Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merge update-db with remote-signer-setup #176

Closed
wants to merge 24 commits into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
__pycache__/
venv
dist
data
.mypy_cache
.pytest_cache
.idea
Expand Down
50 changes: 21 additions & 29 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -329,6 +329,22 @@ Done. Successfully configured operator to use remote signer for 1 public key(s)!
- `--execution-endpoints` - Comma separated list of API endpoints for execution nodes.
- `--verbose` - Enable debug mode. Default is false.

#### `remote-signer-setup` upload keystores to web3signer

If `--remote-db-url` flag specified the command encrypts and loads validator keys from keystore files into the database

```bash
./operator remote-signer-setup --remote-db-url postgresql://postgres:postgres@localhost:5432/web3signer --vault=0x3320ad928c20187602a2b2c04eeaa813fa899468
Loading keystores... [####################################] 10/10
Encrypting database keys...
Generated 10 validator keys, upload them to the database? [Y/n]: Y
The database contains 10 validator keys.
Save decryption key: '<DECRYPTION KEYS>'
```

**NB! You must store the decryption key in a secure place.
It will allow you to upload new keystores in the existing database**

### Running the operator

Provide the operator with the URL to your remote signer instance
Expand Down Expand Up @@ -474,38 +490,14 @@ Keystores for vault {vault} successfully recovered to {keystores_dir}

### Web3Signer infrastructure commands

#### 1. Update database

The command encrypts and loads validator keys from keystore files into the database

```bash
./v3-operator update-db --db-url postgresql://postgres:postgres@localhost:5432/web3signer --keystores-dir ./data/keystores --keystores-password-file ./data/keystores/password.txt
Loading keystores... [####################################] 10/10
Encrypting database keys...
Generated 10 validator keys, upload them to the database? [Y/n]: Y
The database contains 10 validator keys.
Save decryption key: '<DECRYPTION KEYS>'
```

##### update-db options

- `--keystores-dir` - The directory with validator keys in the EIP-2335 standard. Defaults to ./data/keystores.
- `--keystores-password-file` - The path to file with password for encrypting the keystores. Defaults to
./data/keystores/password.txt.
- `--db-url` - The database connection address.
- `--encryption-key` - The key for encrypting database record. If you are upload new keystores use the same encryption
key.
- `--no-confirm` - Skips confirmation messages when provided.

**NB! You must store the decryption key in a secure place.
It will allow you to upload new keystores in the existing database**
#### 1. Upload keystores to web3signer. See `Remote signer setup` section

#### 2. Sync validator configs

Creates validator configuration files for Lighthouse, Prysm, and Teku clients to sign data using keys form database.

```bash
./v3-operator sync-validator
./operator remote-db-validator
Enter the recipient address for MEV & priority fees: 0xB31...1
Enter the endpoint of the web3signer service: https://web3signer-example.com
Enter the database connection string, ex. 'postgresql://username:pass@hostname/dbname': postgresql://postgres:postgres@localhost/web3signer
Expand All @@ -518,7 +510,7 @@ Signer keys for Teku\Prysm saved to data/configs/signer_keys.yml file.
Proposer config for Teku\Prysm saved to data/configs/proposer_config.json file.
```

##### sync-validator options
##### remote-db-validator options

- `--validator-index` - The validator index to generate the configuration files.
- `--total-validators` - The total number of validators connected to the web3signer.
Expand All @@ -536,13 +528,13 @@ Fetch and decrypt keys for web3signer and store them as keypairs in the output_d
Set `DECRYPTION_KEY` env, use value generated by `update-db` command

```bash
./v3-operator sync-web3signer
./operator remote-db-web3signer
Enter the folder where web3signer keystores will be saved: /data/web3signer
Enter the database connection string, ex. 'postgresql://username:pass@hostname/dbname': postgresql://postgres:postgres@localhost/web3signer
Web3Signer now uses 7 private keys.
```

##### sync-web3signer options
##### remote-db-web3signer options

- `--db-url` - The database connection address.
- `--output-dir` - The folder where Web3Signer keystores will be saved.
Expand Down
1,207 changes: 612 additions & 595 deletions poetry.lock

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion pyproject.toml
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ python-decouple = "==3.8"
sentry-sdk = "==1.31.0"
py-ecc = "==6.0.0"
multiproof = { git = "https://github.com/stakewise/multiproof.git", rev = "v0.1.5" }
sw-utils = { git = "https://github.com/stakewise/sw-utils.git", rev = "v0.3.25" }
sw-utils = { git = "https://github.com/stakewise/sw-utils.git", rev = "v0.3.27" }
staking-deposit = { git = "https://github.com/ethereum/staking-deposit-cli.git", rev = "v2.4.0" }
pycryptodomex = "==3.19.0"
milagro-bls-binding = "==1.9.0"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@
'Prysm, and Teku clients to sign data using keys from database.'
)
# pylint: disable-next=too-many-arguments,too-many-locals
def sync_validator(
def remote_db_validator(
validator_index: int,
total_validators: int,
db_url: str,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@
)
@click.command(help='Synchronizes web3signer private keys from the database')
# pylint: disable-next=too-many-locals
def sync_web3signer(db_url: str, output_dir: str, decryption_key_env: str) -> None:
def remote_db_web3signer(db_url: str, output_dir: str, decryption_key_env: str) -> None:
"""
The command is running by the init container in web3signer pods.
Fetch and decrypt keys for web3signer and store them as keypairs in the output_dir.
Expand Down
Loading