docs/run-first-validator.md

@@ -92,6 +92,19 @@
 
 - For integrating TMKMS with laconicd, follow steps below in the machine where the TMKMS service is to be setup (machine 4)
 
+- Copy the example variables file:
+
+  ```bash
+  cp ~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.example.yml ~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.yml
+  ```
+
+- Update `~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.yml` with required values:
+
+  ```yaml
+  # Set the mode of operation for TMKMS (e.g., "softsign", "yubihsm")
+  tmkms_mode: <tmkms-mode>
+  ```
+
 - Export the data directory and TMKMS deployment directory as environment variables:
 
   ```bash
@@ -226,6 +239,22 @@
   node_port: "26659"
   ```
 
+- If using `yubihsm` mode, run following command to setup the yubihsm:
+
+  **WARNING: THIS PROCESS PERFORMS A FACTORY RESET OF THE YUBIHSM, DELETING ALL EXISTING KEYS AND REPLACING THEM WITH NEW ONES. MAKE SURE YOU HAVE MADE BACKUPS OF IMPORTANT KEYS BEFORE PROCEEDING!!!**
+
+  ```bash
+  # Use a strong password for YubiHSM
+  docker run -it --rm \
+  -v $DATA_DIRECTORY/tmkms-deployment/data/tmkms-data:/home/tmkmsuser/tmkms \
+  -v ~/cerc/tmkms-stack/stack-orchestrator/config/tmkms/setup-yubihsm.sh:/scripts/setup-yubihsm.sh \
+  -e "PASSWORD=<yubihsm-password>" \
+  -e "CHAIN_ID=laconic-mainnet" \
+  -e "NODE_IP=<NODE_PUBLIC_IP_ADDRESS>" \
+  -e "NODE_PORT=26659" \
+  cerc/tmkms:local bash -c "/scripts/setup-yubihsm.sh"
+  ```
+
 - Run ansible playbook to run the TMKMS:
 
   ```bash

docs/run-validator.md

@@ -104,6 +104,19 @@
 
 - For integrating TMKMS with laconicd, follow steps below in the machine where the TMKMS service is to be setup (machine 4)
 
+- Copy the example variables file:
+
+  ```bash
+  cp ~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.example.yml ~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.yml
+  ```
+
+- Update `~/cerc/laconicd-stack/playbooks/tmkms/tmkms-vars.yml` with required values:
+
+  ```yaml
+  # Set the mode of operation for TMKMS (e.g., "softsign", "yubihsm")
+  tmkms_mode: <tmkms-mode>
+  ```
+
 - Export the data directory as environment variable:
 
   ```bash
@@ -144,6 +157,22 @@
   node_port: "26659"
   ```
 
+- If using `yubihsm` mode, run following command to setup the yubihsm:
+
+  **WARNING: THIS PROCESS PERFORMS A FACTORY RESET OF THE YUBIHSM, DELETING ALL EXISTING KEYS AND REPLACING THEM WITH NEW ONES. MAKE SURE YOU HAVE MADE BACKUPS OF IMPORTANT KEYS BEFORE PROCEEDING!!!**
+
+  ```bash
+  # Use a strong password for YubiHSM
+  docker run -it --rm \
+  -v $DATA_DIRECTORY/tmkms-deployment/data/tmkms-data:/home/tmkmsuser/tmkms \
+  -v ~/cerc/tmkms-stack/stack-orchestrator/config/tmkms/setup-yubihsm.sh:/scripts/setup-yubihsm.sh \
+  -e "PASSWORD=<yubihsm-password>" \
+  -e "CHAIN_ID=laconic-mainnet" \
+  -e "NODE_IP=<NODE_PUBLIC_IP_ADDRESS>" \
+  -e "NODE_PORT=26659" \
+  cerc/tmkms:local bash -c "/scripts/setup-yubihsm.sh"
+  ```
+
 - Run ansible playbook to run the TMKMS:
 
   ```bash

playbooks/tmkms/run-tmkms.yml

@@ -40,6 +40,7 @@
           NODE_IP: "{{ node_ip }}"
           NODE_PORT: "{{ node_port }}"
           KEY_PREFIX: "{{ key_prefix }}"
+          TMKMS_MODE: "{{ tmkms_mode }}"
         mode: '0777'
 
     - name: Start tmkms deployment

playbooks/tmkms/setup-tmkms.yml

@@ -1,6 +1,8 @@
 ---
 - name: Setup TMKMS stack
   hosts: localhost
+  vars_files:
+    - tmkms-vars.yml
   vars:
     data_directory: "{{ lookup('env', 'DATA_DIRECTORY') }}"
     tmkms_deployment_dir: "{{ lookup('env', 'TMKMS_DEPLOYMENT_DIR') | default('tmkms-deployment', true) }}"
@@ -16,11 +18,11 @@
 
     - name: Fetch tmkms stack
       shell: |
-        laconic-so fetch-stack git.vdb.to/LaconicNetwork/tmkms-stack --git-ssh --pull
+        laconic-so fetch-stack git.vdb.to/LaconicNetwork/tmkms-stack@sk-yubihsm --git-ssh --pull
 
     - name: Build tmkms container images
       shell: |
-        laconic-so --stack ~/cerc/tmkms-stack/stack-orchestrator/stacks/tmkms build-containers {{ build_args }}
+        laconic-so --stack ~/cerc/tmkms-stack/stack-orchestrator/stacks/tmkms build-containers {{ build_args }} --extra-build-args "--build-arg BACKEND={{ tmkms_mode }}"
 
     - name: Create tmkms deployment spec file
       shell: |

playbooks/tmkms/tmkms-vars.example.yml

@@ -14,3 +14,6 @@ key_prefix: "laconic"
 
 # The chain ID for the blockchain network
 chain_id: "laconic-mainnet"
+
+# The mode of operation for TMKMS (e.g., "softsign", "yubihsm")
+tmkms_mode: "softsign"