user-config.toml

# Example user-config.toml for new MPC node operators.
# Defaults target testnet and mirror what NEAR One runs on its live
# testnet node. Inline `# mainnet: ...` comments below show the value
# to use when running on mainnet instead.
#
# MUST be replaced with real values before deploying:
#   - my_near_account_id / near_responder_account_id
#   - secrets.secret_store_key_hex
#   - secrets.backup_encryption_key_hex
# The placeholders below are intentionally non-hex so a forgotten swap
# fails loudly at node startup.

[launcher_config]
image_reference = "nearone/mpc-node"
# Matches the canonical port list in
# docs/running-an-mpc-node-in-tdx-external-guide.md#required-ports
# (80 P2P, 8080 web/metrics, 8079 migration, 3030 debug, 24567 DSS).
port_mappings = [
    { host = 80,    container = 80 },     # MPC P2P (port_override convention)
    { host = 8080,  container = 8080 },   # web_ui / metrics / /public_data
    { host = 8079,  container = 8079 },   # migration_web_ui
    { host = 3030,  container = 3030 },   # debug / telemetry
    { host = 24567, container = 24567 },  # decentralized state sync
]

[mpc_node_config]
home_dir = "/data"

# PCCS endpoints for TDX attestation collateral. The node tries each
# entry in order until one succeeds. Defaults below: Phala primary,
# Intel direct as fallback.
#
# To add a self-hosted local PCCS (e.g. for an operator running their
# own), prepend an entry with a `tls` override. See the operator
# deployment guide's "Self-hosting a local PCCS" appendix for the cert
# setup. Example (commented):
#
#   [[mpc_node_config.pccs_endpoints]]
#   url = "https://10.0.2.2:8081/"
#   tls = { override = "ca_cert_pem", ca_cert_pem = "..." }
#
# `tls = { override = "insecure" }` disables TLS certificate/hostname
# verification for any URL (no loopback enforcement, only a WARN). Use
# only for local PCCS.

[[mpc_node_config.pccs_endpoints]]
url = "https://pccs.phala.network/"

[[mpc_node_config.pccs_endpoints]]
url = "https://api.trustedservices.intel.com/"

[mpc_node_config.log]
format = "plain"
filter = "info"

[mpc_node_config.near_init]
chain_id = "testnet"  # mainnet: "mainnet"
# Testnet boot nodes. For mainnet, replace with the mainnet boot-nodes
# string from https://near-nodes.io/ or the official nearcore mainnet
# config.json (rpc.mainnet.near.org).
boot_nodes = "ed25519:2956bsTqWmXcVmXDSovLYS4HRpdyh51euNCiuQjy1h8Y@65.108.141.230:24567,ed25519:2Ej627FDrHUBA1Mp55qw3zyhACSvJHF25sxtZfyFqasc@65.108.133.7:24567,ed25519:2GorYSFQUWB1But3sXLEM6zARfwb9Pj27QhQMsMpK8Dx@150.136.35.62:24567,ed25519:2nGLw9isJYVqCfaYzA6KHBE9YbtjzGQPPtVcRwYvpJj6@23.88.74.249:24567,ed25519:3VCjDXCbJWNr247wLzBas653C8FT69drtu3vDXbRAG2E@35.188.52.109:24567,ed25519:3wdbS6vbahK7pzgn8r8oFcgFthWvcT8mtXcUgtpQngqW@57.129.88.239:24567,ed25519:49F9yZpbQVefzWegVZYTh18WwFPPcfgvkDmhm7zM5MR4@89.58.28.231:24567,ed25519:4Fx8rLhGobUPVie1FXQCAxFaMQ3Dg6PYMDdm5keZcKW6@84.207.214.228:24567,ed25519:4M63uf6ccsjBkFygqx4T45fKSvKsFFMva9g7FRxjwzTH@176.9.105.103:24568,ed25519:4Rj2NR92umGC4xtXeJFkyCUYymdad3zii1zVEMVnVKqH@5.9.40.211:24567,ed25519:4b5MtShRdtu87BTNoPHX4HDBbZGnm5pjEQoGZk5J7L1w@34.12.14.28:24567,ed25519:4gdz1kjG7ndfbSwgMRtgNYZ7D6reHdnBgZN71U3agwtw@198.244.253.126:24567,ed25519:4qCcK9sWsqCpXzjV6kXxkaLyu5o5UpYNLpQzKFDSjfhA@34.123.242.245:24567,ed25519:4xTqirCWWjJ9QpXQbJLkyUbjRuRBgr4ZVpKMQAs4CjcH@57.128.210.54:24567,ed25519:4xmhjdejr2jWHqpiCrkeGXbrqBt98q9ewZ77WKrAz7JT@148.251.70.186:24567,ed25519:5M9DnL5xecA34RTHnkBpGB8SMXc2NcPvue7784D3GaH4@88.198.57.94:24568,ed25519:5MipaupEtQu7SqdMWsP5mdh2wfHQHgngai2BziCXv2T@185.6.13.181:24567,ed25519:5QmANbVUKooCvHq9qyKTd5cRgp4vYrQrAqjuRrA9M5TT@144.76.43.124:24567,ed25519:5T2wfCxjXT2rFPsyWAAxWnMqLajM24FC2ZWKXA62xbQ1@47.129.128.11:24567,ed25519:5VdRi9UAxjppwL2ku3g2hWXjn4oQZA4i1goEWJxpp9uv@113.172.202.5:24568"
download_genesis = true
download_config = "rpc"
# IP:24567 the node advertises for decentralized (peer-to-peer) state-sync
# responses. REQUIRED — replace with the public IP your dstack port-forward
# exposes for :24567. State sync needs a reachable advertised address;
# leaving this placeholder makes the node fail to start. Especially critical
# on hosts with more than one external IP, or when running multiple nodes on
# one host, where auto-discovery would otherwise advertise an unreachable IP
# and state sync would stall silently.
tier3_public_addr = "REPLACE_WITH_NODE_PUBLIC_IP:24567"
# Required for node versions before 3.12.0: DSS (decentralized state sync)
# attempts per state part before falling back to the external storage bucket.
# Leave at 100 — released 3.11.x nodes default this to 0 (bucket-only), which
# no longer works now that nearcore has stopped serving the centralized
# buckets, and a node left at the default crashes in a state-sync restart
# loop. Ignored on 3.12.0+, which always uses peer-to-peer ("Peers") state
# sync, so it is safe to keep set across the upgrade.
external_storage_fallback_threshold = 100

[mpc_node_config.secrets]
# MUST replace with real values before deploying. The placeholders below
# are non-hex so startup will fail loudly if not updated.
# Generate: `openssl rand -hex 16` (16 bytes / 32 hex chars).
secret_store_key_hex = "REPLACE_ME_WITH_16_BYTE_HEX_KEY_"
# Generate: `openssl rand -hex 32` (32 bytes / 64 hex chars). On node
# migration, must match the OLD node's backup_encryption_key.
backup_encryption_key_hex = "REPLACE_ME_WITH_32_BYTE_HEX_KEY_REPLACE_ME_WITH_32_BYTE_HEX_KEY_"

[mpc_node_config.node]
my_near_account_id = "your-mpc-account.testnet"
near_responder_account_id = "your-mpc-account.testnet"
number_of_responder_keys = 1
web_ui = "0.0.0.0:8080"
migration_web_ui = "0.0.0.0:8079"
# MPC tokio runtime worker threads (separate from the indexer's). Kept
# below the CVM's attested VCPU=8 so the indexer isn't starved.
cores = 6

[mpc_node_config.node.indexer]
validate_genesis = false
sync_mode = "Latest"
concurrency = 1
mpc_contract_id = "v1.signer-prod.testnet"  # mainnet: "v1.signer"
finality = "optimistic"
# MPC P2P convention is port 80. Forces it on every peer URL (listen +
# dial) regardless of the URL's scheme/port.
port_override = 80

[mpc_node_config.node.triple]
concurrency = 2
desired_triples_to_buffer = 16384
timeout_sec = 120
parallel_triple_generation_stagger_time_sec = 1

[mpc_node_config.node.presignature]
concurrency = 16
desired_presignatures_to_buffer = 8192
timeout_sec = 60

[mpc_node_config.node.signature]
timeout_sec = 60

[mpc_node_config.node.ckd]
timeout_sec = 60

# Foreign-chain RPC providers. The active sections below target testnet
# networks; the mainnet variant is the commented block at the end — for a
# mainnet node, replace the testnet sections with it.
#
# Replace the YOUR_* placeholders with your own API keys and YOUR-SLUG with
# your QuickNode endpoint name. See "Foreign chain RPC providers" in
# docs/running-an-mpc-node-in-tdx-external-guide.md for details, and verify
# with crates/foreign-chain-config-tester before deploying.

[mpc_node_config.node.foreign_chains.bitcoin]
timeout_sec = 30
max_retries = 3
# Genesis block hash, as block explorers render it.
expected_network_fingerprint = "000000000933ea01ad0ee984209779baaec3ced90fa3f408719526f8d77f4943"

[mpc_node_config.node.foreign_chains.bitcoin.providers.public]
rpc_url = "https://bitcoin-testnet-rpc.publicnode.com"

[mpc_node_config.node.foreign_chains.abstract]
timeout_sec = 30
max_retries = 3
expected_network_fingerprint = "11124"

[mpc_node_config.node.foreign_chains.abstract.providers.abstract-testnet]
rpc_url = "https://api.testnet.abs.xyz"

[mpc_node_config.node.foreign_chains.abstract.providers.alchemy]
rpc_url = "https://abstract-testnet.g.alchemy.com/v2/{API_KEY}"

[mpc_node_config.node.foreign_chains.abstract.providers.alchemy.auth]
kind = "path"
placeholder = "{API_KEY}"
token = { val = "YOUR_ALCHEMY_API_KEY" }

[mpc_node_config.node.foreign_chains.abstract.providers.quicknode]
rpc_url = "https://YOUR-SLUG.abstract-testnet.quiknode.pro/{api_key}"

[mpc_node_config.node.foreign_chains.abstract.providers.quicknode.auth]
kind = "path"
placeholder = "{api_key}"
token = { val = "YOUR_QUICKNODE_API_KEY" }

[mpc_node_config.node.foreign_chains.starknet]
timeout_sec = 30
max_retries = 3
expected_network_fingerprint = "0x534e5f5345504f4c4941"  # SN_SEPOLIA

[mpc_node_config.node.foreign_chains.starknet.providers.publicnode]
rpc_url = "https://starknet-sepolia-rpc.publicnode.com"

[mpc_node_config.node.foreign_chains.starknet.providers.alchemy]
rpc_url = "https://starknet-sepolia.g.alchemy.com/starknet/version/rpc/v0_10/{API_KEY}"

[mpc_node_config.node.foreign_chains.starknet.providers.alchemy.auth]
kind = "path"
placeholder = "{API_KEY}"
token = { val = "YOUR_ALCHEMY_API_KEY" }

[mpc_node_config.node.foreign_chains.starknet.providers.quicknode]
rpc_url = "https://YOUR-SLUG.strk-sepolia.quiknode.pro/{api_key}"

[mpc_node_config.node.foreign_chains.starknet.providers.quicknode.auth]
kind = "path"
placeholder = "{api_key}"
token = { val = "YOUR_QUICKNODE_API_KEY" }

[mpc_node_config.node.foreign_chains.aptos]
timeout_sec = 30
max_retries = 3
expected_network_fingerprint = "2"  # Aptos ledger chain id

[mpc_node_config.node.foreign_chains.aptos.providers.public]
rpc_url = "https://fullnode.testnet.aptoslabs.com/v1"

[mpc_node_config.node.foreign_chains.aptos.providers.alchemy]
rpc_url = "https://aptos-testnet.g.alchemy.com/v2/{API_KEY}/v1"

[mpc_node_config.node.foreign_chains.aptos.providers.alchemy.auth]
kind = "path"
placeholder = "{API_KEY}"
token = { val = "YOUR_ALCHEMY_API_KEY" }

[mpc_node_config.node.foreign_chains.aptos.providers.quicknode]
rpc_url = "https://YOUR-SLUG.aptos-testnet.quiknode.pro/{api_key}/v1"

[mpc_node_config.node.foreign_chains.aptos.providers.quicknode.auth]
kind = "path"
placeholder = "{api_key}"
token = { val = "YOUR_QUICKNODE_API_KEY" }

[mpc_node_config.node.foreign_chains.aptos.providers.geomi]
rpc_url = "https://api.testnet.aptoslabs.com/v1"

[mpc_node_config.node.foreign_chains.aptos.providers.geomi.auth]
kind = "header"
name = "Authorization"
scheme = "Bearer"
token = { val = "YOUR_GEOMI_API_KEY" }

# Sui speaks gRPC: keys go in headers, never in the URL (path/query auth is
# not supported by the gRPC client).
[mpc_node_config.node.foreign_chains.sui]
timeout_sec = 30
max_retries = 3
# Genesis checkpoint digest.
expected_network_fingerprint = "69WiPg3DAQiwdxfncX6wYQ2siKwAe6L9BZthQea3JNMD"

[mpc_node_config.node.foreign_chains.sui.providers.public]
rpc_url = "https://archive.testnet.sui.io"

[mpc_node_config.node.foreign_chains.sui.providers.public.auth]
kind = "none"

[mpc_node_config.node.foreign_chains.sui.providers.alchemy]
rpc_url = "https://sui-testnet.g.alchemy.com"

[mpc_node_config.node.foreign_chains.sui.providers.alchemy.auth]
kind = "header"
name = "Authorization"
scheme = "Bearer"
token = { val = "YOUR_ALCHEMY_API_KEY" }

[mpc_node_config.node.foreign_chains.sui.providers.quicknode]
rpc_url = "https://YOUR-SLUG.sui-testnet.quiknode.pro:9000"

[mpc_node_config.node.foreign_chains.sui.providers.quicknode.auth]
kind = "header"
name = "x-token"
token = { val = "YOUR_QUICKNODE_API_KEY" }

# ─── Mainnet variant ─────────────────────────────────────────────────────────
# For a mainnet node, replace the testnet foreign_chains sections above with:
#
# [mpc_node_config.node.foreign_chains.bitcoin]
# timeout_sec = 30
# max_retries = 3
# # Genesis block hash, as block explorers render it.
# expected_network_fingerprint = "000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f"
#
# [mpc_node_config.node.foreign_chains.bitcoin.providers.public]
# rpc_url = "https://bitcoin-rpc.publicnode.com"
#
# [mpc_node_config.node.foreign_chains.abstract]
# timeout_sec = 30
# max_retries = 3
# expected_network_fingerprint = "2741"
#
# [mpc_node_config.node.foreign_chains.abstract.providers.abstract-mainnet]
# rpc_url = "https://api.mainnet.abs.xyz"
#
# [mpc_node_config.node.foreign_chains.abstract.providers.alchemy]
# rpc_url = "https://abstract-mainnet.g.alchemy.com/v2/{API_KEY}"
#
# [mpc_node_config.node.foreign_chains.abstract.providers.alchemy.auth]
# kind = "path"
# placeholder = "{API_KEY}"
# token = { val = "YOUR_ALCHEMY_API_KEY" }
#
# [mpc_node_config.node.foreign_chains.abstract.providers.quicknode]
# rpc_url = "https://YOUR-SLUG.abstract-mainnet.quiknode.pro/{api_key}"
#
# [mpc_node_config.node.foreign_chains.abstract.providers.quicknode.auth]
# kind = "path"
# placeholder = "{api_key}"
# token = { val = "YOUR_QUICKNODE_API_KEY" }
#
# [mpc_node_config.node.foreign_chains.starknet]
# timeout_sec = 30
# max_retries = 3
# expected_network_fingerprint = "0x534e5f4d41494e"  # SN_MAIN
#
# [mpc_node_config.node.foreign_chains.starknet.providers.publicnode]
# rpc_url = "https://starknet-rpc.publicnode.com"
#
# [mpc_node_config.node.foreign_chains.starknet.providers.alchemy]
# rpc_url = "https://starknet-mainnet.g.alchemy.com/starknet/version/rpc/v0_10/{API_KEY}"
#
# [mpc_node_config.node.foreign_chains.starknet.providers.alchemy.auth]
# kind = "path"
# placeholder = "{API_KEY}"
# token = { val = "YOUR_ALCHEMY_API_KEY" }
#
# [mpc_node_config.node.foreign_chains.starknet.providers.quicknode]
# rpc_url = "https://YOUR-SLUG.strk-mainnet.quiknode.pro/{api_key}"
#
# [mpc_node_config.node.foreign_chains.starknet.providers.quicknode.auth]
# kind = "path"
# placeholder = "{api_key}"
# token = { val = "YOUR_QUICKNODE_API_KEY" }
#
# [mpc_node_config.node.foreign_chains.aptos]
# timeout_sec = 30
# max_retries = 3
# expected_network_fingerprint = "1"  # Aptos ledger chain id
#
# [mpc_node_config.node.foreign_chains.aptos.providers.public]
# rpc_url = "https://fullnode.mainnet.aptoslabs.com/v1"
#
# [mpc_node_config.node.foreign_chains.aptos.providers.alchemy]
# rpc_url = "https://aptos-mainnet.g.alchemy.com/v2/{API_KEY}/v1"
#
# [mpc_node_config.node.foreign_chains.aptos.providers.alchemy.auth]
# kind = "path"
# placeholder = "{API_KEY}"
# token = { val = "YOUR_ALCHEMY_API_KEY" }
#
# [mpc_node_config.node.foreign_chains.aptos.providers.quicknode]
# rpc_url = "https://YOUR-SLUG.aptos-mainnet.quiknode.pro/{api_key}/v1"
#
# [mpc_node_config.node.foreign_chains.aptos.providers.quicknode.auth]
# kind = "path"
# placeholder = "{api_key}"
# token = { val = "YOUR_QUICKNODE_API_KEY" }
#
# [mpc_node_config.node.foreign_chains.aptos.providers.geomi]
# rpc_url = "https://api.mainnet.aptoslabs.com/v1"
#
# [mpc_node_config.node.foreign_chains.aptos.providers.geomi.auth]
# kind = "header"
# name = "Authorization"
# scheme = "Bearer"
# token = { val = "YOUR_GEOMI_API_KEY" }
#
# # Sui speaks gRPC: keys go in headers, never in the URL.
# [mpc_node_config.node.foreign_chains.sui]
# timeout_sec = 30
# max_retries = 3
# # Genesis checkpoint digest.
# expected_network_fingerprint = "4btiuiMPvEENsttpZC7CZ53DruC3MAgfznDbASZ7DR6S"
#
# [mpc_node_config.node.foreign_chains.sui.providers.public]
# rpc_url = "https://archive.mainnet.sui.io"
#
# [mpc_node_config.node.foreign_chains.sui.providers.public.auth]
# kind = "none"
#
# [mpc_node_config.node.foreign_chains.sui.providers.alchemy]
# rpc_url = "https://sui-mainnet.g.alchemy.com"
#
# [mpc_node_config.node.foreign_chains.sui.providers.alchemy.auth]
# kind = "header"
# name = "Authorization"
# scheme = "Bearer"
# token = { val = "YOUR_ALCHEMY_API_KEY" }
#
# [mpc_node_config.node.foreign_chains.sui.providers.quicknode]
# rpc_url = "https://YOUR-SLUG.sui-mainnet.quiknode.pro:9000"
#
# [mpc_node_config.node.foreign_chains.sui.providers.quicknode.auth]
# kind = "header"
# name = "x-token"
# token = { val = "YOUR_QUICKNODE_API_KEY" }