Checkout to relevant branch while setting up tmkms stack

Add instructions to setup yubihsm
Add playbooks to run TMKMS service (#14 )
2025-06-12 18:40:57 +05:30 · 2025-06-12 18:34:04 +05:30 · 2025-06-12 11:20:33 +00:00 · 2025-06-11 15:05:04 +00:00 · 2025-06-10 10:07:15 +00:00 · 2025-06-09 12:37:50 +00:00
24 changed files with 975 additions and 371 deletions
@@ -1,5 +1,13 @@
 # laconicd-stack

- Follow [run-first-validator.md](docs/run-first-validator.md) to run the first validator node
- Follow [cosmos-multisig-app playbook](./playbooks/cosmos-multisig-app/README.md) to run the Cosmos Multisig app
- Follow [run-validator.md](docs/run-validator.md) to run subsequent validator nodes
+- This stack is used for running nodes to launch Laconic mainnet chain
+
+- It allows you to export SAPO testnet state and start mainnet nodes
+
+- To launch Laconic mainnet, follow these steps:
+
+  - **Run the First Validator Node:** Begin by setting up and running the initial validator node as detailed in [run-first-validator.md](docs/run-first-validator.md)
+
+  - **Deploy Cosmos Multisig App:** Integrate and run the Cosmos Multisig app using the playbook available at [cosmos-multisig-app playbook](./playbooks/cosmos-multisig-app/README.md)
+
+  - **Run Subsequent Validator Nodes:** Run subsequent validator nodes by following the instructions in [run-validator.md](docs/run-validator.md)
@@ -18,25 +18,25 @@
    {
      "coinDenom": "ALNT",
      "coinMinimalDenom": "alnt",
-      "coinDecimals": 18
+      "coinDecimals": 0
    }
  ],
  "feeCurrencies": [
    {
      "coinDenom": "ALNT",
      "coinMinimalDenom": "alnt",
-      "coinDecimals": 18,
+      "coinDecimals": 0,
      "gasPriceStep": {
-        "low": 0.01,
-        "average": 0.01,
-        "high": 0.02
+        "low": 0.001,
+        "average": 0.001,
+        "high": 0.002
      }
    }
  ],
  "stakeCurrency": {
    "coinDenom": "ALNT",
    "coinMinimalDenom": "alnt",
-    "coinDecimals": 18
+    "coinDecimals": 0
  },
  "features": [
    "stargate",
@@ -9,13 +9,13 @@
    ```bash
    cargo install tmkms --features=softsign --version=0.14.0
    ```
- Install `gzip` using `sudo apt install gzip`
- testnet-state.gz ([exported testnet state](./run-first-validator.md#export-testnet-state)) 
+- Install `zstd` using `sudo apt install zstd`
+- testnet-state.zst ([exported testnet state](./run-first-validator.md#export-testnet-state)) 
 - LPS distribution Google spreadsheet URL or CSV file path

 ## Steps

- In current working directory demo, keep exported `testnet-state.gz` file from prerequisites
+- In current working directory demo, keep exported `testnet-state.zst` file from prerequisites

 - Fetch stack:

@@ -40,10 +40,10 @@
 - Extract the testnet-state JSON file

  ```
-  gzip -dc $CWD/testnet-state.gz > $CWD/testnet-state.json
+  zstd -dc $CWD/testnet-state.zst > $CWD/testnet-state.json

-  # Remove zip folder
-  rm -rf testnet-state.gz
+  # Remove zst folder
+  rm -rf testnet-state.zst
  ```

 - Set envs:
@@ -416,7 +416,7 @@
    use_host_network: "host"

    # Set local host URL for dgraph server
-    dgraph_domain: "http://localhost:8080"
+    dgraph_domain: "http://localhost:8090"
    ```

 - Set envs:
@@ -2,13 +2,126 @@

 ## Prerequisites

- [ansible](playbooks/README.md#ansible-installation)
- [laconic-so](https://github.com/cerc-io/stack-orchestrator/?tab=readme-ov-file#install)
- LPS distribution Google spreadsheet URL or CSV file path
- Install `gzip` using `sudo apt install gzip`
+- Machine 1: Where the SAPO testnet node is already running
+
+  - Install `zstd` using `sudo apt install zstd`
+
+- Machine 2: Where the mainnet first validator node is to be setup
+
+- Machine 3: Where the genesis file is to be generated
+
+  - Install `zstd` using `sudo apt install zstd`
+
+  - LPS distribution Google spreadsheet URL or CSV file path
+
+- Machine 4: Where the TMKMS service is to be setup
+
+- Following tools are required in all machines:
+
+  - [ansible](playbooks/README.md#ansible-installation)
+  - [laconic-so](https://github.com/cerc-io/stack-orchestrator/?tab=readme-ov-file#install)
+
+  - laconicd-stack
+
+    ```bash
+    laconic-so fetch-stack git.vdb.to/cerc-io/laconicd-stack --git-ssh --pull
+    ```
+
+## Build laconicd to generate genesis file
+
+- Run the following steps in a secure machine (machine 3) separate from the one where the node is to be setup (machine 2)
+
+- Run playbook to build laconicd container:
+
+  ```bash
+  ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/validator/build-laconicd.yml
+  ```
+
+## Setup node
+
+- Run the following steps in the machine where the mainnet node is to be setup (machine 2)
+
+- Copy the example variables file if not already done:
+
+  ```bash
+  cp ~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.example.yml ~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.yml
+  ```
+
+- Update `~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.yml` with required values:
+
+  ```bash
+  # Set custom moniker for the node
+  cerc_moniker: "LaconicMainnetNode"
+
+  # Set desired key name
+  key_name: "laconic-validator"
+
+  # Enable TMKMS
+  tmkms_enabled: true
+  ```
+
+- Export the data directory and mainnet deployment directory as environment variables:
+
+  ```bash
+  # Parent directory where the deployment directory will live
+  export DATA_DIRECTORY=
+
+  # Set mainnet deployment directory
+  export MAINNET_DEPLOYMENT_DIR=mainnet-laconicd-deployment
+  ```
+
+- Run ansible playbook to setup the node:
+
+  ```bash
+  ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/first-validator/setup-first-validator.yml
+  ```
+
+- Get the public key of your node:
+
+  ```bash
+    docker run -it \
+    -v $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data:/root/.laconicd \
+    cerc/laconicd:local bash -c "laconicd tendermint show-validator"
+  ```
+
+  NOTE: This public key is required in [next step to generate the genesis file](#generate-mainnet-genesis-file)
+
+- Copy over the `priv_validator_key.json` located at `$DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/config/priv_validator_key.json` to the machine where the TMKMS service is to be setup (machine 4)
+
+## Setup TMKMS
+
+- For integrating TMKMS with laconicd, follow steps below in the machine where the TMKMS service is to be setup (machine 4)
+
+- Copy the example variables file:
+
+  ```bash
+  cp ~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.example.yml ~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.yml
+  ```
+
+- Update `~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.yml` with required values:
+
+  ```yaml
+  # Set the mode of operation for TMKMS (e.g., "softsign", "yubihsm")
+  tmkms_mode: <tmkms-mode>
+  ```
+
+- Export the data directory and TMKMS deployment directory as environment variables:
+
+  ```bash
+  # Parent directory where the deployment directory will live
+  export DATA_DIRECTORY=
+  ```
+
+- Run ansible playbook to setup the TMKMS service:
+
+  ```bash
+  ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/tmkms/setup-tmkms.yml
+  ```

 ## Export testnet state

+- Run the following steps in machine where the testnet node is already running (machine 1)
+
 - Get your private key from testnet deployment:

  ```bash
@@ -23,56 +136,51 @@
  laconic-so deployment --dir <testnet-deployment-dir> stop
  ```

- Fetch the stack in machine where the testnet chain node is running:
-
-  ```bash
-  laconic-so fetch-stack git.vdb.to/cerc-io/laconicd-stack --git-ssh --pull
-  ```
-
 - Run script to export state from testnet chain:

  ```bash
  ~/cerc/laconicd-stack/scripts/export-testnet-state.sh <absolute-path-to-testnet-deployment>
  ```

-  - The compressed gzip will be generated at `<absolute-path-to-testnet-deployment>/export/testnet-state.gz`
+  - The compressed zst file will be generated at `<absolute-path-to-testnet-deployment>/export/testnet-state.zst`

 ## Generate mainnet genesis file

- If mainnet node is to be setup in a new machine, fetch the stack again:
+- Run the following steps in machine where [the genesis file is to be generated (machine 3)](#build-laconicd-to-generate-genesis-file)
+
+- Copy over compressed `testnet-state.zst` file to target machine
+
+- Set envs:

  ```bash
-  laconic-so fetch-stack git.vdb.to/cerc-io/laconicd-stack --git-ssh --pull
+  # Path where exported testnet state JSON file will be created
+  export EXPORTED_STATE_PATH=<absolute-path-to-be-exported-testnet-state-json>
+
+  # Path where LPS distribution JSON file will be created
+  export LPS_DISTRIBUTION_PATH=<absolute-path-to-be-generated-distribution-json>
+
+  export EARLY_SUPPORTS_ACC_ADDR=<account-address-controlled-by-laconic-foundation>
+
+  # Parent directory where the deployment directory will live
+  export DATA_DIRECTORY=
  ```

- Copy over compressed `testnet-state.gz` file to target machine
+- Extract the testnet-state JSON file:

- Extract the testnet-state JSON file
+  ```bash
+  zstd -dc <path-to-compressed-file>/testnet-state.zst > $EXPORTED_STATE_PATH

-  ```
-  gzip -dc <path-to-compressed-file>/testnet-state.gz > testnet-state.json
-
-  # Remove zip folder
-  rm -rf <path-to-compressed-file>/testnet-state.gz
+  # Remove zst folder
+  rm -rf <path-to-compressed-file>/testnet-state.zst
  ```

 - Generate LPS lockup distribution JSON file

  ```bash
-  ~/cerc/laconicd-stack/scripts/generate-lps-lock.sh -i "<lps-distribution-spreadsheet-url-or-file-path>" -d "<destination-folder-for-json-file>"
+  ~/cerc/laconicd-stack/scripts/generate-lps-lock.sh -i "<lps-distribution-spreadsheet-url-or-csv-file-path>" -o $LPS_DISTRIBUTION_PATH
  ```

-  - This will generate the `distribution.json` file
-
- Copy over the LPS lockup distribution `distribution.json` file to target machine
-
- Set envs:
-
-  ```bash
-  export EXPORTED_STATE_PATH=<absolute-path-to-exported-testnet-state-json>
-  export LPS_DISTRIBUTION_PATH=<absolute-path-to-distribution-json>
-  export EARLY_SUPPORTS_ACC_ADDR=<account-address-controlled-by-laconic-foundation>
-  ```
+  - This will generate the `distribution.json` file at `$LPS_DISTRIBUTION_PATH`

 - Copy the example variables file:

@@ -80,12 +188,23 @@
  cp ~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.example.yml ~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.yml
  ```

- Run playbook to use exported state for generating mainnet genesis:
+- Edit `~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.yml` with required values:
+
+  NOTE: Use the public key exported in [previous step](#setup-node)
+
+  ```bash
+  # Make sure to wrap it with single quotes ('')
+  validator_pub_key: '<public-key-of-your-node>'
+  ```
+
+- Run playbook to use exported state for generating mainnet genesis file with gentx:

  ```bash
  ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/first-validator/generate-genesis.yml -e "exported_state_path=$EXPORTED_STATE_PATH" -e "lps_distribution_path=$LPS_DISTRIBUTION_PATH" -e "early_supports_acc_address=$EARLY_SUPPORTS_ACC_ADDR"
  ```

+  - Input private key of the existing account that was exported in previous steps when prompted
+
 - Genesis file will be generated in output directory along with a file specifying the staking amount

  ```bash
@@ -93,143 +212,93 @@
  ls -l output
  ```

-## Setup node
+## Run node

- Copy the example variables file if not already done:
+### Start TMKMS
+
+- Run these steps in the machine where [the TMKMS service is setup (machine 4)](#setup-tmkms)
+
+- Copy the example variables file:

  ```bash
-  cp ~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.example.yml ~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.yml
+  cp ~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.example.yml ~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.yml
  ```

- Update `~/cerc/laconicd-stack/playbooks/first-validator/first-validator-vars.yml` with required values:
+- Update `~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.yml` with required values:
+
+  NOTE: Use the `priv_validator_key.json` file copied from the node setup machine (Machine 2) in [previous step](#setup-node)
+
+  ```yaml
+  # Absolute path to the node's private validator key file
+  priv_validator_key_file_path: "</path/to/priv_validator_key.json>"
+
+  # Set the IP address of the machine where the laconicd node is setup
+  node_ip: "<NODE_PUBLIC_IP_ADDRESS>"
+
+  # Set the port of the laconicd node
+  node_port: "26659"
+  ```
+
+- If using `yubihsm` mode, run following command to setup the yubihsm:
+
+  **WARNING: THIS PROCESS PERFORMS A FACTORY RESET OF THE YUBIHSM, DELETING ALL EXISTING KEYS AND REPLACING THEM WITH NEW ONES. MAKE SURE YOU HAVE MADE BACKUPS OF IMPORTANT KEYS BEFORE PROCEEDING!!!**

  ```bash
-  # Use the private key of the existing account that was exported in previous steps
-  pvt_key: "<private-key>"
-
-  # Path to the generated mainnet genesis file
-  # Use the absolute path of generated output directory in the previous steps
-  genesis_file: "<absolute-path-to-generated-output-dir>/genesis.json"
-
-  # Path to staking-amount.json generated in previous steps
-  staking_amount_file: "<absolute-path-to-generated-output-dir>/staking-amount.json"
-
-  # Set custom moniker for the node
-  cerc_moniker: "LaconicMainnetNode"
-
-  # Set desired key name
-  key_name: "laconic-validator"
+  # Use a strong password for YubiHSM
+  docker run -it --rm \
+  -v $DATA_DIRECTORY/tmkms-deployment/data/tmkms-data:/home/tmkmsuser/tmkms \
+  -v ~/cerc/tmkms-stack/stack-orchestrator/config/tmkms/setup-yubihsm.sh:/scripts/setup-yubihsm.sh \
+  -e "PASSWORD=<yubihsm-password>" \
+  -e "CHAIN_ID=laconic-mainnet" \
+  -e "NODE_IP=<NODE_PUBLIC_IP_ADDRESS>" \
+  -e "NODE_PORT=26659" \
+  cerc/tmkms:local bash -c "/scripts/setup-yubihsm.sh"
  ```

- Export the data directory and mainnet deployment directory as environment variables:
+- Run ansible playbook to run the TMKMS:

  ```bash
-  # Parent directory where the deployment directory will live
-  export DATA_DIRECTORY=
-
-  # Set mainnet deployment directory
-  # for eg: mainnet-laconicd-deployment
-  export MAINNET_DEPLOYMENT_DIR=
+  ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/tmkms/run-tmkms.yml
  ```

- Run ansible playbook to submit gentx and setup the node:
+- Check logs to ensure that TMKMS is running:

  ```bash
-  ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/first-validator/setup-first-validator.yml
-  ```
-
-### Setup TMKMS (Optional but Recommended)
-
-<!-- Reference: https://docs.osmosis.zone/osmosis-core/keys/tmkms/#setup-tmkms -->
-
- For integrating existing TMKMS with laconicd, follow steps below in the machine where TMKMS is setup
-
- Set `$TMKMS_HOME` to the directory path containing TMKMS config files
-
-  ```bash
-  # Contents of tmkms config directory
-  ls -l $TMKMS_HOME
-  drwxrwxr-x 2 ... schema
-  drwx------ 2 ... secrets
-  drwxrwxr-x 2 ... state
-  -rw-rw-r-- 1 ... tmkms.toml
-  ```
-
- Update the TMKMS configuration file `$TMKMS_HOME/tmkms.toml`:
-  ```toml
-  [[chain]]
-  id = "laconic-mainnet"
-  key_format = { type = "cosmos-json", account_key_prefix = "laconicpub", consensus_key_prefix = "laconicvalconspub" }
-  # Replace <TMKMS_HOME> with absolute path to tmkms config directory
-  state_file = "<TMKMS_HOME>/state/priv_validator_state.json"
-
-  [[validator]]
-  chain_id = "laconic-mainnet"
-  # Replace <NODE_IP> with actual IP address of the laconicd node
-  addr = "tcp://<NODE_IP>:26659"
-  # Replace <TMKMS_HOME> with absolute path to tmkms config directory
-  secret_key = "<TMKMS_HOME>/secrets/kms-identity.key"
-  protocol_version = "v0.34"
-  reconnect = true
-
-  [[providers.softsign]]
-  key_type = "consensus"
-  # Replace <TMKMS_HOME> with absolute path to tmkms config directory
-  path = "<TMKMS_HOME>/secrets/priv_validator_key"
-  chain_ids = ["laconic-mainnet"]
-  ```
-
- Copy your validator key to TMKMS:
-
-  - The validator key in laconicd node deployment is present at `$DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/config/priv_validator_key.json`
-
-  - Place the validator key file in TMKMS config directory at `$TMKMS_HOME/secrets/`
-
-  - Import the private validator key into tmkms:
-    
-    ```bash
-    tmkms softsign import $TMKMS_HOME/secrets/priv_validator_key.json $TMKMS_HOME/secrets/priv_validator_key
-    ```
-  
-  - Remove the JSON key file
-    
-    ```bash
-    rm $TMKMS_HOME/secrets/priv_validator_key.json
-    ```
-
- Start TMKMS:
-  ```bash
-  tmkms start --config $TMKMS_HOME/tmkms.toml
+  laconic-so deployment --dir $DATA_DIRECTORY/tmkms-deployment logs tmkms -f
  ```

  - Expected example output:
+
    ```bash
     INFO tmkms::commands::start: tmkms 0.14.0 starting up...
     INFO tmkms::keyring: [keyring:softsign] added consensus Ed25519 key: {"@type":"/cosmos.crypto.ed25519.PubKey","key":"T24No1A1FmetNRVCOSg2G2XAKWh97oBXuELdAD6DFgw="}
     INFO tmkms::connection::tcp: KMS node ID: 7f5fd8dae8953e964e7e56edd4700f597ea0d45c
-    ERROR tmkms::client: [laconic-mainnet@tcp://localhost:26659] I/O error: Connection refused (os error 111)
+    ERROR tmkms::client: [laconic-mainnet@tcp://<node-ip>:26659] I/O error: Connection refused (os error 111)
    ```
+
    NOTE: The errors dissapear once the laconicd node starts

-  - Note the pubkey logged at start for comparing later with validator pubkey on chain
+- Note the pubkey logged at start for comparing later with validator pubkey on chain

- Enable TMKMS in the laconicd node configuration:
-  ```bash
-  # Set TMKMS_ENABLED to true in the node's config.env
-  echo "TMKMS_ENABLED=true" >> $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/config.env
-  ```
+### Start node

- Remove the validator key from node deployment as it is no longer required
+- Run the following steps in the machine where [the mainnet node is setup (machine 2)](#setup-node)

-  ```bash
-  rm $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/config/priv_validator_key.json
-  ```
+- Remove the validator key from node deployment as it is no longer required:

  NOTE: Store it safely offline in case of an emergency

-## Run node
+  ```bash
+  rm -rf $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/config/priv_validator_key.json
+  ```

- Command to run node
+- Copy the genesis file to the mainnet deployment tmp directory:
+
+  ```bash
+  cp <absolute-path-to-genesis-json> $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/tmp/genesis.json
+  ```
+
+- Command to run node:

  ```bash
  laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR start
@@ -241,14 +310,15 @@
  laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR logs laconicd -f
  ```

- If TMKMS has been configured verify that validator and TMKMS pubkeys match
+- Verify that validator and TMKMS pubkeys match:

  - Get validator pubkey on chain
+
    ```bash
    # Check consensus_pubkey in output
    laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR exec laconicd 'laconicd query staking validators -o json | jq .validators'
    ```
-  
+
  - Compare it with the pubkey noted from logs in TMKMS

 - Check bonds list to confirm that testnet state was transferred properly:
@@ -278,21 +348,63 @@
  laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR exec laconicd "laconicd query bank balances $EARLY_SUPPORTS_ACC_ADDR"
  ```

+## Update config
+
+- Run following steps to update the config for TMKMS and node
+
+### TMKMS
+
+- Run these steps in the machine where the TMKMS service is setup (machine 4)
+
+- Stop the TMKMS deployment:
+
+  ```bash
+  laconic-so deployment --dir $DATA_DIRECTORY/$TMKMS_DEPLOYMENT_DIR stop
+  ```
+
+- Update `~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.yml` with required values
+
+- Run ansible playbook to run the TMKMS:
+
+  ```bash
+  ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/tmkms/run-tmkms.yml
+  ```
+
+### Node
+
+- Run these steps in the machine where the mainnet node is setup (machine 2)
+
+- Stop the node deployment:
+
+  ```bash
+  laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR stop
+  ```
+
+- Update `$DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/config.env` with required values
+
+- Start the node deployment:
+
+  ```bash
+  laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR start
+  ```
+
 ## Publish required artifacts

- Copy the genesis file to [config](./config) folder:
+- Run the following steps in machine where the genesis file and staking amount files are generated (machine 3)

-  ```bash
-  cp $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/config/genesis.json ~/cerc/laconicd-stack/config/mainnet-genesis.json
-  ```
+  - Copy the genesis file to [config](./config) folder:

- Copy the staking amount file to [config](./config) folder:
+    ```bash
+    cp $DATA_DIRECTORY/output/genesis.json ~/cerc/laconicd-stack/config/mainnet-genesis.json
+    ```

-  ```bash
-  cp $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/tmp/staking-amount.json ~/cerc/laconicd-stack/config/staking-amount.json
-  ```
+  - Copy the staking amount file to [config](./config) folder:

- Get your node's address:
+    ```bash
+    cp $DATA_DIRECTORY/output/staking-amount.json ~/cerc/laconicd-stack/config/staking-amount.json
+    ```
+
+- Get your node's address by running following command in the machine where the mainnet node is running (machine 2):

  ```bash
  laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR exec laconicd 'echo $(laconicd cometbft show-node-id)@YOUR_PUBLIC_IP_ADDRESS:26656'
@@ -2,10 +2,37 @@

 ## Prerequisites

- [ansible](playbooks/README.md#ansible-installation)
- [laconic-so](https://github.com/cerc-io/stack-orchestrator/?tab=readme-ov-file#install)
+- Machine 1: Where the SAPO testnet node is already running

-## Setup Node
+- Machine 2: Where the mainnet validator node is to be setup
+
+  - laconicd-stack
+
+  - [ansible](playbooks/README.md#ansible-installation)
+
+- Machine 3: Where the create-validator transaction is to be signed
+
+  - laconicd-stack
+
+  - [ansible](playbooks/README.md#ansible-installation)
+
+- Machine 4: Where the TMKMS service is to be setup
+
+  - laconicd-stack
+
+  - [ansible](playbooks/README.md#ansible-installation)
+
+- [laconic-so](https://github.com/cerc-io/stack-orchestrator/?tab=readme-ov-file#install) is required in all machines
+
+- To fetch laconicd-stack:
+
+  ```bash
+  laconic-so fetch-stack git.vdb.to/cerc-io/laconicd-stack --git-ssh --pull
+  ```
+
+## Stop SAPO testnet node
+
+- Run the following steps in machine where the testnet node is already running (machine 1)

 - Get your private key from testnet deployment:

@@ -13,7 +40,7 @@
  laconic-so deployment --dir <testnet-deployment-dir> exec laconicd "laconicd keys export <key-name> --unarmored-hex --unsafe"
  ```

-  NOTE: Store this key securely as it is needed in later steps
+  NOTE: Store this key securely as it is needed in [later steps](#create-validator)

 - Stop the node for SAPO testnet:

@@ -21,13 +48,19 @@
  laconic-so deployment --dir <testnet-deployment-dir> stop
  ```

- Fetch the stack:
+## Build laconicd to create validator
+
+- Run the following steps in a secure machine (machine 3) separate from the one where the node is to be setup (machine 2)
+
+- Run playbook to build laconicd container:

  ```bash
-  laconic-so fetch-stack git.vdb.to/cerc-io/laconicd-stack --git-ssh --pull
+  ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/validator/build-laconicd.yml
  ```

-  This command clones the entire repository into the `~/cerc` folder, which includes the genesis file published by the first validator.
+## Setup Node
+
+- Run the following steps in the machine where the validator node is to be setup (machine 2)

 - Copy the example variables file:

@@ -44,6 +77,9 @@
  # Set persistent peers (comma-separated list of node IDs and addresses)
  # You can find the list of available peers in https://git.vdb.to/cerc-io/laconicd-stack/src/branch/main/node-addresses.yml
  cerc_peers: "<node-id>@<node-host>:26656,<node-id>@<node-host>:26656"
+
+  # Enable TMKMS
+  tmkms_enabled: true
  ```

 - Export the data directory and mainnet deployment directory as environment variables:
@@ -53,8 +89,7 @@
  export DATA_DIRECTORY=

  # Set mainnet deployment directory
-  # for eg: mainnet-laconicd-deployment
-  export MAINNET_DEPLOYMENT_DIR=
+  export MAINNET_DEPLOYMENT_DIR=mainnet-validator-deployment
  ```

 - Run ansible playbook to set up your validator node deployment:
@@ -63,101 +98,159 @@
  ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/validator/setup-validator.yml
  ```

-### Setup TMKMS (Optional but Recommended)
+- Copy over the `priv_validator_key.json` located at `$DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/config/priv_validator_key.json` to the machine from where the TMKMS service is to be setup (machine 4)

-<!-- Reference: https://docs.osmosis.zone/osmosis-core/keys/tmkms/#setup-tmkms -->
+## Setup TMKMS

- For integrating existing TMKMS with laconicd, follow steps below in the machine where TMKMS is setup
+- For integrating TMKMS with laconicd, follow steps below in the machine where the TMKMS service is to be setup (machine 4)

- Set `$TMKMS_HOME` to the directory path containing TMKMS config files
+- Copy the example variables file:

  ```bash
-  # Contents of tmkms config directory
-  ls -l $TMKMS_HOME
-  drwxrwxr-x 2 ... schema
-  drwx------ 2 ... secrets
-  drwxrwxr-x 2 ... state
-  -rw-rw-r-- 1 ... tmkms.toml
+  cp ~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.example.yml ~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.yml
  ```

- Update the TMKMS configuration file `$TMKMS_HOME/tmkms.toml`:
-  ```toml
-  [[chain]]
-  id = "laconic-mainnet"
-  key_format = { type = "cosmos-json", account_key_prefix = "laconicpub", consensus_key_prefix = "laconicvalconspub" }
-  # Replace <TMKMS_HOME> with absolute path to tmkms config directory
-  state_file = "<TMKMS_HOME>/state/priv_validator_state.json"
+- Update `~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.yml` with required values:

-  [[validator]]
-  chain_id = "laconic-mainnet"
-  # Replace <NODE_IP> with actual IP address of the laconicd node
-  addr = "tcp://<NODE_IP>:26659"
-  # Replace <TMKMS_HOME> with absolute path to tmkms config directory
-  secret_key = "<TMKMS_HOME>/secrets/kms-identity.key"
-  protocol_version = "v0.34"
-  reconnect = true
-
-  [[providers.softsign]]
-  key_type = "consensus"
-  # Replace <TMKMS_HOME> with absolute path to tmkms config directory
-  path = "<TMKMS_HOME>/secrets/priv_validator_key"
-  chain_ids = ["laconic-mainnet"]
+  ```yaml
+  # Set the mode of operation for TMKMS (e.g., "softsign", "yubihsm")
+  tmkms_mode: <tmkms-mode>
  ```

- Copy your validator key to TMKMS:
+- Export the data directory as environment variable:

-  - The validator key in laconicd node deployment is present at `$DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/config/priv_validator_key.json`
+  ```bash
+  # Parent directory where the deployment directory will live
+  export DATA_DIRECTORY=
+  ```

-  - Place the validator key file in TMKMS config directory at `$TMKMS_HOME/secrets/`
+- Run ansible playbook to setup the TMKMS service:
+
+  ```bash
+  ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/tmkms/setup-tmkms.yml
+  ```
+
+## Run Node
+
+### Start TMKMS
+
+- Run the following steps in the machine where [the TMKMS service is setup (Machine 4)](#setup-tmkms)
+
+- Copy the example variables file:
+
+  ```bash
+  cp ~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.example.yml ~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.yml
+  ```
+
+- Update `~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.yml` with required values:
+
+  NOTE: Use the `priv_validator_key.json` file copied from the node setup machine (Machine 2) in [previous step](#setup-node)
+
+  ```yaml
+  # Absolute path to the node's private validator key file
+  priv_validator_key_file_path: "</path/to/priv_validator_key.json>"
+
+  # Set the IP address of the machine where the laconicd node is setup
+  node_ip: "<NODE_PUBLIC_IP_ADDRESS>"
+
+  # Set the port of the laconicd node
+  node_port: "26659"
+  ```
+
+- If using `yubihsm` mode, run following command to setup the yubihsm:
+
+  **WARNING: THIS PROCESS PERFORMS A FACTORY RESET OF THE YUBIHSM, DELETING ALL EXISTING KEYS AND REPLACING THEM WITH NEW ONES. MAKE SURE YOU HAVE MADE BACKUPS OF IMPORTANT KEYS BEFORE PROCEEDING!!!**
+
+  ```bash
+  # Use a strong password for YubiHSM
+  docker run -it --rm \
+  -v $DATA_DIRECTORY/tmkms-deployment/data/tmkms-data:/home/tmkmsuser/tmkms \
+  -v ~/cerc/tmkms-stack/stack-orchestrator/config/tmkms/setup-yubihsm.sh:/scripts/setup-yubihsm.sh \
+  -e "PASSWORD=<yubihsm-password>" \
+  -e "CHAIN_ID=laconic-mainnet" \
+  -e "NODE_IP=<NODE_PUBLIC_IP_ADDRESS>" \
+  -e "NODE_PORT=26659" \
+  cerc/tmkms:local bash -c "/scripts/setup-yubihsm.sh"
+  ```
+
+- Run ansible playbook to run the TMKMS:
+
+  ```bash
+  ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/tmkms/run-tmkms.yml
+  ```
+
+- Check logs to ensure that TMKMS is running:
+
+  ```bash
+  laconic-so deployment --dir $DATA_DIRECTORY/tmkms-deployment logs tmkms -f
+  ```
+
+  - Expected example output:

-  - Import the private validator key into tmkms:
-    
    ```bash
-    tmkms softsign import $TMKMS_HOME/secrets/priv_validator_key.json $TMKMS_HOME/secrets/priv_validator_key
-    ```
-  
-  - Remove the JSON key file
-    
-    ```bash
-    rm $TMKMS_HOME/secrets/priv_validator_key.json
+     INFO tmkms::commands::start: tmkms 0.14.0 starting up...
+     INFO tmkms::keyring: [keyring:softsign] added consensus Ed25519 key: {"@type":"/cosmos.crypto.ed25519.PubKey","key":"T24No1A1FmetNRVCOSg2G2XAKWh97oBXuELdAD6DFgw="}
+     INFO tmkms::connection::tcp: KMS node ID: 7f5fd8dae8953e964e7e56edd4700f597ea0d45c
+    ERROR tmkms::client: [laconic-mainnet@<node-ip>:26659] I/O error: Connection refused (os error 111)
    ```

- Start TMKMS:
-  ```bash
-  tmkms start --config $TMKMS_HOME/tmkms.toml
-  ```
+    NOTE: The errors dissapear once the laconicd node starts

- Enable TMKMS in the laconicd node configuration:
-  ```bash
-  # Set TMKMS_ENABLED to true in the node's config.env
-  echo "TMKMS_ENABLED=true" >> $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/config.env
-  ```
+- Note the pubkey logged at start for comparing later with validator pubkey on chain

-## Start Node
+### Start Node
+
+- Run the following steps in the machine where [the validator node is setup (machine 2)](#setup-node)

 - Start the laconicd node:
+
  ```bash
  laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR start
  ```

 - Check logs to ensure that node is running:
+
  ```bash
  laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR logs laconicd -f
  ```

+- Get the public key of your node:
+
+  ```bash
+  laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR exec laconicd "laconicd tendermint show-validator"
+  ```
+
+  NOTE: This public key is required in next step to create validator
+
 ## Create Validator

+- Run these steps in a machine from where [the create-validator transaction is to be signed (machine 3)](#build-laconicd-to-create-validator)
+
+- Copy the example variables file:
+
+  ```bash
+  cp ~/cerc/laconicd-stack/playbooks/validator/validator-vars.example.yml ~/cerc/laconicd-stack/playbooks/validator/validator-vars.yml
+  ```
+
+- Update `~/cerc/laconicd-stack/playbooks/validator/validator-vars.yml` with required values:
+
+  NOTE: Use the public key exported in [previous step](#start-node)
+
+  ```bash
+  # Same moniker as set above
+  cerc_moniker: "<your-moniker>"
+
+  # Make sure to wrap it with single quotes ('')
+  validator_pub_key: '<public-key-of-your-node>'
+
+  # Set the public IP address of the machine where your node is running
+  node_url: "tcp://NODE_PUBLIC_IP_ADDRESS:26657"
+  ```
+
 - Export required env vars:

  ```bash
-  # Use the private key of the existing account that was exported in previous steps
-  export PVT_KEY=<private-key-in-hex-format>
-
-  # desired key name
-  export KEY_NAME=<key-name>
-
  export DATA_DIRECTORY=<data-directory>
-  export MAINNET_DEPLOYMENT_DIR=<mainnet-deployment-dir>
  ```

 - Run ansible playbook to create validator on running chain:
@@ -166,21 +259,68 @@
  ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/validator/create-validator.yml
  ```

- Check the validator list:
+  - Input private key of the existing account that was exported in [previous steps](#stop-sapo-testnet-node) when prompted
+
+- Run the following commands in the machine where the validator node is running (machine 2)
+
+  - Check the validator list:
+
+    ```bash
+    laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR exec laconicd 'laconicd query staking validators'
+    ```
+
+  - Remove the validator key from node deployment as TMKMS is configured:
+
+    NOTE: Store it safely offline in case of an emergency
+
+    ```bash
+    rm -rf $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/config/priv_validator_key.json
+    ```
+
+## Update config
+
+- Run following steps to update the config for TMKMS and node
+
+### TMKMS
+
+- Run these steps in the machine where the TMKMS service is setup (machine 4)
+
+- Stop the TMKMS deployment:

  ```bash
-  laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR exec laconicd 'laconicd query staking validators'
+  laconic-so deployment --dir $DATA_DIRECTORY/tmkms-deployment stop
  ```

- If TMKMS has been configured, remove the validator key from node deployment as it is no longer required:
+- Update `~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.yml` with required values
+
+- Run ansible playbook to run the TMKMS:
+
  ```bash
-  rm $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/data/laconicd-data/config/priv_validator_key.json
+  ansible-playbook -i localhost, -c local ~/cerc/laconicd-stack/playbooks/tmkms/run-tmkms.yml
  ```

-  NOTE: Store it safely offline in case of an emergency
+### Node
+
+- Run these steps in the machine where the mainnet node is setup (machine 2)
+
+- Stop the node deployment:
+
+  ```bash
+  laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR stop
+  ```
+
+- Update `$DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR/config.env` with required values
+
+- Start the node deployment:
+
+  ```bash
+  laconic-so deployment --dir $DATA_DIRECTORY/$MAINNET_DEPLOYMENT_DIR start
+  ```

 ## Register Your Node

+- Run the following steps in the machine where the mainnet node is setup (machine 2)
+
 - Get your node's address:

  ```bash
@@ -4,10 +4,11 @@ This playbook sets up the Cosmos Multisig application for managing multisig wall

 ## Prerequisites

+- [Mainnet node RPC and REST API endpoints](../../docs/run-first-validator.md)
 - [ansible](../README.md#ansible-installation)
- [laconic-so](https://github.com/cerc-io/stack-orchestrator/?tab=readme-ov-file#install)
- [Running Laconic validator node](../../docs/run-validator.md)
- Keplr wallet extension installed in browser
+- If running playbook to setup deployment on remote machine, the following need to be installed in remote:
+  - [laconic-so](https://github.com/cerc-io/stack-orchestrator/?tab=readme-ov-file#install)
+  - [yq](https://github.com/mikefarah/yq?tab=readme-ov-file#wget)

 ## Configuration

@@ -23,35 +24,61 @@ This playbook sets up the Cosmos Multisig application for managing multisig wall
  cp ~/cerc/laconicd-stack/playbooks/cosmos-multisig-app/cosmos-multisig-vars.example.yml ~/cerc/laconicd-stack/playbooks/cosmos-multisig-app/cosmos-multisig-vars.yml
  ```

-* Update `cosmos-multisig-vars.yml` with your node configuration:
+* Update `~/cerc/laconicd-stack/playbooks/cosmos-multisig-app/cosmos-multisig-vars.yml` with your node configuration:
   ```yaml
   # TODO: Update with example domains mapped to ports
-   next_public_node_addresses:
-   node_rest_endpoint:
+   next_public_node_addresses: '["https://laconicd-mainnet.laconic.com"]'
+   node_rest_endpoint: "https://api.laconicd-mainnet.laconic.com"
   ```

 ## Setup Steps

-* Set environment variables:
+* Set common environment variables:
   ```bash
-   export CWD=$(pwd)
-   export DATA_DIRECTORY=$CWD
+   # Parent directory where the deployment directory will live
+   export DATA_DIRECTORY=<path/to/deployments/directory>
   export MULTISIG_DEPLOYMENT_DIR=cosmos-multisig-deployment
-   export NETWORK_JSON_PATH=~/cerc/laconicd-stack/config/network.json
   ```

+### Local Setup
+
 * Setup and start the multisig app:
   ```bash
-   ansible-playbook -v -i localhost, -c local ~/cerc/laconicd-stack/playbooks/cosmos-multisig-app/cosmos-multisig-app-start.yml
+   ansible-playbook -v -i hosts.ini ~/cerc/laconicd-stack/playbooks/cosmos-multisig-app/cosmos-multisig-app-start.yml --limit local
   ```

 * Access the app at <http://localhost:7000/laconic>

+### Remote Setup
+
+* Create and configure hosts.ini:
+  * Copy the example file:
+    ```bash
+    cp ~/cerc/laconicd-stack/playbooks/hosts.ini.example ~/cerc/laconicd-stack/playbooks/cosmos-multisig-app/hosts.ini
+    ```
+  * Edit `~/cerc/laconicd-stack/playbooks/cosmos-multisig-app/hosts.ini` and update the remote host details:
+    ```ini
+    [remote]
+    # Replace with your actual remote host details
+    remote_host ansible_host=your.remote.host ansible_user=your_remote_user ansible_ssh_common_args='-o ForwardAgent=yes'
+    ```
+  * Verify SSH connection using Ansible ping:
+    ```bash
+    ansible all -m ping -i ~/cerc/laconicd-stack/playbooks/cosmos-multisig-app/hosts.ini --limit remote_host
+    ```
+
+* Run the playbook targeting the remote host:
+   ```bash
+   ansible-playbook -v -i ~/cerc/laconicd-stack/playbooks/cosmos-multisig-app/hosts.ini ~/cerc/laconicd-stack/playbooks/cosmos-multisig-app/cosmos-multisig-app-start.yml --limit remote_host
+   ```
+
+* Access the app at <http://your.remote.host:7000/laconic>
+
 ## Check Status

 * Check app logs:
   ```bash
-   laconic-so deployment --dir $DATA_DIRECTORY/$MULTISIG_DEPLOYMENT_DIR logs -f
+   laconic-so deployment --dir $DATA_DIRECTORY/$MULTISIG_DEPLOYMENT_DIR logs -f cosmos-multisig-ui
   ```

 ## Clean up
@@ -1,6 +1,11 @@
 ---
 - name: Setup and deploy the cosmos multisig app
-  hosts: localhost
+  hosts: multihosts
+
+  # To use yq binary installed in user bin path
+  environment:
+    PATH: "{{ ansible_env.PATH }}:/home/{{ansible_user}}/bin"
+
  vars_files:
    - cosmos-multisig-vars.yml
  vars:
@@ -8,8 +13,10 @@
    multisig_deployment_dir: "{{ lookup('env', 'MULTISIG_DEPLOYMENT_DIR') }}"
    spec_output: "{{data_directory}}/cosmos-multisig-ui-spec.yml"
    spec_template: "./templates/specs/cosmos-multisig-app-spec-template.yml.j2"
+    remote_spec_template: "{{data_directory}}/cosmos-multisig-app-spec-template.yml.j2"
    network_json: "../../config/network.json"
-    temp_network_json: "{{data_directory}}/temp_network.json"
+    remote_network_json: "{{data_directory}}/network.json"
+    build_args: "{{ '--force-rebuild' if (lookup('env', 'FORCE_REBUILD') | default(omit, true)) not in [ 'false', 'False', '0' ] else '' }}"
  tasks:
    - name: Fail if DATA_DIRECTORY env var is not set
      fail:
@@ -22,19 +29,31 @@

    - name: Build container image
      shell: |
-        laconic-so --stack ~/cerc/cosmos-multisig-ui/stack-orchestrator/stacks/cosmos-multisig-ui build-containers
+        laconic-so --stack ~/cerc/cosmos-multisig-ui/stack-orchestrator/stacks/cosmos-multisig-ui build-containers {{ build_args }}

    - name: Create deployment spec file
      shell: |
        laconic-so --stack ~/cerc/cosmos-multisig-ui/stack-orchestrator/stacks/cosmos-multisig-ui deploy init --output {{ spec_output }}

+    - name: Copy spec template to remote server
+      copy:
+        src: "{{ spec_template }}"
+        dest: "{{ remote_spec_template }}"
+        mode: '0644'
+
    - name: Replace network section in spec_output
      shell: >
-        yq eval '(.network) = load("{{ spec_template }}").network' -i {{ spec_output }}
+        yq eval '(.network) = load("{{ remote_spec_template }}").network' -i {{ spec_output }}
+
+    - name: Check if deployment directory exists
+      stat:
+        path: "{{data_directory}}/{{ multisig_deployment_dir }}"
+      register: deployment_dir_stat

    - name: Create deployment from spec file
      shell: |
         laconic-so --stack ~/cerc/cosmos-multisig-ui/stack-orchestrator/stacks/cosmos-multisig-ui/ deploy create --spec-file {{ spec_output }} --deployment-dir {{data_directory}}/{{ multisig_deployment_dir }}
+      when: not deployment_dir_stat.stat.exists

    - name: Create config.env in deployment dir
      copy:
@@ -59,26 +78,38 @@
          CHAIN_CONFIG_PATH="{{data_directory}}/{{ multisig_deployment_dir }}/config/cosmos-multisig-ui/network.json"
        mode: '0644'

+    - name: Copy network.json to remote server
+      copy:
+        src: "{{ network_json }}"
+        dest: "{{ remote_network_json }}"
+        mode: '0644'
+
    - name: Update network.json with environment endpoints
      shell: |
        RPC_VALUE=$(echo '{{ next_public_node_addresses }}' | jq -r '.[0]')
        echo "Using RPC value: $RPC_VALUE"

        jq --arg rpc "$RPC_VALUE" --arg rest "{{ node_rest_endpoint }}" \
-          '.rpc = $rpc | .rest = $rest' "{{ network_json }}" > "{{ temp_network_json }}"
+          --arg chainId "{{ next_public_chain_id }}" --arg chainName "{{ next_public_chain_display_name }}" \
+          '.rpc = $rpc | .rest = $rest | .chainId = $chainId | .chainName = $chainName' "{{ remote_network_json }}" > "{{ remote_network_json }}.tmp" && \
+        mv "{{ remote_network_json }}.tmp" "{{ remote_network_json }}"
      args:
        executable: /bin/bash

    - name: Copy modified network JSON to deployment config directory
      copy:
-        src: "{{ temp_network_json }}"
+        src: "{{ remote_network_json }}"
        dest: "{{data_directory}}/{{ multisig_deployment_dir }}/config/cosmos-multisig-ui/network.json"
+        remote_src: true
        mode: '0644'

-    - name: Clean up temporary network.json
+    - name: Clean up temporary files
      file:
-        path: "{{ temp_network_json }}"
+        path: "{{ item }}"
        state: absent
+      with_items:
+        - "{{ remote_spec_template }}"
+        - "{{ remote_network_json }}"

    - name: Start the deployment
      shell: |
@@ -1,16 +1,47 @@
+# Set to true if the application supports multiple chains
 next_public_multichain: false
-next_public_registry_name: "laconic"
+
+# The name of the blockchain registry
+next_public_registry_name: "laconic-mainnet"
+
+# URL or path to the blockchain's logo
 next_public_logo: ""
+
+# The chain ID for the blockchain network
 next_public_chain_id: "laconic-mainnet"
+
+# Display name for the blockchain network
 next_public_chain_display_name: "Laconic Mainnet"
-next_public_node_addresses: ""
+
+# Comma-separated list of node addresses for the application to connect to
+next_public_node_addresses: '[]'
+
+# The REST endpoint for the node
 node_rest_endpoint: ""
+
+# The base denomination of the native token
 next_public_denom: "alnt"
+
+# The display denomination of the native token
 next_public_display_denom: "ALNT"
-next_public_display_denom_exponent: 18
-next_public_assets: '[{"denom_units":[{"denom":"alnt","exponent":0},{"denom":"alnt","exponent":6}],"base":"alnt","name":"Laconic Token","display":"ALNT","symbol":"alnt"}]'
-next_public_gas_price: "0.01alnt"
+
+# The exponent for the display denomination
+next_public_display_denom_exponent: 0
+
+# JSON array of asset definitions, including denom units, base, name, display, and symbol
+next_public_assets: '[{"denom_units":[{"denom":"alnt","exponent":0}],"base":"alnt","name":"Laconic Token","display":"ALNT","symbol":"alnt"}]'
+
+# Default gas price for transactions
+next_public_gas_price: "0.001alnt"
+
+# The address prefix for the blockchain
 next_public_address_prefix: "laconic"
+
+# Set to true if HTTP is enabled for the application
 next_public_is_http_enabled: false
+
+# Set to true to use host network mode for the Docker container
 use_host_network: ""
+
+# Domain for Dgraph service
 dgraph_domain: ""
@@ -3,4 +3,4 @@ network:
    cosmos-multisig-ui:
    - 7000:7000
    alpha:
-    - 8080:8080
+    - 8090:8080
@@ -1,8 +1,23 @@
+
+# The public key of the validator node. This is required for generating the genesis file
+# It should be wrapped in single quotes
+validator_pub_key: ''
+
+# Custom moniker for the validator node
 cerc_moniker: "LaconicMainnetNode"
+
+# The chain ID for the blockchain network
 cerc_chain_id: "laconic-mainnet"
+
+# Set to true to enable TMKMS (Tendermint Key Management System) for this node
+# If true, the node will use an external TMKMS for signing validator operations
+tmkms_enabled:
+
+# Minimum gas price for transactions, in ALNT (e.g., 0.001alnt)
 min_gas_price: 0.001
+
+# Log level for the laconicd node (e.g., "info", "debug", "error")
 cerc_loglevel: "info"
+
+# Desired key name for the validator account
 key_name: "laconic-validator"
-pvt_key: ""
-genesis_file: ""
-staking_amount_file: ""
@@ -3,27 +3,23 @@
  hosts: localhost
  vars_files:
    - first-validator-vars.yml
+  vars:
+    data_directory: "{{ lookup('env', 'DATA_DIRECTORY') }}"
+    gentx_genesis_dir: "{{data_directory}}/generate-gentx-genesis"
+    spec_file: "{{data_directory}}/laconicd-spec.yml"
  connection: local
  tasks:
-    - name: Fetch repositories
-      ansible.builtin.shell:
-        cmd: "laconic-so --stack ~/cerc/laconicd-stack/stack-orchestrator/stacks/mainnet-laconicd setup-repositories --git-ssh --pull"
-
-    # TODO: Add a playbook flag to control force rebuild
-    - name: Build containers
-      ansible.builtin.shell:
-        cmd: "laconic-so --stack ~/cerc/laconicd-stack/stack-orchestrator/stacks/mainnet-laconicd build-containers --force-rebuild"
-
-    - name: Copy exported testnet state file
-      ansible.builtin.copy:
-        src: "{{ exported_state_path }}"
-        dest: "~/cerc/laconicd-stack/testnet-state.json"
-        remote_src: true # Set to true if exported_state_path is on the target host
+    - name: Fail if DATA_DIRECTORY env vars are not set
+      fail:
+        msg: >-
+          Required environment variables are not set.
+          Please export both DATA_DIRECTORY before running the playbook.
+      when: lookup('env', 'DATA_DIRECTORY') == ''

    - block:
        - name: Run script to generate genesis file
          ansible.builtin.shell:
-            cmd: "CHAIN_ID={{ cerc_chain_id }} EARLY_SUPPORTS_ACC_ADDRESS={{ early_supports_acc_address }} {{ ansible_env.HOME }}/cerc/laconicd-stack/scripts/generate-mainnet-genesis.sh {{ ansible_env.HOME }}/cerc/laconicd-stack/testnet-state.json {{ lps_distribution_path }}"
+            cmd: "CHAIN_ID={{ cerc_chain_id }} EARLY_SUPPORTS_ACC_ADDRESS={{ early_supports_acc_address }} {{ ansible_env.HOME }}/cerc/laconicd-stack/scripts/generate-mainnet-genesis.sh {{ exported_state_path }} {{ lps_distribution_path }}"
            chdir: "{{ lookup('env', 'PWD') }}"
      always:
        - name: Clean up temporary genesis directory
@@ -31,11 +27,6 @@
            path: "{{ ansible_env.HOME }}/cerc/laconicd-stack/playbooks/first-validator/mainnet-genesis"
            state: absent

-    - name: Remove temporary copied state file
-      ansible.builtin.file:
-        path: "~/cerc/laconicd-stack/testnet-state.json"
-        state: absent
-
    - name: Display genesis file location
      ansible.builtin.debug:
        msg: "Mainnet genesis file generated at output/genesis.json"
@@ -43,3 +34,69 @@
    - name: Display staking-amount file location
      ansible.builtin.debug:
        msg: "Staking amount written to output/staking-amount.json"
+
+    - name: Create data directory
+      file:
+        path: "{{ gentx_genesis_dir }}"
+        state: directory
+        mode: '0755'
+
+    - name: Ensure tmp directory exists inside gentx genesis directory
+      file:
+        path: "{{gentx_genesis_dir}}/tmp"
+        state: directory
+        mode: '0755'
+
+    - name: Ensure output directory exists inside gentx genesis directory
+      file:
+        path: "{{gentx_genesis_dir}}/output"
+        state: directory
+        mode: '0755'
+
+    - name: Copy staking amount file to gentx genesis tmp directory
+      copy:
+        src: "{{ lookup('env', 'PWD') }}/output/staking-amount.json"
+        dest: "{{gentx_genesis_dir}}/tmp/staking-amount.json"
+        mode: '0644'
+
+    - name: Copy genesis file to gentx genesis tmp directory
+      copy:
+        src: "{{ lookup('env', 'PWD') }}/output/genesis.json"
+        dest: "{{gentx_genesis_dir}}/tmp/genesis.json"
+        mode: '0644'
+
+    - name: Prompt for validator private key
+      vars:
+        private_key_prompt: "Please enter your validator private key: "
+      pause:
+        prompt: "{{ private_key_prompt }}"
+        echo: no
+      register: private_key_input
+
+    - name: Fail if private key is not provided
+      fail:
+        msg: "Private key is required for creating the gentx."
+      when: private_key_input.user_input | default('') | trim == ''
+
+    - name: Run script to create and collect gentx
+      shell: |
+        docker run -i \
+          -v {{gentx_genesis_dir}}:/root/generate-gentx-genesis \
+          -v ~/cerc/laconicd-stack/stack-orchestrator/config/mainnet-laconicd:/scripts \
+          -e "PVT_KEY={{ private_key_input.user_input }}" \
+          -e "KEY_NAME={{ key_name }}" \
+          -e "CERC_MONIKER={{ cerc_moniker }}" \
+          -e "CERC_CHAIN_ID={{ cerc_chain_id }}" \
+          -e "VALIDATOR_PUB_KEY={{ validator_pub_key | to_json }}" \
+          cerc/laconicd:local bash -c "/scripts/create-and-collect-gentx.sh"
+
+    - name: Update genesis file in output
+      copy:
+        src: "{{gentx_genesis_dir}}/output/genesis.json"
+        dest: "{{ lookup('env', 'PWD') }}/output/genesis.json"
+        mode: '0644'
+
+    - name: Clear tmp directory
+      file:
+        path: "{{gentx_genesis_dir}}/tmp"
+        state: absent
@@ -8,6 +8,7 @@
    mainnet_deployment_dir: "{{ lookup('env', 'MAINNET_DEPLOYMENT_DIR') }}"
    spec_file: "{{data_directory}}/laconicd-spec.yml"
    spec_template: "./templates/specs/spec-template.yml.j2"
+    build_args: "{{ '--force-rebuild' if (lookup('env', 'FORCE_REBUILD') | default(omit, true)) not in [ 'false', 'False', '0' ] else '' }}"
  tasks:
    - name: Fail if DATA_DIRECTORY or MAINNET_DEPLOYMENT_DIR env vars are not set
      fail:
@@ -16,16 +17,6 @@
          Please export both DATA_DIRECTORY and MAINNET_DEPLOYMENT_DIR before running the playbook.
      when: lookup('env', 'DATA_DIRECTORY') == '' or lookup('env', 'MAINNET_DEPLOYMENT_DIR') == ''

-    - name: Fail if required key files are not defined
-      fail:
-        msg: >-
-          Required key files are not defined.
-          Please set genesis_file and staking_amount_file in first-validator-vars.yml.
-      when: not genesis_file or not staking_amount_file
-
-    - name: Fetch laconicd stack
-      shell: laconic-so fetch-stack git.vdb.to/cerc-io/laconicd-stack --git-ssh --pull
-
    - name: Setup required repositories
      shell: >
        laconic-so --stack ~/cerc/laconicd-stack/stack-orchestrator/stacks/mainnet-laconicd
@@ -33,7 +24,7 @@

    - name: Build container images
      shell: |
-        laconic-so --stack ~/cerc/laconicd-stack/stack-orchestrator/stacks/mainnet-laconicd build-containers --force-rebuild
+        laconic-so --stack ~/cerc/laconicd-stack/stack-orchestrator/stacks/mainnet-laconicd build-containers {{ build_args }}

    - name: Create deployment spec file
      shell: |
@@ -55,40 +46,20 @@
          CERC_CHAIN_ID: "{{ cerc_chain_id }}"
          MIN_GAS_PRICE: "{{ min_gas_price }}"
          CERC_LOGLEVEL: "{{ cerc_loglevel }}"
+          TMKMS_ENABLED: "{{ tmkms_enabled }}"
        mode: '0777'

+    - name: Initialize laconicd node
+      shell: |
+        docker run -i \
+          -v {{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data:/root/.laconicd \
+          -v {{data_directory}}/{{ mainnet_deployment_dir }}/config/mainnet-laconicd:/scripts \
+          -e "CERC_MONIKER={{ cerc_moniker }}" \
+          -e "CERC_CHAIN_ID={{ cerc_chain_id }}" \
+          cerc/laconicd:local bash -c "/scripts/setup-laconicd.sh"
+
    - name: Ensure tmp directory exists inside laconicd-data
      file:
        path: "{{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data/tmp"
        state: directory
        mode: '0755'
-
-    - name: Copy staking amount file to laconicd-data tmp directory
-      copy:
-        src: "{{ staking_amount_file }}"
-        dest: "{{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data/tmp/staking-amount.json"
-        mode: '0644'
-
-    - name: Copy genesis file to laconicd-data tmp directory
-      copy:
-        src: "{{ genesis_file }}"
-        dest: "{{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data/tmp/genesis.json"
-        mode: '0644'
-
-    - name: Fail if pvt_key is not set
-      fail:
-        msg: >-
-          Private key (pvt_key) is not set in first-validator-vars.yml.
-          This is required for creating the gentx.
-      when: not pvt_key
-
-    - name: Run script to create and collect gentx
-      shell: |
-        docker run -i \
-          -v {{data_directory}}/{{ mainnet_deployment_dir }}/data/laconicd-data:/root/.laconicd \
-          -v {{data_directory}}/{{ mainnet_deployment_dir }}/config/mainnet-laconicd:/scripts \
-          -e "PVT_KEY={{ pvt_key }}" \
-          -e "KEY_NAME={{ key_name }}" \
-          -e "CERC_MONIKER={{ cerc_moniker }}" \
-          -e "CERC_CHAIN_ID={{ cerc_chain_id }}" \
-          cerc/laconicd:local bash -c "/scripts/create-and-collect-gentx.sh"
@@ -0,0 +1,10 @@
+[local]
+localhost ansible_connection=local
+
+[remote]
+# Replace these values with your actual remote host details
+remote_host ansible_host=your.remote.host ansible_user=your_remote_user ansible_ssh_common_args='-o ForwardAgent=yes'
+
+[multihosts:children]
+local
+remote 
@@ -0,0 +1,54 @@
+---
+- name: Run TMKMS stack
+  hosts: localhost
+  vars_files:
+    - tmkms-vars.yml
+  vars:
+    data_directory: "{{ lookup('env', 'DATA_DIRECTORY') }}"
+    tmkms_deployment_dir: "{{ lookup('env', 'TMKMS_DEPLOYMENT_DIR') | default('tmkms-deployment', true) }}"
+  tasks:
+    - name: Fail if DATA_DIRECTORY env var is not set
+      fail:
+        msg: >-
+          Required environment variable DATA_DIRECTORY is not set.
+          Please export DATA_DIRECTORY before running the playbook.
+      when: lookup('env', 'DATA_DIRECTORY') == ''
+
+    - name: Ensure tmp directory exists inside tmkms-data volume
+      file:
+        path: "{{data_directory}}/{{ tmkms_deployment_dir }}/data/tmkms-data/tmp"
+        state: directory
+        mode: '0755'
+
+    - name: Check if priv_validator_key_file_path exists
+      stat:
+        path: "{{ priv_validator_key_file_path }}"
+      register: priv_key_file
+
+    - name: Copy private validator key to tmkms deployment tmp directory
+      copy:
+        src: "{{ priv_validator_key_file_path }}"
+        dest: "{{data_directory}}/{{ tmkms_deployment_dir }}/data/tmkms-data/tmp/priv_validator_key.json"
+        mode: '0644'
+      when: priv_key_file.stat.exists
+
+    - name: Create config.env for tmkms deployment
+      copy:
+        dest: "{{data_directory}}/{{ tmkms_deployment_dir }}/config.env"
+        content: |
+          CHAIN_ID: "{{ chain_id }}"
+          NODE_IP: "{{ node_ip }}"
+          NODE_PORT: "{{ node_port }}"
+          KEY_PREFIX: "{{ key_prefix }}"
+          TMKMS_MODE: "{{ tmkms_mode }}"
+        mode: '0777'
+
+    - name: Start tmkms deployment
+      shell: |
+        laconic-so deployment --dir {{data_directory}}/{{ tmkms_deployment_dir }} start
+
+    - name: Remove input private validator key file
+      file:
+        path: "{{ priv_validator_key_file_path }}"
+        state: absent
+      when: priv_key_file.stat.exists
@@ -0,0 +1,33 @@
+---
+- name: Setup TMKMS stack
+  hosts: localhost
+  vars_files:
+    - tmkms-vars.yml
+  vars:
+    data_directory: "{{ lookup('env', 'DATA_DIRECTORY') }}"
+    tmkms_deployment_dir: "{{ lookup('env', 'TMKMS_DEPLOYMENT_DIR') | default('tmkms-deployment', true) }}"
+    tmkms_spec_file: "{{data_directory}}/tmkms-spec.yml"
+    build_args: "{{ '--force-rebuild' if (lookup('env', 'FORCE_REBUILD') | default(omit, true)) not in [ 'false', 'False', '0' ] else '' }}"
+  tasks:
+    - name: Fail if DATA_DIRECTORY env var is not set
+      fail:
+        msg: >-
+          Required environment variable DATA_DIRECTORY is not set.
+          Please export DATA_DIRECTORY before running the playbook.
+      when: lookup('env', 'DATA_DIRECTORY') == ''
+
+    - name: Fetch tmkms stack
+      shell: |
+        laconic-so fetch-stack git.vdb.to/LaconicNetwork/tmkms-stack@sk-yubihsm --git-ssh --pull
+
+    - name: Build tmkms container images
+      shell: |
+        laconic-so --stack ~/cerc/tmkms-stack/stack-orchestrator/stacks/tmkms build-containers {{ build_args }} --extra-build-args "--build-arg BACKEND={{ tmkms_mode }}"
+
+    - name: Create tmkms deployment spec file
+      shell: |
+        laconic-so --stack ~/cerc/tmkms-stack/stack-orchestrator/stacks/tmkms deploy init --output {{ tmkms_spec_file }}
+
+    - name: Create tmkms deployment from spec file
+      shell: |
+        laconic-so --stack ~/cerc/tmkms-stack/stack-orchestrator/stacks/tmkms deploy create --spec-file {{ tmkms_spec_file }} --deployment-dir {{data_directory}}/{{ tmkms_deployment_dir }}
@@ -0,0 +1,19 @@
+# Absolute path to the node's private validator key file (e.g., /path/to/priv_validator_key.json).
+# This file is copied into the TMKMS deployment
+priv_validator_key_file_path: ""
+
+# The IP address of the machine where the laconicd node is set up
+# TMKMS will connect to this IP address
+node_ip: ""
+
+# The port of the laconicd node that TMKMS will connect to
+node_port: "26659"
+
+# The key prefix used for account and consensus public keys in the blockchain
+key_prefix: "laconic"
+
+# The chain ID for the blockchain network
+chain_id: "laconic-mainnet"
+
+# The mode of operation for TMKMS (e.g., "softsign", "yubihsm")
+tmkms_mode: "softsign"
@@ -0,0 +1,15 @@
+---
+- name: Build Laconicd
+  hosts: localhost
+  connection: local
+  vars:
+    build_args: "{{ '--force-rebuild' if (lookup('env', 'FORCE_REBUILD') | default(omit, true)) not in [ 'false', 'False', '0' ] else '' }}"
+  tasks:
+    - name: Setup required repositories
+      shell: >
+        laconic-so --stack ~/cerc/laconicd-stack/stack-orchestrator/stacks/mainnet-laconicd
+        setup-repositories --git-ssh --pull
+
+    - name: Build container images
+      shell: |
+        laconic-so --stack ~/cerc/laconicd-stack/stack-orchestrator/stacks/mainnet-laconicd build-containers {{ build_args }}
@@ -1,11 +1,12 @@
 ---
 - name: Create validator on running chain
  hosts: localhost
+  vars_files:
+    - validator-vars.yml
  vars:
    data_directory: "{{ lookup('env', 'DATA_DIRECTORY') }}"
-    deployment_dir: "{{ lookup('env', 'MAINNET_DEPLOYMENT_DIR') }}"
-    key_name: "{{ lookup('env', 'KEY_NAME') }}"
-    pvt_key: "{{ lookup('env', 'PVT_KEY') }}"
+    create_validator_dir: "{{data_directory}}/create-validator"
+    spec_file: "{{data_directory}}/laconicd-validator-spec.yml"
  tasks:
    - name: Fail if DATA_DIRECTORY or MAINNET_DEPLOYMENT_DIR env vars are not set
      fail:
@@ -14,17 +15,50 @@
          Please export both DATA_DIRECTORY and MAINNET_DEPLOYMENT_DIR before running the playbook.
      when: lookup('env', 'DATA_DIRECTORY') == '' or lookup('env', 'MAINNET_DEPLOYMENT_DIR') == ''

-    - name: Fail if pvt_key is not set
+    - name: Fail if required key files are not defined
      fail:
        msg: >-
-          Neither private key (pvt_key) is set.
-          Please export PVT_KEY.
-      when: not pvt_key
+          Required key files are not defined.
+          Please set staking_amount_file in validator-vars.yml.
+      when: not staking_amount_file

-    - name: Import private key in laconicd
-      shell: |
-        laconic-so deployment --dir {{ data_directory }}/{{ deployment_dir }} exec laconicd "laconicd keys import-hex {{ key_name }} {{ pvt_key }} --keyring-backend test"
+    - name: Ensure tmp directory exists inside laconicd-data
+      file:
+        path: "{{create_validator_dir}}/tmp"
+        state: directory
+        mode: '0755'
+
+    - name: Copy staking amount file to laconicd-data tmp directory
+      copy:
+        src: "{{ staking_amount_file }}"
+        dest: "{{create_validator_dir}}/tmp/staking-amount.json"
+        mode: '0644'
+
+    - name: Prompt for validator private key
+      vars:
+        private_key_prompt: "Please enter your validator private key: "
+      pause:
+        prompt: "{{ private_key_prompt }}"
+        echo: no
+      register: private_key_input
+
+    - name: Fail if private key is not provided
+      fail:
+        msg: "Private key is required for creating the gentx."
+      when: private_key_input.user_input | default('') | trim == ''

    - name: Run create-validator script
      shell: |
-        laconic-so deployment --dir {{ data_directory }}/{{ deployment_dir }} exec laconicd "KEY_NAME={{ key_name }} /scripts/create-validator.sh"
+        docker run -i \
+          -v {{create_validator_dir}}:/root/create-validator \
+          -v ~/cerc/laconicd-stack/stack-orchestrator/config/mainnet-laconicd/create-validator.sh:/scripts/create-validator.sh \
+          -e "KEY_NAME={{ key_name }}" \
+          -e "NODE_URL={{ node_url }}" \
+          -e "CERC_MONIKER={{ cerc_moniker }}" \
+          -e "CERC_CHAIN_ID={{ cerc_chain_id }}" \
+          -e "MIN_GAS_PRICE={{ min_gas_price }}" \
+          -e "VALIDATOR_PUB_KEY={{ validator_pub_key | to_json }}" \
+          -e "PVT_KEY={{ private_key_input.user_input }}" \
+          --network=host \
+          cerc/laconicd:local \
+          sh -c "/scripts/create-validator.sh"
@@ -8,6 +8,7 @@
    mainnet_deployment_dir: "{{ lookup('env', 'MAINNET_DEPLOYMENT_DIR') }}"
    spec_file: "{{data_directory}}/laconicd-validator-spec.yml"
    spec_template: "./templates/specs/spec-template.yml.j2"
+    build_args: "{{ '--force-rebuild' if (lookup('env', 'FORCE_REBUILD') | default(omit, true)) not in [ 'false', 'False', '0' ] else '' }}"
  tasks:
    - name: Fail if DATA_DIRECTORY or MAINNET_DEPLOYMENT_DIR env vars are not set
      fail:
@@ -23,9 +24,6 @@
          Please set genesis_file and staking_amount_file in validator-vars.yml.
      when: not genesis_file or not staking_amount_file

-    - name: Fetch laconicd stack
-      shell: laconic-so fetch-stack git.vdb.to/cerc-io/laconicd-stack --git-ssh --pull
-
    - name: Setup required repositories
      shell: >
        laconic-so --stack ~/cerc/laconicd-stack/stack-orchestrator/stacks/mainnet-laconicd
@@ -33,7 +31,7 @@

    - name: Build container images
      shell: |
-        laconic-so --stack ~/cerc/laconicd-stack/stack-orchestrator/stacks/mainnet-laconicd build-containers --force-rebuild
+        laconic-so --stack ~/cerc/laconicd-stack/stack-orchestrator/stacks/mainnet-laconicd build-containers {{ build_args }}

    - name: Create deployment spec file
      shell: |
@@ -56,6 +54,7 @@
          CERC_PEERS: "{{ cerc_peers }}"
          MIN_GAS_PRICE: "{{ min_gas_price }}"
          CERC_LOGLEVEL: "{{ cerc_loglevel }}"
+          TMKMS_ENABLED: "{{ tmkms_enabled }}"
        mode: '0777'

    - name: Ensure tmp directory exists inside laconicd-data
@@ -1,7 +1,35 @@
-cerc_chain_id: "laconic-mainnet"
-min_gas_price: 0.001
-cerc_loglevel: "info"
-genesis_file: "~/cerc/laconicd-stack/config/mainnet-genesis.json"
-staking_amount_file: "~/cerc/laconicd-stack/config/staking-amount.json"
+# The URL of the laconicd node's RPC endpoint (e.g., "tcp://NODE_PUBLIC_IP_ADDRESS:26657")
+node_url: ""
+
+# The public key of the validator node. This is required for creating the validator on chain
+# It should be wrapped in single quotes
+validator_pub_key: ''
+
+# Custom moniker for the validator node
 cerc_moniker: ""
+
+# Comma-separated list of persistent peers for the laconicd node
+# You can find available peers in https://git.vdb.to/cerc-io/laconicd-stack/src/branch/main/node-addresses.yml
 cerc_peers: ""
+
+# Set to true to enable TMKMS (Tendermint Key Management System) for this node
+# If true, the node will use an external TMKMS for signing validator operations
+tmkms_enabled:
+
+# The chain ID for the blockchain network
+cerc_chain_id: "laconic-mainnet"
+
+# Minimum gas price for transactions, in ALNT (e.g., 0.001alnt)
+min_gas_price: 0.001
+
+# Log level for the laconicd node (e.g., "info", "debug", "error")
+cerc_loglevel: "info"
+
+# Absolute path to the mainnet genesis.json file
+genesis_file: "~/cerc/laconicd-stack/config/mainnet-genesis.json"
+
+# Absolute path to the staking-amount.json file
+staking_amount_file: "~/cerc/laconicd-stack/config/staking-amount.json"
+
+# Desired key name for the validator account
+key_name: "laconic-validator"
@@ -19,10 +19,10 @@ OUTPUT_DIR=${TESTNET_DEPLOYMENT_DIR}/export
 mkdir -p $OUTPUT_DIR

 # Export state from testnet chain
-testnet_state_file="$OUTPUT_DIR/testnet-state.gz"
+testnet_state_file="$OUTPUT_DIR/testnet-state.zst"
 docker run -it \
  -v ${TESTNET_DEPLOYMENT_DIR}/data/laconicd-data:/root/testnet-deployment/.laconicd \
  cerc/laconicd:local bash -c "laconicd export --home /root/testnet-deployment/.laconicd" \
-  | jq | gzip > "$testnet_state_file"
+  | jq | zstd > "$testnet_state_file"

 echo "Exported state from testnet to $testnet_state_file"
@@ -4,7 +4,7 @@ set -e

 # Default values
 INPUT=""
-OUTPUT_DIR="."
+OUTPUT_FILE="./distribution.json"

 # Parse command line arguments
 while [[ $# -gt 0 ]]; do
@@ -13,13 +13,13 @@ while [[ $# -gt 0 ]]; do
      INPUT="$2"
      shift 2
      ;;
-    -d|--dir)
-      OUTPUT_DIR="$2"
+    -o|--output)
+      OUTPUT_FILE="$2"
      shift 2
      ;;
    *)
      echo "Unknown option: $1"
-      echo "Usage: $0 -i|--input <input_url_or_path> [-d|--dir <output_directory>]"
+      echo "Usage: $0 -i|--input <input_url_or_path> [-o|--output <output_file_path>]"
      exit 1
      ;;
  esac
@@ -28,13 +28,10 @@ done
 # Check if input is provided
 if [ -z "$INPUT" ]; then
  echo "Error: Input URL or path is required"
-  echo "Usage: $0 -i|--input <input_url_or_path> [-d|--dir <output_directory>]"
-  exit 1
+  echo "Usage: $0 -i|--input <input_url_or_path> [-o|--output <output_file_path>]"
+      exit 1
 fi

-# Create output directory if it doesn't exist
-mkdir -p "$OUTPUT_DIR"
-
 venv_dir="$PWD/venv-lps-lock"
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

@@ -50,7 +47,7 @@ fi
 echo "Running LPS lock generation script..."
 "$venv_dir/bin/python" "$script_dir/generate-lps-distribution-json.py" \
  --input "$INPUT" \
-  --output "$OUTPUT_DIR/distribution.json"
+  --output "$OUTPUT_FILE"

 # Clean up venv
 echo "Cleaning up..."
@@ -3,6 +3,7 @@
 set -e

 NODE_HOME=/root/.laconicd
+GENTX_DIR=/root/generate-gentx-genesis
 genesis_file_path=$NODE_HOME/config/genesis.json
 KEYRING="test"

@@ -21,13 +22,18 @@ if [ -z "$KEY_NAME" ]; then
  exit 1
 fi

-input_genesis_file=$NODE_HOME/tmp/genesis.json
+if [ -z "$VALIDATOR_PUB_KEY" ]; then
+  echo "VALIDATOR_PUB_KEY environment variable not set, exiting..."
+  exit 1
+fi
+
+input_genesis_file=$GENTX_DIR/tmp/genesis.json
 if [ ! -f ${input_genesis_file} ]; then
  echo "Genesis file not provided, exiting..."
  exit 1
 fi

-staking_amount_file="$NODE_HOME/tmp/staking-amount.json"
+staking_amount_file="$GENTX_DIR/tmp/staking-amount.json"
 if [ ! -f "$staking_amount_file" ]; then
  echo "staking-amount.json file not provided, exiting..."
  exit 1
@@ -66,7 +72,7 @@ fi
 stake_amount=$(jq -r '.common_staking_amount' "$staking_amount_file")

 # Create gentx with staked amount equal to allocated balance
-laconicd genesis gentx $KEY_NAME $stake_amount$DENOM --chain-id $CHAIN_ID --keyring-backend $KEYRING
+laconicd genesis gentx $KEY_NAME $stake_amount$DENOM --chain-id $CHAIN_ID --keyring-backend $KEYRING --pubkey "$VALIDATOR_PUB_KEY"

 # Collect the gentx and validate
 laconicd genesis collect-gentxs
@@ -74,5 +80,4 @@ laconicd genesis validate

 chmod 777 $genesis_file_path

-# Update the input genesis file
-cp $genesis_file_path $input_genesis_file
+cp $genesis_file_path $GENTX_DIR/output
@@ -3,16 +3,16 @@ set -e

 DENOM=alnt

-NODE_HOME=/root/.laconicd
+CREATE_VALIDATOR_DIR=/root/create-validator
 KEYRING="test"

-staking_amount_file="$NODE_HOME/tmp/staking-amount.json"
+staking_amount_file="$CREATE_VALIDATOR_DIR/tmp/staking-amount.json"
 if [ ! -f "$staking_amount_file" ]; then
  echo "staking-amount.json file not provided, exiting..."
  exit 1
 fi

-if [-z "$KEY_NAME" ]; then
+if [ -z "$KEY_NAME" ]; then
  echo "KEY_NAME environment variable not set, exiting..."
  exit 1
 fi
@@ -22,14 +22,31 @@ if [ -z "$CERC_MONIKER" ]; then
  exit 1
 fi

+if [ -z "$NODE_URL" ]; then
+  echo "NODE_URL environment variable not set, exiting..."
+  exit 1
+fi
+
+if [ -z "$VALIDATOR_PUB_KEY" ]; then
+  echo "VALIDATOR_PUB_KEY environment variable not set, exiting..."
+  exit 1
+fi
+
+if [ -z "$PVT_KEY" ]; then
+  echo "PVT_KEY environment variable not set, exiting..."
+  exit 1
+fi
+
+laconicd keys import-hex "$KEY_NAME" "$PVT_KEY" --keyring-backend test
+
 # Set staking amount
 stake_amount=$(jq -r '.common_staking_amount' "$staking_amount_file")

 # Create validator.json file
-validator_json="$NODE_HOME/tmp/validator.json"
+validator_json="$CREATE_VALIDATOR_DIR/tmp/validator.json"
 cat > "$validator_json" << EOF
 {
-  "pubkey": $(laconicd tendermint show-validator),
+  "pubkey": $VALIDATOR_PUB_KEY,
  "amount": "${stake_amount}${DENOM}",
  "moniker": "${CERC_MONIKER}",
  "commission-rate": "0.0",
@@ -47,4 +64,5 @@ laconicd tx staking create-validator "$validator_json" \
  --gas-prices $MIN_GAS_PRICE$DENOM \
  --from $KEY_NAME \
  --keyring-backend $KEYRING \
+  --node $NODE_URL \
  --yes
Author	SHA1	Message	Date
Shreerang Kale	0ba5d4cab3	Checkout to relevant branch while setting up tmkms stack	2025-06-12 18:40:57 +05:30
Shreerang Kale	1eaa237070	Add instructions to setup yubihsm	2025-06-12 18:34:04 +05:30
shreerangandShreerang Kale	3a483792f7	Add playbooks to run TMKMS service (#14 ) Part of https://www.notion.so/Create-stacks-for-mainnet-1f2a6b22d4728034be4be2c51decf94e Co-authored-by: Shreerang Kale <shreerangkale@gmail.com> Reviewed-on: #14 Co-authored-by: shreerang <shreerang@noreply.git.vdb.to> Co-committed-by: shreerang <shreerang@noreply.git.vdb.to>	2025-06-12 11:20:33 +00:00
nabarun	6accde384d	Update multisig playbook to setup deployment on remote machine (#15 ) Part of <https://www.notion.so/Create-stacks-for-mainnet-1f2a6b22d4728034be4be2c51decf94e> Reviewed-on: #15 Co-authored-by: Nabarun <nabarun@deepstacksoft.com> Co-committed-by: Nabarun <nabarun@deepstacksoft.com>	2025-06-11 15:05:04 +00:00
shreerangandShreerang Kale	edee217050	Divide generate genesis and create validator playbooks into build and start playbooks (#13 ) Part of https://www.notion.so/Create-stacks-for-mainnet-1f2a6b22d4728034be4be2c51decf94e Co-authored-by: Shreerang Kale <shreerangkale@gmail.com> Reviewed-on: #13 Co-authored-by: shreerang <shreerang@noreply.git.vdb.to> Co-committed-by: shreerang <shreerang@noreply.git.vdb.to>	2025-06-10 10:07:15 +00:00
shreerangandShreerang Kale	44ab959af5	Update playbooks to sign txs on a separate machine from the one running `laconicd` node (#5 ) Part of https://www.notion.so/Create-stacks-for-mainnet-1f2a6b22d4728034be4be2c51decf94e Co-authored-by: Shreerang Kale <shreerangkale@gmail.com> Reviewed-on: #5 Co-authored-by: shreerang <shreerang@noreply.git.vdb.to> Co-committed-by: shreerang <shreerang@noreply.git.vdb.to>	2025-06-09 12:37:50 +00:00
ishavenikarandIshaVenikar	7a94eb2a03	Use zstd to compress testnet state file (#12 ) Part of https://www.notion.so/Create-stacks-for-mainnet-1f2a6b22d4728034be4be2c51decf94e Co-authored-by: IshaVenikar <ishavenikar7@gmail.com> Reviewed-on: #12 Co-authored-by: ishavenikar <ishavenikar@noreply.git.vdb.to> Co-committed-by: ishavenikar <ishavenikar@noreply.git.vdb.to>	2025-06-09 08:51:38 +00:00