Horcrux Setup

Setup instructions

Install horcrux

Recommend to use a non-root user to install horcrux. At time of writing the latest horcrux production binary version is 3.3.0.

# Download and install horcrux
wget https://github.com/strangelove-ventures/horcrux/releases/download/v3.3.0/horcrux_linux-amd64
sudo mv horcrux_linux-amd64 /usr/local/go/bin/horcrux
chmod +x usr/local/go/bin/horcrux

# Confirm version
horcrux version

Add network

To add a network, we need to provide the following information: <network-chain-id> e.g juno-1 <sentries> Comma separated list, e.g "tcp://1.2.3.4:26659,tcp://5.6.7.8:26659"

When we initialise the configuration we will apply the --home flag to specify a home directory using the network name.

Usage:
  horcrux config init [flags]

Aliases:
  init, i

Flags:
      --bare                     allows initialization without providing any flags. If flags are provided, will not perform final validation
  -c, --cosigner strings         cosigners in format tcp://{cosigner-addr}:{p2p-port}
                                 (e.g. --cosigner tcp://horcrux-1:2222 --cosigner tcp://horcrux-2:2222 --cosigner tcp://horcrux-3:2222)
  -d, --debug-addr string        listen address for debug server and prometheus metrics in format localhost:8543
  -g, --flagGRPCAddress string   GRPC address if listener should be enabled
      --grpc-timeout string      cosigner grpc timeout value, 
                                 accepts valid duration strings for Go's time.ParseDuration() e.g. 1s, 1000ms, 1.5m (default "500ms")
  -h, --help                     help for init
  -k, --key-dir string           key directory if other than home directory
  -m, --mode string              sign mode, "threshold" (recommended) or "single" (unsupported). threshold mode requires --cosigner (multiple) and --threshold (default "threshold")
  -n, --node strings             chain nodes in format tcp://{node-addr}:{privval-port} 
                                 (e.g. --node tcp://sentry-1:1234 --node tcp://sentry-2:1234 --node tcp://sentry-3:1234 )
  -o, --overwrite                overwrite an existing config.yaml
      --raft-timeout string      cosigner raft timeout value, 
                                 accepts valid duration strings for Go's time.ParseDuration() e.g. 1s, 1000ms, 1.5m (default "500ms")
  -t, --threshold int            number of shards required for threshold signature

Global Flags:
      --home string   Directory for config and data (default is $HOME/.horcrux)

So to add a configuration for a network we execute:

horcrux config init -m single --node "tcp://<YOURIP>:<YOURPORT>,tcp://<YOURIP2>:<YOURPORT2>" --home ~/.horcrux/artio-80085

Copy the priv validator key

You will now need to copy the priv_validator_key.json to the $HOME/.horcrux/<network-chain-id> directory

⚠️ STOP WHAT YOU ARE DOING AND HAVE A BIT OF A THINK! ⚠️

We are now getting into double sign teritory.

It is okay to miss some blocks. If you are locally signing on a validator node, now is the time to stop the service for the node, disable the service and remove the priv_validator_key.json from that server.

Confirm the validator has stopped signing with an explorer, try to start the service again, check the explorer still indicates you are not signing, check <chaind> status on you node and ensure that no vote power is shown in the response, stop the node again, consider your luck and then consider completely decomissioning the node and burning the hard drive.

On Validator and Backup Machines:

On the validator and backup machines make sure you REMOVE THE PRIV_VALIDATOR_KEY.json. Go Ito your config file located at /home/user/.berad/config/config.toml and edit 3 lines: comment out #priv_validator_key_file, #priv_validator_state_file, and then add your tcp address to priv_validator_laddr

[ledger.cometbft]
proxy_app = "tcp://127.0.0.1:<YOURPORT>"
moniker = "technodrome"
fast_sync = true
db_backend = "goleveldb"
db_dir = "data"
log_level = "info"
log_format = "plain"
genesis_file = "config/genesis.json"
#priv_validator_key_file = "config/priv_validator_key.json"
#priv_validator_state_file = "data/priv_validator_state.json"
priv_validator_laddr = "tcp://<YOURIP>:<YOURPORT>"
node_key_file = "config/node_key.json"
abci = "socket"
filter_peers = false

After making changes restart you berad service.

sudo systemctl restart berad

Back on the horcrux signer machine, Add service file for horcrux instance

Check again that no explorer is indicating you are signing.

Execute the following

sudo nano  /etc/systemd/system/horcrux-bera.service 

[Unit]
Description=Horcrux signer berachain
After=network.target
StartLimitBurst=5
StartLimitIntervalSec=60s

[Service]
Type=simple
User=user
WorkingDirectory=/home/user
ExecStart=/usr/local/go/bin/horcrux signer start --home /home/user/.artio-80085 --accept-risk
Restart=on-failure
RestartSec=10
LimitNOFILE=4096

[Install]
WantedBy=multi-user.target

Enable and start service, watch logs as you doublesign and then are relentlessly mocked on spacex-social-network (Just Kidding)

sudo systemctl daemon-reload
sudo systemctl enable horcrux-bera && sudo systemctl restart horcrux-bera
journalctl -fu horcrux-bera -o cat