diff --git a/ansible/nym-node/playbooks/group_vars/all.yml b/ansible/nym-node/playbooks/group_vars/all.yml index aed33fcce3..ea526db82a 100644 --- a/ansible/nym-node/playbooks/group_vars/all.yml +++ b/ansible/nym-node/playbooks/group_vars/all.yml @@ -1,21 +1,4 @@ --- -ansible_ssh_private_key_file: ~/.ssh/ - -cli_url: "https://github.com/nymtech/nym/releases/download/nym-binaries-{{ nym_version }}/nym-cli" -tunnel_manager_url: "https://github.com/nymtech/nym/raw/refs/heads/develop/scripts/nym-node-setup/network-tunnel-manager.sh" -quic_bridge_deployment_url: "https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/nym-node-setup/quic_bridge_deployment.sh" - -############################################################################### -## GLOBAL VARS -## These values will be used globally unless overwritten per node in inventory/all -############################################################################### - -ansible_user: root # used for ssh, like `ssh root@nym-exit.ch-1.mynodes.net` -email: "" # used in certbot, description.toml and landing page -website: "" # it is used in the description.toml -description: "" # or define per node in inventory/all -# operator_name: "" # used in landing page if provided - ############################################################################### ## GLOBAL VARS ## These values will be used globally unless overwritten per node in inventory/all @@ -23,16 +6,41 @@ description: "" # or define per node in inventory/all ## Per node changes in inventory/all will overwrite these global vars ############################################################################### -# moniker: "" # if not setup here not in inventory/all it get's derived from the hostname -# mode: # entry-gateway/exit-gateway/mixnode -# wireguard_enabled: # true/false -hostname: "" # this is a fallback, keep it and setup hostname per node in inventory/all +## MANDATORY - uncomment & define + +## --SSH-- +#ansible_user: root # used for ssh, like `ssh root@nym-exit.ch-1.mynodes.net` +# ansible_ssh_private_key_file: ~/.ssh/ + +## --Operator info-- +# email: "" # used in certbot, description.toml and landing page +# website: "" # it is used in the description.toml +# description: "" # or define per node in inventory/all +# moniker: "" + +## --Node defaults (can override per node in inventory/all)-- +# accept_operator_terms: true # controls --accept-operator-terms-and-conditions, read: https://nym.com/docs/operators/nodes/nym-node/setup#terms--conditions +# mode: exit-gateway # entry-gateway/exit-gateway/mixnode +# wireguard_enabled: true # true/false +hostname: "" # keep this fallback, keep it and setup hostname per node in inventory/all + +## OPTIONAL - uncomment & define + +# operator_name: "" # used in landing page if provided +# nym_version: "nym-binaries-v2026.7-tola" # to use particular version instead of Latest, provide in such form: + +## alternative SSH key var setting, instead of a hardcoded path +## useful if the playbook is shared in a repo by more admins with each having own local key +# ansible_ssh_private_key_file: "{{ lookup('env', '') }}" ############################################################################### -## GLOBAL PACKAGES +## GLOBAL PACKAGES & URLs ## These will be installed during deployment ############################################################################### +nym_cli_url: "https://github.com/nymtech/nym/releases/download/{{ nym_version }}/nym-cli" +tunnel_manager_url: "https://github.com/nymtech/nym/raw/refs/heads/develop/scripts/nym-node-setup/network-tunnel-manager.sh" +quic_bridge_deployment_url: "https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/nym-node-setup/quic_bridge_deployment.sh" packages: - tmux @@ -50,24 +58,6 @@ packages: - ufw -############################################################################### -## OPTIONAL OVERRIDES -## All values below already have defaults in the playbook/roles -## Uncomment only if you want to override them -############################################################################### - -############################################################################### -## SYSTEM MAINTENANCE PLAYBOOK KNOBS -############################################################################### - -# To use particular version instead of Latest, provide in such form: -# nym_version: "nym-binaries-v2026.7-tola" - -## NOTE: -## if you want to pin Nym to a specific version instead of using the -## latest release from GitHub in /tasks/main.yml then -## uncomment the line above and set the tag - ############################################################################### ## SYSTEM MAINTENANCE PLAYBOOK KNOBS ############################################################################### diff --git a/ansible/nym-node/playbooks/inventory/all b/ansible/nym-node/playbooks/inventory/all index d87beccbc0..e99dde3cf8 100644 --- a/ansible/nym-node/playbooks/inventory/all +++ b/ansible/nym-node/playbooks/inventory/all @@ -1,34 +1,39 @@ [nym_nodes] -# READ CONFIGURATION GUIDE: -# https://nym.com//docs/operators/orchestration/ansible#configuration +## READ CONFIGURATION GUIDE: +## https://nym.com/docs/operators/orchestration/ansible#configuration -# VARIABLES INFO -# required vars to set values per node: -# `ansible_host`, `hostname`, `location` +############## +## TEMPLATE ## +############## +## uncomment and exchange the with your real values for each node without the <> brackets -# global vars can be set in the group_vars/all.yml, for example: -# `email`, `ansible_user`, `moniker`, `description`, `mode`, `wireguard_enabled` -# othersise they must be set per node! - -############ -# TEMPLATE # -############ # node1 ansible_host= ansible_user= hostname= location= email= mode= wireguard_enabled= moniker= description= -# remove all comments and exchange the with your real values for each node -# without <> brackets +#################### +## VARIABLES INFO ## +#################### -# PRIORITY ORDER -# anything setup globaly can be overwritten in this file per node -# if provided here, it takes priority over the global setting +## --REQUIRED VARS-- +## required per node: +## ansible_host, hostname, location -# EXAMPLES -# exit + wireguard gateway: +## --OPTIONAL VARS-- +## can be set in the group_vars/all.yml or per node here: +## email, ansible_user, moniker, description, mode, wireguard_enabled + +## --PRIORITY ORDER-- +## anything setup globaly can be overwritten in this file per node +## if provided here, it takes priority over the global setting + +## --EXAMPLES-- +## exit + wireguard gateway: # node2 ansible_host=11.12.13.14 hostname=nym-exit.ch-1.mydomain.net mode=exit-gateway location=CH wireguard_enabled=true -# entry gateway, no wireguard: +## entry gateway, no wireguard: # node3 ansible_host=12.13.14.15 hostname=nym-entry.ch-2.mydomain.net mode=entry-gateway location=CH wireguard_enabled=false -# NOTE: -# all examples above don't have defined user, email nor description as we use the definition from group_vars/main.yml without an attempt of overwriting it -# all examples above don't have moniker defined as there is a function in /templates/description.toml.j2 deriving it from the hostname +## mixnode (comment out tunnel+quic roles in deploy.yml for these) +# mix-de-1 ansible_host=13.14.15.16 hostname=nym-mix.de-1.example.net location=DE mode=mixnode wireguard_enabled=false + +## NOTE: +## all examples above don't have defined user, email nor description as we use global vars from playbooks/group_vars/all.yml diff --git a/ansible/nym-node/roles/nginx/tasks/main.yml b/ansible/nym-node/roles/nginx/tasks/main.yml index 320431718e..58e293fb98 100644 --- a/ansible/nym-node/roles/nginx/tasks/main.yml +++ b/ansible/nym-node/roles/nginx/tasks/main.yml @@ -89,7 +89,6 @@ loop: - "/etc/nginx/sites-enabled/{{ hostname }}-ssl" - "/etc/nginx/sites-enabled/nym-wss-config" - when: not le_cert.stat.exists notify: Restart nginx - name: Ensure nginx is enabled and running (needed for ACME http-01) @@ -111,18 +110,13 @@ - name: Obtain/renew certificate command: cmd: >- - {% if le_cert.stat.exists %} - certbot certonly --webroot - -w /var/www/{{ hostname }} + certbot certonly --nginx --non-interactive --agree-tos --keep-until-expiring -m {{ email }} -d {{ hostname }} - {% else %} - certbot --nginx - --non-interactive --agree-tos --redirect - -m {{ email }} -d {{ hostname }} - {% endif %} register: certbot_result - failed_when: false + failed_when: false + + # re-check cert after certbot attempt - name: Re-check whether certificate exists after certbot @@ -170,4 +164,4 @@ changed_when: false - name: Flush handlers (apply restart after successful tests) - meta: flush_handlers + meta: flush_handlers \ No newline at end of file diff --git a/ansible/nym-node/roles/nym/defaults/main.yml b/ansible/nym-node/roles/nym/defaults/main.yml index e36f6fc140..fcd1eeb4c0 100644 --- a/ansible/nym-node/roles/nym/defaults/main.yml +++ b/ansible/nym-node/roles/nym/defaults/main.yml @@ -10,7 +10,7 @@ mixnet_bind_address: "0.0.0.0:1789" # maps to --mixnet-bind-address landing_page_assets_base_dir: "/var/www" # Flag toggles -# accept_operator_terms: true # controls --accept-operator-terms-and-conditions +accept_operator_terms: false # override in group_vars or inventory nym_write_flag: true # controls -w nym_init_only_flag: true # controls --init-only wss_port: 9001 # controlls --announce-wss-port @@ -18,7 +18,7 @@ wss_port: 9001 # controlls --announce-wss-port # Optional: extra flags if you want to append more later nym_extra_flags: "" -# CLI URL (nym_version can be set elsewhere / via GitHub API) +# CLI URL nym_cli_url: "https://github.com/nymtech/nym/releases/download/{{ nym_version }}/nym-cli" # UFW diff --git a/documentation/docs/components/outputs/api-scraping-outputs/circulating-supply.json b/documentation/docs/components/outputs/api-scraping-outputs/circulating-supply.json index 4be1f2b19c..b6de748826 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/circulating-supply.json +++ b/documentation/docs/components/outputs/api-scraping-outputs/circulating-supply.json @@ -5,7 +5,7 @@ }, "mixmining_reserve": { "denom": "unym", - "amount": "166613455567357" + "amount": "164623226345363" }, "vesting_tokens": { "denom": "unym", @@ -13,6 +13,6 @@ }, "circulating_supply": { "denom": "unym", - "amount": "833386544432643" + "amount": "835376773654637" } } diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nodes-count.json b/documentation/docs/components/outputs/api-scraping-outputs/nodes-count.json index 98ee11e305..9b221d2a82 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nodes-count.json +++ b/documentation/docs/components/outputs/api-scraping-outputs/nodes-count.json @@ -1,6 +1,6 @@ { "nodes": 682, - "locations": 78, - "mixnodes": 242, - "exit_gateways": 432 + "locations": 76, + "mixnodes": 239, + "exit_gateways": 435 } diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/circulating-supply.md b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/circulating-supply.md index 6f6c094083..42252b8a5e 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/circulating-supply.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/circulating-supply.md @@ -1 +1 @@ -833_386_544 +835_376_773 diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/epoch-reward-budget.md b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/epoch-reward-budget.md index b72f034b0c..519f583689 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/epoch-reward-budget.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/epoch-reward-budget.md @@ -1 +1 @@ -4_628 +4_572 diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/stake-saturation.md b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/stake-saturation.md index 02acf9bc71..435fbd506f 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/stake-saturation.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/stake-saturation.md @@ -1 +1 @@ -254_977 +255_586 diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking-target.md b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking-target.md index c5a32267aa..1b5fa7f459 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking-target.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking-target.md @@ -1 +1 @@ -61_194_673 +61_340_814 diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking_supply.md b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking_supply.md index aa81fc5ba9..1016ec7ef9 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking_supply.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/staking_supply.md @@ -1 +1 @@ -61_194_672 +61_340_813 diff --git a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/token-table.md b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/token-table.md index fdf11e42a6..eafb403911 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/token-table.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/token-table.md @@ -1,7 +1,7 @@ | **Item** | **Description** | **Amount in NYM** | |:-------------------|:------------------------------------------------------|--------------------:| | Total Supply | Maximum amount of NYM token in existence | 1_000_000_000 | -| Mixmining Reserve | Tokens releasing for operators rewards | 166_613_455 | +| Mixmining Reserve | Tokens releasing for operators rewards | 164_623_226 | | Vesting Tokens | Tokens locked outside of circulation for future claim | 0 | -| Circulating Supply | Amount of unlocked tokens | 833_386_544 | -| Stake Saturation | Optimal size of node self-bond + delegation | 254_977 | +| Circulating Supply | Amount of unlocked tokens | 835_376_773 | +| Stake Saturation | Optimal size of node self-bond + delegation | 255_586 | diff --git a/documentation/docs/components/outputs/api-scraping-outputs/reward-params.json b/documentation/docs/components/outputs/api-scraping-outputs/reward-params.json index 9e7ce9741e..40f531502a 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/reward-params.json +++ b/documentation/docs/components/outputs/api-scraping-outputs/reward-params.json @@ -1,10 +1,10 @@ { "interval": { - "reward_pool": "166613455567357.391753168447944888", - "staking_supply": "61194672938727.325886595653401629", + "reward_pool": "164623226345363.285226429762152046", + "staking_supply": "61340813321050.793375219026221616", "staking_supply_scale_factor": "0.07342892", - "epoch_reward_budget": "4628151543.537705326476901331", - "stake_saturation_point": "254977803911.363857860815222506", + "epoch_reward_budget": "4572867398.482313478511937837", + "stake_saturation_point": "255586722171.04497239674594259", "sybil_resistance": "0.3", "active_set_work_factor": "10", "interval_pool_emission": "0.02" diff --git a/documentation/docs/components/outputs/api-scraping-outputs/time-now.md b/documentation/docs/components/outputs/api-scraping-outputs/time-now.md index bab5e7c55f..de9ba936fc 100644 --- a/documentation/docs/components/outputs/api-scraping-outputs/time-now.md +++ b/documentation/docs/components/outputs/api-scraping-outputs/time-now.md @@ -1 +1 @@ -Wednesday, May 27th 2026, 11:42:58 UTC +Thursday, June 4th 2026, 09:20:29 UTC diff --git a/documentation/docs/pages/operators/nodes/preliminary-steps/vps-setup/advanced.mdx b/documentation/docs/pages/operators/nodes/preliminary-steps/vps-setup/advanced.mdx index 9863df4d92..84d3031552 100644 --- a/documentation/docs/pages/operators/nodes/preliminary-steps/vps-setup/advanced.mdx +++ b/documentation/docs/pages/operators/nodes/preliminary-steps/vps-setup/advanced.mdx @@ -291,17 +291,26 @@ KVM network is gone. ##### 3. Setup KVM public bridge for new VMs -To create a KVM network bridge on Ubuntu, edit a config file located in `/etc/netplan/` either called `00-installer.yaml` or `00-installer-config.yaml` and add the bridge details. +To create a KVM network bridge on Ubuntu, edit a config file located in `/etc/netplan/` often called `50-cloud-init.yaml` or `00-installer.yaml` or `00-installer-config.yaml` and add the bridge details. -- Before you edit the file, make a backup to stay on the save side: +- Before you edit the file, make a backup to stay on the save side, the file should be named something like this: ```bash -cp /etc/netplan/00-installer-config.yaml /etc/netplan/00-installer-config.yaml.bak +cp /etc/netplan/50-cloud-init.yaml /etc/netplan/50-cloud-init.yaml.bak # or cp /etc/netplan/00-installer.yaml /etc/netplan/00-installer.yaml.bak +# or +cp /etc/netplan/00-installer-config.yaml /etc/netplan/00-installer-config.yaml.bak ``` -- Open `00-installer-config.yaml` or `00-installer.yaml.`config in a text editor: +- If none of these files existed, simply check the name of your config by this command and apply the same backup logic: +```sh +ls /etc/netplan/ +``` + +- Open the original config in a text editor: ```bash +nano /etc/netplan/50-cloud-init.yaml +# or nano /etc/netplan/00-installer.yaml # or nano /etc/netplan/00-installer-config.yaml @@ -380,12 +389,13 @@ netplan --debug apply ```bash apt install yamllint -y +yamllint /etc/netplan/50-cloud-init.yaml +# or yamllint /etc/netplan/00-installer.yaml # or yamllint /etc/netplan/00-installer-config.yaml - - ``` + - Apply correct permissions: ```bash chmod 600 /etc/netplan/00-installer.yaml @@ -410,9 +420,12 @@ systemctl enable --now systemd-networkd - If things went wrong, you can always revert from the backed up file: ```bash +cp /etc/netplan/50-cloud-init.yaml.bak /etc/netplan/50-cloud-init.yaml +# or cp /etc/netplan/00-installer-config.yaml.bak /etc/netplan/00-installer-config.yaml # or cp /etc/netplan/00-installer.yaml.bak /etc/netplan/00-installer.yaml + # and netplan apply ``` @@ -535,19 +548,50 @@ Using the scripts is a two-step process. First, initialisation part is done from ##### 1. Initialise VM from the host machine - Log in to your host as `root` -- Run this block and follow the prompts carefully: +- Get the script: ```bash wget "https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/kvm-setup/initialise-vm.sh" chmod +x ./initialise-vm.sh -./initialise-vm.sh ``` +- Run this block and follow the prompts carefully or provide with arguments: +```sh +# interactive CLI +./initialise-vm.sh + +# arguments - see --help menu +./initialise-vm.sh --help + +# example +# ./initialise-vm.sh --name ubuntu1 --password topsecretrootpassword --cpus 4 --ram 8192 --size 60 +``` + + ##### 2. Configure VM from within -- After logging into your VM run this block and follow the prompts carefully: +- After logging into your VM, using `login: root` and `password: `, get second script to configure the VM from within: ```bash wget "https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/kvm-setup/configure-vm.sh" chmod +x ./configure-vm.sh +``` + +- Likely your connection won't work and therefore you need to create the script manually, open a text editor: +```sh +nano configure-vm.sh +``` + +- Paste there [this content](https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/kvm-setup/configure-vm.sh) +- Save and exit +- Run this block and follow the prompts carefully, or provide with arguments: + +```sh +# interactive CLI ./configure-vm.sh + +# arguments - see --help menu +./configure-vm.sh --help + +# example +# ./configure-vm.sh --interface enp1s0 --ipv4 192.168.1.100 --gateway4 192.168.1.1 --ipv6 2001:db8::1 --gateway6 2001:db8::fffe ``` diff --git a/documentation/docs/pages/operators/orchestration/ansible.mdx b/documentation/docs/pages/operators/orchestration/ansible.mdx index 8d6016bbd7..791b8cf186 100644 --- a/documentation/docs/pages/operators/orchestration/ansible.mdx +++ b/documentation/docs/pages/operators/orchestration/ansible.mdx @@ -3,6 +3,7 @@ import { Tabs } from 'nextra/components'; import { Steps } from 'nextra/components'; import { RunTabs } from 'components/operators/nodes/node-run-command-tabs'; import { VarInfo } from 'components/variable-info.tsx'; +import { AccordionTemplate } from 'components/accordion-template.tsx'; # Orchestrating Nym Nodes with Ansible @@ -95,14 +96,13 @@ Before starting Ansible, ensure that your `A` and `AAAA` records are pointed to ###### 1. Configure global variables: - Open `playbooks/group_vars/all.yml` -- Setup any variables which you want to have propagated on all your nodes globally +- Define all values under the section labeled as `## MANDATORY - uncomment & define` - these values will be propagated on all your nodes globally +- Optionally define values of your choice under the section `## OPTIONAL - uncomment & define` - Note that in the next step we will be setting up a node inventory, where each of the variable can be configured per node, taking priority over the global ones. -- Setup a correct path for your SSH kety to `ansible_ssh_private_key_file:` -- Use these variables or comment them out with `#`: - - `ansible_user` - - `email` - - `website` - - `description` +- Setup a correct path for your SSH kety to `ansible_ssh_private_key_file:`, alternatively export your SSH key as an env var and use this: +```sh +ansible_ssh_private_key_file: "{{ lookup('env', '') }}" +``` - Keep `hostname=""` as a fallback for nodes without a hostname ###### 2. Create node inventory: @@ -111,11 +111,11 @@ Before starting Ansible, ensure that your `A` and `AAAA` records are pointed to ```sh node1 ansible_host= ansible_user= hostname= location= email= mode= wireguard_enabled= moniker= description= ``` -- These are mandatory values specific for each node - must be defined in the inventory: +- Mandatory values specific for each node - must be defined in the inventory: - `ansible_host`: IPv4 host address - `hostname`: node domain, otherwise fallbacks to `""` for nodes without domain - `location`: node server location -- These are mandatory values which can be setup per node or in `group_vars/all` globally: +- Mandatory values which can be setup per node or in `group_vars/all` globally: - `ansible_user` - `email` - `website` @@ -123,6 +123,7 @@ node1 ansible_host= ansible_user= hostname= loca - `description` - `mode` - `wireguard_enabled` + - `accept_operator_terms` - **Make sure to read [Nym Operators Terms & Conditions](/operators/nodes/nym-node/setup#terms--conditions) first!** ###### 3. Test your setup Run this command to check if everything is configured correctly in your inventory: @@ -131,17 +132,12 @@ cd playbooks ansible-inventory --graph ``` -###### 4. Configure `nym-node run` command arguments +###### 4. Optional: remove some of `nym-node run` command arguments +These variables are read by the main task for `nym-node` installation: `roles/nym/tasks/config.yaml` + Open `roles/nym/defaults/main.yml` and have a look on the variables used: -- If you agree with [Terms and conditions](/operators/nodes/nym-node/setup#terms--conditions) uncomment the line: `accept_operator_terms: true` without which your node can never take part in Nym Network. -- The rest is up to your configuration but generally these flags workflows - -These variables are read by the main task for `nym-node` installation: `roles/nym/tasks/config.yaml` -- Open that yaml and have a look on the flags -- In case of not needing some of the, delete them (ie when running `--mode mixnode` you can delete everything from `--hostname` to `--announce-wss-port`) - -###### 5. Configure `deploy.yml` playbook +###### 5. Optional: Configure `deploy.yml` playbook Open `playbooks/deploy.yml` and comment out `tunnel` and `quic` roles in case of running your playbook for nodes in a mode `mixnode`. Save all the files and test with: @@ -159,11 +155,13 @@ This chapter describes fundamental commands for using Ansible playbooks in relat ### Logic + + The main logic of the playbook flow when running with a basic command and playbook like this: ```sh ansible-playbook .yml ``` - + ###### 1. Read inventory Ansible parses `inventory/all` and performs the playbook on all entries in it, unless specified otherwise @@ -175,7 +173,8 @@ Ansible parses `group_vars/all.yml` and asigns global variables to all inventory ###### 3. Follow roles in the playbook Ansible reads the roles defined in `.yml` passed with the command and executes the tasks defined under each role - + + ### Usage @@ -237,6 +236,17 @@ cd playbooks ansible-playbook system-maintenance.yml ``` +###### 5. Mitigate kernel CVE + +This playbook is to mitigate some of the Kernel issues found in April and May 2026. + +This playbook will run roles on all the inventory entries in parallel by default. + +```sh +cd playbooks +ansible-playbook mitigate_kernel_CVE.yml +``` + @@ -248,7 +258,7 @@ ansible-playbook system-maintenance.yml -###### One node at a time +###### Node limit To test new configuration, it's advised to try it on one server at first. Of course you can comment out any entries in the inventory, but there are easier ways to do it. - Provide flag `-l` followed by inventory entry and Ansible will change state only of that entry: @@ -261,11 +271,14 @@ ansible-playbook upgrade.yml -l node1 # point to multiple entries ansible-playbook upgrade.yml -l "node1,node2" -# use regex +# use regex - ie all exit nodes ansible-playbook upgrade.yml -l "*exit*" + +# use group in inventory labeled as [group] +ansible-playbook deploy.yml -l new_nodes ``` -###### Role limit +###### Tag selection To update your exit policy by using the newest [NTM](https://github.com/nymtech/nym/blob/develop/scripts/nym-node-setup/network-tunnel-manager.sh) via Ansible, just run: diff --git a/scripts/kvm-setup/configure-vm.sh b/scripts/kvm-setup/configure-vm.sh index e1904313d5..8369d8564a 100644 --- a/scripts/kvm-setup/configure-vm.sh +++ b/scripts/kvm-setup/configure-vm.sh @@ -1,36 +1,101 @@ - #!/bin/bash -# detect active network interface -INTERFACE=$(ip -o link show | awk -F': ' '{print $2}' | grep -v lo | head -n 1) +usage() { + local code="${1:-0}" + cat < to specify one manually." + exit 1 + fi +else + echo "Using network interface: $INTERFACE" +fi + +# --- resize partition --- echo "Expanding partition and resizing filesystem..." growpart /dev/vda 1 resize2fs /dev/vda1 df -h -# ask before continuing -read -p "Continue with network configuration? (y/n): " CONTINUE -if [[ "$CONTINUE" != "y" ]]; then +if ! confirm "Continue with network configuration?"; then echo "Exiting." exit 1 fi -# generate Netplan config +# --- generate Netplan config --- NETPLAN_CONFIG="/etc/netplan/01-network-config.yaml" echo "Creating Netplan configuration at $NETPLAN_CONFIG..." @@ -45,28 +110,19 @@ network: addresses: EOF -# append IPv4 address if provided -if [[ -n "$IPv4_VM" ]]; then - echo " - $IPv4_VM/24" >> $NETPLAN_CONFIG -fi +[[ -n "$IPv4_VM" ]] && echo " - $IPv4_VM/24" >> $NETPLAN_CONFIG +[[ -n "$IPv6_VM" ]] && echo " - $IPv6_VM/64" >> $NETPLAN_CONFIG -# append IPv6 address if provided -if [[ -n "$IPv6_VM" ]]; then - echo " - $IPv6_VM/64" >> $NETPLAN_CONFIG -fi - -echo " routes:" >> $NETPLAN_CONFIG - -# append IPv4 route if provided -if [[ -n "$IPv4_GATEWAY_HOST_SERVER" ]]; then - echo " - to: default" >> $NETPLAN_CONFIG - echo " via: $IPv4_GATEWAY_HOST_SERVER" >> $NETPLAN_CONFIG -fi - -# append IPv6 route if provided -if [[ -n "$IPv6_GATEWAY_HOST_SERVER" ]]; then - echo " - to: default" >> $NETPLAN_CONFIG - echo " via: $IPv6_GATEWAY_HOST_SERVER" >> $NETPLAN_CONFIG +if [[ -n "$IPv4_GATEWAY_HOST_SERVER" || -n "$IPv6_GATEWAY_HOST_SERVER" ]]; then + echo " routes:" >> $NETPLAN_CONFIG + if [[ -n "$IPv4_GATEWAY_HOST_SERVER" ]]; then + echo " - to: default" >> $NETPLAN_CONFIG + echo " via: $IPv4_GATEWAY_HOST_SERVER" >> $NETPLAN_CONFIG + fi + if [[ -n "$IPv6_GATEWAY_HOST_SERVER" ]]; then + echo " - to: default" >> $NETPLAN_CONFIG + echo " via: $IPv6_GATEWAY_HOST_SERVER" >> $NETPLAN_CONFIG + fi fi cat <> $NETPLAN_CONFIG @@ -78,58 +134,43 @@ cat <> $NETPLAN_CONFIG - 2001:4860:4860::8888 # Google IPv6 DNS EOF -# secure Netplan config chmod 600 $NETPLAN_CONFIG - -# generate Netplan configuration netplan generate -# ask before applying Netplan -read -p "Apply Netplan changes? (y/n): " CONTINUE -if [[ "$CONTINUE" != "y" ]]; then +if ! confirm "Apply Netplan changes?"; then echo "Exiting." exit 1 fi -# apply Netplan and verify settings netplan --debug apply -# show IP configurations ip -4 a ip -6 a ip -4 r ip -6 r -# test network connectivity echo "Testing IPv4 connectivity for 10 seconds..." timeout 10 ping -4 google.com - echo "Testing IPv6 connectivity for 10 seconds..." timeout 10 ping -6 google.com -# ask before updating system -read -p "Proceed with system update and upgrade? (y/n): " CONTINUE -if [[ "$CONTINUE" != "y" ]]; then - echo "Skipping updates." -else +if confirm "Proceed with system update and upgrade?"; then apt update && apt upgrade -y +else + echo "Skipping updates." fi -# generate SSH host keys without password +# --- SSH setup --- echo "Generating SSH host keys..." -ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N "" -ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -N "" -ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key -N "" +ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N "" +ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -N "" +ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key -N "" ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N "" -# restart SSH service systemctl restart ssh.service -# ensure ~/.ssh directory exists mkdir -p ~/.ssh - -# Open authorized_keys file for user input echo "# Add your admin SSH keys here, save and exit!" > ~/.ssh/authorized_keys nano ~/.ssh/authorized_keys -echo "Setup complete! Try to ping and ssh from the outside before killing this console" +echo "Setup complete! Try to ping and ssh from the outside before killing this console" \ No newline at end of file diff --git a/scripts/kvm-setup/initialise-vm.sh b/scripts/kvm-setup/initialise-vm.sh index f8755d50c1..82fb9f46cb 100644 --- a/scripts/kvm-setup/initialise-vm.sh +++ b/scripts/kvm-setup/initialise-vm.sh @@ -1,6 +1,86 @@ #!/bin/bash -# check if noble-server-cloudimg-amd64.img is in working dir - if not, wget it +usage() { + local code="${1:-0}" + cat <