In this guide we will create an Akash Validator as a deployment on the Akash network. The Tendermint Key Management System (TMKMS) will be used so that we do not store the validator’s private key on the validator server itself.
An implementation of Stunnel is included to provide secure peer to peer communication between the Akash validator and the TMKMS server.
The Validator deployment will take advantage of statesync for rapid blockchain synchronization.
Sections in this guide:
- STEP 1 - Validator Topology
- STEP 2 - Obtain Private Key
- STEP 3 - Akash Validator Deployment
- STEP 4 - TMKMS Setup
- STEP 5 - Start and Verify the TMKMS Service
- STEP 6 - Stunnel Client
- STEP 7 - Verify Validator Status
- Additional Resources
Additional Resources
Creation of an Akash Validator with TMKMS and Stunnel via streamlined steps is the focus of this guide. For further information and details, reference the following GitHub repository maintained by the creators of the Omnibus project.
Validator Topology
In this guide we create a Validator within an Akash Deployment.
The topology of the environment will be as follows:
- Akash Validator as a deployment and as created in the Akash Validator Deployment section of this guide
- Tendermint Key Managment System (TMKMS) used for storage of the Validators private key on a secured server. The TMKMS instance - configured in the TMKMS Setup section of this guide - may be created on any secure server of your choosing. The TMKMS server must have connectivity to the Akash Validator.
- Stunnel provides a secure communication path between the validator and the TMKMS node. A Stunnel server will be co-located with the Validator. A Stunnel client will be co-located with the TMKMS server.
Obtain Private Key
In the TMKMS Setup section of this guide we will import your Validators private key.
If you have a pre-existing Akash Validator the private key from this instance may be used.
If this is a new Akash Validator - create an Akash validator instance for the purpose of private key generation, capture the private key, and then shut down the validator. Use the instructions in Akash Node Deployment Via Omnibus to easily build an Akash Node for this purpose and to obtain the validator private key as detailed below. It is NOT necessary to complete the additional steps to turn the Node into a Validator. Completing only the Node build will allow the capture of the needed Validator private key.
Example Validator Private Key Retrieval
- Display contents of key file on the validator
- Example Output
Akash Validator Deployment
Akash Console
- Within this guide we will use the Akash Console application to create the Akash Validator
- Please review our Akash Console docs for instructions on how to install and configure the application if this is your first time using
Create the Akash Validator Deployment
- Use the steps that follow - within Akash Console - to create your Akash Validator deployment
- The Akash SDL used additionally spins up a Stunnel server to facilitate secure communication with the TMKMS server created in later steps
Create New Deployment
- Use the
CREATE DEPLOYMENT
button to launch a new deployment
Empty Template Option
- Select the
Empty
option as we will be copying a pre-constructed Akash SDL for the deployment
Copy SDL into Editor
- Copy the following Akash SDL into the Editor pane
- Reference the Populated Editor section of this guide for further clarity
- Note that the SDL is using persistent storage to allow data residency should your deployment restart. Data will only persist thru the life of the associated Akash lease.
To ensure the most to update SDL is utilized, view the latest version here.
SDL Edits
- Consider updating the Pre-Shared Key (PSK) value in the
proxy
service >env
stanza to your own unique value. The pre-shared key must match that which is defined in the upcoming Stunnel Client configuration. - Update the MONIKER in the
node
service >env
stanza to your own name/organization name. - No additional edits of this SDL are necessary for Akash Validator creation.
Populated Editor
NOTE- SDL spans past the view in this panel and bottom portion is not displayed
- Select the
CREATE DEPLOYMENT
button to proceed
Deployment Deposit
- An escrow account is created for the deployment that is deducted from by the provider for the cost of the workload over time
- By default 0.5 AKT is specified as the initial escrow deposit
- If a deployment’s escrow runs out of funds (0 AKT), the lease will be closed by the provider. Consider increasing the initial deposit to an amount that will be enough to fund the deployment for some time. And/or consider a strategy to ensure the escrow is re-funded on a periodic basis to ensure no disruption to your validator.
- When ready select
DEPOSIT
to proceed andAPPROVE
any Transaction/gas fee prompts that follow
Select Akash Provider
- A list of Akash Providers that have bid on your deployment is displayed
- Choose the desired Provider from the list and then select
ACCEPT BID
to proceed
Deployment Logs
- The
LOGS > EVENTS
pane for the new Deployment will display - NOTE - after a period of time the logs will display a
Back-off restarting failed container
message. This is expected as the container will not start until it has established a connection with the TMKMS server in subsequent steps. - Select the
LEASES
tab to proceed into the next step
Capture Deployment URI and Port
- In upcoming TMKMS configuration sections we will need to specify our Akash Validator deployment’s URI and port
- Capture this info from the
LEASES
tab for later use and specifically in the Stunnel Client section - In the example the following values would be captured (these values will be different for your deployment):
- URI - using the Provider field -
provider.mainnet-1.ca.aksh.pw
- Signer Port - using the Forwarded Port field and capturing the port forward to
36658
which in this example is31684
- Proxy/RPC Port -using the Forwarded Port field and capturing the port forward to
36657
which in this example is32675
TMKMS Setup
Considerations
- In a future step in this guide we deploy a Stunnel client which must co-exist on the same machine as the TMKMS server
- For simplicity we use Docker Compose to build the Stunnel client
- We do not offer a TMKMS image based on security concerns in using a third party TMKMS image. However you may want to consider using the Linux instructions below for TMKMS server build and create a container image yourself so that both the TKMKS server and the Stunnel client may both be deployed as containers on the single host.
Prepare TMKMS Dependencies (Ubuntu Instructions)
- All steps in this section should be performed on the TMKMS server unless otherwise noted
Rust Install
GCC
Libusb
Setup TMKMS
- All steps in this section should be performed on the TMKMS server unless otherwise noted
Compiling TMKMS from Source Code
Copy Validator Private Key into TMKMS Config File
- Create the
priv_validator_key.json
file
- Copy/paste the validator private key into the
priv_validator_key.json
file
Example priv_validator_key.json
file
Import the Private Validator Key into TMKMS
Delete Private Key File on the Validator
- Conduct this step on the Akash Validator machine
- Securely delete the priv_validator_key.json from your validator node and store it safely offline in case of an emergency. The
priv_validator_key
will be what TMKMS will use to sign for your validator. - Return to the TMKMS server after this step to complete subsequent steps in this section
Modify tmkms.toml
- Begin by deleting the existing
tmkms.toml
file and re-creating anew
- Copy the following configuration into the new
tmkms.toml
file - No edits to the file syntax below should be necessary
Start and Verify the TMKMS Service
All steps in this section should be performed on the TMKMS server unless otherwise noted
Start the TMKMS Service
Initial Log Messages
- The following connection error messages will initially display after the TMKMS service start
- Wait approximately 5-10 minutes for the connection to establish and at which time these error messages should cease
Log Messages Indicating Successful TMKMS Connection
- NOTE - these verifications and log entries will not be seen until after the Stunnel Client is created and configured
- Eventually the following TMKMS log messages should display indicating successful connection between the TMKMS server and the Akash validator
Stunnel Client
Overview
- The Stunnel client is used to connect to the Stunnel server which was co-located on the Akash Validator server in prior steps
- We will install the Stunnel client via Docker Compose
- The Stunnel client must co-exist on the same server as TMKMS which was built in the prior step
Stunnel Client Source Code
Stunnel Repository with Docker Files
- The Stunnel Dockerfile and Docker Compose files used in this section are located here for your review
Pull Down a Copy of the Stunnel Repo
- This step and all subsequent steps should be performed on the server TMKMS was installed on prior
Customize the Stunnel Client Docker Compose File
- Navigate into the
client
directory and make necessary updates to thedocker-compose.yml
file as detailed below
Necessary Docker Compose File Updates
- Use the details captured in the Akash Validator Deployment section of the guide - within the
Capture Deployment URI and Port
subsection - for the Docker Compose file updates discussed below
STUNNEL_SVC_RPC_CONNECT
- Update the
STUNNEL_SVC_RPC_CONNECT
field - This field should use the exposed Proxy/RPC port captured during the Akash Validator deployment and within this step
- Template - update the provider and exposed port variables with your unique Akash deployment values
- Example of the setting based on the example deployment in this guide
STUNNEL_SVC_SIGNER_CONNECT
- Update the
STUNNEL_SVC_SIGNER_CONNECT
field - This field should use the exposed Signer port captured during the Akash Validator deployment and within this step
- Template - update the provider and exposed port variables with your unique Akash deployment values
- Example of the setting based on the example deployment in this guide
Network > Server_Default Setting
- Update the Network > Server_Default setting to external: false such as:
Pre-Shared Key (PSK)
- Ensure the PSK field matches the value defined earlier in the Akash Validator Deployment section
Example docker-compose.yaml
File
Docker Compose Up
- Create the Stunnel Client Container
Stunnel Client Successful Connection Logs
Confirm Name of Container
Example Output
View Stunnel Client Container Logs
Example
Example Logs Indicating Successful Connection
Verify Validator Status
Overview
- In this section we will verify the state of the Akash Validator following successful integration of TMKMS and Stunnel
- Use Akash Console for the validations in this section
Verify Stunnel Proxy Service
- Navigate into your Akash Validator deployment within Akash Console
- Enter the
LOGS
tab of the deployment - From the
Services
drop down menu > selectproxy
- With Stunnel logs isolated we should see successful TLS connection messages such as the examples below
Verify Validator Status
- Navigate into your Akash Validator deployment within Akash Console
- Enter the
LOGS
tab of the deployment - From the
Services
drop down menu > selectnode
- With Validator logs isolated we should see successful
executed block
andcommitted state
messages such as those below