You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/website/root/manual/operate/run-aggregator-node.md
+7Lines changed: 7 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -60,6 +60,7 @@ Note that this guide works only on a Linux machine.
60
60
- Operate a **Cardano full node**
61
61
62
62
- To access the file system of the **Cardano full node**, you will need the following permissions:
63
+
63
64
- Read rights on the `Database` folder (specified by the `--database-path` setting of the **Cardano node**)
64
65
- Read and write rights on the `Inter Process Communication` file (typically defined by the `CARDANO_NODE_SOCKET_PATH` environment variable used to launch the **Cardano node**)
65
66
@@ -273,10 +274,12 @@ The configuration values for the `/opt/mithril/mithril-aggregator.env` file are
273
274
-`CUSTOM_ORIGIN_TAG_WHITE_LIST`: Comma-separated list of custom origin tags to whitelist for client requests (default: `EXPLORER,BENCHMARK,CI,NA`).
274
275
275
276
-**Base configuration****optional** values are:
277
+
276
278
-`BLOCKFROST_PARAMETERS`: Parameters to connect to the Blockfrost API. Used to fetch the ticker and name of the registered stake pools. Example: `{"project_id":"preprodWuV1ICdtOWfZYfdcxpZ0tsS1N9rVZomQ"}`
277
279
-`SIGNER_IMPORTER_RUN_INTERVAL`: Time interval at which the pools names and ticker in blockfrost will be imported (in minutes, default: `720`).
278
280
279
281
- The **Cardano database** configuration values are (only needed if supporting Cardano database certification):
282
+
280
283
-`DB_DIRECTORY`: Directory of the Cardano node database stores (same as the `--database-path` setting of the Cardano node)
281
284
-`DATA_STORES_DIRECTORY`: Directory where the aggregator will store its databases (eg, `/opt/mithril/stores`)
282
285
-`GOOGLE_APPLICATION_CREDENTIALS_JSON`: JSON content of the GCP service account credentials (required if using GCP for snapshot storage)
@@ -300,6 +303,7 @@ The configuration values for the `/opt/mithril/mithril-aggregator.env` file are
300
303
Here is an **example** set of values for **release-preprod** that will be used in this guide in the **tip** boxes to illustrate some commands:
@@ -1299,6 +1305,7 @@ If you want to make your follower aggregator publicly discoverable, you should:
1299
1305
1. **Ensure your aggregator is accessible via HTTPS** by setting up Traefik or another reverse proxy with a valid SSL certificate (as described in the [Set up the SSL certificate](#setup-the-ssl-certificate-traefik) section).
1300
1306
1301
1307
2. **Register your aggregator in the networks configuration**. You can do this by:
1308
+
1302
1309
- Opening an issue in the [Mithril GitHub repository](https://github.com/input-output-hk/mithril/issues)
1303
1310
- Or by creating a pull request that modifies the [`networks.json`](https://github.com/input-output-hk/mithril/blob/main/networks.json) file and updates the `aggregators` field in the Cardano network you are targeting.
Copy file name to clipboardExpand all lines: docs/website/root/manual/operate/run-signer-node.md
+3Lines changed: 3 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -99,10 +99,12 @@ Note that this guide works only on a Linux machine.
99
99
:::
100
100
101
101
- To operate a **Cardano node** as a **stake pool**, you need:
102
+
102
103
- The pool's `operational certificate`
103
104
- The pool's `KES secret key`
104
105
105
106
- To access the file system of the **Cardano block-producing** node for **production** deployment (or of the **Cardano relay** node for **naive** deployment), you will need the following permissions:
107
+
106
108
- Read rights on the `Database` folder (specified by the `--database-path` setting of the **Cardano node**)
107
109
- Read and write rights on the `Inter Process Communication` file (typically defined by the `CARDANO_NODE_SOCKET_PATH` environment variable used to launch the **Cardano node**)
- If you have already installed `Squid` via the `apt` package manager, we recommend that you delete it before manually building it from source by running the following commands:
Copy file name to clipboardExpand all lines: docs/website/root/mithril/advanced/mithril-protocol/protocol.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -103,6 +103,7 @@ a quorum of `k` valid signatures must be submitted.
103
103
- For every valid signature, the party creates a proof (`π`) containing a signature of the message, verification key, stake, and paths of the party in the Merkle tree.
104
104
105
105
- Then, multiple signatures can be aggregated together to form a certificate (`τ`) by:
106
+
106
107
- Verifying signatures from each party:
107
108
- Checking the party is authorized to sign for the given index (using the same procedure as signing)
Copy file name to clipboardExpand all lines: docs/website/root/mithril/advanced/threat-model.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -114,6 +114,7 @@ For each asset, we first identify which part of the **CIA triad** (Confidentiali
114
114
- The KES key is present only on the block-producing (BP) node but needs to be shared with both the `cardano-node` process and the `mithril-signer` process.
115
115
- KES keys are needed by `mithril-signer` to sign a verification key along with an operational certificate that authenticates the key for this stake pool ID.
116
116
- This signing happens at every epoch.
117
+
117
118
-**Confidentiality**: Yes
118
119
Capturing KES private keys allows an attacker to impersonate a registered SPO on-chain and produce blocks on its behalf until the keys are rotated.
119
120
@@ -324,6 +325,7 @@ A DoS on the `mithril-aggregator`.
324
325
Data integrity of the Cardano block producer’s on-disk database could be compromised either by the action of the Mithril signer or by an attacker with access to the signer.
Copy file name to clipboardExpand all lines: docs/website/versioned_docs/version-maintained/manual/operate/run-aggregator-node.md
+7Lines changed: 7 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -60,6 +60,7 @@ Note that this guide works only on a Linux machine.
60
60
- Operate a **Cardano full node**
61
61
62
62
- To access the file system of the **Cardano full node**, you will need the following permissions:
63
+
63
64
- Read rights on the `Database` folder (specified by the `--database-path` setting of the **Cardano node**)
64
65
- Read and write rights on the `Inter Process Communication` file (typically defined by the `CARDANO_NODE_SOCKET_PATH` environment variable used to launch the **Cardano node**)
65
66
@@ -273,10 +274,12 @@ The configuration values for the `/opt/mithril/mithril-aggregator.env` file are
273
274
-`CUSTOM_ORIGIN_TAG_WHITE_LIST`: Comma-separated list of custom origin tags to whitelist for client requests (default: `EXPLORER,BENCHMARK,CI,NA`).
274
275
275
276
-**Base configuration****optional** values are:
277
+
276
278
-`BLOCKFROST_PARAMETERS`: Parameters to connect to the Blockfrost API. Used to fetch the ticker and name of the registered stake pools. Example: `{"project_id":"preprodWuV1ICdtOWfZYfdcxpZ0tsS1N9rVZomQ"}`
277
279
-`SIGNER_IMPORTER_RUN_INTERVAL`: Time interval at which the pools names and ticker in blockfrost will be imported (in minutes, default: `720`).
278
280
279
281
- The **Cardano database** configuration values are (only needed if supporting Cardano database certification):
282
+
280
283
-`DB_DIRECTORY`: Directory of the Cardano node database stores (same as the `--database-path` setting of the Cardano node)
281
284
-`DATA_STORES_DIRECTORY`: Directory where the aggregator will store its databases (eg, `/opt/mithril/stores`)
282
285
-`GOOGLE_APPLICATION_CREDENTIALS_JSON`: JSON content of the GCP service account credentials (required if using GCP for snapshot storage)
@@ -300,6 +303,7 @@ The configuration values for the `/opt/mithril/mithril-aggregator.env` file are
300
303
Here is an **example** set of values for **release-preprod** that will be used in this guide in the **tip** boxes to illustrate some commands:
@@ -1300,6 +1306,7 @@ If you want to make your follower aggregator publicly discoverable, you should:
1300
1306
1. **Ensure your aggregator is accessible via HTTPS** by setting up Traefik or another reverse proxy with a valid SSL certificate (as described in the [Set up the SSL certificate](#setup-the-ssl-certificate-traefik) section).
1301
1307
1302
1308
2. **Register your aggregator in the networks configuration**. You can do this by:
1309
+
1303
1310
- Opening an issue in the [Mithril GitHub repository](https://github.com/input-output-hk/mithril/issues)
1304
1311
- Or by creating a pull request that modifies the [`networks.json`](https://github.com/input-output-hk/mithril/blob/main/networks.json) file and updates the `aggregators` field in the Cardano network you are targeting.
0 commit comments