v0.3.15

This is LCDVN's v0.3.15 release and is a recommended update for all operators. It follows the monitoring changes of v0.3.12 / v0.3.13. It updates Charon to v1.11.3 and lido-dv-exit to v0.6.1, and tightens the stack's defaults further. Feedback is welcome and appreciated, please use github issues or discord if you have trouble with this release.

Update

# Stop the node
docker compose down
# Save your local .env / custom overrides
git stash
# Update your local copy of this repo
git pull
# Checkout this release
git checkout v0.3.15
# Re-apply your stashed changes
git stash apply
# Restart the node
docker compose up -d
# Check your node (may need sudo)
./grafana/security-check.sh

If you are updating from a release before v0.3.12, also read the v0.3.12 release notes: Grafana now starts from a fresh database, and anything you created in the Grafana UI does not carry over.

Note

The client version variables documented in .env.sample.* (such as CL_LIGHTHOUSE_VERSION, NETHERMIND_VERSION and RETH_VERSION) now take effect. Previously the compose files read different names and ignored them. If you left one of these uncommented in your .env, that version is used after updating, so check that it isn't stale.

After updating

1. Read the security check's output. It reports:

   • any port, other than the P2P ports, that your node publishes on a public address;
   • anything in your old data/grafana that this stack does not create;
   • changed files under grafana/.

   If it reports anything you did not set up yourself, please let us know at security@obol.tech. Files you added yourself under grafana/, such as custom dashboards, are listed for you to review, not counted as findings.

2. Delete the old Grafana data once the check is clean, as it is no longer used: sudo rm -rf data/grafana.

3. Rotate any credentials in your client URLs. If any beacon node or execution client URL you gave Charon or lido-dv-exit contains a password or an API key, rotate it. This includes keys in the path or query, such as /v2/<key> or ?apikey=<key>. Earlier versions logged these URLs in full.

Changes

Only P2P ports should face the internet

Ports that Docker publishes are not filtered by host firewalls such as ufw. On a VPS or bare-metal host, anything Docker publishes on 0.0.0.0 is reachable from the internet unless a provider firewall blocks it. Only the EL, CL and Charon P2P ports need to accept incoming connections, so keep everything else on 127.0.0.1.

• The example ports in docker-compose.override.yml.sample now bind to 127.0.0.1, so copy them as they are.
• security-check.sh lists every other port your node publishes on a public address.

Charon v1.11.3 and lido-dv-exit v0.6.1

• Both redact credentials and API keys in beacon node and execution client URLs from their logs.
• lido-dv-exit now mounts the .charon directory read-only. It only reads the cluster lock and its key from it.

Monitoring

• security-check.sh finds more signs of changes in the old data/grafana, including on recent Grafana versions. This covers extra organizations, dashboards and folders, alert rules, contact points, and records that were created and later deleted.
• Read-only mounts. Grafana's provisioning files and dashboards are mounted read-only, and so are the validator ejector's exit messages. validator-ejector/ is now in .gitignore.
• Re-enabling Grafana logins: the README's example now turns anonymous access off and sets your own secret key. It also asks you to reset the admin password before restarting. If you followed the old example, run:

  docker compose exec grafana grafana cli admin reset-admin-password '<a strong password>'

Clients

• Nethermind's JSON-RPC no longer enables the Trace and Parity modules, which nothing in this stack uses.

What's Changed

• lido-dv-exit: bump to v0.6.1 and mount .charon read-only by @OisinKyne in #344

Full Changelog: v0.3.13...v0.3.15