yorickdowne

Overview

I was looking after a Dell PowerEdge R420 server with a hardware RAID card in it, a PERC8 H710P Mini. Connected to this were two WD Blue 3D NAND SATA SSDs in RAID-1, that were handling a write-intensive database: Geth, in this case.

After 11 months of running without problems, I had reason to "resync" Geth, and the server could not keep up with the required IOPS. Symptoms were Database compacting, degraded performance messages for hours, without recovery, and read/write latency in excess of 20/70ms, as measured by sudo iostat -mdx and its r_await and w_await data.

The cause of this was that the RAID controller does not support TRIM on the SSD, and the SSD's performance degraded over time because of it.

yorickdowne

eth-docker informal specification

User behavior and threat model

A typical user of eth-docker is someone who wants to become a validator on the Ethereum network, also known as staking or staker, or someone who is already a validator on the Ethereum network and wants to add more validators to their setup. They can be someone who is going to setup their machine at home, someone who is going to use some kind of VPS to host their setup, or some kind of institutional staker working for large staking services or large investors.

eth-docker is an automation wrapper to run an "Ethereum node", consisting of a consensus layer client, execution layer client, and validator client.

yorickdowne

Eh?

So a FOSS project might have signed releases with a GPG sig. How do you verify it on a Linux machine?

Example sigp/lighthouse, but same idea for any project.

Install gpg: sudo apt install gpg

Grab their PGP key ID from their download page and gpg --keyserver pgp.mit.edu --recv THEIRKEYID and wait

yorickdowne

#! /bin/bash
 
# http://linuxcommand.org/wss0150.php
function error_exit
{
  echo "$1" 1>&2
  exit 1
} 

# http://unix.stackexchange.com/questions/70859/why-doesnt-sudo-su-in-a-shell-script-run-the-rest-of-the-script-as-root 

yorickdowne

Overview

Geth, and other execution clients such as Erigon, Nethermind, and Besu, take some time on shutdown to cleanly close their database. When not given that time, they will need to resync upon restart, often for hours. This gist describes the systemd service file parameter to give them up to 5 minutes of time for a clean shutdown.

Steps

• Find your service file. It may be called /etc/systemd/system/geth.service or /etc/systemd/system/eth1.service.
• Edit it using sudo nano FILENAME, and add TimeoutStopSec=300 to the [Service] section. Here is an example of a service file after the change:

yorickdowne

Overview

Geth 1.10.23 fixes a bug in 1.10.22, which would have resulted in missing state in its database. The Go-Ethereum team recommends to roll the chain back and let Geth catch up again, if and only if you had updated to 1.10.22. If you did not, just update to 1.10.23 now and call it done.

This is how to roll back to a previous block when using eth-docker.

Update Geth to 1.10.23

./ethd update and ./ethd up should do it.

yorickdowne

Overview

Running on netcup is not much different from running on any other Linux host. The main difference is that the host is directly exposed to the Internet, and that it is provisioned with Debian, not Ubuntu, to begin with.

Install Ubuntu

In netcup's customer control panel, Overview, click on "SCP Auto-Login". This gets you into their Server Control Panel.

In netcup's server control panel, choose Media on the left, and the Images tab. Select the Ubuntu 20.04 image and install it, partitioning the whole disk. The "SCP password" being asked for here is the password for the Server Control Panel, which you received in a welcome email when first signing up with netcup.

yorickdowne

These instructions have moved.

yorickdowne

#! /bin/bash
 
# http://linuxcommand.org/wss0150.php
function error_exit
{
	echo "$1" 1>&2
	exit 1
} 

# http://unix.stackexchange.com/questions/70859/why-doesnt-sudo-su-in-a-shell-script-run-the-rest-of-the-script-as-root 

yorickdowne

/u/settleddown posted some excellent instructions on how to create your own BloxStaking KeyVault instance in AWS and keep it updated yourself.

I've adjusted these instructions to "take over" the existing instance, without needing to spin up an entirely new one. The Python script now prompts the user for the password.

NB: pip3 is very slow on WSL2. This can be resolved by running pip3 install -U keyring, and then mkdir -p ~/.config/python_keyring/ and edit vi ~/.config/python_keyring/keyringrc.cfg and paste into it:

[backend]
default-keyring=keyring.backends.null.Keyring