Günther Craft: Leseprobe & Inhaltsverzeichnis

import { FastifyInstance } from 'fastify';
import Stripe from 'stripe';
import { config } from '../../config/index.js';
import { FulfillmentService } from '../../services/fulfillmentService.js';

export async function webhookRoutes(app: FastifyInstance) {
  // CRITICAL: Stripe verlangt das unmodifizierte Raw-Body-Buffer-Array!
  app.post('/webhooks/stripe', {
    config: { rawBody: true }
  }, async (request, reply) => {
    const signature = request.headers['stripe-signature'] as string;
    const rawBody = (request as any).rawBody;

    if (!signature || !rawBody) {
      return reply.code(400).send({ error: 'Missing signature or payload buffer' });
    }

    let event: Stripe.Event;
    try {
      event = stripe.webhooks.constructEvent(
        rawBody,
        signature,
        config.stripe.webhookSecret
      );
    } catch (err: any) {
      request.log.error(`Stripe signature failure: ${err.message}`);
      return reply.code(400).send({ error: 'Signature verification failed' });
    }

    // Sofortige Bestätigung an Stripe senden (verhindert HTTP 504 Timeouts)
    reply.code(200).send({ received: true });

    // Asynchrone Zustandsmaschine mit Idempotenz-Schutz
    if (event.type === 'checkout.session.completed') {
      const session = event.data.object as Stripe.Checkout.Session;
      await FulfillmentService.processStripeCheckout(session);
    }
  });
}

// Atomarer Statusübergang: Nur EIN Prozess kann von 'received' zu 'burning' wechseln
const claimed = await prisma.payment.updateMany({
  where: {
    stripePaymentId: paymentId,
    status: 'received' // Bedingung: Darf noch von niemandem beansprucht worden sein
  },
  data: {
    status: 'burning'
  }
});

if (claimed.count === 0) {
  // Wenn count === 0, hat bereits ein paralleler Request den Vorgang beansprucht
  console.log(`[BurnService] Payment ${paymentId} already claimed or burned. Skipping.`);
  return { success: false, reason: 'ALREADY_CLAIMED' };
}

// Hier ist sichergestellt: Kein zweiter Prozess kann diesen Block gleichzeitig ausführen!
const txHash = await Web3McpClient.executeBurn(burnAmountTokens);
await prisma.payment.update({
  where: { stripePaymentId: paymentId },
  data: { status: 'burned', txHash }
});

import { createWalletClient, http, stringToHex } from 'viem';
import { privateKeyToAccount } from 'viem/accounts';
import { base } from 'viem/chains';

const account = privateKeyToAccount(config.web3.walletPrivateKey);

const walletClient = createWalletClient({
  account,
  chain: base,
  transport: http(config.web3.rpcUrl)
});

// Calldata Payload kodieren: Auditierbarer Fingerabdruck des Verkaufs
const customCalldata = stringToHex(`GUNTER_BURN:${paymentId}:${amountCents}`);

// Zero-Value Transaktion an Burn-Adresse mit Payload im Datenfeld
const txHash = await walletClient.sendTransaction({
  to: '0x000000000000000000000000000000000000dEaD',
  value: 0n,
  data: customCalldata,
  maxFeePerGas: parseGwei('0.1') // Gas Guard: Schützt vor Spikes
});

console.log(`Proof-of-Execution on Base: https://basescan.org/tx/${txHash}`);

# 1. LXC Container auf Proxmox Node erstellen (Debian 12 Bookworm)
pct create 115 local:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst \
  --hostname gunther-core \
  --cores 4 \
  --memory 8192 \
  --swap 2048 \
  --net0 name=eth0,bridge=vmbr0,ip=10.0.1.115/24,gw=10.0.1.1 \
  --storage local-lvm \
  --rootfs local-lvm:32 \
  --unprivileged 1 \
  --onboot 1

# 2. Container starten und Node.js 22 LTS installieren
pct start 115
pct exec 115 -- curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
pct exec 115 -- apt-get install -y nodejs sqlite3 build-essential

# 3. Systemd Watchdog konfigurieren (Auto-Restart bei Fehlern binnen 5s)
pct exec 115 -- systemctl enable --now gunther-core