Update scripts and playbooks to sign gentx on a separate machine

This commit is contained in:
Shreerang Kale 2025-06-09 12:51:53 +05:30
parent 6733aa7318
commit 338966f43f
5 changed files with 258 additions and 185 deletions

View File

@ -7,8 +7,151 @@
- LPS distribution Google spreadsheet URL or CSV file path
- Install `gzip` using `sudo apt install gzip`
## Setup node
- Run the following steps in the machine where the mainnet node is to be setup
- Copy the example variables file if not already done:
```bash
cp ~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.example.yml ~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.yml
```
- Update `~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.yml` with required values:
```bash
# Set custom moniker for the node
cerc_moniker: "LaconicMainnetNode"
# Set desired key name
key_name: "laconic-validator"
```
- Export the data directory and mainnet deployment directory as environment variables:
```bash
# Parent directory where the deployment directory will live
export DATA_DIRECTORY=
# Set mainnet deployment directory
# for eg: mainnet-laconicd-deployment
export MAINNET_DEPLOYMENT_DIR=
```
- Run ansible playbook to setup the node:
```bash
ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/first-validator/setup-first-validator.yml
```
- Get the public key of your node:
```bash
docker run -it \
-v ./$MAINNET_DEPLOYMENT_DIR/data/laconicd-data:/root/.laconicd \
cerc/laconicd:local bash -c "laconicd tendermint show-validator"
```
NOTE: This public key is required in next step to generate the genesis file
### Setup TMKMS (Optional but Recommended)
<!-- Reference: https://docs.osmosis.zone/osmosis-core/keys/tmkms/#setup-tmkms -->
- For integrating existing TMKMS with laconicd, follow steps below in the machine where TMKMS is setup
- Set `$TMKMS_HOME` to the directory path containing TMKMS config files
```bash
# Contents of tmkms config directory
ls -l $TMKMS_HOME
drwxrwxr-x 2 ... schema
drwx------ 2 ... secrets
drwxrwxr-x 2 ... state
-rw-rw-r-- 1 ... tmkms.toml
```
- Update the TMKMS configuration file `$TMKMS_HOME/tmkms.toml`:
```toml
[[chain]]
id = "laconic-mainnet"
key_format = { type = "cosmos-json", account_key_prefix = "laconicpub", consensus_key_prefix = "laconicvalconspub" }
# Replace <TMKMS_HOME> with absolute path to tmkms config directory
state_file = "<TMKMS_HOME>/state/priv_validator_state.json"
[[validator]]
chain_id = "laconic-mainnet"
# Replace <NODE_IP> with actual IP address of the laconicd node
addr = "tcp://<NODE_IP>:26659"
# Replace <TMKMS_HOME> with absolute path to tmkms config directory
secret_key = "<TMKMS_HOME>/secrets/kms-identity.key"
protocol_version = "v0.34"
reconnect = true
[[providers.softsign]]
key_type = "consensus"
# Replace <TMKMS_HOME> with absolute path to tmkms config directory
path = "<TMKMS_HOME>/secrets/priv_validator_key"
chain_ids = ["laconic-mainnet"]
```
- Copy your validator key to TMKMS:
- The validator key in laconicd node deployment is present at `$DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/config/priv_validator_key.json`
- Place the validator key file in TMKMS config directory at `$TMKMS_HOME/secrets/`
- Import the private validator key into tmkms:
```bash
tmkms softsign import $TMKMS_HOME/secrets/priv_validator_key.json $TMKMS_HOME/secrets/priv_validator_key
```
- Remove the JSON key file
```bash
rm $TMKMS_HOME/secrets/priv_validator_key.json
```
- Start TMKMS:
```bash
tmkms start --config $TMKMS_HOME/tmkms.toml
```
- Expected example output:
```bash
INFO tmkms::commands::start: tmkms 0.14.0 starting up...
INFO tmkms::keyring: [keyring:softsign] added consensus Ed25519 key: {"@type":"/cosmos.crypto.ed25519.PubKey","key":"T24No1A1FmetNRVCOSg2G2XAKWh97oBXuELdAD6DFgw="}
INFO tmkms::connection::tcp: KMS node ID: 7f5fd8dae8953e964e7e56edd4700f597ea0d45c
ERROR tmkms::client: [laconic-mainnet@tcp://localhost:26659] I/O error: Connection refused (os error 111)
```
NOTE: The errors dissapear once the laconicd node starts
- Note the pubkey logged at start for comparing later with validator pubkey on chain
- Enable TMKMS in the laconicd node configuration:
```bash
# Set TMKMS_ENABLED to true in the node's config.env
echo "TMKMS_ENABLED=true" >> $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/config.env
```
- Remove the validator key from node deployment as it is no longer required
```bash
rm $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/config/priv_validator_key.json
```
NOTE: Store it safely offline in case of an emergency
## Export testnet state
- Run the following steps in machine where the testnet node is running
- Get your private key from testnet deployment:
```bash
@ -39,17 +182,19 @@
## Generate mainnet genesis file
- If mainnet node is to be setup in a new machine, fetch the stack again:
- Run the following steps in secure machine separate from the one where the node is setup
- Fetch the stack:
```bash
laconic-so fetch-stack git.vdb.to/cerc-io/laconicd-stack --git-ssh --pull
```
- Copy over compressed `testnet-state.gz` file to target machine
- Copy over compressed `testnet-state.gz` file
- Extract the testnet-state JSON file
- Extract the testnet-state JSON file:
```
```bash
gzip -dc <path-to-compressed-file>/testnet-state.gz > testnet-state.json
# Remove zip folder
@ -64,66 +209,13 @@
- This will generate the `distribution.json` file
- Copy over the LPS lockup distribution `distribution.json` file to target machine
- Set envs:
```bash
export EXPORTED_STATE_PATH=<absolute-path-to-exported-testnet-state-json>
export LPS_DISTRIBUTION_PATH=<absolute-path-to-distribution-json>
export EARLY_SUPPORTS_ACC_ADDR=<account-address-controlled-by-laconic-foundation>
```
- Copy the example variables file:
```bash
cp ~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.example.yml ~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.yml
```
- Run playbook to use exported state for generating mainnet genesis:
```bash
ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/first-validator/generate-genesis.yml -e "exported_state_path=$EXPORTED_STATE_PATH" -e "lps_distribution_path=$LPS_DISTRIBUTION_PATH" -e "early_supports_acc_address=$EARLY_SUPPORTS_ACC_ADDR"
```
- Genesis file will be generated in output directory along with a file specifying the staking amount
```bash
# List files in output directory - genesis.json and staking-amount.json
ls -l output
```
## Setup node
- Copy the example variables file if not already done:
```bash
cp ~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.example.yml ~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.yml
```
- Update `~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.yml` with required values:
```bash
# Use the private key of the existing account that was exported in previous steps
pvt_key: "<private-key>"
# Path to the generated mainnet genesis file
# Use the absolute path of generated output directory in the previous steps
genesis_file: "<absolute-path-to-generated-output-dir>/genesis.json"
# Path to staking-amount.json generated in previous steps
staking_amount_file: "<absolute-path-to-generated-output-dir>/staking-amount.json"
# Set custom moniker for the node
cerc_moniker: "LaconicMainnetNode"
# Set desired key name
key_name: "laconic-validator"
```
- Export the data directory and mainnet deployment directory as environment variables:
```bash
# Parent directory where the deployment directory will live
export DATA_DIRECTORY=
@ -132,104 +224,43 @@
export MAINNET_DEPLOYMENT_DIR=
```
- Run ansible playbook to submit gentx and setup the node:
- Copy the example variables file:
```bash
ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/first-validator/setup-first-validator.yml
cp ~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.example.yml ~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.yml
```
### Setup TMKMS (Optional but Recommended)
<!-- Reference: https://docs.osmosis.zone/osmosis-core/keys/tmkms/#setup-tmkms -->
- For integrating existing TMKMS with laconicd, follow steps below in the machine where TMKMS is setup
- Set `$TMKMS_HOME` to the directory path containing TMKMS config files
- Edit `~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.yml` with required values:
```bash
# Contents of tmkms config directory
ls -l $TMKMS_HOME
drwxrwxr-x 2 ... schema
drwx------ 2 ... secrets
drwxrwxr-x 2 ... state
-rw-rw-r-- 1 ... tmkms.toml
# Use the public key exported in previous step (make sure to wrap it with single quotes [''])
validator_pub_key: '<public-key-of-your-node>'
```
- Update the TMKMS configuration file `$TMKMS_HOME/tmkms.toml`:
```toml
[[chain]]
id = "laconic-mainnet"
key_format = { type = "cosmos-json", account_key_prefix = "laconicpub", consensus_key_prefix = "laconicvalconspub" }
# Replace <TMKMS_HOME> with absolute path to tmkms config directory
state_file = "<TMKMS_HOME>/state/priv_validator_state.json"
[[validator]]
chain_id = "laconic-mainnet"
# Replace <NODE_IP> with actual IP address of the laconicd node
addr = "tcp://<NODE_IP>:26659"
# Replace <TMKMS_HOME> with absolute path to tmkms config directory
secret_key = "<TMKMS_HOME>/secrets/kms-identity.key"
protocol_version = "v0.34"
reconnect = true
[[providers.softsign]]
key_type = "consensus"
# Replace <TMKMS_HOME> with absolute path to tmkms config directory
path = "<TMKMS_HOME>/secrets/priv_validator_key"
chain_ids = ["laconic-mainnet"]
```
- Copy your validator key to TMKMS:
- The validator key in laconicd node deployment is present at `$DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/config/priv_validator_key.json`
- Place the validator key file in TMKMS config directory at `$TMKMS_HOME/secrets/`
- Import the private validator key into tmkms:
```bash
tmkms softsign import $TMKMS_HOME/secrets/priv_validator_key.json $TMKMS_HOME/secrets/priv_validator_key
```
- Remove the JSON key file
```bash
rm $TMKMS_HOME/secrets/priv_validator_key.json
```
- Start TMKMS:
```bash
tmkms start --config $TMKMS_HOME/tmkms.toml
```
- Expected example output:
```bash
INFO tmkms::commands::start: tmkms 0.14.0 starting up...
INFO tmkms::keyring: [keyring:softsign] added consensus Ed25519 key: {"@type":"/cosmos.crypto.ed25519.PubKey","key":"T24No1A1FmetNRVCOSg2G2XAKWh97oBXuELdAD6DFgw="}
INFO tmkms::connection::tcp: KMS node ID: 7f5fd8dae8953e964e7e56edd4700f597ea0d45c
ERROR tmkms::client: [laconic-mainnet@tcp://localhost:26659] I/O error: Connection refused (os error 111)
```
NOTE: The errors dissapear once the laconicd node starts
- Note the pubkey logged at start for comparing later with validator pubkey on chain
- Enable TMKMS in the laconicd node configuration:
```bash
# Set TMKMS_ENABLED to true in the node's config.env
echo "TMKMS_ENABLED=true" >> $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/config.env
```
- Remove the validator key from node deployment as it is no longer required
- Run playbook to use exported state for generating mainnet genesis:
```bash
rm $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/config/priv_validator_key.json
ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/first-validator/generate-genesis.yml -e "exported_state_path=$EXPORTED_STATE_PATH" -e "lps_distribution_path=$LPS_DISTRIBUTION_PATH" -e "early_supports_acc_address=$EARLY_SUPPORTS_ACC_ADDR"
```
NOTE: Store it safely offline in case of an emergency
- Input private key of the existing account that was exported in previous steps when prompted
- Genesis file will be generated in output directory along with a file specifying the staking amount
```bash
# List files in output directory - genesis.json and staking-amount.json
ls -l output
```
## Run node
- Command to run node
- Copy the genesis file to the mainnet deployment tmp directory:
```bash
cp <absolute-path-to-genesis-json> $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/tmp/genesis.json
```
- Command to run node:
```bash
laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR start
@ -241,14 +272,15 @@
laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR logs laconicd -f
```
- If TMKMS has been configured verify that validator and TMKMS pubkeys match
- If TMKMS has been configured verify that validator and TMKMS pubkeys match:
- Get validator pubkey on chain
```bash
# Check consensus_pubkey in output
laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR exec laconicd 'laconicd query staking validators -o json | jq .validators'
```
- Compare it with the pubkey noted from logs in TMKMS
- Check bonds list to confirm that testnet state was transferred properly:

View File

@ -3,6 +3,4 @@ cerc_chain_id: "laconic-mainnet"
min_gas_price: 0.001
cerc_loglevel: "info"
key_name: "laconic-validator"
pvt_key: ""
genesis_file: ""
staking_amount_file: ""
validator_pub_key: ''

View File

@ -3,13 +3,24 @@
hosts: localhost
vars_files:
- first-validator-vars.yml
vars:
data_directory: "{{ lookup('env', 'DATA_DIRECTORY') }}"
mainnet_deployment_dir: "{{ lookup('env', 'MAINNET_DEPLOYMENT_DIR') }}"
spec_file: "{{data_directory}}/laconicd-spec.yml"
connection: local
tasks:
- name: Fail if DATA_DIRECTORY or MAINNET_DEPLOYMENT_DIR env vars are not set
fail:
msg: >-
Required environment variables are not set.
Please export both DATA_DIRECTORY and MAINNET_DEPLOYMENT_DIR before running the playbook.
when: lookup('env', 'DATA_DIRECTORY') == '' or lookup('env', 'MAINNET_DEPLOYMENT_DIR') == ''
- name: Fetch repositories
ansible.builtin.shell:
cmd: "laconic-so --stack ~/cerc/laconicd-stack/stack-orchestrator/stacks/mainnet-laconicd setup-repositories --git-ssh --pull"
# TODO: Add a playbook flag to control force rebuild
# TODO: Add a flag to control force rebuild
- name: Build containers
ansible.builtin.shell:
cmd: "laconic-so --stack ~/cerc/laconicd-stack/stack-orchestrator/stacks/mainnet-laconicd build-containers --force-rebuild"
@ -43,3 +54,65 @@
- name: Display staking-amount file location
ansible.builtin.debug:
msg: "Staking amount written to output/staking-amount.json"
- name: Create deployment spec file
shell: |
laconic-so --stack ~/cerc/laconicd-stack/stack-orchestrator/stacks/mainnet-laconicd deploy init --output {{ spec_file }}
- name: Create deployment from spec file
shell: |
laconic-so --stack ~/cerc/laconicd-stack/stack-orchestrator/stacks/mainnet-laconicd deploy create --spec-file {{ spec_file }} --deployment-dir {{data_directory}}/{{ mainnet_deployment_dir }}
- name: Ensure tmp directory exists inside laconicd-data
file:
path: "{{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data/tmp"
state: directory
mode: '0755'
- name: Copy staking amount file to laconicd-data tmp directory
copy:
src: "{{ lookup('env', 'PWD') }}/output/staking-amount.json"
dest: "{{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data/tmp/staking-amount.json"
mode: '0644'
- name: Copy genesis file to laconicd-data tmp directory
copy:
src: "{{ lookup('env', 'PWD') }}/output/genesis.json"
dest: "{{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data/tmp/genesis.json"
mode: '0644'
- name: Prompt for validator private key
vars:
private_key_prompt: "Please enter your validator private key: "
pause:
prompt: "{{ private_key_prompt }}"
echo: no
register: private_key_input
- name: Fail if private key is not provided
fail:
msg: "Private key is required for creating the gentx."
when: private_key_input.user_input | default('') | trim == ''
- name: Run script to create and collect gentx
shell: |
docker run -i \
-v {{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data:/root/.laconicd \
-v {{data_directory}}/{{ mainnet_deployment_dir }}/config/mainnet-laconicd:/scripts \
-e "PVT_KEY={{ private_key_input.user_input }}" \
-e "KEY_NAME={{ key_name }}" \
-e "CERC_MONIKER={{ cerc_moniker }}" \
-e "CERC_CHAIN_ID={{ cerc_chain_id }}" \
-e "VALIDATOR_PUB_KEY={{ validator_pub_key | to_json }}" \
cerc/laconicd:local bash -c "/scripts/create-and-collect-gentx.sh"
- name: Update genesis file in output
copy:
src: "{{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data/config/genesis.json"
dest: "{{ lookup('env', 'PWD') }}/output/genesis.json"
mode: '0644'
- name: Clear tmp directory
file:
path: "{{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data/tmp"
state: absent

View File

@ -56,39 +56,3 @@
MIN_GAS_PRICE: "{{ min_gas_price }}"
CERC_LOGLEVEL: "{{ cerc_loglevel }}"
mode: '0777'
- name: Ensure tmp directory exists inside laconicd-data
file:
path: "{{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data/tmp"
state: directory
mode: '0755'
- name: Copy staking amount file to laconicd-data tmp directory
copy:
src: "{{ staking_amount_file }}"
dest: "{{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data/tmp/staking-amount.json"
mode: '0644'
- name: Copy genesis file to laconicd-data tmp directory
copy:
src: "{{ genesis_file }}"
dest: "{{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data/tmp/genesis.json"
mode: '0644'
- name: Fail if pvt_key is not set
fail:
msg: >-
Private key (pvt_key) is not set in first-validator-vars.yml.
This is required for creating the gentx.
when: not pvt_key
- name: Run script to create and collect gentx
shell: |
docker run -i \
-v {{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data:/root/.laconicd \
-v {{data_directory}}/{{ mainnet_deployment_dir }}/config/mainnet-laconicd:/scripts \
-e "PVT_KEY={{ pvt_key }}" \
-e "KEY_NAME={{ key_name }}" \
-e "CERC_MONIKER={{ cerc_moniker }}" \
-e "CERC_CHAIN_ID={{ cerc_chain_id }}" \
cerc/laconicd:local bash -c "/scripts/create-and-collect-gentx.sh"

View File

@ -4,6 +4,7 @@ set -e
NODE_HOME=/root/.laconicd
genesis_file_path=$NODE_HOME/config/genesis.json
# TODO: Set to OS keyring backend
KEYRING="test"
if [ -f "$genesis_file_path" ]; then
@ -21,6 +22,11 @@ if [ -z "$KEY_NAME" ]; then
exit 1
fi
if [ -z "$VALIDATOR_PUB_KEY" ]; then
echo "VALIDATOR_PUB_KEY environment variable not set, exiting..."
exit 1
fi
input_genesis_file=$NODE_HOME/tmp/genesis.json
if [ ! -f ${input_genesis_file} ]; then
echo "Genesis file not provided, exiting..."
@ -66,7 +72,7 @@ fi
stake_amount=$(jq -r '.common_staking_amount' "$staking_amount_file")
# Create gentx with staked amount equal to allocated balance
laconicd genesis gentx $KEY_NAME $stake_amount$DENOM --chain-id $CHAIN_ID --keyring-backend $KEYRING
laconicd genesis gentx $KEY_NAME $stake_amount$DENOM --chain-id $CHAIN_ID --keyring-backend $KEYRING --pubkey "$VALIDATOR_PUB_KEY"
# Collect the gentx and validate
laconicd genesis collect-gentxs
@ -74,5 +80,5 @@ laconicd genesis validate
chmod 777 $genesis_file_path
# Update the input genesis file
cp $genesis_file_path $input_genesis_file
# Clear tmp directory
rm -rf $NODE_HOME/tmp