README
¶
tmsigner
A lightweight single key tendermint validator signer for use with an array of sentry nodes.
Fork information and code history
The tmsigner is based off of litvintech's fork of polychainlabs/tendermint-validator. This fork reorganizes the code and adds much nicer config management to the code. This is the basis for future improvements to this code.
With respect to the work by:
Design
A lightweight alternative to using a full node instance for validating blocks. The validator is able to connect to any number of sentry nodes and will sign blocks provided by the nodes. The validator maintains a watermark file to protect against double signing.
Pre-requisites
Before starting, please make sure to fully understand node and validator requirements and operation for your particular network and chain.
Setup
The security of any key material is outside the scope of this guide. At a minimum we recommend performing key material steps on airgapped computers and using your audited security procedures.
Setup Validator Instance
Configure the instance with a toml file. Below is a sample configuration.
# The network chain id for your p2p nodes
chain_id = "chain-id-here"
# Configure any number of p2p network nodes.
# We recommend at least 2 nodes for redundancy.
[[node]]
address = "tcp://<node-a ip>:1234"
[[node]]
address = "tcp://<node-b ip>:1234"
You can generate this by running tmsigner init {{chain_id}}. tmsigner expects the private key file to exist in $HOME/.tmsigner/priv_validator_key.json and the state file to exist in $HOME/.tmsigner/data/{{chain_id}}_priv_validator_state.json. You can change the default home folder using the --home flag on all commands.
Configure p2p network nodes
Validators are not directly connected to the p2p network nor do they store chain and application state. They rely on nodes to receive blocks from the p2p network, make signing requests, and relay the signed blocks back to the p2p network.
To make a node available as a relay for a validator, find the priv_validator_laddr (or equivalent) configuration item in your node's configuration file. Change this value, to accept connections on an IP address and port of your choosing.
# TCP or UNIX socket address for Tendermint to listen on for
# connections from an external PrivValidator process
-priv_validator_laddr = ""
+priv_validator_laddr = "tcp://0.0.0.0:1234"
Full configuration and operation of your tendermint node is outside the scope of this guide. You should consult your network's documentation for node configuration.
We recommend hosting nodes on separate and isolated infrastructure from your validator instances.
Launch validator
Once your validator instance and node is configured, you can launch the signer.
tmsigner start
We recommend using systemd or similar service management program as appropriate for your runtime platform.
Security
Security and management of any key material is outside the scope of this service. Always consider your own security and risk profile when dealing with sensitive keys, services, or infrastructure.
No Liability
As far as the law allows, this software comes as is, without any warranty or condition, and no contributor will be liable to anyone for any damages related to this software or this license, under any kind of legal claim.
References
Documentation
¶
Overview ¶
Copyright © 2020 Jack Zampolin jack.zampolin@gmail.com
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Source Files
Directories