
-  environment         = var.environment
-  stage               = var.stage
-  container_env_vars  = merge(local.lighthouse_env_vars, { LIGHTHOUSE_SERVICE = "propose" })
-  schedule_expression = "rate(30 minutes)"
-  memory_size         = 512
-}
-
-
 
 module "relayer" {
   source                   = "../../../modules/service"
@@ -420,7 +398,6 @@ module "relayer" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
   lb_subnets               = module.network.public_subnets
   docker_image             = var.full_image_name_relayer
   container_family         = "relayer"
@@ -450,8 +427,7 @@ module "relayer_web3signer" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
-  lb_subnets               = module.network.public_subnets
+  lb_subnets               = module.network.private_subnets
   docker_image             = "ghcr.io/connext/web3signer:latest"
   container_family         = "relayer-web3signer"
   health_check_path        = "/upcheck"
@@ -480,7 +456,6 @@ module "watcher" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
   lb_subnets               = module.network.public_subnets
   docker_image             = var.full_image_name_watcher
   container_family         = "watcher"
@@ -510,8 +485,7 @@ module "watcher_web3signer" {
   execution_role_arn       = data.aws_iam_role.ecr_admin_role.arn
   cluster_id               = module.ecs.ecs_cluster_id
   vpc_id                   = module.network.vpc_id
-  private_subnets          = module.network.private_subnets
-  lb_subnets               = module.network.public_subnets
+  lb_subnets               = module.network.private_subnets
   docker_image             = "ghcr.io/connext/web3signer:latest"
   container_family         = "watcher-web3signer"
   health_check_path        = "/upcheck"
@@ -555,9 +529,6 @@ module "ecs" {
   environment             = var.environment
   domain                  = var.domain
   ecs_cluster_name_prefix = "nxtp-ecs"
-  vpc_id                  = module.network.vpc_id
-  private_subnets         = module.network.private_subnets
-  public_subnets          = module.network.public_subnets
 }
 
 module "sequencer_cache" {
@@ -606,3 +577,8 @@ module "lighthouse_cache" {
   cache_subnet_group_subnet_ids = module.network.public_subnets
   node_type                     = "cache.r4.large"
 }
+
+module "ecr-lcp" {
+  source           = "../../../modules/ecr-lcp"
+  repository_names = ["nxtp-cartographer", "nxtp-lighthouse", "postgrest"]
+}
diff --git a/ops/mainnet/prod/core/variables.tf b/ops/mainnet/prod/core/variables.tf
@@ -188,10 +188,6 @@ variable "lighthouse_send_outbound_root_heartbeat" {
   type = string
 }
 
-variable "lighthouse_propose_heartbeat" {
-  type = string
-}
-
 variable "full_image_name_relayer" {
   type        = string
   description = "relayer image name"