Rob Thijssen
e3dfd73f2f
Node on bob, external GPU miner on benjy, split because --miner-listen-port disables the node's built-in CPU mining. The PoW is Poseidon2 over Goldilocks: register-resident, no memory hardness, dominated by 64-bit modular multiplication. Measured on the fleet, GPU beats CPU by ~200x (RTX 5090 368 MH/s @ 600W, RTX 4090 183 MH/s @ 450W, Ryzen 9 9950X3D 4.15 MH/s), so CPU mining is disabled everywhere including on the GPU hosts. The workflow deploys or validates. Validate mode asserts the hash counter is advancing and the GPU is drawing power, because a miner that enumerated no adapter and a node authoring nothing both look healthy to systemctl is-active. infra-setup.sh provisions the scoped gitea_ci accounts, generates the node's libp2p key (the node refuses to start without one and it must never be rotated by a deploy), and derives the reward preimage from a seed phrase on stdin. It deliberately will not mint a fresh wallet: that phrase is escalation-grade and fails agent-credentials.md §1.
75 lines
2.2 KiB
Desktop File
75 lines
2.2 KiB
Desktop File
# Quantus Planck node, validator role, external-miner mode.
|
|
#
|
|
# Hardened per ~/git/architecture/generic.md §8. Two knobs are deliberately
|
|
# relaxed; both are load-bearing, do not "tidy" them back:
|
|
#
|
|
# MemoryDenyWriteExecute=false
|
|
# Substrate JITs the on-chain wasm runtime through wasmtime and needs W|X
|
|
# pages. With this true the node aborts during block import.
|
|
#
|
|
# Type=simple (not notify)
|
|
# quantus-node does not sd_notify(READY=1). Type=notify would block
|
|
# `systemctl restart` until TimeoutStartSec expires
|
|
# (deployment-gitea-actions.md §6).
|
|
#
|
|
# The reward preimage arrives via EnvironmentFile because the node exposes no
|
|
# environment-variable form for any flag (`--help` carries no `[env:]`
|
|
# annotations), so it must be a CLI argument. The EnvironmentFile keeps it out
|
|
# of this world-readable unit; it is still visible in `ps` to a local user on
|
|
# the host, which is accepted on a single-tenant box.
|
|
|
|
[Unit]
|
|
Description=Quantus node (Planck, validator, external-miner mode)
|
|
Documentation=https://github.com/Quantus-Network/chain
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=quantus-node
|
|
Group=quantus-node
|
|
Environment=RUST_LOG=info
|
|
EnvironmentFile=/etc/quantus-node/node.env
|
|
WorkingDirectory=/var/lib/quantus-node
|
|
|
|
ExecStart=/usr/local/bin/quantus-node \
|
|
--validator \
|
|
--chain planck \
|
|
--name %H \
|
|
--base-path /var/lib/quantus-node \
|
|
--node-key-file /var/lib/quantus-node/node_key.p2p \
|
|
--rewards-inner-hash ${QUANTUS_INNER_HASH} \
|
|
--miner-listen-port 9833 \
|
|
--port 30333 \
|
|
--prometheus-port 9615 \
|
|
--max-blocks-per-request 64 \
|
|
--sync full
|
|
|
|
Restart=always
|
|
RestartSec=10s
|
|
# RocksDB needs time to flush cleanly; a SIGKILL mid-compaction means a slow
|
|
# (or corrupt) recovery on next start.
|
|
TimeoutStopSec=300
|
|
KillSignal=SIGINT
|
|
LimitNOFILE=65536
|
|
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
LockPersonality=true
|
|
SystemCallArchitectures=native
|
|
MemoryDenyWriteExecute=false
|
|
|
|
ReadWritePaths=/var/lib/quantus-node
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|