diff --git a/ansible/nym-node/roles/upgrade/tasks/finalize.yml b/ansible/nym-node/roles/upgrade/tasks/finalize.yml index b17d74dcc5..d9f9f2f1de 100644 --- a/ansible/nym-node/roles/upgrade/tasks/finalize.yml +++ b/ansible/nym-node/roles/upgrade/tasks/finalize.yml @@ -9,7 +9,7 @@ changed_when: false when: not ansible_check_mode -# show the full stdout so we don’t depend on regex parsing at all +# show the full stdout # show full upgraded version output, line by line - name: Show upgraded nym-node version info debug: diff --git a/documentation/docs/components/outputs/api-scraping-outputs/circulating-supply.json b/documentation/docs/components/outputs/api-scraping-outputs/circulating-supply.json index 6cd0631f56..df7471adde 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/circulating-supply.json +++ b/documentation/docs/components/outputs/api-scraping-outputs/circulating-supply.json @@ -5,7 +5,7 @@ }, "mixmining_reserve": { "denom": "unym", - "amount": "176683247613141" + "amount": "174592308324894" }, "vesting_tokens": { "denom": "unym", @@ -13,6 +13,6 @@ }, "circulating_supply": { "denom": "unym", - "amount": "823316752386859" + "amount": "825407691675106" } } diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/circulating-supply.md b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/circulating-supply.md index b2330d4dfd..91ff277f75 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/circulating-supply.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/circulating-supply.md @@ -1 +1 @@ -823_316_752 +825_407_691 diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/epoch-reward-budget.md b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/epoch-reward-budget.md index aa997f052d..5ef2576ddb 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/epoch-reward-budget.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/epoch-reward-budget.md @@ -1 +1 @@ -4_907 +4_849 diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/nyx-percent-stake.md b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/nyx-percent-stake.md index 858227b92a..3381dfa5c0 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/nyx-percent-stake.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/nyx-percent-stake.md @@ -1 +1 @@ -0.79% +0.83% diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/nyx-total-stake.md b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/nyx-total-stake.md index 6c69256b94..3926dee04e 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/nyx-total-stake.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/nyx-total-stake.md @@ -1 +1 @@ -36.446 +34.648 diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/stake-saturation.md b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/stake-saturation.md index 7decf6145b..24d0944fa1 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/stake-saturation.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/stake-saturation.md @@ -1 +1 @@ -251_896 +252_536 diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking-target.md b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking-target.md index 2edf9806e9..ffd684c3fa 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking-target.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking-target.md @@ -1 +1 @@ -60_455_259 +60_608_795 diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking_supply.md b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking_supply.md index 2672e8287c..555068ef86 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking_supply.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking_supply.md @@ -1 +1 @@ -60_455_258 +60_608_794 diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/token-table.md b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/token-table.md index 3fc10952b3..c81a077a17 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/token-table.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/token-table.md @@ -1,7 +1,7 @@ | **Item** | **Description** | **Amount in NYM** | |:-------------------|:------------------------------------------------------|--------------------:| | Total Supply | Maximum amount of NYM token in existence | 1_000_000_000 | -| Mixmining Reserve | Tokens releasing for operators rewards | 176_683_247 | +| Mixmining Reserve | Tokens releasing for operators rewards | 174_592_308 | | Vesting Tokens | Tokens locked outside of cicrulation for future claim | 0 | -| Circulating Supply | Amount of unlocked tokens | 823_316_752 | -| Stake Saturation | Optimal size of node self-bond + delegation | 251_896 | +| Circulating Supply | Amount of unlocked tokens | 825_407_691 | +| Stake Saturation | Optimal size of node self-bond + delegation | 252_536 | diff --git a/documentation/docs/components/outputs/api-scraping-outputs/reward-params.json b/documentation/docs/components/outputs/api-scraping-outputs/reward-params.json index 60ce01133f..ae0a8aa8aa 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/reward-params.json +++ b/documentation/docs/components/outputs/api-scraping-outputs/reward-params.json @@ -1,10 +1,10 @@ { "interval": { - "reward_pool": "176683247613141.489518623753339272", - "staking_supply": "60455258984180.809034503857018251", + "reward_pool": "174592308324894.719164125613282609", + "staking_supply": "60608794397902.33807512267258462", "staking_supply_scale_factor": "0.07342892", - "epoch_reward_budget": "4907867989.25393026440621537", - "stake_saturation_point": "251896912434.086704310432737576", + "epoch_reward_budget": "4849786342.358186643447933702", + "stake_saturation_point": "252536643324.593075313011135769", "sybil_resistance": "0.3", "active_set_work_factor": "10", "interval_pool_emission": "0.02" diff --git a/documentation/docs/components/outputs/api-scraping-outputs/time-now.md b/documentation/docs/components/outputs/api-scraping-outputs/time-now.md index 20c7a9e2bd..edf8f1ed5d 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/time-now.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/time-now.md @@ -1 +1 @@ -Thursday, December 11th 2025, 11:24:33 UTC +Thursday, January 15th 2026, 09:44:55 UTC diff --git a/documentation/docs/pages/operators/changelog.mdx b/documentation/docs/pages/operators/changelog.mdx index 14de12d6ec..1f7b4b690b 100644 --- a/documentation/docs/pages/operators/changelog.mdx +++ b/documentation/docs/pages/operators/changelog.mdx @@ -49,6 +49,95 @@ This page displays a full list of all the changes during our release cycle from +## `v2026.1-niolo` + +- [Release Binaries](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2026.1-niolo) +- [`nym-node`](nodes/nym-node.mdx) version `1.23.0` + +```sh +nym-node +Binary Name: nym-node +Build Timestamp: 2025-12-02T16:21:03.251191389Z +Build Version: 1.23.0 +Commit SHA: 46fe1bc8191f42aa27f34743c96e9e9f26453d87 +Commit Date: 2025-12-02T15:29:30.000000000Z +Commit Branch: release/2025.22-niolo +rustc Version: 1.91.1 +rustc Channel: stable +cargo Profile: release +``` + +### Operators Updates & Tools + +We’re excited to announce the first **nym-node release of 2026**. + +**Exit Policy Ports Management** + +In December 2025, two NIP proposals were approved, introducing new ports to Nym network: [NIP-6](https://governator.nym.com/proposal/prop-ba886b9d-6f6e-4365-b4ed-fe7e604bc375), opening ports for WhatsApp and Session + Port `465` and [NIP-4](https://governator.nym.com/proposal/prop-ca6726ea-38b1-4568-97fe-8bdc5fdc83a0), opening port `587`. + +**Due to the concerns raised by the operators we built a rate limiting function to Network tunnel manager (NTM) to prevent spam abuse of the network. You can see the changes [here](https://github.com/nymtech/nym/pull/6317).** + +To implement the changes and ensure that the nodes have expected performance, please re-run NTM following these steps: + + +###### 1. Get the new NTM +- Download the updated NTM and make executable +```sh +curl -L https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/nym-node-setup/network-tunnel-manager.sh -o ./network-tunnel-manager.sh && \ +chmod +x network-tunnel-manager.sh +``` + +###### 2. Update exit policy +- To be sure that your routing is clean, run this command: +```sh +./network-tunnel-manager.sh complete_networking_configuration +``` + + +**Node Orchestration** + +Nym network scaling is done mostly by squads, organizations, DAOs and other entities of collaborating operators administrating multiple nodes. To improve efficiency, user experience and cost we added a new menu item [*Orchestration*](/operators/orchestration) where you can find step by step guides to: + +- [Virtualise server using KVM](/operators/nodes/preliminary-steps/vps-setup/advanced): Creating VMs with desired size, bandwidth and capacity for lower cost in comparison to renting VPS +- [Ansible guide](/operators/orchestration/ansible): Orchestrating many nodes effectively using the [Ansible template](https://github.com/nymtech/nym/tree/develop/ansible/nym-node) + +Please, let us know how that worked for you. + +### Features + +- [Merge intermediate upgrade mode changes](https://github.com/nymtech/nym/pull/6174): This PR contains a long changelog on itself, please read the full [in the PR description](https://github.com/nymtech/nym/pull/6174) + +- [Config migration](https://github.com/nymtech/nym/pull/6259) + +- [Statistics API v2](https://github.com/nymtech/nym/pull/6227): This PRs adds a v2 of the `VpnClientSessionReport` and update the stats API to be able to store it + +- [Update chain registry link](https://github.com/nymtech/nym/pull/6219) + + +### Bugfix + +- [Re-exposed 'derive_extended_private_key'](https://github.com/nymtech/nym/pull/6247) + +- [`gateway-probe` fixes for run-local](https://github.com/nymtech/nym/pull/6212) + +- [Upgrade mode: VPN adjustments](https://github.com/nymtech/nym/pull/6189): This PR further builds up on [\#6174](https://github.com/nymtech/nym/pull/6174) to include changes required by the VPN-client to fully support the upgrade mode, what is relevant here is that this PR modifies the credential storage to allow it to storage an opaque `emergency credential` that lets it be shared between sessions (if it is still valid) ] + +- [Add weighted scoring to NS API](https://github.com/nymtech/nym/pull/6144) + +### Refactors & Maintenance + +- [Remove run DKG migration](https://github.com/nymtech/nym/pull/6253) + +- [Do not re-derive wallet keys on every tx](https://github.com/nymtech/nym/pull/6213): The `cosmrs' trait bounds on `EcdsaSigner` got updated to include `Send` and `Sync`, meaning we no longer need to derive private keys on every transaction and instead we can just do it once, on construction + +- [Remove support for legacy mixnode within the performance contract](https://github.com/nymtech/nym/pull/6205): The network no longer supports those nodes, there's no point in having the "brand new" (kinda) contract support them either + + + + +
+ + ## Last Update of 2025 We are not going to do a platform release this year anymore, but we have two important updates to share. @@ -2750,6 +2839,7 @@ Config changes: To allow reading through older changelogs, we store them below sorted by years. +
@@ -4444,7 +4534,7 @@ done - Top routing score now includes: - Wireguard registration and complete handshake test, to configure see [tasklist below](#operators-tasks) - DNS resolution check, to configure see [tasklist below](#operators-tasks) - - Wireguard perfomance bigger than 0.75, to configure see [tasklist below](#operators-tasks) + - Wireguard performance bigger than 0.75, to configure see [tasklist below](#operators-tasks) - New [Nym Wallet](https://github.com/nymtech/nym/releases/tag/nym-wallet-v1.2.14) is out! - Vesting contract functionalities have been purged, users can only remove tokens from vesting diff --git a/documentation/docs/pages/operators/nodes/nym-node/setup.mdx b/documentation/docs/pages/operators/nodes/nym-node/setup.mdx index 36e415e78a..59d401496f 100644 --- a/documentation/docs/pages/operators/nodes/nym-node/setup.mdx +++ b/documentation/docs/pages/operators/nodes/nym-node/setup.mdx @@ -21,16 +21,17 @@ This documentation page provides a guide on how to set up and run a [NYM NODE](. ```sh nym-node Binary Name: nym-node -Build Timestamp: 2025-11-25T14:26:29.627763948Z -Build Version: 1.22.0 -Commit SHA: 22793bc45ea21561671d6670497ff42bc36b9d76 -Commit Date: 2025-11-25T15:16:42.000000000+01:00 -Commit Branch: HEAD -rustc Version: 1.88.0 +Build Timestamp: 2025-12-02T16:21:03.251191389Z +Build Version: 1.23.0 +Commit SHA: 46fe1bc8191f42aa27f34743c96e9e9f26453d87 +Commit Date: 2025-12-02T15:29:30.000000000Z +Commit Branch: release/2025.22-niolo +rustc Version: 1.91.1 rustc Channel: stable cargo Profile: release ``` + Detailed version archive and release notes is documented [here](../../changelog.mdx). {/* COMMENTING THIS OUT ASS WE HAVE TO FIGURE OUT HOW TO SHOW THE LATEST VERSION FROM MASTER BRANCH diff --git a/documentation/docs/pages/operators/nodes/preliminary-steps/wallet-preparation.mdx b/documentation/docs/pages/operators/nodes/preliminary-steps/wallet-preparation.mdx index 8f9f9e312a..be5845e983 100644 --- a/documentation/docs/pages/operators/nodes/preliminary-steps/wallet-preparation.mdx +++ b/documentation/docs/pages/operators/nodes/preliminary-steps/wallet-preparation.mdx @@ -11,7 +11,13 @@ If pre-compiled binaries for your operating system aren't available, you can bui If you don't already have one, please create a Nym address using the wallet, and fund it with NYM tokens. The minimum amount required to bond a node is 100 `NYM`, but make sure you have a bit more to account for gas costs. -`NYM` can be purchased via [Bity](https://bity.com) from the wallet itself with BTC or fiat, and is currently present on several [exchanges](https://www.coingecko.com/en/coins/nym#markets). +`NYM` can be swapped in these places: + +- [SpectreDAO Swap](https://explorer.nym.spectredao.net/swap) (1000+ tokens supported) +- [Binance bridge](https://bridge.nym.com/) +- [ERC20 bridge](https://swapper.nym.com/swap) - follow [this guide](https://nym.com/blog/nym-for-nym-swapper-app-bridges-native-and-erc20-token) + +`NYM` can be also bought on several [exchanges](https://www.coingecko.com/en/coins/nym#markets). > Remember that you can **only** use Cosmos `NYM` tokens to bond your node. You **cannot** use ERC20 representations of `NYM` to run a node. diff --git a/scripts/nym-node-setup/network-tunnel-manager.sh b/scripts/nym-node-setup/network-tunnel-manager.sh index 9d6826f6cc..a901d5be3c 100755 --- a/scripts/nym-node-setup/network-tunnel-manager.sh +++ b/scripts/nym-node-setup/network-tunnel-manager.sh @@ -487,6 +487,25 @@ configure_dns_and_icmp_wg() { ok "dns and icmp configuration completed" } +apply_smtps_465_rate_limit() { + info "adding SMTPS tcp/465 rules with rate limiting to ${NYM_CHAIN}" + + # IPv4 + iptables -A "$NYM_CHAIN" -p tcp --dport 465 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + iptables -A "$NYM_CHAIN" -p tcp --dport 465 -m conntrack --ctstate NEW -m hashlimit \ + --hashlimit-upto 30/min --hashlimit-burst 60 --hashlimit-mode srcip --hashlimit-name smtps465v4 -j ACCEPT + iptables -A "$NYM_CHAIN" -p tcp --dport 465 -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset + + # IPv6 + ip6tables -A "$NYM_CHAIN" -p tcp --dport 465 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + ip6tables -A "$NYM_CHAIN" -p tcp --dport 465 -m conntrack --ctstate NEW -m hashlimit \ + --hashlimit-upto 30/min --hashlimit-burst 60 --hashlimit-mode srcip --hashlimit-name smtps465v6 -j ACCEPT + ip6tables -A "$NYM_CHAIN" -p tcp --dport 465 -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset + + ok "SMTPS tcp/465 installed: NEW <= 30/min burst 60 per srcip; overflow rejected; ESTABLISHED allowed" +} + + ############################################################################### # part 2: wireguard exit policy manager ############################################################################### @@ -527,6 +546,7 @@ exit_policy_install_deps() { create_nym_chain() { info "creating nym exit policy chain $NYM_CHAIN" + # create/flush chain if iptables -S "$NYM_CHAIN" >/dev/null 2>&1; then iptables -F "$NYM_CHAIN" else @@ -539,15 +559,25 @@ create_nym_chain() { ip6tables -N "$NYM_CHAIN" fi - if ! iptables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j "$NYM_CHAIN" 2>/dev/null; then - iptables -I FORWARD 1 -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j "$NYM_CHAIN" - fi + # remove *all* FORWARD -> NYM-EXIT jumps + while read -r rule; do + spec="${rule#-A FORWARD }" + iptables -D FORWARD $spec 2>/dev/null || true + done < <(iptables -S FORWARD | grep -F " -j $NYM_CHAIN" || true) - if ! ip6tables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j "$NYM_CHAIN" 2>/dev/null; then - ip6tables -I FORWARD 1 -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j "$NYM_CHAIN" - fi + while read -r rule; do + spec="${rule#-A FORWARD }" + ip6tables -D FORWARD $spec 2>/dev/null || true + done < <(ip6tables -S FORWARD | grep -F " -j $NYM_CHAIN" || true) + + # add the single correct hook + iptables -I FORWARD 1 -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j "$NYM_CHAIN" + ip6tables -I FORWARD 1 -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j "$NYM_CHAIN" + + ok "NYM-EXIT chain ready + single FORWARD hook installed" } + setup_nat_rules() { info "setting up nat and forwarding rules for $WG_INTERFACE via $NETWORK_DEVICE" @@ -616,6 +646,8 @@ apply_port_allowlist() { ["HTTPS"]="443" ["SMBWindowsFileShare"]="445" ["Kpasswd"]="464" + # this port is opened and rate limited in apply_smtps_465_rate_limit + # ["SMTP"]="465" ["RTSP"]="554" ["SMTPSubmission"]="587" ["LDAPS"]="636" @@ -1178,6 +1210,7 @@ exit_policy_install() { create_nym_chain setup_nat_rules apply_port_allowlist + apply_smtps_465_rate_limit apply_spamhaus_blocklist add_default_reject_rule save_iptables_rules