originally forked from https://github.com/KaiserKarel/validators/
This repo contains my configurations for validators (through Nixos). The current implementation is a little bit hands-on.
To make this work:
nix-build image.nix
The machine image can be used with digital ocean to deploy new nixos machines. Make sure to enable ssh access.
For secrets management, I use sops-nix. The flow after creating a new machine is approximately:
- copy and remove /var/lib/unionvisor/home/config/priv_validator_key.json to my work machine.
- edit the config.toml to enable prometheus and set the seeds.
- add priv_validator_key to my sops-nix config, encrypt
- nixos-rebuild switch... to redeploy.
The above ensures that I have checked-in encrypted backups of my secrets, and that for secret-rotation I just need to redeploy.