Simplify pub key translatations

* bootstrap next app + add overview page

* fix AssetList type

* fix up nav stuff

* Refactor Nav component and add network components pages

* Refactor WorldMap component and update TelegramIcon, GitHubIcon, NymVpnIcon, DiscordIcon, and TwitterIcon components

* add service providers page

* mixnodes page

* delegations page + use material react table for all tables

* nodes map page

* Refactor StyledLink component and remove unnecessary console.log statements

* Refactor ESLint configuration, remove unused dependencies, and update component imports

* update deps

* Refactor imports and update dependencies

* fix dark mode

* build single mixnode page

* build single gateway page

* Refactor handleOnDelegate function to use useCallback in mixnodes page.tsx

* Add defaults for constants

---------

Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com>

.github/workflows/cd-docs.yml

@@ -9,7 +9,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler
+        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git
       - name: Install rsync
         run: sudo apt-get install rsync
       - uses: rlespinasse/github-slug-action@v3.x
@@ -30,9 +30,24 @@ jobs:
       - name: Remove existing Nym config directory (`~/.nym/`)
         run: cd documentation && ./remove_existing_config.sh
         continue-on-error: false
-      - name: Build all projects in documentation/ & move to ~/dist/docs/
+# This is the original flow
+#      - name: Build all projects in documentation/ & move to ~/dist/docs/
+#        run: cd documentation && ./build_all_to_dist.sh
+
+# This is a workaround replacement which builds on the last working commit b332a6b55668f60988e36961f3f62a794ba82ddb and then on current branch
+      - name: Save current branch to ~/current_branch
+        run: git rev-parse --abbrev-ref HEAD > ~/current_branch
+      - name: Git pull & switch to b332a6b55668f60988e36961f3f62a794ba82ddb
+        run: git pull && git checkout b332a6b55668f60988e36961f3f62a794ba82ddb
+      - name: Build all projects in documentation/ & move to ~/dist/docs/ from b332a6b55668f60988e36961f3f62a794ba82ddb
         run: cd documentation && ./build_all_to_dist.sh
-        continue-on-error: false
+
+      - name: Switch to current branch
+        run: git checkout $echo "$(cat ~/current_branch)"
+      - name: Build all projects in documentation/ & move to ~/dist/docs/ on current branch
+        run: cd documentation && ./build_all_to_dist.sh && rm ~/current_branch
+
+# End of replacemet
 
       - name: Post process
         run: cd documentation && ./post_process.sh

.github/workflows/ci-docs.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler
+        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git
       - name: Install rsync
         run: sudo apt-get install rsync
       - uses: rlespinasse/github-slug-action@v3.x
@@ -34,9 +34,25 @@ jobs:
       - name: Remove existing Nym config directory (`~/.nym/`)
         run: cd documentation && ./remove_existing_config.sh
         continue-on-error: false
-      - name: Build all projects in documentation/ & move to ~/dist/docs/
+
+# This is the original flow
+#      - name: Build all projects in documentation/ & move to ~/dist/docs/
+#        run: cd documentation && ./build_all_to_dist.sh
+
+# This is a workaround replacement which builds on the last working commit b332a6b55668f60988e36961f3f62a794ba82ddb and then on current branch
+      - name: Save current branch to ~/current_branch
+        run: git rev-parse --abbrev-ref HEAD > ~/current_branch
+      - name: Git pull & switch to b332a6b55668f60988e36961f3f62a794ba82ddb
+        run: git pull && git checkout b332a6b55668f60988e36961f3f62a794ba82ddb
+      - name: Build all projects in documentation/ & move to ~/dist/docs/ from b332a6b55668f60988e36961f3f62a794ba82ddb
         run: cd documentation && ./build_all_to_dist.sh
-        continue-on-error: false
+
+      - name: Switch to current branch
+        run: git checkout $echo "$(cat ~/current_branch)"
+      - name: Build all projects in documentation/ & move to ~/dist/docs/ on current branch
+        run: cd documentation && ./build_all_to_dist.sh && rm ~/current_branch
+
+# End of replacemet
 
       - name: Deploy branch to CI www
         continue-on-error: true

.github/workflows/publish-nym-binaries.yml

@@ -30,6 +30,7 @@ jobs:
       mixnode_hash: ${{ steps.binary-hashes.outputs.mixnode_hash }}
       gateway_hash: ${{ steps.binary-hashes.outputs.gateway_hash }}
       nymvisor_hash: ${{ steps.binary-hashes.outputs.nymvisor_hash }}
+      nymnode_hash: ${{ steps.binary-hashes.outputs.nymnode_hash }}
       socks5_hash: ${{ steps.binary-hashes.outputs.socks5_hash }}
       netreq_hash: ${{ steps.binary-hashes.outputs.netreq_hash }}
       cli_hash: ${{ steps.binary-hashes.outputs.cli_hash }}
@@ -38,6 +39,7 @@ jobs:
       mixnode_version: ${{ steps.binary-versions.outputs.mixnode_version }}
       gateway_version: ${{ steps.binary-versions.outputs.gateway_version }}
       nymvisor_version: ${{ steps.binary-versions.outputs.nymvisor_version }}
+      nymnode_version: ${{ steps.binary-versions.outputs.nymnode_version }}
       socks5_version: ${{ steps.binary-versions.outputs.socks5_version }}
       netreq_version: ${{ steps.binary-versions.outputs.netreq_version }}
       cli_version: ${{ steps.binary-versions.outputs.cli_version }}
@@ -81,6 +83,7 @@ jobs:
             target/release/nym-network-statistics
             target/release/nym-cli
             target/release/nymvisor
+            target/release/nym-node
           retention-days: 30
 
       - id: create-release
@@ -99,6 +102,7 @@ jobs:
             target/release/nym-network-statistics
             target/release/nym-cli
             target/release/nymvisor
+            target/release/nym-node
 
   push-release-data-client:
     if: ${{ (startsWith(github.ref, 'refs/tags/nym-binaries-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}

.github/workflows/publish-nym-wallet-macos.yml

@@ -102,6 +102,18 @@ jobs:
             nym-wallet/target/release/bundle/dmg/*.dmg
             nym-wallet/target/release/bundle/macos/*.app.tar.gz*
 
+      - name: Deploy artifacts to CI www
+        continue-on-error: true
+        uses: easingthemes/ssh-deploy@main
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
+          ARGS: "-avzr"
+          SOURCE: "nym-wallet/target/release/bundle/macos/nym-wallet.app.tar.gz"
+          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
+          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
+          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/builds/${{ github.ref_name }}/nym-wallet
+          EXCLUDE: "/dist/, /node_modules/"            
+
   push-release-data:
     if: ${{ (startsWith(github.ref, 'refs/tags/nym-wallet-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
     uses: ./.github/workflows/release-calculate-hash.yml

.github/workflows/publish-nym-wallet-ubuntu.yml

@@ -77,6 +77,18 @@ jobs:
             nym-wallet/target/release/bundle/appimage/*.AppImage
             nym-wallet/target/release/bundle/appimage/*.AppImage.tar.gz*
 
+      - name: Deploy artifacts to CI www
+        continue-on-error: true
+        uses: easingthemes/ssh-deploy@main
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
+          ARGS: "-avzr"
+          SOURCE: "nym-wallet/target/release/bundle/appimage/nym-wallet*.AppImage.tar.gz"
+          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
+          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
+          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/builds/${{ github.ref_name }}/nym-wallet
+          EXCLUDE: "/dist/, /node_modules/"               
+
   push-release-data:
     if: ${{ (startsWith(github.ref, 'refs/tags/nym-wallet-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
     uses: ./.github/workflows/release-calculate-hash.yml

.github/workflows/publish-nym-wallet-win10.yml

@@ -97,6 +97,18 @@ jobs:
             nym-wallet/target/release/bundle/msi/*.msi
             nym-wallet/target/release/bundle/msi/*.msi.zip*
 
+      - name: Deploy artifacts to CI www
+        continue-on-error: true
+        uses: easingthemes/ssh-deploy@main
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
+          ARGS: "-avzr"
+          SOURCE: "nym-wallet/target/release/bundle/msi/nym-wallet_1.*.msi"
+          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
+          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
+          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/builds/${{ github.ref_name }}/nym-wallet
+          EXCLUDE: "/dist/, /node_modules/"            
+
   push-release-data:
     if: ${{ (startsWith(github.ref, 'refs/tags/nym-wallet-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
     uses: ./.github/workflows/release-calculate-hash.yml

CHANGELOG.md

@@ -4,6 +4,30 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2024.4-nutella] (2024-05-08)
+
+- [fix] apply disable_poisson_rate from internal NR/IPR cfgs ([#4579])
+- updating sign commands to include nym-node ([#4578])
+- changed nym-node redirects from 308 'Permanent Redirect' to 303: 'See Other' ([#4572])
+
+[#4579]: https://github.com/nymtech/nym/pull/4579
+[#4578]: https://github.com/nymtech/nym/pull/4578
+[#4572]: https://github.com/nymtech/nym/pull/4572
+
+## [2024.3-eclipse] (2024-04-22)
+
+- Initial release of the first iteration of the Nym Node
+- Improvements to gateway functionality
+- IPR development
+- Removal of allow list in favour of implementing an exit policy
+- Explorer delegation: enables direct delegation to nodes via the Nym Explorer
+
+
+## [2024.2-fast-and-furious] (2024-03-25)
+
+- Internal testing pre-release 
+
+
 ## [2024.1-marabou] (2024-02-15)
 
 **New Features:**

Cargo.toml

@@ -122,7 +122,6 @@ members = [
     #    "wasm/full-nym-wasm",
     "wasm/mix-fetch",
     "wasm/node-tester",
-    "wasm/credentials"
 ]
 
 default-members = [
@@ -161,7 +160,8 @@ license = "Apache-2.0"
 [workspace.dependencies]
 anyhow = "1.0.71"
 async-trait = "0.1.68"
-axum = "0.6.20"
+axum = "0.7.5"
+axum-extra = "0.9.3"
 base64 = "0.21.4"
 bs58 = "0.5.0"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
@@ -172,15 +172,16 @@ dotenvy = "0.15.6"
 futures = "0.3.28"
 generic-array = "0.14.7"
 getrandom = "0.2.10"
+headers = "0.4.0"
 humantime-serde = "1.1.1"
-hyper = "0.14.27"
+hyper = "1.3.1"
 k256 = "0.13"
 lazy_static = "1.4.0"
 log = "0.4"
 once_cell = "1.7.2"
 parking_lot = "0.12.1"
 rand = "0.8.5"
-reqwest = { version = "0.11.22", default-features = false }
+reqwest = { version = "0.12.4", default-features = false }
 schemars = "0.8.1"
 serde = "1.0.152"
 serde_json = "1.0.91"
@@ -194,8 +195,8 @@ tokio-tungstenite = { version = "0.20.1" }
 tracing = "0.1.37"
 tungstenite = { version = "0.20.1", default-features = false }
 ts-rs = "7.0.0"
-utoipa = "3.5.0"
-utoipa-swagger-ui = "3.1.5"
+utoipa = "4.2.0"
+utoipa-swagger-ui = "6.0.0"
 url = "2.4"
 zeroize = "1.6.0"
 
@@ -236,12 +237,6 @@ tendermint-rpc = "0.34" # same version as used by cosmrs
 prost = "0.12"
 
 # wasm-related dependencies
-
-# The `console_error_panic_hook` crate provides better debugging of panics by
-# logging them with `console.error`. This is great for development, but requires
-# all the `std::fmt` and `std::panicking` infrastructure, so isn't great for
-# code size when deploying.
-console_error_panic_hook = "0.1.7"
 gloo-utils = "0.1.7"
 js-sys = "0.3.63"
 serde-wasm-bindgen = "0.5.0"

Makefile

@@ -103,7 +103,6 @@ sdk-wasm: sdk-wasm-build sdk-wasm-test sdk-wasm-lint
 sdk-wasm-build:
 	$(MAKE) -C nym-browser-extension/storage wasm-pack
 	$(MAKE) -C wasm/client
-	$(MAKE) -C wasm/credentials
 	$(MAKE) -C wasm/node-tester
 	$(MAKE) -C wasm/mix-fetch
 	#$(MAKE) -C wasm/full-nym-wasm

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.33"
+version = "1.1.34"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/native/src/commands/import_credential.rs

@@ -8,5 +8,7 @@ use nym_client_core::cli_helpers::client_import_credential::{
 };
 
 pub(crate) async fn execute(args: CommonClientImportCredentialArgs) -> Result<(), ClientError> {
-    import_credential::<CliNativeClient, _>(args).await
+    import_credential::<CliNativeClient, _>(args).await?;
+    println!("successfully imported credential!");
+    Ok(())
 }

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.33"
+version = "1.1.34"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

clients/socks5/src/commands/import_credential.rs

@@ -10,5 +10,7 @@ use nym_client_core::cli_helpers::client_import_credential::{
 pub(crate) async fn execute(
     args: CommonClientImportCredentialArgs,
 ) -> Result<(), Socks5ClientError> {
-    import_credential::<CliSocks5Client, _>(args).await
+    import_credential::<CliSocks5Client, _>(args).await?;
+    println!("successfully imported credential!");
+    Ok(())
 }

common/bandwidth-controller/src/acquire/mod.rs

@@ -17,17 +17,13 @@ use zeroize::Zeroizing;
 
 pub mod state;
 
-pub async fn deposit<C>(
-    client: &C,
-    amount: impl Into<Coin>,
-) -> Result<State, BandwidthControllerError>
+pub async fn deposit<C>(client: &C, amount: Coin) -> Result<State, BandwidthControllerError>
 where
     C: CoconutBandwidthSigningClient + Sync,
 {
     let mut rng = OsRng;
     let signing_key = identity::PrivateKey::new(&mut rng);
     let encryption_key = encryption::PrivateKey::new(&mut rng);
-    let amount = amount.into();
 
     let tx_hash = client
         .deposit(

common/bandwidth-controller/src/lib.rs

@@ -18,6 +18,7 @@ pub mod acquire;
 pub mod error;
 mod utils;
 
+#[derive(Debug)]
 pub struct BandwidthController<C, St> {
     storage: St,
     client: C,

common/client-core/Cargo.toml

@@ -3,7 +3,7 @@ name = "nym-client-core"
 version = "1.1.15"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 edition = "2021"
-rust-version = "1.66"
+rust-version = "1.70"
 license.workspace = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -25,7 +25,6 @@ si-scale = "0.2.2"
 tap = "1.0.1"
 thiserror = { workspace = true }
 url = { workspace = true, features = ["serde"] }
-tungstenite = { workspace = true, default-features = false }
 tokio = { workspace = true, features = ["macros"] }
 time = { workspace = true }
 zeroize = { workspace = true }
@@ -48,7 +47,7 @@ nym-validator-client = { path = "../client-libs/validator-client", default-featu
 nym-task = { path = "../task" }
 nym-credential-storage = { path = "../credential-storage" }
 nym-network-defaults = { path = "../network-defaults" }
-nym-client-core-config-types = { path = "./config-types", features = ["disk-persistence"]}
+nym-client-core-config-types = { path = "./config-types", features = ["disk-persistence"] }
 nym-client-core-surb-storage = { path = "./surb-storage" }
 nym-client-core-gateways-storage = { path = "./gateways-storage" }
 
@@ -74,8 +73,17 @@ workspace = true
 features = ["time"]
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-tungstenite]
-version = "0.20.1"
-features = ["rustls-tls-native-roots"]
+workspace = true
+features = ["rustls-tls-webpki-roots"]
+
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.tungstenite]
+workspace = true
+default-features = true
+features = ["rustls-tls-webpki-roots"]
+
+[target."cfg(target_arch = \"wasm32\")".dependencies.tungstenite]
+workspace = true
+default-features = false
 
 [target."cfg(target_arch = \"wasm32\")".dependencies.wasm-bindgen-futures]
 workspace = true

common/client-core/config-types/src/error.rs

@@ -8,3 +8,12 @@ use thiserror::Error;
 pub struct ConfigUpgradeFailure {
     pub current_version: String,
 }
+
+#[derive(Error, Debug)]
+pub enum InvalidTrafficModeFailure {
+    #[error("attempted to set medium toggle traffic mode with fast mode flag")]
+    MediumToggleWithFastMode,
+
+    #[error("attempted to set medium toggle traffic mode with no cover flag")]
+    MediumToggleWithNoCover,
+}

common/client-core/config-types/src/lib.rs

@@ -56,6 +56,7 @@ const DEFAULT_MAXIMUM_REPLY_SURB_AGE: Duration = Duration::from_secs(12 * 60 * 6
 // 24 hours
 const DEFAULT_MAXIMUM_REPLY_KEY_AGE: Duration = Duration::from_secs(24 * 60 * 60);
 
+use crate::error::InvalidTrafficModeFailure;
 pub use nym_country_group::CountryGroup;
 
 #[derive(Debug, Clone, Deserialize, PartialEq, Serialize)]
@@ -127,6 +128,56 @@ impl Config {
         self
     }
 
+    // TODO: this should be refactored properly
+    // as of 12.09.23 the below is true (not sure how this comment will rot in the future)
+    // medium_toggle:
+    // - sets secondary packet size to 16kb
+    // - disables poisson distribution of the main traffic stream
+    // - sets the cover traffic stream to 1 packet / 5s (on average)
+    // - disables per hop delay
+    //
+    // fastmode (to be renamed to `fast-poisson`):
+    // - sets average per hop delay to 10ms
+    // - sets the cover traffic stream to 1 packet / 2000s (on average); for all intents and purposes it disables the stream
+    // - sets the poisson distribution of the main traffic stream to 4ms, i.e. 250 packets / s on average
+    //
+    // no_cover:
+    // - disables poisson distribution of the main traffic stream
+    // - disables the secondary cover traffic stream
+    #[doc(hidden)]
+    pub fn try_apply_traffic_modes(
+        &mut self,
+        disable_poisson_process: bool,
+        medium_toggle: bool,
+        fast_mode: bool,
+        no_cover: bool,
+    ) -> Result<(), InvalidTrafficModeFailure> {
+        if disable_poisson_process {
+            self.set_no_poisson_process()
+        }
+
+        if medium_toggle {
+            if fast_mode {
+                return Err(InvalidTrafficModeFailure::MediumToggleWithFastMode);
+            }
+            if no_cover {
+                return Err(InvalidTrafficModeFailure::MediumToggleWithNoCover);
+            }
+
+            self.set_experimental_medium_toggle();
+        }
+
+        if fast_mode {
+            self.set_high_default_traffic_volume()
+        }
+
+        if no_cover {
+            self.set_no_cover_traffic();
+        }
+
+        Ok(())
+    }
+
     pub fn set_high_default_traffic_volume(&mut self) {
         self.debug.traffic.average_packet_delay = Duration::from_millis(10);
         // basically don't really send cover messages
@@ -136,6 +187,15 @@ impl Config {
         self.debug.traffic.message_sending_average_delay = Duration::from_millis(4);
     }
 
+    /// Enable medium mixnet traffic, for experiments only.
+    /// This includes things like disabling cover traffic, no per hop delays, etc.
+    #[doc(hidden)]
+    pub fn set_experimental_medium_toggle(&mut self) {
+        self.set_no_cover_traffic_with_keepalive();
+        self.set_no_per_hop_delays();
+        self.debug.traffic.secondary_packet_size = Some(PacketSize::ExtendedPacket16);
+    }
+
     pub fn with_disabled_poisson_process(mut self, disabled: bool) -> Self {
         if disabled {
             self.set_no_poisson_process()

common/client-core/src/client/base_client/mod.rs

@@ -39,7 +39,7 @@ use log::{debug, error, info, warn};
 use nym_bandwidth_controller::BandwidthController;
 use nym_client_core_gateways_storage::{GatewayDetails, GatewaysDetailsStore};
 use nym_credential_storage::storage::Storage as CredentialStorage;
-use nym_crypto::asymmetric::encryption;
+use nym_crypto::asymmetric::{encryption, identity};
 use nym_gateway_client::{
     AcknowledgementReceiver, GatewayClient, GatewayConfig, MixnetMessageReceiver, PacketRouter,
 };
@@ -670,6 +670,7 @@ where
         let self_address = Self::mix_address(&init_res);
         let ack_key = init_res.client_keys.ack_key();
         let encryption_keys = init_res.client_keys.encryption_keypair();
+        let identity_keys = init_res.client_keys.identity_keypair();
 
         // the components are started in very specific order. Unless you know what you are doing,
         // do not change that.
@@ -792,6 +793,7 @@ where
 
         Ok(BaseClient {
             address: self_address,
+            identity_keys,
             client_input: ClientInputStatus::AwaitingProducer {
                 client_input: ClientInput {
                     connection_command_sender: client_connection_tx,
@@ -816,6 +818,7 @@ where
 
 pub struct BaseClient {
     pub address: Recipient,
+    pub identity_keys: Arc<identity::KeyPair>,
     pub client_input: ClientInputStatus,
     pub client_output: ClientOutputStatus,
     pub client_state: ClientState,

common/client-core/src/init/mod.rs

@@ -201,7 +201,7 @@ where
     log::debug!("Setting up gateway");
     match setup {
         GatewaySetup::MustLoad { gateway_id } => {
-            log::trace!("GatewaySetup::MustLoad with id: {gateway_id:?}");
+            log::debug!("GatewaySetup::MustLoad with id: {gateway_id:?}");
             use_loaded_gateway_details(key_store, details_store, gateway_id).await
         }
         GatewaySetup::New {
@@ -209,7 +209,7 @@ where
             available_gateways,
             wg_tun_address,
         } => {
-            log::trace!("GatewaySetup::New with spec: {specification:?}");
+            log::debug!("GatewaySetup::New with spec: {specification:?}");
             setup_new_gateway(
                 key_store,
                 details_store,
@@ -224,7 +224,7 @@ where
             gateway_details,
             client_keys: managed_keys,
         } => {
-            log::trace!("GatewaySetup::ReuseConnection");
+            log::debug!("GatewaySetup::ReuseConnection");
             Ok(reuse_gateway_connection(
                 authenticated_ephemeral_client,
                 *gateway_details,

common/client-libs/gateway-client/Cargo.toml

@@ -16,6 +16,8 @@ thiserror = { workspace = true }
 url = { workspace = true }
 rand = { version = "0.7.3", features = ["wasm-bindgen"] }
 tokio = { version = "1.24.1", features = ["macros"] }
+si-scale = "0.2.2"
+time.workspace = true
 
 # internal
 nym-bandwidth-controller = { path = "../../bandwidth-controller" }
@@ -46,10 +48,7 @@ features = ["net", "sync", "time"]
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-tungstenite]
 workspace = true
-# the choice of this particular tls feature was arbitrary;
-# if you reckon a different one would be more appropriate, feel free to change it
-# features = ["native-tls"]
-features = ["rustls-tls-native-roots"]
+features = ["rustls-tls-webpki-roots"]
 
 # wasm-only dependencies
 [target."cfg(target_arch = \"wasm32\")".dependencies.wasm-bindgen]

common/client-libs/gateway-client/src/client.rs

@@ -79,6 +79,7 @@ impl GatewayConfig {
 }
 
 // TODO: this should be refactored into a state machine that keeps track of its authentication state
+#[derive(Debug)]
 pub struct GatewayClient<C, St = EphemeralCredentialStorage> {
     authenticated: bool,
     disabled_credentials_mode: bool,
@@ -441,7 +442,7 @@ impl<C, St> GatewayClient<C, St> {
         }
 
         debug_assert!(self.connection.is_available());
-        log::trace!("Registering gateway");
+        log::debug!("Registering gateway");
 
         // it's fine to instantiate it here as it's only used once (during authentication or registration)
         // and putting it into the GatewayClient struct would be a hassle
@@ -493,6 +494,7 @@ impl<C, St> GatewayClient<C, St> {
         if !self.connection.is_established() {
             return Err(GatewayClientError::ConnectionNotEstablished);
         }
+        log::debug!("Authenticating with gateway");
 
         // it's fine to instantiate it here as it's only used once (during authentication or registration)
         // and putting it into the GatewayClient struct would be a hassle
@@ -528,6 +530,7 @@ impl<C, St> GatewayClient<C, St> {
                 self.authenticated = status;
                 self.bandwidth_remaining = bandwidth_remaining;
                 self.negotiated_protocol = protocol_version;
+                log::debug!("authenticated: {status}, bandwidth remaining: {bandwidth_remaining}");
                 Ok(())
             }
             ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
@@ -540,10 +543,11 @@ impl<C, St> GatewayClient<C, St> {
         &mut self,
     ) -> Result<Arc<SharedKeys>, GatewayClientError> {
         if self.authenticated {
+            debug!("Already authenticated");
             return if let Some(shared_key) = &self.shared_key {
                 Ok(Arc::clone(shared_key))
             } else {
-                Err(GatewayClientError::AuthenticationFailure)
+                Err(GatewayClientError::AuthenticationFailureWithPreexistingSharedKey)
             };
         }
 
@@ -849,6 +853,7 @@ impl<C, St> GatewayClient<C, St> {
 // type alias for an ease of use
 pub type InitGatewayClient = GatewayClient<InitOnly>;
 
+#[derive(Debug)]
 pub struct InitOnly;
 
 impl GatewayClient<InitOnly, EphemeralCredentialStorage> {

common/client-libs/gateway-client/src/error.rs

@@ -71,6 +71,9 @@ pub enum GatewayClientError {
     #[error("Authentication failure")]
     AuthenticationFailure,
 
+    #[error("Authentication failure with preexisting shared key")]
+    AuthenticationFailureWithPreexistingSharedKey,
+
     #[error("Timed out")]
     Timeout,
 

common/client-libs/gateway-client/src/socket_state.rs

@@ -10,9 +10,14 @@ use futures::stream::{SplitSink, SplitStream};
 use futures::{SinkExt, StreamExt};
 use log::*;
 use nym_gateway_requests::registration::handshake::SharedKeys;
+use nym_gateway_requests::ServerResponse;
 use nym_task::TaskClient;
+use si_scale::helpers::bibytes2;
 use std::os::raw::c_int as RawFd;
+use std::sync::atomic::{AtomicI64, Ordering};
 use std::sync::Arc;
+use std::time::Duration;
+use time::OffsetDateTime;
 use tungstenite::Message;
 
 #[cfg(unix)]
@@ -48,6 +53,22 @@ pub(crate) fn ws_fd(_conn: &WsConn) -> Option<RawFd> {
     None
 }
 
+// disgusting? absolutely, but does the trick for now
+static LAST_LOGGED_BANDWIDTH_TS: AtomicI64 = AtomicI64::new(0);
+
+fn maybe_log_bandwidth(remaining: i64) {
+    // SAFETY: this value is always populated with valid timestamps
+    let last =
+        OffsetDateTime::from_unix_timestamp(LAST_LOGGED_BANDWIDTH_TS.load(Ordering::Relaxed))
+            .unwrap();
+    let now = OffsetDateTime::now_utc();
+    if last + Duration::from_secs(10) < now {
+        log::info!("remaining bandwidth: {}", bibytes2(remaining as f64));
+        LAST_LOGGED_BANDWIDTH_TS.store(now.unix_timestamp(), Ordering::Relaxed)
+    }
+}
+
+#[derive(Debug)]
 pub(crate) struct PartiallyDelegated {
     sink_half: SplitSink<WsConn, Message>,
     delegated_stream: (SplitStreamReceiver, oneshot::Sender<()>),
@@ -55,7 +76,10 @@ pub(crate) struct PartiallyDelegated {
 }
 
 impl PartiallyDelegated {
-    fn recover_received_plaintexts(ws_msgs: Vec<Message>, shared_key: &SharedKeys) -> Vec<Vec<u8>> {
+    fn recover_received_plaintexts(
+        ws_msgs: Vec<Message>,
+        shared_key: &SharedKeys,
+    ) -> Result<Vec<Vec<u8>>, GatewayClientError> {
         let mut plaintexts = Vec::with_capacity(ws_msgs.len());
         for ws_msg in ws_msgs {
             match ws_msg {
@@ -73,15 +97,32 @@ impl PartiallyDelegated {
                 // TODO: those can return the "send confirmations" - perhaps it should be somehow worked around?
                 Message::Text(text) => {
                     trace!(
-                    "received a text message - probably a response to some previous query! - {}",
-                    text
+                    "received a text message - probably a response to some previous query! - {text}",
                 );
+                    match ServerResponse::try_from(text)
+                        .map_err(|_| GatewayClientError::MalformedResponse)?
+                    {
+                        ServerResponse::Send {
+                            remaining_bandwidth,
+                        } => maybe_log_bandwidth(remaining_bandwidth),
+                        ServerResponse::Error { message } => {
+                            error!("gateway failure: {message}");
+                            return Err(GatewayClientError::GatewayError(message));
+                        }
+                        other => {
+                            warn!(
+                                "received illegal message of type {} in an authenticated client",
+                                other.name()
+                            )
+                        }
+                    }
+
                     continue;
                 }
                 _ => continue,
             }
         }
-        plaintexts
+        Ok(plaintexts)
     }
 
     fn route_socket_messages(
@@ -89,7 +130,7 @@ impl PartiallyDelegated {
         packet_router: &PacketRouter,
         shared_key: &SharedKeys,
     ) -> Result<(), GatewayClientError> {
-        let plaintexts = Self::recover_received_plaintexts(ws_msgs, shared_key);
+        let plaintexts = Self::recover_received_plaintexts(ws_msgs, shared_key)?;
         packet_router.route_received(plaintexts)
     }
 
@@ -129,7 +170,8 @@ impl PartiallyDelegated {
                         };
 
                         if let Err(err) = Self::route_socket_messages(ws_msgs, &packet_router, shared_key.as_ref()) {
-                            log::warn!("Route socket messages failed: {err}");
+                            log::error!("Route socket messages failed: {err}");
+                            break Err(err)
                         }
                     }
                 };
@@ -221,6 +263,7 @@ impl PartiallyDelegated {
 // we can either have the stream itself or an option to re-obtain it
 // by notifying the future owning it to finish the execution and awaiting the result
 // which should be almost immediate (or an invalid state which should never, ever happen)
+#[derive(Debug)]
 pub(crate) enum SocketState {
     Available(Box<WsConn>),
     PartiallyDelegated(PartiallyDelegated),

common/client-libs/validator-client/Cargo.toml

@@ -24,7 +24,6 @@ nym-group-contract-common = { path = "../../cosmwasm-smart-contracts/group-contr
 nym-service-provider-directory-common = { path = "../../cosmwasm-smart-contracts/service-provider-directory" }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
-reqwest = { workspace = true, features = ["json"] }
 nym-http-api-client = { path = "../../../common/http-api-client"}
 thiserror = { workspace = true }
 log = { workspace = true }
@@ -67,6 +66,14 @@ cosmwasm-std = { workspace = true }
 workspace = true
 features = ["tokio"]
 
+[target."cfg(target_arch = \"wasm32\")".dependencies.reqwest]
+workspace = true
+features = ["json"]
+
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.reqwest]
+workspace = true
+features = ["json", "rustls-tls"]
+
 [dev-dependencies]
 bip39 = { workspace = true }
 cosmrs = { workspace = true, features = ["bip32"] }

common/client-libs/validator-client/src/nyxd/error.rs

@@ -44,7 +44,7 @@ pub enum NyxdError {
     #[error("{0} is not a valid tx hash")]
     InvalidTxHash(String),
 
-    #[error("Tendermint RPC request failed: {0}")]
+    #[error("Tendermint RPC request failed - {0}")]
     TendermintErrorRpc(#[from] TendermintRpcError),
 
     #[error("tendermint library failure: {0}")]
@@ -56,22 +56,22 @@ pub enum NyxdError {
     #[error("Failed when attempting to deserialize data ({0})")]
     DeserializationError(String),
 
-    #[error("Failed when attempting to encode our protobuf data: {0}")]
+    #[error("Failed when attempting to encode our protobuf data - {0}")]
     ProtobufEncodingError(#[from] prost::EncodeError),
 
-    #[error("Failed to decode our protobuf data: {0}")]
+    #[error("Failed to decode our protobuf data - {0}")]
     ProtobufDecodingError(#[from] prost::DecodeError),
 
-    #[error("Account '{0}' does not exist on the chain")]
+    #[error("Account {0} does not exist on the chain")]
     NonExistentAccountError(AccountId),
 
-    #[error("Failed on json serialization/deserialization: {0}")]
+    #[error("Failed on json serialization/deserialization - {0}")]
     SerdeJsonError(#[from] serde_json::Error),
 
-    #[error("Account '{0}' is not a valid account address")]
+    #[error("Account {0} is not a valid account address")]
     MalformedAccountAddress(String),
 
-    #[error("Account '{0}' has an invalid associated public key")]
+    #[error("Account {0} has an invalid associated public key")]
     InvalidPublicKey(AccountId),
 
     #[error("Queried contract (code_id: {0}) did not have any code information attached")]
@@ -86,7 +86,7 @@ pub enum NyxdError {
     #[error("Block has an invalid height (either negative or larger than i64::MAX")]
     InvalidHeight,
 
-    #[error("Failed to compress provided wasm code: {0}")]
+    #[error("Failed to compress provided wasm code - {0}")]
     WasmCompressionError(io::Error),
 
     #[error("Logs returned from the validator were malformed")]

common/client-libs/validator-client/src/rpc/reqwest.rs

@@ -109,8 +109,7 @@ trait TendermintRpcErrorMap {
 
 impl TendermintRpcErrorMap for reqwest::Error {
     fn into_rpc_err(self) -> Error {
-        // that's not the best error converion, but it's better than a panic
-        Error::client_internal(self.to_string())
+        todo!()
     }
 }
 

common/commands/src/coconut/generate_freepass.rs

@@ -148,6 +148,10 @@ pub async fn execute(args: Args, client: SigningClient) -> anyhow::Result<()> {
         bail!("the provided free pass request has too long expiry (expiry is set to on {expiration_date})")
     }
 
+    if expiration_date < now {
+        bail!("the provided free pass expiry is set in the past!")
+    }
+
     // issuance start
     block_until_coconut_is_available(&client).await?;
 

common/commands/src/validator/mixnet/delegators/delegate_to_multiple_mixnodes.rs

@@ -0,0 +1,354 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use std::cmp::Ordering;
+use std::collections::{HashMap, HashSet};
+use std::fs;
+use std::fs::OpenOptions;
+
+use clap::Parser;
+use comfy_table::Table;
+use csv::WriterBuilder;
+use log::info;
+use nym_mixnet_contract_common::ExecuteMsg;
+use nym_mixnet_contract_common::ExecuteMsg::{DelegateToMixnode, UndelegateFromMixnode};
+
+use nym_mixnet_contract_common::PendingEpochEventKind::{Delegate, Undelegate};
+use nym_validator_client::nyxd::contract_traits::{NymContractsProvider, PagedMixnetQueryClient};
+use nym_validator_client::nyxd::Coin;
+
+use crate::context::SigningClient;
+use crate::utils::pretty_coin;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(long)]
+    pub memo: Option<String>,
+
+    #[clap(
+        long,
+        help = "Input csv files with delegation amounts. Format: (mixID, amount(in NYM))"
+    )]
+    pub input: String,
+
+    #[clap(
+        long,
+        help = "An output file path (CSV format) to create or append a log of results to"
+    )]
+    pub output: Option<String>,
+}
+
+#[derive(Debug)]
+pub struct InputFileRow {
+    pub mix_id: String,
+    pub amount: Coin,
+}
+#[derive(Debug)]
+pub struct InputFileReader {
+    pub rows: Vec<InputFileRow>,
+}
+
+impl InputFileReader {
+    pub fn new(path: &str) -> Result<InputFileReader, anyhow::Error> {
+        let file_contents = fs::read_to_string(path)?;
+        let mut rows = Vec::new();
+        let mut mix_id_set = HashSet::new();
+
+        for line in file_contents
+            .lines()
+            .map(str::trim)
+            .filter(|line| !line.is_empty())
+        {
+            let tokens: Vec<_> = line.split(',').collect();
+            if tokens.len() != 2 {
+                anyhow::bail!("Incorrect format: {}", line);
+            }
+            let mix_id = tokens[0].trim().to_string();
+            let input_amount = tokens[1]
+                .trim()
+                .parse::<u128>()
+                .map_err(|_| anyhow::anyhow!("'{}' has an invalid amount", line))?;
+
+            let micro_nym_amount = input_amount * 1_000_000;
+
+            if !mix_id_set.insert(mix_id.clone()) {
+                anyhow::bail!("Duplicate mix_id found: {}", mix_id);
+            }
+
+            rows.push(InputFileRow {
+                mix_id,
+                amount: Coin {
+                    amount: micro_nym_amount,
+                    denom: "unym".to_string(),
+                },
+            });
+        }
+        Ok(InputFileReader { rows })
+    }
+}
+
+fn write_to_csv(
+    output_details: Vec<[String; 3]>,
+    output_file: Option<String>,
+) -> Result<(), anyhow::Error> {
+    if let Some(file_path) = output_file {
+        // Determine if the file exists and is not empty
+        let file_exists = fs::metadata(&file_path)
+            .map(|metadata| metadata.len() > 0)
+            .unwrap_or(false);
+
+        // Open the file for appending or creation
+        let file = OpenOptions::new()
+            .append(true)
+            .create(true)
+            .open(&file_path)?;
+
+        if !file_exists {
+            let mut wtr = csv::Writer::from_writer(&file);
+            wtr.write_record(["Operation", "Transaction Hash", "Timestamp"])?;
+            wtr.flush()?;
+        }
+
+        let mut wtr = WriterBuilder::new()
+            .has_headers(!file_exists)
+            .from_writer(file);
+
+        // Write the details to the CSV file
+        for detail in output_details {
+            wtr.write_record(&detail)?;
+        }
+        wtr.flush()?;
+        info!("All operations saved to output file");
+    }
+    Ok(())
+}
+
+async fn fetch_delegation_data(
+    client: &SigningClient,
+) -> Result<HashMap<String, Coin>, anyhow::Error> {
+    let address = client.address();
+    // Fetch all delegations for the user
+    let delegations = match client.get_all_delegator_delegations(&address).await {
+        Ok(delegations) => delegations,
+        Err(e) => {
+            anyhow::bail!("Error fetching delegations: {}", e)
+        }
+    };
+
+    // Build a map to make it easier to handle delegation data
+    let mut existing_delegation_map: HashMap<String, Coin> = HashMap::new();
+    let mut pending_delegation_map: HashMap<String, Coin> = HashMap::new();
+
+    for delegation in delegations {
+        existing_delegation_map
+            .insert(delegation.mix_id.to_string(), Coin::from(delegation.amount));
+    }
+
+    // Look for pending delegate / undelegate events which might be of interest to us
+    let pending_events = match client.get_all_pending_epoch_events().await {
+        Ok(events) => events,
+        Err(e) => {
+            anyhow::bail!("Error fetching pending epoch events: {}", e);
+        }
+    };
+
+    for event in pending_events {
+        match event.event.kind {
+            // If a pending undelegate tx is found, remove it from delegation map
+            Undelegate { owner, mix_id, .. } => {
+                if owner == address.as_ref()
+                    && existing_delegation_map.contains_key(&mix_id.to_string())
+                {
+                    existing_delegation_map.remove(&mix_id.to_string());
+                }
+            }
+
+            // If a pending delegation event is found, gather them to consolidate later
+            Delegate {
+                owner,
+                mix_id,
+                amount,
+                ..
+            } => {
+                if owner == address.as_ref() {
+                    let mut amount = Coin::from(amount);
+                    if let Some(pending_record) = pending_delegation_map.get(&mix_id.to_string()) {
+                        amount.amount += pending_record.amount;
+                    }
+                    pending_delegation_map.insert(mix_id.to_string(), amount);
+                }
+            }
+            _ => {}
+        };
+    }
+
+    // Consolidate pending events into delegation map
+    for (mix_id, amount) in pending_delegation_map {
+        existing_delegation_map
+            .entry(mix_id)
+            .and_modify(|e| e.amount += amount.amount)
+            .or_insert(amount);
+    }
+
+    Ok(existing_delegation_map)
+}
+
+pub async fn delegate_to_multiple_mixnodes(args: Args, client: SigningClient) {
+    let records = match InputFileReader::new(&args.input) {
+        Ok(records) => records,
+        Err(e) => {
+            println!("Error reading input file: {}", e);
+            return;
+        }
+    };
+
+    let existing_delegation_map = fetch_delegation_data(&client)
+        .await
+        .expect("Could not fetch existing delegations");
+
+    let mut delegation_table = Table::new();
+    let mut undelegation_table = Table::new();
+    let mut delegation_msgs: Vec<(ExecuteMsg, Vec<Coin>)> = Vec::new();
+    let mut undelegation_msgs: Vec<(ExecuteMsg, Vec<Coin>)> = Vec::new();
+
+    delegation_table.set_header(["Mix ID", "Input Amount", "Adjusted Amount"]);
+    undelegation_table.set_header(["Mix ID"]);
+
+    for row in &records.rows {
+        let input_amount = row.amount.amount;
+        let existing_delegation_amount = existing_delegation_map
+            .get(&row.mix_id)
+            .map_or(0, |coin| coin.amount);
+
+        match existing_delegation_amount.cmp(&input_amount) {
+            Ordering::Equal => continue, // No action needed if amounts are equal
+
+            Ordering::Less => {
+                // Delegate the difference if the existing delegation is less
+                let difference = Coin {
+                    amount: input_amount - existing_delegation_amount,
+                    denom: row.amount.denom.clone(),
+                };
+                let mix_id = row.mix_id.clone().parse::<u32>().unwrap();
+                delegation_msgs.push((DelegateToMixnode { mix_id }, vec![difference.clone()]));
+                delegation_table.add_row(&[
+                    row.mix_id.clone(),
+                    pretty_coin(&row.amount),
+                    pretty_coin(&difference),
+                ]);
+            }
+
+            Ordering::Greater => {
+                let mix_id = row.mix_id.clone().parse::<u32>().unwrap();
+                let coins: Vec<Coin> = vec![];
+                undelegation_msgs.push((UndelegateFromMixnode { mix_id }, coins));
+                undelegation_table.add_row(&[row.mix_id.clone()]);
+
+                if row.amount.amount > 0 {
+                    delegation_msgs.push((DelegateToMixnode { mix_id }, vec![row.amount.clone()]));
+                    delegation_table.add_row(&[
+                        row.mix_id.clone(),
+                        pretty_coin(&row.amount),
+                        pretty_coin(&row.amount),
+                    ]);
+                }
+            }
+        }
+    }
+
+    if delegation_msgs.is_empty() && undelegation_msgs.is_empty() {
+        println!("Nothing to do. Delegations are up-to-date!");
+        return;
+    }
+
+    if !undelegation_msgs.is_empty() {
+        println!("Undelegation records : \n{}\n\n", undelegation_table);
+    }
+
+    if !delegation_msgs.is_empty() {
+        println!("Delegation records : \n{}\n\n", delegation_table);
+    }
+
+    let ans = inquire::Confirm::new("Do you want to continue with the shown operations?")
+        .with_default(false)
+        .with_help_message("You must confirm before the transactions are signed")
+        .prompt();
+
+    if let Err(e) = ans {
+        info!("Aborting, {}...", e);
+        return;
+    }
+
+    if let Ok(false) = ans {
+        info!("Aborting:: User denied proceeding with signing!");
+        return;
+    }
+
+    let mut output_details: Vec<[String; 3]> = Vec::new();
+    let now = time::OffsetDateTime::now_utc();
+    let now = now
+        .format(&time::format_description::well_known::Rfc3339)
+        .unwrap();
+
+    let mixnet_contract = client
+        .mixnet_contract_address()
+        .expect("mixnet contract address is not available");
+
+    // Execute all undelegation transactions
+    if !undelegation_msgs.is_empty() {
+        let res = client
+            .execute_multiple(
+                mixnet_contract,
+                undelegation_msgs.clone(),
+                None,
+                format!(
+                    "Undelegate from {} nodes via nym-cli",
+                    undelegation_msgs.len()
+                ),
+            )
+            .await
+            .expect("Could not undelegate!");
+
+        println!(
+            "Undelegation transaction successful : {}",
+            res.transaction_hash
+        );
+        output_details.push([
+            "Undelegate".to_string(),
+            res.transaction_hash.to_string(),
+            now.clone(),
+        ]);
+    }
+
+    // Execute all  delegation delegations
+    if !delegation_msgs.is_empty() {
+        let res = client
+            .execute_multiple(
+                mixnet_contract,
+                delegation_msgs,
+                None,
+                format!(
+                    "Delegatation to {} nodes via nym-cli",
+                    undelegation_msgs.len()
+                ),
+            )
+            .await
+            .expect("Could not delegate");
+
+        println!(
+            "Delegation transaction successful : {}",
+            res.transaction_hash
+        );
+        output_details.push([
+            "Delegate".to_string(),
+            res.transaction_hash.to_string(),
+            now.clone(),
+        ]);
+    }
+
+    if args.output.is_some() {
+        if let Err(e) = write_to_csv(output_details, args.output) {
+            info!("Failed to write to CSV, {}", e);
+        }
+    }
+}

common/commands/src/validator/mixnet/delegators/mod.rs

@@ -6,6 +6,7 @@ use clap::{Args, Subcommand};
 pub mod rewards;
 
 pub mod delegate_to_mixnode;
+pub mod delegate_to_multiple_mixnodes;
 pub mod query_for_delegations;
 pub mod undelegate_from_mixnode;
 pub mod vesting_delegate_to_mixnode;
@@ -26,6 +27,8 @@ pub enum MixnetDelegatorsCommands {
     Rewards(rewards::MixnetDelegatorsReward),
     /// Delegate to a mixnode
     Delegate(delegate_to_mixnode::Args),
+    /// Perform bulk delegations from an input file
+    DelegateMulti(delegate_to_multiple_mixnodes::Args),
     /// Undelegate from a mixnode
     Undelegate(undelegate_from_mixnode::Args),
     /// Delegate to a mixnode with locked tokens

common/cosmwasm-smart-contracts/coconut-dkg/src/types.rs

@@ -328,4 +328,8 @@ impl EpochState {
     pub fn is_dealing_exchange(&self) -> bool {
         matches!(self, EpochState::DealingExchange { .. })
     }
+
+    pub fn is_waiting_initialisation(&self) -> bool {
+        matches!(self, EpochState::WaitingInitialisation)
+    }
 }

common/credential-storage/Cargo.toml

@@ -8,6 +8,7 @@ license.workspace = true
 
 [dependencies]
 async-trait = { workspace = true }
+
 log = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["sync"]}
@@ -25,4 +26,4 @@ features = [ "rt-multi-thread", "net", "signal", "fs" ]
 
 [build-dependencies]
 sqlx = { workspace = true, features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate"] }
-tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
+tokio = { version = "1.24.1", features = ["rt-multi-thread", "macros"] }

common/credential-storage/migrations/20241104120000_add_unique.sql

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+ALTER TABLE coconut_credentials
+    RENAME TO old_coconut_credentials;
+
+CREATE TABLE coconut_credentials
+(
+    id                     INTEGER                                                                     NOT NULL PRIMARY KEY AUTOINCREMENT,
+
+--     introduce a way for us to introduce breaking changes in serialization
+    serialization_revision INTEGER                                                                     NOT NULL,
+
+--     the best we can do without enums
+    credential_type        TEXT CHECK ( credential_type IN ('BandwidthVoucher', 'FreeBandwidthPass') ) NOT NULL,
+    credential_data        BLOB                                                                        NOT NULL UNIQUE,
+    epoch_id               INTEGER                                                                     NOT NULL,
+
+--     this field is only really applicable to free passes
+    expired                BOOLEAN                                                                     NOT NULL
+);
+
+ALTER TABLE credential_usage
+    RENAME TO old_credential_usage;
+
+-- for bandwidth vouchers there's going to be only a single entry; for freepasses there can be as many as there are gateways
+CREATE TABLE credential_usage
+(
+    credential_id   INTEGER NOT NULL REFERENCES coconut_credentials (id),
+    gateway_id_bs58 TEXT    NOT NULL,
+
+--     no matter credential type, we can't spend the same credential with the same gateway multiple times
+    UNIQUE (credential_id, gateway_id_bs58)
+);
+
+INSERT INTO coconut_credentials
+SELECT *
+FROM old_coconut_credentials;
+
+
+INSERT INTO credential_usage
+SELECT *
+FROM old_credential_usage;
+
+DROP TABLE old_coconut_credentials;
+DROP TABLE old_credential_usage;

common/credential-storage/src/backends/memory.rs

@@ -33,12 +33,6 @@ impl CoconutCredentialManager {
         }
     }
 
-    pub async fn take_credentials(self) -> Vec<StoredIssuedCredential> {
-        let mut inner = self.inner.write().await;
-        inner.credential_usage = Vec::new();
-        std::mem::take(&mut inner.credentials)
-    }
-
     pub async fn insert_issued_credential(
         &self,
         credential_type: String,

common/credential-storage/src/backends/sqlite.rs

@@ -44,7 +44,7 @@ impl CoconutCredentialManager {
             r#"
                 SELECT * 
                 FROM coconut_credentials
-                WHERE coconut_credentials.credential_type == "FreeBandwidthPass"
+                WHERE coconut_credentials.credential_type == "FreeBandwidthPass" AND coconut_credentials.expired = false
                       AND NOT EXISTS (SELECT 1
                                       FROM   credential_usage
                                       WHERE  credential_usage.credential_id = coconut_credentials.id

common/credential-storage/src/ephemeral_storage.rs

@@ -1,6 +1,8 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use std::fmt::{self, Debug, Formatter};
+
 use crate::backends::memory::CoconutCredentialManager;
 use crate::error::StorageError;
 use crate::models::{StorableIssuedCredential, StoredIssuedCredential};
@@ -15,12 +17,6 @@ pub struct EphemeralStorage {
     coconut_credential_manager: CoconutCredentialManager,
 }
 
-impl EphemeralStorage {
-    pub async fn take_credentials(self) -> Vec<StoredIssuedCredential> {
-        self.coconut_credential_manager.take_credentials().await
-    }
-}
-
 impl Default for EphemeralStorage {
     fn default() -> Self {
         EphemeralStorage {
@@ -29,6 +25,12 @@ impl Default for EphemeralStorage {
     }
 }
 
+impl Debug for EphemeralStorage {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        write!(f, "EphemeralStorage")
+    }
+}
+
 #[async_trait]
 impl Storage for EphemeralStorage {
     type StorageError = StorageError;

common/credential-storage/src/error.rs

@@ -18,4 +18,7 @@ pub enum StorageError {
 
     #[error("No unused credential in database. You need to buy at least one")]
     NoCredential,
+
+    #[error("Database unique constraint violation. Is the credential already imported?")]
+    ConstraintUnique,
 }

common/credential-storage/src/models.rs

@@ -3,6 +3,19 @@
 
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
+// #[derive(Clone)]
+// pub struct CoconutCredential {
+//     #[allow(dead_code)]
+//     pub id: i64,
+//     pub voucher_value: String,
+//     pub voucher_info: String,
+//     pub serial_number: String,
+//     pub binding_number: String,
+//     pub signature: String,
+//     pub epoch_id: String,
+//     pub consumed: bool,
+// }
+
 #[cfg_attr(not(target_arch = "wasm32"), derive(sqlx::FromRow))]
 #[derive(Zeroize, ZeroizeOnDrop, Clone)]
 pub struct StoredIssuedCredential {

common/credential-storage/src/persistent_storage.rs

@@ -69,9 +69,21 @@ impl Storage for PersistentStorage {
                 bandwidth_credential.credential_data,
                 bandwidth_credential.epoch_id,
             )
-            .await?;
-
-        Ok(())
+            .await
+            .map_err(|err| {
+                // There is one error we want to handle specifically.
+                // Check if database_error is `SqliteError` with code 2067 which
+                // means UNIQUE constraint violation
+                if let Some(db_error) = err.as_database_error() {
+                    if db_error.code().map_or(false, |code| code == "2067") {
+                        StorageError::ConstraintUnique
+                    } else {
+                        err.into()
+                    }
+                } else {
+                    err.into()
+                }
+            })
     }
 
     async fn get_next_unspent_credential(

common/credentials-interface/src/lib.rs

@@ -8,11 +8,11 @@ use std::str::FromStr;
 use thiserror::Error;
 
 pub use nym_coconut::{
-    aggregate_signature_shares, aggregate_verification_keys, blind_sign, hash_to_scalar, keygen,
-    prepare_blind_sign, prove_bandwidth_credential, verify_credential, Attribute, Base58,
-    BlindSignRequest, BlindedSerialNumber, BlindedSignature, Bytable, CoconutError, KeyPair,
-    Parameters, PrivateAttribute, PublicAttribute, SecretKey, Signature, SignatureShare,
-    VerificationKey, VerifyCredentialRequest,
+    aggregate_signature_shares, aggregate_signature_shares_and_verify, aggregate_verification_keys,
+    blind_sign, hash_to_scalar, keygen, prepare_blind_sign, prove_bandwidth_credential,
+    verify_credential, Attribute, Base58, BlindSignRequest, BlindedSerialNumber, BlindedSignature,
+    Bytable, CoconutError, KeyPair, Parameters, PrivateAttribute, PublicAttribute, SecretKey,
+    Signature, SignatureShare, VerificationKey, VerifyCredentialRequest,
 };
 
 pub const VOUCHER_INFO_TYPE: &str = "BandwidthVoucher";

common/credentials/src/coconut/bandwidth/freepass.rs

@@ -12,7 +12,8 @@ use serde::{Deserialize, Serialize};
 use time::{Duration, OffsetDateTime, Time};
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
-pub const MAX_FREE_PASS_VALIDITY: Duration = Duration::WEEK; // 1 week
+pub const DEFAULT_FREE_PASS_VALIDITY: Duration = Duration::WEEK; // 1 week
+pub const MAX_FREE_PASS_VALIDITY: Duration = Duration::weeks(12); // 12 weeks
 
 #[derive(Debug, Zeroize, ZeroizeOnDrop, Serialize, Deserialize)]
 pub struct FreePassIssuedData {
@@ -77,9 +78,9 @@ impl FreePassIssuanceData {
     }
 
     pub fn default_expiry_date() -> OffsetDateTime {
-        // set it to furthest midnight in the future such as it's no more than a week away,
+        // set it to the furthest midnight in the future such as it's no more than a week away,
         // i.e. if it's currently for example 9:43 on 2nd March 2024, it will set it to 0:00 on 9th March 2024
-        (OffsetDateTime::now_utc() + MAX_FREE_PASS_VALIDITY).replace_time(Time::MIDNIGHT)
+        (OffsetDateTime::now_utc() + DEFAULT_FREE_PASS_VALIDITY).replace_time(Time::MIDNIGHT)
     }
 
     pub fn expiry_date_attribute(&self) -> &Attribute {

common/credentials/src/coconut/bandwidth/issuance.rs

@@ -10,18 +10,19 @@ use crate::coconut::bandwidth::{
 use crate::coconut::utils::scalar_serde_helper;
 use crate::error::Error;
 use nym_credentials_interface::{
-    aggregate_signature_shares, hash_to_scalar, prepare_blind_sign, Attribute, BlindedSerialNumber,
-    BlindedSignature, Parameters, PrivateAttribute, PublicAttribute, Signature, SignatureShare,
-    VerificationKey,
+    aggregate_signature_shares, aggregate_signature_shares_and_verify, hash_to_scalar,
+    prepare_blind_sign, Attribute, BlindedSerialNumber, BlindedSignature, Parameters,
+    PrivateAttribute, PublicAttribute, Signature, SignatureShare, VerificationKey,
 };
 use nym_crypto::asymmetric::{encryption, identity};
 use nym_validator_client::nym_api::EpochId;
-use nym_validator_client::nyxd::{Coin, Hash};
 use nym_validator_client::signing::AccountData;
 use serde::{Deserialize, Serialize};
 use time::OffsetDateTime;
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
+pub use nym_validator_client::nyxd::{Coin, Hash};
+
 #[derive(Zeroize, ZeroizeOnDrop, Serialize, Deserialize)]
 pub enum BandwidthCredentialIssuanceDataVariant {
     Voucher(BandwidthVoucherIssuanceData),
@@ -265,6 +266,13 @@ impl IssuanceBandwidthCredential {
         self.unblind_signature(validator_vk, &signing_data, blinded_signature)
     }
 
+    pub fn unchecked_aggregate_signature_shares(
+        &self,
+        shares: &[SignatureShare],
+    ) -> Result<Signature, Error> {
+        aggregate_signature_shares(shares).map_err(Error::SignatureAggregationError)
+    }
+
     pub fn aggregate_signature_shares(
         &self,
         verification_key: &VerificationKey,
@@ -279,7 +287,7 @@ impl IssuanceBandwidthCredential {
         attributes.extend_from_slice(&private_attributes);
         attributes.extend_from_slice(&public_attributes);
 
-        aggregate_signature_shares(params, verification_key, &attributes, shares)
+        aggregate_signature_shares_and_verify(params, verification_key, &attributes, shares)
             .map_err(Error::SignatureAggregationError)
     }
 

common/credentials/src/coconut/bandwidth/voucher.rs

@@ -6,7 +6,7 @@ use crate::coconut::utils::scalar_serde_helper;
 use crate::error::Error;
 use nym_api_requests::coconut::BlindSignRequestBody;
 use nym_credentials_interface::{
-    hash_to_scalar, Attribute, BlindSignRequest, BlindedSignature, PublicAttribute,
+    hash_to_scalar, Attribute, BlindSignRequest, BlindedSignature, CredentialType, PublicAttribute,
 };
 use nym_crypto::asymmetric::{encryption, identity};
 use nym_validator_client::nyxd::{Coin, Hash};
@@ -123,6 +123,10 @@ impl BandwidthVoucherIssuanceData {
         &self.value_prehashed
     }
 
+    pub fn typ() -> CredentialType {
+        CredentialType::Voucher
+    }
+
     pub fn tx_hash(&self) -> Hash {
         self.deposit_tx_hash
     }

common/network-defaults/Cargo.toml

@@ -17,11 +17,3 @@ schemars = { workspace = true, features = ["preserve_order"] }
 serde = { workspace = true, features = ["derive"]}
 thiserror = { workspace = true }
 url = { workspace = true }
-
-# 'wasm-serde-types' feature
-tsify = { workspace = true, features = ["js"], optional = true }
-wasm-bindgen = { workspace = true, optional = true }
-
-[features]
-default = []
-wasm-serde-types = ["tsify", "wasm-bindgen"]

common/network-defaults/src/lib.rs

@@ -11,96 +11,39 @@ use std::{
     ffi::OsStr,
     ops::Not,
 };
-pub use url::{ParseError as UrlParseError, Url};
-
-#[cfg(feature = "wasm-serde-types")]
-use tsify::Tsify;
-
-#[cfg(feature = "wasm-serde-types")]
-use wasm_bindgen::prelude::wasm_bindgen;
+use url::Url;
 
 pub mod mainnet;
 pub mod var_names;
 
 #[derive(Clone, Debug, Deserialize, Eq, Hash, PartialEq, Serialize, JsonSchema)]
-#[cfg_attr(feature = "wasm-serde-types", derive(Tsify))]
-#[cfg_attr(feature = "wasm-serde-types", tsify(into_wasm_abi, from_wasm_abi))]
-#[serde(rename_all = "camelCase")]
-#[serde(deny_unknown_fields)]
 pub struct ChainDetails {
-    #[serde(alias = "bech32_account_prefix")]
     pub bech32_account_prefix: String,
-
-    #[serde(alias = "mix_denom")]
     pub mix_denom: DenomDetailsOwned,
-
-    #[serde(alias = "stake_denom")]
     pub stake_denom: DenomDetailsOwned,
 }
 
 #[derive(Clone, Debug, Default, Deserialize, Eq, Hash, PartialEq, Serialize, JsonSchema)]
-#[cfg_attr(feature = "wasm-serde-types", derive(Tsify))]
-#[cfg_attr(feature = "wasm-serde-types", tsify(into_wasm_abi, from_wasm_abi))]
-#[serde(rename_all = "camelCase")]
-#[serde(deny_unknown_fields)]
 pub struct NymContracts {
-    #[cfg_attr(feature = "wasm-serde-types", tsify(optional))]
-    #[serde(alias = "mixnet_contract_address")]
     pub mixnet_contract_address: Option<String>,
-
-    #[cfg_attr(feature = "wasm-serde-types", tsify(optional))]
-    #[serde(alias = "vesting_contract_address")]
     pub vesting_contract_address: Option<String>,
-
-    #[cfg_attr(feature = "wasm-serde-types", tsify(optional))]
-    #[serde(alias = "coconut_bandwidth_contract_address")]
     pub coconut_bandwidth_contract_address: Option<String>,
-
-    #[cfg_attr(feature = "wasm-serde-types", tsify(optional))]
-    #[serde(alias = "group_contract_address")]
     pub group_contract_address: Option<String>,
-
-    #[cfg_attr(feature = "wasm-serde-types", tsify(optional))]
-    #[serde(alias = "multisig_contract_address")]
     pub multisig_contract_address: Option<String>,
-
-    #[cfg_attr(feature = "wasm-serde-types", tsify(optional))]
-    #[serde(alias = "coconut_dkg_contract_address")]
     pub coconut_dkg_contract_address: Option<String>,
-
-    #[cfg_attr(feature = "wasm-serde-types", tsify(optional))]
-    #[serde(alias = "ephemera_contract_address")]
     pub ephemera_contract_address: Option<String>,
-
-    #[cfg_attr(feature = "wasm-serde-types", tsify(optional))]
-    #[serde(alias = "service_provider_directory_contract_address")]
     pub service_provider_directory_contract_address: Option<String>,
-
-    #[cfg_attr(feature = "wasm-serde-types", tsify(optional))]
-    #[serde(alias = "name_service_contract_address")]
     pub name_service_contract_address: Option<String>,
 }
 
 // I wanted to use the simpler `NetworkDetails` name, but there's a clash
 // with `NetworkDetails` defined in all.rs...
 #[derive(Clone, Debug, Deserialize, Eq, Hash, PartialEq, Serialize, JsonSchema)]
-#[cfg_attr(feature = "wasm-serde-types", derive(Tsify))]
-#[cfg_attr(feature = "wasm-serde-types", tsify(into_wasm_abi, from_wasm_abi))]
-#[serde(rename_all = "camelCase")]
-#[serde(deny_unknown_fields)]
 pub struct NymNetworkDetails {
-    #[serde(alias = "network_name")]
     pub network_name: String,
-
-    #[serde(alias = "chain_details")]
     pub chain_details: ChainDetails,
-
     pub endpoints: Vec<ValidatorDetails>,
-
     pub contracts: NymContracts,
-
-    #[cfg_attr(feature = "wasm-serde-types", tsify(optional))]
-    #[serde(alias = "explorer_api")]
     pub explorer_api: Option<String>,
 }
 
@@ -373,17 +316,10 @@ impl DenomDetails {
 }
 
 #[derive(Debug, Serialize, Deserialize, Hash, Clone, PartialEq, Eq, JsonSchema)]
-#[cfg_attr(feature = "wasm-serde-types", derive(Tsify))]
-#[cfg_attr(feature = "wasm-serde-types", tsify(into_wasm_abi, from_wasm_abi))]
-#[serde(rename_all = "camelCase")]
-#[serde(deny_unknown_fields)]
 pub struct DenomDetailsOwned {
     pub base: String,
-
     pub display: String,
-
     // i.e. display_amount * 10^display_exponent = base_amount
-    #[serde(alias = "display_exponent")]
     pub display_exponent: u32,
 }
 
@@ -408,24 +344,14 @@ impl DenomDetailsOwned {
 }
 
 #[derive(Clone, Debug, Deserialize, Eq, Hash, PartialEq, Serialize, JsonSchema)]
-#[cfg_attr(feature = "wasm-serde-types", derive(Tsify))]
-#[cfg_attr(feature = "wasm-serde-types", tsify(into_wasm_abi, from_wasm_abi))]
-#[serde(rename_all = "camelCase")]
-#[serde(deny_unknown_fields)]
-#[non_exhaustive]
 pub struct ValidatorDetails {
     // it is assumed those values are always valid since they're being provided in our defaults file
-    #[serde(alias = "nyxd_url")]
     pub nyxd_url: String,
-
-    #[cfg_attr(feature = "wasm-serde-types", tsify(optional))]
-    #[serde(alias = "websocket_url")]
+    //
     pub websocket_url: Option<String>,
 
     // Right now api_url is optional as we are not running the api reliably on all validators
     // however, later on it should be a mandatory field
-    #[cfg_attr(feature = "wasm-serde-types", tsify(optional))]
-    #[serde(alias = "api_url")]
     pub api_url: Option<String>,
     // TODO: I'd argue this one should also have a field like `gas_price` since its a validator-specific setting
 }
@@ -447,26 +373,16 @@ impl ValidatorDetails {
         }
     }
 
-    pub fn try_nyxd_url(&self) -> Result<Url, url::ParseError> {
-        self.nyxd_url.parse()
-    }
-
     pub fn nyxd_url(&self) -> Url {
-        self.try_nyxd_url()
+        self.nyxd_url
+            .parse()
             .expect("the provided nyxd url is invalid!")
     }
 
-    pub fn try_api_url(&self) -> Option<Result<Url, url::ParseError>> {
-        self.api_url.as_ref().map(|url| url.parse())
-    }
-
     pub fn api_url(&self) -> Option<Url> {
-        self.try_api_url()
-            .map(|url| url.expect("the provided api url is invalid!"))
-    }
-
-    pub fn try_websocket_url(&self) -> Option<Result<Url, url::ParseError>> {
-        self.websocket_url.as_ref().map(|url| url.parse())
+        self.api_url
+            .as_ref()
+            .map(|url| url.parse().expect("the provided api url is invalid!"))
     }
 
     pub fn websocket_url(&self) -> Option<Url> {

common/network-defaults/src/mainnet.rs

@@ -18,9 +18,12 @@ pub const VESTING_CONTRACT_ADDRESS: &str =
     "n1nc5tatafv6eyq7llkr2gv50ff9e22mnf70qgjlv737ktmt4eswrq73f2nw";
 
 pub const COCONUT_BANDWIDTH_CONTRACT_ADDRESS: &str = "";
-pub const GROUP_CONTRACT_ADDRESS: &str = "";
-pub const MULTISIG_CONTRACT_ADDRESS: &str = "";
-pub const COCONUT_DKG_CONTRACT_ADDRESS: &str = "";
+pub const GROUP_CONTRACT_ADDRESS: &str =
+    "n1e2zq4886zzewpvpucmlw8v9p7zv692f6yck4zjzxh699dkcmlrfqk2knsr";
+pub const MULTISIG_CONTRACT_ADDRESS: &str =
+    "n1txayqfz5g9qww3rlflpg025xd26m9payz96u54x4fe3s2ktz39xqk67gzx";
+pub const COCONUT_DKG_CONTRACT_ADDRESS: &str =
+    "n19604yflqggs9mk2z26mqygq43q2kr3n932egxx630svywd5mpxjsztfpvx";
 pub const EPHEMERA_CONTRACT_ADDRESS: &str = "";
 
 pub const REWARDING_VALIDATOR_ADDRESS: &str = "n10yyd98e2tuwu0f7ypz9dy3hhjw7v772q6287gy";

common/nymcoconut/benches/benchmarks.rs

@@ -6,10 +6,10 @@ use criterion::{criterion_group, criterion_main, Criterion};
 use ff::Field;
 use group::{Curve, Group};
 use nym_coconut::{
-    aggregate_signature_shares, aggregate_verification_keys, blind_sign, prepare_blind_sign,
-    prove_bandwidth_credential, random_scalars_refs, setup, ttp_keygen, verify_credential,
-    verify_partial_blind_signature, Attribute, BlindedSignature, Parameters, Signature,
-    SignatureShare, VerificationKey,
+    aggregate_signature_shares_and_verify, aggregate_verification_keys, blind_sign,
+    prepare_blind_sign, prove_bandwidth_credential, random_scalars_refs, setup, ttp_keygen,
+    verify_credential, verify_partial_blind_signature, Attribute, BlindedSignature, Parameters,
+    Signature, SignatureShare, VerificationKey,
 };
 use rand::seq::SliceRandom;
 use std::ops::Neg;
@@ -99,7 +99,7 @@ fn unblind_and_aggregate(
     let mut attributes = vec![];
     attributes.extend_from_slice(private_attributes);
     attributes.extend_from_slice(public_attributes);
-    aggregate_signature_shares(
+    aggregate_signature_shares_and_verify(
         params,
         verification_key,
         &attributes,

common/nymcoconut/src/lib.rs

@@ -4,14 +4,18 @@
 #![warn(clippy::expect_used)]
 #![warn(clippy::unwrap_used)]
 
+pub use bls12_381::Scalar;
 pub use elgamal::elgamal_keygen;
 pub use elgamal::ElGamalKeyPair;
 pub use elgamal::PublicKey;
 pub use error::CoconutError;
+pub use scheme::aggregation::aggregate_key_shares;
 pub use scheme::aggregation::aggregate_signature_shares;
+pub use scheme::aggregation::aggregate_signature_shares_and_verify;
 pub use scheme::aggregation::aggregate_verification_keys;
 pub use scheme::issuance::blind_sign;
 pub use scheme::issuance::prepare_blind_sign;
+pub use scheme::issuance::sign;
 pub use scheme::issuance::verify_partial_blind_signature;
 pub use scheme::issuance::BlindSignRequest;
 pub use scheme::keygen::keygen;
@@ -19,16 +23,19 @@ pub use scheme::keygen::ttp_keygen;
 pub use scheme::keygen::KeyPair;
 pub use scheme::keygen::SecretKey;
 pub use scheme::keygen::VerificationKey;
+pub use scheme::keygen::VerificationKeyShare;
 pub use scheme::setup::setup;
 pub use scheme::setup::Parameters;
 pub use scheme::verification::check_vk_pairing;
 pub use scheme::verification::prove_bandwidth_credential;
+pub use scheme::verification::verify;
 pub use scheme::verification::verify_credential;
 pub use scheme::verification::BlindedSerialNumber;
 pub use scheme::verification::VerifyCredentialRequest;
 pub use scheme::BlindedSignature;
 pub use scheme::Signature;
 pub use scheme::SignatureShare;
+pub use scheme::SignerIndex;
 pub use traits::Base58;
 pub use traits::Bytable;
 pub use utils::hash_to_scalar;

common/nymcoconut/src/scheme/aggregation.rs

@@ -12,7 +12,7 @@ use crate::error::{CoconutError, Result};
 use crate::scheme::verification::check_bilinear_pairing;
 use crate::scheme::{PartialSignature, Signature, SignatureShare, SignerIndex, VerificationKey};
 use crate::utils::perform_lagrangian_interpolation_at_origin;
-use crate::{Attribute, Parameters};
+use crate::{Attribute, Parameters, VerificationKeyShare};
 
 pub(crate) trait Aggregatable: Sized {
     fn aggregate(aggregatable: &[Self], indices: Option<&[SignerIndex]>) -> Result<Self>;
@@ -80,7 +80,23 @@ pub fn aggregate_verification_keys(
     Aggregatable::aggregate(keys, indices)
 }
 
+pub fn aggregate_key_shares(shares: &[VerificationKeyShare]) -> Result<VerificationKey> {
+    let (keys, indices): (Vec<_>, Vec<_>) = shares
+        .iter()
+        .map(|share| (share.key.clone(), share.index))
+        .unzip();
+
+    aggregate_verification_keys(&keys, Some(&indices))
+}
+
 pub fn aggregate_signatures(
+    signatures: &[PartialSignature],
+    indices: Option<&[SignerIndex]>,
+) -> Result<Signature> {
+    Aggregatable::aggregate(signatures, indices)
+}
+
+pub fn aggregate_signatures_and_verify(
     params: &Parameters,
     verification_key: &VerificationKey,
     attributes: &[&Attribute],
@@ -88,11 +104,7 @@ pub fn aggregate_signatures(
     indices: Option<&[SignerIndex]>,
 ) -> Result<Signature> {
     // aggregate the signature
-
-    let signature = match Aggregatable::aggregate(signatures, indices) {
-        Ok(res) => res,
-        Err(err) => return Err(err),
-    };
+    let signature = aggregate_signatures(signatures, indices)?;
 
     // Verify the signature
     let alpha = verification_key.alpha;
@@ -116,7 +128,16 @@ pub fn aggregate_signatures(
     Ok(signature)
 }
 
-pub fn aggregate_signature_shares(
+pub fn aggregate_signature_shares(shares: &[SignatureShare]) -> Result<Signature> {
+    let (signatures, indices): (Vec<_>, Vec<_>) = shares
+        .iter()
+        .map(|share| (*share.signature(), share.index()))
+        .unzip();
+
+    aggregate_signatures(&signatures, Some(&indices))
+}
+
+pub fn aggregate_signature_shares_and_verify(
     params: &Parameters,
     verification_key: &VerificationKey,
     attributes: &[&Attribute],
@@ -127,7 +148,7 @@ pub fn aggregate_signature_shares(
         .map(|share| (*share.signature(), share.index()))
         .unzip();
 
-    aggregate_signatures(
+    aggregate_signatures_and_verify(
         params,
         verification_key,
         attributes,
@@ -210,7 +231,7 @@ mod tests {
 
     #[test]
     fn signature_aggregation_works_for_any_subset_of_signatures() {
-        let mut params = Parameters::new(2).unwrap();
+        let params = Parameters::new(2).unwrap();
         random_scalars_refs!(attributes, params, 2);
 
         let keypairs = ttp_keygen(&params, 3, 5).unwrap();
@@ -227,12 +248,12 @@ mod tests {
 
         let sigs = sks
             .iter()
-            .map(|sk| sign(&mut params, sk, &attributes).unwrap())
+            .map(|sk| sign(&params, sk, &attributes).unwrap())
             .collect::<Vec<_>>();
 
         // aggregating (any) threshold works
         let aggr_vk_1 = aggregate_verification_keys(&vks[..3], Some(&[1, 2, 3])).unwrap();
-        let aggr_sig1 = aggregate_signatures(
+        let aggr_sig1 = aggregate_signatures_and_verify(
             &params,
             &aggr_vk_1,
             &attributes,
@@ -242,7 +263,7 @@ mod tests {
         .unwrap();
 
         let aggr_vk_2 = aggregate_verification_keys(&vks[2..], Some(&[3, 4, 5])).unwrap();
-        let aggr_sig2 = aggregate_signatures(
+        let aggr_sig2 = aggregate_signatures_and_verify(
             &params,
             &aggr_vk_1,
             &attributes,
@@ -258,7 +279,7 @@ mod tests {
 
         // aggregating threshold+1 works
         let aggr_vk_more = aggregate_verification_keys(&vks[1..], Some(&[2, 3, 4, 5])).unwrap();
-        let aggr_more = aggregate_signatures(
+        let aggr_more = aggregate_signatures_and_verify(
             &params,
             &aggr_vk_more,
             &attributes,
@@ -270,7 +291,7 @@ mod tests {
 
         // aggregating all
         let aggr_vk_all = aggregate_verification_keys(&vks, Some(&[1, 2, 3, 4, 5])).unwrap();
-        let aggr_all = aggregate_signatures(
+        let aggr_all = aggregate_signatures_and_verify(
             &params,
             &aggr_vk_all,
             &attributes,
@@ -282,7 +303,7 @@ mod tests {
 
         // not taking enough points (threshold was 3) should fail
         let aggr_vk_not_enough = aggregate_verification_keys(&vks[..2], Some(&[1, 2])).unwrap();
-        let aggr_not_enough = aggregate_signatures(
+        let aggr_not_enough = aggregate_signatures_and_verify(
             &params,
             &aggr_vk_not_enough,
             &attributes,
@@ -294,7 +315,7 @@ mod tests {
 
         // taking wrong index should fail
         let aggr_vk_bad = aggregate_verification_keys(&vks[2..], Some(&[1, 2, 3])).unwrap();
-        assert!(aggregate_signatures(
+        assert!(aggregate_signatures_and_verify(
             &params,
             &aggr_vk_bad,
             &attributes,
@@ -330,9 +351,14 @@ mod tests {
             .unzip();
 
         let aggr_vk_all = aggregate_verification_keys(&vks, None).unwrap();
-        assert!(
-            aggregate_signatures(&params, &aggr_vk_all, &attributes, &signatures, None).is_err()
-        );
+        assert!(aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk_all,
+            &attributes,
+            &signatures,
+            None
+        )
+        .is_err());
     }
 
     #[test]
@@ -352,11 +378,15 @@ mod tests {
             .unzip();
         let aggr_vk_all = aggregate_verification_keys(&vks, None).unwrap();
 
-        assert!(
-            aggregate_signatures(&params, &aggr_vk_all, &attributes, &signatures, Some(&[]))
-                .is_err()
-        );
-        assert!(aggregate_signatures(
+        assert!(aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk_all,
+            &attributes,
+            &signatures,
+            Some(&[])
+        )
+        .is_err());
+        assert!(aggregate_signatures_and_verify(
             &params,
             &aggr_vk_all,
             &attributes,
@@ -383,7 +413,7 @@ mod tests {
             .unzip();
         let aggr_vk_all = aggregate_verification_keys(&vks, None).unwrap();
 
-        assert!(aggregate_signatures(
+        assert!(aggregate_signatures_and_verify(
             &params,
             &aggr_vk_all,
             &attributes,

common/nymcoconut/src/scheme/issuance.rs

@@ -13,9 +13,8 @@ use crate::scheme::setup::Parameters;
 use crate::scheme::BlindedSignature;
 use crate::scheme::SecretKey;
 use crate::Attribute;
-/// Creates a Coconut Signature under a given secret key on a set of public attributes only.
-#[cfg(test)]
 use crate::Signature;
+
 // TODO: possibly completely remove those two functions.
 // They only exist to have a simpler and smaller code snippets to test
 // basic functionalities.
@@ -158,6 +157,10 @@ impl BlindSignRequest {
         )
     }
 
+    pub fn verify_commitment_hash(&self, public_attributes: &[&Attribute]) -> bool {
+        self.commitment_hash == compute_hash(self.commitment, public_attributes)
+    }
+
     pub fn get_commitment_hash(&self) -> G1Projective {
         self.commitment_hash
     }
@@ -426,9 +429,9 @@ pub fn verify_partial_blind_signature(
         .into()
 }
 
-#[cfg(test)]
+/// Creates a Coconut Signature under a given secret key on a set of public attributes only.
 pub fn sign(
-    params: &mut Parameters,
+    params: &Parameters,
     secret_key: &SecretKey,
     public_attributes: &[&Attribute],
 ) -> Result<Signature> {

common/nymcoconut/src/scheme/keygen.rs

@@ -151,10 +151,6 @@ impl Base58 for SecretKey {}
 // TODO: perhaps change points to affine representation
 // to make verification slightly more efficient?
 #[derive(Debug, PartialEq, Eq, Clone)]
-#[cfg_attr(
-    feature = "key-zeroize",
-    derive(zeroize::Zeroize, zeroize::ZeroizeOnDrop)
-)]
 pub struct VerificationKey {
     // TODO add gen2 as per the paper or imply it from the fact library is using bls381?
     pub(crate) alpha: G2Projective,
@@ -411,12 +407,23 @@ impl Bytable for VerificationKey {
 
 impl Base58 for VerificationKey {}
 
+#[derive(Debug, Clone)]
+pub struct VerificationKeyShare {
+    pub key: VerificationKey,
+    pub index: SignerIndex,
+}
+
+impl From<(VerificationKey, SignerIndex)> for VerificationKeyShare {
+    fn from(value: (VerificationKey, SignerIndex)) -> Self {
+        VerificationKeyShare {
+            key: value.0,
+            index: value.1,
+        }
+    }
+}
+
 #[derive(Debug, Serialize, Deserialize)]
 #[cfg_attr(test, derive(PartialEq, Eq, Clone))]
-#[cfg_attr(
-    feature = "key-zeroize",
-    derive(zeroize::Zeroize, zeroize::ZeroizeOnDrop)
-)]
 pub struct KeyPair {
     secret_key: SecretKey,
     verification_key: VerificationKey,
@@ -425,6 +432,12 @@ pub struct KeyPair {
     pub index: Option<SignerIndex>,
 }
 
+impl From<KeyPair> for (SecretKey, VerificationKey) {
+    fn from(value: KeyPair) -> Self {
+        (value.secret_key, value.verification_key)
+    }
+}
+
 impl PemStorableKeyPair for KeyPair {
     type PrivatePemKey = SecretKey;
     type PublicPemKey = VerificationKey;
@@ -461,6 +474,13 @@ impl KeyPair {
         &self.verification_key
     }
 
+    pub fn to_verification_key_share(&self) -> Option<VerificationKeyShare> {
+        self.index.map(|index| VerificationKeyShare {
+            key: self.verification_key.clone(),
+            index,
+        })
+    }
+
     pub fn to_bytes(&self) -> Vec<u8> {
         // Schema is coconutkeypair[14]|secret_key_len[8]|secret_key[secret_key_len]|verification_key_len[8]|verification_key[verification_key_len]|signer_index[8] - optional
         self.to_byte_vec()

common/nymcoconut/src/scheme/mod.rs

@@ -70,6 +70,11 @@ impl Signature {
         &self.1
     }
 
+    pub fn randomise_simple(&self, params: &Parameters) -> Signature {
+        let r = params.random_scalar();
+        Signature(self.0 * r, self.1 * r)
+    }
+
     pub fn randomise(&self, params: &Parameters) -> (Signature, Scalar) {
         let r = params.random_scalar();
         let r_prime = params.random_scalar();
@@ -191,7 +196,7 @@ impl BlindedSignature {
         &self,
         partial_verification_key: &VerificationKey,
         pedersen_commitments_openings: &[Scalar],
-    ) -> Result<Signature> {
+    ) -> Signature {
         // parse the signature
         let h = &self.0;
         let c = &self.1;
@@ -204,7 +209,7 @@ impl BlindedSignature {
 
         let unblinded_c = c - blinding_removers;
 
-        Ok(Signature(*h, unblinded_c))
+        Signature(*h, unblinded_c)
     }
 
     pub fn unblind_and_verify(
@@ -216,7 +221,7 @@ impl BlindedSignature {
         commitment_hash: &G1Projective,
         pedersen_commitments_openings: &[Scalar],
     ) -> Result<Signature> {
-        let unblinded = self.unblind(partial_verification_key, pedersen_commitments_openings)?;
+        let unblinded = self.unblind(partial_verification_key, pedersen_commitments_openings);
         unblinded.verify(
             params,
             partial_verification_key,
@@ -240,6 +245,7 @@ impl BlindedSignature {
 }
 
 // perhaps this should take signature by reference? we'll see how it goes
+#[derive(Clone, Copy)]
 pub struct SignatureShare {
     signature: Signature,
     index: SignerIndex,
@@ -276,7 +282,9 @@ impl SignatureShare {
 mod tests {
     use super::*;
     use crate::hash_to_scalar;
-    use crate::scheme::aggregation::{aggregate_signatures, aggregate_verification_keys};
+    use crate::scheme::aggregation::{
+        aggregate_signatures_and_verify, aggregate_verification_keys,
+    };
     use crate::scheme::issuance::{blind_sign, compute_hash, prepare_blind_sign, sign};
     use crate::scheme::keygen::{keygen, ttp_keygen};
     use crate::scheme::verification::{prove_bandwidth_credential, verify, verify_credential};
@@ -418,13 +426,13 @@ mod tests {
 
     #[test]
     fn verification_on_two_public_attributes() {
-        let mut params = Parameters::new(2).unwrap();
+        let params = Parameters::new(2).unwrap();
         random_scalars_refs!(attributes, params, 2);
 
         let keypair1 = keygen(&params);
         let keypair2 = keygen(&params);
-        let sig1 = sign(&mut params, keypair1.secret_key(), &attributes).unwrap();
-        let sig2 = sign(&mut params, keypair2.secret_key(), &attributes).unwrap();
+        let sig1 = sign(&params, keypair1.secret_key(), &attributes).unwrap();
+        let sig2 = sign(&params, keypair2.secret_key(), &attributes).unwrap();
 
         assert!(verify(
             &params,
@@ -568,9 +576,14 @@ mod tests {
         attributes.extend_from_slice(&public_attributes);
 
         let aggr_vk = aggregate_verification_keys(&vks[..2], Some(&[1, 2])).unwrap();
-        let aggr_sig =
-            aggregate_signatures(&params, &aggr_vk, &attributes, &sigs[..2], Some(&[1, 2]))
-                .unwrap();
+        let aggr_sig = aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk,
+            &attributes,
+            &sigs[..2],
+            Some(&[1, 2]),
+        )
+        .unwrap();
 
         let theta = prove_bandwidth_credential(
             &params,
@@ -590,9 +603,14 @@ mod tests {
 
         // taking different subset of keys and credentials
         let aggr_vk = aggregate_verification_keys(&vks[1..], Some(&[2, 3])).unwrap();
-        let aggr_sig =
-            aggregate_signatures(&params, &aggr_vk, &attributes, &sigs[1..], Some(&[2, 3]))
-                .unwrap();
+        let aggr_sig = aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk,
+            &attributes,
+            &sigs[1..],
+            Some(&[2, 3]),
+        )
+        .unwrap();
 
         let theta = prove_bandwidth_credential(
             &params,

common/nymcoconut/src/scheme/setup.rs

@@ -10,6 +10,7 @@ use crate::error::{CoconutError, Result};
 use crate::utils::hash_g1;
 
 /// System-wide parameters used for the protocol
+#[derive(Clone)]
 pub struct Parameters {
     /// Generator of the G1 group
     g1: G1Affine,

common/nymcoconut/src/scheme/verification.rs

@@ -288,7 +288,6 @@ pub fn verify_credential(
 }
 
 // Used in tests only
-#[cfg(test)]
 pub fn verify(
     params: &Parameters,
     verification_key: &VerificationKey,

common/nymcoconut/src/tests/helpers.rs

@@ -75,8 +75,12 @@ pub fn theta_from_keys_and_attributes(
     attributes.extend_from_slice(public_attributes);
 
     // Randomize credentials and generate any cryptographic material to verify them
-    let signature =
-        aggregate_signature_shares(params, &verification_key, &attributes, &signature_shares)?;
+    let signature = aggregate_signature_shares_and_verify(
+        params,
+        &verification_key,
+        &attributes,
+        &signature_shares,
+    )?;
 
     // Generate cryptographic material to verify them
     let theta = prove_bandwidth_credential(

common/nyxd-scraper/Cargo.toml

@@ -16,7 +16,9 @@ const_format = "0.2.32"
 cosmrs.workspace = true
 eyre = "0.6.9"
 futures.workspace = true
+humantime = "2.1.0"
 sha2 = "0.10.8"
+serde = { workspace = true, features = ["derive"] }
 sqlx = { workspace = true, features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate", "time"] }
 tendermint.workspace = true
 tendermint-rpc = { workspace = true, features = ["websocket-client", "http-client"] }
@@ -24,13 +26,13 @@ thiserror.workspace = true
 time = { workspace = true }
 tokio = { workspace = true, features = ["full"] }
 tokio-stream = "0.1.14"
-tokio-util = { version = "0.7.10", features = ["rt"]}
+tokio-util = { version = "0.7.10", features = ["rt"] }
 tracing.workspace = true
 url.workspace = true
 
 
 # TEMP
-nym-bin-common = { path = "../bin-common", features = ["basic_tracing"]}
+#nym-bin-common = { path = "../bin-common", features = ["basic_tracing"]}
 
 
 [build-dependencies]

common/nyxd-scraper/README.md

@@ -0,0 +1,23 @@
+# Nyxd Scraper
+
+## Pruning
+
+Similarly to cosmos-sdk, we incorporate pruning into our (scraped) chain data. We attempt to follow their strategies as
+closely as possible for convenience's sake. Therefore, the following are available:
+
+### Strategies
+
+The strategies are configured in `config.toml`, with the format `pruning = "<strategy>"` where the options are:
+
+* `default`: only the last 362,880 states(approximately 3.5 weeks worth of state) are kept; pruning at 10 block
+  intervals
+* `nothing`: all historic states will be saved, nothing will be deleted (i.e. archiving node)
+* `everything`: 2 latest states will be kept; pruning at 10 block intervals.
+* `custom`: allow pruning options to be manually specified through `pruning.keep_recent`, and `pruning.interval`
+
+### Custom Pruning
+
+These are applied if and only if the pruning strategy is `custom`:
+
+* `pruning.keep_recent`: N means to keep all of the last N blocks
+* `pruning.interval`: N means to delete old block data from disk every Nth block.

common/nyxd-scraper/src/block_processor/mod.rs

@@ -8,6 +8,7 @@ use crate::error::ScraperError;
 use crate::modules::{BlockModule, MsgModule, TxModule};
 use crate::rpc_client::RpcClient;
 use crate::storage::{persist_block, ScraperStorage};
+use crate::PruningOptions;
 use futures::StreamExt;
 use std::collections::{BTreeMap, HashSet, VecDeque};
 use std::ops::{Add, Range};
@@ -18,9 +19,10 @@ use tokio::sync::Notify;
 use tokio::time::{interval_at, Instant};
 use tokio_stream::wrappers::UnboundedReceiverStream;
 use tokio_util::sync::CancellationToken;
-use tracing::{debug, error, info, warn};
+use tracing::{debug, error, info, instrument, trace, warn};
 
 mod helpers;
+pub(crate) mod pruning;
 pub(crate) mod types;
 
 const MISSING_BLOCKS_CHECK_INTERVAL: Duration = Duration::from_secs(30);
@@ -40,9 +42,11 @@ impl PendingSync {
 }
 
 pub struct BlockProcessor {
+    pruning_options: PruningOptions,
     cancel: CancellationToken,
     synced: Arc<Notify>,
     last_processed_height: u32,
+    last_pruned_height: u32,
     last_processed_at: Instant,
     pending_sync: PendingSync,
     queued_blocks: BTreeMap<u32, BlockToProcess>,
@@ -62,6 +66,7 @@ pub struct BlockProcessor {
 
 impl BlockProcessor {
     pub async fn new(
+        pruning_options: PruningOptions,
         cancel: CancellationToken,
         synced: Arc<Notify>,
         incoming: UnboundedReceiver<BlockToProcess>,
@@ -70,11 +75,17 @@ impl BlockProcessor {
         rpc_client: RpcClient,
     ) -> Result<Self, ScraperError> {
         let last_processed = storage.get_last_processed_height().await?;
+        let last_processed_height = last_processed.try_into().unwrap_or_default();
+
+        let last_pruned = storage.get_pruned_height().await?;
+        let last_pruned_height = last_pruned.try_into().unwrap_or_default();
 
         Ok(BlockProcessor {
+            pruning_options,
             cancel,
             synced,
-            last_processed_height: last_processed.try_into().unwrap_or_default(),
+            last_processed_height,
+            last_pruned_height,
             last_processed_at: Instant::now(),
             pending_sync: Default::default(),
             queued_blocks: Default::default(),
@@ -131,12 +142,17 @@ impl BlockProcessor {
             }
         }
 
+        let commit_start = Instant::now();
         tx.commit()
             .await
             .map_err(|source| ScraperError::StorageTxCommitFailure { source })?;
+        crate::storage::log_db_operation_time("committing processing tx", commit_start);
 
         self.last_processed_height = full_info.block.header.height.value() as u32;
         self.last_processed_at = Instant::now();
+        if let Err(err) = self.maybe_prune_storage().await {
+            error!("failed to prune the storage: {err}");
+        }
 
         Ok(())
     }
@@ -210,6 +226,61 @@ impl BlockProcessor {
         Ok(())
     }
 
+    #[instrument(skip(self))]
+    async fn prune_storage(&mut self) -> Result<(), ScraperError> {
+        let keep_recent = self.pruning_options.strategy_keep_recent();
+        let last_to_keep = self.last_processed_height - keep_recent;
+
+        info!(
+            keep_recent,
+            oldest_to_keep = last_to_keep,
+            "pruning the storage"
+        );
+
+        let lowest: u32 = self
+            .storage
+            .lowest_block_height()
+            .await?
+            .unwrap_or_default()
+            .try_into()
+            .unwrap_or_default();
+
+        let to_prune = last_to_keep.saturating_sub(lowest);
+        match to_prune {
+            v if v > 1000 => warn!("approximately {v} blocks worth of data will be pruned"),
+            v if v > 100 => info!("approximately {v} blocks worth of data will be pruned"),
+            0 => trace!("no blocks to prune"),
+            v => debug!("approximately {v} blocks worth of data will be pruned"),
+        }
+
+        if to_prune == 0 {
+            return Ok(());
+        }
+
+        self.storage
+            .prune_storage(last_to_keep, self.last_processed_height)
+            .await?;
+
+        self.last_pruned_height = self.last_processed_height;
+        Ok(())
+    }
+
+    async fn maybe_prune_storage(&mut self) -> Result<(), ScraperError> {
+        debug!("checking for storage pruning");
+
+        if self.pruning_options.strategy.is_nothing() {
+            trace!("the current pruning strategy is 'nothing'");
+            return Ok(());
+        }
+
+        let interval = self.pruning_options.strategy_interval();
+        if self.last_pruned_height + interval <= self.last_processed_height {
+            self.prune_storage().await?;
+        }
+
+        Ok(())
+    }
+
     async fn next_incoming(&mut self, block: BlockToProcess) {
         let height = block.height;
 
@@ -279,6 +350,8 @@ impl BlockProcessor {
     async fn startup_resync(&mut self) -> Result<(), ScraperError> {
         assert!(self.pending_sync.is_empty());
 
+        self.maybe_prune_storage().await?;
+
         let latest_block = self.rpc_client.current_block_height().await? as u32;
         if latest_block > self.last_processed_height && self.last_processed_height != 0 {
             let request_range = self.last_processed_height + 1..latest_block + 1;

common/nyxd-scraper/src/block_processor/pruning.rs

@@ -0,0 +1,122 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::ScraperError;
+use serde::{Deserialize, Serialize};
+
+pub const DEFAULT_PRUNING_KEEP_RECENT: u32 = 362880;
+pub const DEFAULT_PRUNING_INTERVAL: u32 = 10;
+pub const EVERYTHING_PRUNING_KEEP_RECENT: u32 = 2;
+pub const EVERYTHING_PRUNING_INTERVAL: u32 = 10;
+
+/// We follow cosmos-sdk pruning strategies for convenience’s sake.
+#[derive(Debug, Default, Clone, Copy, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PruningStrategy {
+    /// 'Default' strategy defines a pruning strategy where the last 362880 heights are
+    /// kept where to-be pruned heights are pruned at every 10th height.
+    /// The last 362880 heights are kept(approximately 3.5 weeks worth of state) assuming the typical
+    /// block time is 6s. If these values do not match the applications' requirements, use the "custom" option.
+    #[default]
+    Default,
+
+    /// 'Everything' strategy defines a pruning strategy where all committed heights are
+    /// deleted, storing only the current height and last 2 states. To-be pruned heights are
+    /// pruned at every 10th height.
+    Everything,
+
+    /// 'Nothing' strategy defines a pruning strategy where all heights are kept on disk.
+    Nothing,
+
+    /// 'Custom' strategy defines a pruning strategy where the user specifies the pruning.
+    Custom,
+}
+
+impl PruningStrategy {
+    pub fn is_custom(&self) -> bool {
+        matches!(self, PruningStrategy::Custom)
+    }
+
+    pub fn is_nothing(&self) -> bool {
+        matches!(self, PruningStrategy::Nothing)
+    }
+
+    pub fn is_everything(&self) -> bool {
+        matches!(self, PruningStrategy::Everything)
+    }
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
+pub struct PruningOptions {
+    /// keep_recent defines how many recent heights to keep on disk.
+    pub keep_recent: u32,
+
+    /// interval defines the frequency of removing the pruned heights from the disk.
+    pub interval: u32,
+
+    /// strategy defines the currently used kind of [PruningStrategy].
+    pub strategy: PruningStrategy,
+}
+
+impl PruningOptions {
+    pub fn validate(&self) -> Result<(), ScraperError> {
+        // if strategy is not set to custom, other options are meaningless since they won't be applied
+        if !self.strategy.is_custom() {
+            return Ok(());
+        }
+
+        if self.interval == 0 {
+            return Err(ScraperError::ZeroPruningInterval);
+        }
+
+        if self.interval < EVERYTHING_PRUNING_INTERVAL {
+            return Err(ScraperError::TooSmallPruningInterval {
+                interval: self.interval,
+            });
+        }
+
+        if self.keep_recent < EVERYTHING_PRUNING_KEEP_RECENT {
+            return Err(ScraperError::TooSmallKeepRecent {
+                keep_recent: self.keep_recent,
+            });
+        }
+
+        Ok(())
+    }
+
+    pub fn nothing() -> Self {
+        PruningOptions {
+            keep_recent: 0,
+            interval: 0,
+            strategy: PruningStrategy::Nothing,
+        }
+    }
+
+    pub fn strategy_interval(&self) -> u32 {
+        match self.strategy {
+            PruningStrategy::Default => DEFAULT_PRUNING_INTERVAL,
+            PruningStrategy::Everything => EVERYTHING_PRUNING_INTERVAL,
+            PruningStrategy::Nothing => 0,
+            PruningStrategy::Custom => self.interval,
+        }
+    }
+
+    pub fn strategy_keep_recent(&self) -> u32 {
+        match self.strategy {
+            PruningStrategy::Default => DEFAULT_PRUNING_KEEP_RECENT,
+            PruningStrategy::Everything => EVERYTHING_PRUNING_KEEP_RECENT,
+            PruningStrategy::Nothing => 0,
+            PruningStrategy::Custom => self.keep_recent,
+        }
+    }
+}
+
+impl Default for PruningOptions {
+    fn default() -> Self {
+        PruningOptions {
+            keep_recent: DEFAULT_PRUNING_KEEP_RECENT,
+            interval: DEFAULT_PRUNING_INTERVAL,
+            strategy: Default::default(),
+        }
+    }
+}

common/nyxd-scraper/src/error.rs

@@ -1,6 +1,9 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::block_processor::pruning::{
+    EVERYTHING_PRUNING_INTERVAL, EVERYTHING_PRUNING_KEEP_RECENT,
+};
 use tendermint::Hash;
 use thiserror::Error;
 use tokio::sync::mpsc::error::SendError;
@@ -122,6 +125,15 @@ pub enum ScraperError {
         "could not find validator information for {address}; the validator has signed a commit"
     )]
     MissingValidatorInfoCommitted { address: String },
+
+    #[error("pruning.interval must not be set to 0. If you want to disable pruning, select pruning.strategy = \"nothing\"")]
+    ZeroPruningInterval,
+
+    #[error("pruning.interval must not be smaller than {}. got: {interval}. for most aggressive pruning, select pruning.strategy = \"everything\"", EVERYTHING_PRUNING_INTERVAL)]
+    TooSmallPruningInterval { interval: u32 },
+
+    #[error("pruning.keep_recent must not be smaller than {}. got: {keep_recent}. for most aggressive pruning, select pruning.strategy = \"everything\"", EVERYTHING_PRUNING_KEEP_RECENT)]
+    TooSmallKeepRecent { keep_recent: u32 },
 }
 
 impl<T> From<SendError<T>> for ScraperError {

common/nyxd-scraper/src/lib.rs

@@ -14,6 +14,7 @@ pub(crate) mod rpc_client;
 pub(crate) mod scraper;
 pub mod storage;
 
+pub use block_processor::pruning::{PruningOptions, PruningStrategy};
 pub use modules::{BlockModule, MsgModule, TxModule};
 pub use scraper::{Config, NyxdScraper};
 pub use storage::models;

common/nyxd-scraper/src/scraper/mod.rs

@@ -8,6 +8,7 @@ use crate::modules::{BlockModule, MsgModule, TxModule};
 use crate::rpc_client::RpcClient;
 use crate::scraper::subscriber::ChainSubscriber;
 use crate::storage::ScraperStorage;
+use crate::PruningOptions;
 use std::path::PathBuf;
 use std::sync::Arc;
 use tokio::sync::mpsc::{channel, unbounded_channel};
@@ -27,6 +28,8 @@ pub struct Config {
     pub rpc_url: Url,
 
     pub database_path: PathBuf,
+
+    pub pruning_options: PruningOptions,
 }
 
 pub struct NyxdScraperBuilder {
@@ -54,6 +57,7 @@ impl NyxdScraperBuilder {
             processing_tx.clone(),
         );
         let mut block_processor = BlockProcessor::new(
+            scraper.config.pruning_options,
             scraper.cancel_token.clone(),
             scraper.startup_sync.clone(),
             processing_rx,
@@ -119,6 +123,7 @@ impl NyxdScraper {
     }
 
     pub async fn new(config: Config) -> Result<Self, ScraperError> {
+        config.pruning_options.validate()?;
         let storage = ScraperStorage::init(&config.database_path).await?;
 
         Ok(NyxdScraper {
@@ -160,6 +165,7 @@ impl NyxdScraper {
             processing_tx.clone(),
         );
         let block_processor = BlockProcessor::new(
+            self.config.pruning_options,
             self.cancel_token.clone(),
             self.startup_sync.clone(),
             processing_rx,

common/nyxd-scraper/src/storage/manager.rs

@@ -1,9 +1,11 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::storage::log_db_operation_time;
 use crate::storage::models::{CommitSignature, Validator};
 use sqlx::types::time::OffsetDateTime;
 use sqlx::{Executor, Sqlite};
+use tokio::time::Instant;
 use tracing::{instrument, trace};
 
 #[derive(Clone)]
@@ -25,10 +27,36 @@ impl StorageManager {
         Ok(())
     }
 
+    pub(crate) async fn get_lowest_block(&self) -> Result<Option<i64>, sqlx::Error> {
+        trace!("get_lowest_block");
+        let start = Instant::now();
+
+        let maybe_record = sqlx::query!(
+            r#"
+                SELECT height
+                FROM block
+                ORDER BY height ASC
+                LIMIT 1
+            "#,
+        )
+        .fetch_optional(&self.connection_pool)
+        .await?;
+        log_db_operation_time("get_lowest_block", start);
+
+        if let Some(row) = maybe_record {
+            Ok(row.height)
+        } else {
+            Ok(None)
+        }
+    }
+
     pub(crate) async fn get_first_block_height_after(
         &self,
         time: OffsetDateTime,
     ) -> Result<Option<i64>, sqlx::Error> {
+        trace!("get_first_block_height_after");
+        let start = Instant::now();
+
         let maybe_record = sqlx::query!(
             r#"
                 SELECT height
@@ -41,6 +69,7 @@ impl StorageManager {
         )
         .fetch_optional(&self.connection_pool)
         .await?;
+        log_db_operation_time("get_first_block_height_after", start);
 
         if let Some(row) = maybe_record {
             Ok(row.height)
@@ -53,6 +82,9 @@ impl StorageManager {
         &self,
         time: OffsetDateTime,
     ) -> Result<Option<i64>, sqlx::Error> {
+        trace!("get_last_block_height_before");
+        let start = Instant::now();
+
         let maybe_record = sqlx::query!(
             r#"
                 SELECT height
@@ -65,6 +97,7 @@ impl StorageManager {
         )
         .fetch_optional(&self.connection_pool)
         .await?;
+        log_db_operation_time("get_last_block_height_before", start);
 
         if let Some(row) = maybe_record {
             Ok(row.height)
@@ -79,6 +112,9 @@ impl StorageManager {
         start_height: i64,
         end_height: i64,
     ) -> Result<i32, sqlx::Error> {
+        trace!("get_signed_between");
+        let start = Instant::now();
+
         let count = sqlx::query!(
             r#"
                 SELECT COUNT(*) as count FROM pre_commit
@@ -94,6 +130,7 @@ impl StorageManager {
         .fetch_one(&self.connection_pool)
         .await?
         .count;
+        log_db_operation_time("get_signed_between", start);
 
         Ok(count)
     }
@@ -103,7 +140,10 @@ impl StorageManager {
         consensus_address: &str,
         height: i64,
     ) -> Result<Option<CommitSignature>, sqlx::Error> {
-        sqlx::query_as(
+        trace!("get_precommit");
+        let start = Instant::now();
+
+        let res = sqlx::query_as(
             r#"
                 SELECT * FROM pre_commit
                 WHERE validator_address = ? 
@@ -113,14 +153,20 @@ impl StorageManager {
         .bind(consensus_address)
         .bind(height)
         .fetch_optional(&self.connection_pool)
-        .await
+        .await?;
+        log_db_operation_time("get_precommit", start);
+
+        Ok(res)
     }
 
     pub(crate) async fn get_block_validators(
         &self,
         height: i64,
     ) -> Result<Vec<Validator>, sqlx::Error> {
-        sqlx::query_as!(
+        trace!("get_block_validators");
+        let start = Instant::now();
+
+        let res = sqlx::query_as!(
             Validator,
             r#"
                 SELECT * FROM validator 
@@ -133,16 +179,28 @@ impl StorageManager {
             height
         )
         .fetch_all(&self.connection_pool)
-        .await
+        .await?;
+        log_db_operation_time("get_block_validators", start);
+
+        Ok(res)
     }
 
     pub(crate) async fn get_validators(&self) -> Result<Vec<Validator>, sqlx::Error> {
-        sqlx::query_as("SELECT * FROM validator")
+        trace!("get_validators");
+        let start = Instant::now();
+
+        let res = sqlx::query_as("SELECT * FROM validator")
             .fetch_all(&self.connection_pool)
-            .await
+            .await?;
+        log_db_operation_time("get_validators", start);
+
+        Ok(res)
     }
 
     pub(crate) async fn get_last_processed_height(&self) -> Result<i64, sqlx::Error> {
+        trace!("get_last_processed_height");
+        let start = Instant::now();
+
         let maybe_record = sqlx::query!(
             r#"
                 SELECT last_processed_height FROM metadata
@@ -150,6 +208,7 @@ impl StorageManager {
         )
         .fetch_optional(&self.connection_pool)
         .await?;
+        log_db_operation_time("get_last_processed_height", start);
 
         if let Some(row) = maybe_record {
             Ok(row.last_processed_height)
@@ -157,6 +216,27 @@ impl StorageManager {
             Ok(-1)
         }
     }
+
+    pub(crate) async fn get_pruned_height(&self) -> Result<i64, sqlx::Error> {
+        trace!("get_pruned_height");
+        let start = Instant::now();
+
+        let maybe_record = sqlx::query!(
+            r#"
+                SELECT last_pruned_height FROM pruning
+            "#
+        )
+        .fetch_optional(&self.connection_pool)
+        .await?;
+
+        log_db_operation_time("get_pruned_height", start);
+
+        if let Some(row) = maybe_record {
+            Ok(row.last_pruned_height)
+        } else {
+            Ok(-1)
+        }
+    }
 }
 
 // make those generic over executor so that they could be performed over connection pool and a tx
@@ -170,7 +250,8 @@ pub(crate) async fn insert_validator<'a, E>(
 where
     E: Executor<'a, Database = Sqlite>,
 {
-    trace!("insert validator");
+    trace!("insert_validator");
+    let start = Instant::now();
 
     sqlx::query!(
         r#"
@@ -183,6 +264,7 @@ where
     )
     .execute(executor)
     .await?;
+    log_db_operation_time("insert_validator", start);
 
     Ok(())
 }
@@ -200,7 +282,8 @@ pub(crate) async fn insert_block<'a, E>(
 where
     E: Executor<'a, Database = Sqlite>,
 {
-    trace!("insert block");
+    trace!("insert_block");
+    let start = Instant::now();
 
     sqlx::query!(
         r#"
@@ -217,6 +300,7 @@ where
     )
     .execute(executor)
     .await?;
+    log_db_operation_time("insert_block", start);
 
     Ok(())
 }
@@ -233,7 +317,8 @@ pub(crate) async fn insert_precommit<'a, E>(
 where
     E: Executor<'a, Database = Sqlite>,
 {
-    trace!("insert precommit");
+    trace!("insert_precommit");
+    let start = Instant::now();
 
     sqlx::query!(
         r#"
@@ -249,6 +334,7 @@ where
     )
     .execute(executor)
     .await?;
+    log_db_operation_time("insert_precommit", start);
 
     Ok(())
 }
@@ -270,7 +356,8 @@ pub(crate) async fn insert_transaction<'a, E>(
 where
     E: Executor<'a, Database = Sqlite>,
 {
-    trace!("insert transaction");
+    trace!("insert_transaction");
+    let start = Instant::now();
 
     sqlx::query!(
         r#"
@@ -298,6 +385,7 @@ where
     )
         .execute(executor)
         .await?;
+    log_db_operation_time("insert_transaction", start);
 
     Ok(())
 }
@@ -313,7 +401,8 @@ pub(crate) async fn insert_message<'a, E>(
 where
     E: Executor<'a, Database = Sqlite>,
 {
-    trace!("insert message");
+    trace!("insert_message");
+    let start = Instant::now();
 
     sqlx::query!(
         r#"
@@ -330,6 +419,7 @@ where
     )
     .execute(executor)
     .await?;
+    log_db_operation_time("insert_message", start);
 
     Ok(())
 }
@@ -343,10 +433,100 @@ where
     E: Executor<'a, Database = Sqlite>,
 {
     trace!("update_last_processed");
+    let start = Instant::now();
 
     sqlx::query!("UPDATE metadata SET last_processed_height = ?", height)
         .execute(executor)
         .await?;
+    log_db_operation_time("update_last_processed", start);
+
+    Ok(())
+}
+
+#[instrument(skip(executor))]
+pub(crate) async fn update_last_pruned<'a, E>(height: i64, executor: E) -> Result<(), sqlx::Error>
+where
+    E: Executor<'a, Database = Sqlite>,
+{
+    trace!("update_last_pruned");
+    let start = Instant::now();
+
+    sqlx::query!("UPDATE pruning SET last_pruned_height = ?", height)
+        .execute(executor)
+        .await?;
+    log_db_operation_time("update_last_pruned", start);
+
+    Ok(())
+}
+
+pub(crate) async fn prune_blocks<'a, E>(oldest_to_keep: i64, executor: E) -> Result<(), sqlx::Error>
+where
+    E: Executor<'a, Database = Sqlite>,
+{
+    trace!("prune_blocks");
+    let start = Instant::now();
+
+    sqlx::query!("DELETE FROM block WHERE height < ?", oldest_to_keep)
+        .execute(executor)
+        .await?;
+    log_db_operation_time("prune_blocks", start);
+
+    Ok(())
+}
+
+pub(crate) async fn prune_pre_commits<'a, E>(
+    oldest_to_keep: i64,
+    executor: E,
+) -> Result<(), sqlx::Error>
+where
+    E: Executor<'a, Database = Sqlite>,
+{
+    trace!("prune_pre_commits");
+    let start = Instant::now();
+
+    sqlx::query!("DELETE FROM pre_commit WHERE height < ?", oldest_to_keep)
+        .execute(executor)
+        .await?;
+    log_db_operation_time("prune_pre_commits", start);
+
+    Ok(())
+}
+
+pub(crate) async fn prune_transactions<'a, E>(
+    oldest_to_keep: i64,
+    executor: E,
+) -> Result<(), sqlx::Error>
+where
+    E: Executor<'a, Database = Sqlite>,
+{
+    trace!("prune_transactions");
+    let start = Instant::now();
+
+    sqlx::query!(
+        "DELETE FROM \"transaction\" WHERE height < ?",
+        oldest_to_keep
+    )
+    .execute(executor)
+    .await?;
+    log_db_operation_time("prune_transactions", start);
+
+    Ok(())
+}
+
+pub(crate) async fn prune_messages<'a, E>(
+    oldest_to_keep: i64,
+    executor: E,
+) -> Result<(), sqlx::Error>
+where
+    E: Executor<'a, Database = Sqlite>,
+{
+    trace!("prune_messages");
+    let start = Instant::now();
+
+    sqlx::query!("DELETE FROM message WHERE height < ?", oldest_to_keep)
+        .execute(executor)
+        .await?;
+    log_db_operation_time("prune_messages", start);
 
     Ok(())
 }

common/nyxd-scraper/src/storage/mod.rs

@@ -5,7 +5,8 @@ use crate::block_processor::types::{FullBlockInformation, ParsedTransactionRespo
 use crate::error::ScraperError;
 use crate::storage::manager::{
     insert_block, insert_message, insert_precommit, insert_transaction, insert_validator,
-    update_last_processed, StorageManager,
+    prune_blocks, prune_messages, prune_pre_commits, prune_transactions, update_last_processed,
+    update_last_pruned, StorageManager,
 };
 use crate::storage::models::{CommitSignature, Validator};
 use sqlx::types::time::OffsetDateTime;
@@ -15,6 +16,7 @@ use std::path::Path;
 use tendermint::block::{Commit, CommitSig};
 use tendermint::Block;
 use tendermint_rpc::endpoint::validators;
+use tokio::time::Instant;
 use tracing::{debug, error, info, instrument, trace, warn};
 
 mod helpers;
@@ -28,6 +30,19 @@ pub struct ScraperStorage {
     pub(crate) manager: StorageManager,
 }
 
+pub(crate) fn log_db_operation_time(op_name: &str, start_time: Instant) {
+    let elapsed = start_time.elapsed();
+    let formatted = humantime::format_duration(elapsed);
+
+    match elapsed.as_millis() {
+        v if v > 10000 => error!("{op_name} took {formatted} to execute"),
+        v if v > 1000 => warn!("{op_name} took {formatted} to execute"),
+        v if v > 100 => info!("{op_name} took {formatted} to execute"),
+        v if v > 10 => debug!("{op_name} took {formatted} to execute"),
+        _ => trace!("{op_name} took {formatted} to execute"),
+    }
+}
+
 impl ScraperStorage {
     #[instrument]
     pub async fn init<P: AsRef<Path> + Debug>(database_path: P) -> Result<Self, ScraperError> {
@@ -65,6 +80,32 @@ impl ScraperStorage {
         Ok(storage)
     }
 
+    #[instrument(skip(self))]
+    pub async fn prune_storage(
+        &self,
+        oldest_to_keep: u32,
+        current_height: u32,
+    ) -> Result<(), ScraperError> {
+        let start = Instant::now();
+
+        let mut tx = self.begin_processing_tx().await?;
+
+        prune_messages(oldest_to_keep.into(), &mut tx).await?;
+        prune_transactions(oldest_to_keep.into(), &mut tx).await?;
+        prune_pre_commits(oldest_to_keep.into(), &mut tx).await?;
+        prune_blocks(oldest_to_keep.into(), &mut tx).await?;
+        update_last_pruned(current_height.into(), &mut tx).await?;
+
+        let commit_start = Instant::now();
+        tx.commit()
+            .await
+            .map_err(|source| ScraperError::StorageTxCommitFailure { source })?;
+        log_db_operation_time("committing pruning tx", commit_start);
+
+        log_db_operation_time("pruning storage", start);
+        Ok(())
+    }
+
     #[instrument(skip_all)]
     pub async fn begin_processing_tx(&self) -> Result<StorageTransaction, ScraperError> {
         debug!("starting storage tx");
@@ -75,6 +116,10 @@ impl ScraperStorage {
             .map_err(|source| ScraperError::StorageTxBeginFailure { source })
     }
 
+    pub async fn lowest_block_height(&self) -> Result<Option<i64>, ScraperError> {
+        Ok(self.manager.get_lowest_block().await?)
+    }
+
     pub async fn get_first_block_height_after(
         &self,
         time: OffsetDateTime,
@@ -155,6 +200,10 @@ impl ScraperStorage {
     pub async fn get_last_processed_height(&self) -> Result<i64, ScraperError> {
         Ok(self.manager.get_last_processed_height().await?)
     }
+
+    pub async fn get_pruned_height(&self) -> Result<i64, ScraperError> {
+        Ok(self.manager.get_pruned_height().await?)
+    }
 }
 
 pub async fn persist_block(

common/task/src/manager.rs

@@ -474,6 +474,10 @@ impl TaskClient {
         self.mode.set_should_not_signal_on_drop();
     }
 
+    pub fn disarm(&mut self) {
+        self.mark_as_success();
+    }
+
     pub fn send_we_stopped(&mut self, err: SentError) {
         if self.mode.is_dummy() {
             return;

common/topology/src/gateway.rs

@@ -205,10 +205,10 @@ impl<'a> TryFrom<&'a DescribedGateway> for Node {
             clients_ws_port: self_described.mixnet_websockets.ws_port,
             clients_wss_port: self_described.mixnet_websockets.wss_port,
             identity_key: identity::PublicKey::from_base58_string(
-                &self_described.host_information.keys.ed25519_identity,
+                &self_described.host_information.keys.ed25519,
             )?,
             sphinx_key: encryption::PublicKey::from_base58_string(
-                &self_described.host_information.keys.x25519_sphinx,
+                &self_described.host_information.keys.x25519,
             )?,
             version: self_described
                 .build_information

common/tun/src/linux/tun_device.rs

@@ -159,7 +159,7 @@ impl TunDevice {
                 "add",
                 &format!("{}/{}", ipv6, netmaskv6),
                 "dev",
-                &tun.name(),
+                (tun.name()),
             ])
             .output()?;
         Ok(tun)

common/types/src/delegation.rs

@@ -50,7 +50,7 @@ pub struct DelegationWithEverything {
     pub accumulated_by_delegates: Option<DecCoin>,
     pub accumulated_by_operator: Option<DecCoin>,
     pub block_height: u64,
-    pub delegated_on_iso_datetime: String,
+    pub delegated_on_iso_datetime: Option<String>,
     pub cost_params: Option<MixNodeCostParams>,
     pub avg_uptime_percent: Option<u8>,
 
@@ -60,6 +60,8 @@ pub struct DelegationWithEverything {
     pub uses_vesting_contract_tokens: bool,
     pub unclaimed_rewards: Option<DecCoin>,
 
+    pub errors: Option<String>,
+
     // DEPRECATED, IF POSSIBLE TRY TO DISCONTINUE USE OF IT!
     pub pending_events: Vec<DelegationEvent>,
     pub mixnode_is_unbonding: Option<bool>,

common/types/src/gateway.rs

@@ -171,3 +171,25 @@ impl fmt::Display for GatewayIpPacketRouterDetails {
         writeln!(f, "\taddress: {}", self.address)
     }
 }
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct GatewayWireguardDetails {
+    pub enabled: bool,
+
+    pub announced_port: u16,
+    pub private_network_prefix: u8,
+}
+
+impl fmt::Display for GatewayWireguardDetails {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        writeln!(f, "wireguard:")?;
+        writeln!(f, "\tenabled: {}", self.enabled)?;
+
+        writeln!(f, "\tannounced_port: {}", self.announced_port)?;
+        writeln!(
+            f,
+            "\tprivate_network_prefix: {}",
+            self.private_network_prefix
+        )
+    }
+}

common/wasm/client-core/Cargo.toml

@@ -37,5 +37,11 @@ wasm-utils = { path = "../utils" }
 wasm-storage = { path = "../storage" }
 
 
+# The `console_error_panic_hook` crate provides better debugging of panics by
+# logging them with `console.error`. This is great for development, but requires
+# all the `std::fmt` and `std::panicking` infrastructure, so isn't great for
+# code size when deploying.
+console_error_panic_hook = { version = "0.1", optional = true }
+
 [features]
-default = ["wasm-utils/console_error_panic_hook"]
+default = ["console_error_panic_hook"]

common/wasm/utils/Cargo.toml

@@ -17,12 +17,6 @@ gloo-utils = { workspace = true }
 gloo-net = { version = "0.3.1", features = ["websocket"], optional = true }
 #gloo-net = { path = "../../../../gloo/crates/net", features = ["websocket"], optional = true }
 
-# The `console_error_panic_hook` crate provides better debugging of panics by
-# logging them with `console.error`. This is great for development, but requires
-# all the `std::fmt` and `std::panicking` infrastructure, so isn't great for
-# code size when deploying.
-console_error_panic_hook = { workspace = true, optional = true }
-
 # we don't want entire tokio-tungstenite, tungstenite itself is just fine - we just want message and error enums
 [dependencies.tungstenite]
 workspace = true
@@ -35,7 +29,6 @@ optional = true
 
 [features]
 default = ["sleep"]
-panic-hook = ["console_error_panic_hook"]
 sleep = ["web-sys", "web-sys/Window"]
 websocket = [
     "getrandom",

common/wasm/utils/src/lib.rs

@@ -70,15 +70,3 @@ pub async fn sleep(ms: i32) -> Result<(), wasm_bindgen::JsValue> {
     js_fut.await?;
     Ok(())
 }
-
-#[wasm_bindgen]
-#[cfg(feature = "panic-hook")]
-pub fn set_panic_hook() {
-    // When the `console_error_panic_hook` feature is enabled, we can call the
-    // `set_panic_hook` function at least once during initialization, and then
-    // we will get better error messages if our code ever panics.
-    //
-    // For more details see
-    // https://github.com/rustwasm/console_error_panic_hook#readme
-    console_error_panic_hook::set_once();
-}

common/wasm/utils/src/websocket/mod.rs

@@ -6,6 +6,7 @@ use futures::{Sink, Stream};
 use gloo_net::websocket::futures::WebSocket;
 use gloo_net::websocket::{Message, WebSocketError};
 use gloo_utils::errors::JsError;
+use std::fmt::{self, Formatter};
 use std::io;
 use std::pin::Pin;
 use std::task::{Context, Poll};
@@ -77,6 +78,12 @@ impl Stream for JSWebsocket {
     }
 }
 
+impl fmt::Debug for JSWebsocket {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        write!(f, "JSWebSocket")
+    }
+}
+
 impl Sink<WsMessage> for JSWebsocket {
     type Error = WsError;
 

common/wireguard-types/Cargo.toml

@@ -17,7 +17,9 @@ log = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 thiserror = { workspace = true }
 
+nym-config = { path = "../config" }
 nym-crypto = { path = "../crypto", features = ["asymmetric"] }
+nym-network-defaults = { path = "../network-defaults" }
 
 # feature-specific dependencies:
 

common/wireguard-types/src/config.rs

@@ -0,0 +1,23 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use std::net::{IpAddr, SocketAddr};
+
+#[derive(Copy, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, Debug)]
+pub struct Config {
+    /// Socket address this node will use for binding its wireguard interface.
+    /// default: `0.0.0.0:51822`
+    pub bind_address: SocketAddr,
+
+    /// Private IP address of the wireguard gateway.
+    /// default: `10.1.0.1`
+    pub private_ip: IpAddr,
+
+    /// Port announced to external clients wishing to connect to the wireguard interface.
+    /// Useful in the instances where the node is behind a proxy.
+    pub announced_port: u16,
+
+    /// The prefix denoting the maximum number of the clients that can be connected via Wireguard.
+    /// The maximum value for IPv4 is 32 and for IPv6 is 128
+    pub private_network_prefix: u8,
+}

common/wireguard-types/src/lib.rs

@@ -1,15 +1,51 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use dashmap::DashMap;
+use nym_crypto::asymmetric::encryption::KeyPair;
+use std::sync::Arc;
+
+pub mod config;
 pub mod error;
 pub mod public_key;
 pub mod registration;
 
+pub use config::Config;
 pub use error::Error;
 pub use public_key::PeerPublicKey;
 pub use registration::{
-    ClientMac, ClientMessage, ClientRegistrationResponse, GatewayClient, InitMessage, Nonce,
+    ClientMac, ClientMessage, ClientRegistrationResponse, GatewayClient, GatewayClientRegistry,
+    InitMessage, Nonce,
 };
 
 #[cfg(feature = "verify")]
 pub use registration::HmacSha256;
+
+#[derive(Clone)]
+pub struct WireguardGatewayData {
+    config: Config,
+    keypair: Arc<KeyPair>,
+    client_registry: Arc<GatewayClientRegistry>,
+}
+
+impl WireguardGatewayData {
+    pub fn new(config: Config, keypair: Arc<KeyPair>) -> Self {
+        WireguardGatewayData {
+            config,
+            keypair,
+            client_registry: Arc::new(DashMap::default()),
+        }
+    }
+
+    pub fn config(&self) -> Config {
+        self.config
+    }
+
+    pub fn keypair(&self) -> &Arc<KeyPair> {
+        &self.keypair
+    }
+
+    pub fn client_registry(&self) -> &Arc<GatewayClientRegistry> {
+        &self.client_registry
+    }
+}

common/wireguard-types/src/public_key.rs

@@ -24,6 +24,10 @@ impl PeerPublicKey {
     pub fn as_bytes(&self) -> &[u8] {
         self.0.as_bytes()
     }
+
+    pub fn inner(&self) -> PublicKey {
+        self.0
+    }
 }
 
 impl fmt::Display for PeerPublicKey {

common/wireguard-types/src/registration.rs

@@ -12,7 +12,7 @@ use std::{fmt, ops::Deref, str::FromStr};
 #[cfg(feature = "verify")]
 use hmac::{Hmac, Mac};
 #[cfg(feature = "verify")]
-use nym_crypto::asymmetric::encryption::{PrivateKey, PublicKey};
+use nym_crypto::asymmetric::encryption::PrivateKey;
 #[cfg(feature = "verify")]
 use sha2::Sha256;
 
@@ -87,7 +87,7 @@ impl GatewayClient {
     #[cfg(feature = "verify")]
     pub fn new(
         local_secret: &PrivateKey,
-        remote_public: PublicKey,
+        remote_public: x25519_dalek::PublicKey,
         private_ip: IpAddr,
         nonce: u64,
     ) -> Self {
@@ -96,8 +96,6 @@ impl GatewayClient {
         let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
         let local_public: x25519_dalek::PublicKey = (&static_secret).into();
 
-        let remote_public = x25519_dalek::PublicKey::from(remote_public.to_bytes());
-
         let dh = static_secret.diffie_hellman(&remote_public);
 
         // TODO: change that to use our nym_crypto::hmac module instead

common/wireguard/src/lib.rs

@@ -3,40 +3,37 @@
 // #![warn(clippy::expect_used)]
 // #![warn(clippy::unwrap_used)]
 
-pub mod setup;
-
 /// Start wireguard device
 #[cfg(target_os = "linux")]
 pub async fn start_wireguard(
     mut task_client: nym_task::TaskClient,
-    _gateway_client_registry: std::sync::Arc<
-        nym_wireguard_types::registration::GatewayClientRegistry,
-    >,
+    wireguard_data: std::sync::Arc<nym_wireguard_types::WireguardGatewayData>,
 ) -> Result<defguard_wireguard_rs::WGApi, Box<dyn std::error::Error + Send + Sync + 'static>> {
-    use crate::setup::{peer_allowed_ips, peer_static_public_key, PRIVATE_KEY};
+    use base64::{prelude::BASE64_STANDARD, Engine};
     use defguard_wireguard_rs::{
         host::Peer, key::Key, net::IpAddrMask, InterfaceConfiguration, WGApi, WireguardInterfaceApi,
     };
-    use nym_network_defaults::{WG_PORT, WG_TUN_DEVICE_ADDRESS};
+
+    let mut peers = vec![];
+    for peer_client in wireguard_data.client_registry().iter() {
+        let mut peer = Peer::new(Key::new(peer_client.pub_key.to_bytes()));
+        let peer_ip_mask = IpAddrMask::new(peer_client.private_ip, 32);
+        peer.set_allowed_ips(vec![peer_ip_mask]);
+        peers.push(peer);
+    }
 
     let ifname = String::from("wg0");
     let wgapi = WGApi::new(ifname.clone(), false)?;
     wgapi.create_interface()?;
     let interface_config = InterfaceConfiguration {
         name: ifname.clone(),
-        prvkey: PRIVATE_KEY.to_string(),
-        address: WG_TUN_DEVICE_ADDRESS.to_string(),
-        port: WG_PORT as u32,
-        peers: vec![],
+        prvkey: BASE64_STANDARD.encode(wireguard_data.keypair().private_key().to_bytes()),
+        address: wireguard_data.config().private_ip.to_string(),
+        port: wireguard_data.config().announced_port as u32,
+        peers,
     };
     wgapi.configure_interface(&interface_config)?;
-    let peer = peer_static_public_key();
-    let mut peer = Peer::new(Key::new(peer.to_bytes()));
-    let peer_ip = peer_allowed_ips();
-    let peer_ip_mask = IpAddrMask::new(peer_ip.network_address(), peer_ip.netmask());
-    peer.set_allowed_ips(vec![peer_ip_mask]);
-    wgapi.configure_peer(&peer)?;
-    wgapi.configure_peer_routing(&[peer.clone()])?;
+    // wgapi.configure_peer_routing(&peers)?;
 
     tokio::spawn(async move { task_client.recv().await });
 

common/wireguard/src/setup.rs

@@ -1,56 +0,0 @@
-use std::net::IpAddr;
-
-use base64::{engine::general_purpose, Engine as _};
-use log::info;
-
-// The wireguard UDP listener
-pub const WG_ADDRESS: &str = "0.0.0.0";
-
-// The private key of the listener
-// Corresponding public key: "WM8s8bYegwMa0TJ+xIwhk+dImk2IpDUKslDBCZPizlE="
-pub(crate) const PRIVATE_KEY: &str = "AEqXrLFT4qjYq3wmX0456iv94uM6nDj5ugp6Jedcflg=";
-
-// The AllowedIPs for the connected peer, which is one a single IP and the same as the IP that the
-// peer has configured on their side.
-const ALLOWED_IPS: &str = "10.1.0.2";
-
-fn decode_base64_key(base64_key: &str) -> [u8; 32] {
-    general_purpose::STANDARD
-        .decode(base64_key)
-        .unwrap()
-        .try_into()
-        .unwrap()
-}
-
-pub fn server_static_private_key() -> x25519_dalek::StaticSecret {
-    // TODO: this is a temporary solution for development
-    let static_private_bytes: [u8; 32] = decode_base64_key(PRIVATE_KEY);
-    let static_private = x25519_dalek::StaticSecret::from(static_private_bytes);
-    let static_public = x25519_dalek::PublicKey::from(&static_private);
-    info!(
-        "wg public key: {}",
-        general_purpose::STANDARD.encode(static_public)
-    );
-    static_private
-}
-
-pub fn peer_static_public_key() -> x25519_dalek::PublicKey {
-    // A single static public key is used during development
-
-    // Read from NYM_PEER_PUBLIC_KEY env variable
-    let peer = std::env::var("NYM_PEER_PUBLIC_KEY").expect("NYM_PEER_PUBLIC_KEY must be set");
-
-    let peer_static_public_bytes: [u8; 32] = decode_base64_key(&peer);
-    let peer_static_public = x25519_dalek::PublicKey::from(peer_static_public_bytes);
-    info!(
-        "Adding wg peer public key: {}",
-        general_purpose::STANDARD.encode(peer_static_public)
-    );
-    peer_static_public
-}
-
-pub fn peer_allowed_ips() -> ip_network::IpNetwork {
-    let key: IpAddr = ALLOWED_IPS.parse().unwrap();
-    let cidr = 32u8;
-    ip_network::IpNetwork::new_truncate(key, cidr).unwrap()
-}

documentation/build_all_to_dist.sh

@@ -26,6 +26,7 @@ else
       echo "cleaning old book"
       rm -rf ./book/
       # build book
+      # mdbook test || true
       mdbook build
       # check for destination, if ! then mkdir & check again else echo thumbs up
       if [ ! -d ../../dist/docs/$i ]; then

documentation/dev-portal/book.toml

@@ -24,7 +24,7 @@ turn-off = false
 
 [preprocessor.admonish]
 command = "mdbook-admonish"
-assets_version = "3.0.0" # do not edit: managed by `mdbook-admonish install`
+assets_version = "3.0.2" # do not edit: managed by `mdbook-admonish install`
 
 # https://gitlab.com/tglman/mdbook-variables/
 [preprocessor.variables.variables]

documentation/dev-portal/nym_themes/mdbook-admonish.css

@@ -1,20 +1,4 @@
 @charset "UTF-8";
-:root {
-  --md-admonition-icon--admonish-note: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z'/></svg>");
-  --md-admonition-icon--admonish-abstract: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17 9H7V7h10m0 6H7v-2h10m-3 6H7v-2h7M12 3a1 1 0 0 1 1 1 1 1 0 0 1-1 1 1 1 0 0 1-1-1 1 1 0 0 1 1-1m7 0h-4.18C14.4 1.84 13.3 1 12 1c-1.3 0-2.4.84-2.82 2H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2z'/></svg>");
-  --md-admonition-icon--admonish-info: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 9h-2V7h2m0 10h-2v-6h2m-1-9A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10A10 10 0 0 0 12 2z'/></svg>");
-  --md-admonition-icon--admonish-tip: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17.66 11.2c-.23-.3-.51-.56-.77-.82-.67-.6-1.43-1.03-2.07-1.66C13.33 7.26 13 4.85 13.95 3c-.95.23-1.78.75-2.49 1.32-2.59 2.08-3.61 5.75-2.39 8.9.04.1.08.2.08.33 0 .22-.15.42-.35.5-.23.1-.47.04-.66-.12a.58.58 0 0 1-.14-.17c-1.13-1.43-1.31-3.48-.55-5.12C5.78 10 4.87 12.3 5 14.47c.06.5.12 1 .29 1.5.14.6.41 1.2.71 1.73 1.08 1.73 2.95 2.97 4.96 3.22 2.14.27 4.43-.12 6.07-1.6 1.83-1.66 2.47-4.32 1.53-6.6l-.13-.26c-.21-.46-.77-1.26-.77-1.26m-3.16 6.3c-.28.24-.74.5-1.1.6-1.12.4-2.24-.16-2.9-.82 1.19-.28 1.9-1.16 2.11-2.05.17-.8-.15-1.46-.28-2.23-.12-.74-.1-1.37.17-2.06.19.38.39.76.63 1.06.77 1 1.98 1.44 2.24 2.8.04.14.06.28.06.43.03.82-.33 1.72-.93 2.27z'/></svg>");
-  --md-admonition-icon--admonish-success: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m9 20.42-6.21-6.21 2.83-2.83L9 14.77l9.88-9.89 2.83 2.83L9 20.42z'/></svg>");
-  --md-admonition-icon--admonish-question: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m15.07 11.25-.9.92C13.45 12.89 13 13.5 13 15h-2v-.5c0-1.11.45-2.11 1.17-2.83l1.24-1.26c.37-.36.59-.86.59-1.41a2 2 0 0 0-2-2 2 2 0 0 0-2 2H8a4 4 0 0 1 4-4 4 4 0 0 1 4 4 3.2 3.2 0 0 1-.93 2.25M13 19h-2v-2h2M12 2A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10c0-5.53-4.5-10-10-10z'/></svg>");
-  --md-admonition-icon--admonish-warning: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 14h-2V9h2m0 9h-2v-2h2M1 21h22L12 2 1 21z'/></svg>");
-  --md-admonition-icon--admonish-failure: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20 6.91 17.09 4 12 9.09 6.91 4 4 6.91 9.09 12 4 17.09 6.91 20 12 14.91 17.09 20 20 17.09 14.91 12 20 6.91z'/></svg>");
-  --md-admonition-icon--admonish-danger: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M11 15H6l7-14v8h5l-7 14v-8z'/></svg>");
-  --md-admonition-icon--admonish-bug: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 12h-4v-2h4m0 6h-4v-2h4m6-6h-2.81a5.985 5.985 0 0 0-1.82-1.96L17 4.41 15.59 3l-2.17 2.17a6.002 6.002 0 0 0-2.83 0L8.41 3 7 4.41l1.62 1.63C7.88 6.55 7.26 7.22 6.81 8H4v2h2.09c-.05.33-.09.66-.09 1v1H4v2h2v1c0 .34.04.67.09 1H4v2h2.81c1.04 1.79 2.97 3 5.19 3s4.15-1.21 5.19-3H20v-2h-2.09c.05-.33.09-.66.09-1v-1h2v-2h-2v-1c0-.34-.04-.67-.09-1H20V8z'/></svg>");
-  --md-admonition-icon--admonish-example: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M7 13v-2h14v2H7m0 6v-2h14v2H7M7 7V5h14v2H7M3 8V5H2V4h2v4H3m-1 9v-1h3v4H2v-1h2v-.5H3v-1h1V17H2m2.25-7a.75.75 0 0 1 .75.75c0 .2-.08.39-.21.52L3.12 13H5v1H2v-.92L4 11H2v-1h2.25z'/></svg>");
-  --md-admonition-icon--admonish-quote: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 17h3l2-4V7h-6v6h3M6 17h3l2-4V7H5v6h3l-2 4z'/></svg>");
-  --md-details-icon: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M8.59 16.58 13.17 12 8.59 7.41 10 6l6 6-6 6-1.41-1.42Z'/></svg>");
-}
-
 :is(.admonition) {
   display: flow-root;
   margin: 1.5625em 0;
@@ -71,6 +55,8 @@ a.admonition-anchor-link::before {
   padding-inline: 4.4rem 1.2rem;
   font-weight: 700;
   background-color: rgba(68, 138, 255, 0.1);
+  print-color-adjust: exact;
+  -webkit-print-color-adjust: exact;
   display: flex;
 }
 :is(.admonition-title, summary.admonition-title) p {
@@ -86,6 +72,8 @@ html :is(.admonition-title, summary.admonition-title):last-child {
   width: 2rem;
   height: 2rem;
   background-color: #448aff;
+  print-color-adjust: exact;
+  -webkit-print-color-adjust: exact;
   mask-image: url('data:image/svg+xml;charset=utf-8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>');
   -webkit-mask-image: url('data:image/svg+xml;charset=utf-8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>');
   mask-repeat: no-repeat;
@@ -119,6 +107,25 @@ details[open].admonition > summary.admonition-title::after {
   transform: rotate(90deg);
 }
 
+:root {
+  --md-details-icon: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M8.59 16.58 13.17 12 8.59 7.41 10 6l6 6-6 6-1.41-1.42Z'/></svg>");
+}
+
+:root {
+  --md-admonition-icon--admonish-note: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z'/></svg>");
+  --md-admonition-icon--admonish-abstract: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17 9H7V7h10m0 6H7v-2h10m-3 6H7v-2h7M12 3a1 1 0 0 1 1 1 1 1 0 0 1-1 1 1 1 0 0 1-1-1 1 1 0 0 1 1-1m7 0h-4.18C14.4 1.84 13.3 1 12 1c-1.3 0-2.4.84-2.82 2H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2z'/></svg>");
+  --md-admonition-icon--admonish-info: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 9h-2V7h2m0 10h-2v-6h2m-1-9A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10A10 10 0 0 0 12 2z'/></svg>");
+  --md-admonition-icon--admonish-tip: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17.66 11.2c-.23-.3-.51-.56-.77-.82-.67-.6-1.43-1.03-2.07-1.66C13.33 7.26 13 4.85 13.95 3c-.95.23-1.78.75-2.49 1.32-2.59 2.08-3.61 5.75-2.39 8.9.04.1.08.2.08.33 0 .22-.15.42-.35.5-.23.1-.47.04-.66-.12a.58.58 0 0 1-.14-.17c-1.13-1.43-1.31-3.48-.55-5.12C5.78 10 4.87 12.3 5 14.47c.06.5.12 1 .29 1.5.14.6.41 1.2.71 1.73 1.08 1.73 2.95 2.97 4.96 3.22 2.14.27 4.43-.12 6.07-1.6 1.83-1.66 2.47-4.32 1.53-6.6l-.13-.26c-.21-.46-.77-1.26-.77-1.26m-3.16 6.3c-.28.24-.74.5-1.1.6-1.12.4-2.24-.16-2.9-.82 1.19-.28 1.9-1.16 2.11-2.05.17-.8-.15-1.46-.28-2.23-.12-.74-.1-1.37.17-2.06.19.38.39.76.63 1.06.77 1 1.98 1.44 2.24 2.8.04.14.06.28.06.43.03.82-.33 1.72-.93 2.27z'/></svg>");
+  --md-admonition-icon--admonish-success: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m9 20.42-6.21-6.21 2.83-2.83L9 14.77l9.88-9.89 2.83 2.83L9 20.42z'/></svg>");
+  --md-admonition-icon--admonish-question: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m15.07 11.25-.9.92C13.45 12.89 13 13.5 13 15h-2v-.5c0-1.11.45-2.11 1.17-2.83l1.24-1.26c.37-.36.59-.86.59-1.41a2 2 0 0 0-2-2 2 2 0 0 0-2 2H8a4 4 0 0 1 4-4 4 4 0 0 1 4 4 3.2 3.2 0 0 1-.93 2.25M13 19h-2v-2h2M12 2A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10c0-5.53-4.5-10-10-10z'/></svg>");
+  --md-admonition-icon--admonish-warning: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 14h-2V9h2m0 9h-2v-2h2M1 21h22L12 2 1 21z'/></svg>");
+  --md-admonition-icon--admonish-failure: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20 6.91 17.09 4 12 9.09 6.91 4 4 6.91 9.09 12 4 17.09 6.91 20 12 14.91 17.09 20 20 17.09 14.91 12 20 6.91z'/></svg>");
+  --md-admonition-icon--admonish-danger: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M11 15H6l7-14v8h5l-7 14v-8z'/></svg>");
+  --md-admonition-icon--admonish-bug: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 12h-4v-2h4m0 6h-4v-2h4m6-6h-2.81a5.985 5.985 0 0 0-1.82-1.96L17 4.41 15.59 3l-2.17 2.17a6.002 6.002 0 0 0-2.83 0L8.41 3 7 4.41l1.62 1.63C7.88 6.55 7.26 7.22 6.81 8H4v2h2.09c-.05.33-.09.66-.09 1v1H4v2h2v1c0 .34.04.67.09 1H4v2h2.81c1.04 1.79 2.97 3 5.19 3s4.15-1.21 5.19-3H20v-2h-2.09c.05-.33.09-.66.09-1v-1h2v-2h-2v-1c0-.34-.04-.67-.09-1H20V8z'/></svg>");
+  --md-admonition-icon--admonish-example: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M7 13v-2h14v2H7m0 6v-2h14v2H7M7 7V5h14v2H7M3 8V5H2V4h2v4H3m-1 9v-1h3v4H2v-1h2v-.5H3v-1h1V17H2m2.25-7a.75.75 0 0 1 .75.75c0 .2-.08.39-.21.52L3.12 13H5v1H2v-.92L4 11H2v-1h2.25z'/></svg>");
+  --md-admonition-icon--admonish-quote: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 17h3l2-4V7h-6v6h3M6 17h3l2-4V7H5v6h3l-2 4z'/></svg>");
+}
+
 :is(.admonition):is(.admonish-note) {
   border-color: #448aff;
 }

documentation/dev-portal/src/SUMMARY.md

@@ -20,19 +20,15 @@
 # User Manuals
 
 - [NymVPN alpha](nymvpn/intro.md)
-    - [GUI](nymvpn/gui.md)
-        - [Linux](nymvpn/gui-linux.md)
-        - [MacOS](nymvpn/gui-mac.md)
     - [CLI](nymvpn/cli.md)
-        - [Linux](nymvpn/cli-linux.md)
-        - [MacOS](nymvpn/cli-mac.md)
-    - [Troubleshooting](nymvpn/troubleshooting.md)
-    - [NymVPN FAQ](nymvpn/faq.md)
+
+<!-- OUTDATED STUFF:
 - [NymConnect X Monero](tutorials/monero.md)
 - [NymConnect X Matrix](tutorials/matrix.md)
 - [NymConnect X Telegram](tutorials/telegram.md)
 - [NymConnect X Electrum](tutorials/electrum.md)
 - [NymConnect X Firo wallet](tutorials/firo.md)
+-->
 
 # Code Examples
 

documentation/dev-portal/src/nymvpn/cli-linux.md

@@ -1,4 +1,4 @@
-# NymVPN alpha CLI: Guide for GNU/Linux
+# NymVPN alpha CLI Guide
 
 ```admonish info
 NymVPN is an experimental software and it's for testing purposes only. All users testing the client are expected to sign GDPR Information Sheet and Consent Form (shared at the workshop) so we use their results to improve the client, and submit the form [*NymVPN User research*]({{nym_vpn_form_url}}) with the testing results.
@@ -8,7 +8,7 @@ NymVPN is an experimental software and it's for testing purposes only. All users
 
 > Any syntax in `<>` brackets is a user's/version unique variable. Exchange with a corresponding name without the `<>` brackets.
 
-1. Open Github [releases page]({{nym_vpn_releases}}) and download the binary for Debian based Linux
+1. Open Github [releases page]({{nym_vpn_releases}}) and download the CLI latest binary for your system
 
 2. Verify sha hash of your downloaded binary with the one listed on the [releases page]({{nym_vpn_releases}}). You can use a simple `shasum` command and compare strings (ie with Python) or run in the same directory the following command, exchanging `<SHA_STRING>` with the one of your binary, like in the example:
 ```sh
@@ -25,17 +25,12 @@ tar -xvf <BINARY>.tar.gz
 # tar -xvf nym-vpn-cli_<!-- cmdrun scripts/nym_vpn_cli_version.sh -->_ubuntu-22.04_x86_64.tar.gz
 ```
 
-4. Make executable by running:
+4. Make executable:
 ```sh
 # make sure you are in the right sub-directory
 chmod u+x ./nym-vpn-cli
 ```
 
-5. Create Sandbox environment config file by saving [this](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) as `sandbox.env` in the same directory as your NymVPN binaries by running:
-```sh
-curl -o sandbox.env -L https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env
-```
-
 ## Run NymVPN
 
 **For NymVPN to work, all other VPNs must be switched off!** At this alpha stage of NymVPN, the network connection (wifi) must be reconnected after or in between the testing rounds.
@@ -47,7 +42,7 @@ Make sure your terminal is open in the same directory as your `nym-vpn-cli` bina
 ```sh
 sudo ./nym-vpn-cli -c ./sandbox.env --entry-gateway-id <ENTRY_GATEWAY_ID> --exit-router-address <EXIT_ROUTER_ADDRESS> --enable-wireguard --private-key <PRIVATE_KEY> --wg-ip <WIREGUARD_IP>
 ```
-3. To choose different Gateways, visit [nymvpn.com/en/alpha/api/gateways](https://nymvpn.com/en/alpha/api/gateways) and pick one
+3. To choose different Gateways, visit [explorer.nymtech.net/network-components/gateways](https://explorer.nymtech.net/network-components/gateways) and copy-paste an identity key of your choice
 4. See all possibilities in [command explanation](#cli-commands-and-options) section below
 
 In case of errors, see [troubleshooting section](troubleshooting.md).
@@ -56,16 +51,16 @@ In case of errors, see [troubleshooting section](troubleshooting.md).
 
 The basic syntax of `nym-vpn-cli` is:
 ```sh
-sudo ./nym-vpn-cli -c ./sandbox.env --entry-gateway-id <ENTRY_GATEWAY_ID> --exit-router-address <EXIT_ROUTER_ADDRESS> --enable-wireguard --private-key <PRIVATE_KEY> --wg-ip <WG_IP>
+sudo ./nym-vpn-cli <--exit-router-address <EXIT_ROUTER_ADDRESS>|--exit-gateway-id <EXIT_GATEWAY_ID>|--exit-gateway-country <EXIT_GATEWAY_COUNTRY>>
 ```
-* To choose different Gateways, visit [nymvpn.com/en/alpha/api/gateways](https://nymvpn.com/en/alpha/api/gateways)
+* To choose different Gateways, visit [nymvpn.com/en/alpha/api/gateways](https://explorer.nymtech.net/network-components/gateways)
 * To see all possibilities run with `--help` flag:
 ```sh
 ./nym-vpn-cli --help
 ```
 ~~~admonish example collapsible=true title="Console output"
 ```sh
-Usage: nym-vpn-cli [OPTIONS]
+Usage: nym-vpn-cli [OPTIONS] <--exit-router-address <EXIT_ROUTER_ADDRESS>|--exit-gateway-id <EXIT_GATEWAY_ID>|--exit-gateway-country <EXIT_GATEWAY_COUNTRY>>
 
 Options:
   -c, --config-env-file <CONFIG_ENV_FILE>
@@ -76,11 +71,13 @@ Options:
           Mixnet public ID of the entry gateway
       --entry-gateway-country <ENTRY_GATEWAY_COUNTRY>
           Auto-select entry gateway by country ISO
+      --entry-gateway-low-latency
+          Auto-select entry gateway by latency
       --exit-router-address <EXIT_ROUTER_ADDRESS>
           Mixnet recipient address
       --exit-gateway-id <EXIT_GATEWAY_ID>
 
-      --exit-router-country <EXIT_ROUTER_COUNTRY>
+      --exit-gateway-country <EXIT_GATEWAY_COUNTRY>
           Mixnet recipient address
       --enable-wireguard
           Enable the wireguard traffic between the client and the entry gateway
@@ -88,8 +85,10 @@ Options:
           Associated private key
       --wg-ip <WG_IP>
           The IP address of the wireguard interface used for the first hop to the entry gateway
-      --nym-ip <NYM_IP>
-          The IP address of the nym TUN device that wraps IP packets in sphinx packets
+      --nym-ipv4 <NYM_IPV4>
+          The IPv4 address of the nym TUN device that wraps IP packets in sphinx packets
+      --nym-ipv6 <NYM_IPV6>
+          The IPv6 address of the nym TUN device that wraps IP packets in sphinx packets
       --nym-mtu <NYM_MTU>
           The MTU of the nym TUN device that wraps IP packets in sphinx packets
       --disable-routing
@@ -125,3 +124,19 @@ Here is a list of the options and their descriptions. Some are essential, some a
 - `--ip` is the IP address of the TUN device. That is the IP address of the local private network that is set up between local client and the Exit Gateway.
 - `--mtu`: The MTU of the TUN device. That is the max IP packet size of the local private network that is set up between local client and the Exit Gateway.
 - `--disable-routing`: Disable routing all traffic through the VPN TUN device.
+
+## Testnet environment
+
+If you want to run NymVPN CLI in Nym Sandbox environment, there are a few adjustments to be done:
+
+1. Create Sandbox environment config file by saving [this](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) as `sandbox.env` in the same directory as your NymVPN binaries by running:
+```sh
+curl -o sandbox.env -L https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env
+```
+
+1. Check available Gateways at [nymvpn.com/en/alpha/api/gateways](https://nymvpn.com/en/alpha/api/gateways)
+
+2. Run with a flag `-c`
+```sh
+sudo ./nym-vpn-cli -c <PATH_TO>/sandbox.env <--exit-router-address <EXIT_ROUTER_ADDRESS>|--exit-gateway-id <EXIT_GATEWAY_ID>|--exit-gateway-country <EXIT_GATEWAY_COUNTRY>>
+```

documentation/dev-portal/src/nymvpn/cli.bak

@@ -0,0 +1,35 @@
+# NymVPN Command Line Interface (CLI)
+
+```admonish info
+Our alpha testing round is done with participants at live workshop events. This guide will not work for everyone, as the NymVPN source code is not yet publicly accessible. The alpha testing is done on Nym testnet Sandbox environment, this configuration is limited and will not work in the future.
+
+**If you commit to test NymVPN alpha, please start with the [user research form]({{nym_vpn_form_url}}) where all the steps will be provided**. If you disagree with any of the conditions listed, please leave this page.
+```
+
+Follow the simple [automated script](#automated-script-for-cli-installation) below to install and run NymVPN CLI. If you prefer to do a manual setup follow the steps in the guide for [Linux](cli-linux.md) or [MacOS](cli-mac.md).
+
+Visit NymVPN alpha latest [release page]({{nym_vpn_releases}}) to check sha sums or download the binaries directly.
+
+## Automated Script for CLI Installation
+
+We wrote a [script](https://gist.github.com/serinko/d65450653d6bbafacbcee71c9cb8fb31) which does download of the CLI, sha256 verification, extraction, installation and configuration for Linux and MacOS users automatically following the steps below:
+
+1. Open a terminal window in a directory where you want the script and NymVPN CLI binary be downloaded and run
+```sh
+curl -o execute-nym-vpn-cli-binary.sh -L https://gist.githubusercontent.com/tommyv1987/87267ded27e1eb7651aa9cc745ddf4af/raw/d39f98dbb36ccff761a7e940073388a6fe7b73fe/execute-nym-vpn-cli-binary.sh && chmod u+x execute-nym-vpn-cli-binary.sh && sudo -E ./execute-nym-vpn-cli-binary.sh
+```
+
+2. Follow the prompts in the program
+
+3. The script will automatically start the client. Make sure to **turn off any other VPNs** and follow the prompts:
+
+* It prints a JSON view of existing Gateways and prompt you to:
+    - *Make sure to use two different Gateways for entry and exit!*
+    - `enter a gateway ID:` paste one of the values labeled with a key `"identityKey"` printed above (without `" "`)
+    - `enter an exit address:` paste one of the values labeled with a key `"address"` printed above (without `" "`)
+    - `do you want five hop or two hop?`: type `five` or `two`
+    - `enable WireGuard? (yes/no):` if you chose yes, find your private key and wireguard IP [here](https://nymvpn.com/en/alpha)
+
+To run `nym-vpn-cli` again, reconnect your wifi, move to the directory of your CLI binary `cd ~/nym-vpn-cli-dir` and follow the guide for [Linux](cli-linux.md#run-nymvpn) or [MacOS](cli-mac.md#run-nymvpn). If you find it too difficult, just run this script again - like in step \#3 above.
+
+In case of errors check out the [troubleshooting](troubleshooting.md) section.

documentation/dev-portal/src/nymvpn/cli.md

@@ -1,35 +1,177 @@
-# NymVPN Command Line Interface (CLI)
+# NymVPN CLI Guide
 
 ```admonish info
-Our alpha testing round is done with participants at live workshop events. This guide will not work for everyone, as the NymVPN source code is not yet publicly accessible. The alpha testing is done on Nym testnet Sandbox environment, this configuration is limited and will not work in the future.
-
-**If you commit to test NymVPN alpha, please start with the [user research form]({{nym_vpn_form_url}}) where all the steps will be provided**. If you disagree with any of the conditions listed, please leave this page.
+NymVPN is an experimental software and it's for testing purposes only. Anyone can submit a registration to the private alpha round on [nymvpn.com](https://nymvpn.com/en).
 ```
 
-Follow the simple [automated script](#automated-script-for-cli-installation) below to install and run NymVPN CLI. If you prefer to do a manual setup follow the steps in the guide for [Linux](cli-linux.md) or [MacOS](cli-mac.md).
+## Overview
 
-Visit NymVPN alpha latest [release page]({{nym_vpn_releases}}) to check sha sums or download the binaries directly.
+The core binaries consist of:
 
-## Automated Script for CLI Installation
+- **`nym-vpn-cli`**: Basic commandline client for running the vpn. This runs in the foreground.
 
-We wrote a [script](https://gist.github.com/serinko/d65450653d6bbafacbcee71c9cb8fb31) which does download of the CLI, sha256 verification, extraction, installation and configuration for Linux and MacOS users automatically following the steps below:
+- **`nym-vpnd`**: Daemon implementation of the vpn client that can run in the background and interacted with using `nym-vpnc`.
 
-1. Open a terminal window in a directory where you want the script and NymVPN CLI binary be downloaded and run
+- **`nym-vpnc`**: The commandline client used to interact with `nym-vpnd`.
+
+
+## Installation
+
+> Any syntax in `<>` brackets is a user's/version unique variable. Exchange with a corresponding name without the `<>` brackets.
+
+1. Open Github [releases page]({{nym_vpn_releases}}) and download the CLI latest binary for your system
+
+2. Verify sha hash of your downloaded binary with the one listed on the [releases page]({{nym_vpn_releases}}). You can use a simple `shasum` command and compare strings (ie with Python) or run in the same directory the following command, exchanging `<SHA_STRING>` with the one of your binary, like in the example:
 ```sh
-curl -o execute-nym-vpn-cli-binary.sh -L https://gist.githubusercontent.com/tommyv1987/87267ded27e1eb7651aa9cc745ddf4af/raw/d39f98dbb36ccff761a7e940073388a6fe7b73fe/execute-nym-vpn-cli-binary.sh && chmod u+x execute-nym-vpn-cli-binary.sh && sudo -E ./execute-nym-vpn-cli-binary.sh
+echo "<SHA_STRING>" | shasum -a 256 -c
+
+# choose a correct one according to your binary, this is just an example
+# echo "0e4abb461e86b2c168577e0294112a3bacd3a24bf8565b49783bfebd9b530e23  nym-vpn-cli_<!-- cmdrun ../../../scripts/cmdrun/nym_vpn_cli_version.sh -->_ubuntu-22.04_amd64.tar.gz" | shasum -a 256 -c
 ```
 
-2. Follow the prompts in the program
+3. Extract files:
+```sh
+tar -xvf <BINARY>.tar.gz
+# for example
+# tar -xvf nym-vpn-cli_<!-- cmdrun ../../../scripts/cmdrun/nym_vpn_cli_version.sh -->_ubuntu-22.04_x86_64.tar.gz
+```
 
-3. The script will automatically start the client. Make sure to **turn off any other VPNs** and follow the prompts:
+## Running
 
-* It prints a JSON view of existing Gateways and prompt you to:
-    - *Make sure to use two different Gateways for entry and exit!*
-    - `enter a gateway ID:` paste one of the values labeled with a key `"identityKey"` printed above (without `" "`)
-    - `enter an exit address:` paste one of the values labeled with a key `"address"` printed above (without `" "`)
-    - `do you want five hop or two hop?`: type `five` or `two`
-    - `enable WireGuard? (yes/no):` if you chose yes, find your private key and wireguard IP [here](https://nymvpn.com/en/alpha)
+If you are running Debian/Ubuntu/PopOS or any other distributio supporting debian packages and systemd, see the [relevant section below](#debian-package-for-debianubuntupopos).
 
-To run `nym-vpn-cli` again, reconnect your wifi, move to the directory of your CLI binary `cd ~/nym-vpn-cli-dir` and follow the guide for [Linux](cli-linux.md#run-nymvpn) or [MacOS](cli-mac.md#run-nymvpn). If you find it too difficult, just run this script again - like in step \#3 above.
+### Daemon
 
-In case of errors check out the [troubleshooting](troubleshooting.md) section.
+Start the daemon with
+
+```sh
+sudo -E ./nym-vpnd
+```
+
+Then run
+
+```sh
+./nym-vpnc status
+./nym-vpnc connect
+./nym-vpnc disconnect
+```
+
+### CLI
+
+An alternative to the daemon is to run the `nym-vpn-cli` commandline client that runs in the foreground.
+```sh
+./nym-vpn-cli run
+```
+
+## Credentials
+
+NymVPN uses [zkNym bandwidth credentials](https://nymtech.net/docs/bandwidth-credentials.html). Those can be imported as a file or base58 encoded string.
+
+
+```sh
+sudo -E ./nym-vpn-cli import-credential --credential-path </PATH/TO/freepass.nym>
+sudo -E ./nym-vpn-cli import-credential --credential-data "<STRING>"
+```
+
+## Debian package for Debian/Ubuntu/PopOS
+
+For linux platforms using deb packages and systemd, there are also debian packages.
+
+```sh
+sudo apt install ./nym-vpnd_<!-- cmdrun ../../../scripts/cmdrun/nym_vpn_cli_version.sh -->-1_amd64.deb ./nym-vpnc_<!-- cmdrun ../../../scripts/cmdrun/nym_vpn_cli_version.sh -->-1_amd64.deb
+
+# In case of error please substitute the correct version
+```
+
+Installing the `nym-vpnd` deb package starts a `nym-vpnd.service`. Check that the daemon is running with
+```sh
+systemctl status nym-vpnd.service
+```
+and check its logs with
+```sh
+sudo journalctl -u nym-vpnd.service -f
+```
+To stop the background service
+```sh
+systemctl stop nym-vpnd.service
+```
+It will start again on startup, so disable with
+```sh
+systemctl disable nym-vpnd.service
+```
+
+Interact with it with `nym-vpnc`
+```sh
+nym-vpnc status
+nym-vpnc connect
+nym-vpnc disconnect
+```
+
+## Commands & Options
+
+```admonish note
+Nym Exit Gateway functionality was implemented just recently and not all the Gateways are upgraded and ready to handle the VPN connections. If you want to make sure you are connecting to a Gateway with an embedded Network Requester, IP Packet Router and applied Nym exit policy, visit [harbourmaster.nymtech.net](https://harbourmaster.nymtech.net/) and search Gateways with all the functionalities enabled.
+```
+
+The basic syntax of `nym-vpn-cli` is:
+```sh
+# choose only one conditional --argument listed in {brackets}
+sudo ./nym-vpn-cli { --exit-router-address <EXIT_ROUTER_ADDRESS>|--exit-gateway-id <EXIT_GATEWAY_ID>|--exit-gateway-country <EXIT_GATEWAY_COUNTRY> }
+```
+
+To see all the possibilities run with `--help` flag:
+```sh
+./nym-vpn-cli --help
+```
+~~~admonish example collapsible=true title="Console output"
+```sh
+Usage: nym-vpn-cli [OPTIONS] <COMMAND>
+
+Commands:
+  run                Run the client
+  import-credential  Import credential
+  help               Print this message or the help of the given subcommand(s)
+
+Options:
+  -c, --config-env-file <CONFIG_ENV_FILE>  Path pointing to an env file describing the network
+      --data-path <DATA_PATH>              Path to the data directory of the mixnet client
+  -h, --help                               Print help
+  -V, --version                            Print version
+```
+~~~
+
+Here is a list of the options and their descriptions. Some are essential, some are more technical and not needed to be adjusted by users.
+
+**Fundamental commands and arguments**
+
+- `--entry-gateway-id`: paste one of the values labeled with a key `"identityKey"` (without `" "`)
+- `--exit-gateway-id`: paste one of the values labeled with a key `"identityKey"` (without `" "`)
+- `--exit-router-address`: paste one of the values labeled with a key `"address"` (without `" "`)
+- `--enable-wireguard`: Enable the wireguard traffic between the client and the entry gateway. NymVPN uses Mullvad libraries for wrapping `wireguard-go` and to setup local routing rules to route all traffic to the TUN virtual network device
+- `--wg-ip`: The address of the wireguard interface, you can get it [here](https://nymvpn.com/en/alpha)
+- `--private-key`: get your private key for testing purposes [here](https://nymvpn.com/en/alpha)
+- `--enable-two-hop` is a faster setup where the traffic is routed from the client to Entry Gateway and directly to Exit Gateway (default is 5-hops)
+
+**Advanced options**
+
+- `-c` is a path to an enviroment config, like [`sandbox.env`](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env)
+- `--enable-poisson`: Enables process rate limiting of outbound traffic (disabled by default). It means that NymVPN client will send packets at a steady stream to the Entry Gateway. By default it's on average one sphinx packet per 20ms, but there is some randomness (poisson distribution). When there are no real data to fill the sphinx packets with, cover packets are generated instead.
+- `--ip` is the IP address of the TUN device. That is the IP address of the local private network that is set up between local client and the Exit Gateway.
+- `--mtu`: The MTU of the TUN device. That is the max IP packet size of the local private network that is set up between local client and the Exit Gateway.
+- `--disable-routing`: Disable routing all traffic through the VPN TUN device.
+
+## Testnet environment
+
+If you want to run NymVPN CLI in Nym Sandbox environment, there are a few adjustments to be done:
+
+1. Create Sandbox environment config file by saving [this](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) as `sandbox.env` in the same directory as your NymVPN binaries:
+```sh
+curl -o sandbox.env -L https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env
+```
+
+2. Check available Gateways at [nymvpn.com/en/alpha/api/gateways](https://nymvpn.com/en/alpha/api/gateways)
+
+3. Run with a flag `-c`
+```sh
+sudo ./nym-vpn-cli -c <PATH_TO>/sandbox.env <--exit-router-address <EXIT_ROUTER_ADDRESS>|--exit-gateway-id <EXIT_GATEWAY_ID>|--exit-gateway-country <EXIT_GATEWAY_COUNTRY>>
+```

documentation/dev-portal/src/nymvpn/gui.md

@@ -1,12 +1,12 @@
 # NymVPN - Desktop (GUI)
 
 ```admonish info
-Our alpha testing round is done with participants at live workshop events. This guide will not work for everyone, as the NymVPN source code is not yet publicly accessible. The alpha testing is done on Nym testnet Sandbox environment, this configuration is limited and will not work in the future.
+Our alpha testing round is done with participants at live workshop events and the application in this stage may not work for everyone.
 
 **If you commit to test NymVPN alpha, please start with the [user research form]({{nym_vpn_form_url}}) where all the steps will be provided**. If you disagree with any of the conditions listed, please leave this page.
 ```
 
-This is the alpha version of NymVPN desktop application (GUI). A demo of how the client will look like for majority of day-to-day users.
+This is a desktop (GUI) version of NymVPN client. A demo of how the application will look like for majority of day-to-day users.
 
 Follow the simple [automated script](#automated-script-for-gui-installation) below to install and run NymVPN GUI. If the script didn't work for your distribution or you prefer to do a manual setup follow the steps in the guide for [Linux](gui-linux.md) or [MacOS](gui-mac.md) .
 
@@ -14,12 +14,12 @@ Visit NymVPN alpha latest [release page]({{nym_vpn_releases}}) to check sha sums
 
 ## Linux AppImage Automated Installation Method
 
-The latest releases contain `appimage.sh` script. This method makes the installation simple for Linux users who want to run NymVPN from AppImmage. Executing the command below will download the binary to `~/.local/bin` and verify the checksum.
+The latest releases contain `appimage.sh` script. This method makes the installation simple for Linux users who want to run NymVPN from AppImmage. Executing the command below will download the binary to `~/.local/bin` and verify the checksum:
 ```sh
 curl -fsSL https://github.com/nymtech/nym-vpn-client/releases/download/nym-vpn-desktop-v<!-- cmdrun scripts/nym_vpn_desktop_version.sh -->/appimage.sh | bash
 ```
 
-Run with the command
+Run with the command:
 ```sh
 sudo -E ~/.local/bin/nym-vpn.appimage
 ```

documentation/dev-portal/src/nymvpn/intro.md

@@ -2,21 +2,12 @@
 
 <div style="padding:56.25% 0 0 0;position:relative;"><iframe src="https://player.vimeo.com/video/897010658?h=1f55870fe6&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479" frameborder="0" allow="autoplay; fullscreen; picture-in-picture" style="position:absolute;top:0;left:0;width:100%;height:100%;" title="NYMVPN alpha demo 37C3"></iframe></div><script src="https://player.vimeo.com/api/player.js"></script>
 
-**Nym proudly presents NymVPN alpha** - a client that uses [Nym Mixnet](https://nymtech.net) to anonymise all of a user's internet traffic through either a 5-hop mixnet (for a full network privacy) or the faster 2-hop decentralised VPN (with some extra features).
+**NymVPN alpha** is a client that uses [Nym Mixnet](https://nymtech.net) to anonymise all of a user's internet traffic through either a 5-hop mixnet (for a full network privacy) or the faster 2-hop decentralised VPN (with some extra features).
 
 
-**You are invited to take part in the alpha testing** of this new application. The following pages provide a how-to guide, explaining steps to install and run NymVPN [CLI](cli.md) and [GUI](gui.md) on the Sandbox testnet environment.
+**You are invited to take part in the alpha testing** of this new application. Register for private testing round at [nymvpn.com](https://nymvpn.com/en), that will grant you access to the [download page](https://nymvpn.com/download). Visit [NymVPN Support & FAQ](https://nymvpn.com/en/support) or join the [NymVPN matrix channel](https://matrix.to/#/#NymVPN:nymtech.chat) if you have any questions, comments or blockers.
 
-**Here is how**
-
-1. Go to the NymVPN [testers form]({{nym_vpn_form_url}})
-2. Please consent to the GDPR so we can use the results
-3. To test the GUI, [go here](gui.md)
-4. To test the CLI, [go here](cli.md)
-5. Fill and submit the [form!]({{nym_vpn_form_url}})
-6. Join the [NymVPN matrix channel](https://matrix.to/#/#NymVPN:nymtech.chat) if you have any questions, comments or blockers
-
-***NymVPN alpha testing will last from 15th of January - 15th of February.***
+Checkout the [release page](https://github.com/nymtech/nym-vpn-client/releases) for available binaries.
 
 *NOTE: NymVPN alpha is experimental software for testing purposes only.*
 
@@ -37,16 +28,7 @@ client ───► Gateway ──┘  mix  │  mix  ┌─►mix ───►
                          mix  └─►mix──┘  mix
 ```
 
-Users can switch to 2-hop only mode, which is a faster but less private option. In this mode traffic is only sent between the two Gateways, and is not passed between Mix Nodes.
-
-The client can optionally do the first hop (local client to Entry Gateway) using Wireguard. NymVPN uses Mullvad libraries for wrapping `wireguard-go` and to setup local routing rules to route all traffic to the TUN virtual network device.
-
-## NymVPN Resources & Guides
-
-* [NymVPN webpage](https://nymvpn.com)
-* [Alpha release page]({{nym_vpn_releases}})
-* [NymVPN application (GUI) guide](gui.md)
-* [NymVPN Command Line Interface (CLI) guide](cli.md)
-* [Troubleshooting](troubleshooting.md)
-* [NymVPN FAQ](faq.md)
-* [NymVPN matrix channel](https://matrix.to/#/#NymVPN:nymtech.chat)
+Users can switch to 2-hop only mode, which is a faster but less private option. In this mode traffic is only sent between the two Gateways, and is not passed between Mix Nodes. It uses Mixnet Sphinx packets with shorter, fixed routes, which improve latency, but doesn't offer the same level of protection as the 5 hop mode.
+<!-- TO BE IMPLEMENTED:
+Users can switch to 2-hop only mode, which is a faster but less private option. In this mode traffic is only sent between the two Gateways, and is not passed between Mix Nodes. The client than use two wireguard tunnels with the entry and exit gateway, the Exit Gateway one being tunnelled itself through the entry gateway tunnel. NymVPN uses Mullvad libraries for wrapping `wireguard-go` and to setup local routing rules to route all traffic to the TUN virtual network device.
+-->

documentation/dev-portal/src/nymvpn/troubleshooting.md

@@ -2,6 +2,14 @@
 
 Below are listed some points which may need to be addressed when testing NymVPN alpha. If you crashed into any errors which are not listed, please contact us at the testing workshop or in the NymVPN [Matrix channel](https://matrix.to/#/#NymVPN:nymtech.chat).
 
+#### NymVPN attempts to connect to sandbox testnet
+
+If you testing the latest versions and you correctly expect the client to run over the mainnet, but it listens to `https://sandbox-nym-api1.nymtech.net`, it's probably because of your previous configuration.
+
+Check your `config.toml` either in the directory from which you run your client or in `~/.config/nym-vpn/` and remove `sandbox.env` from the config file and folder.
+
+If the problem persists (probably due to some locally cache) download [`mainnet.env`](https://github.com/nymtech/nym/blob/master/envs/mainnet.env) and save it to the same directory.
+
 #### Running GUI failed due to `TOML parse error`
 
 If you see this error when running NymVPN alpha desktop, it's because the older versions needed entry location in `config.toml` configuration file. From `v0.0.3` the entry location is selected directly by the user in the application. This error is due to an old `app-data.toml` config in your computer.

documentation/docs/book.toml

@@ -25,7 +25,7 @@ turn-off = true
 
 [preprocessor.admonish]
 command = "mdbook-admonish"
-assets_version = "3.0.0" # do not edit: managed by `mdbook-admonish install`
+assets_version = "3.0.2" # do not edit: managed by `mdbook-admonish install`
 
 # https://gitlab.com/tglman/mdbook-variables/
 [preprocessor.variables.variables]

documentation/docs/nym_themes/mdbook-admonish.css

@@ -1,20 +1,4 @@
 @charset "UTF-8";
-:root {
-  --md-admonition-icon--admonish-note: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z'/></svg>");
-  --md-admonition-icon--admonish-abstract: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17 9H7V7h10m0 6H7v-2h10m-3 6H7v-2h7M12 3a1 1 0 0 1 1 1 1 1 0 0 1-1 1 1 1 0 0 1-1-1 1 1 0 0 1 1-1m7 0h-4.18C14.4 1.84 13.3 1 12 1c-1.3 0-2.4.84-2.82 2H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2z'/></svg>");
-  --md-admonition-icon--admonish-info: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 9h-2V7h2m0 10h-2v-6h2m-1-9A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10A10 10 0 0 0 12 2z'/></svg>");
-  --md-admonition-icon--admonish-tip: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17.66 11.2c-.23-.3-.51-.56-.77-.82-.67-.6-1.43-1.03-2.07-1.66C13.33 7.26 13 4.85 13.95 3c-.95.23-1.78.75-2.49 1.32-2.59 2.08-3.61 5.75-2.39 8.9.04.1.08.2.08.33 0 .22-.15.42-.35.5-.23.1-.47.04-.66-.12a.58.58 0 0 1-.14-.17c-1.13-1.43-1.31-3.48-.55-5.12C5.78 10 4.87 12.3 5 14.47c.06.5.12 1 .29 1.5.14.6.41 1.2.71 1.73 1.08 1.73 2.95 2.97 4.96 3.22 2.14.27 4.43-.12 6.07-1.6 1.83-1.66 2.47-4.32 1.53-6.6l-.13-.26c-.21-.46-.77-1.26-.77-1.26m-3.16 6.3c-.28.24-.74.5-1.1.6-1.12.4-2.24-.16-2.9-.82 1.19-.28 1.9-1.16 2.11-2.05.17-.8-.15-1.46-.28-2.23-.12-.74-.1-1.37.17-2.06.19.38.39.76.63 1.06.77 1 1.98 1.44 2.24 2.8.04.14.06.28.06.43.03.82-.33 1.72-.93 2.27z'/></svg>");
-  --md-admonition-icon--admonish-success: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m9 20.42-6.21-6.21 2.83-2.83L9 14.77l9.88-9.89 2.83 2.83L9 20.42z'/></svg>");
-  --md-admonition-icon--admonish-question: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m15.07 11.25-.9.92C13.45 12.89 13 13.5 13 15h-2v-.5c0-1.11.45-2.11 1.17-2.83l1.24-1.26c.37-.36.59-.86.59-1.41a2 2 0 0 0-2-2 2 2 0 0 0-2 2H8a4 4 0 0 1 4-4 4 4 0 0 1 4 4 3.2 3.2 0 0 1-.93 2.25M13 19h-2v-2h2M12 2A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10c0-5.53-4.5-10-10-10z'/></svg>");
-  --md-admonition-icon--admonish-warning: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 14h-2V9h2m0 9h-2v-2h2M1 21h22L12 2 1 21z'/></svg>");
-  --md-admonition-icon--admonish-failure: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20 6.91 17.09 4 12 9.09 6.91 4 4 6.91 9.09 12 4 17.09 6.91 20 12 14.91 17.09 20 20 17.09 14.91 12 20 6.91z'/></svg>");
-  --md-admonition-icon--admonish-danger: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M11 15H6l7-14v8h5l-7 14v-8z'/></svg>");
-  --md-admonition-icon--admonish-bug: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 12h-4v-2h4m0 6h-4v-2h4m6-6h-2.81a5.985 5.985 0 0 0-1.82-1.96L17 4.41 15.59 3l-2.17 2.17a6.002 6.002 0 0 0-2.83 0L8.41 3 7 4.41l1.62 1.63C7.88 6.55 7.26 7.22 6.81 8H4v2h2.09c-.05.33-.09.66-.09 1v1H4v2h2v1c0 .34.04.67.09 1H4v2h2.81c1.04 1.79 2.97 3 5.19 3s4.15-1.21 5.19-3H20v-2h-2.09c.05-.33.09-.66.09-1v-1h2v-2h-2v-1c0-.34-.04-.67-.09-1H20V8z'/></svg>");
-  --md-admonition-icon--admonish-example: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M7 13v-2h14v2H7m0 6v-2h14v2H7M7 7V5h14v2H7M3 8V5H2V4h2v4H3m-1 9v-1h3v4H2v-1h2v-.5H3v-1h1V17H2m2.25-7a.75.75 0 0 1 .75.75c0 .2-.08.39-.21.52L3.12 13H5v1H2v-.92L4 11H2v-1h2.25z'/></svg>");
-  --md-admonition-icon--admonish-quote: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 17h3l2-4V7h-6v6h3M6 17h3l2-4V7H5v6h3l-2 4z'/></svg>");
-  --md-details-icon: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M8.59 16.58 13.17 12 8.59 7.41 10 6l6 6-6 6-1.41-1.42Z'/></svg>");
-}
-
 :is(.admonition) {
   display: flow-root;
   margin: 1.5625em 0;
@@ -71,6 +55,8 @@ a.admonition-anchor-link::before {
   padding-inline: 4.4rem 1.2rem;
   font-weight: 700;
   background-color: rgba(68, 138, 255, 0.1);
+  print-color-adjust: exact;
+  -webkit-print-color-adjust: exact;
   display: flex;
 }
 :is(.admonition-title, summary.admonition-title) p {
@@ -86,6 +72,8 @@ html :is(.admonition-title, summary.admonition-title):last-child {
   width: 2rem;
   height: 2rem;
   background-color: #448aff;
+  print-color-adjust: exact;
+  -webkit-print-color-adjust: exact;
   mask-image: url('data:image/svg+xml;charset=utf-8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>');
   -webkit-mask-image: url('data:image/svg+xml;charset=utf-8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>');
   mask-repeat: no-repeat;
@@ -119,6 +107,25 @@ details[open].admonition > summary.admonition-title::after {
   transform: rotate(90deg);
 }
 
+:root {
+  --md-details-icon: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M8.59 16.58 13.17 12 8.59 7.41 10 6l6 6-6 6-1.41-1.42Z'/></svg>");
+}
+
+:root {
+  --md-admonition-icon--admonish-note: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z'/></svg>");
+  --md-admonition-icon--admonish-abstract: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17 9H7V7h10m0 6H7v-2h10m-3 6H7v-2h7M12 3a1 1 0 0 1 1 1 1 1 0 0 1-1 1 1 1 0 0 1-1-1 1 1 0 0 1 1-1m7 0h-4.18C14.4 1.84 13.3 1 12 1c-1.3 0-2.4.84-2.82 2H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2z'/></svg>");
+  --md-admonition-icon--admonish-info: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 9h-2V7h2m0 10h-2v-6h2m-1-9A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10A10 10 0 0 0 12 2z'/></svg>");
+  --md-admonition-icon--admonish-tip: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17.66 11.2c-.23-.3-.51-.56-.77-.82-.67-.6-1.43-1.03-2.07-1.66C13.33 7.26 13 4.85 13.95 3c-.95.23-1.78.75-2.49 1.32-2.59 2.08-3.61 5.75-2.39 8.9.04.1.08.2.08.33 0 .22-.15.42-.35.5-.23.1-.47.04-.66-.12a.58.58 0 0 1-.14-.17c-1.13-1.43-1.31-3.48-.55-5.12C5.78 10 4.87 12.3 5 14.47c.06.5.12 1 .29 1.5.14.6.41 1.2.71 1.73 1.08 1.73 2.95 2.97 4.96 3.22 2.14.27 4.43-.12 6.07-1.6 1.83-1.66 2.47-4.32 1.53-6.6l-.13-.26c-.21-.46-.77-1.26-.77-1.26m-3.16 6.3c-.28.24-.74.5-1.1.6-1.12.4-2.24-.16-2.9-.82 1.19-.28 1.9-1.16 2.11-2.05.17-.8-.15-1.46-.28-2.23-.12-.74-.1-1.37.17-2.06.19.38.39.76.63 1.06.77 1 1.98 1.44 2.24 2.8.04.14.06.28.06.43.03.82-.33 1.72-.93 2.27z'/></svg>");
+  --md-admonition-icon--admonish-success: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m9 20.42-6.21-6.21 2.83-2.83L9 14.77l9.88-9.89 2.83 2.83L9 20.42z'/></svg>");
+  --md-admonition-icon--admonish-question: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m15.07 11.25-.9.92C13.45 12.89 13 13.5 13 15h-2v-.5c0-1.11.45-2.11 1.17-2.83l1.24-1.26c.37-.36.59-.86.59-1.41a2 2 0 0 0-2-2 2 2 0 0 0-2 2H8a4 4 0 0 1 4-4 4 4 0 0 1 4 4 3.2 3.2 0 0 1-.93 2.25M13 19h-2v-2h2M12 2A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10c0-5.53-4.5-10-10-10z'/></svg>");
+  --md-admonition-icon--admonish-warning: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 14h-2V9h2m0 9h-2v-2h2M1 21h22L12 2 1 21z'/></svg>");
+  --md-admonition-icon--admonish-failure: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20 6.91 17.09 4 12 9.09 6.91 4 4 6.91 9.09 12 4 17.09 6.91 20 12 14.91 17.09 20 20 17.09 14.91 12 20 6.91z'/></svg>");
+  --md-admonition-icon--admonish-danger: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M11 15H6l7-14v8h5l-7 14v-8z'/></svg>");
+  --md-admonition-icon--admonish-bug: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 12h-4v-2h4m0 6h-4v-2h4m6-6h-2.81a5.985 5.985 0 0 0-1.82-1.96L17 4.41 15.59 3l-2.17 2.17a6.002 6.002 0 0 0-2.83 0L8.41 3 7 4.41l1.62 1.63C7.88 6.55 7.26 7.22 6.81 8H4v2h2.09c-.05.33-.09.66-.09 1v1H4v2h2v1c0 .34.04.67.09 1H4v2h2.81c1.04 1.79 2.97 3 5.19 3s4.15-1.21 5.19-3H20v-2h-2.09c.05-.33.09-.66.09-1v-1h2v-2h-2v-1c0-.34-.04-.67-.09-1H20V8z'/></svg>");
+  --md-admonition-icon--admonish-example: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M7 13v-2h14v2H7m0 6v-2h14v2H7M7 7V5h14v2H7M3 8V5H2V4h2v4H3m-1 9v-1h3v4H2v-1h2v-.5H3v-1h1V17H2m2.25-7a.75.75 0 0 1 .75.75c0 .2-.08.39-.21.52L3.12 13H5v1H2v-.92L4 11H2v-1h2.25z'/></svg>");
+  --md-admonition-icon--admonish-quote: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 17h3l2-4V7h-6v6h3M6 17h3l2-4V7H5v6h3l-2 4z'/></svg>");
+}
+
 :is(.admonition):is(.admonish-note) {
   border-color: #448aff;
 }

documentation/install_mdbook_deps.sh

@@ -13,12 +13,12 @@ declare -a plugins=("admonish" "linkcheck" "last-changed" "theme" "variables" "c
 
 # install mdbook + plugins
 install_mdbook_deps() {
-	printf "\ninstalling mdbook..." 
-	# installing mdbook with only specific features for speed 
+	printf "\ninstalling mdbook..."
+	# installing mdbook with only specific features for speed
 #  cargo install mdbook --no-default-features --features search --vers "^$MINOR_VERSION"
 	cargo install mdbook --vers "^$MINOR_VERSION"
 
-	printf "\ninstalling plugins..." 
+	printf "\ninstalling plugins..."
 	for i in "${plugins[@]}"
 	do
 		cargo install mdbook-$i
@@ -41,13 +41,13 @@ install_mdbook_deps() {
 # uninstall mdbook + plugins
 uninstall_mdbook_deps() {
 	# mdbook
-	printf "\nuninstalling existing mdbook installation...\n" 
-	cargo uninstall mdbook 
-	# check it worked 
+	printf "\nuninstalling existing mdbook installation...\n"
+	cargo uninstall mdbook
+	# check it worked
 	if [ $? -ne 0 ]; then
 		printf "\nsomething went wrong, exiting"
 		exit 1
-	else 
+	else
 		printf "\nmdbook deleted\n"
 	fi
 
@@ -57,10 +57,10 @@ uninstall_mdbook_deps() {
 	do
 		cargo uninstall mdbook-$i
 		# check it worked
-		if [ $? -ne 0 ]; then 
+		if [ $? -ne 0 ]; then
 			printf "\nsomething went wrong, exiting"
 			exit 1
-		else 
+		else
 		printf "\nmdbook-$i deleted\n"
 	fi
 	done
@@ -71,10 +71,10 @@ main() {
 		printf "mdbook already installed (located at: $(which mdbook))"
 		uninstall_mdbook_deps;
 		install_mdbook_deps;
-	else 
+	else
 		printf "mdbook not installed"
 		install_mdbook_deps;
 	fi
 }
 
-main; 
+main;

documentation/operators/book.toml

@@ -24,7 +24,7 @@ turn-off = true
 
 [preprocessor.admonish]
 command = "mdbook-admonish"
-assets_version = "3.0.0" # do not edit: managed by `mdbook-admonish install`
+assets_version = "3.0.2" # do not edit: managed by `mdbook-admonish install`
 
 # https://gitlab.com/tglman/mdbook-variables/
 [preprocessor.variables.variables]

documentation/operators/nym_themes/mdbook-admonish.css

@@ -1,20 +1,4 @@
 @charset "UTF-8";
-:root {
-  --md-admonition-icon--admonish-note: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z'/></svg>");
-  --md-admonition-icon--admonish-abstract: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17 9H7V7h10m0 6H7v-2h10m-3 6H7v-2h7M12 3a1 1 0 0 1 1 1 1 1 0 0 1-1 1 1 1 0 0 1-1-1 1 1 0 0 1 1-1m7 0h-4.18C14.4 1.84 13.3 1 12 1c-1.3 0-2.4.84-2.82 2H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2z'/></svg>");
-  --md-admonition-icon--admonish-info: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 9h-2V7h2m0 10h-2v-6h2m-1-9A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10A10 10 0 0 0 12 2z'/></svg>");
-  --md-admonition-icon--admonish-tip: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17.66 11.2c-.23-.3-.51-.56-.77-.82-.67-.6-1.43-1.03-2.07-1.66C13.33 7.26 13 4.85 13.95 3c-.95.23-1.78.75-2.49 1.32-2.59 2.08-3.61 5.75-2.39 8.9.04.1.08.2.08.33 0 .22-.15.42-.35.5-.23.1-.47.04-.66-.12a.58.58 0 0 1-.14-.17c-1.13-1.43-1.31-3.48-.55-5.12C5.78 10 4.87 12.3 5 14.47c.06.5.12 1 .29 1.5.14.6.41 1.2.71 1.73 1.08 1.73 2.95 2.97 4.96 3.22 2.14.27 4.43-.12 6.07-1.6 1.83-1.66 2.47-4.32 1.53-6.6l-.13-.26c-.21-.46-.77-1.26-.77-1.26m-3.16 6.3c-.28.24-.74.5-1.1.6-1.12.4-2.24-.16-2.9-.82 1.19-.28 1.9-1.16 2.11-2.05.17-.8-.15-1.46-.28-2.23-.12-.74-.1-1.37.17-2.06.19.38.39.76.63 1.06.77 1 1.98 1.44 2.24 2.8.04.14.06.28.06.43.03.82-.33 1.72-.93 2.27z'/></svg>");
-  --md-admonition-icon--admonish-success: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m9 20.42-6.21-6.21 2.83-2.83L9 14.77l9.88-9.89 2.83 2.83L9 20.42z'/></svg>");
-  --md-admonition-icon--admonish-question: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m15.07 11.25-.9.92C13.45 12.89 13 13.5 13 15h-2v-.5c0-1.11.45-2.11 1.17-2.83l1.24-1.26c.37-.36.59-.86.59-1.41a2 2 0 0 0-2-2 2 2 0 0 0-2 2H8a4 4 0 0 1 4-4 4 4 0 0 1 4 4 3.2 3.2 0 0 1-.93 2.25M13 19h-2v-2h2M12 2A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10c0-5.53-4.5-10-10-10z'/></svg>");
-  --md-admonition-icon--admonish-warning: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 14h-2V9h2m0 9h-2v-2h2M1 21h22L12 2 1 21z'/></svg>");
-  --md-admonition-icon--admonish-failure: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20 6.91 17.09 4 12 9.09 6.91 4 4 6.91 9.09 12 4 17.09 6.91 20 12 14.91 17.09 20 20 17.09 14.91 12 20 6.91z'/></svg>");
-  --md-admonition-icon--admonish-danger: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M11 15H6l7-14v8h5l-7 14v-8z'/></svg>");
-  --md-admonition-icon--admonish-bug: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 12h-4v-2h4m0 6h-4v-2h4m6-6h-2.81a5.985 5.985 0 0 0-1.82-1.96L17 4.41 15.59 3l-2.17 2.17a6.002 6.002 0 0 0-2.83 0L8.41 3 7 4.41l1.62 1.63C7.88 6.55 7.26 7.22 6.81 8H4v2h2.09c-.05.33-.09.66-.09 1v1H4v2h2v1c0 .34.04.67.09 1H4v2h2.81c1.04 1.79 2.97 3 5.19 3s4.15-1.21 5.19-3H20v-2h-2.09c.05-.33.09-.66.09-1v-1h2v-2h-2v-1c0-.34-.04-.67-.09-1H20V8z'/></svg>");
-  --md-admonition-icon--admonish-example: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M7 13v-2h14v2H7m0 6v-2h14v2H7M7 7V5h14v2H7M3 8V5H2V4h2v4H3m-1 9v-1h3v4H2v-1h2v-.5H3v-1h1V17H2m2.25-7a.75.75 0 0 1 .75.75c0 .2-.08.39-.21.52L3.12 13H5v1H2v-.92L4 11H2v-1h2.25z'/></svg>");
-  --md-admonition-icon--admonish-quote: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 17h3l2-4V7h-6v6h3M6 17h3l2-4V7H5v6h3l-2 4z'/></svg>");
-  --md-details-icon: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M8.59 16.58 13.17 12 8.59 7.41 10 6l6 6-6 6-1.41-1.42Z'/></svg>");
-}
-
 :is(.admonition) {
   display: flow-root;
   margin: 1.5625em 0;
@@ -71,6 +55,8 @@ a.admonition-anchor-link::before {
   padding-inline: 4.4rem 1.2rem;
   font-weight: 700;
   background-color: rgba(68, 138, 255, 0.1);
+  print-color-adjust: exact;
+  -webkit-print-color-adjust: exact;
   display: flex;
 }
 :is(.admonition-title, summary.admonition-title) p {
@@ -86,6 +72,8 @@ html :is(.admonition-title, summary.admonition-title):last-child {
   width: 2rem;
   height: 2rem;
   background-color: #448aff;
+  print-color-adjust: exact;
+  -webkit-print-color-adjust: exact;
   mask-image: url('data:image/svg+xml;charset=utf-8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>');
   -webkit-mask-image: url('data:image/svg+xml;charset=utf-8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>');
   mask-repeat: no-repeat;
@@ -119,6 +107,25 @@ details[open].admonition > summary.admonition-title::after {
   transform: rotate(90deg);
 }
 
+:root {
+  --md-details-icon: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M8.59 16.58 13.17 12 8.59 7.41 10 6l6 6-6 6-1.41-1.42Z'/></svg>");
+}
+
+:root {
+  --md-admonition-icon--admonish-note: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z'/></svg>");
+  --md-admonition-icon--admonish-abstract: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17 9H7V7h10m0 6H7v-2h10m-3 6H7v-2h7M12 3a1 1 0 0 1 1 1 1 1 0 0 1-1 1 1 1 0 0 1-1-1 1 1 0 0 1 1-1m7 0h-4.18C14.4 1.84 13.3 1 12 1c-1.3 0-2.4.84-2.82 2H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2z'/></svg>");
+  --md-admonition-icon--admonish-info: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 9h-2V7h2m0 10h-2v-6h2m-1-9A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10A10 10 0 0 0 12 2z'/></svg>");
+  --md-admonition-icon--admonish-tip: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17.66 11.2c-.23-.3-.51-.56-.77-.82-.67-.6-1.43-1.03-2.07-1.66C13.33 7.26 13 4.85 13.95 3c-.95.23-1.78.75-2.49 1.32-2.59 2.08-3.61 5.75-2.39 8.9.04.1.08.2.08.33 0 .22-.15.42-.35.5-.23.1-.47.04-.66-.12a.58.58 0 0 1-.14-.17c-1.13-1.43-1.31-3.48-.55-5.12C5.78 10 4.87 12.3 5 14.47c.06.5.12 1 .29 1.5.14.6.41 1.2.71 1.73 1.08 1.73 2.95 2.97 4.96 3.22 2.14.27 4.43-.12 6.07-1.6 1.83-1.66 2.47-4.32 1.53-6.6l-.13-.26c-.21-.46-.77-1.26-.77-1.26m-3.16 6.3c-.28.24-.74.5-1.1.6-1.12.4-2.24-.16-2.9-.82 1.19-.28 1.9-1.16 2.11-2.05.17-.8-.15-1.46-.28-2.23-.12-.74-.1-1.37.17-2.06.19.38.39.76.63 1.06.77 1 1.98 1.44 2.24 2.8.04.14.06.28.06.43.03.82-.33 1.72-.93 2.27z'/></svg>");
+  --md-admonition-icon--admonish-success: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m9 20.42-6.21-6.21 2.83-2.83L9 14.77l9.88-9.89 2.83 2.83L9 20.42z'/></svg>");
+  --md-admonition-icon--admonish-question: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m15.07 11.25-.9.92C13.45 12.89 13 13.5 13 15h-2v-.5c0-1.11.45-2.11 1.17-2.83l1.24-1.26c.37-.36.59-.86.59-1.41a2 2 0 0 0-2-2 2 2 0 0 0-2 2H8a4 4 0 0 1 4-4 4 4 0 0 1 4 4 3.2 3.2 0 0 1-.93 2.25M13 19h-2v-2h2M12 2A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10c0-5.53-4.5-10-10-10z'/></svg>");
+  --md-admonition-icon--admonish-warning: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 14h-2V9h2m0 9h-2v-2h2M1 21h22L12 2 1 21z'/></svg>");
+  --md-admonition-icon--admonish-failure: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20 6.91 17.09 4 12 9.09 6.91 4 4 6.91 9.09 12 4 17.09 6.91 20 12 14.91 17.09 20 20 17.09 14.91 12 20 6.91z'/></svg>");
+  --md-admonition-icon--admonish-danger: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M11 15H6l7-14v8h5l-7 14v-8z'/></svg>");
+  --md-admonition-icon--admonish-bug: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 12h-4v-2h4m0 6h-4v-2h4m6-6h-2.81a5.985 5.985 0 0 0-1.82-1.96L17 4.41 15.59 3l-2.17 2.17a6.002 6.002 0 0 0-2.83 0L8.41 3 7 4.41l1.62 1.63C7.88 6.55 7.26 7.22 6.81 8H4v2h2.09c-.05.33-.09.66-.09 1v1H4v2h2v1c0 .34.04.67.09 1H4v2h2.81c1.04 1.79 2.97 3 5.19 3s4.15-1.21 5.19-3H20v-2h-2.09c.05-.33.09-.66.09-1v-1h2v-2h-2v-1c0-.34-.04-.67-.09-1H20V8z'/></svg>");
+  --md-admonition-icon--admonish-example: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M7 13v-2h14v2H7m0 6v-2h14v2H7M7 7V5h14v2H7M3 8V5H2V4h2v4H3m-1 9v-1h3v4H2v-1h2v-.5H3v-1h1V17H2m2.25-7a.75.75 0 0 1 .75.75c0 .2-.08.39-.21.52L3.12 13H5v1H2v-.92L4 11H2v-1h2.25z'/></svg>");
+  --md-admonition-icon--admonish-quote: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 17h3l2-4V7h-6v6h3M6 17h3l2-4V7H5v6h3l-2 4z'/></svg>");
+}
+
 :is(.admonition):is(.admonish-note) {
   border-color: #448aff;
 }

documentation/operators/src/SUMMARY.md

@@ -2,6 +2,7 @@
 # Summary
 
 - [Introduction](introduction.md)
+- [Changelog](changelog.md)
 
 # Binaries
 
@@ -12,13 +13,17 @@
 
 # Operators Guides
 
-- [Mixnet Nodes Setup](nodes/setup-guides.md)
-    - [Preliminary Steps](preliminary-steps.md)
-    - [Mix Node](nodes/mix-node-setup.md)
-    - [Gateway](nodes/gateway-setup.md)
-    - [Network Requester](nodes/network-requester-setup.md)
+- [Preliminary Steps](nodes/preliminary-steps.md)
+  - [Nym Wallet Preparation](nodes/wallet-preparation.md)
+  - [VPS Setup](nodes/vps-setup.md)
+- [Nym Node](nodes/nym-node.md)
+  - [Setup & Run](nodes/setup.md)
+  - [Configuration](nodes/configuration.md)
+      - [WSS & Reversed Proxy](nodes/proxy-configuration.md)
+  - [Bonding](nodes/bonding.md)
 - [Nyx Validator Setup](nodes/validator-setup.md)
   - [Nym API Setup](nodes/nym-api.md)
+  - [Validator & API Configuration](nodes/nyx-configuration.md)
 - [Maintenance](nodes/maintenance.md)
   - [Manual Node Upgrade](nodes/manual-upgrade.md)
   - [Automatic Node Upgrade: Nymvisor Setup and Usage](nodes/nymvisor-upgrade.md)
@@ -28,12 +33,12 @@
   - [Prometheus & Grafana](testing/prometheus-grafana.md)
     - [ExploreNYM scripts](testing/explorenym-scripts.md)
 <!--    - [Run in a Docker](testing/docker-monitor.md) -->
-- [Troubleshooting](nodes/troubleshooting.md)
-<!--
-  - [Nym Nodes]()
-  - [Validators]
-  - [Binary]
--->
+
+# Troubleshooting
+
+- [VPS Setup](troubleshooting/vps-isp.md)
+- [Nym Node](troubleshooting/nodes.md)
+- [Validators](troubleshooting/validators.md)
 
 # Token Economics
 
@@ -43,10 +48,11 @@
 
 # FAQ
 
-- [Mix Nodes](faq/mixnodes-faq.md)
-- [Project Smoosh](faq/smoosh-faq.md)
+- [General Operators FAQ](faq/general-faq.md)
+- [Nym Nodes](faq/nym-nodes-faq.md)
+- [Nyx & Validators](faq/nyx-faq.md)
 
-# Legal Forum
+# Community & Legal Forum
 
 - [Exit Gateway](legal/exit-gateway.md)
 - [Community Counsel](legal/community-counsel.md)
@@ -56,6 +62,19 @@
     - [Landing Pages](legal/landing-pages.md)
 - [How to Add Info](legal/add-content.md)
 
+---
+# Archive
+
+- [Why archive?](archive/archive.md)
+- [Mixnet Nodes Setup](archive/nodes/setup-guides.md)
+    - [Preliminary Steps](archive/nodes/initial-steps.md)
+    - [Mix Node](archive/nodes/mix-node-setup.md)
+    - [Gateway](archive/nodes/gateway-setup.md)
+    - [Network Requester](archive/nodes/network-requester-setup.md)
+- [FAQ: Mix Nodes](archive/faq/mixnodes-faq.md)
+- [FAQ: Project Smoosh](archive/faq/smoosh-faq.md)
+
+
 ---
 # Misc.
 - [Code of Conduct](coc.md)

documentation/operators/src/archive/archive.md

@@ -0,0 +1,7 @@
+# Archived Pages
+
+This section contains old but still relevant pages/guides, archived for backwards compatibility. The content of the pages is not updated. See the top of every page informing you about the last time of update. 
+
+Pages listed in archive section will eventually be terminated as they will become completely irrelevant with time.
+
+

documentation/operators/src/archive/faq/mixnodes-faq.md

@@ -1,5 +1,9 @@
 # Frequently Asked Questions
 
+```admonish warning
+**This is an archived page for backwards compatibility. The content of this page is not updated since April 19th 2024. Eventually this page will be terminated!**
+```
+
 ## Nym Mixnet
 
 To see different stats about Nym Mixnet live, we recommend you to visit [status.notrustverify.ch](https://status.notrustverify.ch/d/CW3L7dVVk/nym-mixnet?orgId=1) built by [No Trust Verify](https://notrustverify.ch/) crew, one of the squads within Nym core community.
@@ -32,7 +36,6 @@ The rewarded nodes are the nodes which will receive some rewards by the end of t
 
 2. Standby: Bottom *N* nodes of the rewarded set, they don't mix data from the clients but are used for testing. Their reward is smaller.
 
-
 For more detailed calculation, read our blog post [Nym Token Economics update](https://blog.nymtech.net/nym-token-economics-update-fedff0ed5267). More info on staking can be found [here](https://blog.nymtech.net/staking-in-nym-introducing-mainnet-mixmining-f9bb1cbc7c36). And [here](https://blog.nymtech.net/want-to-stake-in-nym-here-is-how-to-choose-a-mix-node-to-delegate-nym-to-c3b862add165) is more info on how to choose a Mix Node for delegation. And finally an [update](https://blog.nymtech.net/quarterly-token-economic-parameter-update-b2862948710f) on token economics from July 2023.
 
 <iframe src="https://status.notrustverify.ch/d-solo/CW3L7dVVk/nym-mixnet?orgId=1&from=1703074829887&to=1705666829887&panelId=31" width="850" height="400" frameborder="0"></iframe>
@@ -57,7 +60,7 @@ Because of the way the smart contract works we keep it one-node one-address at t
 
 ### Which nodes are the most needed to be setup to strengthen Nym infrastructure and which ones bring rewards?
 
-Ath this point the most crutial component needed are [Exit Gateways](../legal/exit-gateway.md).
+Ath this point the most crutial component needed are [Exit Gateways](../../legal/exit-gateway.md).
 
 ### Are Mix Nodes whitelisted?
 

documentation/operators/src/archive/faq/smoosh-faq.md

@@ -1,37 +1,32 @@
 # Project Smoosh - FAQ
 
-> We aim on purpose to make minimal changes to reward scheme and software. We're just 'smooshing' together stuff we already debugged and know works.  
-> -- Harry Halpin,  Nym CEO  
+```admonish warning
+**This is an archived page for backwards compatibility. We have switched to [`nym-node` binary](../../nodes/nym-node.md), please [migrate](../../nodes/setup.md#migrate) your nodes. The content of this page is not updated since April 26th 2024. Eventually this page will be terminated!**
+```
+
+> We aim on purpose to make minimal changes to reward scheme and software. We're just 'smooshing' together stuff we already debugged and know works.
+> -- Harry Halpin,  Nym CEO
 
 <br>
 
-This page refer to the changes which are planned to take place over Q3 and Q4 2023. As this is a transition period in the beginning (Q3 2023) the [Mix Nodes FAQ page](mixnodes-faq.md) holds more answers to the current setup as project Smoosh refers to the eventual setup. As project Smoosh gets progressively implemented the answers on this page will become to be more relevant to the current state and eventually this FAQ page will be merged with the still relevant parts of the main Mix Nodes FAQ page. 
+This page refer to the changes which are planned to take place over Q3 and Q4 2023. As this is a transition period in the beginning (Q3 2023) the [Mix Nodes FAQ page](mixnodes-faq.md) holds more answers to the current setup as project Smoosh refers to the eventual setup. As project Smoosh gets progressively implemented the answers on this page will become to be more relevant to the current state and eventually this FAQ page will be merged with the still relevant parts of the main Mix Nodes FAQ page.
 
 If any questions are not answered or it's not clear for you in which stage project Smoosh is right now, please reach out in Node Operators [Matrix room](https://matrix.to/#/#operators:nymtech.chat).
 
-## Overview
-
-### What is project Smoosh?
-
-As we shared in our blog post article [*What does it take to build the wolds most powerful VPN*](https://blog.nymtech.net/what-does-it-take-to-build-the-worlds-most-powerful-vpn-d351a76ec4e6), project Smoosh is:  
-
-> A nick-name by CTO Dave Hrycyszyn and Chief Scientist Claudia Diaz for the work they are currently doing to “smoosh” Nym Nodes so that the same operator can serve alternately as Mix Node, Gateway or VPN node. This requires careful calibration of the Nym token economics, for example, only nodes with the highest reputation for good quality service will be in the VPN set and have the chance to earn higher rewards.
-> By simplifying the components, adding VPN features and supporting new node operators, the aim is to widen the geographical coverage of nodes and have significant redundancy, meaning plenty of operators to be able to meet demand. This requires strong token economic incentives as well as training and support for new node operators.
-
-## Technical Questions
 
 ### What are the changes?
 
 Project Smoosh will have four steps, please follow the table below to track the dynamic progress:
 
-| **Step** | **Status** |
-| :--- | :--- |
-| **1.** Combine the `nym-gateway` and `nym-network-requester` into one binary | ✅ done |
-| **2.** Create [Exit Gateway](../legal/exit-gateway.md): Take the `nym-gateway` binary including `nym-network-requester` combined in \#1 and switch from [`allowed.list`](https://nymtech.net/.wellknown/network-requester/standard-allowed-list.txt) to a new [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) | ✅ done |
-| **3.** Combine all the nodes in the Nym Mixnet into one binary, that is `nym-mixnode`, `nym-gateway` (entry and exit) and `nym-network-requester`. | 🛠️ in progress |
-| **4.** Adjust reward scheme to incentivise and reward Exit Gateways as a part of `nym-node` binary, implementing [zkNym credentials](https://youtu.be/nLmdsZ1BsQg?t=1717). | 🛠️ in progress |
+| **Step**                                                                                                                                                                                                                                                                                                                                         | **Status**     |
+| :---                                                                                                                                                                                                                                                                                                                                             | :---           |
+| **1.** Combine the `nym-gateway` and `nym-network-requester` into one binary                                                                                                                                                                                                                                                                     | ✅ done        |
+| **2.** Create [Exit Gateway](../../legal/exit-gateway.md): Take the `nym-gateway` binary including `nym-network-requester` combined in \#1 and switch from [`allowed.list`](https://nymtech.net/.wellknown/network-requester/standard-allowed-list.txt) to a new [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) | ✅ done        |
+| **3.** Combine all the nodes in the Nym Mixnet into one binary, that is `nym-mixnode`, `nym-gateway` (entry and exit) and `nym-network-requester`.                                                                                                                                                                                               | ✅ done        |
+| **4.** Adjust reward scheme to incentivise and reward Exit Gateways as a part of `nym-node` binary, implementing [zkNym credentials](https://youtu.be/nLmdsZ1BsQg?t=1717).                                                                                                                                                                       | 🛠️ in progress |
+| **5.** Implement multiple node functionalities into one `nym-node` connected to one Nyx account.                                                                                                                                                                                                                                                 | 🛠️ in progress |
 
-These steps will be staggered over time - period of several months, and will be implemented one by one with enough time to take in feedback and fix bugs in between.  
+These steps will be staggered over time - period of several months, and will be implemented one by one with enough time to take in feedback and fix bugs in between.
 Generally, the software will be the same, just instead of multiple binaries, there will be one Nym Node (`nym-node`) binary. Delegations will remain on as they are now, per our token economics (staking, saturation etc)
 
 ### What does it mean for Nym nodes operators?
@@ -44,7 +39,7 @@ We are exploring two potential methods for implementing binary functionality in
 
 ### Where can I read more about the Exit Gateway setup?
 
-We created an [entire page](../legal/exit-gateway.md) about the technical and legal questions around Exit Gateway. 
+We created an [entire page](../../legal/exit-gateway.md) about the technical and legal questions around Exit Gateway.
 
 ### What is the change from allow list to deny list?
 
@@ -57,8 +52,8 @@ Follow the dynamic progress of exit policy implementation on Gateways below:
 | **Step** | **Status** |
 | :--- | :--- |
 | **1.** By default the [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) filtering is disabled and the [`allowed.list`](https://nymtech.net/.wellknown/network-requester/standard-allowed-list.txt) filtering is going to continue be used. This is to prevent operators getting surprised by upgrading their Gateways (or Network Requesters) and suddenly be widely open to the internet. To enable the new exit policy, operators must use `--with-exit-policy` flag or modify the `config.toml` file. | ✅ done |
-| **2.** The exit policy is part of the Gateway setup by default. To disable this exit policy, operators must use `--disable-exit-policy` flag. | 🛠️ in progress |
-| **3.** The exit policy is the only option. The `allowed.list` is completely removed. | 🛠️ in progress |
+| **2.** The exit policy is part of the Gateway setup by default. To disable this exit policy, operators must use `--disable-exit-policy` flag. | ✅ done |
+| **3.** The exit policy is the only option. The `allowed.list` is completely removed. | ✅ done |
 
 Keep in mind the table above only relates to changes happening on Gateways. For the Project Smoosh progress refer to the [table above](./smoosh-faq.md#what-are-the-changes). Whether Exit Gateway functionality will be optional or mandatory part of every active Nym Node depends on the chosen [design](./smoosh-faq.md#what-does-it-mean-for-nym-nodes-operators).
 
@@ -86,9 +81,9 @@ This depends on [design](./smoosh-faq.md#what-does-it-mean-for-nym-nodes-operato
 
 As each operator can choose what roles their nodes provide, the nodes which work as open Gateways will have higher rewards because they are the most important to keep up and stable. Besides that the operators of Gateways may be exposed to more complication and possible legal risks.
 
-The nodes which are initialized to run as Mix Nodes and Gateways will be chosen to be on top of the active set before the ones working only as a Mix Node. 
+The nodes which are initialized to run as Mix Nodes and Gateways will be chosen to be on top of the active set before the ones working only as a Mix Node.
 
-I case we go with \#2, all nodes active in the epoch will be rewarded proportionally according their work. 
+I case we go with \#2, all nodes active in the epoch will be rewarded proportionally according their work.
 
 In either way, Nym will share all the specifics beforehand.
 
@@ -108,7 +103,6 @@ From an operator standpoint, it shall just be a standard Nym upgrade, a new opti
 
 ### Are there any legal concerns for the operators?
 
-So far the general line is that running a Gateway is not illegal (unless you are in Iran, China, and a few other places) and due to encryption/mixing less risky than running a normal VPN node. For Mix Nodes, it's very safe as they have "no idea" what packets they are mixing.  
-
-There are several legal questions and analysis to be made for different jurisdictions. To be able to share resources and findings between the operators themselves we created a [Community Legal Forum](../legal/exit-gateway.md). 
+So far the general line is that running a Gateway is not illegal (unless you are in Iran, China, and a few other places) and due to encryption/mixing less risky than running a normal VPN node. For Mix Nodes, it's very safe as they have "no idea" what packets they are mixing.
 
+There are several legal questions and analysis to be made for different jurisdictions. To be able to share resources and findings between the operators themselves we created a [Community Legal Forum](../../legal/exit-gateway.md).