{"id":15156390,"url":"https://github.com/w3f/polkadot-validator-setup","last_synced_at":"2025-09-30T04:32:26.926Z","repository":{"id":39034668,"uuid":"199802225","full_name":"w3f/polkadot-validator-setup","owner":"w3f","description":"Polkadot Validator Secure Setup","archived":true,"fork":false,"pushed_at":"2022-05-28T17:47:47.000Z","size":1086,"stargazers_count":215,"open_issues_count":14,"forks_count":131,"subscribers_count":20,"default_branch":"master","last_synced_at":"2025-01-15T15:55:49.276Z","etag":null,"topics":["ansible","blockchain","devops","polkadot","polkadot-validator","proof-of-stake","substrate","terraform","validator","vpn","wireguard"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/w3f.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-07-31T07:21:51.000Z","updated_at":"2024-12-10T06:12:56.000Z","dependencies_parsed_at":"2022-08-01T07:49:45.445Z","dependency_job_id":null,"html_url":"https://github.com/w3f/polkadot-validator-setup","commit_stats":null,"previous_names":["w3f/polkadot-secure-validator"],"tags_count":59,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/w3f%2Fpolkadot-validator-setup","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/w3f%2Fpolkadot-validator-setup/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/w3f%2Fpolkadot-validator-setup/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/w3f%2Fpolkadot-validator-setup/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/w3f","download_url":"https://codeload.github.com/w3f/polkadot-validator-setup/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":234702074,"owners_count":18873824,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","blockchain","devops","polkadot","polkadot-validator","proof-of-stake","substrate","terraform","validator","vpn","wireguard"],"created_at":"2024-09-26T19:20:49.485Z","updated_at":"2025-09-30T04:32:21.566Z","avatar_url":"https://github.com/w3f.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"NOTE: this repository isn't actively maintained\n\n# Polkadot Validator Setup\n\nThis repo describes a potential setup for a Polkadot or Kusama validator that aims to\nprevent some types of potential attacks at the TCP layer and below.\nThe [Workflow](#workflow) section describes the [Platform Layer](#platform-layer)\nand the [Application Layer](#application-layer) in more detail.\n\n## Usage\n\nThere are two ways of using this repository:\n\n* **Platform \u0026 Application Layer**\n\n  Configure credentials for infrastructure providers such as AWS, Azure, GCP, digitalocean,\n  and/or Packet, then execute the Terraform process to automatically deploy the\n  required machines ([Platform Layer](#platform-layer)) and setup the\n  [Application Layer](#application-layer).\n\n  See the [Complete Guide](GUIDE_COMPLETE.md) for more.\n\n* **Application Layer**\n\n  Setup Debian-based machines yourself, which only need basic SSH access and\n  configure those in an inventory. The Ansible scripts will setup the entire\n  [Application Layer](#application-layer).\n\n  See the [Ansible Guide](GUIDE_ANSIBLE.md) for more.\n\n## Structure\n\nThe secure validator setup is composed of one or more validators that run with a local\ninstance of NGINX as a reverse TCP proxy in front of them. The validators are instructed to:\n* advertise themselves with the public IP of the node and the port where the\nreverse proxy is listening.\n* bind to the localhost interface, so that they only allow incoming connections from the\nproxy.\n\nThe setup also configures a firewall in which the default p2p port is closed for\nincoming connections and only the proxy port is open.\n\n## Workflow\n\nThe secure validator setup is structured in two layers, an underlying platform\nand the applications that run on top of it.\n\n### Platform Layer\n\nValidators are created using the terraform modules located at [terraform](/terraform)\ndirectory. We have created code for several providers but it is possible to add new\nones, please reach out if you are interested in any provider currently not available.\n\nBesides the actual machines the terraform modules create the minimum required networking\ninfrastructure for adding firewall rules to protect the nodes.\n\n### Application Layer\n\nThis is done through the ansible playbook and polkadot-validator role located at\n[ansible](/ansible), basically the role performs these actions:\n\n* Software firewall setup, for the validator we only allow the proxy, SSH and, if\nenabled, node-exporter ports.\n* Configure journald to tune log storage.\n* Create polkadot user and group.\n* Configure NGINX proxy\n* Setup polkadot service, including binary download.\n* Polkadot session management, create session keys if they are not present.\n* Setup node-exporter if the configuration includes it.\n\n# Note about upgrades from the sentries setup\n\nThe current version of polkadot-secure-validator doesn't allow to create and configure\nsentry nodes. Although the terraform files and ansible roles of this latest version\ncan be applied on setups created with previous versions, the validators would be configured\nto work without sentries and to connect to the network using the local reverse proxy instead.\n\nIf you created the sentries with a previous version of this tool through terraform following\nthe complete workflow, then they will not be deleted automatically when running this new version.\nIn short, the old sentries will no longer be used by the validators and it will be up to you to\nremove them manually.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fw3f%2Fpolkadot-validator-setup","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fw3f%2Fpolkadot-validator-setup","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fw3f%2Fpolkadot-validator-setup/lists"}