* Send miner auth token in Ready handshake. Require --auth-token or --auth-token-file when connecting to a node so the miner matches the node's shared-secret QUIC auth. Co-authored-by: Cursor <cursoragent@cursor.com> * Pin the node's miner TLS certificate by SHA-256 fingerprint. Require --tls-cert-sha256 or --tls-cert-sha256-file so miners reject MITM certs instead of accepting any self-signed server certificate. Co-authored-by: Cursor <cursoragent@cursor.com> * fmt * Docs: prefer reading miner auth token from file, not node logs. Co-authored-by: Cursor <cursoragent@cursor.com> * Version the miner ALPN as quantus-miner/2 to match the node. A node/miner protocol mismatch now fails cleanly at the TLS handshake with "no application protocol" instead of an opaque auth error. Co-authored-by: Cursor <cursoragent@cursor.com> * point at git * Depend on published quantus-miner-api 0.3.0 from crates.io. The temporary git branch pin is no longer needed now that 0.3.0 is published. Co-authored-by: Cursor <cursoragent@cursor.com> * Fail closed on permanent auth/TLS misconfig instead of reconnect looping. Validate the fingerprint and Ready frame size at miner/pool startup before metrics, workers, or HTTP come up. Treat node auth rejection and pin mismatch as PermanentConnectError (no retry), and only reset reconnect backoff after the first NewJob proves auth succeeded. Co-authored-by: Cursor <cursoragent@cursor.com> * Point miner auth docs and examples at miner-auth-token / TLS pin files. The node never logs the auth token; CLI/pool help and every serve/Docker example now require the chain config files (or env vars) instead of implying credentials can be copied from logs. Co-authored-by: Cursor <cursoragent@cursor.com> * fmt * Remove the miner Dockerfile and Docker packaging docs/CI. Container GPU access is a poor fit for this miner, and the Docker examples were unusable with SocketAddr (hostnames rejected). Run the native binary instead. Co-authored-by: Cursor <cursoragent@cursor.com> * Shut down the pool on permanent upstream auth failure; keep reconnecting otherwise. Supervise run_node_client alongside HTTP so a bad token/pin ends the process instead of leaving a live API on a dead upstream. Node restarts still reconnect with backoff; the current job is cleared while disconnected so captchas are not issued against a stale header. Co-authored-by: Cursor <cursoragent@cursor.com> * Replace obsolete EXTERNAL_MINER_PROTOCOL.md with a pointer to MINING.md. The local copy still described the pre-auth protocol (no Ready token, no pin, old ALPN, 16 MB frames). Canonical docs live in quantus-miner-api and the node's MINING.md. Co-authored-by: Cursor <cursoragent@cursor.com> * Delete EXTERNAL_MINER_PROTOCOL.md; README already points at MINING.md. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
5.5 KiB
5.5 KiB
External Miner Service for Quantus Network
High-performance external mining service for Quantus Network with support for CPU, GPU, and hybrid CPU+GPU mining.
Building
# CPU-only build (default)
cargo build -p miner-cli --release
# With GPU support (recommended)
cargo build -p miner-cli --release
The binary will be available at target/release/quantus-miner.
Running
The node requires a shared auth token and TLS cert pin. Both live under the
node's chain config dir (<base-path>/chains/<chain>/):
miner-auth-token— shared secret (not logged by the node; read this file)miner-tls-cert-sha256— SHA-256 of the miner TLS cert (also printed in node logs)
# Preferred: mount/read the node's chain config files
./target/release/quantus-miner serve \
--node-addr 127.0.0.1:9833 \
--auth-token-file /path/to/miner-auth-token \
--tls-cert-sha256-file /path/to/miner-tls-cert-sha256 \
--cpu-workers 4
# Or pass values directly (token from miner-auth-token; fingerprint also in node logs)
./target/release/quantus-miner serve \
--node-addr 127.0.0.1:9833 \
--auth-token <TOKEN> \
--tls-cert-sha256 <FINGERPRINT> \
--gpu-devices 1
# Hybrid CPU+GPU mining
./target/release/quantus-miner serve \
--node-addr 127.0.0.1:9833 \
--auth-token-file /path/to/miner-auth-token \
--tls-cert-sha256-file /path/to/miner-tls-cert-sha256 \
--cpu-workers 4 \
--gpu-devices 1
Configuration
| Argument | Environment Variable | Description | Default |
|---|---|---|---|
--node-addr <ADDR> |
MINER_NODE_ADDR |
Node address to connect to | 127.0.0.1:9833 |
--auth-token <TOKEN> |
MINER_AUTH_TOKEN |
Shared secret from the node's miner-auth-token file (not logged) |
required |
--auth-token-file <PATH> |
MINER_AUTH_TOKEN_FILE |
Read the shared secret from a file (preferred) | — |
--tls-cert-sha256 <HEX> |
MINER_TLS_CERT_SHA256 |
SHA-256 of the node's miner TLS cert (miner-tls-cert-sha256 / node logs) |
required |
--tls-cert-sha256-file <PATH> |
MINER_TLS_CERT_SHA256_FILE |
Read the TLS cert fingerprint from a file | — |
--cpu-workers <N> |
MINER_CPU_WORKERS |
Number of CPU worker threads | Auto-detect |
--gpu-devices <N> |
MINER_GPU_DEVICES |
Number of GPU devices | Auto-detect |
--gpu-batch-size <N> |
MINER_GPU_BATCH_SIZE |
GPU batch size in nonces | 1000000 |
--cpu-batch-size <N> |
MINER_CPU_BATCH_SIZE |
CPU batch size in hashes | 10000 |
--gpu-throttle-ms <MS> |
MINER_GPU_THROTTLE_MS |
Sleep duration (ms) between GPU batches | 0 |
--metrics-port <PORT> |
MINER_METRICS_PORT |
Prometheus metrics port | 9900 |
GPU Mining
GPU support uses WGPU for cross-platform acceleration:
- macOS: Metal backend (Apple Silicon & Intel)
- Linux: Vulkan/OpenGL backends
- Windows: DirectX 12/Vulkan backends
Setup
Build with GPU support:
cargo build -p miner-cli --release
Platform requirements:
- macOS: Works out-of-the-box
- Linux: Install GPU drivers (
nvidia-driver,mesa-vulkan-drivers) - Windows: Ensure recent graphics drivers are installed
Performance Monitoring
- macOS:
sudo powermetrics --samplers gpu_power -i 1000 - Linux:
nvidia-smi(NVIDIA) orradeontop(AMD) - Windows: Task Manager GPU tab
Examples
All serve examples need the auth token and TLS pin (files or inline values).
# CPU mining with 8 workers
./target/release/quantus-miner serve \
--auth-token-file /path/to/miner-auth-token \
--tls-cert-sha256-file /path/to/miner-tls-cert-sha256 \
--cpu-workers 8
# Pure GPU mining
./target/release/quantus-miner serve \
--auth-token-file /path/to/miner-auth-token \
--tls-cert-sha256-file /path/to/miner-tls-cert-sha256 \
--gpu-devices 1
# GPU mining with throttle (reduce GPU utilization)
./target/release/quantus-miner serve \
--auth-token-file /path/to/miner-auth-token \
--tls-cert-sha256-file /path/to/miner-tls-cert-sha256 \
--gpu-devices 1 --gpu-throttle-ms 50
# Hybrid mining: 4 CPU + 1 GPU workers
./target/release/quantus-miner serve \
--auth-token-file /path/to/miner-auth-token \
--tls-cert-sha256-file /path/to/miner-tls-cert-sha256 \
--cpu-workers 4 --gpu-devices 1
# With verbose logging
RUST_LOG=debug ./target/release/quantus-miner serve \
--auth-token-file /path/to/miner-auth-token \
--tls-cert-sha256-file /path/to/miner-tls-cert-sha256 \
--cpu-workers 2 --gpu-devices 1
# Production setup with metrics
./target/release/quantus-miner serve \
--node-addr 127.0.0.1:9833 \
--auth-token-file /path/to/miner-auth-token \
--tls-cert-sha256-file /path/to/miner-tls-cert-sha256 \
--cpu-workers 6 \
--gpu-devices 1 \
--metrics-port 9900
Protocol
The miner uses a QUIC-based protocol for communication with the node:
- Transport: QUIC with TLS 1.3 (self-signed certificate, pinned by SHA-256)
- Auth:
Ready { token }must match the node'sminer-auth-token - ALPN:
quantus-miner/2 - Port: 9833 (default)
- Messages:
Ready(miner→node),NewJob(node→miner),JobResult(miner→node)
For full protocol specification, see the node's MINING.md.
Benchmarking
# Benchmark CPU performance
./target/release/quantus-miner benchmark --cpu-workers 8 --duration 30
# Benchmark GPU performance
./target/release/quantus-miner benchmark --gpu-devices 1 --duration 30
# Benchmark hybrid performance
./target/release/quantus-miner benchmark --cpu-workers 4 --gpu-devices 1 --duration 30