First pass on pow faucet for testnet (#1624)

* first pass on pow faucet for testnet * delete unused thing * remove unneeded thing * remove other thing * https & remove a log * don't force redirect on https, its not working? * some renaming of stuff * lint * lint * some stablity config * move protos to proto directory, add generated pb file for go users * add health probe * add hpa and request cpu * handle err * some more config
2024-12-22 03:30:35 +00:00 · 2019-02-19 12:32:14 -05:00 · 2019-02-19 12:32:14 -05:00 · 81c2e4e94b
commit 81c2e4e94b
parent 0e1f5ef55c
16 changed files with 1176 additions and 156 deletions
--- a/BUILD.bazel
+++ b/BUILD.bazel
@ -17,14 +17,18 @@ gazelle(
 alias(
    name = "proto_compiler",
    actual = "@io_bazel_rules_go//proto:gogofast_proto",
-    visibility = ["//proto:__subpackages__"],
+    visibility = [
+        "//proto:__subpackages__",
+    ],
 )

 # Protobuf compiler (gRPC)
 alias(
    name = "grpc_proto_compiler",
    actual = "@io_bazel_rules_go//proto:gogofast_grpc",
-    visibility = ["//proto:__subpackages__"],
+    visibility = [
+        "//proto:__subpackages__",
+    ],
 )

 gometalinter(
--- a/19
+++ b/19
@ -107,6 +107,19 @@ load(

 _go_image_repos()

+http_archive(
+    name = "prysm_testnet_site",
+    url = "https://github.com/prestonvanloon/prysm-testnet-site/archive/ee6c0659223775395cd5e592a6c0e5c6d4abe7e1.tar.gz",
+    strip_prefix = "prysm-testnet-site-ee6c0659223775395cd5e592a6c0e5c6d4abe7e1",
+    sha256 = "c02fcf85202d184c6fa4e78fa16295729affbfd60e4827728ec189d7e3895d90",
+    build_file_content = """
+proto_library(
+  name = "faucet_proto",
+  srcs = ["src/proto/faucet.proto"],
+  visibility = ["//visibility:public"],
+)""",
+)
+
 http_archive(
    name = "io_kubernetes_build",
    sha256 = "b4e7819861f2ec89b7309bd0c44fb3348c3a4a8ee494ec7668edb3960ff11814",
@ -990,6 +1003,12 @@ go_repository(
    importpath = "gopkg.in/natefinch/npipe.v2",
 )

+go_repository(
+    name = "com_github_prestonvanloon_go_recaptcha",
+    commit = "0834cef6e8bd3a7ebdb3ac7def9440ee47d501a4",
+    importpath = "github.com/prestonvanloon/go-recaptcha",
+)
+
 go_repository(
    name = "com_github_phoreproject_bls",
    commit = "afaefda3ea643e9292b6f4596403ed5c742561b4",
--- a/k8s/beacon-chain/testnet-site.yaml
+++ b/k8s/beacon-chain/testnet-site.yaml
@ -0,0 +1,94 @@
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: testnet-site-alpha
+  namespace: beacon-chain
+  labels:
+    app: beacon-chain
+    component: testnet-site
+    version: alpha
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: beacon-chain
+      component: testnet-site
+      version: alpha
+  template:
+    metadata:
+      labels:
+        app: beacon-chain
+        component: testnet-site
+        version: alpha
+    spec:
+      priorityClassName: best-effort-priority
+      containers:
+      - name: site
+        image: gcr.io/prysmaticlabs/prysm-testnet-site:latest
+        ports:
+        - containerPort: 80
+          name: http
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 80
+          initialDelaySeconds: 3
+          periodSeconds: 3
+        resources:
+          requests:
+            cpu: "100m"
+---
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: testnet-site-alpha
+  namespace: beacon-chain
+spec:
+  scaleTargetRef:
+    apiVersion: extensions/v1beta1
+    kind: Deployment
+    name: testnet-site-alpha
+  minReplicas: 2
+  maxReplicas: 10
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      targetAverageUtilization: 80
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: testnet-site-alpha
+  namespace: beacon-chain
+spec:
+  selector:
+    app: beacon-chain
+    component: testnet-site
+    version: alpha
+  ports:
+  - port: 80
+    targetPort: 80
+    name: http-nginx
+  type: ClusterIP
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: alpha-prylabs-net
+  namespace: istio-system
+spec:
+  hosts:
+  - alpha.prylabs.net
+  gateways:
+  - prylabs-wildcard-gateway
+  http:
+  - match:
+    - uri:
+        prefix: /
+    route:
+    - destination:
+        port: 
+          number: 80
+        host: testnet-site-alpha.beacon-chain.svc.cluster.local
+
--- a/k8s/geth/BUILD.bazel
+++ b/k8s/geth/BUILD.bazel
@ -41,7 +41,6 @@ _services = [
 _secrets = [
    "bootnode",
    "ethstats",
-    "faucet",
    "goerli_validator",
 ]

--- a/k8s/geth/faucet.deploy.yaml
+++ b/k8s/geth/faucet.deploy.yaml
@ -1,103 +1,34 @@
 kind: Deployment
-apiVersion: apps/v1beta1
+apiVersion: apps/v1
 metadata:
-  name: faucet
+  name: public-faucet
  namespace: pow
  labels:
-    component: faucet
+    component: public-faucet
    app: goerli
    version: v1
 spec:
  replicas: 1
-  selector: 
+  selector:
    matchLabels:
-      universe: geth
-      component: faucet
-      app: goerli
+      app: goerli 
      version: v1
+      component: public-faucet
  template:
    metadata:
      labels:
-        universe: geth
-        component: faucet
        app: goerli
        version: v1
+        component: public-faucet
    spec:
-      priorityClassName: batch-priority
+      priorityClassName: production-priority
      containers:
-        - name: faucet
-          image: ethereum/client-go:alltools-stable
-          ports: 
-           - containerPort: 8080
-             name: api
-           - containerPort: 30303
-             name: discovery-tcp
-             protocol: TCP
-           - containerPort: 30303
-             name: discovery-udp
-             protocol: UDP
-          # Use /bin/sh -c to execute geth so that we have access to HOSTNAME in 
-          # the command arguments.
-          # https://github.com/kubernetes/kubernetes/issues/57726
-          command:
-            - "/bin/sh"
-            - "-c"
-            - > 
-              touch /tmp/pwd; # empty password file
-              faucet
-              -account.json=/data/accounts/account.json
-              -account.pass=/tmp/pwd
-              -apiport=8080
-              -bootnodes=enode://$(BOOTNODE_PUBKEY)@$(GETH_BOOTNODE_V5_SERVICE_HOST):$(GETH_BOOTNODE_V5_SERVICE_PORT_BOOTNODE_UDP)
-              -ethport=30303
-              -ethstats=$HOSTNAME:$(ETHSTATS_WS_SECRET)@$(GETH_ETHSTATS_SERVICE_HOST):$(GETH_ETHSTATS_SERVICE_PORT)
-              -faucet.amount=350
-              -faucet.minutes=1440
-              -faucet.name=validator-faucet
-              -faucet.tiers=3
-              -genesis=/data/genesis.json
-              -loglevel=3
-              -network=1337
-              -noauth
-          env:
-            - name: ETHSTATS_WS_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: ethstats-secrets
-                  key: ws
-            - name: BOOTNODE_PUBKEY
-              valueFrom:
-                secretKeyRef:
-                  name: geth-bootnode-secret
-                  key: public_key
-          volumeMounts:
-            - name: genesis
-              mountPath: "/data"
-              readOnly: true
-            - name: accounts
-              mountPath: "/data/accounts"
-              readOnly: true
-            - name: faucet-data
-              mountPath: "/root/.faucet/keys"
-          resources:
-            requests:
-              memory: "500Mi"
-              cpu: "50m"
-            limits:
-              memory: "750Mi"
-              cpu: "100m"
-      volumes:
-        - name: genesis
-          configMap: 
-            name: genesis
-            items:
-              - key: json
-                path: genesis.json
-        - name: accounts
-          secret:
-            secretName: geth-faucet-accounts-secret
-            items: 
-              - key: json
-                path: account.json
-        - name: faucet-data
-          emptyDir: {}
+      - name: faucet-grpc
+        image: gcr.io/prysmaticlabs/prysm/faucet:latest
+        args: 
+        - --recaptcha_secret=6LdX85EUAAAAAO-_qMEOdecIzxV3eH222ekzi1Y9
+        - --port=8000
+        ports: 
+        - containerPort: 8000
+          name: grpc-faucet
+
--- a/k8s/geth/faucet.encrypted_secret.yaml
+++ b/k8s/geth/faucet.encrypted_secret.yaml
@ -1,11 +0,0 @@
-apiVersion: v1
-data:
-  json: JDe7rXgTCBhjk8XGsF0R0IsseBmQCOBFk07TF7JY49DkiY1FbbbrDPq0Dmeo8GIrO8RVJ6CMF6RD/GpTZbT8o7xadi9K3XC010Z3hSm7KkjH190sUqAmGm4hdNHeOJfyCHsY6eAE10XoTsb//P18u4drbL+9UXzeqT6DZE6z9lpLq0FvvN2mBes9iIPJ1o71IaE6hN1FPElCOwkLjTUuBfUrGaXiFm5GKaIjTTr9TAmkPzVm7LxAsX1vdfov3bhiVDcBQ4fWMArFZMRe4k5VaH83U18N+fIjPx02TQFHpopWNIZIOJM8657Kh+nQ8CEKOI3KWliqhcioU3Szl0Kfbx+jAxa65Aqc7xTooGViTJW/cH77Fmv9Vmd/pHsImDnxCkcgpEOA5Dmo+FFiSNQNyOX+WwSPM0e8SXHwTeZo+XZYMvLd8+eoJ11lMy0zfh9lVB/+coQSHUt7Fph7jPkdzmrZeXoMDIMo+FsPeUXZfAfnqmGptR65PWmBD0vlYicLMhZcefDOiyhYOQZQnLc2NhlSSiTNJ6QUKOn/0GSrli93PygTzsZ4miwZlRCylCESClYKJlTA9z2Vcn87gb/WXpD3RTjqj9M4zej9XXvqklPXqwf9NIZ9rzrfVBuUU7rTtehnigjH79b4AeUvE4iZ6O7njl7F603Dm6klTndRD31MO6981KQD95INkXa2/RKHNydwiC9yIDyR2RSuWv98V7QnKSZuFjUQSZKt3N7sj2RSRLibPrRC0ZADzp1F0HZSpt5s6Lvu50nY+C/R92lbT06meVSEYCjXFss8S42ryVNbCPzmEp8HEbXS9Lb/C+8r4ZP3msflOcGusv+h9Co87zI4Y03AdOkPIsKU0Y3TdBs8ch7JJR8DSI1B7SqxoLpR.IgbIjZjpv3ltq1US.WEGysEyBgvlgjOr0PnefZg==
-kind: Secret
-metadata:
-  name: geth-faucet-accounts-secret
-  namespace: pow
-type: Opaque
-# kubesec:v:3
-# kubesec:gcp:projects/prysmaticlabs/locations/global/keyRings/prysmatic-k8s-secrets/cryptoKeys/testkey:CiQAaKPz5+6N9EC53IjSMXUoxSv/u1/ZSo1BW7bMfyky/eAXPaQSSQD23sIs8C8Pzo/4qjR6fYd6pKSHvDRYDTTgt5Cxrzu+XCYCwm0jLUI1KL2VMohoXswZrEMP2r0JZzxzWTmDQUHCcsGY06uzpYI=
-# kubesec:mac:bcwLQScHxyWBk0ob.sR6Ss+HAwTBtspOpKlKuZw==
--- a/k8s/geth/faucet.service.yaml
+++ b/k8s/geth/faucet.service.yaml
@ -1,14 +1,55 @@
 kind: Service
 apiVersion: v1
 metadata:
-  name: geth-faucet
+  name: public-faucet
  namespace: pow
 spec:
  selector:
-    component: faucet
-    universe: geth
+    component: public-faucet
  ports:
-    - port: 8080
-      name: http
-      targetPort: 8080
+  - port: 8000
+    targetPort: 8000
+    name: grpc-web-port 
  type: ClusterIP
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata: 
+  name: api-prylabs-net
+  namespace: istio-system
+spec:
+  hosts:
+  - api.prylabs.net
+  gateways:
+  - prylabs-wildcard-gateway
+  http:
+  - route:
+    - destination:
+        port: 
+          number: 8000
+        host: public-faucet.pow.svc.cluster.local
+    corsPolicy:
+      allowOrigin:
+        - "*"
+      allowMethods:
+        - POST
+        - GET
+        - OPTIONS
+        - PUT
+        - DELETE
+      allowHeaders:
+        - grpc-timeout
+        - content-type
+        - keep-alive
+        - user-agent
+        - cache-control
+        - content-type
+        - content-transfer-encoding
+        - x-accept-content-transfer-encoding
+        - x-accept-response-streaming
+        - x-user-agent
+        - x-grpc-web
+      maxAge: 1728s
+      exposeHeaders:
+        - grpc-status
+        - grpc-message
--- a/k8s/geth/goerli.config.yaml
+++ b/k8s/geth/goerli.config.yaml
@ -823,5 +823,34 @@ data:
      "enode://176b9417f511d05b6b2cf3e34b756cf0a7096b3094572a8f6ef4cdcb9d1f9d00683bf0f83347eebdf3b81c3521c2332086d9592802230bf528eaf606a1d9677b@13.93.54.137:30303",
      "enode://46add44b9f13965f7b9875ac6b85f016f341012d84f975377573800a863526f4da19ae2c620ec73d11591fa9510e992ecc03ad0751f53cc02f7c7ed6d55c7291@94.237.54.114:30313",
      "enode://c1f8b7c2ac4453271fa07d8e9ecf9a2e8285aa0bd0c07df0131f47153306b0736fd3db8924e7a9bf0bed6b1d8d4f87362a71b033dc7c64547728d953e43e59b2@52.64.155.147:30303",
-       "enode://f4a9c6ee28586009fb5a96c8af13a58ed6d8315a9eee4772212c1d4d9cebe5a8b8a78ea4434f318726317d04a3f531a1ef0420cf9752605a562cfe858c46e263@213.186.16.82:30303"
+       "enode://f4a9c6ee28586009fb5a96c8af13a58ed6d8315a9eee4772212c1d4d9cebe5a8b8a78ea4434f318726317d04a3f531a1ef0420cf9752605a562cfe858c46e263@213.186.16.82:30303",
+       "enode://0dfa7f6e75ae29db0c4c7b437662dca82e6f4d0a437377522e1a8d6899bef6b22b17b9c2b4d97efc778022c7195a4521234b14caee9393b88711f1c58dfa28d2@193.25.101.157:30303",
+       "enode://faa6771806db7b7755c93e26fff129e7062d12eba10c8819d2f8f8393c56025a1abc3ef3b08d9c42276b82dff0bafb657e0ce8263d8f044b63da71b7ea160701@144.76.236.199:40303",
+       "enode://11b9b881072c2597f57a60a46573d045506c8942f6f7caeb1030cc15daf848f19a34c907ae2f0413ea482e62d7774345bf967b41f2e68c389fb5f9bb4733387f@83.133.244.235:30308",
+       "enode://37cf5cff7438500ed2917b18e7c6968fdb4c6beaea4321ef07a6ac794f835419f1e52794d4ef5e6ecba648d1167841ed88dfeff4ba114c21e61cc043309902d7@178.19.221.38:30303",
+       "enode://176b9417f511d05b6b2cf3e34b756cf0a7096b3094572a8f6ef4cdcb9d1f9d00683bf0f83347eebdf3b81c3521c2332086d9592802230bf528eaf606a1d9677b@13.93.54.137:30303",
+       "enode://79048141f7fac7c8d5d6385ba82db8bc2721b83b321e13cd58045ce36c06f2ecce52419414004006834147650a827f454a41d11cfb5dda1ac377fab9021d05ee@54.88.169.219:30303",
+       "enode://1ee64d8fbfc102f65989976c97cd255f4a44217be3b4a3c2bd3eb16c36412d2088af255937759729c3cc22c0719ec25cb2a2b32de6968a1a7e2ca30b4cdf5bbe@184.72.172.101:30303",
+       "enode://be85d983bc2e7c2342446366f540a7ef88369c698e544d0dc1cbface103358ab6765f851587e6eedfa5c8b5f4a24a7d8a102cd0b73a9d1bf7a3c10e7e5ab4ab9@178.128.229.101:30303",
+       "enode://7b45b47751af98cc096d1eb6000ce7ed9180c3c197ff1eeff7a9dffe9dea235f0c78b2e0636afaa2a29eb4e3f662bd87602c027447016bc392c189dda3c360a2@199.182.232.17:30303",
+       "enode://c1f8b7c2ac4453271fa07d8e9ecf9a2e8285aa0bd0c07df0131f47153306b0736fd3db8924e7a9bf0bed6b1d8d4f87362a71b033dc7c64547728d953e43e59b2@52.64.155.147:30303",
+       "enode://0dcbcc08d92d002689d885993ca422c3cad48da2bd9957a00f65e6fd0c87395beda4b345b42b441dace1baf459abc60b9224c618ac2f15845256eb38940af148@5.189.176.161:38303",
+       "enode://afac0eec5a87f3b7b697d377e894f39e29bdf784a1a4ef6ac88a7b3890d02ae345aa69a3d066e987a1c4d0970a73d583a622aa2952724be434d214b3935f33c5@207.180.208.90:38303",
+       "enode://ace5aa59b9624a9c0e4e43bc45ffa21b18178ee675e8bd90c12850824509c00dff40304544db913fb8ed5e9fdc791346240a3fffeb66cdf38ee2a42686fc1e2d@157.230.145.111:30303",
+       "enode://167e1143c41f127017340a85d4045f7c2a82264853f05a4c5b9fb2a57b2117621373446447a0d6baa4013422abe0ccc15d3a78a9467686244ef32dee36e20561@35.176.227.86:30303",
+       "enode://90f1511aefa32021ea90da2535a94201f4ef6d33fdc5d22793c66d6ffaccd52f3dbe32f4b383e31261b78a81522a5c891c1a1f436dfb6acc9e01f0496376d0b2@18.185.53.69:30303",
+       "enode://bf11c9b29f943fe840133d5675c2e7d18d8c6ac776c10fdebc06afbd30bcbd60eb57019d9d479aa17f13e2f323d7a0ef6418d588464960ea6fcccb1e84431409@3.92.108.81:30303",
+       "enode://90123dbca6e8ae1796431017cc00b2a6de5ec1114d108670f1da183c9ae0f024b4d1cb5abd13dbcf260f0b166fa31803ab99ca8f620f6dae8d800a37bfbb951c@178.128.229.101:30303",
+       "enode://011f758e6552d105183b1761c5e2dea0111bc20fd5f6422bc7f91e0fabbec9a6595caf6239b37feb773dddd3f87240d99d859431891e4a642cf2a0a9e6cbb98a@51.141.78.53:30303",
+       "enode://1ee64d8fbfc102f65989976c97cd255f4a44217be3b4a3c2bd3eb16c36412d2088af255937759729c3cc22c0719ec25cb2a2b32de6968a1a7e2ca30b4cdf5bbe@184.72.172.101:30303",
+       "enode://0dfa7f6e75ae29db0c4c7b437662dca82e6f4d0a437377522e1a8d6899bef6b22b17b9c2b4d97efc778022c7195a4521234b14caee9393b88711f1c58dfa28d2@193.25.101.157:30303",
+       "enode://11b9b881072c2597f57a60a46573d045506c8942f6f7caeb1030cc15daf848f19a34c907ae2f0413ea482e62d7774345bf967b41f2e68c389fb5f9bb4733387f@83.133.244.235:30308",
+       "enode://f2fdc86b60b70d1861eae07a3dbcc19dea1ea9fda07e4046c28f55481c8ce78c106e60b31ef0fc8bbbcba8708d892d3e051dfc6ef994345d51710bf1f32f6318@54.84.193.65:30300",
+       "enode://176b9417f511d05b6b2cf3e34b756cf0a7096b3094572a8f6ef4cdcb9d1f9d00683bf0f83347eebdf3b81c3521c2332086d9592802230bf528eaf606a1d9677b@13.93.54.137:30303",
+       "enode://c1f8b7c2ac4453271fa07d8e9ecf9a2e8285aa0bd0c07df0131f47153306b0736fd3db8924e7a9bf0bed6b1d8d4f87362a71b033dc7c64547728d953e43e59b2@52.64.155.147:30303",
+       "enode://4ccd3bb614cdc4adf879a2837c17f823f84ff4333a43cc25caf22f6bfa5b0727eee01c79a36cfd94e3c707c3ea7d69c197ab5ca053591bd499bec75625d1e0d4@54.183.211.78:30303",
+       "enode://573b6607cd59f241e30e4c4943fd50e99e2b6f42f9bd5ca111659d309c06741247f4f1e93843ad3e8c8c18b6e2d94c161b7ef67479b3938780a97134b618b5ce@52.56.136.200:30303",
+       "enode://bf11c9b29f943fe840133d5675c2e7d18d8c6ac776c10fdebc06afbd30bcbd60eb57019d9d479aa17f13e2f323d7a0ef6418d588464960ea6fcccb1e84431409@3.92.108.81:30303",
+       "enode://37cf5cff7438500ed2917b18e7c6968fdb4c6beaea4321ef07a6ac794f835419f1e52794d4ef5e6ecba648d1167841ed88dfeff4ba114c21e61cc043309902d7@178.19.221.38:30303",
+       "enode://be45489e74fa5dd27a5cd5a62a7a3460cd1ec1a067d6f3e2ac7a4183019f7845e7a31dc40d090812b39c9ad9567b4900b6de4ccf3e6a5d4bb9aa0c07242244dc@34.210.9.238:30303"
    ]
--- a/k8s/geth/nodes.deploy.yaml
+++ b/k8s/geth/nodes.deploy.yaml
@ -52,8 +52,6 @@ spec:
            - >
              geth
              --networkid=5
-              --bootnodesv4=enode://$(BOOTNODE_PUBKEY)@$(GETH_BOOTNODE_V4_SERVICE_HOST):$(GETH_BOOTNODE_V4_SERVICE_PORT_BOOTNODE_UDP)
-              --bootnodesv5=enode://$(BOOTNODE_PUBKEY)@$(GETH_BOOTNODE_V5_SERVICE_HOST):$(GETH_BOOTNODE_V5_SERVICE_PORT_BOOTNODE_UDP)
              --ethstats=💎prylabs-$HOSTNAME:$(ETHSTATS_WS_SECRET)@wss://stats.goerli.net
              --rpc
              --rpcapi=eth
@ -61,7 +59,6 @@ spec:
              --keystore=/keystore
              --verbosity=3
              --nousb
-              --lightserv=50
              --metrics
              --mine
              --unlock=0xd9a5179f091d85051d3c982785efd1455cec8699
--- a/k8s/geth/public_nodes.service.yaml
+++ b/k8s/geth/public_nodes.service.yaml
@ -22,43 +22,15 @@ spec:
  type: ClusterIP
 ---
 apiVersion: networking.istio.io/v1alpha3
-kind: Gateway
-metadata:
-  name: public-rpc-nodes-gateway
-  namespace: pow
-spec:
-  selector:
-    istio: ingressgateway 
-  servers:
-  - port:
-      number: 80
-      name: http
-      protocol: HTTP
-    hosts:
-    - goerli.prylabs.net
-    tls:
-      httpsRedirect: false
-  - port:
-      number: 443
-      name: https
-      protocol: HTTPS
-    hosts:
-    - goerli.prylabs.net
-    tls:
-      mode: SIMPLE
-      privateKey: /etc/istio/ingressgateway-certs/tls.key
-      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
---
-apiVersion: networking.istio.io/v1alpha3
 kind: VirtualService
 metadata:
-  name: public-rpc-nodes
-  namespace: pow
+  name: goerli-prylabs-net
+  namespace: istio-system
 spec:
  hosts:
  - goerli.prylabs.net
  gateways:
-  - public-rpc-nodes-gateway
+  - prylabs-wildcard-gateway
  http:
  - match:
    - uri:
@ -85,14 +57,6 @@ spec:
        port:
          number: 8545
        host: public-rpc-nodes.pow.svc.cluster.local
-        subset: v1
-      weight: 50
-    - destination:
-        port:
-          number: 8545
-        host: public-rpc-nodes.pow.svc.cluster.local
-        subset: v1-stable
-      weight: 50
 ---
 apiVersion: networking.istio.io/v1alpha3
 kind: DestinationRule
@ -101,13 +65,6 @@ spec:
   namespace: pow
 spec:
   host: public-rpc-nodes.pow.svc.cluster.local
-   subsets:
-   - name: v1
-     labels:
-       version: v1
-   - name: v1-stable
-     labels:
-       version: v1-stable
   trafficPolicy:
     loadBalancer:
       consistentHash:
--- a/k8s/prylabs-wildcard-gateway.yaml
+++ b/k8s/prylabs-wildcard-gateway.yaml
@ -0,0 +1,30 @@
+# Note: Gateways cannot share the same TLS certificates so this wild card 
+# gateway should be used for all services requesting *.prylabs.net.
+# See: https://github.com/istio/istio/issues/9429
+apiVersion: networking.istio.io/v1alpha3
+kind: Gateway
+metadata:
+  name: prylabs-wildcard-gateway
+  namespace: istio-system
+spec:
+  selector:
+    istio: ingressgateway 
+  servers:
+  - port:
+      number: 80
+      name: http
+      protocol: HTTP
+    hosts:
+    - goerli.prylabs.net
+    tls:
+      httpsRedirect: false
+  - port:
+      number: 443
+      name: https
+      protocol: HTTPS
+    hosts:
+    - "*.prylabs.net"
+    tls:
+      mode: SIMPLE
+      privateKey: /etc/istio/ingressgateway-certs/tls.key
+      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
--- a/proto/faucet/BUILD.bazel
+++ b/proto/faucet/BUILD.bazel
@ -0,0 +1,11 @@
+# gazelle:ignore
+load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+
+go_proto_library(
+    name = "faucet_go_proto",
+    importpath = "github.com/prysmaticlabs/prysm/proto/faucet",
+    proto = "@prysm_testnet_site//:faucet_proto",
+    compiler = "//:grpc_proto_compiler",
+    visibility = ["//visibility:public"],
+)
+
--- a/proto/faucet/faucet.pb.go
+++ b/proto/faucet/faucet.pb.go
@ -0,0 +1,781 @@
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: src/proto/faucet.proto
+
+package faucet
+
+import proto "github.com/gogo/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+import (
+	context "golang.org/x/net/context"
+	grpc "google.golang.org/grpc"
+)
+
+import io "io"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+
+type FundingRequest struct {
+	WalletAddress        string   `protobuf:"bytes,1,opt,name=wallet_address,json=walletAddress,proto3" json:"wallet_address,omitempty"`
+	RecaptchaSiteKey     string   `protobuf:"bytes,2,opt,name=recaptcha_site_key,json=recaptchaSiteKey,proto3" json:"recaptcha_site_key,omitempty"`
+	RecaptchaResponse    string   `protobuf:"bytes,3,opt,name=recaptcha_response,json=recaptchaResponse,proto3" json:"recaptcha_response,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *FundingRequest) Reset()         { *m = FundingRequest{} }
+func (m *FundingRequest) String() string { return proto.CompactTextString(m) }
+func (*FundingRequest) ProtoMessage()    {}
+func (*FundingRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_faucet_376b649ffc3eaaa1, []int{0}
+}
+func (m *FundingRequest) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *FundingRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_FundingRequest.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalTo(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (dst *FundingRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_FundingRequest.Merge(dst, src)
+}
+func (m *FundingRequest) XXX_Size() int {
+	return m.Size()
+}
+func (m *FundingRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_FundingRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_FundingRequest proto.InternalMessageInfo
+
+func (m *FundingRequest) GetWalletAddress() string {
+	if m != nil {
+		return m.WalletAddress
+	}
+	return ""
+}
+
+func (m *FundingRequest) GetRecaptchaSiteKey() string {
+	if m != nil {
+		return m.RecaptchaSiteKey
+	}
+	return ""
+}
+
+func (m *FundingRequest) GetRecaptchaResponse() string {
+	if m != nil {
+		return m.RecaptchaResponse
+	}
+	return ""
+}
+
+type FundingResponse struct {
+	Error                string   `protobuf:"bytes,1,opt,name=error,proto3" json:"error,omitempty"`
+	Amount               string   `protobuf:"bytes,2,opt,name=amount,proto3" json:"amount,omitempty"`
+	TransactionHash      string   `protobuf:"bytes,3,opt,name=transactionHash,proto3" json:"transactionHash,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *FundingResponse) Reset()         { *m = FundingResponse{} }
+func (m *FundingResponse) String() string { return proto.CompactTextString(m) }
+func (*FundingResponse) ProtoMessage()    {}
+func (*FundingResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_faucet_376b649ffc3eaaa1, []int{1}
+}
+func (m *FundingResponse) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *FundingResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_FundingResponse.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalTo(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (dst *FundingResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_FundingResponse.Merge(dst, src)
+}
+func (m *FundingResponse) XXX_Size() int {
+	return m.Size()
+}
+func (m *FundingResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_FundingResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_FundingResponse proto.InternalMessageInfo
+
+func (m *FundingResponse) GetError() string {
+	if m != nil {
+		return m.Error
+	}
+	return ""
+}
+
+func (m *FundingResponse) GetAmount() string {
+	if m != nil {
+		return m.Amount
+	}
+	return ""
+}
+
+func (m *FundingResponse) GetTransactionHash() string {
+	if m != nil {
+		return m.TransactionHash
+	}
+	return ""
+}
+
+func init() {
+	proto.RegisterType((*FundingRequest)(nil), "faucet.FundingRequest")
+	proto.RegisterType((*FundingResponse)(nil), "faucet.FundingResponse")
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConn
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion4
+
+// FaucetServiceClient is the client API for FaucetService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type FaucetServiceClient interface {
+	RequestFunds(ctx context.Context, in *FundingRequest, opts ...grpc.CallOption) (*FundingResponse, error)
+}
+
+type faucetServiceClient struct {
+	cc *grpc.ClientConn
+}
+
+func NewFaucetServiceClient(cc *grpc.ClientConn) FaucetServiceClient {
+	return &faucetServiceClient{cc}
+}
+
+func (c *faucetServiceClient) RequestFunds(ctx context.Context, in *FundingRequest, opts ...grpc.CallOption) (*FundingResponse, error) {
+	out := new(FundingResponse)
+	err := c.cc.Invoke(ctx, "/faucet.FaucetService/RequestFunds", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// FaucetServiceServer is the server API for FaucetService service.
+type FaucetServiceServer interface {
+	RequestFunds(context.Context, *FundingRequest) (*FundingResponse, error)
+}
+
+func RegisterFaucetServiceServer(s *grpc.Server, srv FaucetServiceServer) {
+	s.RegisterService(&_FaucetService_serviceDesc, srv)
+}
+
+func _FaucetService_RequestFunds_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(FundingRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(FaucetServiceServer).RequestFunds(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/faucet.FaucetService/RequestFunds",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(FaucetServiceServer).RequestFunds(ctx, req.(*FundingRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+var _FaucetService_serviceDesc = grpc.ServiceDesc{
+	ServiceName: "faucet.FaucetService",
+	HandlerType: (*FaucetServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "RequestFunds",
+			Handler:    _FaucetService_RequestFunds_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "src/proto/faucet.proto",
+}
+
+func (m *FundingRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *FundingRequest) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.WalletAddress) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintFaucet(dAtA, i, uint64(len(m.WalletAddress)))
+		i += copy(dAtA[i:], m.WalletAddress)
+	}
+	if len(m.RecaptchaSiteKey) > 0 {
+		dAtA[i] = 0x12
+		i++
+		i = encodeVarintFaucet(dAtA, i, uint64(len(m.RecaptchaSiteKey)))
+		i += copy(dAtA[i:], m.RecaptchaSiteKey)
+	}
+	if len(m.RecaptchaResponse) > 0 {
+		dAtA[i] = 0x1a
+		i++
+		i = encodeVarintFaucet(dAtA, i, uint64(len(m.RecaptchaResponse)))
+		i += copy(dAtA[i:], m.RecaptchaResponse)
+	}
+	if m.XXX_unrecognized != nil {
+		i += copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	return i, nil
+}
+
+func (m *FundingResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *FundingResponse) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.Error) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintFaucet(dAtA, i, uint64(len(m.Error)))
+		i += copy(dAtA[i:], m.Error)
+	}
+	if len(m.Amount) > 0 {
+		dAtA[i] = 0x12
+		i++
+		i = encodeVarintFaucet(dAtA, i, uint64(len(m.Amount)))
+		i += copy(dAtA[i:], m.Amount)
+	}
+	if len(m.TransactionHash) > 0 {
+		dAtA[i] = 0x1a
+		i++
+		i = encodeVarintFaucet(dAtA, i, uint64(len(m.TransactionHash)))
+		i += copy(dAtA[i:], m.TransactionHash)
+	}
+	if m.XXX_unrecognized != nil {
+		i += copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	return i, nil
+}
+
+func encodeVarintFaucet(dAtA []byte, offset int, v uint64) int {
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return offset + 1
+}
+func (m *FundingRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.WalletAddress)
+	if l > 0 {
+		n += 1 + l + sovFaucet(uint64(l))
+	}
+	l = len(m.RecaptchaSiteKey)
+	if l > 0 {
+		n += 1 + l + sovFaucet(uint64(l))
+	}
+	l = len(m.RecaptchaResponse)
+	if l > 0 {
+		n += 1 + l + sovFaucet(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *FundingResponse) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Error)
+	if l > 0 {
+		n += 1 + l + sovFaucet(uint64(l))
+	}
+	l = len(m.Amount)
+	if l > 0 {
+		n += 1 + l + sovFaucet(uint64(l))
+	}
+	l = len(m.TransactionHash)
+	if l > 0 {
+		n += 1 + l + sovFaucet(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func sovFaucet(x uint64) (n int) {
+	for {
+		n++
+		x >>= 7
+		if x == 0 {
+			break
+		}
+	}
+	return n
+}
+func sozFaucet(x uint64) (n int) {
+	return sovFaucet(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (m *FundingRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowFaucet
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: FundingRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: FundingRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WalletAddress", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowFaucet
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthFaucet
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.WalletAddress = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RecaptchaSiteKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowFaucet
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthFaucet
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RecaptchaSiteKey = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RecaptchaResponse", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowFaucet
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthFaucet
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RecaptchaResponse = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipFaucet(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthFaucet
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *FundingResponse) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowFaucet
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: FundingResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: FundingResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowFaucet
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthFaucet
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Error = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Amount", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowFaucet
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthFaucet
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Amount = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TransactionHash", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowFaucet
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthFaucet
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TransactionHash = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipFaucet(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthFaucet
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipFaucet(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowFaucet
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowFaucet
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+			return iNdEx, nil
+		case 1:
+			iNdEx += 8
+			return iNdEx, nil
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowFaucet
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			iNdEx += length
+			if length < 0 {
+				return 0, ErrInvalidLengthFaucet
+			}
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowFaucet
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipFaucet(dAtA[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
+		case 5:
+			iNdEx += 4
+			return iNdEx, nil
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+	}
+	panic("unreachable")
+}
+
+var (
+	ErrInvalidLengthFaucet = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowFaucet   = fmt.Errorf("proto: integer overflow")
+)
+
+func init() { proto.RegisterFile("src/proto/faucet.proto", fileDescriptor_faucet_376b649ffc3eaaa1) }
+
+var fileDescriptor_faucet_376b649ffc3eaaa1 = []byte{
+	// 268 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x64, 0x90, 0x4d, 0x4a, 0xf4, 0x40,
+	0x10, 0x86, 0xbf, 0xfe, 0xc4, 0x80, 0xcd, 0xfc, 0x68, 0x23, 0x31, 0xb8, 0x08, 0x32, 0x20, 0xcc,
+	0x42, 0x67, 0x40, 0x4f, 0x30, 0x2e, 0x06, 0xc1, 0x5d, 0xe6, 0x00, 0xa1, 0xed, 0x94, 0x4e, 0xe3,
+	0xd8, 0x1d, 0xab, 0x2a, 0xca, 0xdc, 0xc3, 0x43, 0xb9, 0xf4, 0x08, 0x92, 0x93, 0x88, 0xe9, 0x26,
+	0xf8, 0xb3, 0x7c, 0x9f, 0x7a, 0xa1, 0x5e, 0x1e, 0x99, 0x12, 0x9a, 0x79, 0x8d, 0x9e, 0xfd, 0xfc,
+	0x4e, 0x37, 0x06, 0x78, 0xd6, 0x05, 0x95, 0x84, 0x34, 0x79, 0x15, 0x72, 0xb4, 0x6c, 0x5c, 0x65,
+	0xdd, 0x7d, 0x01, 0x4f, 0x0d, 0x10, 0xab, 0x53, 0x39, 0x7a, 0xd1, 0x9b, 0x0d, 0x70, 0xa9, 0xab,
+	0x0a, 0x81, 0x28, 0x13, 0x27, 0x62, 0xba, 0x57, 0x0c, 0x03, 0x5d, 0x04, 0xa8, 0xce, 0xa4, 0x42,
+	0x30, 0xba, 0x66, 0xb3, 0xd6, 0x25, 0x59, 0x86, 0xf2, 0x01, 0xb6, 0xd9, 0xff, 0xae, 0xba, 0xdf,
+	0x5f, 0x56, 0x96, 0xe1, 0x06, 0xb6, 0xea, 0xfc, 0x7b, 0x1b, 0x81, 0x6a, 0xef, 0x08, 0xb2, 0x9d,
+	0xae, 0x7d, 0xd0, 0x5f, 0x8a, 0x78, 0x98, 0x58, 0x39, 0xee, 0x57, 0x05, 0xa4, 0x0e, 0xe5, 0x2e,
+	0x20, 0x7a, 0x8c, 0x6b, 0x42, 0x50, 0xa9, 0x4c, 0xf4, 0xa3, 0x6f, 0x1c, 0xc7, 0xcf, 0x31, 0xa9,
+	0xa9, 0x1c, 0x33, 0x6a, 0x47, 0xda, 0xb0, 0xf5, 0xee, 0x5a, 0xd3, 0x3a, 0x3e, 0xfb, 0x8d, 0x2f,
+	0x0a, 0x39, 0x5c, 0x76, 0x2e, 0x56, 0x80, 0xcf, 0xd6, 0x80, 0x5a, 0xc8, 0x41, 0x54, 0xf1, 0x35,
+	0x81, 0x54, 0x3a, 0x8b, 0xe6, 0x7e, 0x7a, 0x3a, 0x3e, 0xfa, 0xc3, 0xe3, 0xf8, 0x7f, 0x57, 0x83,
+	0xb7, 0x36, 0x17, 0xef, 0x6d, 0x2e, 0x3e, 0xda, 0x5c, 0xdc, 0x26, 0x9d, 0xf2, 0xcb, 0xcf, 0x00,
+	0x00, 0x00, 0xff, 0xff, 0x9a, 0x27, 0xc6, 0x35, 0x8c, 0x01, 0x00, 0x00,
+}
--- a/tools/faucet/BUILD.bazel
+++ b/tools/faucet/BUILD.bazel
@ -0,0 +1,56 @@
+# gazelle:ignore
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@io_bazel_rules_docker//go:image.bzl", "go_image")
+load("@io_bazel_rules_docker//container:container.bzl", "container_push")
+
+IMPORT_PATH = "github.com/prysmaticlabs/prysm/tools/faucet"
+SRCS = [
+    "main.go",
+    "server.go",
+]
+DEPS = [
+    "//proto/faucet:faucet_go_proto",
+    "@org_golang_google_grpc//:go_default_library",
+    "@org_golang_google_grpc//peer:go_default_library",
+    "@org_golang_google_grpc//reflection:go_default_library",
+    "@com_github_prestonvanloon_go_recaptcha//:go_default_library",
+]
+
+go_library(
+    name = "go_default_library",
+    srcs = SRCS,  
+    importpath = IMPORT_PATH,
+    visibility = ["//visibility:private"],
+    deps = DEPS,
+)
+
+go_binary(
+    name = "faucet",
+    embed = [":go_default_library"],
+    visibility = ["//visibility:public"],
+)
+
+go_image(
+    name = "image",
+    srcs = SRCS,
+    importpath = IMPORT_PATH,
+    deps = DEPS,
+    pure = "off", # depends on cgo for go-ethereum crypto
+    static = "on",
+    tags = ["manual"],
+    goarch = "amd64",
+    goos = "linux",
+    race = "off",
+)
+
+container_push(
+    name = "push_image",
+    format = "Docker",
+    image = ":image",
+    registry = "gcr.io",
+    repository = "prysmaticlabs/prysm/faucet",
+    tag = "latest",
+    tags = ["manual"],
+    visibility = ["//visibility:private"],
+)
--- a/tools/faucet/main.go
+++ b/tools/faucet/main.go
@ -0,0 +1,38 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"net"
+
+	recaptcha "github.com/prestonvanloon/go-recaptcha"
+	faucetpb "github.com/prysmaticlabs/prysm/proto/faucet"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/reflection"
+)
+
+var (
+	port            = flag.Int("port", 8000, "Port to server gRPC service")
+	recaptchaSecret = flag.String("recaptcha_secret", "", "Secret to verify recaptcha")
+)
+
+func main() {
+	flag.Parse()
+
+	lis, err := net.Listen("tcp", fmt.Sprintf(":%d", *port))
+	if err != nil {
+		panic(err)
+	}
+	s := grpc.NewServer()
+	fmt.Println("recaptcha = " + *recaptchaSecret)
+	faucetpb.RegisterFaucetServiceServer(s, &faucetServer{
+		r: recaptcha.Recaptcha{RecaptchaPrivateKey: *recaptchaSecret},
+	})
+
+	reflection.Register(s)
+
+	fmt.Printf("Serving gRPC requests on port %d\n", *port)
+	if err := s.Serve(lis); err != nil {
+		fmt.Printf("Error: %v", err)
+	}
+}
--- a/tools/faucet/server.go
+++ b/tools/faucet/server.go
@ -0,0 +1,44 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	recaptcha "github.com/prestonvanloon/go-recaptcha"
+	faucetpb "github.com/prysmaticlabs/prysm/proto/faucet"
+	"google.golang.org/grpc/peer"
+)
+
+var minScore = 0.5
+
+type faucetServer struct {
+	r recaptcha.Recaptcha
+}
+
+// RequestFunds from the ethereum 1.x faucet. Requires a valid captcha
+// response.
+func (s *faucetServer) RequestFunds(ctx context.Context, req *faucetpb.FundingRequest) (*faucetpb.FundingResponse, error) {
+	p, ok := peer.FromContext(ctx)
+	if !ok {
+		return nil, errors.New("peer from ctx not ok")
+	}
+	fmt.Printf("Sending captcha request for peer %s\n", p.Addr.String())
+
+	rr, err := s.r.Check(p.Addr.String(), req.RecaptchaResponse)
+	if err != nil {
+		return nil, err
+	}
+	if !rr.Success {
+		fmt.Printf("Unsuccessful recaptcha request. Error codes: %+v\n", rr.ErrorCodes)
+		return &faucetpb.FundingResponse{Error: "Recaptcha failed"}, nil
+	}
+	if rr.Score < minScore {
+		return &faucetpb.FundingResponse{Error: "Recaptcha score too low"}, nil
+	}
+
+	return &faucetpb.FundingResponse{
+		Amount:          "500000000000000000",
+		TransactionHash: "0xfake",
+	}, nil
+}