Skip to content

Commit 19ba67d

Browse files
tharberttharbert
authored
add node operator documentation (MystenLabs#9190)
1 parent 5ce1659 commit 19ba67d

File tree

20 files changed

+979
-3
lines changed

20 files changed

+979
-3
lines changed

‎dashboards/README.md

Whitespace-only changes.

‎docker/fullnode/docker-compose.yaml

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,9 @@ services:
44
fullnode:
55
image: mysten/sui-node:stable
66
ports:
7+
- "8084:8084/udp"
78
- "9000:9000"
89
- "9184:9184"
9-
expose:
10-
- "9000"
11-
- "9184"
1210
volumes:
1311
- ./fullnode-template.yaml:/sui/fullnode.yaml:ro
1412
- ./genesis.blob:/sui/genesis.blob:ro

‎docker/sui-node/Dockerfile

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,8 @@ ARG PROFILE=release
5151
WORKDIR sui
5252
# Both bench and release profiles copy from release dir
5353
COPY --from=builder /sui/target/release/sui-node /usr/local/bin
54+
# Staged migration from /usr/local/bin to /opt/sui/bin
55+
COPY --from=builder /sui/target/release/sui-node /opt/sui/bin
5456

5557
ARG BUILD_DATE
5658
ARG GIT_REVISION

‎nre/README.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Node and Network Reliability Engineering
2+
3+
-----
4+
5+
This repo contains:
6+
7+
- [Sui for Node Operators](./sui_for_node_operators.md) - This documentation aggregates all the information about deploying and operating the Sui Node software for Node Operators.
8+
9+
- `ansible/` - An ansible playbook for standing up your node. Successful execution of the playbook will result in a systemd managed process running sui-node. You can use this or just consult the steps when provisioning your node.
10+
11+
- `config/` - Sui Node configuration templates.
12+
13+
- `docker/` - A docker compose configuration for standing up your node. You can use this or just consult the steps when provisioning your node.
14+
15+
- `systemd/` - Steps to setup your node as a systemd service. You can use this or reference the steps when provisioning your node.

‎nre/ansible/README.md

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Configure a Linux system as a Sui Node using Ansible
2+
3+
This is a self contained Ansible role for configuring a Linux system as a Sui Node.
4+
5+
Tested with `ansible [core 2.13.4]` and:
6+
7+
- ubuntu 20.04 (linux/amd64) on bare metal
8+
- ubuntu 22.04 (linux/amd64) on bare metal
9+
10+
## Prerequisites and Setup
11+
12+
1. Install [Ansible](https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html)
13+
14+
2. Add the target host to the [Ansible Inventory](./inventory.yaml)
15+
16+
3. Update the `sui_release` var in the [Ansible Inventory](./inventory.yaml)
17+
18+
4. Update [validator.yaml](../config/validator.yaml) and copy it to this directory.
19+
20+
5. Copy the genesis.blob to this directory (should be available after the Genesis ceremony).
21+
22+
6. Udate the `keypair_path` var in the [Ansible Inventory](./inventory.yaml)
23+
24+
## Example use:
25+
26+
- Configure everything:
27+
28+
`ansible-playbook -i inventory.yaml sui-node.yaml -e host=$inventory_name`
29+
30+
- Software update:
31+
32+
`TODO`

‎nre/ansible/inventory.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
validator:
3+
hosts:
4+
validator:
5+
ansible_host: validator.example.com
6+
ansible_user: ubuntu
7+
sui_release: "$SUI_SHA" # UPDATE THIS
8+
node_config: "./validator.yaml"
9+
genesis_blob: "./genesis.blob"
10+
keypair_path: "./key-pairs/"

‎nre/ansible/roles/sui-node/files/journald.conf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[Journal]
2+
RateLimitBurst=500000
3+
ForwardToSyslog=no

‎nre/ansible/roles/sui-node/files/sui-node.service

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
[Unit]
2+
Description=Sui Node
3+
4+
[Service]
5+
User=sui
6+
WorkingDirectory=/opt/sui/
7+
Environment=RUST_BACKTRACE=1
8+
Environment=RUST_LOG=info,sui_core=debug,narwhal=debug,narwhal-primary::helper=info
9+
ExecStart=/opt/sui/bin/sui-node --config-path /opt/sui/config/validator.yaml
10+
Restart=always
11+
12+
[Install]
13+
WantedBy=multi-user.target

‎nre/ansible/roles/sui-node/tasks/iptables.yaml

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
---
2+
- name: Set the policy for the INPUT chain to ACCEPT (IPv4)
3+
iptables:
4+
chain: INPUT
5+
ip_version: ipv4
6+
policy: ACCEPT
7+
8+
- name: Flush filter chains (IPv4)
9+
ansible.builtin.iptables:
10+
chain: "{{ item }}"
11+
ip_version: ipv4
12+
flush: yes
13+
with_items: ["INPUT", "FORWARD", "OUTPUT"]
14+
15+
- name: Flush filter chains (IPv6)
16+
ansible.builtin.iptables:
17+
chain: "{{ item }}"
18+
ip_version: ipv6
19+
flush: yes
20+
with_items: ["INPUT", "FORWARD", "OUTPUT"]
21+
22+
- name: Allow all loopback connectivity
23+
ansible.builtin.iptables:
24+
chain: INPUT
25+
in_interface: lo
26+
jump: ACCEPT
27+
28+
- name: Allow TCP port 22 / SSH connectivity
29+
ansible.builtin.iptables:
30+
chain: INPUT
31+
destination_port: 22
32+
jump: ACCEPT
33+
protocol: tcp
34+
35+
- name: Allow established and related connectivity
36+
iptables:
37+
chain: INPUT
38+
ctstate: ESTABLISHED,RELATED
39+
jump: ACCEPT
40+
41+
- name: Allow TCP destination port 8080 / sui-node protocol connectivity
42+
iptables:
43+
chain: INPUT
44+
destination_port: 8080
45+
jump: ACCEPT
46+
protocol: tcp
47+
comment: sui-node protocol
48+
49+
- name: Allow UDP destination port 8081 / sui-node narwhal-primary-address connectivity
50+
iptables:
51+
chain: INPUT
52+
destination_port: 8081
53+
jump: ACCEPT
54+
protocol: udp
55+
comment: sui-node narwhal-primary-address
56+
57+
- name: Allow UDP destination port 8082 / sui-node narwhal-worker-address connectivity
58+
iptables:
59+
chain: INPUT
60+
destination_port: 8082
61+
jump: ACCEPT
62+
protocol: udp
63+
comment: sui-node narwhal-worker-address
64+
65+
- name: Allow UDP destination port 8084 / sui-node peer-to-peer connectivity
66+
iptables:
67+
chain: INPUT
68+
destination_port: 8084
69+
jump: ACCEPT
70+
protocol: udp
71+
comment: sui-node peer-to-peer
72+
73+
- name: Set the policy for the INPUT chain to DROP (IPv4)
74+
iptables:
75+
chain: INPUT
76+
ip_version: ipv4
77+
policy: DROP
78+
79+
- name: Set the policy for the INPUT chain to DROP (IPv6)
80+
iptables:
81+
chain: INPUT
82+
ip_version: ipv6
83+
policy: DROP
84+
85+
- name: Save iptables configuration (/etc/iptables/)
86+
ansible.builtin.command: netfilter-persistent save
87+
become: yes

‎nre/ansible/roles/sui-node/tasks/main.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
- name: Install required system packages
3+
apt: name={{ item }} state=latest update_cache=yes
4+
loop: [
5+
'iptables-persistent'
6+
]
7+
8+
- name: Include Ubuntu tasks
9+
ansible.builtin.include_tasks: "{{ role_path }}/tasks/ubuntu.yaml"
10+
when: ansible_distribution == 'Ubuntu'
11+
12+
- name: Include iptables tasks
13+
ansible.builtin.include_tasks: "{{ role_path }}/tasks/iptables.yaml"
14+
when: skip_iptables == false
15+
16+
- name: Include monitoring tasks
17+
ansible.builtin.include_tasks: "{{ role_path }}/tasks/monitoring.yaml"
18+
when: skip_monitoring == false
19+
20+
- name: Include Sui tasks
21+
ansible.builtin.include_tasks: "{{ role_path }}/tasks/sui.yaml"

0 commit comments

Comments
 (0)