From 7145de118ece3f14a76117b1a1b2624a6256ee1e Mon Sep 17 00:00:00 2001 From: pablomendezroyo Date: Thu, 17 Oct 2024 11:03:03 +0200 Subject: [PATCH 1/2] Implement certificates per network --- validator/Dockerfile | 6 ++++-- .../cert/gnosis/teku_client_keystore.p12 | Bin 0 -> 2622 bytes .../cert/{ => gnosis}/teku_keystore_password.txt | 0 .../cert/{ => holesky}/teku_client_keystore.p12 | Bin .../cert/holesky/teku_keystore_password.txt | 1 + .../security/cert/lukso/teku_client_keystore.p12 | Bin 0 -> 2622 bytes .../cert/lukso/teku_keystore_password.txt | 1 + .../cert/mainnet/teku_client_keystore.p12 | Bin 0 -> 2606 bytes .../cert/mainnet/teku_keystore_password.txt | 1 + 9 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 validator/security/cert/gnosis/teku_client_keystore.p12 rename validator/security/cert/{ => gnosis}/teku_keystore_password.txt (100%) rename validator/security/cert/{ => holesky}/teku_client_keystore.p12 (100%) create mode 100644 validator/security/cert/holesky/teku_keystore_password.txt create mode 100644 validator/security/cert/lukso/teku_client_keystore.p12 create mode 100644 validator/security/cert/lukso/teku_keystore_password.txt create mode 100644 validator/security/cert/mainnet/teku_client_keystore.p12 create mode 100644 validator/security/cert/mainnet/teku_keystore_password.txt diff --git a/validator/Dockerfile b/validator/Dockerfile index 120f498..b382194 100644 --- a/validator/Dockerfile +++ b/validator/Dockerfile @@ -7,7 +7,8 @@ ARG STAKER_SCRIPTS_VERSION USER root -ENV TLS_CERT_PATH=/tls/cert +# Modify TLS_CERT_PATH to include the NETWORK arg value +ENV TLS_CERT_PATH=/tls/cert/${NETWORK} ENV DATA_DIR=/opt/teku/data \ NETWORK=${NETWORK} \ @@ -18,7 +19,7 @@ ENV DATA_DIR=/opt/teku/data \ STAKER_SCRIPTS_URL=https://github.com/dappnode/staker-package-scripts/releases/download/${STAKER_SCRIPTS_VERSION} COPY /security/validator-api-bearer ${VALIDATOR_API_TOKEN_PATH} -COPY /security/cert ${TLS_CERT_PATH} +COPY /security/cert/${NETWORK} ${TLS_CERT_PATH} COPY entrypoint.sh /usr/local/bin/entrypoint.sh ADD ${STAKER_SCRIPTS_URL}/consensus_tools.sh /etc/profile.d/ @@ -31,3 +32,4 @@ RUN apt-get update && apt-get install ca-certificates --yes --no-install-recomme ENV NETWORK=${NETWORK} ENTRYPOINT [ "/usr/local/bin/entrypoint.sh" ] + diff --git a/validator/security/cert/gnosis/teku_client_keystore.p12 b/validator/security/cert/gnosis/teku_client_keystore.p12 new file mode 100644 index 0000000000000000000000000000000000000000..3538af00766ec6e706a87483a806e2cfb2746e31 GIT binary patch literal 2622 zcma)8X*d*$8lH_YmW+Kl#u?p0NHZ8?5XPE)tjE4HWJ$ItTcgmiZ=sQ04n?+P-$g<* z6v#=Kq#=7 z1bYu5!KgpzF%*fZ>AxhV3J8g*+fHk7f89i(rVyJKQn)z^hm%N0h>@RHw?eeSrQqM8)`5~jy}$RT~X|y$AeYj zxKyH;fOZ$sD~+7Pn%uITqUwO7*sE1>T5eA?ex2cDGUk^ibnJLHdV#n)c%CQSRyOmS z(NIksTg`4SQ@~178B4|&az~8YL1`>~r?OkM?1i=_k>ZS&Pmw}_cqiPl4k4=Z65Ii? zKdbAs;#iT_ZGzk!X`2{p8Qoe~uu2gBZX{82RyAI&8#%}>ERAql;?j?XrUy=lKgFFA z{cz{@Gl%UW=x;)TlB78<)mow`&pFsAm?_BzG8tO^O(Efl`0bT~ zifyhTwJgo~*7F6z(v%ypRH&?peN3fVkM)&GxMd!Bc5S00$q10;&3kRWmgkfs@wa5( zgXM|M-{W{jS-H)2P`)MjukVUhUm3@y9zJNzk&st2GCUIFA8F+?NPo`A>bCby-fzDn z$Z-q|OiKvMTocoFBDgw*V#|bD+k0jE1xoAIf))!JHx_Ym_vkEdS}4>_j_JVhDwtK* zy}cKNaK$%Gdrv!+tD0jM54W7UtJM|RzM2`iYvCdvJ=2gf9jxJ?A*8TkHOz5YqkjZR zmAq0;l6e=27*|fuu(kRXgwQd`*c*DOPDw%F%P93a<12}h(CtJQF9O4QxbbVGZrOLb zqbdsrm2DQ*l}G!qT&NN&mMu8A=<<2)H20mXpSt5IVf9gc@3m%LVt&R$$N;dy%SwyO z{JNG7?P1gStR=#FgehkgBRo96B_sr0_O)fpbi23DMiqzkj*{1jy>8M|U^kCBN29AL zf#a5whtvl7BeXF8!8LxGt(;1?5&~oCtp&HW&T3xr3UZ!4H{vg{w_i$7y{rVsn8<`Z z03=;v+$44at8z1rYzPRG4#Qn|{wNIVTBDg(i(c(_4#NT6R^Iz9eKNe3-Mj6IlF;11 zoe#(K)WO|SBy4g+i{UNT6-vs(1P6H!t88u^Qy=f-+ws%x%_oQ&a6C_s@o@g7PsMhd z&*tb`wTb>l;>DP69>{(b`77yrIguS7ei8P_DMEOkF6-;KGmc&PNoc!q85LN76IHv`oRw;m?DH8TX6jiYCMr`?z4k z_kp3Ke9KaLLy;g{KXahW#Uuy_MFO9KfPf#c_m=|vUu8YQdFG<|If5K)%n6ANNy9u7)vh00#_=Kj zk+rnCfdNBdlb77y?U-}24Sw5R`MAWK{DqJ3Y~%7OV$HuT>V_+ z>c`EpiC?-a$3!+;^rtmHw3n=rtPGF_8ZwQU{Uh^(O;z^V#TvU4C-qZ4qxs05%n5v? zwdp3o&7pK=`%BG@RbkAbgiTnMN$mQ^yD4wW z5+?W#T4IVnVQAK}j(6@W`@+9_# zZx7KT#xoPW`XIPo(4yLg;0@x#pDYDETTA;qiSj!qMgaTcheDGP`=Znv72y?%yT3Lq zU)Shdw+Ou~ch8W>IQ{)@!OW;Y^q{8~^k$;1hv0;H?W;HSxg}hf?V8{9)Yb>mZ+&bV zQ;~MI{8G;;JsHdB@+3d_%7}Z?#_zf!sd%)io->*d&A)95fh$b}Z+QoUR+e@vE(fat zNt;*1>ZDUDaAR)x>vC1`uF=emuk?avNogLZdi-{!}0!699truxYORa`9VZ zMqxa1?l3s-h>!!fVs+h0iC@ZiU$hYn;k~j&RDMmLYd$Erg>6js8xpy1sr%0g_y^qt B!-fC= literal 0 HcmV?d00001 diff --git a/validator/security/cert/teku_keystore_password.txt b/validator/security/cert/gnosis/teku_keystore_password.txt similarity index 100% rename from validator/security/cert/teku_keystore_password.txt rename to validator/security/cert/gnosis/teku_keystore_password.txt diff --git a/validator/security/cert/teku_client_keystore.p12 b/validator/security/cert/holesky/teku_client_keystore.p12 similarity index 100% rename from validator/security/cert/teku_client_keystore.p12 rename to validator/security/cert/holesky/teku_client_keystore.p12 diff --git a/validator/security/cert/holesky/teku_keystore_password.txt b/validator/security/cert/holesky/teku_keystore_password.txt new file mode 100644 index 0000000..a1a35a1 --- /dev/null +++ b/validator/security/cert/holesky/teku_keystore_password.txt @@ -0,0 +1 @@ +dappnode \ No newline at end of file diff --git a/validator/security/cert/lukso/teku_client_keystore.p12 b/validator/security/cert/lukso/teku_client_keystore.p12 new file mode 100644 index 0000000000000000000000000000000000000000..3fe369393a6a22d1f5582190f9e61572ccc5866c GIT binary patch literal 2622 zcma)8X*d*&8l4R@uKk;`4l^N3G&8<1V^@!))XU*PF8bd-0GS|L+ zG$^UDWM8Lb8DwXQ+kNhR`tJR8?~nI6&wI{$&d>9_7!tPz2nfcIU`$S!VuDe^E-#P^ zSVV#iK}fKVKj}UUiR1NuNgO2*633IDbm7m*=lt8hT|C@CP!Wkk?_4s(MhTv#8Ufpj^+;Z;mZL?{iG<(rS3c4Mivs(T0y{DQ}cHAN(;(-*?(v zEl#HBynkvyJLR(0@zy%rk?J+z#-eL;Sue0bQGWVx1$oCWpqVM;a?(8BB)FINzMc<$ znjY?XlfLxuX14z^{l7oVc)W5xWoDPa;2EW}1Sa@|{injM; zddMygQgtG9CyOgvosz*v|UT;ie z19BE47fRHa3k~S6Tc;&e3r)Wp;%%21^8MmBsJg2S&KHogC(g!vXEK8*NA3Osw;naV z6_tCqx7-N$d2sWLtSt;BI1*qrd!@8PQl1Byx|uhN1i&_KxsG6 z0WhI8{oXmfErF};2SbD1!DM!=c2|zb#$`TtmAURV;*smq0}`L*zllnT+v{1ls*uZI zf0NdnG(l2LA$FM{VH|jrP_M6$UsAI9;_U^)2C(lC2198Nd^9!@_Lm!Aa|xY+b*_ zM=-p47+{34MlS|8I!QS3o}tv8%)^W~DOio7RfdmgQg^(F$F_1l5d=esS-*i~mZKZz z{h}Jy9-K&)fJ;_Vcm$;=Lq@y#H9G_4l^=~e<~1fA&ORKQ1Mog^*q8A(ArnV}mvbM} zP1vKj`=$CsiFK?fO0!&=AO?@~s;W_oH-u@X<~oGs8trHBd}g_a)}djj6Z7Kn4M!LL z0_iM%M;PNh4 zUM}=n`1o4?F6oU*nT&1<5@EAhW7Y1Wlwz%h=~2lSfad%%&rFrwWxZ@nFfQ>PS;@)T zK5Sq_Fk~ESh(Z0TOBfsrmlOir2Dk!z0p5UXKQS2K54iQ8C&#dGh>(r9p9d1FhR2@4 zsiZG5i79CPVg&VO4fFX zXVCizW`xi2*#4D!V?K=ymT!~Evs=g?U;tZ<_Z2n#q3biR!k3_Pp66Lu z{=UPms$6Bdk4N*Br590t``)U~brbWgv(v_|f}A718%1wSe>;cslDD6NyUU&RM9#h% z2d0IvOlb;tYTJ`s&P}oG@ToIZAqy0)mf#QV4 z1v?G5fh4Jvm|f4e(A{=N7!hhDpEBI5lsGBmsO8Y7<@Yrqk*eKoGAmpo%$HC#twIYT z#%0ttdezOc!n6SDA@4FMj6iSK@c9?ny!jb`?GJAtqXWXMBsAc>4?Ar(Rb8I-Qv%21qPp^E(h1!AXdlNrIGe`8hOb0ejF2XN}-_r^hWSw{ZY+W9*HAX5GFot zFi-P9x_WGIic`!)$ko5~11-hvw=7XNc+XkDN^z%dmZ67zMQnJV${2Kk zJ?1NGp>@5w`{GK=S#`+`xT^vouxGpStD{g`S4Yjx2@U~Cs`|@m=JPRlYnTE&2%^~3 z>)eT3H9d4YK+Vq3WH3HJ|5fhZNk-y}&ayVanj@%kxaifOn)A!SwN<0euVKA(5+Cmx z`pazB1S-4VDu}A-JFeOoG7MdEDnPeY))1}JbS`9N_L*cQF%#eB;88Gn8X#%LD`=Nw7&MOg8Fj)Gi#z49q9N z`oSbv_fNV5NrKe>mjrnNCP4~*(m6jX6Uz4QEp}EQQ$7iz^^;UX;(u*G;7Dua?|--K zNI5WKPP>awXTEhpy0M#+P1tW==(l)XCMGFPCZGtC9m?`AM0b+GnV_5)`z^|=(HFQ1yDlLqgLv008!fM>|>gSsDOU*w3xLpHK zhr7PqqtzPA@_SpfylGIabkmfqV_!wt#qvWz`1Cg1#Ib-MZ$0MVtSTHTl(6kVwVVi# zOtsdm*h!-GvOpr=4T>%38+2dd*HrtMI?|K1quLgf?R8VFw6nhtk4oh&A8uxtIvCM~KjcPcl07nrs9Q=X!#u0xT2HHHtsd%_)!hYKfkN zTq>Maq@JGms5O5<>5%)}#*MSXD0|6Xd0bNqfE~5ds$*x(%vO~_>(knlO6BFsgKjdn**Lb?TzL=KRmOTN9>pPAw8&C@| zv*s6Sq%8)dBJ<^eN;np)OD|ZDZn|?0EMzL3X?jE%#2s%7I5O2KYpgEke0rTL60h-p~St+?C_$Hg}OeTwH1 zU17ZbhCxu6zy}+S-HZB{crBm@S5jmpp7ayq3q8so%ZwlcE)yzI=r?0HozQ zTw-9KXE)KJtwS}K=<6?aTTllgP}izjTrVOvbeGhXb4vsNBYvZ!q~$(7H@0%NrP*jo z%W8w(mTP5ELf*lv@^8gm5rzyX^VYNvF3<#ikJtiAoAu!7lr;U=KDT z#hoiV-`m4wrOLTl1*~DbM^qQ8;)Lx9cE$7#ueSl&tlcpnad-UQxNsK+o*~QcE@N7r z?B_NdiZhsY7O{gw-&#fZl_qB~Ryp=RuT;zTKbYB^tYKKRaJMVZ30g|YjhshsPsx^5 zInLD2x1lw5b42d_Y!M+%x`w?35IjDq22P?HYZ)M&KPrQ zp{>ErSICPka=YjeG%XJ~8Wp`oc&Ns|86 z)Yy5f&_~D_cVQ@-(6mLg6yE9~W)w0~Fetg0j4KcskwC3lul(rBv)+QjbzNZs?r|B& zyYIqm-EXi)yLPfu%WR0KtK!Bpkub^flGE;zF`=uU*Nq<}7Iv*wii%<{LW?UeZ7U?5 z+O}x8>7cHz{w_gnpa2(m=8q~>q`%T?o15Ja6Y7d>+0nP_#V%iWP>i`>nAF?^Z`gO0bq6=#HHW*midpaPdK%hEI6|6o+TC?LW{Ly%ad0CAj zy}U^Vges@>)uk}t3=nU8F)|7@W_qMMsOmvExG}sxdFKAxlQ%NGjk=mf{XAcW zcTNdV)^R6dSs`s?j1YTnH0$>F7S1xJo);FlOM~p2&TTcWij{(jw8js`E`O*)KIvn# zw9TTXU+$}ci+P8!)xDIU48PrF2*wDIZSvbmPR#*&E<=woY)`g(P!1+c z8H3)PHFFrVS9EfJl}%IukF||s*r#wT?F!q+QNWt5b?v0?X*A&3<)%Bh;EO6`aV5

B-?!qdtkQk%S=rq!$ZukA3>~W2 zQ(B;OfNc*9CBt>#;(RNdFTK~}ex*J+$G~_{F=AKE4=TDDmyLF3^6w}nHGr>ipCox#5x^*HA7y;e z#OXSvh@P?DY$`-sb3z&;6_M~?KNJ%X0sxC_6s;?8^lR> Date: Thu, 17 Oct 2024 13:24:40 +0200 Subject: [PATCH 2/2] add doppelganger flags --- beacon-chain/entrypoint.sh | 1 + validator/entrypoint.sh | 1 + 2 files changed, 2 insertions(+) diff --git a/beacon-chain/entrypoint.sh b/beacon-chain/entrypoint.sh index 1a9ed1f..a166db4 100755 --- a/beacon-chain/entrypoint.sh +++ b/beacon-chain/entrypoint.sh @@ -23,6 +23,7 @@ FLAGS="--network=$NETWORK \ --ee-endpoint=$ENGINE_URL \ --ee-jwt-secret-file=$JWT_FILE_PATH \ --p2p-port=$P2P_PORT \ + --beacon-liveness-tracking-enabled=true \ --rest-api-cors-origins=* \ --rest-api-interface=0.0.0.0 \ --rest-api-port=3500 \ diff --git a/validator/entrypoint.sh b/validator/entrypoint.sh index 2f5d522..df8af4d 100755 --- a/validator/entrypoint.sh +++ b/validator/entrypoint.sh @@ -25,6 +25,7 @@ FLAGS="--log-destination=CONSOLE \ --metrics-interface=0.0.0.0 \ --metrics-port=8008 \ --metrics-host-allowlist=* \ + --doppelganger-detection-enabled=true \ --validator-api-enabled=true \ --validator-api-interface=0.0.0.0 \ --validator-api-port=$VALIDATOR_PORT \