.env.example

# Avalanche L1 failover-benchmark configuration.
# Copy this file to .env and fill in your values:
#
#   cp .env.example .env
#
# Everything is driven from a single CONTROL HOST: it runs the orchestration
# scripts, the load generator (bombard), and the Prometheus/Grafana monitoring
# stack. The control host never runs an L1 node itself, so it survives a full
# site outage and keeps recording the survivors.

# SSH user for every node (all nodes share one user).
SSH_USER=ubuntu

# Path on the control host to the SSH private key that reaches every node.
# All nodes must accept this key. Set it explicitly — if left unset a built-in
# default path is used, which is rarely what you want.
SSH_KEY_PATH=/home/ubuntu/.ssh/your-fleet-key

# =============================================================================
# TOPOLOGY — per-role IP lists
# =============================================================================
# Topology is driven by one IP list per role, per site. Each list's LENGTH sets
# that role's node count; its VALUES set placement. The recommended per-site
# shape is 3 validators + 1 spare + 2 RPC:
#
#   validators  weighted L1 validators — consensus runs here.
#   spare       hot spare — assumes a validator identity when a validator drops.
#   RPC         pinned archive RPC nodes — the load-generator ingress. Never
#               promoted to validators, so ingress survives a failover.
#
# CO-LOCATION: repeat an IP (within or across role lists / sites) to launch
# another avalanchego on that box. Each extra process on a box is auto-offset so
# nothing collides: ports +10 per process (9652/9653 -> 9662/9663 -> 9672/9673)
# and data/staking dirs get a -N suffix (data/validator -> data/validator-1).
# Co-location trades away fault isolation (a box hosting two nodes loses both at
# once), so for a production-fidelity DR test keep one node per box on separate
# machines/regions. It's ideal for fitting the full topology onto fewer boxes.

# --- Site A (primary): recommended one-node-per-box, 6 separate machines ------
VALIDATOR_IPS=10.0.0.1,10.0.0.2,10.0.0.3   # 3 weighted validators
SPARE_IPS=10.0.0.4                          # 1 hot spare
RPC_IPS=10.0.0.5,10.0.0.6                   # 2 archive RPCs (load-gen ingress)

# --- Site B (backup): optional. Set these to enable two-site failover ---------
# Put site B in a DIFFERENT region/data center so cross-site sync latency is
# realistic (e.g. site A in us-east-1, site B in us-east-2). Leave unset/empty
# for single-site mode (failover within site A only).
BACKUP_VALIDATOR_IPS=10.1.0.1,10.1.0.2,10.1.0.3
BACKUP_SPARE_IPS=10.1.0.4
BACKUP_RPC_IPS=10.1.0.5,10.1.0.6

# --- Co-located alternative: the full 12-node, two-site topology on 5 boxes ---
# 3 validator boxes (one site-A + one site-B validator each) + 2 service boxes
# (each runs that site's spare + 2 RPCs). Only site A is active in normal
# operation, so each validator box carries at most one ACTIVE validator. Comment
# out the per-role blocks above and uncomment these to use it:
#
#   VALIDATOR_IPS=10.0.0.1,10.0.0.2,10.0.0.3   # one A-validator per box (:9652)
#   SPARE_IPS=10.0.0.4                          # spare on the site-A services box
#   RPC_IPS=10.0.0.4,10.0.0.4                   # 2 RPCs co-located on the same box
#
#   BACKUP_VALIDATOR_IPS=10.0.0.1,10.0.0.2,10.0.0.3   # B-validators share boxes 1-3 (:9662)
#   BACKUP_SPARE_IPS=10.0.0.5                          # spare on the site-B services box
#   BACKUP_RPC_IPS=10.0.0.5,10.0.0.5                   # 2 RPCs co-located on the same box

# --- LEGACY positional format (still supported) ------------------------------
# If VALIDATOR_IPS is unset, the tooling falls back to a single positional list
# of exactly 6 IPs per site, in order: validators(3), spare(1), RPCs(2).
#   NODE_IPS=10.0.0.1,10.0.0.2,10.0.0.3,10.0.0.4,10.0.0.5,10.0.0.6
#   BACKUP_SITE_NODE_IPS=10.1.0.1,10.1.0.2,10.1.0.3,10.1.0.4,10.1.0.5,10.1.0.6