Simplify pub key translatations

* bootstrap next app + add overview page

* fix AssetList type

* fix up nav stuff

* Refactor Nav component and add network components pages

* Refactor WorldMap component and update TelegramIcon, GitHubIcon, NymVpnIcon, DiscordIcon, and TwitterIcon components

* add service providers page

* mixnodes page

* delegations page + use material react table for all tables

* nodes map page

* Refactor StyledLink component and remove unnecessary console.log statements

* Refactor ESLint configuration, remove unused dependencies, and update component imports

* update deps

* Refactor imports and update dependencies

* fix dark mode

* build single mixnode page

* build single gateway page

* Refactor handleOnDelegate function to use useCallback in mixnodes page.tsx

* Add defaults for constants

---------

Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com>

.github/workflows/cd-docs.yml

@@ -9,7 +9,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler
+        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git
       - name: Install rsync
         run: sudo apt-get install rsync
       - uses: rlespinasse/github-slug-action@v3.x
@@ -30,9 +30,24 @@ jobs:
       - name: Remove existing Nym config directory (`~/.nym/`)
         run: cd documentation && ./remove_existing_config.sh
         continue-on-error: false
-      - name: Build all projects in documentation/ & move to ~/dist/docs/
+# This is the original flow
+#      - name: Build all projects in documentation/ & move to ~/dist/docs/
+#        run: cd documentation && ./build_all_to_dist.sh
+
+# This is a workaround replacement which builds on the last working commit b332a6b55668f60988e36961f3f62a794ba82ddb and then on current branch
+      - name: Save current branch to ~/current_branch
+        run: git rev-parse --abbrev-ref HEAD > ~/current_branch
+      - name: Git pull & switch to b332a6b55668f60988e36961f3f62a794ba82ddb
+        run: git pull && git checkout b332a6b55668f60988e36961f3f62a794ba82ddb
+      - name: Build all projects in documentation/ & move to ~/dist/docs/ from b332a6b55668f60988e36961f3f62a794ba82ddb
         run: cd documentation && ./build_all_to_dist.sh
-        continue-on-error: false
+
+      - name: Switch to current branch
+        run: git checkout $echo "$(cat ~/current_branch)"
+      - name: Build all projects in documentation/ & move to ~/dist/docs/ on current branch
+        run: cd documentation && ./build_all_to_dist.sh && rm ~/current_branch
+
+# End of replacemet
 
       - name: Post process
         run: cd documentation && ./post_process.sh

.github/workflows/ci-docs.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler
+        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git
       - name: Install rsync
         run: sudo apt-get install rsync
       - uses: rlespinasse/github-slug-action@v3.x
@@ -34,9 +34,25 @@ jobs:
       - name: Remove existing Nym config directory (`~/.nym/`)
         run: cd documentation && ./remove_existing_config.sh
         continue-on-error: false
-      - name: Build all projects in documentation/ & move to ~/dist/docs/
+
+# This is the original flow
+#      - name: Build all projects in documentation/ & move to ~/dist/docs/
+#        run: cd documentation && ./build_all_to_dist.sh
+
+# This is a workaround replacement which builds on the last working commit b332a6b55668f60988e36961f3f62a794ba82ddb and then on current branch
+      - name: Save current branch to ~/current_branch
+        run: git rev-parse --abbrev-ref HEAD > ~/current_branch
+      - name: Git pull & switch to b332a6b55668f60988e36961f3f62a794ba82ddb
+        run: git pull && git checkout b332a6b55668f60988e36961f3f62a794ba82ddb
+      - name: Build all projects in documentation/ & move to ~/dist/docs/ from b332a6b55668f60988e36961f3f62a794ba82ddb
         run: cd documentation && ./build_all_to_dist.sh
-        continue-on-error: false
+
+      - name: Switch to current branch
+        run: git checkout $echo "$(cat ~/current_branch)"
+      - name: Build all projects in documentation/ & move to ~/dist/docs/ on current branch
+        run: cd documentation && ./build_all_to_dist.sh && rm ~/current_branch
+
+# End of replacemet
 
       - name: Deploy branch to CI www
         continue-on-error: true

.github/workflows/publish-nym-binaries.yml

@@ -30,6 +30,7 @@ jobs:
       mixnode_hash: ${{ steps.binary-hashes.outputs.mixnode_hash }}
       gateway_hash: ${{ steps.binary-hashes.outputs.gateway_hash }}
       nymvisor_hash: ${{ steps.binary-hashes.outputs.nymvisor_hash }}
+      nymnode_hash: ${{ steps.binary-hashes.outputs.nymnode_hash }}
       socks5_hash: ${{ steps.binary-hashes.outputs.socks5_hash }}
       netreq_hash: ${{ steps.binary-hashes.outputs.netreq_hash }}
       cli_hash: ${{ steps.binary-hashes.outputs.cli_hash }}
@@ -38,6 +39,7 @@ jobs:
       mixnode_version: ${{ steps.binary-versions.outputs.mixnode_version }}
       gateway_version: ${{ steps.binary-versions.outputs.gateway_version }}
       nymvisor_version: ${{ steps.binary-versions.outputs.nymvisor_version }}
+      nymnode_version: ${{ steps.binary-versions.outputs.nymnode_version }}
       socks5_version: ${{ steps.binary-versions.outputs.socks5_version }}
       netreq_version: ${{ steps.binary-versions.outputs.netreq_version }}
       cli_version: ${{ steps.binary-versions.outputs.cli_version }}
@@ -81,6 +83,7 @@ jobs:
             target/release/nym-network-statistics
             target/release/nym-cli
             target/release/nymvisor
+            target/release/nym-node
           retention-days: 30
 
       - id: create-release
@@ -99,6 +102,7 @@ jobs:
             target/release/nym-network-statistics
             target/release/nym-cli
             target/release/nymvisor
+            target/release/nym-node
 
   push-release-data-client:
     if: ${{ (startsWith(github.ref, 'refs/tags/nym-binaries-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}

.github/workflows/publish-nym-wallet-macos.yml

@@ -102,6 +102,18 @@ jobs:
             nym-wallet/target/release/bundle/dmg/*.dmg
             nym-wallet/target/release/bundle/macos/*.app.tar.gz*
 
+      - name: Deploy artifacts to CI www
+        continue-on-error: true
+        uses: easingthemes/ssh-deploy@main
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
+          ARGS: "-avzr"
+          SOURCE: "nym-wallet/target/release/bundle/macos/nym-wallet.app.tar.gz"
+          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
+          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
+          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/builds/${{ github.ref_name }}/nym-wallet
+          EXCLUDE: "/dist/, /node_modules/"            
+
   push-release-data:
     if: ${{ (startsWith(github.ref, 'refs/tags/nym-wallet-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
     uses: ./.github/workflows/release-calculate-hash.yml

.github/workflows/publish-nym-wallet-ubuntu.yml

@@ -77,6 +77,18 @@ jobs:
             nym-wallet/target/release/bundle/appimage/*.AppImage
             nym-wallet/target/release/bundle/appimage/*.AppImage.tar.gz*
 
+      - name: Deploy artifacts to CI www
+        continue-on-error: true
+        uses: easingthemes/ssh-deploy@main
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
+          ARGS: "-avzr"
+          SOURCE: "nym-wallet/target/release/bundle/appimage/nym-wallet*.AppImage.tar.gz"
+          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
+          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
+          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/builds/${{ github.ref_name }}/nym-wallet
+          EXCLUDE: "/dist/, /node_modules/"               
+
   push-release-data:
     if: ${{ (startsWith(github.ref, 'refs/tags/nym-wallet-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
     uses: ./.github/workflows/release-calculate-hash.yml

.github/workflows/publish-nym-wallet-win10.yml

@@ -97,6 +97,18 @@ jobs:
             nym-wallet/target/release/bundle/msi/*.msi
             nym-wallet/target/release/bundle/msi/*.msi.zip*
 
+      - name: Deploy artifacts to CI www
+        continue-on-error: true
+        uses: easingthemes/ssh-deploy@main
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
+          ARGS: "-avzr"
+          SOURCE: "nym-wallet/target/release/bundle/msi/nym-wallet_1.*.msi"
+          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
+          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
+          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/builds/${{ github.ref_name }}/nym-wallet
+          EXCLUDE: "/dist/, /node_modules/"            
+
   push-release-data:
     if: ${{ (startsWith(github.ref, 'refs/tags/nym-wallet-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
     uses: ./.github/workflows/release-calculate-hash.yml

CHANGELOG.md

@@ -4,6 +4,30 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2024.4-nutella] (2024-05-08)
+
+- [fix] apply disable_poisson_rate from internal NR/IPR cfgs ([#4579])
+- updating sign commands to include nym-node ([#4578])
+- changed nym-node redirects from 308 'Permanent Redirect' to 303: 'See Other' ([#4572])
+
+[#4579]: https://github.com/nymtech/nym/pull/4579
+[#4578]: https://github.com/nymtech/nym/pull/4578
+[#4572]: https://github.com/nymtech/nym/pull/4572
+
+## [2024.3-eclipse] (2024-04-22)
+
+- Initial release of the first iteration of the Nym Node
+- Improvements to gateway functionality
+- IPR development
+- Removal of allow list in favour of implementing an exit policy
+- Explorer delegation: enables direct delegation to nodes via the Nym Explorer
+
+
+## [2024.2-fast-and-furious] (2024-03-25)
+
+- Internal testing pre-release 
+
+
 ## [2024.1-marabou] (2024-02-15)
 
 **New Features:**

Cargo.toml

@@ -160,7 +160,8 @@ license = "Apache-2.0"
 [workspace.dependencies]
 anyhow = "1.0.71"
 async-trait = "0.1.68"
-axum = "0.6.20"
+axum = "0.7.5"
+axum-extra = "0.9.3"
 base64 = "0.21.4"
 bs58 = "0.5.0"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
@@ -171,15 +172,16 @@ dotenvy = "0.15.6"
 futures = "0.3.28"
 generic-array = "0.14.7"
 getrandom = "0.2.10"
+headers = "0.4.0"
 humantime-serde = "1.1.1"
-hyper = "0.14.27"
+hyper = "1.3.1"
 k256 = "0.13"
 lazy_static = "1.4.0"
 log = "0.4"
 once_cell = "1.7.2"
 parking_lot = "0.12.1"
 rand = "0.8.5"
-reqwest = { version = "0.11.22", default-features = false }
+reqwest = { version = "0.12.4", default-features = false }
 schemars = "0.8.1"
 serde = "1.0.152"
 serde_json = "1.0.91"
@@ -193,8 +195,8 @@ tokio-tungstenite = { version = "0.20.1" }
 tracing = "0.1.37"
 tungstenite = { version = "0.20.1", default-features = false }
 ts-rs = "7.0.0"
-utoipa = "3.5.0"
-utoipa-swagger-ui = "3.1.5"
+utoipa = "4.2.0"
+utoipa-swagger-ui = "6.0.0"
 url = "2.4"
 zeroize = "1.6.0"
 

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.33"
+version = "1.1.34"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.33"
+version = "1.1.34"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

common/client-core/Cargo.toml

@@ -3,7 +3,7 @@ name = "nym-client-core"
 version = "1.1.15"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 edition = "2021"
-rust-version = "1.66"
+rust-version = "1.70"
 license.workspace = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -25,7 +25,6 @@ si-scale = "0.2.2"
 tap = "1.0.1"
 thiserror = { workspace = true }
 url = { workspace = true, features = ["serde"] }
-tungstenite = { workspace = true, default-features = false }
 tokio = { workspace = true, features = ["macros"] }
 time = { workspace = true }
 zeroize = { workspace = true }
@@ -48,7 +47,7 @@ nym-validator-client = { path = "../client-libs/validator-client", default-featu
 nym-task = { path = "../task" }
 nym-credential-storage = { path = "../credential-storage" }
 nym-network-defaults = { path = "../network-defaults" }
-nym-client-core-config-types = { path = "./config-types", features = ["disk-persistence"]}
+nym-client-core-config-types = { path = "./config-types", features = ["disk-persistence"] }
 nym-client-core-surb-storage = { path = "./surb-storage" }
 nym-client-core-gateways-storage = { path = "./gateways-storage" }
 
@@ -74,8 +73,17 @@ workspace = true
 features = ["time"]
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-tungstenite]
-version = "0.20.1"
-features = ["rustls-tls-native-roots"]
+workspace = true
+features = ["rustls-tls-webpki-roots"]
+
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.tungstenite]
+workspace = true
+default-features = true
+features = ["rustls-tls-webpki-roots"]
+
+[target."cfg(target_arch = \"wasm32\")".dependencies.tungstenite]
+workspace = true
+default-features = false
 
 [target."cfg(target_arch = \"wasm32\")".dependencies.wasm-bindgen-futures]
 workspace = true

common/client-core/config-types/src/error.rs

@@ -8,3 +8,12 @@ use thiserror::Error;
 pub struct ConfigUpgradeFailure {
     pub current_version: String,
 }
+
+#[derive(Error, Debug)]
+pub enum InvalidTrafficModeFailure {
+    #[error("attempted to set medium toggle traffic mode with fast mode flag")]
+    MediumToggleWithFastMode,
+
+    #[error("attempted to set medium toggle traffic mode with no cover flag")]
+    MediumToggleWithNoCover,
+}

common/client-core/config-types/src/lib.rs

@@ -56,6 +56,7 @@ const DEFAULT_MAXIMUM_REPLY_SURB_AGE: Duration = Duration::from_secs(12 * 60 * 6
 // 24 hours
 const DEFAULT_MAXIMUM_REPLY_KEY_AGE: Duration = Duration::from_secs(24 * 60 * 60);
 
+use crate::error::InvalidTrafficModeFailure;
 pub use nym_country_group::CountryGroup;
 
 #[derive(Debug, Clone, Deserialize, PartialEq, Serialize)]
@@ -127,6 +128,56 @@ impl Config {
         self
     }
 
+    // TODO: this should be refactored properly
+    // as of 12.09.23 the below is true (not sure how this comment will rot in the future)
+    // medium_toggle:
+    // - sets secondary packet size to 16kb
+    // - disables poisson distribution of the main traffic stream
+    // - sets the cover traffic stream to 1 packet / 5s (on average)
+    // - disables per hop delay
+    //
+    // fastmode (to be renamed to `fast-poisson`):
+    // - sets average per hop delay to 10ms
+    // - sets the cover traffic stream to 1 packet / 2000s (on average); for all intents and purposes it disables the stream
+    // - sets the poisson distribution of the main traffic stream to 4ms, i.e. 250 packets / s on average
+    //
+    // no_cover:
+    // - disables poisson distribution of the main traffic stream
+    // - disables the secondary cover traffic stream
+    #[doc(hidden)]
+    pub fn try_apply_traffic_modes(
+        &mut self,
+        disable_poisson_process: bool,
+        medium_toggle: bool,
+        fast_mode: bool,
+        no_cover: bool,
+    ) -> Result<(), InvalidTrafficModeFailure> {
+        if disable_poisson_process {
+            self.set_no_poisson_process()
+        }
+
+        if medium_toggle {
+            if fast_mode {
+                return Err(InvalidTrafficModeFailure::MediumToggleWithFastMode);
+            }
+            if no_cover {
+                return Err(InvalidTrafficModeFailure::MediumToggleWithNoCover);
+            }
+
+            self.set_experimental_medium_toggle();
+        }
+
+        if fast_mode {
+            self.set_high_default_traffic_volume()
+        }
+
+        if no_cover {
+            self.set_no_cover_traffic();
+        }
+
+        Ok(())
+    }
+
     pub fn set_high_default_traffic_volume(&mut self) {
         self.debug.traffic.average_packet_delay = Duration::from_millis(10);
         // basically don't really send cover messages
@@ -136,6 +187,15 @@ impl Config {
         self.debug.traffic.message_sending_average_delay = Duration::from_millis(4);
     }
 
+    /// Enable medium mixnet traffic, for experiments only.
+    /// This includes things like disabling cover traffic, no per hop delays, etc.
+    #[doc(hidden)]
+    pub fn set_experimental_medium_toggle(&mut self) {
+        self.set_no_cover_traffic_with_keepalive();
+        self.set_no_per_hop_delays();
+        self.debug.traffic.secondary_packet_size = Some(PacketSize::ExtendedPacket16);
+    }
+
     pub fn with_disabled_poisson_process(mut self, disabled: bool) -> Self {
         if disabled {
             self.set_no_poisson_process()

common/client-core/src/client/base_client/mod.rs

@@ -39,7 +39,7 @@ use log::{debug, error, info, warn};
 use nym_bandwidth_controller::BandwidthController;
 use nym_client_core_gateways_storage::{GatewayDetails, GatewaysDetailsStore};
 use nym_credential_storage::storage::Storage as CredentialStorage;
-use nym_crypto::asymmetric::encryption;
+use nym_crypto::asymmetric::{encryption, identity};
 use nym_gateway_client::{
     AcknowledgementReceiver, GatewayClient, GatewayConfig, MixnetMessageReceiver, PacketRouter,
 };
@@ -670,6 +670,7 @@ where
         let self_address = Self::mix_address(&init_res);
         let ack_key = init_res.client_keys.ack_key();
         let encryption_keys = init_res.client_keys.encryption_keypair();
+        let identity_keys = init_res.client_keys.identity_keypair();
 
         // the components are started in very specific order. Unless you know what you are doing,
         // do not change that.
@@ -792,6 +793,7 @@ where
 
         Ok(BaseClient {
             address: self_address,
+            identity_keys,
             client_input: ClientInputStatus::AwaitingProducer {
                 client_input: ClientInput {
                     connection_command_sender: client_connection_tx,
@@ -816,6 +818,7 @@ where
 
 pub struct BaseClient {
     pub address: Recipient,
+    pub identity_keys: Arc<identity::KeyPair>,
     pub client_input: ClientInputStatus,
     pub client_output: ClientOutputStatus,
     pub client_state: ClientState,

common/client-libs/gateway-client/Cargo.toml

@@ -48,10 +48,7 @@ features = ["net", "sync", "time"]
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-tungstenite]
 workspace = true
-# the choice of this particular tls feature was arbitrary;
-# if you reckon a different one would be more appropriate, feel free to change it
-# features = ["native-tls"]
-features = ["rustls-tls-native-roots"]
+features = ["rustls-tls-webpki-roots"]
 
 # wasm-only dependencies
 [target."cfg(target_arch = \"wasm32\")".dependencies.wasm-bindgen]

common/client-libs/gateway-client/src/client.rs

@@ -442,7 +442,7 @@ impl<C, St> GatewayClient<C, St> {
         }
 
         debug_assert!(self.connection.is_available());
-        log::trace!("Registering gateway");
+        log::debug!("Registering gateway");
 
         // it's fine to instantiate it here as it's only used once (during authentication or registration)
         // and putting it into the GatewayClient struct would be a hassle
@@ -494,6 +494,7 @@ impl<C, St> GatewayClient<C, St> {
         if !self.connection.is_established() {
             return Err(GatewayClientError::ConnectionNotEstablished);
         }
+        log::debug!("Authenticating with gateway");
 
         // it's fine to instantiate it here as it's only used once (during authentication or registration)
         // and putting it into the GatewayClient struct would be a hassle
@@ -529,6 +530,7 @@ impl<C, St> GatewayClient<C, St> {
                 self.authenticated = status;
                 self.bandwidth_remaining = bandwidth_remaining;
                 self.negotiated_protocol = protocol_version;
+                log::debug!("authenticated: {status}, bandwidth remaining: {bandwidth_remaining}");
                 Ok(())
             }
             ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
@@ -541,10 +543,11 @@ impl<C, St> GatewayClient<C, St> {
         &mut self,
     ) -> Result<Arc<SharedKeys>, GatewayClientError> {
         if self.authenticated {
+            debug!("Already authenticated");
             return if let Some(shared_key) = &self.shared_key {
                 Ok(Arc::clone(shared_key))
             } else {
-                Err(GatewayClientError::AuthenticationFailure)
+                Err(GatewayClientError::AuthenticationFailureWithPreexistingSharedKey)
             };
         }
 

common/client-libs/gateway-client/src/error.rs

@@ -71,6 +71,9 @@ pub enum GatewayClientError {
     #[error("Authentication failure")]
     AuthenticationFailure,
 
+    #[error("Authentication failure with preexisting shared key")]
+    AuthenticationFailureWithPreexistingSharedKey,
+
     #[error("Timed out")]
     Timeout,
 

common/client-libs/validator-client/Cargo.toml

@@ -24,7 +24,6 @@ nym-group-contract-common = { path = "../../cosmwasm-smart-contracts/group-contr
 nym-service-provider-directory-common = { path = "../../cosmwasm-smart-contracts/service-provider-directory" }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
-reqwest = { workspace = true, features = ["json"] }
 nym-http-api-client = { path = "../../../common/http-api-client"}
 thiserror = { workspace = true }
 log = { workspace = true }
@@ -67,6 +66,14 @@ cosmwasm-std = { workspace = true }
 workspace = true
 features = ["tokio"]
 
+[target."cfg(target_arch = \"wasm32\")".dependencies.reqwest]
+workspace = true
+features = ["json"]
+
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.reqwest]
+workspace = true
+features = ["json", "rustls-tls"]
+
 [dev-dependencies]
 bip39 = { workspace = true }
 cosmrs = { workspace = true, features = ["bip32"] }

common/commands/src/validator/mixnet/delegators/delegate_to_multiple_mixnodes.rs

@@ -157,7 +157,7 @@ async fn fetch_delegation_data(
             // If a pending undelegate tx is found, remove it from delegation map
             Undelegate { owner, mix_id, .. } => {
                 if owner == address.as_ref()
-                    && existing_delegation_map.get(&mix_id.to_string()).is_some()
+                    && existing_delegation_map.contains_key(&mix_id.to_string())
                 {
                     existing_delegation_map.remove(&mix_id.to_string());
                 }

common/cosmwasm-smart-contracts/coconut-dkg/src/types.rs

@@ -328,4 +328,8 @@ impl EpochState {
     pub fn is_dealing_exchange(&self) -> bool {
         matches!(self, EpochState::DealingExchange { .. })
     }
+
+    pub fn is_waiting_initialisation(&self) -> bool {
+        matches!(self, EpochState::WaitingInitialisation)
+    }
 }

common/credential-storage/src/error.rs

@@ -18,4 +18,7 @@ pub enum StorageError {
 
     #[error("No unused credential in database. You need to buy at least one")]
     NoCredential,
+
+    #[error("Database unique constraint violation. Is the credential already imported?")]
+    ConstraintUnique,
 }

common/credential-storage/src/persistent_storage.rs

@@ -69,9 +69,21 @@ impl Storage for PersistentStorage {
                 bandwidth_credential.credential_data,
                 bandwidth_credential.epoch_id,
             )
-            .await?;
-
-        Ok(())
+            .await
+            .map_err(|err| {
+                // There is one error we want to handle specifically.
+                // Check if database_error is `SqliteError` with code 2067 which
+                // means UNIQUE constraint violation
+                if let Some(db_error) = err.as_database_error() {
+                    if db_error.code().map_or(false, |code| code == "2067") {
+                        StorageError::ConstraintUnique
+                    } else {
+                        err.into()
+                    }
+                } else {
+                    err.into()
+                }
+            })
     }
 
     async fn get_next_unspent_credential(

common/credentials-interface/src/lib.rs

@@ -8,11 +8,11 @@ use std::str::FromStr;
 use thiserror::Error;
 
 pub use nym_coconut::{
-    aggregate_signature_shares, aggregate_verification_keys, blind_sign, hash_to_scalar, keygen,
-    prepare_blind_sign, prove_bandwidth_credential, verify_credential, Attribute, Base58,
-    BlindSignRequest, BlindedSerialNumber, BlindedSignature, Bytable, CoconutError, KeyPair,
-    Parameters, PrivateAttribute, PublicAttribute, SecretKey, Signature, SignatureShare,
-    VerificationKey, VerifyCredentialRequest,
+    aggregate_signature_shares, aggregate_signature_shares_and_verify, aggregate_verification_keys,
+    blind_sign, hash_to_scalar, keygen, prepare_blind_sign, prove_bandwidth_credential,
+    verify_credential, Attribute, Base58, BlindSignRequest, BlindedSerialNumber, BlindedSignature,
+    Bytable, CoconutError, KeyPair, Parameters, PrivateAttribute, PublicAttribute, SecretKey,
+    Signature, SignatureShare, VerificationKey, VerifyCredentialRequest,
 };
 
 pub const VOUCHER_INFO_TYPE: &str = "BandwidthVoucher";

common/credentials/src/coconut/bandwidth/freepass.rs

@@ -12,7 +12,8 @@ use serde::{Deserialize, Serialize};
 use time::{Duration, OffsetDateTime, Time};
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
-pub const MAX_FREE_PASS_VALIDITY: Duration = Duration::WEEK; // 1 week
+pub const DEFAULT_FREE_PASS_VALIDITY: Duration = Duration::WEEK; // 1 week
+pub const MAX_FREE_PASS_VALIDITY: Duration = Duration::weeks(12); // 12 weeks
 
 #[derive(Debug, Zeroize, ZeroizeOnDrop, Serialize, Deserialize)]
 pub struct FreePassIssuedData {
@@ -77,9 +78,9 @@ impl FreePassIssuanceData {
     }
 
     pub fn default_expiry_date() -> OffsetDateTime {
-        // set it to furthest midnight in the future such as it's no more than a week away,
+        // set it to the furthest midnight in the future such as it's no more than a week away,
         // i.e. if it's currently for example 9:43 on 2nd March 2024, it will set it to 0:00 on 9th March 2024
-        (OffsetDateTime::now_utc() + MAX_FREE_PASS_VALIDITY).replace_time(Time::MIDNIGHT)
+        (OffsetDateTime::now_utc() + DEFAULT_FREE_PASS_VALIDITY).replace_time(Time::MIDNIGHT)
     }
 
     pub fn expiry_date_attribute(&self) -> &Attribute {

common/credentials/src/coconut/bandwidth/issuance.rs

@@ -10,18 +10,19 @@ use crate::coconut::bandwidth::{
 use crate::coconut::utils::scalar_serde_helper;
 use crate::error::Error;
 use nym_credentials_interface::{
-    aggregate_signature_shares, hash_to_scalar, prepare_blind_sign, Attribute, BlindedSerialNumber,
-    BlindedSignature, Parameters, PrivateAttribute, PublicAttribute, Signature, SignatureShare,
-    VerificationKey,
+    aggregate_signature_shares, aggregate_signature_shares_and_verify, hash_to_scalar,
+    prepare_blind_sign, Attribute, BlindedSerialNumber, BlindedSignature, Parameters,
+    PrivateAttribute, PublicAttribute, Signature, SignatureShare, VerificationKey,
 };
 use nym_crypto::asymmetric::{encryption, identity};
 use nym_validator_client::nym_api::EpochId;
-use nym_validator_client::nyxd::{Coin, Hash};
 use nym_validator_client::signing::AccountData;
 use serde::{Deserialize, Serialize};
 use time::OffsetDateTime;
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
+pub use nym_validator_client::nyxd::{Coin, Hash};
+
 #[derive(Zeroize, ZeroizeOnDrop, Serialize, Deserialize)]
 pub enum BandwidthCredentialIssuanceDataVariant {
     Voucher(BandwidthVoucherIssuanceData),
@@ -265,6 +266,13 @@ impl IssuanceBandwidthCredential {
         self.unblind_signature(validator_vk, &signing_data, blinded_signature)
     }
 
+    pub fn unchecked_aggregate_signature_shares(
+        &self,
+        shares: &[SignatureShare],
+    ) -> Result<Signature, Error> {
+        aggregate_signature_shares(shares).map_err(Error::SignatureAggregationError)
+    }
+
     pub fn aggregate_signature_shares(
         &self,
         verification_key: &VerificationKey,
@@ -279,7 +287,7 @@ impl IssuanceBandwidthCredential {
         attributes.extend_from_slice(&private_attributes);
         attributes.extend_from_slice(&public_attributes);
 
-        aggregate_signature_shares(params, verification_key, &attributes, shares)
+        aggregate_signature_shares_and_verify(params, verification_key, &attributes, shares)
             .map_err(Error::SignatureAggregationError)
     }
 

common/credentials/src/coconut/bandwidth/voucher.rs

@@ -6,7 +6,7 @@ use crate::coconut::utils::scalar_serde_helper;
 use crate::error::Error;
 use nym_api_requests::coconut::BlindSignRequestBody;
 use nym_credentials_interface::{
-    hash_to_scalar, Attribute, BlindSignRequest, BlindedSignature, PublicAttribute,
+    hash_to_scalar, Attribute, BlindSignRequest, BlindedSignature, CredentialType, PublicAttribute,
 };
 use nym_crypto::asymmetric::{encryption, identity};
 use nym_validator_client::nyxd::{Coin, Hash};
@@ -123,6 +123,10 @@ impl BandwidthVoucherIssuanceData {
         &self.value_prehashed
     }
 
+    pub fn typ() -> CredentialType {
+        CredentialType::Voucher
+    }
+
     pub fn tx_hash(&self) -> Hash {
         self.deposit_tx_hash
     }

common/network-defaults/src/mainnet.rs

@@ -18,9 +18,12 @@ pub const VESTING_CONTRACT_ADDRESS: &str =
     "n1nc5tatafv6eyq7llkr2gv50ff9e22mnf70qgjlv737ktmt4eswrq73f2nw";
 
 pub const COCONUT_BANDWIDTH_CONTRACT_ADDRESS: &str = "";
-pub const GROUP_CONTRACT_ADDRESS: &str = "";
-pub const MULTISIG_CONTRACT_ADDRESS: &str = "";
-pub const COCONUT_DKG_CONTRACT_ADDRESS: &str = "";
+pub const GROUP_CONTRACT_ADDRESS: &str =
+    "n1e2zq4886zzewpvpucmlw8v9p7zv692f6yck4zjzxh699dkcmlrfqk2knsr";
+pub const MULTISIG_CONTRACT_ADDRESS: &str =
+    "n1txayqfz5g9qww3rlflpg025xd26m9payz96u54x4fe3s2ktz39xqk67gzx";
+pub const COCONUT_DKG_CONTRACT_ADDRESS: &str =
+    "n19604yflqggs9mk2z26mqygq43q2kr3n932egxx630svywd5mpxjsztfpvx";
 pub const EPHEMERA_CONTRACT_ADDRESS: &str = "";
 
 pub const REWARDING_VALIDATOR_ADDRESS: &str = "n10yyd98e2tuwu0f7ypz9dy3hhjw7v772q6287gy";

common/nymcoconut/benches/benchmarks.rs

@@ -6,10 +6,10 @@ use criterion::{criterion_group, criterion_main, Criterion};
 use ff::Field;
 use group::{Curve, Group};
 use nym_coconut::{
-    aggregate_signature_shares, aggregate_verification_keys, blind_sign, prepare_blind_sign,
-    prove_bandwidth_credential, random_scalars_refs, setup, ttp_keygen, verify_credential,
-    verify_partial_blind_signature, Attribute, BlindedSignature, Parameters, Signature,
-    SignatureShare, VerificationKey,
+    aggregate_signature_shares_and_verify, aggregate_verification_keys, blind_sign,
+    prepare_blind_sign, prove_bandwidth_credential, random_scalars_refs, setup, ttp_keygen,
+    verify_credential, verify_partial_blind_signature, Attribute, BlindedSignature, Parameters,
+    Signature, SignatureShare, VerificationKey,
 };
 use rand::seq::SliceRandom;
 use std::ops::Neg;
@@ -99,7 +99,7 @@ fn unblind_and_aggregate(
     let mut attributes = vec![];
     attributes.extend_from_slice(private_attributes);
     attributes.extend_from_slice(public_attributes);
-    aggregate_signature_shares(
+    aggregate_signature_shares_and_verify(
         params,
         verification_key,
         &attributes,

common/nymcoconut/src/lib.rs

@@ -4,14 +4,18 @@
 #![warn(clippy::expect_used)]
 #![warn(clippy::unwrap_used)]
 
+pub use bls12_381::Scalar;
 pub use elgamal::elgamal_keygen;
 pub use elgamal::ElGamalKeyPair;
 pub use elgamal::PublicKey;
 pub use error::CoconutError;
+pub use scheme::aggregation::aggregate_key_shares;
 pub use scheme::aggregation::aggregate_signature_shares;
+pub use scheme::aggregation::aggregate_signature_shares_and_verify;
 pub use scheme::aggregation::aggregate_verification_keys;
 pub use scheme::issuance::blind_sign;
 pub use scheme::issuance::prepare_blind_sign;
+pub use scheme::issuance::sign;
 pub use scheme::issuance::verify_partial_blind_signature;
 pub use scheme::issuance::BlindSignRequest;
 pub use scheme::keygen::keygen;
@@ -19,16 +23,19 @@ pub use scheme::keygen::ttp_keygen;
 pub use scheme::keygen::KeyPair;
 pub use scheme::keygen::SecretKey;
 pub use scheme::keygen::VerificationKey;
+pub use scheme::keygen::VerificationKeyShare;
 pub use scheme::setup::setup;
 pub use scheme::setup::Parameters;
 pub use scheme::verification::check_vk_pairing;
 pub use scheme::verification::prove_bandwidth_credential;
+pub use scheme::verification::verify;
 pub use scheme::verification::verify_credential;
 pub use scheme::verification::BlindedSerialNumber;
 pub use scheme::verification::VerifyCredentialRequest;
 pub use scheme::BlindedSignature;
 pub use scheme::Signature;
 pub use scheme::SignatureShare;
+pub use scheme::SignerIndex;
 pub use traits::Base58;
 pub use traits::Bytable;
 pub use utils::hash_to_scalar;

common/nymcoconut/src/scheme/aggregation.rs

@@ -12,7 +12,7 @@ use crate::error::{CoconutError, Result};
 use crate::scheme::verification::check_bilinear_pairing;
 use crate::scheme::{PartialSignature, Signature, SignatureShare, SignerIndex, VerificationKey};
 use crate::utils::perform_lagrangian_interpolation_at_origin;
-use crate::{Attribute, Parameters};
+use crate::{Attribute, Parameters, VerificationKeyShare};
 
 pub(crate) trait Aggregatable: Sized {
     fn aggregate(aggregatable: &[Self], indices: Option<&[SignerIndex]>) -> Result<Self>;
@@ -80,7 +80,23 @@ pub fn aggregate_verification_keys(
     Aggregatable::aggregate(keys, indices)
 }
 
+pub fn aggregate_key_shares(shares: &[VerificationKeyShare]) -> Result<VerificationKey> {
+    let (keys, indices): (Vec<_>, Vec<_>) = shares
+        .iter()
+        .map(|share| (share.key.clone(), share.index))
+        .unzip();
+
+    aggregate_verification_keys(&keys, Some(&indices))
+}
+
 pub fn aggregate_signatures(
+    signatures: &[PartialSignature],
+    indices: Option<&[SignerIndex]>,
+) -> Result<Signature> {
+    Aggregatable::aggregate(signatures, indices)
+}
+
+pub fn aggregate_signatures_and_verify(
     params: &Parameters,
     verification_key: &VerificationKey,
     attributes: &[&Attribute],
@@ -88,11 +104,7 @@ pub fn aggregate_signatures(
     indices: Option<&[SignerIndex]>,
 ) -> Result<Signature> {
     // aggregate the signature
-
-    let signature = match Aggregatable::aggregate(signatures, indices) {
-        Ok(res) => res,
-        Err(err) => return Err(err),
-    };
+    let signature = aggregate_signatures(signatures, indices)?;
 
     // Verify the signature
     let alpha = verification_key.alpha;
@@ -116,7 +128,16 @@ pub fn aggregate_signatures(
     Ok(signature)
 }
 
-pub fn aggregate_signature_shares(
+pub fn aggregate_signature_shares(shares: &[SignatureShare]) -> Result<Signature> {
+    let (signatures, indices): (Vec<_>, Vec<_>) = shares
+        .iter()
+        .map(|share| (*share.signature(), share.index()))
+        .unzip();
+
+    aggregate_signatures(&signatures, Some(&indices))
+}
+
+pub fn aggregate_signature_shares_and_verify(
     params: &Parameters,
     verification_key: &VerificationKey,
     attributes: &[&Attribute],
@@ -127,7 +148,7 @@ pub fn aggregate_signature_shares(
         .map(|share| (*share.signature(), share.index()))
         .unzip();
 
-    aggregate_signatures(
+    aggregate_signatures_and_verify(
         params,
         verification_key,
         attributes,
@@ -210,7 +231,7 @@ mod tests {
 
     #[test]
     fn signature_aggregation_works_for_any_subset_of_signatures() {
-        let mut params = Parameters::new(2).unwrap();
+        let params = Parameters::new(2).unwrap();
         random_scalars_refs!(attributes, params, 2);
 
         let keypairs = ttp_keygen(&params, 3, 5).unwrap();
@@ -227,12 +248,12 @@ mod tests {
 
         let sigs = sks
             .iter()
-            .map(|sk| sign(&mut params, sk, &attributes).unwrap())
+            .map(|sk| sign(&params, sk, &attributes).unwrap())
             .collect::<Vec<_>>();
 
         // aggregating (any) threshold works
         let aggr_vk_1 = aggregate_verification_keys(&vks[..3], Some(&[1, 2, 3])).unwrap();
-        let aggr_sig1 = aggregate_signatures(
+        let aggr_sig1 = aggregate_signatures_and_verify(
             &params,
             &aggr_vk_1,
             &attributes,
@@ -242,7 +263,7 @@ mod tests {
         .unwrap();
 
         let aggr_vk_2 = aggregate_verification_keys(&vks[2..], Some(&[3, 4, 5])).unwrap();
-        let aggr_sig2 = aggregate_signatures(
+        let aggr_sig2 = aggregate_signatures_and_verify(
             &params,
             &aggr_vk_1,
             &attributes,
@@ -258,7 +279,7 @@ mod tests {
 
         // aggregating threshold+1 works
         let aggr_vk_more = aggregate_verification_keys(&vks[1..], Some(&[2, 3, 4, 5])).unwrap();
-        let aggr_more = aggregate_signatures(
+        let aggr_more = aggregate_signatures_and_verify(
             &params,
             &aggr_vk_more,
             &attributes,
@@ -270,7 +291,7 @@ mod tests {
 
         // aggregating all
         let aggr_vk_all = aggregate_verification_keys(&vks, Some(&[1, 2, 3, 4, 5])).unwrap();
-        let aggr_all = aggregate_signatures(
+        let aggr_all = aggregate_signatures_and_verify(
             &params,
             &aggr_vk_all,
             &attributes,
@@ -282,7 +303,7 @@ mod tests {
 
         // not taking enough points (threshold was 3) should fail
         let aggr_vk_not_enough = aggregate_verification_keys(&vks[..2], Some(&[1, 2])).unwrap();
-        let aggr_not_enough = aggregate_signatures(
+        let aggr_not_enough = aggregate_signatures_and_verify(
             &params,
             &aggr_vk_not_enough,
             &attributes,
@@ -294,7 +315,7 @@ mod tests {
 
         // taking wrong index should fail
         let aggr_vk_bad = aggregate_verification_keys(&vks[2..], Some(&[1, 2, 3])).unwrap();
-        assert!(aggregate_signatures(
+        assert!(aggregate_signatures_and_verify(
             &params,
             &aggr_vk_bad,
             &attributes,
@@ -330,9 +351,14 @@ mod tests {
             .unzip();
 
         let aggr_vk_all = aggregate_verification_keys(&vks, None).unwrap();
-        assert!(
-            aggregate_signatures(&params, &aggr_vk_all, &attributes, &signatures, None).is_err()
-        );
+        assert!(aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk_all,
+            &attributes,
+            &signatures,
+            None
+        )
+        .is_err());
     }
 
     #[test]
@@ -352,11 +378,15 @@ mod tests {
             .unzip();
         let aggr_vk_all = aggregate_verification_keys(&vks, None).unwrap();
 
-        assert!(
-            aggregate_signatures(&params, &aggr_vk_all, &attributes, &signatures, Some(&[]))
-                .is_err()
-        );
-        assert!(aggregate_signatures(
+        assert!(aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk_all,
+            &attributes,
+            &signatures,
+            Some(&[])
+        )
+        .is_err());
+        assert!(aggregate_signatures_and_verify(
             &params,
             &aggr_vk_all,
             &attributes,
@@ -383,7 +413,7 @@ mod tests {
             .unzip();
         let aggr_vk_all = aggregate_verification_keys(&vks, None).unwrap();
 
-        assert!(aggregate_signatures(
+        assert!(aggregate_signatures_and_verify(
             &params,
             &aggr_vk_all,
             &attributes,

common/nymcoconut/src/scheme/issuance.rs

@@ -13,9 +13,8 @@ use crate::scheme::setup::Parameters;
 use crate::scheme::BlindedSignature;
 use crate::scheme::SecretKey;
 use crate::Attribute;
-/// Creates a Coconut Signature under a given secret key on a set of public attributes only.
-#[cfg(test)]
 use crate::Signature;
+
 // TODO: possibly completely remove those two functions.
 // They only exist to have a simpler and smaller code snippets to test
 // basic functionalities.
@@ -158,6 +157,10 @@ impl BlindSignRequest {
         )
     }
 
+    pub fn verify_commitment_hash(&self, public_attributes: &[&Attribute]) -> bool {
+        self.commitment_hash == compute_hash(self.commitment, public_attributes)
+    }
+
     pub fn get_commitment_hash(&self) -> G1Projective {
         self.commitment_hash
     }
@@ -426,9 +429,9 @@ pub fn verify_partial_blind_signature(
         .into()
 }
 
-#[cfg(test)]
+/// Creates a Coconut Signature under a given secret key on a set of public attributes only.
 pub fn sign(
-    params: &mut Parameters,
+    params: &Parameters,
     secret_key: &SecretKey,
     public_attributes: &[&Attribute],
 ) -> Result<Signature> {

common/nymcoconut/src/scheme/keygen.rs

@@ -151,10 +151,6 @@ impl Base58 for SecretKey {}
 // TODO: perhaps change points to affine representation
 // to make verification slightly more efficient?
 #[derive(Debug, PartialEq, Eq, Clone)]
-#[cfg_attr(
-    feature = "key-zeroize",
-    derive(zeroize::Zeroize, zeroize::ZeroizeOnDrop)
-)]
 pub struct VerificationKey {
     // TODO add gen2 as per the paper or imply it from the fact library is using bls381?
     pub(crate) alpha: G2Projective,
@@ -411,12 +407,23 @@ impl Bytable for VerificationKey {
 
 impl Base58 for VerificationKey {}
 
+#[derive(Debug, Clone)]
+pub struct VerificationKeyShare {
+    pub key: VerificationKey,
+    pub index: SignerIndex,
+}
+
+impl From<(VerificationKey, SignerIndex)> for VerificationKeyShare {
+    fn from(value: (VerificationKey, SignerIndex)) -> Self {
+        VerificationKeyShare {
+            key: value.0,
+            index: value.1,
+        }
+    }
+}
+
 #[derive(Debug, Serialize, Deserialize)]
 #[cfg_attr(test, derive(PartialEq, Eq, Clone))]
-#[cfg_attr(
-    feature = "key-zeroize",
-    derive(zeroize::Zeroize, zeroize::ZeroizeOnDrop)
-)]
 pub struct KeyPair {
     secret_key: SecretKey,
     verification_key: VerificationKey,
@@ -425,6 +432,12 @@ pub struct KeyPair {
     pub index: Option<SignerIndex>,
 }
 
+impl From<KeyPair> for (SecretKey, VerificationKey) {
+    fn from(value: KeyPair) -> Self {
+        (value.secret_key, value.verification_key)
+    }
+}
+
 impl PemStorableKeyPair for KeyPair {
     type PrivatePemKey = SecretKey;
     type PublicPemKey = VerificationKey;
@@ -461,6 +474,13 @@ impl KeyPair {
         &self.verification_key
     }
 
+    pub fn to_verification_key_share(&self) -> Option<VerificationKeyShare> {
+        self.index.map(|index| VerificationKeyShare {
+            key: self.verification_key.clone(),
+            index,
+        })
+    }
+
     pub fn to_bytes(&self) -> Vec<u8> {
         // Schema is coconutkeypair[14]|secret_key_len[8]|secret_key[secret_key_len]|verification_key_len[8]|verification_key[verification_key_len]|signer_index[8] - optional
         self.to_byte_vec()

common/nymcoconut/src/scheme/mod.rs

@@ -70,6 +70,11 @@ impl Signature {
         &self.1
     }
 
+    pub fn randomise_simple(&self, params: &Parameters) -> Signature {
+        let r = params.random_scalar();
+        Signature(self.0 * r, self.1 * r)
+    }
+
     pub fn randomise(&self, params: &Parameters) -> (Signature, Scalar) {
         let r = params.random_scalar();
         let r_prime = params.random_scalar();
@@ -191,7 +196,7 @@ impl BlindedSignature {
         &self,
         partial_verification_key: &VerificationKey,
         pedersen_commitments_openings: &[Scalar],
-    ) -> Result<Signature> {
+    ) -> Signature {
         // parse the signature
         let h = &self.0;
         let c = &self.1;
@@ -204,7 +209,7 @@ impl BlindedSignature {
 
         let unblinded_c = c - blinding_removers;
 
-        Ok(Signature(*h, unblinded_c))
+        Signature(*h, unblinded_c)
     }
 
     pub fn unblind_and_verify(
@@ -216,7 +221,7 @@ impl BlindedSignature {
         commitment_hash: &G1Projective,
         pedersen_commitments_openings: &[Scalar],
     ) -> Result<Signature> {
-        let unblinded = self.unblind(partial_verification_key, pedersen_commitments_openings)?;
+        let unblinded = self.unblind(partial_verification_key, pedersen_commitments_openings);
         unblinded.verify(
             params,
             partial_verification_key,
@@ -240,6 +245,7 @@ impl BlindedSignature {
 }
 
 // perhaps this should take signature by reference? we'll see how it goes
+#[derive(Clone, Copy)]
 pub struct SignatureShare {
     signature: Signature,
     index: SignerIndex,
@@ -276,7 +282,9 @@ impl SignatureShare {
 mod tests {
     use super::*;
     use crate::hash_to_scalar;
-    use crate::scheme::aggregation::{aggregate_signatures, aggregate_verification_keys};
+    use crate::scheme::aggregation::{
+        aggregate_signatures_and_verify, aggregate_verification_keys,
+    };
     use crate::scheme::issuance::{blind_sign, compute_hash, prepare_blind_sign, sign};
     use crate::scheme::keygen::{keygen, ttp_keygen};
     use crate::scheme::verification::{prove_bandwidth_credential, verify, verify_credential};
@@ -418,13 +426,13 @@ mod tests {
 
     #[test]
     fn verification_on_two_public_attributes() {
-        let mut params = Parameters::new(2).unwrap();
+        let params = Parameters::new(2).unwrap();
         random_scalars_refs!(attributes, params, 2);
 
         let keypair1 = keygen(&params);
         let keypair2 = keygen(&params);
-        let sig1 = sign(&mut params, keypair1.secret_key(), &attributes).unwrap();
-        let sig2 = sign(&mut params, keypair2.secret_key(), &attributes).unwrap();
+        let sig1 = sign(&params, keypair1.secret_key(), &attributes).unwrap();
+        let sig2 = sign(&params, keypair2.secret_key(), &attributes).unwrap();
 
         assert!(verify(
             &params,
@@ -568,9 +576,14 @@ mod tests {
         attributes.extend_from_slice(&public_attributes);
 
         let aggr_vk = aggregate_verification_keys(&vks[..2], Some(&[1, 2])).unwrap();
-        let aggr_sig =
-            aggregate_signatures(&params, &aggr_vk, &attributes, &sigs[..2], Some(&[1, 2]))
-                .unwrap();
+        let aggr_sig = aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk,
+            &attributes,
+            &sigs[..2],
+            Some(&[1, 2]),
+        )
+        .unwrap();
 
         let theta = prove_bandwidth_credential(
             &params,
@@ -590,9 +603,14 @@ mod tests {
 
         // taking different subset of keys and credentials
         let aggr_vk = aggregate_verification_keys(&vks[1..], Some(&[2, 3])).unwrap();
-        let aggr_sig =
-            aggregate_signatures(&params, &aggr_vk, &attributes, &sigs[1..], Some(&[2, 3]))
-                .unwrap();
+        let aggr_sig = aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk,
+            &attributes,
+            &sigs[1..],
+            Some(&[2, 3]),
+        )
+        .unwrap();
 
         let theta = prove_bandwidth_credential(
             &params,

common/nymcoconut/src/scheme/setup.rs

@@ -10,6 +10,7 @@ use crate::error::{CoconutError, Result};
 use crate::utils::hash_g1;
 
 /// System-wide parameters used for the protocol
+#[derive(Clone)]
 pub struct Parameters {
     /// Generator of the G1 group
     g1: G1Affine,

common/nymcoconut/src/scheme/verification.rs

@@ -288,7 +288,6 @@ pub fn verify_credential(
 }
 
 // Used in tests only
-#[cfg(test)]
 pub fn verify(
     params: &Parameters,
     verification_key: &VerificationKey,

common/nymcoconut/src/tests/helpers.rs

@@ -75,8 +75,12 @@ pub fn theta_from_keys_and_attributes(
     attributes.extend_from_slice(public_attributes);
 
     // Randomize credentials and generate any cryptographic material to verify them
-    let signature =
-        aggregate_signature_shares(params, &verification_key, &attributes, &signature_shares)?;
+    let signature = aggregate_signature_shares_and_verify(
+        params,
+        &verification_key,
+        &attributes,
+        &signature_shares,
+    )?;
 
     // Generate cryptographic material to verify them
     let theta = prove_bandwidth_credential(

common/nyxd-scraper/Cargo.toml

@@ -16,7 +16,9 @@ const_format = "0.2.32"
 cosmrs.workspace = true
 eyre = "0.6.9"
 futures.workspace = true
+humantime = "2.1.0"
 sha2 = "0.10.8"
+serde = { workspace = true, features = ["derive"] }
 sqlx = { workspace = true, features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate", "time"] }
 tendermint.workspace = true
 tendermint-rpc = { workspace = true, features = ["websocket-client", "http-client"] }
@@ -24,13 +26,13 @@ thiserror.workspace = true
 time = { workspace = true }
 tokio = { workspace = true, features = ["full"] }
 tokio-stream = "0.1.14"
-tokio-util = { version = "0.7.10", features = ["rt"]}
+tokio-util = { version = "0.7.10", features = ["rt"] }
 tracing.workspace = true
 url.workspace = true
 
 
 # TEMP
-nym-bin-common = { path = "../bin-common", features = ["basic_tracing"]}
+#nym-bin-common = { path = "../bin-common", features = ["basic_tracing"]}
 
 
 [build-dependencies]

common/nyxd-scraper/README.md

@@ -0,0 +1,23 @@
+# Nyxd Scraper
+
+## Pruning
+
+Similarly to cosmos-sdk, we incorporate pruning into our (scraped) chain data. We attempt to follow their strategies as
+closely as possible for convenience's sake. Therefore, the following are available:
+
+### Strategies
+
+The strategies are configured in `config.toml`, with the format `pruning = "<strategy>"` where the options are:
+
+* `default`: only the last 362,880 states(approximately 3.5 weeks worth of state) are kept; pruning at 10 block
+  intervals
+* `nothing`: all historic states will be saved, nothing will be deleted (i.e. archiving node)
+* `everything`: 2 latest states will be kept; pruning at 10 block intervals.
+* `custom`: allow pruning options to be manually specified through `pruning.keep_recent`, and `pruning.interval`
+
+### Custom Pruning
+
+These are applied if and only if the pruning strategy is `custom`:
+
+* `pruning.keep_recent`: N means to keep all of the last N blocks
+* `pruning.interval`: N means to delete old block data from disk every Nth block.

common/nyxd-scraper/src/block_processor/mod.rs

@@ -8,6 +8,7 @@ use crate::error::ScraperError;
 use crate::modules::{BlockModule, MsgModule, TxModule};
 use crate::rpc_client::RpcClient;
 use crate::storage::{persist_block, ScraperStorage};
+use crate::PruningOptions;
 use futures::StreamExt;
 use std::collections::{BTreeMap, HashSet, VecDeque};
 use std::ops::{Add, Range};
@@ -18,9 +19,10 @@ use tokio::sync::Notify;
 use tokio::time::{interval_at, Instant};
 use tokio_stream::wrappers::UnboundedReceiverStream;
 use tokio_util::sync::CancellationToken;
-use tracing::{debug, error, info, warn};
+use tracing::{debug, error, info, instrument, trace, warn};
 
 mod helpers;
+pub(crate) mod pruning;
 pub(crate) mod types;
 
 const MISSING_BLOCKS_CHECK_INTERVAL: Duration = Duration::from_secs(30);
@@ -40,9 +42,11 @@ impl PendingSync {
 }
 
 pub struct BlockProcessor {
+    pruning_options: PruningOptions,
     cancel: CancellationToken,
     synced: Arc<Notify>,
     last_processed_height: u32,
+    last_pruned_height: u32,
     last_processed_at: Instant,
     pending_sync: PendingSync,
     queued_blocks: BTreeMap<u32, BlockToProcess>,
@@ -62,6 +66,7 @@ pub struct BlockProcessor {
 
 impl BlockProcessor {
     pub async fn new(
+        pruning_options: PruningOptions,
         cancel: CancellationToken,
         synced: Arc<Notify>,
         incoming: UnboundedReceiver<BlockToProcess>,
@@ -70,11 +75,17 @@ impl BlockProcessor {
         rpc_client: RpcClient,
     ) -> Result<Self, ScraperError> {
         let last_processed = storage.get_last_processed_height().await?;
+        let last_processed_height = last_processed.try_into().unwrap_or_default();
+
+        let last_pruned = storage.get_pruned_height().await?;
+        let last_pruned_height = last_pruned.try_into().unwrap_or_default();
 
         Ok(BlockProcessor {
+            pruning_options,
             cancel,
             synced,
-            last_processed_height: last_processed.try_into().unwrap_or_default(),
+            last_processed_height,
+            last_pruned_height,
             last_processed_at: Instant::now(),
             pending_sync: Default::default(),
             queued_blocks: Default::default(),
@@ -131,12 +142,17 @@ impl BlockProcessor {
             }
         }
 
+        let commit_start = Instant::now();
         tx.commit()
             .await
             .map_err(|source| ScraperError::StorageTxCommitFailure { source })?;
+        crate::storage::log_db_operation_time("committing processing tx", commit_start);
 
         self.last_processed_height = full_info.block.header.height.value() as u32;
         self.last_processed_at = Instant::now();
+        if let Err(err) = self.maybe_prune_storage().await {
+            error!("failed to prune the storage: {err}");
+        }
 
         Ok(())
     }
@@ -210,6 +226,61 @@ impl BlockProcessor {
         Ok(())
     }
 
+    #[instrument(skip(self))]
+    async fn prune_storage(&mut self) -> Result<(), ScraperError> {
+        let keep_recent = self.pruning_options.strategy_keep_recent();
+        let last_to_keep = self.last_processed_height - keep_recent;
+
+        info!(
+            keep_recent,
+            oldest_to_keep = last_to_keep,
+            "pruning the storage"
+        );
+
+        let lowest: u32 = self
+            .storage
+            .lowest_block_height()
+            .await?
+            .unwrap_or_default()
+            .try_into()
+            .unwrap_or_default();
+
+        let to_prune = last_to_keep.saturating_sub(lowest);
+        match to_prune {
+            v if v > 1000 => warn!("approximately {v} blocks worth of data will be pruned"),
+            v if v > 100 => info!("approximately {v} blocks worth of data will be pruned"),
+            0 => trace!("no blocks to prune"),
+            v => debug!("approximately {v} blocks worth of data will be pruned"),
+        }
+
+        if to_prune == 0 {
+            return Ok(());
+        }
+
+        self.storage
+            .prune_storage(last_to_keep, self.last_processed_height)
+            .await?;
+
+        self.last_pruned_height = self.last_processed_height;
+        Ok(())
+    }
+
+    async fn maybe_prune_storage(&mut self) -> Result<(), ScraperError> {
+        debug!("checking for storage pruning");
+
+        if self.pruning_options.strategy.is_nothing() {
+            trace!("the current pruning strategy is 'nothing'");
+            return Ok(());
+        }
+
+        let interval = self.pruning_options.strategy_interval();
+        if self.last_pruned_height + interval <= self.last_processed_height {
+            self.prune_storage().await?;
+        }
+
+        Ok(())
+    }
+
     async fn next_incoming(&mut self, block: BlockToProcess) {
         let height = block.height;
 
@@ -279,6 +350,8 @@ impl BlockProcessor {
     async fn startup_resync(&mut self) -> Result<(), ScraperError> {
         assert!(self.pending_sync.is_empty());
 
+        self.maybe_prune_storage().await?;
+
         let latest_block = self.rpc_client.current_block_height().await? as u32;
         if latest_block > self.last_processed_height && self.last_processed_height != 0 {
             let request_range = self.last_processed_height + 1..latest_block + 1;

common/nyxd-scraper/src/block_processor/pruning.rs

@@ -0,0 +1,122 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::ScraperError;
+use serde::{Deserialize, Serialize};
+
+pub const DEFAULT_PRUNING_KEEP_RECENT: u32 = 362880;
+pub const DEFAULT_PRUNING_INTERVAL: u32 = 10;
+pub const EVERYTHING_PRUNING_KEEP_RECENT: u32 = 2;
+pub const EVERYTHING_PRUNING_INTERVAL: u32 = 10;
+
+/// We follow cosmos-sdk pruning strategies for convenience’s sake.
+#[derive(Debug, Default, Clone, Copy, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PruningStrategy {
+    /// 'Default' strategy defines a pruning strategy where the last 362880 heights are
+    /// kept where to-be pruned heights are pruned at every 10th height.
+    /// The last 362880 heights are kept(approximately 3.5 weeks worth of state) assuming the typical
+    /// block time is 6s. If these values do not match the applications' requirements, use the "custom" option.
+    #[default]
+    Default,
+
+    /// 'Everything' strategy defines a pruning strategy where all committed heights are
+    /// deleted, storing only the current height and last 2 states. To-be pruned heights are
+    /// pruned at every 10th height.
+    Everything,
+
+    /// 'Nothing' strategy defines a pruning strategy where all heights are kept on disk.
+    Nothing,
+
+    /// 'Custom' strategy defines a pruning strategy where the user specifies the pruning.
+    Custom,
+}
+
+impl PruningStrategy {
+    pub fn is_custom(&self) -> bool {
+        matches!(self, PruningStrategy::Custom)
+    }
+
+    pub fn is_nothing(&self) -> bool {
+        matches!(self, PruningStrategy::Nothing)
+    }
+
+    pub fn is_everything(&self) -> bool {
+        matches!(self, PruningStrategy::Everything)
+    }
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
+pub struct PruningOptions {
+    /// keep_recent defines how many recent heights to keep on disk.
+    pub keep_recent: u32,
+
+    /// interval defines the frequency of removing the pruned heights from the disk.
+    pub interval: u32,
+
+    /// strategy defines the currently used kind of [PruningStrategy].
+    pub strategy: PruningStrategy,
+}
+
+impl PruningOptions {
+    pub fn validate(&self) -> Result<(), ScraperError> {
+        // if strategy is not set to custom, other options are meaningless since they won't be applied
+        if !self.strategy.is_custom() {
+            return Ok(());
+        }
+
+        if self.interval == 0 {
+            return Err(ScraperError::ZeroPruningInterval);
+        }
+
+        if self.interval < EVERYTHING_PRUNING_INTERVAL {
+            return Err(ScraperError::TooSmallPruningInterval {
+                interval: self.interval,
+            });
+        }
+
+        if self.keep_recent < EVERYTHING_PRUNING_KEEP_RECENT {
+            return Err(ScraperError::TooSmallKeepRecent {
+                keep_recent: self.keep_recent,
+            });
+        }
+
+        Ok(())
+    }
+
+    pub fn nothing() -> Self {
+        PruningOptions {
+            keep_recent: 0,
+            interval: 0,
+            strategy: PruningStrategy::Nothing,
+        }
+    }
+
+    pub fn strategy_interval(&self) -> u32 {
+        match self.strategy {
+            PruningStrategy::Default => DEFAULT_PRUNING_INTERVAL,
+            PruningStrategy::Everything => EVERYTHING_PRUNING_INTERVAL,
+            PruningStrategy::Nothing => 0,
+            PruningStrategy::Custom => self.interval,
+        }
+    }
+
+    pub fn strategy_keep_recent(&self) -> u32 {
+        match self.strategy {
+            PruningStrategy::Default => DEFAULT_PRUNING_KEEP_RECENT,
+            PruningStrategy::Everything => EVERYTHING_PRUNING_KEEP_RECENT,
+            PruningStrategy::Nothing => 0,
+            PruningStrategy::Custom => self.keep_recent,
+        }
+    }
+}
+
+impl Default for PruningOptions {
+    fn default() -> Self {
+        PruningOptions {
+            keep_recent: DEFAULT_PRUNING_KEEP_RECENT,
+            interval: DEFAULT_PRUNING_INTERVAL,
+            strategy: Default::default(),
+        }
+    }
+}

common/nyxd-scraper/src/error.rs

@@ -1,6 +1,9 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::block_processor::pruning::{
+    EVERYTHING_PRUNING_INTERVAL, EVERYTHING_PRUNING_KEEP_RECENT,
+};
 use tendermint::Hash;
 use thiserror::Error;
 use tokio::sync::mpsc::error::SendError;
@@ -122,6 +125,15 @@ pub enum ScraperError {
         "could not find validator information for {address}; the validator has signed a commit"
     )]
     MissingValidatorInfoCommitted { address: String },
+
+    #[error("pruning.interval must not be set to 0. If you want to disable pruning, select pruning.strategy = \"nothing\"")]
+    ZeroPruningInterval,
+
+    #[error("pruning.interval must not be smaller than {}. got: {interval}. for most aggressive pruning, select pruning.strategy = \"everything\"", EVERYTHING_PRUNING_INTERVAL)]
+    TooSmallPruningInterval { interval: u32 },
+
+    #[error("pruning.keep_recent must not be smaller than {}. got: {keep_recent}. for most aggressive pruning, select pruning.strategy = \"everything\"", EVERYTHING_PRUNING_KEEP_RECENT)]
+    TooSmallKeepRecent { keep_recent: u32 },
 }
 
 impl<T> From<SendError<T>> for ScraperError {

common/nyxd-scraper/src/lib.rs

@@ -14,6 +14,7 @@ pub(crate) mod rpc_client;
 pub(crate) mod scraper;
 pub mod storage;
 
+pub use block_processor::pruning::{PruningOptions, PruningStrategy};
 pub use modules::{BlockModule, MsgModule, TxModule};
 pub use scraper::{Config, NyxdScraper};
 pub use storage::models;

common/nyxd-scraper/src/scraper/mod.rs

@@ -8,6 +8,7 @@ use crate::modules::{BlockModule, MsgModule, TxModule};
 use crate::rpc_client::RpcClient;
 use crate::scraper::subscriber::ChainSubscriber;
 use crate::storage::ScraperStorage;
+use crate::PruningOptions;
 use std::path::PathBuf;
 use std::sync::Arc;
 use tokio::sync::mpsc::{channel, unbounded_channel};
@@ -27,6 +28,8 @@ pub struct Config {
     pub rpc_url: Url,
 
     pub database_path: PathBuf,
+
+    pub pruning_options: PruningOptions,
 }
 
 pub struct NyxdScraperBuilder {
@@ -54,6 +57,7 @@ impl NyxdScraperBuilder {
             processing_tx.clone(),
         );
         let mut block_processor = BlockProcessor::new(
+            scraper.config.pruning_options,
             scraper.cancel_token.clone(),
             scraper.startup_sync.clone(),
             processing_rx,
@@ -119,6 +123,7 @@ impl NyxdScraper {
     }
 
     pub async fn new(config: Config) -> Result<Self, ScraperError> {
+        config.pruning_options.validate()?;
         let storage = ScraperStorage::init(&config.database_path).await?;
 
         Ok(NyxdScraper {
@@ -160,6 +165,7 @@ impl NyxdScraper {
             processing_tx.clone(),
         );
         let block_processor = BlockProcessor::new(
+            self.config.pruning_options,
             self.cancel_token.clone(),
             self.startup_sync.clone(),
             processing_rx,

common/nyxd-scraper/src/storage/manager.rs

@@ -1,9 +1,11 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::storage::log_db_operation_time;
 use crate::storage::models::{CommitSignature, Validator};
 use sqlx::types::time::OffsetDateTime;
 use sqlx::{Executor, Sqlite};
+use tokio::time::Instant;
 use tracing::{instrument, trace};
 
 #[derive(Clone)]
@@ -25,10 +27,36 @@ impl StorageManager {
         Ok(())
     }
 
+    pub(crate) async fn get_lowest_block(&self) -> Result<Option<i64>, sqlx::Error> {
+        trace!("get_lowest_block");
+        let start = Instant::now();
+
+        let maybe_record = sqlx::query!(
+            r#"
+                SELECT height
+                FROM block
+                ORDER BY height ASC
+                LIMIT 1
+            "#,
+        )
+        .fetch_optional(&self.connection_pool)
+        .await?;
+        log_db_operation_time("get_lowest_block", start);
+
+        if let Some(row) = maybe_record {
+            Ok(row.height)
+        } else {
+            Ok(None)
+        }
+    }
+
     pub(crate) async fn get_first_block_height_after(
         &self,
         time: OffsetDateTime,
     ) -> Result<Option<i64>, sqlx::Error> {
+        trace!("get_first_block_height_after");
+        let start = Instant::now();
+
         let maybe_record = sqlx::query!(
             r#"
                 SELECT height
@@ -41,6 +69,7 @@ impl StorageManager {
         )
         .fetch_optional(&self.connection_pool)
         .await?;
+        log_db_operation_time("get_first_block_height_after", start);
 
         if let Some(row) = maybe_record {
             Ok(row.height)
@@ -53,6 +82,9 @@ impl StorageManager {
         &self,
         time: OffsetDateTime,
     ) -> Result<Option<i64>, sqlx::Error> {
+        trace!("get_last_block_height_before");
+        let start = Instant::now();
+
         let maybe_record = sqlx::query!(
             r#"
                 SELECT height
@@ -65,6 +97,7 @@ impl StorageManager {
         )
         .fetch_optional(&self.connection_pool)
         .await?;
+        log_db_operation_time("get_last_block_height_before", start);
 
         if let Some(row) = maybe_record {
             Ok(row.height)
@@ -79,6 +112,9 @@ impl StorageManager {
         start_height: i64,
         end_height: i64,
     ) -> Result<i32, sqlx::Error> {
+        trace!("get_signed_between");
+        let start = Instant::now();
+
         let count = sqlx::query!(
             r#"
                 SELECT COUNT(*) as count FROM pre_commit
@@ -94,6 +130,7 @@ impl StorageManager {
         .fetch_one(&self.connection_pool)
         .await?
         .count;
+        log_db_operation_time("get_signed_between", start);
 
         Ok(count)
     }
@@ -103,7 +140,10 @@ impl StorageManager {
         consensus_address: &str,
         height: i64,
     ) -> Result<Option<CommitSignature>, sqlx::Error> {
-        sqlx::query_as(
+        trace!("get_precommit");
+        let start = Instant::now();
+
+        let res = sqlx::query_as(
             r#"
                 SELECT * FROM pre_commit
                 WHERE validator_address = ? 
@@ -113,14 +153,20 @@ impl StorageManager {
         .bind(consensus_address)
         .bind(height)
         .fetch_optional(&self.connection_pool)
-        .await
+        .await?;
+        log_db_operation_time("get_precommit", start);
+
+        Ok(res)
     }
 
     pub(crate) async fn get_block_validators(
         &self,
         height: i64,
     ) -> Result<Vec<Validator>, sqlx::Error> {
-        sqlx::query_as!(
+        trace!("get_block_validators");
+        let start = Instant::now();
+
+        let res = sqlx::query_as!(
             Validator,
             r#"
                 SELECT * FROM validator 
@@ -133,16 +179,28 @@ impl StorageManager {
             height
         )
         .fetch_all(&self.connection_pool)
-        .await
+        .await?;
+        log_db_operation_time("get_block_validators", start);
+
+        Ok(res)
     }
 
     pub(crate) async fn get_validators(&self) -> Result<Vec<Validator>, sqlx::Error> {
-        sqlx::query_as("SELECT * FROM validator")
+        trace!("get_validators");
+        let start = Instant::now();
+
+        let res = sqlx::query_as("SELECT * FROM validator")
             .fetch_all(&self.connection_pool)
-            .await
+            .await?;
+        log_db_operation_time("get_validators", start);
+
+        Ok(res)
     }
 
     pub(crate) async fn get_last_processed_height(&self) -> Result<i64, sqlx::Error> {
+        trace!("get_last_processed_height");
+        let start = Instant::now();
+
         let maybe_record = sqlx::query!(
             r#"
                 SELECT last_processed_height FROM metadata
@@ -150,6 +208,7 @@ impl StorageManager {
         )
         .fetch_optional(&self.connection_pool)
         .await?;
+        log_db_operation_time("get_last_processed_height", start);
 
         if let Some(row) = maybe_record {
             Ok(row.last_processed_height)
@@ -157,6 +216,27 @@ impl StorageManager {
             Ok(-1)
         }
     }
+
+    pub(crate) async fn get_pruned_height(&self) -> Result<i64, sqlx::Error> {
+        trace!("get_pruned_height");
+        let start = Instant::now();
+
+        let maybe_record = sqlx::query!(
+            r#"
+                SELECT last_pruned_height FROM pruning
+            "#
+        )
+        .fetch_optional(&self.connection_pool)
+        .await?;
+
+        log_db_operation_time("get_pruned_height", start);
+
+        if let Some(row) = maybe_record {
+            Ok(row.last_pruned_height)
+        } else {
+            Ok(-1)
+        }
+    }
 }
 
 // make those generic over executor so that they could be performed over connection pool and a tx
@@ -170,7 +250,8 @@ pub(crate) async fn insert_validator<'a, E>(
 where
     E: Executor<'a, Database = Sqlite>,
 {
-    trace!("insert validator");
+    trace!("insert_validator");
+    let start = Instant::now();
 
     sqlx::query!(
         r#"
@@ -183,6 +264,7 @@ where
     )
     .execute(executor)
     .await?;
+    log_db_operation_time("insert_validator", start);
 
     Ok(())
 }
@@ -200,7 +282,8 @@ pub(crate) async fn insert_block<'a, E>(
 where
     E: Executor<'a, Database = Sqlite>,
 {
-    trace!("insert block");
+    trace!("insert_block");
+    let start = Instant::now();
 
     sqlx::query!(
         r#"
@@ -217,6 +300,7 @@ where
     )
     .execute(executor)
     .await?;
+    log_db_operation_time("insert_block", start);
 
     Ok(())
 }
@@ -233,7 +317,8 @@ pub(crate) async fn insert_precommit<'a, E>(
 where
     E: Executor<'a, Database = Sqlite>,
 {
-    trace!("insert precommit");
+    trace!("insert_precommit");
+    let start = Instant::now();
 
     sqlx::query!(
         r#"
@@ -249,6 +334,7 @@ where
     )
     .execute(executor)
     .await?;
+    log_db_operation_time("insert_precommit", start);
 
     Ok(())
 }
@@ -270,7 +356,8 @@ pub(crate) async fn insert_transaction<'a, E>(
 where
     E: Executor<'a, Database = Sqlite>,
 {
-    trace!("insert transaction");
+    trace!("insert_transaction");
+    let start = Instant::now();
 
     sqlx::query!(
         r#"
@@ -298,6 +385,7 @@ where
     )
         .execute(executor)
         .await?;
+    log_db_operation_time("insert_transaction", start);
 
     Ok(())
 }
@@ -313,7 +401,8 @@ pub(crate) async fn insert_message<'a, E>(
 where
     E: Executor<'a, Database = Sqlite>,
 {
-    trace!("insert message");
+    trace!("insert_message");
+    let start = Instant::now();
 
     sqlx::query!(
         r#"
@@ -330,6 +419,7 @@ where
     )
     .execute(executor)
     .await?;
+    log_db_operation_time("insert_message", start);
 
     Ok(())
 }
@@ -343,10 +433,100 @@ where
     E: Executor<'a, Database = Sqlite>,
 {
     trace!("update_last_processed");
+    let start = Instant::now();
 
     sqlx::query!("UPDATE metadata SET last_processed_height = ?", height)
         .execute(executor)
         .await?;
+    log_db_operation_time("update_last_processed", start);
+
+    Ok(())
+}
+
+#[instrument(skip(executor))]
+pub(crate) async fn update_last_pruned<'a, E>(height: i64, executor: E) -> Result<(), sqlx::Error>
+where
+    E: Executor<'a, Database = Sqlite>,
+{
+    trace!("update_last_pruned");
+    let start = Instant::now();
+
+    sqlx::query!("UPDATE pruning SET last_pruned_height = ?", height)
+        .execute(executor)
+        .await?;
+    log_db_operation_time("update_last_pruned", start);
+
+    Ok(())
+}
+
+pub(crate) async fn prune_blocks<'a, E>(oldest_to_keep: i64, executor: E) -> Result<(), sqlx::Error>
+where
+    E: Executor<'a, Database = Sqlite>,
+{
+    trace!("prune_blocks");
+    let start = Instant::now();
+
+    sqlx::query!("DELETE FROM block WHERE height < ?", oldest_to_keep)
+        .execute(executor)
+        .await?;
+    log_db_operation_time("prune_blocks", start);
+
+    Ok(())
+}
+
+pub(crate) async fn prune_pre_commits<'a, E>(
+    oldest_to_keep: i64,
+    executor: E,
+) -> Result<(), sqlx::Error>
+where
+    E: Executor<'a, Database = Sqlite>,
+{
+    trace!("prune_pre_commits");
+    let start = Instant::now();
+
+    sqlx::query!("DELETE FROM pre_commit WHERE height < ?", oldest_to_keep)
+        .execute(executor)
+        .await?;
+    log_db_operation_time("prune_pre_commits", start);
+
+    Ok(())
+}
+
+pub(crate) async fn prune_transactions<'a, E>(
+    oldest_to_keep: i64,
+    executor: E,
+) -> Result<(), sqlx::Error>
+where
+    E: Executor<'a, Database = Sqlite>,
+{
+    trace!("prune_transactions");
+    let start = Instant::now();
+
+    sqlx::query!(
+        "DELETE FROM \"transaction\" WHERE height < ?",
+        oldest_to_keep
+    )
+    .execute(executor)
+    .await?;
+    log_db_operation_time("prune_transactions", start);
+
+    Ok(())
+}
+
+pub(crate) async fn prune_messages<'a, E>(
+    oldest_to_keep: i64,
+    executor: E,
+) -> Result<(), sqlx::Error>
+where
+    E: Executor<'a, Database = Sqlite>,
+{
+    trace!("prune_messages");
+    let start = Instant::now();
+
+    sqlx::query!("DELETE FROM message WHERE height < ?", oldest_to_keep)
+        .execute(executor)
+        .await?;
+    log_db_operation_time("prune_messages", start);
 
     Ok(())
 }

common/nyxd-scraper/src/storage/mod.rs

@@ -5,7 +5,8 @@ use crate::block_processor::types::{FullBlockInformation, ParsedTransactionRespo
 use crate::error::ScraperError;
 use crate::storage::manager::{
     insert_block, insert_message, insert_precommit, insert_transaction, insert_validator,
-    update_last_processed, StorageManager,
+    prune_blocks, prune_messages, prune_pre_commits, prune_transactions, update_last_processed,
+    update_last_pruned, StorageManager,
 };
 use crate::storage::models::{CommitSignature, Validator};
 use sqlx::types::time::OffsetDateTime;
@@ -15,6 +16,7 @@ use std::path::Path;
 use tendermint::block::{Commit, CommitSig};
 use tendermint::Block;
 use tendermint_rpc::endpoint::validators;
+use tokio::time::Instant;
 use tracing::{debug, error, info, instrument, trace, warn};
 
 mod helpers;
@@ -28,6 +30,19 @@ pub struct ScraperStorage {
     pub(crate) manager: StorageManager,
 }
 
+pub(crate) fn log_db_operation_time(op_name: &str, start_time: Instant) {
+    let elapsed = start_time.elapsed();
+    let formatted = humantime::format_duration(elapsed);
+
+    match elapsed.as_millis() {
+        v if v > 10000 => error!("{op_name} took {formatted} to execute"),
+        v if v > 1000 => warn!("{op_name} took {formatted} to execute"),
+        v if v > 100 => info!("{op_name} took {formatted} to execute"),
+        v if v > 10 => debug!("{op_name} took {formatted} to execute"),
+        _ => trace!("{op_name} took {formatted} to execute"),
+    }
+}
+
 impl ScraperStorage {
     #[instrument]
     pub async fn init<P: AsRef<Path> + Debug>(database_path: P) -> Result<Self, ScraperError> {
@@ -65,6 +80,32 @@ impl ScraperStorage {
         Ok(storage)
     }
 
+    #[instrument(skip(self))]
+    pub async fn prune_storage(
+        &self,
+        oldest_to_keep: u32,
+        current_height: u32,
+    ) -> Result<(), ScraperError> {
+        let start = Instant::now();
+
+        let mut tx = self.begin_processing_tx().await?;
+
+        prune_messages(oldest_to_keep.into(), &mut tx).await?;
+        prune_transactions(oldest_to_keep.into(), &mut tx).await?;
+        prune_pre_commits(oldest_to_keep.into(), &mut tx).await?;
+        prune_blocks(oldest_to_keep.into(), &mut tx).await?;
+        update_last_pruned(current_height.into(), &mut tx).await?;
+
+        let commit_start = Instant::now();
+        tx.commit()
+            .await
+            .map_err(|source| ScraperError::StorageTxCommitFailure { source })?;
+        log_db_operation_time("committing pruning tx", commit_start);
+
+        log_db_operation_time("pruning storage", start);
+        Ok(())
+    }
+
     #[instrument(skip_all)]
     pub async fn begin_processing_tx(&self) -> Result<StorageTransaction, ScraperError> {
         debug!("starting storage tx");
@@ -75,6 +116,10 @@ impl ScraperStorage {
             .map_err(|source| ScraperError::StorageTxBeginFailure { source })
     }
 
+    pub async fn lowest_block_height(&self) -> Result<Option<i64>, ScraperError> {
+        Ok(self.manager.get_lowest_block().await?)
+    }
+
     pub async fn get_first_block_height_after(
         &self,
         time: OffsetDateTime,
@@ -155,6 +200,10 @@ impl ScraperStorage {
     pub async fn get_last_processed_height(&self) -> Result<i64, ScraperError> {
         Ok(self.manager.get_last_processed_height().await?)
     }
+
+    pub async fn get_pruned_height(&self) -> Result<i64, ScraperError> {
+        Ok(self.manager.get_pruned_height().await?)
+    }
 }
 
 pub async fn persist_block(

common/tun/src/linux/tun_device.rs

@@ -159,7 +159,7 @@ impl TunDevice {
                 "add",
                 &format!("{}/{}", ipv6, netmaskv6),
                 "dev",
-                &tun.name(),
+                (tun.name()),
             ])
             .output()?;
         Ok(tun)

common/types/src/delegation.rs

@@ -50,7 +50,7 @@ pub struct DelegationWithEverything {
     pub accumulated_by_delegates: Option<DecCoin>,
     pub accumulated_by_operator: Option<DecCoin>,
     pub block_height: u64,
-    pub delegated_on_iso_datetime: String,
+    pub delegated_on_iso_datetime: Option<String>,
     pub cost_params: Option<MixNodeCostParams>,
     pub avg_uptime_percent: Option<u8>,
 
@@ -60,6 +60,8 @@ pub struct DelegationWithEverything {
     pub uses_vesting_contract_tokens: bool,
     pub unclaimed_rewards: Option<DecCoin>,
 
+    pub errors: Option<String>,
+
     // DEPRECATED, IF POSSIBLE TRY TO DISCONTINUE USE OF IT!
     pub pending_events: Vec<DelegationEvent>,
     pub mixnode_is_unbonding: Option<bool>,

common/types/src/gateway.rs

@@ -171,3 +171,25 @@ impl fmt::Display for GatewayIpPacketRouterDetails {
         writeln!(f, "\taddress: {}", self.address)
     }
 }
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct GatewayWireguardDetails {
+    pub enabled: bool,
+
+    pub announced_port: u16,
+    pub private_network_prefix: u8,
+}
+
+impl fmt::Display for GatewayWireguardDetails {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        writeln!(f, "wireguard:")?;
+        writeln!(f, "\tenabled: {}", self.enabled)?;
+
+        writeln!(f, "\tannounced_port: {}", self.announced_port)?;
+        writeln!(
+            f,
+            "\tprivate_network_prefix: {}",
+            self.private_network_prefix
+        )
+    }
+}

common/wireguard-types/Cargo.toml

@@ -17,7 +17,9 @@ log = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 thiserror = { workspace = true }
 
+nym-config = { path = "../config" }
 nym-crypto = { path = "../crypto", features = ["asymmetric"] }
+nym-network-defaults = { path = "../network-defaults" }
 
 # feature-specific dependencies:
 

common/wireguard-types/src/config.rs

@@ -0,0 +1,23 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use std::net::{IpAddr, SocketAddr};
+
+#[derive(Copy, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, Debug)]
+pub struct Config {
+    /// Socket address this node will use for binding its wireguard interface.
+    /// default: `0.0.0.0:51822`
+    pub bind_address: SocketAddr,
+
+    /// Private IP address of the wireguard gateway.
+    /// default: `10.1.0.1`
+    pub private_ip: IpAddr,
+
+    /// Port announced to external clients wishing to connect to the wireguard interface.
+    /// Useful in the instances where the node is behind a proxy.
+    pub announced_port: u16,
+
+    /// The prefix denoting the maximum number of the clients that can be connected via Wireguard.
+    /// The maximum value for IPv4 is 32 and for IPv6 is 128
+    pub private_network_prefix: u8,
+}

common/wireguard-types/src/lib.rs

@@ -1,15 +1,51 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use dashmap::DashMap;
+use nym_crypto::asymmetric::encryption::KeyPair;
+use std::sync::Arc;
+
+pub mod config;
 pub mod error;
 pub mod public_key;
 pub mod registration;
 
+pub use config::Config;
 pub use error::Error;
 pub use public_key::PeerPublicKey;
 pub use registration::{
-    ClientMac, ClientMessage, ClientRegistrationResponse, GatewayClient, InitMessage, Nonce,
+    ClientMac, ClientMessage, ClientRegistrationResponse, GatewayClient, GatewayClientRegistry,
+    InitMessage, Nonce,
 };
 
 #[cfg(feature = "verify")]
 pub use registration::HmacSha256;
+
+#[derive(Clone)]
+pub struct WireguardGatewayData {
+    config: Config,
+    keypair: Arc<KeyPair>,
+    client_registry: Arc<GatewayClientRegistry>,
+}
+
+impl WireguardGatewayData {
+    pub fn new(config: Config, keypair: Arc<KeyPair>) -> Self {
+        WireguardGatewayData {
+            config,
+            keypair,
+            client_registry: Arc::new(DashMap::default()),
+        }
+    }
+
+    pub fn config(&self) -> Config {
+        self.config
+    }
+
+    pub fn keypair(&self) -> &Arc<KeyPair> {
+        &self.keypair
+    }
+
+    pub fn client_registry(&self) -> &Arc<GatewayClientRegistry> {
+        &self.client_registry
+    }
+}

common/wireguard-types/src/public_key.rs

@@ -24,6 +24,10 @@ impl PeerPublicKey {
     pub fn as_bytes(&self) -> &[u8] {
         self.0.as_bytes()
     }
+
+    pub fn inner(&self) -> PublicKey {
+        self.0
+    }
 }
 
 impl fmt::Display for PeerPublicKey {

common/wireguard-types/src/registration.rs

@@ -12,7 +12,7 @@ use std::{fmt, ops::Deref, str::FromStr};
 #[cfg(feature = "verify")]
 use hmac::{Hmac, Mac};
 #[cfg(feature = "verify")]
-use nym_crypto::asymmetric::encryption::{PrivateKey, PublicKey};
+use nym_crypto::asymmetric::encryption::PrivateKey;
 #[cfg(feature = "verify")]
 use sha2::Sha256;
 
@@ -87,7 +87,7 @@ impl GatewayClient {
     #[cfg(feature = "verify")]
     pub fn new(
         local_secret: &PrivateKey,
-        remote_public: PublicKey,
+        remote_public: x25519_dalek::PublicKey,
         private_ip: IpAddr,
         nonce: u64,
     ) -> Self {
@@ -96,8 +96,6 @@ impl GatewayClient {
         let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
         let local_public: x25519_dalek::PublicKey = (&static_secret).into();
 
-        let remote_public = x25519_dalek::PublicKey::from(remote_public.to_bytes());
-
         let dh = static_secret.diffie_hellman(&remote_public);
 
         // TODO: change that to use our nym_crypto::hmac module instead

common/wireguard/src/lib.rs

@@ -3,40 +3,37 @@
 // #![warn(clippy::expect_used)]
 // #![warn(clippy::unwrap_used)]
 
-pub mod setup;
-
 /// Start wireguard device
 #[cfg(target_os = "linux")]
 pub async fn start_wireguard(
     mut task_client: nym_task::TaskClient,
-    _gateway_client_registry: std::sync::Arc<
-        nym_wireguard_types::registration::GatewayClientRegistry,
-    >,
+    wireguard_data: std::sync::Arc<nym_wireguard_types::WireguardGatewayData>,
 ) -> Result<defguard_wireguard_rs::WGApi, Box<dyn std::error::Error + Send + Sync + 'static>> {
-    use crate::setup::{peer_allowed_ips, peer_static_public_key, PRIVATE_KEY};
+    use base64::{prelude::BASE64_STANDARD, Engine};
     use defguard_wireguard_rs::{
         host::Peer, key::Key, net::IpAddrMask, InterfaceConfiguration, WGApi, WireguardInterfaceApi,
     };
-    use nym_network_defaults::{WG_PORT, WG_TUN_DEVICE_ADDRESS};
+
+    let mut peers = vec![];
+    for peer_client in wireguard_data.client_registry().iter() {
+        let mut peer = Peer::new(Key::new(peer_client.pub_key.to_bytes()));
+        let peer_ip_mask = IpAddrMask::new(peer_client.private_ip, 32);
+        peer.set_allowed_ips(vec![peer_ip_mask]);
+        peers.push(peer);
+    }
 
     let ifname = String::from("wg0");
     let wgapi = WGApi::new(ifname.clone(), false)?;
     wgapi.create_interface()?;
     let interface_config = InterfaceConfiguration {
         name: ifname.clone(),
-        prvkey: PRIVATE_KEY.to_string(),
-        address: WG_TUN_DEVICE_ADDRESS.to_string(),
-        port: WG_PORT as u32,
-        peers: vec![],
+        prvkey: BASE64_STANDARD.encode(wireguard_data.keypair().private_key().to_bytes()),
+        address: wireguard_data.config().private_ip.to_string(),
+        port: wireguard_data.config().announced_port as u32,
+        peers,
     };
     wgapi.configure_interface(&interface_config)?;
-    let peer = peer_static_public_key();
-    let mut peer = Peer::new(Key::new(peer.to_bytes()));
-    let peer_ip = peer_allowed_ips();
-    let peer_ip_mask = IpAddrMask::new(peer_ip.network_address(), peer_ip.netmask());
-    peer.set_allowed_ips(vec![peer_ip_mask]);
-    wgapi.configure_peer(&peer)?;
-    wgapi.configure_peer_routing(&[peer.clone()])?;
+    // wgapi.configure_peer_routing(&peers)?;
 
     tokio::spawn(async move { task_client.recv().await });
 

common/wireguard/src/setup.rs

@@ -1,56 +0,0 @@
-use std::net::IpAddr;
-
-use base64::{engine::general_purpose, Engine as _};
-use log::info;
-
-// The wireguard UDP listener
-pub const WG_ADDRESS: &str = "0.0.0.0";
-
-// The private key of the listener
-// Corresponding public key: "WM8s8bYegwMa0TJ+xIwhk+dImk2IpDUKslDBCZPizlE="
-pub(crate) const PRIVATE_KEY: &str = "AEqXrLFT4qjYq3wmX0456iv94uM6nDj5ugp6Jedcflg=";
-
-// The AllowedIPs for the connected peer, which is one a single IP and the same as the IP that the
-// peer has configured on their side.
-const ALLOWED_IPS: &str = "10.1.0.2";
-
-fn decode_base64_key(base64_key: &str) -> [u8; 32] {
-    general_purpose::STANDARD
-        .decode(base64_key)
-        .unwrap()
-        .try_into()
-        .unwrap()
-}
-
-pub fn server_static_private_key() -> x25519_dalek::StaticSecret {
-    // TODO: this is a temporary solution for development
-    let static_private_bytes: [u8; 32] = decode_base64_key(PRIVATE_KEY);
-    let static_private = x25519_dalek::StaticSecret::from(static_private_bytes);
-    let static_public = x25519_dalek::PublicKey::from(&static_private);
-    info!(
-        "wg public key: {}",
-        general_purpose::STANDARD.encode(static_public)
-    );
-    static_private
-}
-
-pub fn peer_static_public_key() -> x25519_dalek::PublicKey {
-    // A single static public key is used during development
-
-    // Read from NYM_PEER_PUBLIC_KEY env variable
-    let peer = std::env::var("NYM_PEER_PUBLIC_KEY").expect("NYM_PEER_PUBLIC_KEY must be set");
-
-    let peer_static_public_bytes: [u8; 32] = decode_base64_key(&peer);
-    let peer_static_public = x25519_dalek::PublicKey::from(peer_static_public_bytes);
-    info!(
-        "Adding wg peer public key: {}",
-        general_purpose::STANDARD.encode(peer_static_public)
-    );
-    peer_static_public
-}
-
-pub fn peer_allowed_ips() -> ip_network::IpNetwork {
-    let key: IpAddr = ALLOWED_IPS.parse().unwrap();
-    let cidr = 32u8;
-    ip_network::IpNetwork::new_truncate(key, cidr).unwrap()
-}

documentation/build_all_to_dist.sh

@@ -26,6 +26,7 @@ else
       echo "cleaning old book"
       rm -rf ./book/
       # build book
+      # mdbook test || true
       mdbook build
       # check for destination, if ! then mkdir & check again else echo thumbs up
       if [ ! -d ../../dist/docs/$i ]; then

documentation/dev-portal/book.toml

@@ -24,7 +24,7 @@ turn-off = false
 
 [preprocessor.admonish]
 command = "mdbook-admonish"
-assets_version = "3.0.0" # do not edit: managed by `mdbook-admonish install`
+assets_version = "3.0.2" # do not edit: managed by `mdbook-admonish install`
 
 # https://gitlab.com/tglman/mdbook-variables/
 [preprocessor.variables.variables]

documentation/dev-portal/nym_themes/mdbook-admonish.css

@@ -1,20 +1,4 @@
 @charset "UTF-8";
-:root {
-  --md-admonition-icon--admonish-note: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z'/></svg>");
-  --md-admonition-icon--admonish-abstract: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17 9H7V7h10m0 6H7v-2h10m-3 6H7v-2h7M12 3a1 1 0 0 1 1 1 1 1 0 0 1-1 1 1 1 0 0 1-1-1 1 1 0 0 1 1-1m7 0h-4.18C14.4 1.84 13.3 1 12 1c-1.3 0-2.4.84-2.82 2H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2z'/></svg>");
-  --md-admonition-icon--admonish-info: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 9h-2V7h2m0 10h-2v-6h2m-1-9A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10A10 10 0 0 0 12 2z'/></svg>");
-  --md-admonition-icon--admonish-tip: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17.66 11.2c-.23-.3-.51-.56-.77-.82-.67-.6-1.43-1.03-2.07-1.66C13.33 7.26 13 4.85 13.95 3c-.95.23-1.78.75-2.49 1.32-2.59 2.08-3.61 5.75-2.39 8.9.04.1.08.2.08.33 0 .22-.15.42-.35.5-.23.1-.47.04-.66-.12a.58.58 0 0 1-.14-.17c-1.13-1.43-1.31-3.48-.55-5.12C5.78 10 4.87 12.3 5 14.47c.06.5.12 1 .29 1.5.14.6.41 1.2.71 1.73 1.08 1.73 2.95 2.97 4.96 3.22 2.14.27 4.43-.12 6.07-1.6 1.83-1.66 2.47-4.32 1.53-6.6l-.13-.26c-.21-.46-.77-1.26-.77-1.26m-3.16 6.3c-.28.24-.74.5-1.1.6-1.12.4-2.24-.16-2.9-.82 1.19-.28 1.9-1.16 2.11-2.05.17-.8-.15-1.46-.28-2.23-.12-.74-.1-1.37.17-2.06.19.38.39.76.63 1.06.77 1 1.98 1.44 2.24 2.8.04.14.06.28.06.43.03.82-.33 1.72-.93 2.27z'/></svg>");
-  --md-admonition-icon--admonish-success: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m9 20.42-6.21-6.21 2.83-2.83L9 14.77l9.88-9.89 2.83 2.83L9 20.42z'/></svg>");
-  --md-admonition-icon--admonish-question: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m15.07 11.25-.9.92C13.45 12.89 13 13.5 13 15h-2v-.5c0-1.11.45-2.11 1.17-2.83l1.24-1.26c.37-.36.59-.86.59-1.41a2 2 0 0 0-2-2 2 2 0 0 0-2 2H8a4 4 0 0 1 4-4 4 4 0 0 1 4 4 3.2 3.2 0 0 1-.93 2.25M13 19h-2v-2h2M12 2A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10c0-5.53-4.5-10-10-10z'/></svg>");
-  --md-admonition-icon--admonish-warning: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 14h-2V9h2m0 9h-2v-2h2M1 21h22L12 2 1 21z'/></svg>");
-  --md-admonition-icon--admonish-failure: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20 6.91 17.09 4 12 9.09 6.91 4 4 6.91 9.09 12 4 17.09 6.91 20 12 14.91 17.09 20 20 17.09 14.91 12 20 6.91z'/></svg>");
-  --md-admonition-icon--admonish-danger: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M11 15H6l7-14v8h5l-7 14v-8z'/></svg>");
-  --md-admonition-icon--admonish-bug: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 12h-4v-2h4m0 6h-4v-2h4m6-6h-2.81a5.985 5.985 0 0 0-1.82-1.96L17 4.41 15.59 3l-2.17 2.17a6.002 6.002 0 0 0-2.83 0L8.41 3 7 4.41l1.62 1.63C7.88 6.55 7.26 7.22 6.81 8H4v2h2.09c-.05.33-.09.66-.09 1v1H4v2h2v1c0 .34.04.67.09 1H4v2h2.81c1.04 1.79 2.97 3 5.19 3s4.15-1.21 5.19-3H20v-2h-2.09c.05-.33.09-.66.09-1v-1h2v-2h-2v-1c0-.34-.04-.67-.09-1H20V8z'/></svg>");
-  --md-admonition-icon--admonish-example: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M7 13v-2h14v2H7m0 6v-2h14v2H7M7 7V5h14v2H7M3 8V5H2V4h2v4H3m-1 9v-1h3v4H2v-1h2v-.5H3v-1h1V17H2m2.25-7a.75.75 0 0 1 .75.75c0 .2-.08.39-.21.52L3.12 13H5v1H2v-.92L4 11H2v-1h2.25z'/></svg>");
-  --md-admonition-icon--admonish-quote: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 17h3l2-4V7h-6v6h3M6 17h3l2-4V7H5v6h3l-2 4z'/></svg>");
-  --md-details-icon: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M8.59 16.58 13.17 12 8.59 7.41 10 6l6 6-6 6-1.41-1.42Z'/></svg>");
-}
-
 :is(.admonition) {
   display: flow-root;
   margin: 1.5625em 0;
@@ -71,6 +55,8 @@ a.admonition-anchor-link::before {
   padding-inline: 4.4rem 1.2rem;
   font-weight: 700;
   background-color: rgba(68, 138, 255, 0.1);
+  print-color-adjust: exact;
+  -webkit-print-color-adjust: exact;
   display: flex;
 }
 :is(.admonition-title, summary.admonition-title) p {
@@ -86,6 +72,8 @@ html :is(.admonition-title, summary.admonition-title):last-child {
   width: 2rem;
   height: 2rem;
   background-color: #448aff;
+  print-color-adjust: exact;
+  -webkit-print-color-adjust: exact;
   mask-image: url('data:image/svg+xml;charset=utf-8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>');
   -webkit-mask-image: url('data:image/svg+xml;charset=utf-8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>');
   mask-repeat: no-repeat;
@@ -119,6 +107,25 @@ details[open].admonition > summary.admonition-title::after {
   transform: rotate(90deg);
 }
 
+:root {
+  --md-details-icon: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M8.59 16.58 13.17 12 8.59 7.41 10 6l6 6-6 6-1.41-1.42Z'/></svg>");
+}
+
+:root {
+  --md-admonition-icon--admonish-note: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z'/></svg>");
+  --md-admonition-icon--admonish-abstract: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17 9H7V7h10m0 6H7v-2h10m-3 6H7v-2h7M12 3a1 1 0 0 1 1 1 1 1 0 0 1-1 1 1 1 0 0 1-1-1 1 1 0 0 1 1-1m7 0h-4.18C14.4 1.84 13.3 1 12 1c-1.3 0-2.4.84-2.82 2H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2z'/></svg>");
+  --md-admonition-icon--admonish-info: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 9h-2V7h2m0 10h-2v-6h2m-1-9A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10A10 10 0 0 0 12 2z'/></svg>");
+  --md-admonition-icon--admonish-tip: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17.66 11.2c-.23-.3-.51-.56-.77-.82-.67-.6-1.43-1.03-2.07-1.66C13.33 7.26 13 4.85 13.95 3c-.95.23-1.78.75-2.49 1.32-2.59 2.08-3.61 5.75-2.39 8.9.04.1.08.2.08.33 0 .22-.15.42-.35.5-.23.1-.47.04-.66-.12a.58.58 0 0 1-.14-.17c-1.13-1.43-1.31-3.48-.55-5.12C5.78 10 4.87 12.3 5 14.47c.06.5.12 1 .29 1.5.14.6.41 1.2.71 1.73 1.08 1.73 2.95 2.97 4.96 3.22 2.14.27 4.43-.12 6.07-1.6 1.83-1.66 2.47-4.32 1.53-6.6l-.13-.26c-.21-.46-.77-1.26-.77-1.26m-3.16 6.3c-.28.24-.74.5-1.1.6-1.12.4-2.24-.16-2.9-.82 1.19-.28 1.9-1.16 2.11-2.05.17-.8-.15-1.46-.28-2.23-.12-.74-.1-1.37.17-2.06.19.38.39.76.63 1.06.77 1 1.98 1.44 2.24 2.8.04.14.06.28.06.43.03.82-.33 1.72-.93 2.27z'/></svg>");
+  --md-admonition-icon--admonish-success: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m9 20.42-6.21-6.21 2.83-2.83L9 14.77l9.88-9.89 2.83 2.83L9 20.42z'/></svg>");
+  --md-admonition-icon--admonish-question: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m15.07 11.25-.9.92C13.45 12.89 13 13.5 13 15h-2v-.5c0-1.11.45-2.11 1.17-2.83l1.24-1.26c.37-.36.59-.86.59-1.41a2 2 0 0 0-2-2 2 2 0 0 0-2 2H8a4 4 0 0 1 4-4 4 4 0 0 1 4 4 3.2 3.2 0 0 1-.93 2.25M13 19h-2v-2h2M12 2A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10c0-5.53-4.5-10-10-10z'/></svg>");
+  --md-admonition-icon--admonish-warning: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 14h-2V9h2m0 9h-2v-2h2M1 21h22L12 2 1 21z'/></svg>");
+  --md-admonition-icon--admonish-failure: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20 6.91 17.09 4 12 9.09 6.91 4 4 6.91 9.09 12 4 17.09 6.91 20 12 14.91 17.09 20 20 17.09 14.91 12 20 6.91z'/></svg>");
+  --md-admonition-icon--admonish-danger: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M11 15H6l7-14v8h5l-7 14v-8z'/></svg>");
+  --md-admonition-icon--admonish-bug: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 12h-4v-2h4m0 6h-4v-2h4m6-6h-2.81a5.985 5.985 0 0 0-1.82-1.96L17 4.41 15.59 3l-2.17 2.17a6.002 6.002 0 0 0-2.83 0L8.41 3 7 4.41l1.62 1.63C7.88 6.55 7.26 7.22 6.81 8H4v2h2.09c-.05.33-.09.66-.09 1v1H4v2h2v1c0 .34.04.67.09 1H4v2h2.81c1.04 1.79 2.97 3 5.19 3s4.15-1.21 5.19-3H20v-2h-2.09c.05-.33.09-.66.09-1v-1h2v-2h-2v-1c0-.34-.04-.67-.09-1H20V8z'/></svg>");
+  --md-admonition-icon--admonish-example: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M7 13v-2h14v2H7m0 6v-2h14v2H7M7 7V5h14v2H7M3 8V5H2V4h2v4H3m-1 9v-1h3v4H2v-1h2v-.5H3v-1h1V17H2m2.25-7a.75.75 0 0 1 .75.75c0 .2-.08.39-.21.52L3.12 13H5v1H2v-.92L4 11H2v-1h2.25z'/></svg>");
+  --md-admonition-icon--admonish-quote: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 17h3l2-4V7h-6v6h3M6 17h3l2-4V7H5v6h3l-2 4z'/></svg>");
+}
+
 :is(.admonition):is(.admonish-note) {
   border-color: #448aff;
 }

documentation/dev-portal/src/SUMMARY.md

@@ -20,17 +20,15 @@
 # User Manuals
 
 - [NymVPN alpha](nymvpn/intro.md)
-    - [GUI](nymvpn/gui.md)
-        - [Linux](nymvpn/gui-linux.md)
-        - [MacOS](nymvpn/gui-mac.md)
     - [CLI](nymvpn/cli.md)
-    - [Troubleshooting](nymvpn/troubleshooting.md)
-    - [NymVPN FAQ](nymvpn/faq.md)
+
+<!-- OUTDATED STUFF:
 - [NymConnect X Monero](tutorials/monero.md)
 - [NymConnect X Matrix](tutorials/matrix.md)
 - [NymConnect X Telegram](tutorials/telegram.md)
 - [NymConnect X Electrum](tutorials/electrum.md)
 - [NymConnect X Firo wallet](tutorials/firo.md)
+-->
 
 # Code Examples
 

documentation/dev-portal/src/nymvpn/cli.md

@@ -1,9 +1,20 @@
-# NymVPN alpha CLI Guide
+# NymVPN CLI Guide
 
 ```admonish info
-NymVPN is an experimental software and it's for testing purposes only. All users testing the client are expected to sign GDPR Information Sheet and Consent Form (shared at the workshop) so we use their results to improve the client, and submit the form [*NymVPN User research*]({{nym_vpn_form_url}}) with the testing results.
+NymVPN is an experimental software and it's for testing purposes only. Anyone can submit a registration to the private alpha round on [nymvpn.com](https://nymvpn.com/en).
 ```
 
+## Overview
+
+The core binaries consist of:
+
+- **`nym-vpn-cli`**: Basic commandline client for running the vpn. This runs in the foreground.
+
+- **`nym-vpnd`**: Daemon implementation of the vpn client that can run in the background and interacted with using `nym-vpnc`.
+
+- **`nym-vpnc`**: The commandline client used to interact with `nym-vpnd`.
+
+
 ## Installation
 
 > Any syntax in `<>` brackets is a user's/version unique variable. Exchange with a corresponding name without the `<>` brackets.
@@ -15,47 +26,93 @@ NymVPN is an experimental software and it's for testing purposes only. All users
 echo "<SHA_STRING>" | shasum -a 256 -c
 
 # choose a correct one according to your binary, this is just an example
-# echo "0e4abb461e86b2c168577e0294112a3bacd3a24bf8565b49783bfebd9b530e23  nym-vpn-cli_<!-- cmdrun scripts/nym_vpn_cli_version.sh -->_ubuntu-22.04_amd64.tar.gz" | shasum -a 256 -c
+# echo "0e4abb461e86b2c168577e0294112a3bacd3a24bf8565b49783bfebd9b530e23  nym-vpn-cli_<!-- cmdrun ../../../scripts/cmdrun/nym_vpn_cli_version.sh -->_ubuntu-22.04_amd64.tar.gz" | shasum -a 256 -c
 ```
 
 3. Extract files:
 ```sh
 tar -xvf <BINARY>.tar.gz
 # for example
-# tar -xvf nym-vpn-cli_<!-- cmdrun scripts/nym_vpn_cli_version.sh -->_ubuntu-22.04_x86_64.tar.gz
+# tar -xvf nym-vpn-cli_<!-- cmdrun ../../../scripts/cmdrun/nym_vpn_cli_version.sh -->_ubuntu-22.04_x86_64.tar.gz
 ```
 
-4. Make executable:
+## Running
+
+If you are running Debian/Ubuntu/PopOS or any other distributio supporting debian packages and systemd, see the [relevant section below](#debian-package-for-debianubuntupopos).
+
+### Daemon
+
+Start the daemon with
+
 ```sh
-# make sure you are in the right sub-directory
-chmod u+x nym-vpn-cli
+sudo -E ./nym-vpnd
 ```
 
-## Run NymVPN
+Then run
 
-**For NymVPN to work, all other VPNs must be switched off!** At this alpha stage of NymVPN, the network connection (wifi) must be reconnected after or in between the testing rounds.
-
-Make sure your terminal is open in the same directory as your `nym-vpn-cli` binary.
-
-1. Run it as root with `sudo` - the command will look like this with specified arguments:
 ```sh
-# choose only one conditional --argument listed in {brackets}
-sudo ./nym-vpn-cli { --exit-router-address <EXIT_ROUTER_ADDRESS>|--exit-gateway-id <EXIT_GATEWAY_ID>|--exit-gateway-country <EXIT_GATEWAY_COUNTRY> }
+./nym-vpnc status
+./nym-vpnc connect
+./nym-vpnc disconnect
 ```
 
-2. To choose different Gateways, visit [explorer.nymtech.net/network-components/gateways](https://explorer.nymtech.net/network-components/gateways) and copy-paste an identity key of your choice
+### CLI
+
+An alternative to the daemon is to run the `nym-vpn-cli` commandline client that runs in the foreground.
+```sh
+./nym-vpn-cli run
+```
+
+## Credentials
+
+NymVPN uses [zkNym bandwidth credentials](https://nymtech.net/docs/bandwidth-credentials.html). Those can be imported as a file or base58 encoded string.
+
+
+```sh
+sudo -E ./nym-vpn-cli import-credential --credential-path </PATH/TO/freepass.nym>
+sudo -E ./nym-vpn-cli import-credential --credential-data "<STRING>"
+```
+
+## Debian package for Debian/Ubuntu/PopOS
+
+For linux platforms using deb packages and systemd, there are also debian packages.
+
+```sh
+sudo apt install ./nym-vpnd_<!-- cmdrun ../../../scripts/cmdrun/nym_vpn_cli_version.sh -->-1_amd64.deb ./nym-vpnc_<!-- cmdrun ../../../scripts/cmdrun/nym_vpn_cli_version.sh -->-1_amd64.deb
+
+# In case of error please substitute the correct version
+```
+
+Installing the `nym-vpnd` deb package starts a `nym-vpnd.service`. Check that the daemon is running with
+```sh
+systemctl status nym-vpnd.service
+```
+and check its logs with
+```sh
+sudo journalctl -u nym-vpnd.service -f
+```
+To stop the background service
+```sh
+systemctl stop nym-vpnd.service
+```
+It will start again on startup, so disable with
+```sh
+systemctl disable nym-vpnd.service
+```
+
+Interact with it with `nym-vpnc`
+```sh
+nym-vpnc status
+nym-vpnc connect
+nym-vpnc disconnect
+```
+
+## Commands & Options
 
 ```admonish note
-Nym Exit Gateway functionality was implemented just recently and not all the Gateways are upgraded and ready to handle the VPN connections. If you want to make sure you are connecting to a Gateway with an embedded Network Requester, IP Packet Router and applied Nym exit policy, visit [this page](https://nymtech.net/events/fast-and-furious), scroll down to the list and search Gateways with all the functionalities enabled.
+Nym Exit Gateway functionality was implemented just recently and not all the Gateways are upgraded and ready to handle the VPN connections. If you want to make sure you are connecting to a Gateway with an embedded Network Requester, IP Packet Router and applied Nym exit policy, visit [harbourmaster.nymtech.net](https://harbourmaster.nymtech.net/) and search Gateways with all the functionalities enabled.
 ```
 
-3. See all possibilities in [command explanation](#cli-commands-and-options) section below
-
-4. In case of errors, see [troubleshooting section](troubleshooting.md)
-
-
-### CLI Commands and Options
-
 The basic syntax of `nym-vpn-cli` is:
 ```sh
 # choose only one conditional --argument listed in {brackets}
@@ -68,49 +125,18 @@ To see all the possibilities run with `--help` flag:
 ```
 ~~~admonish example collapsible=true title="Console output"
 ```sh
-Usage: nym-vpn-cli [OPTIONS] <--exit-router-address <EXIT_ROUTER_ADDRESS>|--exit-gateway-id <EXIT_GATEWAY_ID>|--exit-gateway-country <EXIT_GATEWAY_COUNTRY>>
+Usage: nym-vpn-cli [OPTIONS] <COMMAND>
+
+Commands:
+  run                Run the client
+  import-credential  Import credential
+  help               Print this message or the help of the given subcommand(s)
 
 Options:
-  -c, --config-env-file <CONFIG_ENV_FILE>
-          Path pointing to an env file describing the network
-      --mixnet-client-path <MIXNET_CLIENT_PATH>
-          Path to the data directory of a previously initialised mixnet client, where the keys reside
-      --entry-gateway-id <ENTRY_GATEWAY_ID>
-          Mixnet public ID of the entry gateway
-      --entry-gateway-country <ENTRY_GATEWAY_COUNTRY>
-          Auto-select entry gateway by country ISO
-      --entry-gateway-low-latency
-          Auto-select entry gateway by latency
-      --exit-router-address <EXIT_ROUTER_ADDRESS>
-          Mixnet recipient address
-      --exit-gateway-id <EXIT_GATEWAY_ID>
-
-      --exit-gateway-country <EXIT_GATEWAY_COUNTRY>
-          Mixnet recipient address
-      --enable-wireguard
-          Enable the wireguard traffic between the client and the entry gateway
-      --private-key <PRIVATE_KEY>
-          Associated private key
-      --wg-ip <WG_IP>
-          The IP address of the wireguard interface used for the first hop to the entry gateway
-      --nym-ipv4 <NYM_IPV4>
-          The IPv4 address of the nym TUN device that wraps IP packets in sphinx packets
-      --nym-ipv6 <NYM_IPV6>
-          The IPv6 address of the nym TUN device that wraps IP packets in sphinx packets
-      --nym-mtu <NYM_MTU>
-          The MTU of the nym TUN device that wraps IP packets in sphinx packets
-      --disable-routing
-          Disable routing all traffic through the nym TUN device. When the flag is set, the nym TUN device will be created, but to route traffic through it you will need to do it manually, e.g. ping -Itun0
-      --enable-two-hop
-          Enable two-hop mixnet traffic. This means that traffic jumps directly from entry gateway to exit gateway
-      --enable-poisson-rate
-          Enable Poisson process rate limiting of outbound traffic
-      --disable-background-cover-traffic
-          Disable constant rate background loop cover traffic
-  -h, --help
-          Print help
-  -V, --version
-          Print version
+  -c, --config-env-file <CONFIG_ENV_FILE>  Path pointing to an env file describing the network
+      --data-path <DATA_PATH>              Path to the data directory of the mixnet client
+  -h, --help                               Print help
+  -V, --version                            Print version
 ```
 ~~~
 
@@ -143,9 +169,9 @@ If you want to run NymVPN CLI in Nym Sandbox environment, there are a few adjust
 curl -o sandbox.env -L https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env
 ```
 
-1. Check available Gateways at [nymvpn.com/en/alpha/api/gateways](https://nymvpn.com/en/alpha/api/gateways)
+2. Check available Gateways at [nymvpn.com/en/alpha/api/gateways](https://nymvpn.com/en/alpha/api/gateways)
 
-2. Run with a flag `-c`
+3. Run with a flag `-c`
 ```sh
 sudo ./nym-vpn-cli -c <PATH_TO>/sandbox.env <--exit-router-address <EXIT_ROUTER_ADDRESS>|--exit-gateway-id <EXIT_GATEWAY_ID>|--exit-gateway-country <EXIT_GATEWAY_COUNTRY>>
 ```

documentation/dev-portal/src/nymvpn/intro.md

@@ -2,20 +2,12 @@
 
 <div style="padding:56.25% 0 0 0;position:relative;"><iframe src="https://player.vimeo.com/video/897010658?h=1f55870fe6&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479" frameborder="0" allow="autoplay; fullscreen; picture-in-picture" style="position:absolute;top:0;left:0;width:100%;height:100%;" title="NYMVPN alpha demo 37C3"></iframe></div><script src="https://player.vimeo.com/api/player.js"></script>
 
-**Nym proudly presents NymVPN alpha** - a client that uses [Nym Mixnet](https://nymtech.net) to anonymise all of a user's internet traffic through either a 5-hop mixnet (for a full network privacy) or the faster 2-hop decentralised VPN (with some extra features).
+**NymVPN alpha** is a client that uses [Nym Mixnet](https://nymtech.net) to anonymise all of a user's internet traffic through either a 5-hop mixnet (for a full network privacy) or the faster 2-hop decentralised VPN (with some extra features).
 
 
-**You are invited to take part in the alpha testing** of this new application. The following pages provide a how-to guide, explaining steps to install and run NymVPN [CLI](cli.md) and [GUI](gui.md).
+**You are invited to take part in the alpha testing** of this new application. Register for private testing round at [nymvpn.com](https://nymvpn.com/en), that will grant you access to the [download page](https://nymvpn.com/download). Visit [NymVPN Support & FAQ](https://nymvpn.com/en/support) or join the [NymVPN matrix channel](https://matrix.to/#/#NymVPN:nymtech.chat) if you have any questions, comments or blockers.
 
-**Here is how**
-
-1. Go to the NymVPN [testers form]({{nym_vpn_form_url}})
-2. Fill and submit the [form!]({{nym_vpn_form_url}})
-3. To test the GUI, [go here](gui.md)
-4. To test the CLI, [go here](cli.md)
-5. Join the [NymVPN matrix channel](https://matrix.to/#/#NymVPN:nymtech.chat) if you have any questions, comments or blockers
-
-***NymVPN alpha testing will last from 15th of January - 15th of February.***
+Checkout the [release page](https://github.com/nymtech/nym-vpn-client/releases) for available binaries.
 
 *NOTE: NymVPN alpha is experimental software for testing purposes only.*
 
@@ -36,16 +28,7 @@ client ───► Gateway ──┘  mix  │  mix  ┌─►mix ───►
                          mix  └─►mix──┘  mix
 ```
 
-Users can switch to 2-hop only mode, which is a faster but less private option. In this mode traffic is only sent between the two Gateways, and is not passed between Mix Nodes.
-
-The client can optionally do the first hop (local client to Entry Gateway) using Wireguard. NymVPN uses Mullvad libraries for wrapping `wireguard-go` and to setup local routing rules to route all traffic to the TUN virtual network device.
-
-## NymVPN Resources & Guides
-
-* [NymVPN webpage](https://nymvpn.com)
-* [Alpha release page]({{nym_vpn_releases}})
-* [NymVPN application (GUI) guide](gui.md)
-* [NymVPN Command Line Interface (CLI) guide](cli.md)
-* [Troubleshooting](troubleshooting.md)
-* [NymVPN FAQ](faq.md)
-* [NymVPN matrix channel](https://matrix.to/#/#NymVPN:nymtech.chat)
+Users can switch to 2-hop only mode, which is a faster but less private option. In this mode traffic is only sent between the two Gateways, and is not passed between Mix Nodes. It uses Mixnet Sphinx packets with shorter, fixed routes, which improve latency, but doesn't offer the same level of protection as the 5 hop mode.
+<!-- TO BE IMPLEMENTED:
+Users can switch to 2-hop only mode, which is a faster but less private option. In this mode traffic is only sent between the two Gateways, and is not passed between Mix Nodes. The client than use two wireguard tunnels with the entry and exit gateway, the Exit Gateway one being tunnelled itself through the entry gateway tunnel. NymVPN uses Mullvad libraries for wrapping `wireguard-go` and to setup local routing rules to route all traffic to the TUN virtual network device.
+-->

documentation/docs/book.toml

@@ -25,7 +25,7 @@ turn-off = true
 
 [preprocessor.admonish]
 command = "mdbook-admonish"
-assets_version = "3.0.0" # do not edit: managed by `mdbook-admonish install`
+assets_version = "3.0.2" # do not edit: managed by `mdbook-admonish install`
 
 # https://gitlab.com/tglman/mdbook-variables/
 [preprocessor.variables.variables]

documentation/docs/nym_themes/mdbook-admonish.css

@@ -1,20 +1,4 @@
 @charset "UTF-8";
-:root {
-  --md-admonition-icon--admonish-note: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z'/></svg>");
-  --md-admonition-icon--admonish-abstract: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17 9H7V7h10m0 6H7v-2h10m-3 6H7v-2h7M12 3a1 1 0 0 1 1 1 1 1 0 0 1-1 1 1 1 0 0 1-1-1 1 1 0 0 1 1-1m7 0h-4.18C14.4 1.84 13.3 1 12 1c-1.3 0-2.4.84-2.82 2H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2z'/></svg>");
-  --md-admonition-icon--admonish-info: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 9h-2V7h2m0 10h-2v-6h2m-1-9A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10A10 10 0 0 0 12 2z'/></svg>");
-  --md-admonition-icon--admonish-tip: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17.66 11.2c-.23-.3-.51-.56-.77-.82-.67-.6-1.43-1.03-2.07-1.66C13.33 7.26 13 4.85 13.95 3c-.95.23-1.78.75-2.49 1.32-2.59 2.08-3.61 5.75-2.39 8.9.04.1.08.2.08.33 0 .22-.15.42-.35.5-.23.1-.47.04-.66-.12a.58.58 0 0 1-.14-.17c-1.13-1.43-1.31-3.48-.55-5.12C5.78 10 4.87 12.3 5 14.47c.06.5.12 1 .29 1.5.14.6.41 1.2.71 1.73 1.08 1.73 2.95 2.97 4.96 3.22 2.14.27 4.43-.12 6.07-1.6 1.83-1.66 2.47-4.32 1.53-6.6l-.13-.26c-.21-.46-.77-1.26-.77-1.26m-3.16 6.3c-.28.24-.74.5-1.1.6-1.12.4-2.24-.16-2.9-.82 1.19-.28 1.9-1.16 2.11-2.05.17-.8-.15-1.46-.28-2.23-.12-.74-.1-1.37.17-2.06.19.38.39.76.63 1.06.77 1 1.98 1.44 2.24 2.8.04.14.06.28.06.43.03.82-.33 1.72-.93 2.27z'/></svg>");
-  --md-admonition-icon--admonish-success: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m9 20.42-6.21-6.21 2.83-2.83L9 14.77l9.88-9.89 2.83 2.83L9 20.42z'/></svg>");
-  --md-admonition-icon--admonish-question: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m15.07 11.25-.9.92C13.45 12.89 13 13.5 13 15h-2v-.5c0-1.11.45-2.11 1.17-2.83l1.24-1.26c.37-.36.59-.86.59-1.41a2 2 0 0 0-2-2 2 2 0 0 0-2 2H8a4 4 0 0 1 4-4 4 4 0 0 1 4 4 3.2 3.2 0 0 1-.93 2.25M13 19h-2v-2h2M12 2A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10c0-5.53-4.5-10-10-10z'/></svg>");
-  --md-admonition-icon--admonish-warning: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 14h-2V9h2m0 9h-2v-2h2M1 21h22L12 2 1 21z'/></svg>");
-  --md-admonition-icon--admonish-failure: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20 6.91 17.09 4 12 9.09 6.91 4 4 6.91 9.09 12 4 17.09 6.91 20 12 14.91 17.09 20 20 17.09 14.91 12 20 6.91z'/></svg>");
-  --md-admonition-icon--admonish-danger: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M11 15H6l7-14v8h5l-7 14v-8z'/></svg>");
-  --md-admonition-icon--admonish-bug: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 12h-4v-2h4m0 6h-4v-2h4m6-6h-2.81a5.985 5.985 0 0 0-1.82-1.96L17 4.41 15.59 3l-2.17 2.17a6.002 6.002 0 0 0-2.83 0L8.41 3 7 4.41l1.62 1.63C7.88 6.55 7.26 7.22 6.81 8H4v2h2.09c-.05.33-.09.66-.09 1v1H4v2h2v1c0 .34.04.67.09 1H4v2h2.81c1.04 1.79 2.97 3 5.19 3s4.15-1.21 5.19-3H20v-2h-2.09c.05-.33.09-.66.09-1v-1h2v-2h-2v-1c0-.34-.04-.67-.09-1H20V8z'/></svg>");
-  --md-admonition-icon--admonish-example: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M7 13v-2h14v2H7m0 6v-2h14v2H7M7 7V5h14v2H7M3 8V5H2V4h2v4H3m-1 9v-1h3v4H2v-1h2v-.5H3v-1h1V17H2m2.25-7a.75.75 0 0 1 .75.75c0 .2-.08.39-.21.52L3.12 13H5v1H2v-.92L4 11H2v-1h2.25z'/></svg>");
-  --md-admonition-icon--admonish-quote: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 17h3l2-4V7h-6v6h3M6 17h3l2-4V7H5v6h3l-2 4z'/></svg>");
-  --md-details-icon: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M8.59 16.58 13.17 12 8.59 7.41 10 6l6 6-6 6-1.41-1.42Z'/></svg>");
-}
-
 :is(.admonition) {
   display: flow-root;
   margin: 1.5625em 0;
@@ -71,6 +55,8 @@ a.admonition-anchor-link::before {
   padding-inline: 4.4rem 1.2rem;
   font-weight: 700;
   background-color: rgba(68, 138, 255, 0.1);
+  print-color-adjust: exact;
+  -webkit-print-color-adjust: exact;
   display: flex;
 }
 :is(.admonition-title, summary.admonition-title) p {
@@ -86,6 +72,8 @@ html :is(.admonition-title, summary.admonition-title):last-child {
   width: 2rem;
   height: 2rem;
   background-color: #448aff;
+  print-color-adjust: exact;
+  -webkit-print-color-adjust: exact;
   mask-image: url('data:image/svg+xml;charset=utf-8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>');
   -webkit-mask-image: url('data:image/svg+xml;charset=utf-8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>');
   mask-repeat: no-repeat;
@@ -119,6 +107,25 @@ details[open].admonition > summary.admonition-title::after {
   transform: rotate(90deg);
 }
 
+:root {
+  --md-details-icon: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M8.59 16.58 13.17 12 8.59 7.41 10 6l6 6-6 6-1.41-1.42Z'/></svg>");
+}
+
+:root {
+  --md-admonition-icon--admonish-note: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z'/></svg>");
+  --md-admonition-icon--admonish-abstract: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17 9H7V7h10m0 6H7v-2h10m-3 6H7v-2h7M12 3a1 1 0 0 1 1 1 1 1 0 0 1-1 1 1 1 0 0 1-1-1 1 1 0 0 1 1-1m7 0h-4.18C14.4 1.84 13.3 1 12 1c-1.3 0-2.4.84-2.82 2H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2z'/></svg>");
+  --md-admonition-icon--admonish-info: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 9h-2V7h2m0 10h-2v-6h2m-1-9A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10A10 10 0 0 0 12 2z'/></svg>");
+  --md-admonition-icon--admonish-tip: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17.66 11.2c-.23-.3-.51-.56-.77-.82-.67-.6-1.43-1.03-2.07-1.66C13.33 7.26 13 4.85 13.95 3c-.95.23-1.78.75-2.49 1.32-2.59 2.08-3.61 5.75-2.39 8.9.04.1.08.2.08.33 0 .22-.15.42-.35.5-.23.1-.47.04-.66-.12a.58.58 0 0 1-.14-.17c-1.13-1.43-1.31-3.48-.55-5.12C5.78 10 4.87 12.3 5 14.47c.06.5.12 1 .29 1.5.14.6.41 1.2.71 1.73 1.08 1.73 2.95 2.97 4.96 3.22 2.14.27 4.43-.12 6.07-1.6 1.83-1.66 2.47-4.32 1.53-6.6l-.13-.26c-.21-.46-.77-1.26-.77-1.26m-3.16 6.3c-.28.24-.74.5-1.1.6-1.12.4-2.24-.16-2.9-.82 1.19-.28 1.9-1.16 2.11-2.05.17-.8-.15-1.46-.28-2.23-.12-.74-.1-1.37.17-2.06.19.38.39.76.63 1.06.77 1 1.98 1.44 2.24 2.8.04.14.06.28.06.43.03.82-.33 1.72-.93 2.27z'/></svg>");
+  --md-admonition-icon--admonish-success: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m9 20.42-6.21-6.21 2.83-2.83L9 14.77l9.88-9.89 2.83 2.83L9 20.42z'/></svg>");
+  --md-admonition-icon--admonish-question: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m15.07 11.25-.9.92C13.45 12.89 13 13.5 13 15h-2v-.5c0-1.11.45-2.11 1.17-2.83l1.24-1.26c.37-.36.59-.86.59-1.41a2 2 0 0 0-2-2 2 2 0 0 0-2 2H8a4 4 0 0 1 4-4 4 4 0 0 1 4 4 3.2 3.2 0 0 1-.93 2.25M13 19h-2v-2h2M12 2A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10c0-5.53-4.5-10-10-10z'/></svg>");
+  --md-admonition-icon--admonish-warning: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 14h-2V9h2m0 9h-2v-2h2M1 21h22L12 2 1 21z'/></svg>");
+  --md-admonition-icon--admonish-failure: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20 6.91 17.09 4 12 9.09 6.91 4 4 6.91 9.09 12 4 17.09 6.91 20 12 14.91 17.09 20 20 17.09 14.91 12 20 6.91z'/></svg>");
+  --md-admonition-icon--admonish-danger: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M11 15H6l7-14v8h5l-7 14v-8z'/></svg>");
+  --md-admonition-icon--admonish-bug: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 12h-4v-2h4m0 6h-4v-2h4m6-6h-2.81a5.985 5.985 0 0 0-1.82-1.96L17 4.41 15.59 3l-2.17 2.17a6.002 6.002 0 0 0-2.83 0L8.41 3 7 4.41l1.62 1.63C7.88 6.55 7.26 7.22 6.81 8H4v2h2.09c-.05.33-.09.66-.09 1v1H4v2h2v1c0 .34.04.67.09 1H4v2h2.81c1.04 1.79 2.97 3 5.19 3s4.15-1.21 5.19-3H20v-2h-2.09c.05-.33.09-.66.09-1v-1h2v-2h-2v-1c0-.34-.04-.67-.09-1H20V8z'/></svg>");
+  --md-admonition-icon--admonish-example: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M7 13v-2h14v2H7m0 6v-2h14v2H7M7 7V5h14v2H7M3 8V5H2V4h2v4H3m-1 9v-1h3v4H2v-1h2v-.5H3v-1h1V17H2m2.25-7a.75.75 0 0 1 .75.75c0 .2-.08.39-.21.52L3.12 13H5v1H2v-.92L4 11H2v-1h2.25z'/></svg>");
+  --md-admonition-icon--admonish-quote: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 17h3l2-4V7h-6v6h3M6 17h3l2-4V7H5v6h3l-2 4z'/></svg>");
+}
+
 :is(.admonition):is(.admonish-note) {
   border-color: #448aff;
 }

documentation/install_mdbook_deps.sh

@@ -13,12 +13,12 @@ declare -a plugins=("admonish" "linkcheck" "last-changed" "theme" "variables" "c
 
 # install mdbook + plugins
 install_mdbook_deps() {
-	printf "\ninstalling mdbook..." 
-	# installing mdbook with only specific features for speed 
+	printf "\ninstalling mdbook..."
+	# installing mdbook with only specific features for speed
 #  cargo install mdbook --no-default-features --features search --vers "^$MINOR_VERSION"
 	cargo install mdbook --vers "^$MINOR_VERSION"
 
-	printf "\ninstalling plugins..." 
+	printf "\ninstalling plugins..."
 	for i in "${plugins[@]}"
 	do
 		cargo install mdbook-$i
@@ -41,13 +41,13 @@ install_mdbook_deps() {
 # uninstall mdbook + plugins
 uninstall_mdbook_deps() {
 	# mdbook
-	printf "\nuninstalling existing mdbook installation...\n" 
-	cargo uninstall mdbook 
-	# check it worked 
+	printf "\nuninstalling existing mdbook installation...\n"
+	cargo uninstall mdbook
+	# check it worked
 	if [ $? -ne 0 ]; then
 		printf "\nsomething went wrong, exiting"
 		exit 1
-	else 
+	else
 		printf "\nmdbook deleted\n"
 	fi
 
@@ -57,10 +57,10 @@ uninstall_mdbook_deps() {
 	do
 		cargo uninstall mdbook-$i
 		# check it worked
-		if [ $? -ne 0 ]; then 
+		if [ $? -ne 0 ]; then
 			printf "\nsomething went wrong, exiting"
 			exit 1
-		else 
+		else
 		printf "\nmdbook-$i deleted\n"
 	fi
 	done
@@ -71,10 +71,10 @@ main() {
 		printf "mdbook already installed (located at: $(which mdbook))"
 		uninstall_mdbook_deps;
 		install_mdbook_deps;
-	else 
+	else
 		printf "mdbook not installed"
 		install_mdbook_deps;
 	fi
 }
 
-main; 
+main;

documentation/operators/book.toml

@@ -24,7 +24,7 @@ turn-off = true
 
 [preprocessor.admonish]
 command = "mdbook-admonish"
-assets_version = "3.0.0" # do not edit: managed by `mdbook-admonish install`
+assets_version = "3.0.2" # do not edit: managed by `mdbook-admonish install`
 
 # https://gitlab.com/tglman/mdbook-variables/
 [preprocessor.variables.variables]

documentation/operators/nym_themes/mdbook-admonish.css

@@ -1,20 +1,4 @@
 @charset "UTF-8";
-:root {
-  --md-admonition-icon--admonish-note: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z'/></svg>");
-  --md-admonition-icon--admonish-abstract: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17 9H7V7h10m0 6H7v-2h10m-3 6H7v-2h7M12 3a1 1 0 0 1 1 1 1 1 0 0 1-1 1 1 1 0 0 1-1-1 1 1 0 0 1 1-1m7 0h-4.18C14.4 1.84 13.3 1 12 1c-1.3 0-2.4.84-2.82 2H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2z'/></svg>");
-  --md-admonition-icon--admonish-info: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 9h-2V7h2m0 10h-2v-6h2m-1-9A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10A10 10 0 0 0 12 2z'/></svg>");
-  --md-admonition-icon--admonish-tip: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17.66 11.2c-.23-.3-.51-.56-.77-.82-.67-.6-1.43-1.03-2.07-1.66C13.33 7.26 13 4.85 13.95 3c-.95.23-1.78.75-2.49 1.32-2.59 2.08-3.61 5.75-2.39 8.9.04.1.08.2.08.33 0 .22-.15.42-.35.5-.23.1-.47.04-.66-.12a.58.58 0 0 1-.14-.17c-1.13-1.43-1.31-3.48-.55-5.12C5.78 10 4.87 12.3 5 14.47c.06.5.12 1 .29 1.5.14.6.41 1.2.71 1.73 1.08 1.73 2.95 2.97 4.96 3.22 2.14.27 4.43-.12 6.07-1.6 1.83-1.66 2.47-4.32 1.53-6.6l-.13-.26c-.21-.46-.77-1.26-.77-1.26m-3.16 6.3c-.28.24-.74.5-1.1.6-1.12.4-2.24-.16-2.9-.82 1.19-.28 1.9-1.16 2.11-2.05.17-.8-.15-1.46-.28-2.23-.12-.74-.1-1.37.17-2.06.19.38.39.76.63 1.06.77 1 1.98 1.44 2.24 2.8.04.14.06.28.06.43.03.82-.33 1.72-.93 2.27z'/></svg>");
-  --md-admonition-icon--admonish-success: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m9 20.42-6.21-6.21 2.83-2.83L9 14.77l9.88-9.89 2.83 2.83L9 20.42z'/></svg>");
-  --md-admonition-icon--admonish-question: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m15.07 11.25-.9.92C13.45 12.89 13 13.5 13 15h-2v-.5c0-1.11.45-2.11 1.17-2.83l1.24-1.26c.37-.36.59-.86.59-1.41a2 2 0 0 0-2-2 2 2 0 0 0-2 2H8a4 4 0 0 1 4-4 4 4 0 0 1 4 4 3.2 3.2 0 0 1-.93 2.25M13 19h-2v-2h2M12 2A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10c0-5.53-4.5-10-10-10z'/></svg>");
-  --md-admonition-icon--admonish-warning: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 14h-2V9h2m0 9h-2v-2h2M1 21h22L12 2 1 21z'/></svg>");
-  --md-admonition-icon--admonish-failure: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20 6.91 17.09 4 12 9.09 6.91 4 4 6.91 9.09 12 4 17.09 6.91 20 12 14.91 17.09 20 20 17.09 14.91 12 20 6.91z'/></svg>");
-  --md-admonition-icon--admonish-danger: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M11 15H6l7-14v8h5l-7 14v-8z'/></svg>");
-  --md-admonition-icon--admonish-bug: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 12h-4v-2h4m0 6h-4v-2h4m6-6h-2.81a5.985 5.985 0 0 0-1.82-1.96L17 4.41 15.59 3l-2.17 2.17a6.002 6.002 0 0 0-2.83 0L8.41 3 7 4.41l1.62 1.63C7.88 6.55 7.26 7.22 6.81 8H4v2h2.09c-.05.33-.09.66-.09 1v1H4v2h2v1c0 .34.04.67.09 1H4v2h2.81c1.04 1.79 2.97 3 5.19 3s4.15-1.21 5.19-3H20v-2h-2.09c.05-.33.09-.66.09-1v-1h2v-2h-2v-1c0-.34-.04-.67-.09-1H20V8z'/></svg>");
-  --md-admonition-icon--admonish-example: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M7 13v-2h14v2H7m0 6v-2h14v2H7M7 7V5h14v2H7M3 8V5H2V4h2v4H3m-1 9v-1h3v4H2v-1h2v-.5H3v-1h1V17H2m2.25-7a.75.75 0 0 1 .75.75c0 .2-.08.39-.21.52L3.12 13H5v1H2v-.92L4 11H2v-1h2.25z'/></svg>");
-  --md-admonition-icon--admonish-quote: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 17h3l2-4V7h-6v6h3M6 17h3l2-4V7H5v6h3l-2 4z'/></svg>");
-  --md-details-icon: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M8.59 16.58 13.17 12 8.59 7.41 10 6l6 6-6 6-1.41-1.42Z'/></svg>");
-}
-
 :is(.admonition) {
   display: flow-root;
   margin: 1.5625em 0;
@@ -71,6 +55,8 @@ a.admonition-anchor-link::before {
   padding-inline: 4.4rem 1.2rem;
   font-weight: 700;
   background-color: rgba(68, 138, 255, 0.1);
+  print-color-adjust: exact;
+  -webkit-print-color-adjust: exact;
   display: flex;
 }
 :is(.admonition-title, summary.admonition-title) p {
@@ -86,6 +72,8 @@ html :is(.admonition-title, summary.admonition-title):last-child {
   width: 2rem;
   height: 2rem;
   background-color: #448aff;
+  print-color-adjust: exact;
+  -webkit-print-color-adjust: exact;
   mask-image: url('data:image/svg+xml;charset=utf-8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>');
   -webkit-mask-image: url('data:image/svg+xml;charset=utf-8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>');
   mask-repeat: no-repeat;
@@ -119,6 +107,25 @@ details[open].admonition > summary.admonition-title::after {
   transform: rotate(90deg);
 }
 
+:root {
+  --md-details-icon: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M8.59 16.58 13.17 12 8.59 7.41 10 6l6 6-6 6-1.41-1.42Z'/></svg>");
+}
+
+:root {
+  --md-admonition-icon--admonish-note: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z'/></svg>");
+  --md-admonition-icon--admonish-abstract: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17 9H7V7h10m0 6H7v-2h10m-3 6H7v-2h7M12 3a1 1 0 0 1 1 1 1 1 0 0 1-1 1 1 1 0 0 1-1-1 1 1 0 0 1 1-1m7 0h-4.18C14.4 1.84 13.3 1 12 1c-1.3 0-2.4.84-2.82 2H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2z'/></svg>");
+  --md-admonition-icon--admonish-info: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 9h-2V7h2m0 10h-2v-6h2m-1-9A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10A10 10 0 0 0 12 2z'/></svg>");
+  --md-admonition-icon--admonish-tip: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M17.66 11.2c-.23-.3-.51-.56-.77-.82-.67-.6-1.43-1.03-2.07-1.66C13.33 7.26 13 4.85 13.95 3c-.95.23-1.78.75-2.49 1.32-2.59 2.08-3.61 5.75-2.39 8.9.04.1.08.2.08.33 0 .22-.15.42-.35.5-.23.1-.47.04-.66-.12a.58.58 0 0 1-.14-.17c-1.13-1.43-1.31-3.48-.55-5.12C5.78 10 4.87 12.3 5 14.47c.06.5.12 1 .29 1.5.14.6.41 1.2.71 1.73 1.08 1.73 2.95 2.97 4.96 3.22 2.14.27 4.43-.12 6.07-1.6 1.83-1.66 2.47-4.32 1.53-6.6l-.13-.26c-.21-.46-.77-1.26-.77-1.26m-3.16 6.3c-.28.24-.74.5-1.1.6-1.12.4-2.24-.16-2.9-.82 1.19-.28 1.9-1.16 2.11-2.05.17-.8-.15-1.46-.28-2.23-.12-.74-.1-1.37.17-2.06.19.38.39.76.63 1.06.77 1 1.98 1.44 2.24 2.8.04.14.06.28.06.43.03.82-.33 1.72-.93 2.27z'/></svg>");
+  --md-admonition-icon--admonish-success: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m9 20.42-6.21-6.21 2.83-2.83L9 14.77l9.88-9.89 2.83 2.83L9 20.42z'/></svg>");
+  --md-admonition-icon--admonish-question: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='m15.07 11.25-.9.92C13.45 12.89 13 13.5 13 15h-2v-.5c0-1.11.45-2.11 1.17-2.83l1.24-1.26c.37-.36.59-.86.59-1.41a2 2 0 0 0-2-2 2 2 0 0 0-2 2H8a4 4 0 0 1 4-4 4 4 0 0 1 4 4 3.2 3.2 0 0 1-.93 2.25M13 19h-2v-2h2M12 2A10 10 0 0 0 2 12a10 10 0 0 0 10 10 10 10 0 0 0 10-10c0-5.53-4.5-10-10-10z'/></svg>");
+  --md-admonition-icon--admonish-warning: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M13 14h-2V9h2m0 9h-2v-2h2M1 21h22L12 2 1 21z'/></svg>");
+  --md-admonition-icon--admonish-failure: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M20 6.91 17.09 4 12 9.09 6.91 4 4 6.91 9.09 12 4 17.09 6.91 20 12 14.91 17.09 20 20 17.09 14.91 12 20 6.91z'/></svg>");
+  --md-admonition-icon--admonish-danger: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M11 15H6l7-14v8h5l-7 14v-8z'/></svg>");
+  --md-admonition-icon--admonish-bug: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 12h-4v-2h4m0 6h-4v-2h4m6-6h-2.81a5.985 5.985 0 0 0-1.82-1.96L17 4.41 15.59 3l-2.17 2.17a6.002 6.002 0 0 0-2.83 0L8.41 3 7 4.41l1.62 1.63C7.88 6.55 7.26 7.22 6.81 8H4v2h2.09c-.05.33-.09.66-.09 1v1H4v2h2v1c0 .34.04.67.09 1H4v2h2.81c1.04 1.79 2.97 3 5.19 3s4.15-1.21 5.19-3H20v-2h-2.09c.05-.33.09-.66.09-1v-1h2v-2h-2v-1c0-.34-.04-.67-.09-1H20V8z'/></svg>");
+  --md-admonition-icon--admonish-example: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M7 13v-2h14v2H7m0 6v-2h14v2H7M7 7V5h14v2H7M3 8V5H2V4h2v4H3m-1 9v-1h3v4H2v-1h2v-.5H3v-1h1V17H2m2.25-7a.75.75 0 0 1 .75.75c0 .2-.08.39-.21.52L3.12 13H5v1H2v-.92L4 11H2v-1h2.25z'/></svg>");
+  --md-admonition-icon--admonish-quote: url("data:image/svg+xml;charset=utf-8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'><path d='M14 17h3l2-4V7h-6v6h3M6 17h3l2-4V7H5v6h3l-2 4z'/></svg>");
+}
+
 :is(.admonition):is(.admonish-note) {
   border-color: #448aff;
 }

documentation/operators/src/SUMMARY.md

@@ -2,6 +2,7 @@
 # Summary
 
 - [Introduction](introduction.md)
+- [Changelog](changelog.md)
 
 # Binaries
 
@@ -12,13 +13,17 @@
 
 # Operators Guides
 
-- [Mixnet Nodes Setup](nodes/setup-guides.md)
-    - [Preliminary Steps](preliminary-steps.md)
-    - [Mix Node](nodes/mix-node-setup.md)
-    - [Gateway](nodes/gateway-setup.md)
-    - [Network Requester](nodes/network-requester-setup.md)
+- [Preliminary Steps](nodes/preliminary-steps.md)
+  - [Nym Wallet Preparation](nodes/wallet-preparation.md)
+  - [VPS Setup](nodes/vps-setup.md)
+- [Nym Node](nodes/nym-node.md)
+  - [Setup & Run](nodes/setup.md)
+  - [Configuration](nodes/configuration.md)
+      - [WSS & Reversed Proxy](nodes/proxy-configuration.md)
+  - [Bonding](nodes/bonding.md)
 - [Nyx Validator Setup](nodes/validator-setup.md)
   - [Nym API Setup](nodes/nym-api.md)
+  - [Validator & API Configuration](nodes/nyx-configuration.md)
 - [Maintenance](nodes/maintenance.md)
   - [Manual Node Upgrade](nodes/manual-upgrade.md)
   - [Automatic Node Upgrade: Nymvisor Setup and Usage](nodes/nymvisor-upgrade.md)
@@ -28,12 +33,12 @@
   - [Prometheus & Grafana](testing/prometheus-grafana.md)
     - [ExploreNYM scripts](testing/explorenym-scripts.md)
 <!--    - [Run in a Docker](testing/docker-monitor.md) -->
-- [Troubleshooting](nodes/troubleshooting.md)
-<!--
-  - [Nym Nodes]()
-  - [Validators]
-  - [Binary]
--->
+
+# Troubleshooting
+
+- [VPS Setup](troubleshooting/vps-isp.md)
+- [Nym Node](troubleshooting/nodes.md)
+- [Validators](troubleshooting/validators.md)
 
 # Token Economics
 
@@ -43,10 +48,11 @@
 
 # FAQ
 
-- [Mix Nodes](faq/mixnodes-faq.md)
-- [Project Smoosh](faq/smoosh-faq.md)
+- [General Operators FAQ](faq/general-faq.md)
+- [Nym Nodes](faq/nym-nodes-faq.md)
+- [Nyx & Validators](faq/nyx-faq.md)
 
-# Legal Forum
+# Community & Legal Forum
 
 - [Exit Gateway](legal/exit-gateway.md)
 - [Community Counsel](legal/community-counsel.md)
@@ -56,6 +62,19 @@
     - [Landing Pages](legal/landing-pages.md)
 - [How to Add Info](legal/add-content.md)
 
+---
+# Archive
+
+- [Why archive?](archive/archive.md)
+- [Mixnet Nodes Setup](archive/nodes/setup-guides.md)
+    - [Preliminary Steps](archive/nodes/initial-steps.md)
+    - [Mix Node](archive/nodes/mix-node-setup.md)
+    - [Gateway](archive/nodes/gateway-setup.md)
+    - [Network Requester](archive/nodes/network-requester-setup.md)
+- [FAQ: Mix Nodes](archive/faq/mixnodes-faq.md)
+- [FAQ: Project Smoosh](archive/faq/smoosh-faq.md)
+
+
 ---
 # Misc.
 - [Code of Conduct](coc.md)

documentation/operators/src/archive/archive.md

@@ -0,0 +1,7 @@
+# Archived Pages
+
+This section contains old but still relevant pages/guides, archived for backwards compatibility. The content of the pages is not updated. See the top of every page informing you about the last time of update. 
+
+Pages listed in archive section will eventually be terminated as they will become completely irrelevant with time.
+
+

documentation/operators/src/archive/faq/mixnodes-faq.md

@@ -1,5 +1,9 @@
 # Frequently Asked Questions
 
+```admonish warning
+**This is an archived page for backwards compatibility. The content of this page is not updated since April 19th 2024. Eventually this page will be terminated!**
+```
+
 ## Nym Mixnet
 
 To see different stats about Nym Mixnet live, we recommend you to visit [status.notrustverify.ch](https://status.notrustverify.ch/d/CW3L7dVVk/nym-mixnet?orgId=1) built by [No Trust Verify](https://notrustverify.ch/) crew, one of the squads within Nym core community.
@@ -32,7 +36,6 @@ The rewarded nodes are the nodes which will receive some rewards by the end of t
 
 2. Standby: Bottom *N* nodes of the rewarded set, they don't mix data from the clients but are used for testing. Their reward is smaller.
 
-
 For more detailed calculation, read our blog post [Nym Token Economics update](https://blog.nymtech.net/nym-token-economics-update-fedff0ed5267). More info on staking can be found [here](https://blog.nymtech.net/staking-in-nym-introducing-mainnet-mixmining-f9bb1cbc7c36). And [here](https://blog.nymtech.net/want-to-stake-in-nym-here-is-how-to-choose-a-mix-node-to-delegate-nym-to-c3b862add165) is more info on how to choose a Mix Node for delegation. And finally an [update](https://blog.nymtech.net/quarterly-token-economic-parameter-update-b2862948710f) on token economics from July 2023.
 
 <iframe src="https://status.notrustverify.ch/d-solo/CW3L7dVVk/nym-mixnet?orgId=1&from=1703074829887&to=1705666829887&panelId=31" width="850" height="400" frameborder="0"></iframe>
@@ -57,7 +60,7 @@ Because of the way the smart contract works we keep it one-node one-address at t
 
 ### Which nodes are the most needed to be setup to strengthen Nym infrastructure and which ones bring rewards?
 
-Ath this point the most crutial component needed are [Exit Gateways](../legal/exit-gateway.md).
+Ath this point the most crutial component needed are [Exit Gateways](../../legal/exit-gateway.md).
 
 ### Are Mix Nodes whitelisted?
 

documentation/operators/src/archive/faq/smoosh-faq.md

@@ -1,37 +1,32 @@
 # Project Smoosh - FAQ
 
-> We aim on purpose to make minimal changes to reward scheme and software. We're just 'smooshing' together stuff we already debugged and know works.  
-> -- Harry Halpin,  Nym CEO  
+```admonish warning
+**This is an archived page for backwards compatibility. We have switched to [`nym-node` binary](../../nodes/nym-node.md), please [migrate](../../nodes/setup.md#migrate) your nodes. The content of this page is not updated since April 26th 2024. Eventually this page will be terminated!**
+```
+
+> We aim on purpose to make minimal changes to reward scheme and software. We're just 'smooshing' together stuff we already debugged and know works.
+> -- Harry Halpin,  Nym CEO
 
 <br>
 
-This page refer to the changes which are planned to take place over Q3 and Q4 2023. As this is a transition period in the beginning (Q3 2023) the [Mix Nodes FAQ page](mixnodes-faq.md) holds more answers to the current setup as project Smoosh refers to the eventual setup. As project Smoosh gets progressively implemented the answers on this page will become to be more relevant to the current state and eventually this FAQ page will be merged with the still relevant parts of the main Mix Nodes FAQ page. 
+This page refer to the changes which are planned to take place over Q3 and Q4 2023. As this is a transition period in the beginning (Q3 2023) the [Mix Nodes FAQ page](mixnodes-faq.md) holds more answers to the current setup as project Smoosh refers to the eventual setup. As project Smoosh gets progressively implemented the answers on this page will become to be more relevant to the current state and eventually this FAQ page will be merged with the still relevant parts of the main Mix Nodes FAQ page.
 
 If any questions are not answered or it's not clear for you in which stage project Smoosh is right now, please reach out in Node Operators [Matrix room](https://matrix.to/#/#operators:nymtech.chat).
 
-## Overview
-
-### What is project Smoosh?
-
-As we shared in our blog post article [*What does it take to build the wolds most powerful VPN*](https://blog.nymtech.net/what-does-it-take-to-build-the-worlds-most-powerful-vpn-d351a76ec4e6), project Smoosh is:  
-
-> A nick-name by CTO Dave Hrycyszyn and Chief Scientist Claudia Diaz for the work they are currently doing to “smoosh” Nym Nodes so that the same operator can serve alternately as Mix Node, Gateway or VPN node. This requires careful calibration of the Nym token economics, for example, only nodes with the highest reputation for good quality service will be in the VPN set and have the chance to earn higher rewards.
-> By simplifying the components, adding VPN features and supporting new node operators, the aim is to widen the geographical coverage of nodes and have significant redundancy, meaning plenty of operators to be able to meet demand. This requires strong token economic incentives as well as training and support for new node operators.
-
-## Technical Questions
 
 ### What are the changes?
 
 Project Smoosh will have four steps, please follow the table below to track the dynamic progress:
 
-| **Step** | **Status** |
-| :--- | :--- |
-| **1.** Combine the `nym-gateway` and `nym-network-requester` into one binary | ✅ done |
-| **2.** Create [Exit Gateway](../legal/exit-gateway.md): Take the `nym-gateway` binary including `nym-network-requester` combined in \#1 and switch from [`allowed.list`](https://nymtech.net/.wellknown/network-requester/standard-allowed-list.txt) to a new [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) | ✅ done |
-| **3.** Combine all the nodes in the Nym Mixnet into one binary, that is `nym-mixnode`, `nym-gateway` (entry and exit) and `nym-network-requester`. | 🛠️ in progress |
-| **4.** Adjust reward scheme to incentivise and reward Exit Gateways as a part of `nym-node` binary, implementing [zkNym credentials](https://youtu.be/nLmdsZ1BsQg?t=1717). | 🛠️ in progress |
+| **Step**                                                                                                                                                                                                                                                                                                                                         | **Status**     |
+| :---                                                                                                                                                                                                                                                                                                                                             | :---           |
+| **1.** Combine the `nym-gateway` and `nym-network-requester` into one binary                                                                                                                                                                                                                                                                     | ✅ done        |
+| **2.** Create [Exit Gateway](../../legal/exit-gateway.md): Take the `nym-gateway` binary including `nym-network-requester` combined in \#1 and switch from [`allowed.list`](https://nymtech.net/.wellknown/network-requester/standard-allowed-list.txt) to a new [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) | ✅ done        |
+| **3.** Combine all the nodes in the Nym Mixnet into one binary, that is `nym-mixnode`, `nym-gateway` (entry and exit) and `nym-network-requester`.                                                                                                                                                                                               | ✅ done        |
+| **4.** Adjust reward scheme to incentivise and reward Exit Gateways as a part of `nym-node` binary, implementing [zkNym credentials](https://youtu.be/nLmdsZ1BsQg?t=1717).                                                                                                                                                                       | 🛠️ in progress |
+| **5.** Implement multiple node functionalities into one `nym-node` connected to one Nyx account.                                                                                                                                                                                                                                                 | 🛠️ in progress |
 
-These steps will be staggered over time - period of several months, and will be implemented one by one with enough time to take in feedback and fix bugs in between.  
+These steps will be staggered over time - period of several months, and will be implemented one by one with enough time to take in feedback and fix bugs in between.
 Generally, the software will be the same, just instead of multiple binaries, there will be one Nym Node (`nym-node`) binary. Delegations will remain on as they are now, per our token economics (staking, saturation etc)
 
 ### What does it mean for Nym nodes operators?
@@ -44,7 +39,7 @@ We are exploring two potential methods for implementing binary functionality in
 
 ### Where can I read more about the Exit Gateway setup?
 
-We created an [entire page](../legal/exit-gateway.md) about the technical and legal questions around Exit Gateway. 
+We created an [entire page](../../legal/exit-gateway.md) about the technical and legal questions around Exit Gateway.
 
 ### What is the change from allow list to deny list?
 
@@ -57,8 +52,8 @@ Follow the dynamic progress of exit policy implementation on Gateways below:
 | **Step** | **Status** |
 | :--- | :--- |
 | **1.** By default the [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) filtering is disabled and the [`allowed.list`](https://nymtech.net/.wellknown/network-requester/standard-allowed-list.txt) filtering is going to continue be used. This is to prevent operators getting surprised by upgrading their Gateways (or Network Requesters) and suddenly be widely open to the internet. To enable the new exit policy, operators must use `--with-exit-policy` flag or modify the `config.toml` file. | ✅ done |
-| **2.** The exit policy is part of the Gateway setup by default. To disable this exit policy, operators must use `--disable-exit-policy` flag. | 🛠️ in progress |
-| **3.** The exit policy is the only option. The `allowed.list` is completely removed. | 🛠️ in progress |
+| **2.** The exit policy is part of the Gateway setup by default. To disable this exit policy, operators must use `--disable-exit-policy` flag. | ✅ done |
+| **3.** The exit policy is the only option. The `allowed.list` is completely removed. | ✅ done |
 
 Keep in mind the table above only relates to changes happening on Gateways. For the Project Smoosh progress refer to the [table above](./smoosh-faq.md#what-are-the-changes). Whether Exit Gateway functionality will be optional or mandatory part of every active Nym Node depends on the chosen [design](./smoosh-faq.md#what-does-it-mean-for-nym-nodes-operators).
 
@@ -86,9 +81,9 @@ This depends on [design](./smoosh-faq.md#what-does-it-mean-for-nym-nodes-operato
 
 As each operator can choose what roles their nodes provide, the nodes which work as open Gateways will have higher rewards because they are the most important to keep up and stable. Besides that the operators of Gateways may be exposed to more complication and possible legal risks.
 
-The nodes which are initialized to run as Mix Nodes and Gateways will be chosen to be on top of the active set before the ones working only as a Mix Node. 
+The nodes which are initialized to run as Mix Nodes and Gateways will be chosen to be on top of the active set before the ones working only as a Mix Node.
 
-I case we go with \#2, all nodes active in the epoch will be rewarded proportionally according their work. 
+I case we go with \#2, all nodes active in the epoch will be rewarded proportionally according their work.
 
 In either way, Nym will share all the specifics beforehand.
 
@@ -108,7 +103,6 @@ From an operator standpoint, it shall just be a standard Nym upgrade, a new opti
 
 ### Are there any legal concerns for the operators?
 
-So far the general line is that running a Gateway is not illegal (unless you are in Iran, China, and a few other places) and due to encryption/mixing less risky than running a normal VPN node. For Mix Nodes, it's very safe as they have "no idea" what packets they are mixing.  
-
-There are several legal questions and analysis to be made for different jurisdictions. To be able to share resources and findings between the operators themselves we created a [Community Legal Forum](../legal/exit-gateway.md). 
+So far the general line is that running a Gateway is not illegal (unless you are in Iran, China, and a few other places) and due to encryption/mixing less risky than running a normal VPN node. For Mix Nodes, it's very safe as they have "no idea" what packets they are mixing.
 
+There are several legal questions and analysis to be made for different jurisdictions. To be able to share resources and findings between the operators themselves we created a [Community Legal Forum](../../legal/exit-gateway.md).

documentation/operators/src/archive/nodes/gateway-setup.md

@@ -1,22 +1,25 @@
 # Gateways
 
-> The Nym gateway was built in the [building nym](../binaries/building-nym.md) section. If you haven't yet built Nym and want to run the code, go there first.
+```admonish warning
+**This is an archived page for backwards compatibility for existing node operators. To start a new node or migrate, follow the [`nym-node` guides](../../nodes/nym-node.md).** The content of this page is not updated since April 19th 2024. Eventually this page will be terminated!
+```
+
+> The Nym gateway was built in the [building nym](../../binaries/building-nym.md) section. If you haven't yet built Nym and want to run the code, go there first.
 
 
 ```admonish info
-As a result of [Project Smoosh](../faq/smoosh-faq.md), the current version of `nym-gateway` binary also contains `nym-network-requester` functionality which can be enabled [by the operator](./gateway-setup.md#initialising-gateway-with-network-requester). This combination is a basis of ***Nym Exit Gateway*** node - an essential piece in our new setup. Please read more in our [Project Smoosh FAQ](../faq/smoosh-faq.md) and [Exit Gateway](../legal/exit-gateway.md) pages. We recommend operators begin to shift their setups to this new combined node, instead of operating two separate binaries.
+As a result of [Project Smoosh](../faq/smoosh-faq.md), the current version of `nym-gateway` binary also contains `nym-network-requester` functionality which can be enabled [by the operator](./gateway-setup.md#initialising-gateway-with-network-requester). This combination is a basis of ***Nym Exit Gateway*** node - an essential piece in our new setup. Please read more in our [Project Smoosh FAQ](../faq/smoosh-faq.md) and [Exit Gateway](../../legal/exit-gateway.md) pages. We recommend operators begin to shift their setups to this new combined node, instead of operating two separate binaries.
 ```
 
 > Any syntax in `<>` brackets is a user's unique variable. Exchange with a corresponding name without the `<>` brackets.
 
 ## Current version
-```
-<!-- cmdrun ../../../../target/release/nym-gateway --version | grep "Build Version" | cut -b 21-26  -->
-```
+
+The last version before migration to [`nym-node`](../../nodes/nym-node.md) was `1.1.33`.
 
 ## Preliminary steps
 
-Make sure you do the preparation listed in the [preliminary steps page](../preliminary-steps.md) before setting up your Gateway.
+Make sure you do the preparation listed in the [preliminary steps page](initial-steps.md) before setting up your Gateway.
 
 
 ## Gateway setup
@@ -35,12 +38,6 @@ You can check that your binaries are properly compiled with:
 ./nym-gateway --help
 ```
 
-~~~admonish example collapsible=true title="Console output"
-```
-<!-- cmdrun ../../../../target/release/nym-gateway --help -->
-```
-~~~
-
 You can also check the various arguments required for individual commands with:
 
 ```
@@ -50,7 +47,7 @@ You can also check the various arguments required for individual commands with:
 
 ## Initialising your Gateway
 
-As Nym developers build towards [Exit Gateway](../legal/exit-gateway.md) functionality, operators can now run their `nym-gateway` binary with inbuilt Network Requester and include the our new [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt). Considering the plan to [*smoosh*](../faq/smoosh-faq.md) all the nodes into one binary and have wide opened Exit Gateways, we recommend this setup, instead of operating two separate binaries. 
+As Nym developers build towards [Exit Gateway](../../legal/exit-gateway.md) functionality, operators can now run their `nym-gateway` binary with inbuilt Network Requester and include the our new [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt). Considering the plan to [*smoosh*](../faq/smoosh-faq.md) all the nodes into one binary and have wide opened Exit Gateways, we recommend this setup, instead of operating two separate binaries. 
 
 ```admonish warning
 Before you start an Exit Gateway, read our [Operators Legal Forum](../legal/exit-gateway.md) page and [*Project Smoosh FAQ*](../faq/smoosh-faq.md).
@@ -70,13 +67,6 @@ An operator can initialise the Exit Gateway functionality by adding Network Requ
 ./nym-gateway init --id <ID> --listening-address 0.0.0.0 --public-ips "$(curl -4 https://ifconfig.me)" --with-network-requester --with-exit-policy true
 ```
 
-If we follow the previous example with `<ID>` chosen `superexitgateway`, adding the `--with-network-requester` and `--with-exit-policy` flags, the outcome will be:
-
-~~~admonish example collapsible=true title="Console output"
-```
-<!-- cmdrun ../../../../target/release/nym-gateway init --id superexitgateway --listening-address 0.0.0.0 --public-ips "$(curl -4 https://ifconfig.me)" --with-network-requester --with-exit-policy true -->
-```
-~~~
 
 You can see that the printed information besides *identity* and *sphinx keys* also includes a long string called *address*. This is the address to be provided to your local [socks5 client](https://nymtech.net/docs/clients/socks5-client.html) as a `--provider` if you wish to connect to your own Exit Gateway.  
 
@@ -84,7 +74,7 @@ Additionally
 
 #### Add Network Requester to an existing Gateway
 
-If you already [upgraded](./manual-upgrade.md) your Gateway to the [latest version](./gateway-setup.md#current-version) and initialised without a Network Requester, you can easily change its functionality to Exit Gateway with a command `setup-network-requester`.
+If you already [upgraded](../../nodes/manual-upgrade.md) your Gateway to the [latest version](./gateway-setup.md#current-version) and initialised without a Network Requester, you can easily change its functionality to Exit Gateway with a command `setup-network-requester`.
 
 See the options:
 
@@ -92,11 +82,6 @@ See the options:
 ./nym-gateway setup-network-requester --help
 ```
 
-~~~admonish example collapsible=true title="Console output"
-```
-<!-- cmdrun ../../../../target/release/nym-gateway setup-network-requester --help -->
-```
-~~~
 
 To setup Exit Gateway functionality with our new [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) add a flag `--with-exit-policy true`. 
 
@@ -111,12 +96,6 @@ Say we have a Gateway with `<ID>` as `new-gateway`, originally initialised and r
 ./nym-gateway setup-network-requester --enabled true --with-exit-policy true --id new-gateway
 ```
 
-~~~admonish example collapsible=true title="Console output"
-```
-<!-- cmdrun rm -rf $HOME/.nym/gateways/new-gateway -->
-<!-- cmdrun ../../../../target/release/nym-gateway init --id new-gateway --listening-address 0.0.0.0 --public-ips "$(curl -4 https://ifconfig.me)" && ../../../../target/release/nym-gateway setup-network-requester --enabled true --with-exit-policy true --id new-gateway -->
-```
-~~~
 
 In case there are any unexpected problems, you can also change it manually by editing the Gateway config file stored in `/home/user/.nym/gateways/<ID>/config/config.toml` where the line under `[network_requester]` needs to be edited from `false` to `true`.
 
@@ -157,24 +136,12 @@ To check available configuration options use:
  ./nym-gateway init --help
 ```
 
-~~~admonish example collapsible=true title="Console output"
-```
-<!-- cmdrun ../../../../target/release/nym-gateway init --help -->
-```
-~~~
-
 The following command returns a Gateway on your current IP with the `<ID>` of `simple-gateway`:
 
 ```
 ./nym-gateway init --id simple-gateway --listening-address 0.0.0.0 --public-ips "$(curl -4 https://ifconfig.me)"
 ```
 
-~~~admonish example collapsible=true title="Console output"
-```
-<!-- cmdrun ../../../../target/release/nym-gateway init --id simple-gateway --listening-address 0.0.0.0 --public-ips "$(curl -4 https://ifconfig.me)" -->
-```
-~~~
-
 The `$(curl -4 https://ifconfig.me)` command above returns your IP automatically using an external service. Alternatively, you can enter your IP manually if you wish. If you do this, remember to enter your IP **without** any port information.
 
 ## Running your Gateway
@@ -189,7 +156,7 @@ The `run` command starts the Gateway:
 ## Bonding your Gateway
 
 ```admonish info
-Before you bond your Gateway, please make sure the [firewall configuration](./maintenance.md#configure-your-firewall) is setup so your Gateway can be reached from the outside. You can also setup [WSS on your Gateway](./maintenance.md#run-web-secure-socket-wss-on-gateway) and [automate](./maintenance.md#vps-setup-and-automation) your Gateway to simplify the operation overhead. We highly recommend to run any of these steps before bonding to prevent disruption of your Gateway's routing score later on.
+Before you bond your Gateway, please make sure the [firewall configuration](./maintenance.md#configure-your-firewall) is setup so your Gateway can be reached from the outside. You can also setup WSS and automate your Gateway to simplify the operation overhead. We highly recommend to run any of these steps before bonding to prevent disruption of your Gateway's routing score later on.
 ```
 
 ### Via the Desktop wallet (recommended)
@@ -239,7 +206,7 @@ It will look something like this (as `<YOUR_ID>` we used `supergateway`):
 
 * And paste it into the wallet nodal, press `Next` and confirm the transaction.
 
-![Paste Signature](../images/wallet-screenshots/wallet-gateway-sign.png)  
+![Paste Signature](../../images/wallet-screenshots/wallet-gateway-sign.png)  
 *This image is just an example, copy-paste your own base58-encoded signature.*
 
 * Your Gateway is now bonded.
@@ -252,5 +219,5 @@ If you want to bond your Gateway via the CLI, then check out the [relevant secti
 
 ## Maintenance
 
-For Gateway upgrade, firewall setup, port configuration, API endpoints, VPS suggestions, automation, WSS setup and more, see the [maintenance page](./maintenance.md)
+For Gateway upgrade, firewall setup, port configuration, API endpoints, VPS suggestions, automation, WSS setup and more, see the [maintenance page](../../nodes/maintenance.md)
 

documentation/operators/src/archive/nodes/initial-steps.md

@@ -1,6 +1,10 @@
 # Preliminary Steps
 
-> The Nym `mixnode`, `gateway` and `network-requester` binaries were built in the [building nym](./binaries/building-nym.md) section. If you haven't yet built Nym and want to run the code, go there first.
+```admonish warning
+**This is an archived page for backwards compatibility. The content of this page is not updated since April 19th 2024. Eventually this page will be terminated!**
+```
+
+> The Nym `mixnode`, `gateway` and `network-requester` binaries were built in the [building nym](../../binaries/building-nym.md) section. If you haven't yet built Nym and want to run the code, go there first.
 
 There are a couple of steps that need completing before starting to set up your mix node, gateway or a network requester:
 

documentation/operators/src/archive/nodes/mix-node-setup.md

@@ -1,23 +1,26 @@
 # Mix Nodes
 
-> The Nym Mix Node binary was built in the [building nym](../binaries/building-nym.md) section. If you haven't yet built Nym and want to run the code, go there first.
+```admonish warning
+**This is an archived page for backwards compatibility for existing node operators. To start a new node or migrate, follow the [`nym-node` guides](../../nodes/nym-node.md).** The content of this page is not updated since April 19th 2024. Eventually this page will be terminated!
+```
+
+> The Nym Mix Node binary was built in the [building nym](../../binaries/building-nym.md) section. If you haven't yet built Nym and want to run the code, go there first.
 
 > Any syntax in `<>` brackets is a user's unique variable. Exchange with a corresponding name without the `<>` brackets.
 
 ## Current version
-```
-<!-- cmdrun ../../../../target/release/nym-mixnode --version | grep "Build Version" | cut -b 21-26  -->
-```
+
+The last version before migration to [`nym-node`](../../nodes/nym-node.md) was `1.1.35`.
 
 The `nym-mix node` binary is currently one point version ahead of the rest of the platform binaries due to a patch applied between releases.
 
 ## Preliminary steps
 
-Make sure you do the preparation listed in the [preliminary steps page](../preliminary-steps.md) before setting up your Mix Node.
+Make sure you do the preparation listed in the [preliminary steps page](initial-steps.md) before setting up your Mix Node.
 
 ## Mix node setup
 
-Now that you have built the [codebase](../binaries/building-nym.md), set up your [wallet](https://nymtech.net/docs/wallet/desktop-wallet.html), and have a VPS with the `nym-mix node` binary, you can set up your Mix Node with the instructions below.  
+Now that you have built the [codebase](../../binaries/building-nym.md), set up your [wallet](https://nymtech.net/docs/wallet/desktop-wallet.html), and have a VPS with the `nym-mix node` binary, you can set up your Mix Node with the instructions below.  
 
 To begin, move to `/target/release` directory from which you run the node commands:
 
@@ -35,12 +38,6 @@ You can check that your binaries are properly compiled with:
 
 Which should return a list of all available commands.
 
-~~~admonish example collapsible=true title="Console output"
-```
-<!-- cmdrun ../../../../target/release/nym-mixnode --help -->
-```
-~~~
-
 You can also check the various arguments required for individual commands with:
 
 ```
@@ -57,24 +54,11 @@ To check available configuration options for initializing your node use:
 ./nym-mixnode init --help
 ```
 
-~~~admonish example collapsible=true title="Console output"
-```
-<!-- cmdrun ../../../../target/release/nym-mixnode init --help -->
-```
-~~~
-
 Initialise your Mix Node with the following command, replacing the value of `--id` with the moniker you wish to give your Mix Node. Your `--host` must be publicly routable on the internet in order to mix packets, and can be either an Ipv4 or IPv6 address. The `$(curl -4 https://ifconfig.me)` command returns your IP automatically using an external service. If you enter your IP address manually, enter it **without** any port information.
 
 ```
 ./nym-mixnode init --id <YOUR_ID> --host $(curl -4 https://ifconfig.me) 
 ```
-If `<YOUR_ID>` was `my-node`, the output will look like this:
-
-~~~admonish example collapsible=true title="Console output"
-```
-<!-- cmdrun ../../../../target/release/nym-mixnode init --id my-node --host $(curl -4 https://ifconfig.me) -->
-```
-~~~
 
 > The `init` command will refuse to destroy existing Mix Node keys.
 
@@ -119,9 +103,9 @@ From `v1.1.3`, if you unbond your Mix Node that means you are leaving the mi
 To initialise, run and bond your Mix Node are the minimum steps to do in order for your Mix Node to work. However we recommend to do a few more steps before bonding. These steps will make it easier for you as a node operator on a long run as well as for others to possibly delegate Nym tokens to your Mix Node. These steps are:
 
 - [Describe your Mix Node](./mix-node-setup.md#node-description-optional) 
-- [Configure your firewall](./maintenance.md#configure-your-firewall)
-- [Automate your Mix Node](./maintenance.md#vps-setup-and-automation)
-- Set the [ulimit](./maintenance.md#set-the-ulimit-via-systemd-service-file), in case you haven't automated with [systemd](./maintenance.md#set-the-ulimit-on-non-systemd-based-distributions)
+- [Configure your firewall](../../nodes/maintenance.md#configure-your-firewall)
+- [Automate your Mix Node](../../nodes/maintenance.md#vps-setup-and-automation)
+- Set the [ulimit](../../nodes/maintenance.md#set-the-ulimit-via-systemd-service-file), in case you haven't automated with [systemd](../../nodes/maintenance.md#set-the-ulimit-on-non-systemd-based-distributions)
 
 ### Bond via the Desktop wallet (recommended)
 
@@ -137,15 +121,6 @@ You can bond your Mix Node via the Desktop wallet.
 ./nym-mixnode sign --id <YOUR_ID> --contract-msg <PAYLOAD_GENERATED_BY_THE_WALLET>
 ```
 
-It will look something like this:
-
-~~~admonish example collapsible=true title="Console output"
-```
-<!-- cmdrun ../../../../target/release/nym-mixnode init --id my-node --host $(curl -4 https://ifconfig.me) -->
-<!-- cmdrun ../../../../target/release/nym-mixnode sign --id my-node --contract-msg 22Z9wt4PyiBCbMiErxj5bBa4VCCFsjNawZ1KnLyMeV9pMUQGyksRVANbXHjWndMUaXNRnAuEVJW6UCxpRJwZe788hDt4sicsrv7iAXRajEq19cWPVybbUqgeo76wbXbCbRdg1FvVKgYZGZZp8D72p5zWhKSBRD44qgCrqzfV1SkiFEhsvcLUvZATdLRocAUL75KmWivyRiQjCE1XYEWyRH9yvRYn4TymWwrKVDtEB63zhHjATN4QEi2E5qSrSbBcmmqatXsKakbgSbQoLsYygcHx7tkwbQ2HDYzeiKP1t16Rhcjn6Ftc2FuXUNnTcibk2LQ1hiqu3FAq31bHUbzn2wiaPfm4RgqTwGM4eqnjBofwR3251wQSxbYwKUYwGsrkweRcoPuEaovApR9R19oJ7GVG5BrKmFwZWX3XFVuECe8vt1x9MY7DbQ3xhAapsHhThUmzN6JPPU4qbQ3PdMt3YVWy6oRhap97ma2dPMBaidebfgLJizpRU3Yu7mtb6E8vgi5Xnehrgtd35gitoJqJUY5sB1p6TDPd6vk3MVU1zqusrke7Lvrud4xKfCLqp672Bj9eGb2wPwow643CpHuMkhigfSWsv9jDq13d75EGTEiprC2UmWTzCJWHrDH7ka68DZJ5XXAW67DBewu7KUm1jrJkNs55vS83SWwm5RjzQLVhscdtCH1Bamec6uZoFBNVzjs21o7ax2WHDghJpGMxFi6dmdMCZpqn618t4 -->
-```
-~~~
-
 * Copy the resulting signature:
 
 ```sh
@@ -155,7 +130,7 @@ It will look something like this:
 
 * And paste it into the wallet nodal, press `Next` and confirm the transaction.
 
-![Paste Signature](../images/wallet-screenshots/wallet-sign.png)  
+![Paste Signature](../../images/wallet-screenshots/wallet-sign.png)  
 *This image is just an example, copy-paste your own base58-encoded signature*
 
 * Your node will now be bonded and ready to mix at the beginning of the next epoch (at most 1 hour).
@@ -187,13 +162,6 @@ Change directory by `cd <PATH>/<TO>/<THE>/<RELEASE>` and run the following on th
 ./nym-mixnode sign --id <YOUR_ID> --text <TEXT>
 ```
 
-~~~admonish example collapsible=true title="Console output"
-```
-<!-- cmdrun ../../../../target/release/nym-mixnode init --id YOUR_ID --host $(curl -4 https://ifconfig.me) -->
-<!-- cmdrun ../../../../target/release/nym-mixnode sign --id YOUR_ID --text "TEXT" -->
-```
-~~~
-
 Using `nym-cli`:
 
 > `--mnemonic` is the mnemonic of the member wanting to be the head of family.
@@ -222,13 +190,6 @@ Change directory by `cd <PATH>/<TO>/<THE>/<RELEASE>` and run the following on th
 ./nym-mixnode sign --id <YOUR_ID> --text <TEXT>
 ```
 
-~~~admonish example collapsible=true title="Console output"
-```
-<!-- cmdrun ../../../../target/release/nym-mixnode init --id YOUR_ID --host $(curl -4 https://ifconfig.me) -->
-<!-- cmdrun ../../../../target/release/nym-mixnode sign --id YOUR_ID --text "TEXT" -->
-```
-~~~
-
 Using `nym-cli`:
 
 ```
@@ -276,9 +237,7 @@ There are also 2 community explorers which have been created by [Nodes Guru](htt
 - [Mainnet](https://mixnet.explorers.guru/)
 - [Sandbox testnet](https://sandbox.mixnet.explorers.guru/)
 
-For more details see [Troubleshooting FAQ](../nodes/troubleshooting.md)
-
 ## Maintenance
 
-For Mix Node upgrade, firewall setup, port configuration, API endpoints, VPS suggestions, automation and more, see the [maintenance page](./maintenance.md)
+For Mix Node upgrade, firewall setup, port configuration, API endpoints, VPS suggestions, automation and more, see the [maintenance page](../../nodes/maintenance.md)
 

documentation/operators/src/archive/nodes/network-requester-setup.md

@@ -1,21 +1,20 @@
-# Network Requesters
+# Network Requester
 
-> Nym Network Requester was built in the [building nym](../binaries/building-nym.md) section. If you haven't yet built Nym and want to run the code, go there first.
-
-```admonish info
-As a result of [Project Smoosh](../faq/smoosh-faq.md), the current version of `nym-gateway` binary also contains `nym-network-requester` functionality which can be enabled [by the operator](./gateway-setup.md#initialising-gateway-with-network-requester). This combination is a basis of Nym Exit Gateway node - an essential piece in our new setup. Please read more in our [Project Smoosh FAQ](../faq/smoosh-faq.md) and [Exit Gateways Page](../legal/exit-gateway.md). We recommend operators begin to shift their setups to this new combined node, instead of operating two separate binaries.
+```admonish warning
+**This is an archived page for backwards compatibility for existing node operators. To start a new node or migrate, follow the [`nym-node` guides](../../nodes/nym-node.md).** The content of this page is not updated since April 19th 2024. Eventually this page will be terminated!
 ```
 
+> Nym Network Requester was built in the [building nym](../../binaries/building-nym.md) section. If you haven't yet built Nym and want to run the code, go there first.
+
 > Any syntax in `<>` brackets is a user's unique variable. Exchange with a corresponding name without the `<>` brackets.
 
 ## Current version
-```
-<!-- cmdrun ../../../../target/release/nym-network-requester --version | grep "Build Version" | cut -b 21-26  -->
-```
+
+The last version before migration to [`nym-node`](../../nodes/nym-node.md) was `1.1.33`.
 
 ## Preliminary steps
 
-Make sure you do the preparation listed in the [preliminary steps page](../preliminary-steps.md) before setting up your Network Requester.
+Make sure you do the preparation listed in the [preliminary steps page](initial-steps.md) before setting up your Network Requester.
 
 ## Network Requester Whitelist
 
@@ -127,12 +126,6 @@ cd target/release
 
 The `./nym-network-requester --help ` command can be used to show a list of available parameters.
 
-~~~admonish example collapsible=true title="Console output"
-```
-<!-- cmdrun ../../../../target/release/nym-network-requester --help -->
-```
-~~~
-
 You can check the required parameters for available commands by running:
 
 ```
@@ -149,15 +142,6 @@ The Network Requester needs to be initialized before it can be run. This is requ
  ./nym-network-requester init --id <YOUR_ID>
 ```
 
-In the following we used `example`.
-
-~~~admonish example collapsible=true title="Console output"
-```
-<!-- cmdrun timeout 20s ../../../../target/release/nym-network-requester init --id example -->
-```
-~~~
-
-
 Now that we have initialized our network-requester, we can start it with the following command:
 
 ```
@@ -218,7 +202,4 @@ This command should return the following:
 { "status": "ok" }
 ```
 
-## Maintenance
-
-For Network Requester upgrade (including an upgrade from `<v1.1.9` to `>= v1.1.10`), firewall setup, port configuration, API endpoints, VPS suggestions, automation and more, see the [maintenance page](./maintenance.md).
 

documentation/operators/src/archive/nodes/setup-guides.md

@@ -0,0 +1,15 @@
+# Node Setup Guides
+
+```admonish warning
+**This is an archived page for backwards compatibility. The content of this page is not updated since April 19th 2024. Eventually this page will be terminated!**
+```
+
+To setup any type of Nym's node, start with building [Nym's platform](../../binaries/building-nym.md) on the machine (VPS) where you want to run the node. Nodes will need to be bond to Nym's wallet, setup one [here](https://nymtech.net/docs/wallet/desktop-wallet.html).
+
+This section contains setup guides for the following node types:
+* [Mix Node](mix-node-setup.md)
+* [Gateway](gateway-setup.md)
+* [Network Requester](network-requester-setup.md)
+* [Validator](../../nodes/validator-setup.md)
+
+

documentation/operators/src/binaries/building-nym.md

@@ -54,16 +54,14 @@ cargo build --release # build your binaries with **mainnet** configuration
 
 Quite a bit of stuff gets built. The key working parts are:
 
-* [mix node](../nodes/mix-node-setup.md): `nym-mixnode`
-* [gateway node](../nodes/gateway-setup.md): `nym-gateway`
+* [Nym Node](../nodes/nym-node.md): `nym-node`
+* [Validator](../nodes/validator-setup.md)
 * [websocket client](https://nymtech.net/docs/clients/websocket-client.html): `nym-client`
 * [socks5 client](https://nymtech.net/docs/clients/socks5-client.html): `nym-socks5-client`
 * [webassembly client](https://nymtech.net/docs/clients/webassembly-client.html): `webassembly-client`
-* [network requester](../nodes/network-requester-setup.md): `nym-network-requester`
 * [nym-cli tool](https://nymtech.net/docs/tools/nym-cli.html): `nym-cli`
 * [nym-api](../nodes/nym-api.md): `nym-api`
-
-[//]: # (* [nymvisor](../nodes/nymvisor-upgrade.md): `nymvisor`)
+* [nymvisor](../nodes/nymvisor-upgrade.md): `nymvisor`
  
 The repository also contains Typescript applications which aren't built in this process. These can be built by following the instructions on their respective docs pages.
 * [Nym Wallet](https://nymtech.net/docs/wallet/desktop-wallet.html)

documentation/operators/src/binaries/pre-built-binaries.md

@@ -28,7 +28,5 @@ Now you can use your binary, initialise and run your Nym Node. Follow the guide
 
 **Node setup and usage guides:**
 
-* [Mix nodes](../nodes/mix-node-setup.md)
-* [Gateways](../nodes/gateway-setup.md)
-* [Network requesters](../nodes/network-requester-setup.md)
+* [Nym Nodes](../nodes/nym-node.md)
 * [Validators](../nodes/validator-setup.md)

documentation/operators/src/changelog.md

@@ -0,0 +1,33 @@
+# Changelog
+
+This page displays a full list of all the changes during our release cycle from [`v2024.3-eclipse`](https://github.com/nymtech/nym/blob/nym-binaries-v2024.3-eclipse/CHANGELOG.md) onwards. Operators can find here the newest updates together with links to relevant documentation. The list is sorted so that the newest changes appear first.
+
+## `v2024.4-nutella`
+
+- [Merged PRs](https://github.com/nymtech/nym/milestone/59?closed=1)
+- [`nym-node`](nodes/nym-node.md) version `1.1.1`
+- This release also contains: `nym-gateway` and `nym-network-requester` binaries
+- core improvements on nym-node configuration
+- Nym wallet changes:
+    - Adding `nym-node` command to bonding screens
+    - Fixed the delegation issues with fixing RPC
+- [Network configuration](nodes/configuration.md#connectivity-test-and-configuration) section updates, in particular for `--mode mixnode` operators
+- [VPS IPv6 troubleshooting](troubleshooting/vps-isp.md#ipv6-troubleshooting) updates
+
+## `v2024.3-eclipse`
+
+- Release [Changelog.md](https://github.com/nymtech/nym/blob/nym-binaries-v2024.3-eclipse/CHANGELOG.md)
+- [`nym-node`](nodes/nym-node.md) initial release
+- New tool for monitoring Gateways performance [harbourmaster.nymtech.net](https://harbourmaster.nymtech.net)
+- New versioning `1.1.0+nymnode` mainly for internal migration testing, not essential for operational use. We aim to correct this in a future release to ensure mixnodes feature correctly in the main API
+- New [VPS specs & configuration](nodes/vps-setup.md) page
+- New [configuration page](nodes/configuration.md) with [connectivity setup guide](nodes/configuration.md#connectivity-test-and-configuration) - a new requirement for `exit-gateway`
+- API endpoints redirection: Nym-mixnode and nym-gateway endpoints will eventually be deprecated; due to this, their endpoints will be redirected to new routes once the `nym-node` has been migrated and is running
+
+**API endpoints redirection**
+
+| Previous endpoint              | New endpoint                             |
+| ---                            | ---                                      |
+| `http://<IP>:8000/stats`       | `http://<IP>:8000/api/v1/metrics/mixing` |
+| `http://<IP>:8000/hardware`    | `http://<IP>:8000/api/v1/system-info`    |
+| `http://<IP>:8000/description` | `http://<IP>:8000/api/v1/description`    |

documentation/operators/src/faq/general-faq.md

@@ -0,0 +1,42 @@
+# General Operators FAQ
+
+## Nym Mixnet
+
+To see different stats about Nym Mixnet live, we recommend you to visit [status.notrustverify.ch](https://status.notrustverify.ch/d/CW3L7dVVk/nym-mixnet?orgId=1) built by [No Trust Verify](https://notrustverify.ch/) crew, one of the squads within Nym core community.
+
+<iframe src="https://status.notrustverify.ch/d-solo/CW3L7dVVk/nym-mixnet?orgId=1&from=1702215592419&to=1704807592419&panelId=12" width="800" height="400" frameborder="0"></iframe>
+
+
+### Is there an explorer for Nym Mixnet?
+
+Yes, there are several places, some are built by Nym core community:
+
+* [Nym Explorer](https://explorer.nymtech.net/)
+* [Guru Explorer](https://mixnet.explorers.guru/)
+* [ExploreNYM](https://explorenym.net/)
+
+### Which VPS providers would you recommend?
+
+Consider in which jurisdiction you reside and where do you want to run a Mix Node. Do you want to pay by crypto or not and what are the other important particularities for your case? We always recommend operators to try to choose smaller and decentralised VPS providers over the most known ones controlling a majority of the internet. We receive some good feedback on these: Linode, Gandi, Flokinet and Exoscale. Do your own research and share with the community.
+
+### Why is a node setup on a self-hosted machine so tricky?
+
+We don't recommend this setup because it's really difficult to get a static IP and route IPv6 traffic.
+
+### What's the Sphinx packet size?
+
+The sizes are shown in the configs [here](https://github.com/nymtech/nym/blob/1ba6444e722e7757f1175a296bed6e31e25b8db8/common/nymsphinx/params/src/packet_sizes.rs#L12) (default is the one clients use, the others are for research purposes, not to be used in production as this would fragment the anonymity set). More info can be found [here](https://github.com/nymtech/nym/blob/4844ac953a12b29fa27688609ec193f1d560c996/common/nymsphinx/anonymous-replies/src/reply_surb.rs#L80).
+
+### Why a Mix Node and a Gateway cannot be bonded with the same wallet?
+
+Because of the way the smart contract works we keep it one-node one-address at the moment.
+
+### Which nodes are the most needed to be setup to strengthen Nym infrastructure and which ones bring rewards?
+
+Ath this point the most crutial component needed are [Exit Gateways](../legal/exit-gateway.md).
+
+### Are Nym Nodes whitelisted?
+
+Nope, anyone can run a Nym Node. whether your node is chosen to mix is purely reliant on the node's performance and reputation (self stake + delegations).
+
+

documentation/operators/src/faq/nym-nodes-faq.md

@@ -0,0 +1,32 @@
+# Nym Nodes related Frequently Asked Questions
+
+### What determines the rewards when running a `nym-node --mode mixnode`?
+
+The stake required for a Mix Node to achieve maximum rewards is called Mix Node saturation point. This is calculated from the staking supply (all circulating supply + part of unlocked tokens). The target level of staking is to have 40% of the staking supply locked in Mix Nodes.
+
+The node stake saturation point, which we denote by Nsat, is given by the stake supply, target level of staking divided between the rewarded nodes.
+
+This design ensures the nodes aim to have a same size of stake (reputation) which can be done by delegation staking, as well as it secures a whale prevention and decentralization of staking, as any higher level of delegated $NYM than Nsat per node results in worsening reward ratio. On the contrary, the more Mix Nodes are active, the lower is Nsat. The equilibrium is reached when the staked tokens are delegated equally across the active Mix nodes and that's our basis for this incentive system.
+
+<!--
+<iframe src="https://status.notrustverify.ch/d-solo/CW3L7dVVk/nym-mixnet?orgId=1&from=1703074760986&to=1705666760986&panelId=5" width="800" height="400" frameborder="0"></iframe>
+-->
+
+The rewarded nodes are the nodes which will receive some rewards by the end of the given epoch. These can be separated further separated into:
+
+1. Active: Top *N* nodes of the rewarded set (currently all of them but this can change), these are nodes which are used by the clients and mix packets.
+
+2. Standby: Bottom *N* nodes of the rewarded set, they don't mix data from the clients but are used for testing. Their reward is smaller.
+
+
+For more detailed calculation, read our blog post [Nym Token Economics update](https://blog.nymtech.net/nym-token-economics-update-fedff0ed5267). More info on staking can be found [here](https://blog.nymtech.net/staking-in-nym-introducing-mainnet-mixmining-f9bb1cbc7c36). And [here](https://blog.nymtech.net/want-to-stake-in-nym-here-is-how-to-choose-a-mix-node-to-delegate-nym-to-c3b862add165) is more info on how to choose a Mix Node for delegation. And finally an [update](https://blog.nymtech.net/quarterly-token-economic-parameter-update-b2862948710f) on token economics from July 2023.
+
+<!--
+<iframe src="https://status.notrustverify.ch/d-solo/CW3L7dVVk/nym-mixnet?orgId=1&from=1703074829887&to=1705666829887&panelId=31" width="850" height="400" frameborder="0"></iframe>
+-->
+
+<iframe src="https://dashboard.notrustverify.ch/d-solo/l71MWkX7k/ntv-mixnode?orgId=1&from=1710949572440&to=1713537972440&panelId=18" width="850" height="400" frameborder="0"></iframe>
+
+*More graphs and stats at [stats.notrustverify.ch](https://status.notrustverify.ch/d/CW3L7dVVk/nym-mixnet?orgId=1&from=1703074861988&to=1705666862004).*
+
+

documentation/operators/src/faq/nyx-faq.md

@@ -0,0 +1,29 @@
+## Validators and tokens
+
+### What's the difference between NYM and uNYM?
+
+1 NYM = 1 000 000 uNYM
+
+<!--- Commenting for now as NYX is not publicly out yet
+### What's the difference between NYM and NYX?
+--->
+
+### Why some Nyx blockchain operations take one hour and others are instant?
+
+This is based on the definition in [Nym's CosmWasm](https://github.com/nymtech/nym/tree/develop/common/cosmwasm-smart-contracts) smart contracts code.
+
+Whatever is defined as [a pending epoch event](https://github.com/nymtech/nym/blob/b07627d57e075b6de35b4b1a84927578c3172811/common/cosmwasm-smart-contracts/mixnet-contract/src/pending_events.rs#L35-L103) will get resolved at the end of the current epoch.
+
+And whatever is defined as [a pending interval event](https://github.com/nymtech/nym/blob/b07627d57e075b6de35b4b1a84927578c3172811/common/cosmwasm-smart-contracts/mixnet-contract/src/pending_events.rs#L145-L172) will get resolved at the end of the current interval.
+
+### Can I run a validator?
+
+We are currently working towards building up a closed set of reputable validators. You can ask us for coins to get in, but please don't be offended if we say no - validators are part of our system's core security and we are starting out with people we already know or who have a solid reputation.
+
+### Why is validator set entry whitelisted?
+
+We understand that the early days of the Nyx blockchain will face possible vulnerabilities in terms of size - easy to disrupt or halt the chain if a malicious party entered with a large portion of stake. Besides that, there are some legal issues we need to address before we can distribute the validator set in a fully permissions fashion.
+
+### Why does Nym do airdrops?
+
+It is part of ensuring decentralisation - we need to avoid a handful of people having too much control over the token and market. Of course ideally people will stake the tokens and contribute to the project at this stage. We run surveys to better understand what people are doing with their tokens and what usability issues there are for staking. Any feedback is appreciated as it helps us improve all aspects of using the token and participating in the ecosystem.

documentation/operators/src/introduction.md

@@ -1,25 +1,45 @@
 # Introduction
 
-This is Nym's Operators guide, containing information and setup guides for the various pieces of Nym Mixnet infrastructure (Mix Node, Gateway and Network Requester) and Nyx blockchain validators.
+This is Nym's Operators guide, containing information and setup guides for the various pieces of Nym Mixnet infrastructure and Nyx blockchain validators.
 
-If you are new to Nym and want to learn about the mixnet, explore kickstart options and demos, learn how to integrate with the network, and follow developer tutorials check out the [Developer Portal](https://nymtech.net/developers/).
+```
+                      ┌─►mix──┐  mix     mix
+                      │       │
+            Entry     │       │                   Exit
+client ───► Gateway ──┘  mix  │  mix  ┌─►mix ───► Gateway ───► internet
+                              │       │
+                              │       │
+                         mix  └─►mix──┘  mix
+```
+
+If you are new to Nym and want to learn about the Mixnet, explore kickstart options and demos, learn how to integrate with the network, and follow developer tutorials check out the [Developer Portal](https://nymtech.net/developers/).
 
 If you want to dive deeper into Nym's architecture, clients, nodes, and SDK examples visit the [technical docs](https://nymtech.net/docs/).
 
 
 ## Popular pages
+
 **Binary Information**
+
 * [Building Nym](binaries/building-nym.md)
 * [Pre-built Binaries](binaries/pre-built-binaries.md)
 
 **Node setup and usage guides:**
-* [Mix nodes](nodes/mix-node-setup.md)
-* [Gateways](nodes/gateway-setup.md)
-* [Network requesters](nodes/network-requester-setup.md)
+
+* [Nym Node](nodes/nym-node.md)
+* [Nymvisor](nodes/nymvisor-upgrade.md)
 * [Validators](nodes/validator-setup.md)
+* [Nym API Setup](nodes/nym-api.md)
 
 **Maintenance, troubleshooting and FAQ**
-* [Maintenance](nodes/maintenance.md)
-* [Troubleshooting](nodes/troubleshooting.md)
-* [FAQ](faq/mixnodes-faq.md)
+
+* [FAQ](faq/nym-nodes-faq.md)
+* [Maintenance](nodes/maintenance.md)
+* [Troubleshooting](troubleshooting/nodes.md)
+
+**Community Legal Forum**
+
+* [Exit Gateway](legal/exit-gateway.md)
+* [Community Counsel](legal/community-counsel.md)
+* [How to Add Info](legal/add-content.md)
 

documentation/operators/src/legal/exit-gateway.md

@@ -8,7 +8,7 @@ This page is a part of Nym Community Legal Forum and its content is composed by
 
 This document presents an initiative to further support Nym’s mission of allowing privacy for everyone everywhere. This would be achieved with the support of Nym node operators operating Gateways and opening these to any online service. Such setup needs a **clear policy**, one which will remain the **same for all operators** running Nym nodes. The [proposed **Exit policy**](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) is a combination of two existing safeguards: [Tor Null ‘deny’ list](https://tornull.org/) and [Tor reduced policy](https://tornull.org/tor-reduced-reduced-exit-policy.php).
 
-All the technical changes on the side of Nym nodes - ***Project Smoosh*** - are described in the [FAQ section](../faq/smoosh-faq.md).
+All the technical changes on the side of Nym nodes - ***Project Smoosh*** - are described in the [FAQ section](../archive/faq/smoosh-faq.md).
 
 ```admonish warning
 Nym core team cannot provide comprehensive legal advice across all jurisdictions. Knowledge and experience with the legalities are being built up with the help of our counsel and with you, the community of Nym node operators. We encourage Nym node operators to join the operator channels ([Element](https://matrix.to/#/#operators:nymtech.chat), [Discord](https://discord.com/invite/nym), [Telegram](https://t.me/nymchan_help_chat)) to share best practices and experiences.

documentation/operators/src/legal/landing-pages.md

@@ -10,360 +10,4 @@ Exit Gateway landing page is a great and transparent way to prevent possible tro
 
 ## Avril 14th Exit Gateways
 
-The following snippet needs  be modified as described below according to the public identity that you may want to show on this public notice, i.e. your graphics and your email.
-It would allow you to serve it as a landing page resembling the one proposed by [Tor](https://gitlab.torproject.org/tpo/core/tor/-/raw/HEAD/contrib/operator-tools/tor-exit-notice.html) but with all the changes needed to adhere to the Nym's operators case.
-
-[Avril 14th](https://avril14th.org/) is a team of professionals and optimistic realists eager to contribute to a future of privacy, decentralization and connectivity.
-
-When done with the customization needs as described below, you'll need to upload the file and reference it as the `landing_page_assets_path` on the `[http]` section of the config.toml file:
-```
-landing_page_assets_path = '<PATH_TO_YOUR_CUSTOM_FILE>'
-```
-
-### HTML file customization
-
-- add your favicon logo on the line:
-```
-<link rel="icon" type="image/png" href="">
-```
-
-and your header logo on the line:
-```
-<img class="logo" src="<FIXME>">
-```
-
-by either setting the URl to the image (if you're hosting it publicly, i.e. on your web server)
-```
-href="<PATH_TO_YOUR_PUBLIC_URL>"
-```
-and
-```
-src="<PATH_TO_YOUR_PUBLIC_URL>"
-
-```
-**or** by adding the image inline as base64 encoded image
-```
-href="href="data:image/x-icon;base64,AAABAAMA....""
-```
-and
-```
-src="href="data:image/x-icon;base64,AAABAAMA....""
-```
-
-
-- add the email address you're willing to use for being contacted.
-```
-<a href="mailto:>FIXME>">maintainer</a>
-```
-
-- If you're running the node within the US check the sections marked as FIXME, add your DNS name and uncomment those.
-***
-
-```html
-<!DOCTYPE html>
-<html lang="en-US">
-<head>
-<meta charset="UTF-8">
-<title>This is a NYM Exit Gateway</title>
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<link rel="icon" type="image/png" href="">
-<style>
-:root {
-  font-family: Consolas, "Ubuntu Mono", Menlo, "DejaVu Sans Mono", monospace;
-}
-:root{
---background-color: #121726;
---text-color: #f2f2f2;
---link-color: #fb6e4e;
-}
-html{
-background: var(--background-color);
-}
-body{
-margin-left: auto;
-margin-right: auto;
-padding-left: 5vw;
-padding-right: 5vw;
-max-width: 1000px;
-}
-h1{
-font-size: 55px;
-text-align: center;
-color: var(--title-color)
-}
-p{
-color: var(--text-color);
-}
-p, a{
-font-size: 20px;
-}
-a{
-color: var(--link-color);
-text-decoration: none;
-}
-a:hover{
-filter: brightness(.8);
-text-decoration: underline;
-}
-.links{
-display: flex;
-flex-wrap: wrap;
-justify-content: space-evenly;
-}
-.links > a{
-margin: 10px;
-white-space: nowrap;
-}
-</style>
-
-</head>
-<body>
-<main>
-<h1>This is a NYM Exit Gateway</h1>
-<p style="text-align:center">
-<img class="logo" src="<FIXME>">
-</p>
-
-<p>
-You are most likely accessing this website because you've had some issue with
-the traffic coming from this IP. This router is part of the <a
-href="https://nymtech.net/">NYM project</a>, which is
-dedicated to <a href="https://nymtech.net/about/mission">create</a> outstanding
-privacy software that is legally compliant without sacrificing integrity or
-having any backdoors.
-This router IP should be generating no other traffic, unless it has been
-compromised.</p>
-
-<p>
-The Nym mixnet is operated by a decentralised community of node operators
-and stakers. The Nym mixnet is trustless, meaning that no parts of the system
-nor its operators have access to information that might compromise the privacy
-of users. Nym software enacts a strict principle of data minimisation and has
-no back doors. The Nym mixnet works by encrypting packets in several layers
-and relaying those through a multi-layered network called a mixnet,  eventually
-letting the traffic exit the Nym mixnet through an exit gateway like this one.
-This design makes it very hard for a service to know which user is connecting to it,
-since it can only see the IP-address of the Nym exit gateway:</p>
-
-<p style="text-align:center;margin:40px 0">
-<svg xmlns="http://www.w3.org/2000/svg" width="500" viewBox="0 0 490.28 293.73" style="width:100%;max-width:600px">
-<desc>Illustration showing how a user might connect to a service through the Nym network. The user first sends their data through three daisy-chained encrypted Nym nodes that exist on three different continents. Then the last Nym node in the chain connects to the target service over the normal internet.</desc>
-<defs>
-<style>
-.t{
-fill: var(--text-color);
-stroke: var(--text-color);
-}
-</style>
-</defs>
-<path fill="#6fc8b7" d="M257.89 69.4c-6.61-6.36-10.62-7.73-18.36-8.62-7.97-1.83-20.06-7.99-24.17-.67-3.29 5.85-18.2 12.3-16.87 2.08.92-7.03 11.06-13.28 17-17.37 8.69-5.99 24.97-2.87 26.1-10.28 1.04-6.86-8.33-13.22-8.55-2.3-.38 12.84-19.62 2.24-8.73-6.2 8.92-6.9 16.05-9.02 25.61-6.15 12.37 4.83 25.58-2.05 33.73-.71 12.37-2.01 24.69-5.25 37.39-3.96 13 .43 24.08-.14 37.06.63 9.8 1.58 16.5 2.87 26.37 3.6 6.6.48 17.68-.82 24.3 1.9 8.3 4.24.44 10.94-6.89 11.8-8.79 1.05-23.59-1.19-26.6 1.86-5.8 7.41 10.75 5.68 11.27 14.54.57 9.45-5.42 9.38-8.72 16-2.7 4.2.3 13.93-1.18 18.45-1.85 5.64-19.64 4.47-14.7 14.4 4.16 8.34 1.17 19.14-10.33 12.02-5.88-3.65-9.85-22.04-15.66-21.9-11.06.27-11.37 13.18-12.7 17.52-1.3 4.27-3.79 2.33-6-.63-3.54-4.76-7.75-14.22-12.01-17.32-6.12-4.46-10.75-1.17-15.55 2.83-5.63 4.69-8.78 7.82-7.46 16.5.78 9.1-12.9 15.84-14.98 24.09-2.61 10.32-2.57 22.12-8.81 31.47-4 5.98-14.03 20.12-21.27 14.97-7.5-5.34-7.22-14.6-9.56-23.08-2.5-9.02.6-17.35-2.57-26.2-2.45-6.82-6.23-14.54-13.01-13.24-6.5.92-15.08 1.38-19.23-2.97-5.65-5.93-6-10.1-6.61-18.56 1.65-6.94 5.79-12.64 10.38-18.63 3.4-4.42 17.45-10.39 25.26-7.83 10.35 3.38 17.43 10.5 28.95 8.57 3.12-.53 9.14-4.65 7.1-6.62zm-145.6 37.27c-4.96-1.27-11.57 1.13-11.8 6.94-1.48 5.59-4.82 10.62-5.8 16.32.56 6.42 4.34 12.02 8.18 16.97 3.72 3.85 8.58 7.37 9.3 13.1 1.24 5.88 1.6 11.92 2.28 17.87.34 9.37.95 19.67 7.29 27.16 4.26 3.83 8.4-2.15 6.52-6.3-.54-4.54-.6-9.11 1.01-13.27 4.2-6.7 7.32-10.57 12.44-16.64 5.6-7.16 12.74-11.75 14-20.9.56-4.26 5.72-13.86 1.7-16.72-3.14-2.3-15.83-4-18.86-6.49-2.36-1.71-3.86-9.2-9.86-12.07-4.91-3.1-10.28-6.73-16.4-5.97zm11.16-49.42c6.13-2.93 10.58-4.77 14.61-10.25 3.5-4.28 2.46-12.62-2.59-15.45-7.27-3.22-13.08 5.78-18.81 8.71-5.96 4.2-12.07-5.48-6.44-10.6 5.53-4.13.38-9.2-5.66-8.48-6.12.8-12.48-1.45-18.6-1.73-5.3-.7-10.13-1-15.45-1.37-5.37-.05-16.51-2.23-25.13.87-5.42 1.79-12.5 5.3-16.73 9.06-4.85 4.2.2 7.56 5.54 7.45 5.3-.22 16.8-5.36 20.16.98 3.68 8.13-5.82 18.29-5.2 26.69.1 6.2 3.37 11 4.74 16.98 1.62 5.94 6.17 10.45 10 15.14 4.7 5.06 13.06 6.3 19.53 8.23 7.46.14 3.34-9.23 3.01-14.11 1.77-7.15 8.49-7.82 12.68-13.5 7.14-7.72 16.41-13.4 24.34-18.62zM190.88 3.1c-4.69 0-13.33.04-18.17-.34-7.65.12-13.1-.62-19.48-1.09-3.67.39-9.09 3.34-5.28 7.04 3.8.94 7.32 4.92 7.1 9.31 1.32 4.68 1.2 11.96 6.53 13.88 4.76-.2 7.12-7.6 11.93-8.25 6.85-2.05 12.5-4.58 17.87-9.09 2.48-2.76 7.94-6.38 5.26-10.33-1.55-1.31-2.18-.64-5.76-1.13zm178.81 157.37c-2.66 10.08-5.88 24.97 9.4 15.43 7.97-5.72 12.58-2.02 17.47 1.15.5.43 2.65 9.2 7.19 8.53 5.43-2.1 11.55-5.1 14.96-11.2 2.6-4.62 3.6-12.39 2.76-13.22-3.18-3.43-6.24-11.03-7.7-15.1-.76-2.14-2.24-2.6-2.74-.4-2.82 12.85-6.04 1.22-10.12-.05-8.2-1.67-29.62 7.17-31.22 14.86z"/>
-<g fill="none">
-<path stroke="#cf63a6" stroke-linecap="round" stroke-width="2.76" d="M135.2 140.58c61.4-3.82 115.95-118.83 151.45-103.33"/>
-<path stroke="#cf63a6" stroke-linecap="round" stroke-width="2.76" d="M74.43 46.66c38.15 8.21 64.05 42.26 60.78 93.92M286.65 37.25c-9.6 39.44-3.57 57.12-35.64 91.98"/>
-<path stroke="#e4c101" stroke-dasharray="9.06,2.265" stroke-width="2.27" d="M397.92 162.52c-31.38 1.26-90.89-53.54-148.3-36.17"/>
-<path stroke="#cf63a6" stroke-linecap="round" stroke-width="2.77" d="M17.6 245.88c14.35 0 14.4.05 28-.03"/>
-<path stroke="#e3bf01" stroke-dasharray="9.06,2.265" stroke-width="2.27" d="M46.26 274.14c-17.52-.12-16.68.08-30.34.07"/>
-</g>
-<g transform="translate(120.8 -35.81)">
-<circle cx="509.78" cy="68.74" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
-<circle cx="440.95" cy="251.87" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
-<circle cx="212.62" cy="272.19" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
-<circle cx="92.12" cy="87.56" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
-<circle cx="730.88" cy="315.83" r="18.12" fill="#67727b" transform="translate(-93.3 38.03) scale(.50637)"/>
-<circle cx="-102.85" cy="282.18" r="9.18" fill="#240a3b"/>
-<circle cx="-102.85" cy="309.94" r="9.18" fill="#67727b"/>
-</g>
-<g class="t">
-<text xml:space="preserve" x="-24.76" y="10.37" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="-24.76" y="10.37">The user</tspan></text>
-<text xml:space="preserve" x="150.63" y="196.62" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="150.63" y="196.62">This server</tspan></text>
-<text xml:space="preserve" x="346.39" y="202.63" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="346.39" y="202.63">Your service</tspan></text>
-<text xml:space="preserve" x="34.52" y="249.07" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="34.52" y="249.07">Nym network link</tspan></text>
-<text xml:space="preserve" x="34.13" y="276.05" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="34.13" y="276.05">Unencrypted link</tspan></text>
-<path fill="none" stroke-linecap="round" stroke-width="1.67" d="M222.6 184.1c-2.6-15.27 8.95-23.6 18.43-38.86m186.75 45.61c-.68-10.17-9.4-17.68-18.08-23.49"/>
-<path fill="none" stroke-linecap="round" stroke-width="1.67" d="M240.99 153.41c.35-3.41 1.19-6.17.04-8.17m-7.15 5.48c1.83-2.8 4.58-4.45 7.15-5.48"/>
-<path fill="none" stroke-linecap="round" stroke-width="1.67" d="M412.43 173.21c-2.2-3.15-2.54-3.85-2.73-5.85m0 0c2.46-.65 3.85.01 6.67 1.24M61.62 40.8C48.89 36.98 36.45 27.54 36.9 18.96M61.62 40.8c.05-2.58-3.58-4.8-5.25-5.26m-2.65 6.04c1.8.54 6.8 1.31 7.9-.78"/>
-<path fill="none" stroke-linecap="round" stroke-linejoin="round" stroke-width="2.44" d="M1.22 229.4h247.74v63.1H1.22z"/>
-</g>
-</svg>
-</p>
-
-<p>
-<a href="https://nymtech.net/about/mixnet">Read more about how Nym works.</a></p>
-
-<p>
-Nym relies on a growing ecosystem of users, developers and researcher partners
-aligned with the mission to make sure Nym software is running, remains usable
-and solves real problems. While Nym is not designed for malicious computer
-users, it is true that they can use the network for malicious ends. This
-is largely because criminals and hackers have significantly better access to
-privacy and anonymity than do the regular users whom they prey upon. Criminals
-can and do build, sell, and trade far larger and more powerful networks than
-Nym on a daily basis. Thus, in the mind of this operator, the social need for
-easily accessible censorship-resistant private, anonymous communication trumps
-the risk of unskilled bad actors, who are almost always more easily uncovered
-by traditional police work than by extensive monitoring and surveillance anyway.</p>
-
-<p>
-In terms of applicable law, the best way to understand Nym is to consider it a
-network of routers operating as common carriers, much like the Internet
-backbone. However, unlike the Internet backbone routers, Nym mixnodes do not
-contain identifiable routing information about the source of a packet and do
-mix the user internet traffic with that of other users, making communications
-private and protecting not just the user content but the metadata
-(user's IP address, who the user talks to, when, where, from what device and
-more) and no single Nym node can determine both the origin and destination
-of a given transmission.</p>
-
-<p>
-As such, there is little the operator of this Exit Gateway can do to help you
-track the connection further. This Exit Gateway maintains no logs of any of the
-Nym mixnet traffic, so there is little that can be done to trace either legitimate or
-illegitimate traffic (or to filter one from the other).  Attempts to
-seize this router will accomplish nothing.</p>
-
-<!-- FIXME: US-Only section. Remove if you are a non-US operator -->
-<!--
-<p>
-Furthermore, this machine also serves as a carrier of email, which means that
-its contents are further protected under the ECPA. <a
-href="https://www.law.cornell.edu/uscode/text/18/2707">18
-USC 2707</a> explicitly allows for civil remedies ($1000/account
-<i>plus</i>  legal fees)
-in the event of a seizure executed without good faith or probable cause (it
-should be clear at this point that traffic with an originating IP address of
-FIXME_DNS_NAME should not constitute probable cause to seize the
-machine). Similar considerations exist for 1st amendment content on this
-machine.</p>
--->
-<!-- FIXME: May or may not be US-only. Some non-US tor nodes have in
-     fact reported DMCA harassment... -->
-<!--
-<p>
-If you are a representative of a company who feels that this router is being
-used to violate the DMCA, please be aware that this machine does not host or
-contain any illegal content. Also be aware that network infrastructure
-maintainers are not liable for the type of content that passes over their
-equipment, in accordance with <a
-href="https://www.law.cornell.edu/uscode/text/17/512">DMCA
-"safe harbor" provisions</a>. In other words, you will have just as much luck
-sending a takedown notice to the Internet backbone providers.
-</p>
--->
-
-<p>To decentralise and enable privacy for a broad range of services, this
-Exit Gateway adopts an <a href="https://nymtech.net/.wellknown/network-requester/exit-policy.txt">Exit Policy</a>
-in accordance with the <a href="https://tornull.org/">Tor Null ‘deny’ list</a>
-and the <a href="https://tornull.org/tor-reduced-reduced-exit-policy.php">Tor reduced policy</a>,
-which are two established safeguards.
-</p>
-
-<p>
-That being said, if you still have a complaint about the router, you may email the
- <a href="mailto:>FIXME>">maintainer</a>. If complaints are related
- to a particular service that is being abused, the maintainer will submit that to the
- NYM Operators Community in order to add it to the Exit Policy cited above.
-If approved, that would prevent this router from allowing that traffic to exit through it.
-That can be done only on an IP+destination port basis, however. Common P2P ports are already blocked.</p>
-
-<p>
-You also have the option of blocking this IP address and others on the Nym network if you so desire.
- The Nym project provides a <a href="https://explorer.nymtech.net/network-components/gateways">
- web service</a> to fetch a list of all IP addresses of Nym Gateway Exit nodes that allow exiting to a
-specified IP:port combination. Please be considerate when using these options.</p>
-
-</main>
-</body>
-</html>
-```
-***
-### Reverse proxy
-You may set up a [reverse proxy](https://www.nginx.com/resources/glossary/reverse-proxy-server/) in order to serve this landing page with proper SSL and DNS management, i.e. to resolve it to https://nym-exit.<YOUR_DOMAIN> or https://nym-readme.<YOUR_DOMAIN>.
-
-The following assumes that you're owning a domain and that you've already set the Let's Encrypt certificates on your hosting, and you've copied those on your Gateway, i.e. copy the two Let's Encript pem files on your Gateway's home folder.
-Else you may obtain a Let's Encrypt certificate using a -[-certonly procedure](https://eff-certbot.readthedocs.io/en/latest/using.html#getting-certificates-and-choosing-plugins).
-
-```
-sudo apt install nginx
-```
-If you're running your Gateway (you should...) exposing only the needed ports as listed [here](https://nymtech.net/operators/nodes/maintenance.html?highlight=port#ports), you need to add the Nginx service to your ufw configuration:
-```
-sudo ufw app list
-sudo ufw allow 'Nginx Full'
-sudo ufw reload
-```
-Disable the default Nginx landing page
-```
-sudo systemctl status nginx
-sudo unlink /etc/nginx/sites-enabled/default
-sudo systemctl restart nginx
-```
-Add your endpoint configuration to Nginx changing <YOUR_DOMAIN> occurrencies below with your domain name, including the top-level domain, i.e. *avril4th.org*
-
-```
-sudo nano /etc/nginx/sites-available/nym-exit.<YOUR_DOMAIN>
-```
-
-```
-server {
-  listen 443 ssl http2;
-  listen [::]:443 ssl http2;
-
-  server_name nym-exit.<YOUR_DOMAIN>;
-
-  ssl_certificate <PATH_TO>/fullchain.pem;
-  ssl_certificate_key <PATH_TO>/privkey.pem;
-
-  access_log /var/log/nginx/access.log;
-  error_log /var/log/nginx/error.log;
-
-  location / {
-    proxy_pass http://127.0.0.1:8080;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header Host $host;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-  }
-}
-
-server {
-  listen 80;
-  listen [::]:80;
-
-  if ($host = nym-exit.<YOUR_DOMAIN>) {
-    return 301 https://$host$request_uri;
-  }
-
-  server_name <YOUR_DOMAIN> www.<YOUR_DOMAIN>;
-
-  return 301 https://<YOUR_DOMAIN>$request_uri;
-}
-```
-
-```
-sudo ln -s /etc/nginx/sites-available/nym-exit.<YOUR_DOMAIN> /etc/nginx/sites-enabled/
-sudo nginx -t
-sudo systemctl restart nginx
-```
-
-When done with the customization needs as described below, you'll need to upload the file and reference it as the `landing_page_assets_path` on the `[http]` section of the config.toml file that you'll find in the `~/.nym/gateways/<YOUR_GATEWAY_ID>/config/config.toml` file
-```
-nano ${HOME}/.nym/gateways/<YOUR_GATEWAY_ID>/config/config.toml
-```
-change
-```
-landing_page_assets_path = '<PATH_TO_YOUR_CUSTOM_FILE>'
-```
-
-If you're running the Gateway as a service as described [here](https://nymtech.net/operators/nodes/maintenance.html#systemd) and [here](https://nymtech.net/operators/nodes/maintenance.html#following-steps-for-nym-nodes-running-as-systemd-service) you may just restart your service
-```
-service nym-gateway stop
-service nym-gateway start
-```
-and check for the page being served either checking the service logs
-```
-sudo journalctl -u  nym-gateway.service | grep 8080
-```
-where you should read out
-```
-... Started NymNodeHTTPServer on 0.0.0.0:8080
-```
-or just point your browser to the URI which you set above, such as https://nym-exit.<YOUR_DOMAIN>
+Visit [Reversed Proxy: Avril 14th Exit Gateways Guide](../nodes/proxy-configuration.md#reversed-proxy-avril-14th-exit-gateways-guide) and follow the guide to setup your landing page.

documentation/operators/src/nodes/bonding.md

@@ -0,0 +1,59 @@
+# Bonding Nym Node
+
+```admonish caution
+If you unbond your Nym Node that means you are leaving the mixnet and you will lose all your delegations (permanently). You can join again with the same identity key, however, you will start with **no delegations**.
+```
+
+Nym Mixnet operators are rewarded for their work every epoch (60 minutes). To prevent centralisation, [Nym API](nym-api.md) is ran by distributed validators on Nyx blockchain.
+
+You are asked to `sign` a transaction and bpnd your node to Nyx blockchain so that the Mixnet smart contract is able to map your nym address to your node. This allows us to create a nonce for each account and defend against replay attacks.
+
+**Before you bond your `nym-node` make sure you went through all the previous steps**
+
+1. [Build](../binaries/building-nym.md) or [download](../binaries/pre-built-binaries.md) `nym-node` binary
+2. [Configure VPS](vps-setup.md) correctly
+3. [Prepare Nym wallet](wallet-preparation.md)
+4. [Setup & Run](setup.md) the node
+5. [Configure](configuration.md) the node (Optionally setup automation, WSS, reversed proxy)
+
+```admonish warning
+Do not bond your node to the API if the previous steps weren't finished. Bad connectivity, closed ports, or other poor setup will result in your node getting blacklisted.
+```
+
+## Bond via the Desktop wallet (recommended)
+
+You can bond your `nym-node` via the Desktop wallet.
+
+1. Open your wallet, and head to the `Bond` page, then select the node type `Mixnode` and input your node details. Press `Next`.
+  - To find out your `nym-node` details, run `./nym-node bonding-information --id <ID>`
+  - To get a correct host address, run `echo "$(curl -4 https://ifconfig.me)"`
+
+
+2. Enter the `Amount`, `Operating cost` and `Profit margin` and press `Next`.
+
+3. You will be asked to run a `sign` command with your `nym-node` - copy and paste the long signature as the value of `--contract-msg` and run it.
+
+```
+./nym-node sign --contract-msg <PAYLOAD_GENERATED_BY_THE_WALLET>
+```
+
+4. Copy the resulting signature string and paste it into the wallet nodal, press `Next` and confirm the transaction:
+
+```sh
+# This is just an example, copy the one from your process
+>>> The base58-encoded signature is:
+2bbDJSmSo9r9qdamTNygY297nQTVRyQaxXURuomVcRd7EvG9oEC8uW8fvZZYnDeeC9iWyG9mAbX2K8rWEAxZBro1
+```
+
+![Paste Signature](../images/wallet-screenshots/wallet-sign.png)
+*This image is just an example, copy-paste your own base58-encoded signature*
+
+5. Your node will now be bonded and ready to recieve traffic, latest at the beginning of the next epoch (at most 1 hour)
+
+
+If everything worked, you'll see your node running on the either the [Sandbox testnet network explorer](https://sandbox-explorer.nymtech.net) or the [mainnet network explorer](https://explorer.nymtech.net), depending on which network you're running.
+
+
+## Bond via the CLI (power users)
+
+If you want to bond your Mix Node via the CLI, then check out the [relevant section in the Nym CLI](https://nymtech.net/docs/tools/nym-cli.html#bond-a-mix-node) docs.

documentation/operators/src/nodes/configuration.md

@@ -0,0 +1,406 @@
+# Nym Node Configuration
+
+## Basic Changes
+
+Nym Node can be configured directly by editing the config file (`config.toml`) located at `~/.nym/nym-nodes/<ID>/config/config.toml` (by default `~/.nym/nym-nodes/default-nym-node/config/config.toml`) or through commands on the binary.
+
+### Commands & Examples
+
+Disable sharing of system hardware info with the network:
+
+```sh
+./nym-node run --id <ID> --deny-init --mode entry-gateway -w --expose-system-hardware false --expose-system-info false
+```
+
+Note: `--expose-system-info false` supersedes `--expose-system-hardware false`. If both are present with conflicting values, the system hardware will not be shown.
+
+
+## VPS Setup and Automation
+
+> Replace `<NODE>` variable with type of node you run, preferably `nym-node` (depreciated `nym-mixnode`, `nym-gateway` or `nym-network-requester`).
+
+### Automating your node with nohup, tmux and systemd
+
+Although it’s not totally necessary, it's useful to have the Mix Node automatically start at system boot time. We recommend to run your remote operation via [`tmux`](maintenance.md#tmux) for easier management and a handy return to your previous session. For full automation, including a failed node auto-restart and `ulimit` setup, [`systemd`](maintenance.md#systemd) is a good choice.
+
+> Do any of these steps and run your automated node before you start bonding process!
+
+#### nohup
+
+`nohup` is a command with which your terminal is told to ignore the `HUP` or 'hangup' signal. This will stop the node process ending if you kill your session.
+
+```sh
+nohup ./<NODE> run <OTHER_FLAGS> # use all the flags you use to run your node
+```
+
+#### tmux
+
+One way is to use `tmux` shell on top of your current VPS terminal. Tmux is a terminal multiplexer, it allows you to create several terminal windows and panes from a single terminal. Processes started in `tmux` keep running after closing the terminal as long as the given `tmux` window was not terminated.
+
+Use the following command to get `tmux`.
+
+| Platform | Install Command |
+| :---      | :---             |
+| Arch Linux|`pacman -S tmux`             |
+| Debian or Ubuntu|`apt install tmux`      |
+| Fedora|`dnf install tmux`                 |
+| RHEL or CentOS|`yum install tmux`          |
+|  macOS (using Homebrew | `brew install tmux`    |
+| macOS (using MacPorts) | `port install tmux`    |
+|               openSUSE | `zypper install tmux`  |
+
+In case it didn't work for your distribution, see how to build `tmux` from [version control](https://github.com/tmux/tmux#from-version-control).
+
+**Running tmux**
+
+Now you have installed tmux on your VPS, let's run a Mix Node on tmux, which allows you to detach your terminal and let your `<NODE>` run on its own on the VPS.
+
+* Pause your `<NODE>`
+* Start tmux with the command
+```sh
+tmux
+```
+* The tmux terminal should open in the same working directory, just the layout changed into tmux default layout.
+* Start the `<NODE>` again with a command:
+```sh
+./<NODE> run <OTHER_FLAGS> # use all the flags you use to run your node
+```
+* Now, without closing the tmux window, you can close the whole terminal and the `<NODE>` (and any other process running in tmux) will stay active.
+* Next time just start your teminal, ssh into the VPS and run the following command to attach back to your previous session:
+```sh
+tmux attach-session
+```
+* To see keybinding options of tmux press `ctrl`+`b` and after 1 second `?`
+
+#### systemd
+
+To automate with `systemd` use this init service file by saving it as `/etc/systemd/system/nym-node.service` and follow the [next steps](#following-steps-for-nym-nodes-running-as-systemd-service).
+
+1. Open the service file in a text editor
+```sh
+nano /etc/systemd/system/nym-node.service
+```
+
+2. Paste this config file
+```ini
+[Unit]
+Description=Nym Node
+StartLimitInterval=350
+StartLimitBurst=10
+
+[Service]
+User=<USER>
+LimitNOFILE=65536
+ExecStart=/home/<USER>/<PATH>/nym-node run # add all the flags you use to run your node
+KillSignal=SIGINT
+Restart=on-failure
+RestartSec=30
+
+[Install]
+WantedBy=multi-user.target
+```
+
+3. Save the file
+
+```admonish note
+Make sure your `ExecStart <FULL_PATH>` and `run` command are correct!
+
+Example: If you have built nym in the `$HOME` directory on your server, your username is `jetpanther`, and node `<ID>` is `puma`, then the `ExecStart` line (command) in the script located in `/etc/systemd/system/nym-mixnode.service` for Nym Mixnode might look like this:
+`ExecStart=/home/jetpanther/nym/target/release/nym-node run --id puma`.
+
+Basically, you want the full `/<PATH>/<TO>/nym-mixnode run --id <WHATEVER-YOUR-NODE-ID-IS>`. If you are unsure about your `/<PATH>/<TO>/<NODE>`, then `cd` to your directory where you run your `<NODE>` from and run `pwd` command which returns the full path for you.
+```
+
+
+#### Following steps for Nym nodes running as `systemd` service
+
+Once your init file is save follow these steps:
+
+1. Reload systemctl to pickup the new unit file
+```sh
+systemctl daemon-reload
+```
+
+2. Enable the newly created service:
+
+```sh
+systemctl enable nym-node.service
+```
+
+3. Start your `<NODE>` as a `systemd` service:
+
+```sh
+service nym-node start
+```
+
+This will cause your `<NODE>` to start at system boot time. If you restart your machine, your `<NODE>` will come back up automatically.
+
+**Useful systemd commands**
+
+- You can monitor system logs of your node by running:
+```sh
+journalctl -u nym-node -f
+```
+
+- Or check a status by running:
+```sh
+systemctl status <NODE>.service
+# for example systemctl status nym-node.service
+```
+
+- You can also do `service <NODE> stop` or `service <NODE> restart`.
+
+**Note:** if you make any changes to your `systemd` script after you've enabled it, you will need to run:
+
+```sh
+systemctl daemon-reload
+```
+
+This lets your operating system know it's ok to reload the service configuration. Then restart your `<NODE>`.
+
+
+## Connectivity Test and Configuration
+
+During our ongoing testing events [Fast and Furious](https://nymtech.net/events/fast-and-furious) we found out, that after introducing IP Packet Router (IPR) and [Nym exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) on embedded Network Requester (NR) by default,  only a fragment of Gateways routes correctly through IPv4 and IPv6. We built a useful monitor to check out your Gateway (`nym-node --mode exit-gateway`) at [harbourmaster.nymtech.net](https://harbourmaster.nymtech.net/).
+
+IPv6 routing is not only a case for gateways. Imagine a rare occassion when you run a `mixnode` without IPv6 enabled and a client will sent IPv6 packets through the Mixnet through such route:
+```ascii
+[client] -> [entry-gateway] -> [mixnode layer 1] -> [your mixnode] -> [IPv6 mixnode layer3] -> [exit-gateway]
+```
+In this (unusual) case your `mixnode` will not be able to route the packets. The node will drop the packets and its performance would go down. For that reason it's befetial to have IPv6 enabled when running a `mixnode` functionality.
+
+### Quick IPv6 Check
+
+```admonish caution
+Make sure to keep your IPv4 address enabled while setting up IPv6, as the majority of routing goes through that one!
+```
+
+You can always check IPv6 address and connectivity by using some of these methods:
+
+```sh
+# locally listed IPv6 addresses
+ip -6 addr
+
+# globally reachable IPv6 addresses
+ip -6 addr show scope global
+
+# with DNS
+dig -6 TXT +short o-o.myaddr.l.google.com @ns1.google.com
+dig -t aaaa +short myip.opendns.com @resolver1.opendns.com
+
+# https check
+curl -6 https://ifconfig.co
+curl -6 https://ipv6.icanhazip.com
+
+# using telnet
+telnet -6 ipv6.telnetmyip.com
+```
+
+### IPv6 Configuration
+
+While we're working on Rust implementation to have these settings as a part of the binary build, we wrote a script to solve these connectivity requirements in the meantime we wrote a script [`network_tunnel_manager.sh`](https://gist.github.com/tommyv1987/ccf6ca00ffb3d7e13192edda61bb2a77) to support the operators to configure their servers and address all the connectivity requirements.
+
+Networking configuration across different ISPs and various operation systems does not have a generic solution. If the provided configuration setup doesn't solve your problem check out [IPv6 troubleshooting](../troubleshooting/vps-isp.md#ipv6-troubleshooting) page. Be aware that you may have to do more research and customised adjustments.
+
+#### Mode: `exit-gateway`
+
+The `nymtun0` interface is dynamically managed by the `exit-gateway` service. When the service is stopped, `nymtun0` disappears, and when started, `nymtun0` is recreated.
+
+The script should be used in a context where `nym-node --mode exit-gateway` is running to fully utilise its capabilities, particularly for fetching IPv6 addresses or applying network rules that depend on the `nymtun0` interface.
+
+1. Download `network_tunnel_manager.sh`, make executable and run:
+
+```sh
+curl -o network_tunnel_manager.sh -L https://gist.githubusercontent.com/tommyv1987/ccf6ca00ffb3d7e13192edda61bb2a77/raw/9d785d6ee3aa2970553633eccbd89a827f49fab5/network_tunnel_manager.sh && chmod +x network_tunnel_manager.sh && ./network_tunnel_manager.sh
+```
+
+Here is a quick command explanation, for more details on the `network_tunnel_manager.sh` script, refer to the [overview](https://gist.github.com/tommyv1987/ccf6ca00ffb3d7e13192edda61bb2a77) under the code block.
+
+~~~admonish example collapsible=true title="A summarized usage of `network_tunnel_manager.sh`"
+```sh
+summary:
+This is a comprehensive script for configuring network packet forwarding and iptables rules,
+aimed at ensuring smooth operation of a tunnel interface.
+It includes functionality for both setup and tear-down of nymtun network configurations,
+alongside diagnostics for verifying system settings and network connectivity.
+
+* fetch_ipv6_address_nym_tun - Fetches the IPv6 address assigned to the 'nymtun0'.
+* fetch_and_display_ipv6 - Displays the IPv6 address on the default network device.
+* apply_iptables_rules - Applies necessary IPv4 and IPv6 iptables rules.
+* remove_iptables_rules - Removes applied IPv4 and IPv6 iptables rules.
+* check_ipv6_ipv4_forwarding - Checks if IPv4 and IPv6 forwarding are enabled.
+* check_nymtun_iptables - Check nymtun0 device
+* perform_ipv4_ipv6_pings - Perform ipv4 and ipv6 pings to google
+* check_ip6_ipv4_routing - Check ipv6 and ipv4 routing
+* joke_through_the_mixnet - Run a joke through the mixnet via ipv4 and ipv6
+
+```
+~~~
+
+  - To run the script next time, just enter `./network_tunnel_manager <ARG>`
+
+2. Make sure your `nym-node --mode exit-gateway` service is up running
+
+3. Check Nymtun IP tables:
+```sh
+sudo ./network_tunnel_manager.sh check_nymtun_iptables
+```
+
+~~~admonish example collapsible=true title="Correct `./network_tunnel_manager.sh check_nymtun_iptables` output:"
+```sh
+
+iptables-persistent is already installed.
+network Device: eth0
+---------------------------------------
+
+inspecting IPv4 firewall rules...
+Chain FORWARD (policy DROP 0 packets, 0 bytes)
+    0     0 ufw-reject-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0
+    0     0 ACCEPT     all  --  nymtun0 eth0    0.0.0.0/0            0.0.0.0/0
+    0     0 ACCEPT     all  --  eth0   nymtun0  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
+    0     0 ACCEPT     all  --  nymtun0 eth0    0.0.0.0/0            0.0.0.0/0
+    0     0 ACCEPT     all  --  eth0   nymtun0  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
+    0     0 ACCEPT     all  --  nymtun0 eth0    0.0.0.0/0            0.0.0.0/0
+    0     0 ACCEPT     all  --  eth0   nymtun0  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
+---------------------------------------
+
+inspecting IPv6 firewall rules...
+Chain FORWARD (policy DROP 0 packets, 0 bytes)
+    0     0 ufw6-reject-forward  all      *      *       ::/0                 ::/0
+    0     0 ACCEPT     all      eth0   nymtun0  ::/0                 ::/0                 state RELATED,ESTABLISHED
+    0     0 ACCEPT     all      nymtun0 eth0    ::/0                 ::/0
+    0     0 ACCEPT     all      eth0   nymtun0  ::/0                 ::/0                 state RELATED,ESTABLISHED
+    0     0 ACCEPT     all      nymtun0 eth0    ::/0                 ::/0
+    0     0 ACCEPT     all      eth0   nymtun0  ::/0                 ::/0                 state RELATED,ESTABLISHED
+    0     0 ACCEPT     all      nymtun0 eth0    ::/0                 ::/0
+operation check_nymtun_iptables completed successfully.
+```
+~~~
+
+ - If there's no process running it wouldn't return anything.
+ - In case you see `nymtun0` but not active, this is probably because you are setting up a new (never bonded) node and not upgrading an exisitng one. In that case you need to [bond](bonding.md) your node now.
+
+4. Display IPv6:
+```sh
+sudo ./network_tunnel_manager.sh fetch_and_display_ipv6
+```
+ - if you have a `global ipv6` address this is good
+
+~~~admonish example collapsible=true title="Correct `./network_tunnel_manager.sh fetch_and_display_ipv6` output:"
+```sh
+iptables-persistent is already installed.
+Using IPv6 address: 2001:db8:a160::1/112 #the address will be different for you
+operation fetch_ipv6_address_nym_tun completed successfully.
+```
+~~~
+
+5. Apply the rules:
+```sh
+sudo ./network_tunnel_manager.sh apply_iptables_rules
+```
+
+  - The process may prompt you if you want to save current IPv4 and IPv6 rules, choose yes.
+
+![](../images/ip_table_prompt.png)
+
+   - check IPv6 again like in point 3
+
+6. At this point your node needs to be [bonded](bonding.md) to the API for `nymtun0` to interact with the network. After bonding please follow up with the remaining streps below to ensure that your Exit Gateway is routing properly.
+
+7. Check `nymtun0` interface:
+```sh
+ip addr show nymtun0
+```
+~~~admonish example collapsible=true title="Correct `ip addr show nymtun0` output:"
+```sh
+# your addresses will be different
+8: nymtun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1420 qdisc fq_codel state UNKNOWN group default qlen 500
+    link/none
+    inet 10.0.0.1/16 scope global nymtun0
+       valid_lft forever preferred_lft forever
+    inet6 2001:db8:a160::1/112 scope global
+       valid_lft forever preferred_lft forever
+    inet6 fe80::ad08:d167:5700:8c7c/64 scope link stable-privacy
+       valid_lft forever preferred_lft forever`
+```
+~~~
+
+8. Validate your IPv6 and IPv4 networking by running a joke via Mixnet:
+```sh
+sudo ./network_tunnel_manager.sh joke_through_the_mixnet
+```
+
+Make sure that you get the validation of IPv4 and IPv6 connectivity. If there are still any problems, please refer to [troubleshooting section](../troubleshooting/vps-isp.md#incorrect-gateway-network-check).
+
+#### Mode: `mixnode`
+
+```admonish caution title=""
+Most of the time the packets sent through the Mixnet are IPv4 based. The IPv6 packets are still pretty rare and therefore it's not mandatory from operational point of view. If you preparing to run a `nym-node` with all modes enabled once this option is implemented, then the IPv6 setup on your VPS is required.
+```
+
+1. Download `network_tunnel_manager.sh`, make executable and run:
+
+```sh
+curl -o network_tunnel_manager.sh -L https://gist.githubusercontent.com/tommyv1987/ccf6ca00ffb3d7e13192edda61bb2a77/raw/9d785d6ee3aa2970553633eccbd89a827f49fab5/network_tunnel_manager.sh && chmod +x network_tunnel_manager.sh && ./network_tunnel_manager.sh
+```
+
+Here is a quick command explanation, for more details on the `network_tunnel_manager.sh` script, refer to the [overview](https://gist.github.com/tommyv1987/ccf6ca00ffb3d7e13192edda61bb2a77) under the code block. Mind that for `mixnode` VPS setup we will use only a few of the commands.
+
+~~~admonish example collapsible=true title="A summarized usage of `network_tunnel_manager.sh`"
+```sh
+summary:
+This is a comprehensive script for configuring network packet forwarding and iptables rules,
+aimed at ensuring smooth operation of a tunnel interface.
+It includes functionality for both setup and tear-down of nymtun network configurations,
+alongside diagnostics for verifying system settings and network connectivity.
+
+* fetch_ipv6_address_nym_tun - Fetches the IPv6 address assigned to the 'nymtun0'.
+* fetch_and_display_ipv6 - Displays the IPv6 address on the default network device.
+* apply_iptables_rules - Applies necessary IPv4 and IPv6 iptables rules.
+* remove_iptables_rules - Removes applied IPv4 and IPv6 iptables rules.
+* check_ipv6_ipv4_forwarding - Checks if IPv4 and IPv6 forwarding are enabled.
+* check_nymtun_iptables - Check nymtun0 device
+* perform_ipv4_ipv6_pings - Perform ipv4 and ipv6 pings to google
+* check_ip6_ipv4_routing - Check ipv6 and ipv4 routing
+* joke_through_the_mixnet - Run a joke through the mixnet via ipv4 and ipv6
+
+```
+~~~
+
+  - To run the script next time, just enter `./network_tunnel_manager <ARG>`
+
+2. Display IPv6:
+```sh
+sudo ./network_tunnel_manager.sh fetch_and_display_ipv6
+```
+ - if you have a `global ipv6` address this is good
+
+~~~admonish example collapsible=true title="Correct `./network_tunnel_manager.sh fetch_and_display_ipv6` output:"
+```sh
+iptables-persistent is already installed.
+Using IPv6 address: 2001:db8:a160::1/112 #the address will be different for you
+operation fetch_ipv6_address_nym_tun completed successfully.
+```
+~~~
+
+3. Apply the rules:
+```sh
+sudo ./network_tunnel_manager.sh apply_iptables_rules
+```
+
+  - The process may prompt you if you want to save current IPv4 and IPv6 rules, choose yes.
+
+![](../images/ip_table_prompt.png)
+
+   - check IPv6 again like in point 2
+
+4. Check connectivity
+```sh
+telnet -6 ipv6.telnetmyip.com
+```
+
+Make sure that you get the validation of IPv4 and IPv6 connectivity. If there are still any problems, please refer to [troubleshooting section](../troubleshooting/vps-isp.md#incorrect-gateway-network-check).
+
+## Next Steps
+
+There are a few more good suggestions for `nym-node` VPS configuration, especially to be considered for `exit-gateway` functionality, like Web Secure Socket or Reversed Proxy setup. Visit [Proxy configuration](proxy-configuration.md) page to see the guides.

documentation/operators/src/nodes/maintenance.md

@@ -14,122 +14,6 @@ For example `./target/debug/nym-network-requester --no-banner build-info --outpu
 {"binary_name":"nym-network-requester","build_timestamp":"2023-07-24T15:38:37.00657Z","build_version":"1.1.23","commit_sha":"c70149400206dce24cf20babb1e64f22202672dd","commit_timestamp":"2023-07-24T14:45:45Z","commit_branch":"feature/simplify-cli-parsing","rustc_version":"1.71.0","rustc_channel":"stable","cargo_profile":"debug"}
 ```
 
-
-## Run Web Secure Socket (WSS) on Gateway
-
-Now you can run WSS on your Gateway.
-
-### WSS on a new Gateway
-
-These steps are for an operator who is setting up a [Gateway](gateway-setup.md) for the first time and wants to run it with WSS.
-
-1. New flags will need to be added to the `init` and `run` command. The `--host` option should be replaced with these flags:
-
-- `--listening-address`: The IP address which is used for receiving sphinx packets and listening to client data.
-- `--public-ips`: A comma separated list of IP’s that are announced to the `nym-api`. In the most cases `--public-ips` **is the address used for bonding.**
-
-```sh
---listening-address 0.0.0.0 --public-ips "$(curl -4 https://ifconfig.me)"
-```
-
-- `--hostname` (optional): This flag is required if the operator wishes to run WSS. It can be something like `mainnet-gateway2.nymtech.net`.
-
-2. Make sure to enable all necessary [ports](maintenance.md#configure-your-firewall) on the Gateway:
-
-```sh
-sudo ufw allow 1789,1790,8000,9000,9001,22/tcp, 9001/tcp
-```
-
-The Gateway will then be accessible on something like: *http://85.159.211.99:8080/api/v1/swagger/index.html*
-
-Are you seeing something like: *this node attempted to announce an invalid public address: 0.0.0.0.*?
-
-Please modify `[host.public_ips]` section of your config file stored as `~/.nym/gateways/<ID>/config/config.toml`.
-
-### WSS on an existing Gateway
-
-In case you already run a working Gateway and want to add WSS on it, here are the pre-requisites to running WSS on Gateways:
-
-* You need to use the latest `nym-gateway` binary [version](./gateway-setup.md#current-version) and restart it.
-* That will add the relevant fields to update your config.
-* These two values will be added and need to be amended in your config.toml:
-
-```sh
-clients_wss_port = 0
-hostname = ""
-```
-
-Then you can run this:
-
-```sh
-port=$1 // in the example below we will use 9001
-host=$2 = // this would be a domain name registered for your Gateway for example: mainnet-gateway2.nymtech.net
-
-
-sed -i "s/clients_wss_port = 0/clients_wss_port = ${port}/" ${HOME}/.nym/gateways/*/config/config.toml
-sed -i "s|hostname = ''|hostname = '${host}'|" ${HOME}/.nym/gateways/*/config/config.toml
-```
-The following shell script can be run:
-
-```sh
-#!/bin/bash
-
-if [ "$#" -ne 2 ]; then
-    echo "Usage: sudo ./install_run_caddy.sh <host_name> <port_to_run_wss>"
-    exit 1
-fi
-
-host=$1
-port_value=$2
-
-apt install -y debian-keyring debian-archive-keyring apt-transport-https
-apt --fix-broken install
-
-curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
-
-curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
-
-apt update
-apt install caddy
-
-systemctl enable caddy.service
-
-cd /etc/caddy
-
-# check if Caddyfile exists, if it does, remove and insert a new one
-if [ -f Caddyfile ]; then
-    echo "removing caddyfile inserting a new one"
-    rm -f Caddyfile
-fi
-
-cat  <<EOF >> Caddyfile
-${host}:${port_value} {
-	@websockets {
-		header Connection *Upgrade*
-		header Upgrade websocket
-	}
-	reverse_proxy @websockets localhost:9000
-}
-EOF
-
-cat Caddyfile
-
-echo "script completed successfully!"
-
-systemctl restart caddy.service
-echo "have a nice day!"
-exit 0
-
-```
-
-Although your Gateway is Now ready to use its `wss_port`, your server may not be ready - the following commands will allow you to set up a properly configured firewall using `ufw`:
-
-```sh
-ufw allow 9001/tcp
-```
-
-Lastly don't forget to restart your Gateway, now the API will render the WSS details for this Gateway:
-
 ## Configure your firewall
 
 Although your `<NODE>` is now ready to receive traffic, your server may not be. The following commands will allow you to set up a firewall using `ufw`.
@@ -151,7 +35,7 @@ sudo ufw status
 Finally open your `<NODE>` p2p port, as well as ports for ssh and ports for verloc and measurement pings:
 
 ```sh
-# for Mix Node, Gateway and Network Requester
+# for nym-node
 sudo ufw allow 1789,1790,8000,9000,9001,22/tcp
 
 # in case of setting up WSS on Gateway add:
@@ -173,11 +57,11 @@ For more information about your node's port configuration, check the [port refer
 
 ## VPS Setup and Automation
 
-> Replace `<NODE>` variable with `nym-mixnode`, `nym-gateway` or `nym-network-requester` according the node you running on your machine.
+> Replace `<NODE>` variable with type of node you run, preferably `nym-node` (depreciated `nym-mixnode`, `nym-gateway` or `nym-network-requester`).
 
 ### Automating your node with nohup, tmux and systemd
 
-Although it’s not totally necessary, it's useful to have the Mix Node automatically start at system boot time. We recommend to run your remote operation via [`tmux`](maintenance.md#tmux) for easier management and a handy return to your previous session. For full automation, including a failed node auto-restart and `ulimit` setup, [`systemd`](maintenance.md#systemd) is a good choice. 
+Although it’s not totally necessary, it's useful to have the Mix Node automatically start at system boot time. We recommend to run your remote operation via [`tmux`](maintenance.md#tmux) for easier management and a handy return to your previous session. For full automation, including a failed node auto-restart and `ulimit` setup, [`systemd`](maintenance.md#systemd) is a good choice.
 
 > Do any of these steps and run your automated node before you start bonding process!
 
@@ -186,7 +70,7 @@ Although it’s not totally necessary, it's useful to have the Mix Node automati
 `nohup` is a command with which your terminal is told to ignore the `HUP` or 'hangup' signal. This will stop the node process ending if you kill your session.
 
 ```sh
-nohup ./<NODE> run --id <YOUR_ID> # where `<YOUR_ID>` is the id you set during the `init` command and <NODE> depends on which node you starting
+nohup ./<NODE> run <OTHER_FLAGS> # use all the flags you use to run your node
 ```
 
 #### tmux
@@ -195,15 +79,15 @@ One way is to use `tmux` shell on top of your current VPS terminal. Tmux is a te
 
 Use the following command to get `tmux`.
 
-Platform|Install Command
----|---
-Arch Linux|`pacman -S tmux`
-Debian or Ubuntu|`apt install tmux`
-Fedora|`dnf install tmux`
-RHEL or CentOS|`yum install tmux`
-macOS (using Homebrew|`brew install tmux`
-macOS (using MacPorts)|`port install tmux`
-openSUSE|`zypper install tmux`
+| Platform | Install Command |
+| :---      | :---             |
+| Arch Linux|`pacman -S tmux`             |
+| Debian or Ubuntu|`apt install tmux`      |
+| Fedora|`dnf install tmux`                 |
+| RHEL or CentOS|`yum install tmux`          |
+|  macOS (using Homebrew | `brew install tmux`    |
+| macOS (using MacPorts) | `port install tmux`    |
+|               openSUSE | `zypper install tmux`  |
 
 In case it didn't work for your distribution, see how to build `tmux` from [version control](https://github.com/tmux/tmux#from-version-control).
 
@@ -219,7 +103,7 @@ tmux
 * The tmux terminal should open in the same working directory, just the layout changed into tmux default layout.
 * Start the `<NODE>` again with a command:
 ```sh
-./<NODE> run --id <YOUR_ID>
+./<NODE> run <OTHER_FLAGS> # use all the flags you use to run your node
 ```
 * Now, without closing the tmux window, you can close the whole terminal and the `<NODE>` (and any other process running in tmux) will stay active.
 * Next time just start your teminal, ssh into the VPS and run the following command to attach back to your previous session:
@@ -230,77 +114,18 @@ tmux attach-session
 
 #### systemd
 
-To automate with `systemd` use this init service file and follow the steps below.
-
-##### For Mix Node
-
-```ini
-[Unit]
-Description=Nym Mixnode <VERSION>
-StartLimitInterval=350
-StartLimitBurst=10
-
-[Service]
-User=<USER>
-LimitNOFILE=65536
-ExecStart=/home/<USER>/<PATH>/nym-mixnode run --id <YOUR_ID>
-KillSignal=SIGINT
-Restart=on-failure
-RestartSec=30
-
-[Install]
-WantedBy=multi-user.target
-```
-
-* Put the above file onto your system at `/etc/systemd/system/nym-mixnode.service` and follow the [next steps](maintenance.md#following-steps-for-nym-nodes-running-as-systemd-service).
-
-##### For Gateway
-
-```ini
-[Unit]
-Description=Nym Gateway <VERSION>
-StartLimitInterval=350
-StartLimitBurst=10
-
-[Service]
-User=nym
-LimitNOFILE=65536
-ExecStart=/home/<USER>/<PATH>/nym-gateway run --id <YOUR_ID>
-KillSignal=SIGINT
-Restart=on-failure
-RestartSec=30
-
-[Install]
-WantedBy=multi-user.target
-```
-
-* Put the above file onto your system at `/etc/systemd/system/nym-gateway.service` and follow the [next steps](maintenance.md#following-steps-for-nym-nodes-running-as-systemd-service).
-
-##### For Network Requester
-
-```ini
-[Unit]
-Description=Nym Network Requester <VERSION>
-StartLimitInterval=350
-StartLimitBurst=10
-
-[Service]
-User=nym # replace this with whatever user you wish
-LimitNOFILE=65536
-# remember to add the `--enable-statistics` flag if running as part of a service grant and check the path to your nym-network-requester binary
-ExecStart=/home/nym/nym-network-requester run --id <YOUR_ID>
-KillSignal=SIGINT
-Restart=on-failure
-RestartSec=30
-
-[Install]
-WantedBy=multi-user.target
-```
-* Put the above file onto your system at `/etc/systemd/system/nym-network-requester.service` and follow the [next steps](maintenance.md#following-steps-for-nym-nodes-running-as-systemd-service).
-
 ##### For Nymvisor
 > Since you're running your node via a Nymvisor instance, as well as creating a Nymvisor `.service` file, you will also want to **stop any previous node automation process you already have running**.
 
+To automate with `systemd` use this init service file by saving it as `/etc/systemd/system/nymvisor.service` and follow the [next steps](#following-steps-for-nym-nodes-running-as-systemd-service).
+
+1. Open text editor
+```sh
+nano /etc/systemd/system/nymvisor.service
+```
+
+2. Paste this file
+
 ```
 [Unit]
 Description=Nymvisor <VERSION>
@@ -308,9 +133,9 @@ StartLimitInterval=350
 StartLimitBurst=10
 
 [Service]
-User=nym # replace this with whatever user you wish
+User=<USER> # replace this with whatever user you wish
 LimitNOFILE=65536
-ExecStart=/home/<USER>/<PATH>/nymvisor run run --id <NODE_ID>
+ExecStart=/home/<USER>/<PATH>/nymvisor run --id <ID>
 KillSignal=SIGINT
 Restart=on-failure
 RestartSec=30
@@ -319,74 +144,57 @@ RestartSec=30
 WantedBy=multi-user.target
 ```
 
-* Put the above file onto your system at `/etc/systemd/system/nymvisor.service` and follow the [next steps](maintenance.md#following-steps-for-nym-nodes-running-as-systemd-service).
+3. Save the file
+
+```admonish note
+Make sure your `ExecStart <FULL_PATH>` and `run` command are correct!
+
+Example: If you have built nym in the `$HOME` directory on your server, your username is `jetpanther`, and node `<ID>` is `puma`, then the `ExecStart` line (command) in the script located in `/etc/systemd/system/nym-mixnode.service` for Nym Mixnode might look like this:
+`ExecStart=/home/jetpanther/nym/target/release/nym-node run --id puma`.
+
+Basically, you want the full `/<PATH>/<TO>/nym-mixnode run --id <WHATEVER-YOUR-NODE-ID-IS>`. If you are unsure about your `/<PATH>/<TO>/<NODE>`, then `cd` to your directory where you run your `<NODE>` from and run `pwd` command which returns the full path for you.
+```
+
 
 #### Following steps for Nym nodes running as `systemd` service
 
-Change the `<PATH>` in `ExecStart` to point at your `<NODE>` binary (`nym-mixnode`, `nym-gateway` or `nym-network-requester`), and the `<USER>` so it is the user you are running as.
-
-Example: If you have built nym in the `$HOME` directory on your server, your username is `jetpanther`, and node `<ID>` is `puma`, then the `ExecStart` line (command) in the script located in `/etc/systemd/system/nym-mixnode.service` for Nym Mixnode might look like this:
-
-`ExecStart=/home/jetpanther/nym/target/release/nym-mixnode run --id puma`.
-
-Basically, you want the full `/<PATH>/<TO>/nym-mixnode run --id <WHATEVER-YOUR-NODE-ID-IS>`. If you are unsure about your `/<PATH>/<TO>/<NODE>`, then `cd` to your directory where you run your `<NODE>` from and run `pwd` command which returns the full path for you.
-
-Once done, save the script and follow these steps:
+Once your init file is save follow these steps:
 
+1. Reload systemctl to pickup the new unit file
 ```sh
 systemctl daemon-reload
-# to pickup the new unit file
 ```
 
-Enable the newly created service:
+2. Enable the newly created service:
 
 ```sh
-# for Mix Node
-systemctl enable nym-mixnode.service
-
-# for Gateway
-systemctl enable nym-gateway.service
-
-# for Network Requester
-systemctl enable nym-network-requester.service
-
-# for Nymvisor
-systemctl enable nymvisor.service
+systemctl enable nym-node.service
 ```
 
-Start your `<NODE>` as a `systemd` service:
+3. Start your `<NODE>` as a `systemd` service:
 
 ```sh
-# for Mix Node
-service nym-mixnode start
-
-# for Gateway
-service nym-gateway start
-
-# for Network Requester
-service nym-network-requester.service
-
-# for Nymvisor
-service nymvisor.service start
+service nym-node start
 ```
 
 This will cause your `<NODE>` to start at system boot time. If you restart your machine, your `<NODE>` will come back up automatically.
 
-You can monitor system logs of your node by running:
+**Useful systemd commands**
+
+- You can monitor system logs of your node by running:
 ```sh
-journalctl -f -u <NODE>.service
-# for example journalctl -f -u nym-mixnode.service
+journalctl -u <NODE> -f
 ```
 
-Or check a status by running:
+- Or check a status by running:
 ```sh
 systemctl status <NODE>.service
-# for example systemctl status nym-mixnode.service
+# for example systemctl status nym-node.service
 ```
 
-You can also do `service <NODE> stop` or `service <NODE> restart`.
+- You can also do `service <NODE> stop` or `service <NODE> restart`.
 
-Note: if you make any changes to your `systemd` script after you've enabled it, you will need to run:
+**Note:** if you make any changes to your `systemd` script after you've enabled it, you will need to run:
 
 ```sh
 systemctl daemon-reload
@@ -395,428 +203,86 @@ systemctl daemon-reload
 This lets your operating system know it's ok to reload the service configuration. Then restart your `<NODE>`.
 
 
-##### For Validator
-
-Below is a `systemd` unit file to place at `/etc/systemd/system/nymd.service` to automate your validator:
-
-```ini
-[Unit]
-Description=Nyxd
-StartLimitInterval=350
-StartLimitBurst=10
-
-[Service]
-User=<USER>                                                       # change to your user
-Type=simple
-Environment="LD_LIBRARY_PATH=/home/<USER>/<PATH_TO_NYX_BINARIES>" # change to correct path
-ExecStart=/home/<USER>/<PATH_TO_NYX_BINARIES>/nymd start          # change to correct path
-Restart=on-failure
-RestartSec=30
-LimitNOFILE=infinity
-
-[Install]
-WantedBy=multi-user.target
-```
-
-Proceed to start it with:
-
-```sh
-systemctl daemon-reload # to pickup the new unit file
-systemctl enable nymd   # to enable the service
-systemctl start nymd    # to actually start the service
-journalctl -f -u nymd # to monitor system logs showing the service start
-```
-
-##### For Nym API
-
-Below is a `systemd` unit file to place at `/etc/systemd/system/nym-api.service` to automate your API instance:
-
-```ini
-[Unit]
-Description=NymAPI
-StartLimitInterval=350
-StartLimitBurst=10
-
-[Service]
-User=<USER>                                                       # change to your user
-Type=simple
-ExecStart=/home/<USER>/<PATH_TO_BINARY>/nym-api start             # change to correct path
-Restart=on-failure
-RestartSec=30
-LimitNOFILE=infinity
-
-[Install]
-WantedBy=multi-user.target
-```
-
-Proceed to start it with:
-
-```sh
-systemctl daemon-reload  # to pickup the new unit file
-systemctl enable nym-api # to enable the service
-systemctl start nym-api  # to actually start the service
-journalctl -f -u nym-api # to monitor system logs showing the service start
-```
-
-
-### Setting the ulimit
-
-Linux machines limit how many open files a user is allowed to have. This is called a `ulimit`.
-
-`ulimit` is 1024 by default on most systems. It needs to be set higher, because Mix Nodes make and receive a lot of connections to other nodes.
-
-If you see errors such as:
-
-```sh
-Failed to accept incoming connection - Os { code: 24, kind: Other, message: "Too many open files" }
-```
-
-This means that the operating system is preventing network connections from being made.
-
-#### Set the `ulimit` via `systemd` service file
-
-> Replace `<NODE>` variable with `nym-mixnode`, `nym-gateway` or `nym-network-requester` according the node you running on your machine.
-
-The ulimit setup is relevant for maintenance of Nym Mix Node only.
-
-Query the `ulimit` of your `<NODE>` with:
-
-```sh
-# for nym-mixnode, nym-gateway and nym-network-requester:
-grep -i "open files" /proc/$(ps -A -o pid,cmd|grep <NODE> | grep -v grep |head -n 1 | awk '{print $1}')/limits
-
-# for nyx validator:
-grep -i "open files" /proc/$(ps -A -o pid,cmd|grep nymd | grep -v grep |head -n 1 | awk '{print $1}')/limits
-```
-
-
-
-You'll get back the hard and soft limits, which looks something like this:
-
-```sh
-Max open files            65536                65536                files
-```
-
-If your output is **the same as above**, your node will not encounter any `ulimit` related issues.
-
-However if either value is `1024`, you must raise the limit via the systemd service file. Add the line:
-
-```sh
-LimitNOFILE=65536
-```
-
-Reload the daemon:
-
-```sh
-systemctl daemon-reload
-```
-
-or execute this as root for system-wide setting of `ulimit`:
-
-```sh
-echo "DefaultLimitNOFILE=65535" >> /etc/systemd/system.conf
-```
-
-Reboot your machine and restart your node. When it comes back, use:
-```sh
-# for nym-mixnode, nym-gateway and nym-network-requester:
-cat /proc/$(pidof <NODE>)/limits | grep "Max open files"
-
-# for validator
-cat /proc/$(pidof nym-validator)/limits | grep "Max open files"
-```
-Make sure the limit has changed to 65535.
-
-#### Set the ulimit on `non-systemd` based distributions
-
-In case you chose tmux option for Mix Node automation, see your `ulimit` list by running:
-
-```sh
-ulimit -a
-
-# watch for the output line -n
--n: file descriptors          1024
-```
-
-You can change it either by running a command:
-
-```sh
-ulimit -u -n 4096
-```
-
-or editing `etc/security/conf` and add the following lines:
-
-```sh
-# Example hard limit for max opened files
-username        hard nofile 4096
-
-# Example soft limit for max opened files
-username        soft nofile 4096
-```
-
-Then reboot your server and restart your Mix Node.
-
 ## Moving a node
 
-In case of a need to move a node from one machine to another and avoiding to lose the delegation, here are few steps how to do it.
-
-The following examples transfers a Mix Node (in case of other nodes, change the `mixnodes` in the command for the `<NODE>` of your desire.
-
-* Pause your node process.
+In case of a need to move a Nym Node from one machine to another and avoiding to lose the delegation, here are few steps how to do it.
 
 Assuming both machines are remote VPS.
 
-* Make sure your `~/.ssh/<YOUR_KEY>.pub` is in both of the machines `~/.ssh/authorized_keys` file
-* Create a `mixnodes` folder in the target VPS. Ssh in from your terminal and run:
+* Make sure your `~/.ssh/<YOUR_KEY>.pub` is in both of the servers `~/.ssh/authorized_keys` file
+* Create a `nym-nodes` folder in the target VPS. SSH in from your terminal and run:
 
 ```sh
 # in case none of the nym configs was created previously
 mkdir ~/.nym
 
-#in case no nym Mix Node was initialized previously
-mkdir ~/.nym/mixnodes
+#in case no nym Nym Node was initialized previously
+mkdir ~/.nym/nym-nodes
 ```
-* Move the node data (keys) and config file to the new machine by opening a local terminal (as that one's ssh key is authorized in both of the machines) and running:
+* Move the node data (keys) and config file to the new machine by opening your **local terminal** (as that one's ssh key is authorized in both of the VPS) and running:
 ```sh
-scp -r -3 <SOURCE_USER_NAME>@<SOURCE_HOST_ADDRESS>:~/.nym/mixnodes/<YOUR_ID> <TARGET_USER_NAME>@<TARGET_HOST_ADDRESS>:~/.nym/mixnodes/
+scp -r -3 <SOURCE_USER_NAME>@<SOURCE_HOST_ADDRESS>:~/.nym/nym-nodes <TARGET_USER_NAME>@<TARGET_HOST_ADDRESS>:~/.nym/nym-nodes/
 ```
-* Re-run init (remember that init doesn't overwrite existing keys) to generate a config with the new listening address etc.
+
+**On new/target machine**
+
+* Edit `~/.nym/nym-nodes/<ID>/config/config.toml` config with the new listening address IP.
+* Setup the [systemd](#systemd) automation, reload the daemon and run the service, or just simply run the node if you don't use automation
 * Change the node smart contract info via the wallet interface. Otherwise the keys will point to the old IP address in the smart contract, and the node will not be able to be connected, and it will fail up-time checks.
-* Re-run the node from the new location.
 
+## Rename node local ID
 
-## Virtual IPs and hosting via Google & AWS
+Local node ID (not the identity key) is a name chosen by operators which defines where the nodes configuration data will be stored, where the ID determines the path to `~/.nym/nym-nodes/<ID>/`. This ID is never shared on the network.
 
-For true internet decentralization we encourage operators to use diverse VPS providers instead of the largest companies offering such services. If for some reasons you have already running AWS or Google and want to setup a `<NODE>` there, please read the following.
+Since migrating to [`nym-node`](nym-node.md), specifying an with `--ID <ID>` when starting a new node is no longer necessary. Nodes without a specified ID will be asigned the default ID `default-nym-node`. This streamlines node management, particularly for operators handling multiple nodes via ansible and other automation scripts, as all data is stored at `~/.nym/nym-nodes/default-nym-node`.
 
-On some services (AWS, Google, etc) the machine's available bind address is not the same as the public IP address. In this case, bind `--host` to the local machine address returned by `$(curl -4 https://ifconfig.me)`, but that may not the public IP address to bond your `<NODE>` in the wallet.
+If you already operate a `nym-node` and wish to change the local ID to `default-nym-node` or anything else, follow the steps below to do so.
 
-You can run `ifconfig` command. For example, on a Google machine, you may see the following output:
+```admonish note
+In the example we use `default-nym-node` as a target `<ID>`, if you prefer to use another name, edit the syntax in the commands accordingly.
+```
+
+1. Copy the configuration directory to the new one
+```sh
+cp -r  ~/.nym/nym-nodes/<SOURCE_ID> ~/.nym/nym-nodes/default-nym-node/
+```
+
+2. Rename all `<SOURCE_ID>` occurences in `config.toml` to `default-nym-node`
 
 ```sh
-ens4: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1460
-        inet 10.126.5.7  netmask 255.255.255.255  broadcast 0.0.0.0
-        ...
+# check occurences of the <SOURCE_ID>
+grep -r  "<SOURCE_ID>" ~/.nym/nym-nodes/default-nym-node/*
+```
+```admonish bug title="Caution!"
+If your node `<SOURCE_ID>` is too generic (like `gateway` etc) and it occurs elsewhere than just a custom value, **do not use `sed` command but rewrite the values manually using a text editor!**
 ```
-
-The `ens4` interface has the IP `10.126.5.7`. But this isn't the public IP of the machine, it's the IP of the machine on Google's internal network. Google uses virtual routing, so the public IP of this machine is something else, maybe `36.68.243.18`.
-
-To find the right IP configuration, contact your VPS provider for support to find the right public IP and use it to bond your `<NODE>` with the `nym-api` via Nym wallet.
-
-On self-hosted machine it's a bit more tricky. In that case as an operator you must be sure that your ISP allows for public IPv4 and IPv6 and then it may be a bit of playing around to find the right configuration. One way may be to bind your binary with the `--host` flag to local address `127.0.0.1` and run `echo "$(curl -4 https://ifconfig.me)"` to get a public address which you use to bond your Mix Node to `nym-api` via Nym wallet.
-
-It's up to you as a node operator to ensure that your public and private IPs match up properly.
-
-## Nym API (previously 'Validator API') endpoints
-
-Numerous API endpoints are documented on the Nym API (previously 'Validator API')'s [Swagger Documentation](https://validator.nymtech.net/api/swagger/index.html). There you can also try out various requests from your browser, and download the response from the API. Swagger will also show you what commands it is running, so that you can run these from an app or from your CLI if you prefer.
-
-### Mix Node Reward Estimation API endpoint
-
-The Reward Estimation API endpoint allows Mix Node operators to estimate the rewards they could earn for running a Nym Mix Node with a specific `MIX_ID`.
-
-> The `<MIX_ID>` can be found in the "Mix ID" column of the [Network Explorer](https://explorer.nymtech.net/network-components/mixnodes/active).
-
-The endpoint is a particularly common for Mix Node operators as it can provide an estimate of potential earnings based on factors such as the amount of traffic routed through the Mix Node, the quality of the Mix Node's performance, and the overall demand for Mix Nodes in the network. This information can be useful for Mix Node operators in deciding whether or not to run a Mix Node and in optimizing its operations for maximum profitability.
-
-Using this API endpoint returns information about the Reward Estimation:
 
 ```sh
-/status/mixnode/<MIX_ID>/reward-estimation
+# rename it by using sed command
+sed -i -e "s/<SOURCE_ID>/default-nym-node/g" ~/.nym/nym-nodes/default-nym-node/config/config.toml
+
+# or manually by opening config.toml and rewriting each occurence of <SOURCE_ID>
+nano ~/.nym/nym-nodes/default-nym-node/config/config.toml
 ```
 
-Query Response:
-
+3. Validate by rechecking the config file content
 ```sh
-    "estimation": {
-        "total_node_reward": "942035.916721770541325331",
-        "operator": "161666.263307386408152071",
-        "delegates": "780369.65341438413317326",
-        "operating_cost": "54444.444444444444444443"
-    },
+# either re-run
+grep -r  "<SOURCE_ID>" ~/.nym/nym-nodes/default-nym-node/*
+
+# or by reading the config file
+less ~/.nym/nym-nodes/default-nym-node/config/config.toml
 ```
+- Pay extra attention to the `hostname` line. In case its value was somehow correlated with the `<SOURCE_ID>` string you may need to correct it back
 
-> The unit of value is measured in `uNYM`.
+4. Reload your [systemd service daemon](#systemd) and restart the service, or if automation isn't your thing, simply reboot the node
 
-- `estimated_total_node_reward` - An estimate of the total amount of rewards that a particular Mix Node can expect to receive during the current epoch. This value is calculated by the Nym Validator based on a number of factors, including the current state of the network, the number of Mix Nodes currently active in the network, and the amount of network traffic being processed by the Mix Node.
-
-- `estimated_operator_reward` - An estimate of the amount of rewards that a particular Mix Node operator can expect to receive. This value is calculated by the Nym Validator based on a number of factors, including the amount of traffic being processed by the Mix Node, the quality of service provided by the Mix Node, and the operator's stake in the network.
-
-- `estimated_delegators_reward` - An estimate of the amount of rewards that Mix Node delegators can expect to receive individually. This value is calculated by the Nym Validator based on a number of factors, including the amount of traffic being processed by the Mix Node, the quality of service provided by the Mix Node, and the delegator's stake in the network.
-
-- `estimated_node_profit` - An estimate of the profit that a particular Mix node operator can expect to earn. This value is calculated by subtracting the Mix Node operator's `operating_costs` from their `estimated_operator_reward` for the current epoch.
-
-- `estimated_operator_cost` - An estimate of the total cost that a particular Mix Node operator can expect to incur for their participation. This value is calculated by the Nym Validator based on a number of factors, including the cost of running a Mix Node, such as server hosting fees, and other expenses associated with operating the Mix Node.
-
-### Validator: Installing and configuring nginx for HTTPS
-#### Setup
-[Nginx](https://www.nginx.com/resources/glossary/nginx) is an open source software used for operating high-performance web servers. It allows us to set up reverse proxying on our validator server to improve performance and security.
-
-Install `nginx` and allow the 'Nginx Full' rule in your firewall:
-
-```sh
-sudo ufw allow 'Nginx Full'
-```
-
-Check nginx is running via systemctl:
-
-```sh
-systemctl status nginx
-```
-
-Which should return:
-
-```sh
-● nginx.service - A high performance web server and a reverse proxy server
-   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
-   Active: active (running) since Fri 2018-04-20 16:08:19 UTC; 3 days ago
-     Docs: man:nginx(8)
- Main PID: 2369 (nginx)
-    Tasks: 2 (limit: 1153)
-   CGroup: /system.slice/nginx.service
-           ├─2369 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
-           └─2380 nginx: worker process
-```
-
-#### Full Node Configuration
-
-Proxying various full node services through port 80 can then be done by creating a file with the following at `/etc/nginx/sites-enabled/nyxd-webrequests.conf`:
-
-Setting up a reverse proxy using a webserver such as Nginx allows you to easily configure SSL certificates for the endpoints. When running on mainnet, it is recommended to encrypt all web traffic to your node.
-
-```sh
-### To expose RPC server
-server {
-  listen 80;
-  listen [::]:80;
-  server_name "<rpc.nyx.yourdomain.tld>";
-
-  location / {
-    proxy_pass http://127.0.0.1:26657;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header Host $host;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-  }
-
-  location /websocket {
-      proxy_pass http://127.0.0.1:26657;
-      proxy_http_version 1.1;
-      proxy_set_header Upgrade $http_upgrade;
-      proxy_set_header Connection "Upgrade";
-      proxy_set_header Host $host;
-    }
-}
-
-### To expose Cosmos API server
-server {
-  server_name "<api.nyx.yourdomain.tld>";
-  location / {
-    proxy_pass http://127.0.0.1:1317;
-    proxy_set_header X-Forwarded-For $remote_addr;
-    proxy_set_header Host $http_host;
-    proxy_set_header Upgrade websocket;
-    proxy_set_header Connection Upgrade;
-  }
-}
-
-### To expose GRPC endpoint
-server {
-  server_name "<grpc.nyx.yourdomain.tld>";
-  location / {
-    grpc_pass 127.0.0.1:9090;
-  }
-}
-```
-
-#### nym-api Configuration
-
-```sh
-### To expose nym-api webserver
-server {
-  listen 80;
-  listen [::]:80;
-  server_name "<nym-api.nyx.yourdomain.tld>";
-  add_header 'Access-Control-Allow-Origin' '*';
-
-  location / {
-    proxy_pass http://127.0.0.1:8000;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header Host $host;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-  }
-}
-```
-
-Followed by:
-
-```sh
-sudo apt install certbot nginx python3
-certbot --nginx -m <you@yourdomain.com> --agree-tos
-```
-
-```admonish caution title=""
-If using a VPS running Ubuntu 20: replace `certbot nginx python3` with `python3-certbot-nginx`
-```
-
-These commands will get you an https encrypted nginx proxy in front of the various endpoints.
-
-### Configuring Prometheus metrics (optional)
-
-Configure Prometheus with the following commands (adapted from NodesGuru's [Agoric setup guide](https://nodes.guru/agoric/setup-guide/en)):
-
-```sh
-echo 'export OTEL_EXPORTER_PROMETHEUS_PORT=9464' >> $HOME/.bashrc
-source ~/.bashrc
-sed -i '/\[telemetry\]/{:a;n;/enabled/s/false/true/;Ta}' $HOME/.nymd/config/app.toml
-sed -i "s/prometheus-retention-time = 0/prometheus-retention-time = 60/g" $HOME/.nymd/config/app.toml
-sudo ufw allow 9464
-echo 'Metrics URL: http://'$(curl -s ifconfig.me)':26660/metrics'
-```
-
-Your validator's metrics will be available to you at the returned 'Metrics URL'.
-
-~~~admonish example collapsible=true title="Console output"
-```
-# HELP go_gc_duration_seconds A summary of the pause duration of garbage collection cycles.
-# TYPE go_gc_duration_seconds summary
-go_gc_duration_seconds{quantile="0"} 6.7969e-05
-go_gc_duration_seconds{quantile="0.25"} 7.864e-05
-go_gc_duration_seconds{quantile="0.5"} 8.4591e-05
-go_gc_duration_seconds{quantile="0.75"} 0.000115919
-go_gc_duration_seconds{quantile="1"} 0.001137591
-go_gc_duration_seconds_sum 0.356555301
-go_gc_duration_seconds_count 2448
-# HELP go_goroutines Number of goroutines that currently exist.
-# TYPE go_goroutines gauge
-go_goroutines 668
-# HELP go_info Information about the Go environment.
-# TYPE go_info gauge
-go_info{version="go1.15.7"} 1
-# HELP go_memstats_alloc_bytes Number of bytes allocated and still in use.
-# TYPE go_memstats_alloc_bytes gauge
-go_memstats_alloc_bytes 1.62622216e+08
-# HELP go_memstats_alloc_bytes_total Total number of bytes allocated, even if freed.
-# TYPE go_memstats_alloc_bytes_total counter
-go_memstats_alloc_bytes_total 2.09341707264e+11
-# HELP go_memstats_buck_hash_sys_bytes Number of bytes used by the profiling bucket hash table.
-# TYPE go_memstats_buck_hash_sys_bytes gauge
-go_memstats_buck_hash_sys_bytes 5.612319e+06
-# HELP go_memstats_frees_total Total number of frees.
-# TYPE go_memstats_frees_total counter
-go_memstats_frees_total 2.828263344e+09
-# HELP go_memstats_gc_cpu_fraction The fraction of this program's available CPU time used by the GC since the program started.
-# TYPE go_memstats_gc_cpu_fraction gauge
-go_memstats_gc_cpu_fraction 0.03357798610671518
-# HELP go_memstats_gc_sys_bytes Number of bytes used for garbage collection system metadata.
-# TYPE go_memstats_gc_sys_bytes gauge
-go_memstats_gc_sys_bytes 1.3884192e+07
-```
-~~~
+5. If you double-checked that everything works fine, you can consider removing your old config directory
 
 ## Ports
 All `<NODE>`-specific port configuration can be found in `$HOME/.nym/<NODE>/<YOUR_ID>/config/config.toml`. If you do edit any port configs, remember to restart your client and node processes.
 
-### Mix Node port reference
+### Nym Node: Minode mode port reference
 | Default port | Use                       |
 | ------------ | ------------------------- |
 | `1789`       | Listen for Mixnet traffic |
@@ -824,19 +290,13 @@ All `<NODE>`-specific port configuration can be found in `$HOME/.nym/<NODE>/<YOU
 | `8000`       | Metrics http API endpoint |
 
 
-### Gateway port reference
+### Nym Node: Gateway modes port reference
 | Default port | Use                       |
 |--------------|---------------------------|
 | `1789`       | Listen for Mixnet traffic |
 | `9000`       | Listen for Client traffic |
 | `9001`       | WSS                       |
 
-### Network Requester port reference
-
-| Default port | Use                       |
-|--------------|---------------------------|
-| `9000`       | Listen for Client traffic |
-
 ### Validator port reference
 All validator-specific port configuration can be found in `$HOME/.nymd/config/config.toml`. If you do edit any port configs, remember to restart your validator.
 

documentation/operators/src/nodes/manual-upgrade.md

@@ -1,78 +1,52 @@
 # Manual Node Upgrade
 
-> The process here is similar for the Mix Node, Gateway and Network Requester binaries. In the following steps we use a placeholder `<NODE>` in the commands, please change it for the binary name you want to upgrade (e.g.`nym-mixnode`). Any particularities for the given type of node are included.
+> Any syntax in `<>` brackets is a user's unique variable. Exchange with a corresponding name without the `<>` brackets.
 
-Upgrading your node is a two-step process:
+**Upgrading your node is a straight forward two-step process:**
 
-1. Updating the binary and `~/.nym/<NODE>/<YOUR_ID>/config/config.toml` on your VPS
-2. Updating the node information in the [mixnet smart contract](https://nymtech.net/docs/nyx/mixnet-contract.html). **This is the information that is present on the [mixnet explorer](https://explorer.nymtech.net)**.
+#### 1. Updating the binary and `~/.nym/<NODE>/<YOUR_ID>/config/config.toml` on your VPS
+#### 2. Updating the node information in the [mixnet smart contract](https://nymtech.net/docs/nyx/mixnet-contract.html). This is the information that is present on the [mixnet explorer](https://explorer.nymtech.net).
 
 ## Step 1: Upgrading your binary
-Follow these steps to upgrade your Node binary and update its config file:
-* Pause your node process.
+
+Follow these steps to upgrade your node binary and update its config file:
+1. Pause your node process.
     - if you see the terminal window with your node, press `ctrl + c`
-    - if you run it as `systemd` service, run: `systemctl stop <NODE>.service`
-* Replace the existing `<NODE>` binary with the newest binary (which you can either [compile yourself](https://nymtech.net/docs/binaries/building-nym.html) or grab from our [releases page](https://github.com/nymtech/nym/releases)).
-* Re-run `init` with the same values as you used initially for your `<NODE>` ([Mix Node](./mix-node-setup.md#initialising-your-mix-node), [Gateway](./gateway-setup.md#initialising-your-gateway)) . **This will just update the config file, it will not overwrite existing keys**.
-* Restart your node process with the new binary:
-    - if your node is *not automated*, just `run` your `<NODE>` with `./<NODE> run --id <ID>`. Here are exact guidelines for [Mix Node](./mix-node-setup.md#running-your-mix-node) and [Gateway](./gateway-setup.md#running-your-gateway).
+    - if you run it as `systemd` service, run: `service <NODE> stop`
+2. Replace the existing `<NODE>` binary with the newest binary (which you can either [compile yourself](../binaries/building-nym.md) or [download](../binaries/pre-built-binaries.md).
+3. [Re-run with the same values](setup.md#initialise--run) as you used initially for your `<NODE>`. **This will just update the config file, it will not overwrite existing keys**.
+    - if your node is *not automated*, just `run` your `<NODE>` with `./<NODE> run --id <ID>`.
     - if you *automated* your node with systemd (recommended) run:
 ```sh
 systemctl daemon-reload # to pickup the new unit file
-systemctl start <NODE>.service
-journalctl -f -u <NODE>.service # to monitor log of you node
+
+service <NODE> start && journalctl -f -u <NODE>.service # to monitor log of you node
 ```
 
-If these steps are too difficult and you prefer to automate the process, try to setup your flow with [Nymvisor](nymvisor-upgrade.md).
-
-> In case of a Network Requester this is all, the following step is only for Mix Nodes and Gateways.
+If you prefer to automate the process, try to setup your flow with [Nymvisor](nymvisor-upgrade.md).
 
 ## Step 2: Updating your node information in the smart contract
+
 Follow these steps to update the information about your `<NODE>` which is publicly available from the [`nym-api`](https://validator.nymtech.net/api/swagger/index.html) and information displayed on the [Mixnet explorer](https://explorer.nymtech.net).
 
 You can either do this graphically via the Desktop Wallet, or the CLI.
 
 ### Updating node information via the Desktop Wallet (recommended)
-* Navigate to the `Bonding` page and click the `Node Settings` link in the top right corner:
+
+1. Navigate to the `Bonding` page and click the `Node Settings` link in the top right corner:
 
 ![Bonding page](../images/wallet-screenshots/bonding.png)
 
-* Update the fields in the `Node Settings` page (usually the field `Version` is the only one to change) and click `Submit changes to the blockchain`.
+2. Update the fields in the `Node Settings` page (usually the field `Version` is the only one to change) and click `Submit changes to the blockchain`.
 
 ![Node Settings Page](../images/wallet-screenshots/node_settings.png)
 
 ### Updating node information via the CLI
+
 If you want to bond your `<NODE>` via the CLI, then check out the [relevant section in the Nym CLI](https://nymtech.net/docs/tools/nym-cli.html#upgrade-a-mix-node) docs.
 
-
-## Upgrading Network Requester to >= v1.1.10 from <v1.1.9
-
-In the previous version of the network-requester, users were required to run a nym-client along side it to function. As of `v1.1.10`, the network-requester now has a nym client embedded into the binary, so it can run standalone.
-
-If you are running an existing Network Requester registered with nym-connect, upgrading requires you move your old keys over to the new Network Requester configuration. We suggest following these instructions carefully to ensure a smooth transition.
-
-Initiate the new Network Requester:
-
-```sh
-nym-network-requester init --id <YOUR_ID>
-```
-
-Copy the old keys from your client to the network-requester configuration that was created above:
-
-```sh
-cp -vr ~/.nym/clients/myoldclient/data/* ~/.nym/service-providers/network-requester/<YOUR_ID>/data
-```
-
-Edit the configuration to match what you used on your client. Specifically, edit the configuration file at:
-
-```sh
-~/.nym/service-providers/network-requester/<YOUR_ID>/config/config.toml
-```
-
-Ensure that the fields `gateway_id`, `gateway_owner`, `gateway_listener` in the new config match those in the old client config at:
-
-```sh
-~/.nym/clients/myoldclient/config/config.toml
+```admonish info
+If you run a Gateway, visit [Nym Harbour Master](https://harbourmaster.nymtech.net/) to get all the probe info about your node directly from API.
 ```
 
 ## Upgrading your validator

documentation/operators/src/nodes/nym-node.md

@@ -0,0 +1,102 @@
+# Nym Node
+
+```admonish note
+If you are a `nym-mixnode` or `nym-gateway` operator and you are not familiar with the binary changes called *Project Smoosh*, you can read the archived [Smoosh FAQ](../archive/faq/smoosh-faq.md) page.
+```
+
+NYM NODE is a tool for running a node within the Nym network. Nym Nodes containing functionality such as `mixnode`, `entry-gateway` and `exit-gateway` are fundamental components of Nym Mixnet architecture. Nym Nodes are ran by decentralised node operators.
+
+To setup any type of Nym Node, start with either building [Nym's platform](../binaries/building-nym.md) from source or download [pre-compiled binaries](../binaries/pre-built-binaries.md) on the [configured server (VPS)](vps-setup.md) where you want to run the node. Nym Node will need to be bond to [Nym's wallet](wallet-preparation.md). Follow [preliminary steps](preliminary-steps.md) page before you initialise and run a node.
+
+```admonish info
+**Migrating an existing node to a new `nym-node` is simple. The steps are documented on the [next page](setup.md#migrate)**
+```
+
+## Steps for Nym Node Operators
+
+Once VPS and Nym wallet are configured, binaries ready, the operators of `nym-node` need to:
+
+1. **[Setup & Run](setup.md) the node**
+
+2. **[Configure](configuration.md) the node** (and optionally WSS, reversed proxy, automation)
+
+3. **[Bond](bonding.md) the node to the Nym API, using Nym wallet**
+
+## Quick `nym-node --mode exit-gateway` Setup
+
+During the testing events series [Fast and Furious](https://nymtech.net/events/fast-and-furious) we found out, that after introducing IP Packet Router and [Nym exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) as default features,  only a fragment of Exit Gateways routes correctly through IPv4 and IPv6. We built a useful monitor to check out your Gateway (`nym-node --mode exit-gateway`) at [harbourmaster.nymtech.net](https://harbourmaster.nymtech.net/).
+
+Below is a fast - ten commands - deployment for seasoned operators to migrate and setup the node, configure networking and connectivity and verify that it all works as it should by getting two free jokes through the Mixnet.
+
+```admonish caution
+If you are not well familiar with `nym-node` setup, automation, and `nymtun0` configuration, follow the [steps above](#steps-for-nym-node-operators) page by page. You can use this flow as a reference later on.
+```
+
+1. [Get](../binaries/pre-built-binaries.md) or [build](../binaries/building-nym.md) the latest `nym-node` binary
+
+2. Get [network_tunnel_manager.sh](https://gist.github.com/tommyv1987/ccf6ca00ffb3d7e13192edda61bb2a77) script and grant permissions
+```sh
+curl -o network_tunnel_manager.sh -L https://gist.githubusercontent.com/tommyv1987/ccf6ca00ffb3d7e13192edda61bb2a77/raw/9d785d6ee3aa2970553633eccbd89a827f49fab5/network_tunnel_manager.sh && chmod +x network_tunnel_manager.sh
+```
+
+3. If you have a running `nym-node` or `nym-gateway` (alone or service), stop the process
+  - In case your node was a `nym-gateway`, [**migrate to `nym-node`**](setup.md#migrate) now!
+
+4. Check Nymtun IP tables:
+```sh
+sudo ./network_tunnel_manager.sh check_nymtun_iptables
+```
+ - if there's no process running it shouldn't get anything
+
+5. Display IPv6:
+```sh
+sudo ./network_tunnel_manager.sh fetch_and_display_ipv6
+```
+ - If you have a `global ipv6` address this is good, if not the next step should fix it
+~~~admonish example collapsible=true title="Correct `./network_tunnel_manager.sh fetch_and_display_ipv6` output:"
+```sh
+iptables-persistent is already installed.
+Using IPv6 address: 2001:db8:a160::1/112 #the address will be different for you
+operation fetch_ipv6_address_nym_tun completed successfully.
+```
+~~~
+
+6. Apply the rules:
+```sh
+sudo ./network_tunnel_manager.sh apply_iptables_rules
+```
+  - and check them again like in point 4.
+
+7. (If you didn't have a `nym-node` service yet) Create `systemd` [automation and configuration file](configuration.md#systemd), reload and enable the service
+
+8. Start `nym-node` service:
+```sh
+sudo service nym-node start && journalctl -u nym-node -f -n 100
+```
+  - If you don't run this as an upgrade but started a fresh new node, you need to [bond](bonding.md) the gateway now. After that finish the verification steps below.
+
+9. After a minute of running properly, check `nymtun0`:
+```sh
+ip addr show nymtun0
+```
+
+~~~admonish example collapsible=true title="Correct `ip addr show nymtun0` output:"
+```sh
+# your addresses will be different
+8: nymtun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1420 qdisc fq_codel state UNKNOWN group default qlen 500
+    link/none
+    inet 10.0.0.1/16 scope global nymtun0
+       valid_lft forever preferred_lft forever
+    inet6 2001:db8:a160::1/112 scope global
+       valid_lft forever preferred_lft forever
+    inet6 fe80::ad08:d167:5700:8c7c/64 scope link stable-privacy
+       valid_lft forever preferred_lft forever`
+```
+~~~
+
+10. Validate your IPv6 and IPv4 networking by running a joke via Mixnet:
+```sh
+sudo ./network_tunnel_manager.sh joke_through_the_mixnet
+```
+
+Make sure that you get the validation of IPv4 and IPv6 connectivity, in case of problems, check [troubleshooting page](../troubleshooting/vps-isp.md#incorrect-gateway-network-check). After proceed to [bonding](bonding.md).

documentation/operators/src/nodes/nymvisor-upgrade.md

@@ -11,9 +11,7 @@ In essence, it tries to mirror the behaviour of [Cosmovisor](https://github.com/
 
 You can use Nymvisor to automate the upgrades of the following binaries:
 * `nym-api`
-* `nym-mixnode`
-* `nym-gateway`
-* `nym-network-requester`
+* `nym-node`
 * `nym-client`
 * `nym-socks5-client`
 
@@ -27,9 +25,9 @@ Nymvisor is an early and experimental software. Users should use it at their own
 ```
 
 ## Preliminary steps
-You need to have at least one Mixnet node / client / Nym API instance already set up on the **same VPS** that you wish to run Nymvisor on.
+You need to have at least one Nym Node / client / Nym API instance already set up on the **same VPS** that you wish to run Nymvisor on.
 
-> Using Nymvisor presumes your VPS is running an operating system that is compatible with the pre-compiled binaries avaliable on the [Github releases page](https://github.com/nymtech/nym/releases). If you're not, then until we're packaging for a greater variety of operating systems, you're stuck with [manually upgrading your node](manual-upgrade.md).
+> Using Nymvisor presumes your VPS is running an operating system that is compatible with the pre-compiled binaries availiable on the [Github releases page](https://github.com/nymtech/nym/releases). If you're not, then until we're packaging for a greater variety of operating systems, you're stuck with [manually upgrading your node](manual-upgrade.md).
 
 ## Setup and Usage
 ### Viewing command help
@@ -54,7 +52,7 @@ You can also check the various arguments required for individual commands with:
 ```
 
 ### Initialising your Nymvisor Instance
-> This example will use the Mix Node binary as an example - however replacing `nym-mixnode` with any other supported binary will work the same.
+> This example will use the Nym Node binary as an example - however replacing `nym-node` with any other supported binary will work the same.
 
 Initialise your Nymvisor instance with the following command. You must initialise Nymvisor with the binary you wish to add upgrades for:
 
@@ -62,11 +60,11 @@ Initialise your Nymvisor instance with the following command. You must initialis
 ./nymvisor init --daemon-home ~/.nym/<NODE_TYPE>/<NODE_ID> <PATH_TO_NODE_BINARY>
 ```
 
-Where the value of `--daemon-home` might be `~/.nym/mixnodes/my-node` and `<PATH_TO_NODE_BINARY>` might be `/home/my_user/nym/target/release/nym-mixnode`, or wherever your node binary is located.
+Where the value of `--daemon-home` might be `~/.nym/nym-nodes/default-nym-node` and `<PATH_TO_NODE_BINARY>` might be `/home/my_user/nym/target/release/nym-node`, or wherever your node binary is located.
 
 ~~~admonish example collapsible=true title="Console output"
 ```
-<!-- cmdrun ../../../../target/release/nymvisor init --daemon-home ~/.nym/mixnodes/my-node ../../../../target/release/nym-mixnode | tail -20 -->
+<!-- cmdrun ../../../../target/release/nymvisor init --daemon-home ~/.nym/nym-nodes/default-nym-node ../../../../target/release/nym-node | tail -20 -->
 ```
 ~~~
 
@@ -75,7 +73,7 @@ By default this will create config files at `~/.nym/nymvisors/instances/<NODE_TY
 ### Running your Nymvisor Instance
 Nymvisor acts as a wrapper around the specified node process - it has to do this in order to be able to pause and restart this process. As such, you need to run your node _via_ Nymvisor!
 
-The interface to the `nymvisor run <ARGS>` command is quite simple. Any argument passed after the `run` command will be passed directly to the underlying daemon, for example: `nymvisor run run --id my-mixnode` will run the `$DAEMON_NAME run --id my-mixnode` command (where `DAEMON_NAME` is the name of the binary itself (e.g. `nym-api`, `nym-mixnode`, etc.)).
+The interface to the `nymvisor run <ARGS>` command is quite simple. Any argument passed after the `run` command will be passed directly to the underlying daemon, for example: `nymvisor run run --id default-nym-node` will run the `$DAEMON_NAME run --id default-nym-node` command (where `DAEMON_NAME` is the name of the binary itself (e.g. `nym-api`, `nym-node`, etc.)).
 
 `run` Nymvisor and start your node via the following command. Make sure to stop any existing node before running this command.
 
@@ -85,11 +83,11 @@ The interface to the `nymvisor run <ARGS>` command is quite simple. Any argument
 
 ~~~admonish example collapsible=true title="Console output"
 ```
-<!-- cmdrun ../../../../target/release/nymvisor run run --id my-node -->
+<!-- cmdrun ../../../../target/release/nymvisor run run --id default-nym-node -->
 ```
 ~~~
 
-Nymvisor will now manage your node process (for an in-depth overview of this command check the [in-depth command information](./nymvisor-upgrade.md#commands-in-depth) below). It will periodically poll [this endpoint](https://nymtech.net/.wellknown/nym-mixnode/upgrade-info.json) (replace `nym-mixnode` with whatever node you may actually be running via Nymvisor) and check for a new `version` of the binary it is watching. If this exists, it will then, using the information there:
+Nymvisor will now manage your node process (for an in-depth overview of this command check the [in-depth command information](./nymvisor-upgrade.md#commands-in-depth) below). It will periodically poll [this endpoint](https://nymtech.net/.wellknown/nym-node/upgrade-info.json) (replace `nym-node` with whatever node you may actually be running via Nymvisor) and check for a new `version` of the binary it is watching. If this exists, it will then, using the information there:
 * pause your node process
 * grab the new binary (`version`)
 * verify it against the provided `checksum`
@@ -118,9 +116,9 @@ Similarly to `init`, `add-upgrade` requires a positional argument specifying a v
 ## Config
 The output format of `nymvisor config` can be further configured with `--output` argument. By default a human-readable text representation is used:
 ```
-id:                                nym-mixnode-default
-daemon name:                       nym-mixnode
-daemon home:                       /home/nym/.nym/mixnodes/my-mixnode
+id:                                nym-node-default
+daemon name:                       nym-node
+daemon home:                       /home/nym/.nym/nym-nodes/default-nym-node
 upstream base upgrade url:         https://nymtech.net/.wellknown/
 disable nymvisor logs:             false
 CUSTOM upgrade data directory      ""
@@ -143,7 +141,7 @@ nymvisor config --output=json
 ```
 outputs:
 ```
-{"nymvisor":{"id":"nym-mixnode-default","upstream_base_upgrade_url":"https://nymtech.net/.wellknown/","upstream_polling_rate":"1h","disable_logs":false,"upgrade_data_directory":null},"daemon":{"name":"nym-mixnode","home":"/home/nym/.nym/mixnodes/my-mixnode","absolute_upstream_upgrade_url":null,"allow_binaries_download":true,"enforce_download_checksum":true,"restart_after_upgrade":true,"restart_on_failure":false,"failure_restart_delay":"10s","max_startup_failures":10,"startup_period_duration":"2m","shutdown_grace_period":"10s","backup_data_directory":null,"unsafe_skip_backup":false}}
+{"nymvisor":{"id":"nym-node-default","upstream_base_upgrade_url":"https://nymtech.net/.wellknown/","upstream_polling_rate":"1h","disable_logs":false,"upgrade_data_directory":null},"daemon":{"name":"nym-node","home":"/home/nym/.nym/nym-nodes/default-nym-nodee","absolute_upstream_upgrade_url":null,"allow_binaries_download":true,"enforce_download_checksum":true,"restart_after_upgrade":true,"restart_on_failure":false,"failure_restart_delay":"10s","max_startup_failures":10,"startup_period_duration":"2m","shutdown_grace_period":"10s","backup_data_directory":null,"unsafe_skip_backup":false}}
 ```
 
 ## CLI Overview
@@ -179,8 +177,8 @@ For any of its commands as described in [CLI Overview section](./nymvisor-upgrad
 - `NYMVISOR_UPSTREAM_POLLING_RATE` (defaults to 1h) is polling rate the upstream url for upgrade information.
 - `NYMVISOR_DISABLE_LOGS` (defaults to `false`). If set to `true`, this will disable Nymvisor logs (but not the underlying process) completely.
 - `NYMVISOR_UPGRADE_DATA_DIRECTORY` is the custom directory for upgrade data - binaries and upgrade plans. If not set, the global Nymvisors' data directory will be used instead.
-- `DAEMON_NAME` is the name of the binary itself (e.g. `nym-api`, `nym-mixnode`, etc.).
-- `DAEMON_HOME` is the location where the `nymvisor/` directory is kept that contains the auxiliary files associated with the underlying daemon instance, such as any backups or current version information, e.g. `$HOME/.nym/nym-api/my-nym-api`, `$HOME/.nym/mixnodes/my-mixnode`, etc.
+- `DAEMON_NAME` is the name of the binary itself (e.g. `nym-api`, `nym-node`, etc.).
+- `DAEMON_HOME` is the location where the `nymvisor/` directory is kept that contains the auxiliary files associated with the underlying daemon instance, such as any backups or current version information, e.g. `$HOME/.nym/nym-api/my-nym-api`, `$HOME/.nym/nym-nodes/default-nym-node`, etc.
 - `DAEMON_ABSOLUTE_UPSTREAM_UPGRADE_URL` is the absolute (i.e. the full url) upstream source for upgrade plans for this daemon. The url has to point to an endpoint containing a valid `UpgradeInfo` json file. If set it takes precedence over `NYMVISOR_UPSTREAM_BASE_UPGRADE_URL`.
 - `DAEMON_ALLOW_BINARIES_DOWNLOAD` (defaults to `true`), if set to `true`, it will enable auto-downloading of new binaries (as declared by urls in corresponding `upgrade-info.json` files). For security reasons one might wish to disable it and instead manually provide binaries by either placing them in the appropriate directory or by invoking `add-upgrade` command.
 - `DAEMON_ENFORCE_DOWNLOAD_CHECKSUM` (defaults to `true`), if set to `true` Nymvisor will require that a checksum is provided in the upgrade plan for the upgrade binary to be downloaded. If disabled, Nymvisor will not require a checksum to be provided, but still check the checksum if one is provided.
@@ -226,7 +224,7 @@ A sample full structure looks as follows:
 │       │   │       └── upgrade-info.json
 │       │   ├── upgrade-history.json
 │       │   └── upgrade-plan.json
-│       ├── nym-mixnode
+│       ├── nym-node
 │       │   └── ...
 │       └── $DAEMON_NAME
 │           └── ...
@@ -264,7 +262,7 @@ This section outlines what happens under the hood with the following commands:
 - saves the Nymvisor instance's config file to `$NYMVISOR_CONFIG_PATH` and creates the full directory structure for the file
 - outputs (to `stdout`) the full configuration used
 
-> `nymvisor init` is specifically for initializing Nymvisor, and should **not** be confused with a daemon's `init` command - such as `nym-mixnode init` (e.g. `cosmovisor run init`).
+> `nymvisor init` is specifically for initializing Nymvisor, and should **not** be confused with a daemon's `init` command - such as `nym-node init` (e.g. `cosmovisor run init`).
 
 ### Run
 `nymvisor run` is a lightweight wrapper around the underlying daemon. It uses only a single thread and spawns three simple tasks:

documentation/operators/src/nodes/nyx-configuration.md

@@ -0,0 +1,268 @@
+# Nyx Validator & Nym API Configuration
+
+## Automation
+
+### Validator `systemd` Automation
+
+To automate with `systemd` use this init service file by saving it as `/etc/systemd/system/nymd.service` and follow the steps bellow..
+
+1. Open text editor
+```sh
+nano /etc/systemd/system/nymd.service
+```
+
+2. Paste this file
+```ini
+[Unit]
+Description=Nyxd
+StartLimitInterval=350
+StartLimitBurst=10
+
+[Service]
+User=<USER>                                                       # change to your user
+Type=simple
+Environment="LD_LIBRARY_PATH=/home/<USER>/<PATH_TO_NYX_BINARIES>" # change to correct path
+ExecStart=/home/<USER>/<PATH_TO_NYX_BINARIES>/nymd start          # change to correct path
+Restart=on-failure
+RestartSec=30
+LimitNOFILE=infinity
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Proceed to start it with:
+
+```sh
+systemctl daemon-reload # to pickup the new unit file
+systemctl enable nymd   # to enable the service
+systemctl start nymd    # to actually start the service
+journalctl -f -u nymd # to monitor system logs showing the service start
+```
+
+**Note:** if you make any changes to your `systemd` script after you've enabled it, you will need to run:
+
+```sh
+systemctl daemon-reload
+```
+
+This lets your operating system know it's ok to reload the service configuration. Then restart your `<NODE>`.
+
+### Nym API `systemd` Automation
+
+
+To automate with `systemd` use this init service file by saving it as `/etc/systemd/system/nym-api.service` and follow the steps bellow..
+
+1. Open text editor
+```sh
+nano /etc/systemd/system/nym-api.service
+```
+
+2. Paste this file
+```ini
+[Unit]
+Description=NymAPI
+StartLimitInterval=350
+StartLimitBurst=10
+
+[Service]
+User=<USER>                                                       # change to your user
+Type=simple
+ExecStart=/home/<USER>/<PATH_TO_BINARY>/nym-api start             # change to correct path
+Restart=on-failure
+RestartSec=30
+LimitNOFILE=infinity
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Proceed to start it with:
+
+```sh
+systemctl daemon-reload  # to pickup the new unit file
+systemctl enable nym-api # to enable the service
+systemctl start nym-api  # to actually start the service
+journalctl -f -u nym-api # to monitor system logs showing the service start
+```
+
+**Note:** if you make any changes to your `systemd` script after you've enabled it, you will need to run:
+
+```sh
+systemctl daemon-reload
+```
+
+This lets your operating system know it's ok to reload the service configuration. Then restart your `<NODE>`.
+
+## Nym API (previously 'Validator API') endpoints
+
+Numerous API endpoints are documented on the Nym API (previously 'Validator API')'s [Swagger Documentation](https://validator.nymtech.net/api/swagger/index.html). There you can also try out various requests from your browser, and download the response from the API. Swagger will also show you what commands it is running, so that you can run these from an app or from your CLI if you prefer.
+
+```sh
+sudo ufw allow 'Nginx Full'
+```
+
+Check nginx is running via systemctl:
+
+```sh
+systemctl status nginx
+```
+
+Which should return:
+
+```sh
+● nginx.service - A high performance web server and a reverse proxy server
+   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
+   Active: active (running) since Fri 2018-04-20 16:08:19 UTC; 3 days ago
+     Docs: man:nginx(8)
+ Main PID: 2369 (nginx)
+    Tasks: 2 (limit: 1153)
+   CGroup: /system.slice/nginx.service
+           ├─2369 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
+           └─2380 nginx: worker process
+```
+
+## Full Node Configuration
+
+Proxying various full node services through port 80 can then be done by creating a file with the following at `/etc/nginx/sites-enabled/nyxd-webrequests.conf`:
+
+Setting up a reverse proxy using a webserver such as Nginx allows you to easily configure SSL certificates for the endpoints. When running on mainnet, it is recommended to encrypt all web traffic to your node.
+
+```sh
+### To expose RPC server
+server {
+  listen 80;
+  listen [::]:80;
+  server_name "<rpc.nyx.yourdomain.tld>";
+
+  location / {
+    proxy_pass http://127.0.0.1:26657;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  }
+
+  location /websocket {
+      proxy_pass http://127.0.0.1:26657;
+      proxy_http_version 1.1;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "Upgrade";
+      proxy_set_header Host $host;
+    }
+}
+
+### To expose Cosmos API server
+server {
+  server_name "<api.nyx.yourdomain.tld>";
+  location / {
+    proxy_pass http://127.0.0.1:1317;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header Host $http_host;
+    proxy_set_header Upgrade websocket;
+    proxy_set_header Connection Upgrade;
+  }
+}
+
+### To expose GRPC endpoint
+server {
+  server_name "<grpc.nyx.yourdomain.tld>";
+  location / {
+    grpc_pass 127.0.0.1:9090;
+  }
+}
+```
+
+## nym-api Configuration
+
+```sh
+### To expose nym-api webserver
+server {
+  listen 80;
+  listen [::]:80;
+  server_name "<nym-api.nyx.yourdomain.tld>";
+  add_header 'Access-Control-Allow-Origin' '*';
+
+  location / {
+    proxy_pass http://127.0.0.1:8000;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  }
+}
+```
+
+Followed by:
+
+```sh
+sudo apt install certbot nginx python3
+certbot --nginx -m <you@yourdomain.com> --agree-tos
+```
+
+```admonish caution title=""
+If using a VPS running Ubuntu 20: replace `certbot nginx python3` with `python3-certbot-nginx`
+```
+
+These commands will get you an https encrypted nginx proxy in front of the various endpoints.
+
+## Configuring Prometheus metrics (optional)
+
+Configure Prometheus with the following commands (adapted from NodesGuru's [Agoric setup guide](https://nodes.guru/agoric/setup-guide/en)):
+
+```sh
+echo 'export OTEL_EXPORTER_PROMETHEUS_PORT=9464' >> $HOME/.bashrc
+source ~/.bashrc
+sed -i '/\[telemetry\]/{:a;n;/enabled/s/false/true/;Ta}' $HOME/.nymd/config/app.toml
+sed -i "s/prometheus-retention-time = 0/prometheus-retention-time = 60/g" $HOME/.nymd/config/app.toml
+sudo ufw allow 9464
+echo 'Metrics URL: http://'$(curl -s ifconfig.me)':26660/metrics'
+```
+
+Your validator's metrics will be available to you at the returned 'Metrics URL'.
+
+~~~admonish example collapsible=true title="Console output"
+```
+# HELP go_gc_duration_seconds A summary of the pause duration of garbage collection cycles.
+# TYPE go_gc_duration_seconds summary
+go_gc_duration_seconds{quantile="0"} 6.7969e-05
+go_gc_duration_seconds{quantile="0.25"} 7.864e-05
+go_gc_duration_seconds{quantile="0.5"} 8.4591e-05
+go_gc_duration_seconds{quantile="0.75"} 0.000115919
+go_gc_duration_seconds{quantile="1"} 0.001137591
+go_gc_duration_seconds_sum 0.356555301
+go_gc_duration_seconds_count 2448
+# HELP go_goroutines Number of goroutines that currently exist.
+# TYPE go_goroutines gauge
+go_goroutines 668
+# HELP go_info Information about the Go environment.
+# TYPE go_info gauge
+go_info{version="go1.15.7"} 1
+# HELP go_memstats_alloc_bytes Number of bytes allocated and still in use.
+# TYPE go_memstats_alloc_bytes gauge
+go_memstats_alloc_bytes 1.62622216e+08
+# HELP go_memstats_alloc_bytes_total Total number of bytes allocated, even if freed.
+# TYPE go_memstats_alloc_bytes_total counter
+go_memstats_alloc_bytes_total 2.09341707264e+11
+# HELP go_memstats_buck_hash_sys_bytes Number of bytes used by the profiling bucket hash table.
+# TYPE go_memstats_buck_hash_sys_bytes gauge
+go_memstats_buck_hash_sys_bytes 5.612319e+06
+# HELP go_memstats_frees_total Total number of frees.
+# TYPE go_memstats_frees_total counter
+go_memstats_frees_total 2.828263344e+09
+# HELP go_memstats_gc_cpu_fraction The fraction of this program's available CPU time used by the GC since the program started.
+# TYPE go_memstats_gc_cpu_fraction gauge
+go_memstats_gc_cpu_fraction 0.03357798610671518
+# HELP go_memstats_gc_sys_bytes Number of bytes used for garbage collection system metadata.
+# TYPE go_memstats_gc_sys_bytes gauge
+go_memstats_gc_sys_bytes 1.3884192e+07
+```
+~~~
+
+## Validator port reference
+
+All validator-specific port configuration can be found in `$HOME/.nymd/config/config.toml`. If you do edit any port configs, remember to restart your validator.
+
+| Default port | Use                                  |
+|--------------|--------------------------------------|
+| 1317         | REST API server endpoint             |
+| 26656        | Listen for incoming peer connections |
+| 26660        | Listen for Prometheus connections    |

documentation/operators/src/nodes/preliminary-steps.md

@@ -0,0 +1,10 @@
+# Preliminary Steps
+
+> The `nym-node` binary was built in the [building nym](../binaries/building-nym.md) section. If you haven't yet built Nym and want to run the code, go there first.
+
+There are a couple of steps that need completing before starting to set up your `nym-node`:
+
+1. **[Prepare your wallet](wallet-preparation.md):** [desktop](https://nymtech.net/docs/wallet/desktop-wallet.html) or [CLI](https://nymtech.net/docs/wallet/cli-wallet.html).
+2. **[Requisition and setup a VPS](vps-setup.md)** (Virtual Private Server)
+
+Make sure to follow these steps carefully as it prevents a lot of troubleshooting later on.

documentation/operators/src/nodes/proxy-configuration.md

@@ -0,0 +1,482 @@
+# Reversed Proxy & Web Secure Socket
+
+It's useful to put your Exit Gateway behind a reversed proxy and have it accessible via `https` domain, where you can host a [landing page](../legal/landing-pages.md). The guide is right [below](#reversed-proxy).
+
+Another solution is to have a your Gateway behind WSS. With ongoing migration from `nym-gateway` to `nym-node --mode exit-gateway` we are working on a detailed guide for WSS setup.
+
+## Reversed Proxy: Avril 14th Exit Gateways Guide
+
+```admonish info
+This guide was created by a Nym node operator, Avril 14th as a part of [Nym Operators Community Counsel](../legal/community-counsel.md)
+
+The entire content of this page is under [Creative Commons Attribution 4.0 International Public License](https://creativecommons.org/licenses/by/4.0/).
+```
+
+The following snippet needs  be modified as described below according to the public identity that you may want to show on this public notice, i.e. your graphics and your email.
+It would allow you to serve it as a landing page resembling the one proposed by [Tor](https://gitlab.torproject.org/tpo/core/tor/-/raw/HEAD/contrib/operator-tools/tor-exit-notice.html) but with all the changes needed to adhere to the Nym's operators case.
+
+[Avril 14th](https://avril14th.org/) is a team of professionals and optimistic realists eager to contribute to a future of privacy, decentralization and connectivity.
+
+```admonish warning
+With a migration from `nym-gateway` to `nym-node --mode exit-gateway` the directory tree has been slightly changed. After the migration the configuration directory is in `~/.nym/nym-nodes/`. **The pathways and exact syntax in this guide is yet to be modified!**
+```
+
+When done with the customization needs as described below, you'll need to upload the file and reference it as the `landing_page_assets_path` on the `[http]` section of the config.toml file:
+```
+landing_page_assets_path = '<PATH_TO_YOUR_CUSTOM_FILE>'
+```
+
+### HTML file customization
+
+- add your favicon logo on the line:
+```
+<link rel="icon" type="image/png" href="">
+```
+
+and your header logo on the line:
+```
+<img class="logo" src="<FIXME>">
+```
+
+by either setting the URl to the image (if you're hosting it publicly, i.e. on your web server)
+```
+href="<PATH_TO_YOUR_PUBLIC_URL>"
+```
+and
+```
+src="<PATH_TO_YOUR_PUBLIC_URL>"
+
+```
+**or** by adding the image inline as base64 encoded image
+```
+href="href="data:image/x-icon;base64,AAABAAMA....""
+```
+and
+```
+src="href="data:image/x-icon;base64,AAABAAMA....""
+```
+
+
+- add the email address you're willing to use for being contacted.
+```
+<a href="mailto:>FIXME>">maintainer</a>
+```
+
+- If you're running the node within the US check the sections marked as FIXME, add your DNS name and uncomment those.
+***
+
+```html
+<!DOCTYPE html>
+<html lang="en-US">
+<head>
+<meta charset="UTF-8">
+<title>This is a NYM Exit Gateway</title>
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<link rel="icon" type="image/png" href="">
+<style>
+:root {
+  font-family: Consolas, "Ubuntu Mono", Menlo, "DejaVu Sans Mono", monospace;
+}
+:root{
+--background-color: #121726;
+--text-color: #f2f2f2;
+--link-color: #fb6e4e;
+}
+html{
+background: var(--background-color);
+}
+body{
+margin-left: auto;
+margin-right: auto;
+padding-left: 5vw;
+padding-right: 5vw;
+max-width: 1000px;
+}
+h1{
+font-size: 55px;
+text-align: center;
+color: var(--title-color)
+}
+p{
+color: var(--text-color);
+}
+p, a{
+font-size: 20px;
+}
+a{
+color: var(--link-color);
+text-decoration: none;
+}
+a:hover{
+filter: brightness(.8);
+text-decoration: underline;
+}
+.links{
+display: flex;
+flex-wrap: wrap;
+justify-content: space-evenly;
+}
+.links > a{
+margin: 10px;
+white-space: nowrap;
+}
+</style>
+
+</head>
+<body>
+<main>
+<h1>This is a NYM Exit Gateway</h1>
+<p style="text-align:center">
+<img class="logo" src="<FIXME>">
+</p>
+
+<p>
+You are most likely accessing this website because you've had some issue with
+the traffic coming from this IP. This router is part of the <a
+href="https://nymtech.net/">NYM project</a>, which is
+dedicated to <a href="https://nymtech.net/about/mission">create</a> outstanding
+privacy software that is legally compliant without sacrificing integrity or
+having any backdoors.
+This router IP should be generating no other traffic, unless it has been
+compromised.</p>
+
+<p>
+The Nym mixnet is operated by a decentralised community of node operators
+and stakers. The Nym mixnet is trustless, meaning that no parts of the system
+nor its operators have access to information that might compromise the privacy
+of users. Nym software enacts a strict principle of data minimisation and has
+no back doors. The Nym mixnet works by encrypting packets in several layers
+and relaying those through a multi-layered network called a mixnet,  eventually
+letting the traffic exit the Nym mixnet through an exit gateway like this one.
+This design makes it very hard for a service to know which user is connecting to it,
+since it can only see the IP-address of the Nym exit gateway:</p>
+
+<p style="text-align:center;margin:40px 0">
+<svg xmlns="http://www.w3.org/2000/svg" width="500" viewBox="0 0 490.28 293.73" style="width:100%;max-width:600px">
+<desc>Illustration showing how a user might connect to a service through the Nym network. The user first sends their data through three daisy-chained encrypted Nym nodes that exist on three different continents. Then the last Nym node in the chain connects to the target service over the normal internet.</desc>
+<defs>
+<style>
+.t{
+fill: var(--text-color);
+stroke: var(--text-color);
+}
+</style>
+</defs>
+<path fill="#6fc8b7" d="M257.89 69.4c-6.61-6.36-10.62-7.73-18.36-8.62-7.97-1.83-20.06-7.99-24.17-.67-3.29 5.85-18.2 12.3-16.87 2.08.92-7.03 11.06-13.28 17-17.37 8.69-5.99 24.97-2.87 26.1-10.28 1.04-6.86-8.33-13.22-8.55-2.3-.38 12.84-19.62 2.24-8.73-6.2 8.92-6.9 16.05-9.02 25.61-6.15 12.37 4.83 25.58-2.05 33.73-.71 12.37-2.01 24.69-5.25 37.39-3.96 13 .43 24.08-.14 37.06.63 9.8 1.58 16.5 2.87 26.37 3.6 6.6.48 17.68-.82 24.3 1.9 8.3 4.24.44 10.94-6.89 11.8-8.79 1.05-23.59-1.19-26.6 1.86-5.8 7.41 10.75 5.68 11.27 14.54.57 9.45-5.42 9.38-8.72 16-2.7 4.2.3 13.93-1.18 18.45-1.85 5.64-19.64 4.47-14.7 14.4 4.16 8.34 1.17 19.14-10.33 12.02-5.88-3.65-9.85-22.04-15.66-21.9-11.06.27-11.37 13.18-12.7 17.52-1.3 4.27-3.79 2.33-6-.63-3.54-4.76-7.75-14.22-12.01-17.32-6.12-4.46-10.75-1.17-15.55 2.83-5.63 4.69-8.78 7.82-7.46 16.5.78 9.1-12.9 15.84-14.98 24.09-2.61 10.32-2.57 22.12-8.81 31.47-4 5.98-14.03 20.12-21.27 14.97-7.5-5.34-7.22-14.6-9.56-23.08-2.5-9.02.6-17.35-2.57-26.2-2.45-6.82-6.23-14.54-13.01-13.24-6.5.92-15.08 1.38-19.23-2.97-5.65-5.93-6-10.1-6.61-18.56 1.65-6.94 5.79-12.64 10.38-18.63 3.4-4.42 17.45-10.39 25.26-7.83 10.35 3.38 17.43 10.5 28.95 8.57 3.12-.53 9.14-4.65 7.1-6.62zm-145.6 37.27c-4.96-1.27-11.57 1.13-11.8 6.94-1.48 5.59-4.82 10.62-5.8 16.32.56 6.42 4.34 12.02 8.18 16.97 3.72 3.85 8.58 7.37 9.3 13.1 1.24 5.88 1.6 11.92 2.28 17.87.34 9.37.95 19.67 7.29 27.16 4.26 3.83 8.4-2.15 6.52-6.3-.54-4.54-.6-9.11 1.01-13.27 4.2-6.7 7.32-10.57 12.44-16.64 5.6-7.16 12.74-11.75 14-20.9.56-4.26 5.72-13.86 1.7-16.72-3.14-2.3-15.83-4-18.86-6.49-2.36-1.71-3.86-9.2-9.86-12.07-4.91-3.1-10.28-6.73-16.4-5.97zm11.16-49.42c6.13-2.93 10.58-4.77 14.61-10.25 3.5-4.28 2.46-12.62-2.59-15.45-7.27-3.22-13.08 5.78-18.81 8.71-5.96 4.2-12.07-5.48-6.44-10.6 5.53-4.13.38-9.2-5.66-8.48-6.12.8-12.48-1.45-18.6-1.73-5.3-.7-10.13-1-15.45-1.37-5.37-.05-16.51-2.23-25.13.87-5.42 1.79-12.5 5.3-16.73 9.06-4.85 4.2.2 7.56 5.54 7.45 5.3-.22 16.8-5.36 20.16.98 3.68 8.13-5.82 18.29-5.2 26.69.1 6.2 3.37 11 4.74 16.98 1.62 5.94 6.17 10.45 10 15.14 4.7 5.06 13.06 6.3 19.53 8.23 7.46.14 3.34-9.23 3.01-14.11 1.77-7.15 8.49-7.82 12.68-13.5 7.14-7.72 16.41-13.4 24.34-18.62zM190.88 3.1c-4.69 0-13.33.04-18.17-.34-7.65.12-13.1-.62-19.48-1.09-3.67.39-9.09 3.34-5.28 7.04 3.8.94 7.32 4.92 7.1 9.31 1.32 4.68 1.2 11.96 6.53 13.88 4.76-.2 7.12-7.6 11.93-8.25 6.85-2.05 12.5-4.58 17.87-9.09 2.48-2.76 7.94-6.38 5.26-10.33-1.55-1.31-2.18-.64-5.76-1.13zm178.81 157.37c-2.66 10.08-5.88 24.97 9.4 15.43 7.97-5.72 12.58-2.02 17.47 1.15.5.43 2.65 9.2 7.19 8.53 5.43-2.1 11.55-5.1 14.96-11.2 2.6-4.62 3.6-12.39 2.76-13.22-3.18-3.43-6.24-11.03-7.7-15.1-.76-2.14-2.24-2.6-2.74-.4-2.82 12.85-6.04 1.22-10.12-.05-8.2-1.67-29.62 7.17-31.22 14.86z"/>
+<g fill="none">
+<path stroke="#cf63a6" stroke-linecap="round" stroke-width="2.76" d="M135.2 140.58c61.4-3.82 115.95-118.83 151.45-103.33"/>
+<path stroke="#cf63a6" stroke-linecap="round" stroke-width="2.76" d="M74.43 46.66c38.15 8.21 64.05 42.26 60.78 93.92M286.65 37.25c-9.6 39.44-3.57 57.12-35.64 91.98"/>
+<path stroke="#e4c101" stroke-dasharray="9.06,2.265" stroke-width="2.27" d="M397.92 162.52c-31.38 1.26-90.89-53.54-148.3-36.17"/>
+<path stroke="#cf63a6" stroke-linecap="round" stroke-width="2.77" d="M17.6 245.88c14.35 0 14.4.05 28-.03"/>
+<path stroke="#e3bf01" stroke-dasharray="9.06,2.265" stroke-width="2.27" d="M46.26 274.14c-17.52-.12-16.68.08-30.34.07"/>
+</g>
+<g transform="translate(120.8 -35.81)">
+<circle cx="509.78" cy="68.74" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
+<circle cx="440.95" cy="251.87" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
+<circle cx="212.62" cy="272.19" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
+<circle cx="92.12" cy="87.56" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
+<circle cx="730.88" cy="315.83" r="18.12" fill="#67727b" transform="translate(-93.3 38.03) scale(.50637)"/>
+<circle cx="-102.85" cy="282.18" r="9.18" fill="#240a3b"/>
+<circle cx="-102.85" cy="309.94" r="9.18" fill="#67727b"/>
+</g>
+<g class="t">
+<text xml:space="preserve" x="-24.76" y="10.37" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="-24.76" y="10.37">The user</tspan></text>
+<text xml:space="preserve" x="150.63" y="196.62" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="150.63" y="196.62">This server</tspan></text>
+<text xml:space="preserve" x="346.39" y="202.63" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="346.39" y="202.63">Your service</tspan></text>
+<text xml:space="preserve" x="34.52" y="249.07" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="34.52" y="249.07">Nym network link</tspan></text>
+<text xml:space="preserve" x="34.13" y="276.05" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="34.13" y="276.05">Unencrypted link</tspan></text>
+<path fill="none" stroke-linecap="round" stroke-width="1.67" d="M222.6 184.1c-2.6-15.27 8.95-23.6 18.43-38.86m186.75 45.61c-.68-10.17-9.4-17.68-18.08-23.49"/>
+<path fill="none" stroke-linecap="round" stroke-width="1.67" d="M240.99 153.41c.35-3.41 1.19-6.17.04-8.17m-7.15 5.48c1.83-2.8 4.58-4.45 7.15-5.48"/>
+<path fill="none" stroke-linecap="round" stroke-width="1.67" d="M412.43 173.21c-2.2-3.15-2.54-3.85-2.73-5.85m0 0c2.46-.65 3.85.01 6.67 1.24M61.62 40.8C48.89 36.98 36.45 27.54 36.9 18.96M61.62 40.8c.05-2.58-3.58-4.8-5.25-5.26m-2.65 6.04c1.8.54 6.8 1.31 7.9-.78"/>
+<path fill="none" stroke-linecap="round" stroke-linejoin="round" stroke-width="2.44" d="M1.22 229.4h247.74v63.1H1.22z"/>
+</g>
+</svg>
+</p>
+
+<p>
+<a href="https://nymtech.net/about/mixnet">Read more about how Nym works.</a></p>
+
+<p>
+Nym relies on a growing ecosystem of users, developers and researcher partners
+aligned with the mission to make sure Nym software is running, remains usable
+and solves real problems. While Nym is not designed for malicious computer
+users, it is true that they can use the network for malicious ends. This
+is largely because criminals and hackers have significantly better access to
+privacy and anonymity than do the regular users whom they prey upon. Criminals
+can and do build, sell, and trade far larger and more powerful networks than
+Nym on a daily basis. Thus, in the mind of this operator, the social need for
+easily accessible censorship-resistant private, anonymous communication trumps
+the risk of unskilled bad actors, who are almost always more easily uncovered
+by traditional police work than by extensive monitoring and surveillance anyway.</p>
+
+<p>
+In terms of applicable law, the best way to understand Nym is to consider it a
+network of routers operating as common carriers, much like the Internet
+backbone. However, unlike the Internet backbone routers, Nym mixnodes do not
+contain identifiable routing information about the source of a packet and do
+mix the user internet traffic with that of other users, making communications
+private and protecting not just the user content but the metadata
+(user's IP address, who the user talks to, when, where, from what device and
+more) and no single Nym node can determine both the origin and destination
+of a given transmission.</p>
+
+<p>
+As such, there is little the operator of this Exit Gateway can do to help you
+track the connection further. This Exit Gateway maintains no logs of any of the
+Nym mixnet traffic, so there is little that can be done to trace either legitimate or
+illegitimate traffic (or to filter one from the other).  Attempts to
+seize this router will accomplish nothing.</p>
+
+<!-- FIXME: US-Only section. Remove if you are a non-US operator -->
+<!--
+<p>
+Furthermore, this machine also serves as a carrier of email, which means that
+its contents are further protected under the ECPA. <a
+href="https://www.law.cornell.edu/uscode/text/18/2707">18
+USC 2707</a> explicitly allows for civil remedies ($1000/account
+<i>plus</i>  legal fees)
+in the event of a seizure executed without good faith or probable cause (it
+should be clear at this point that traffic with an originating IP address of
+FIXME_DNS_NAME should not constitute probable cause to seize the
+machine). Similar considerations exist for 1st amendment content on this
+machine.</p>
+-->
+<!-- FIXME: May or may not be US-only. Some non-US tor nodes have in
+     fact reported DMCA harassment... -->
+<!--
+<p>
+If you are a representative of a company who feels that this router is being
+used to violate the DMCA, please be aware that this machine does not host or
+contain any illegal content. Also be aware that network infrastructure
+maintainers are not liable for the type of content that passes over their
+equipment, in accordance with <a
+href="https://www.law.cornell.edu/uscode/text/17/512">DMCA
+"safe harbor" provisions</a>. In other words, you will have just as much luck
+sending a takedown notice to the Internet backbone providers.
+</p>
+-->
+
+<p>To decentralise and enable privacy for a broad range of services, this
+Exit Gateway adopts an <a href="https://nymtech.net/.wellknown/network-requester/exit-policy.txt">Exit Policy</a>
+in accordance with the <a href="https://tornull.org/">Tor Null ‘deny’ list</a>
+and the <a href="https://tornull.org/tor-reduced-reduced-exit-policy.php">Tor reduced policy</a>,
+which are two established safeguards.
+</p>
+
+<p>
+That being said, if you still have a complaint about the router, you may email the
+ <a href="mailto:>FIXME>">maintainer</a>. If complaints are related
+ to a particular service that is being abused, the maintainer will submit that to the
+ NYM Operators Community in order to add it to the Exit Policy cited above.
+If approved, that would prevent this router from allowing that traffic to exit through it.
+That can be done only on an IP+destination port basis, however. Common P2P ports are already blocked.</p>
+
+<p>
+You also have the option of blocking this IP address and others on the Nym network if you so desire.
+ The Nym project provides a <a href="https://explorer.nymtech.net/network-components/gateways">
+ web service</a> to fetch a list of all IP addresses of Nym Gateway Exit nodes that allow exiting to a
+specified IP:port combination. Please be considerate when using these options.</p>
+
+</main>
+</body>
+</html>
+```
+***
+### Reverse proxy
+You may set up a [reverse proxy](https://www.nginx.com/resources/glossary/reverse-proxy-server/) in order to serve this landing page with proper SSL and DNS management, i.e. to resolve it to https://nym-exit.<YOUR_DOMAIN> or https://nym-readme.<YOUR_DOMAIN>.
+
+The following assumes that you're owning a domain and that you've already set the Let's Encrypt certificates on your hosting, and you've copied those on your Gateway, i.e. copy the two Let's Encript pem files on your Gateway's home folder.
+Else you may obtain a Let's Encrypt certificate using a -[-certonly procedure](https://eff-certbot.readthedocs.io/en/latest/using.html#getting-certificates-and-choosing-plugins).
+
+```
+sudo apt install nginx
+```
+If you're running your Gateway (you should...) exposing only the needed ports as listed [here](https://nymtech.net/operators/nodes/maintenance.html?highlight=port#ports), you need to add the Nginx service to your ufw configuration:
+```
+sudo ufw app list
+sudo ufw allow 'Nginx Full'
+sudo ufw reload
+```
+Disable the default Nginx landing page
+```
+sudo systemctl status nginx
+sudo unlink /etc/nginx/sites-enabled/default
+sudo systemctl restart nginx
+```
+Add your endpoint configuration to Nginx changing <YOUR_DOMAIN> occurrencies below with your domain name, including the top-level domain, i.e. *avril4th.org*
+
+```
+sudo nano /etc/nginx/sites-available/nym-exit.<YOUR_DOMAIN>
+```
+
+```
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+
+  server_name nym-exit.<YOUR_DOMAIN>;
+
+  ssl_certificate <PATH_TO>/fullchain.pem;
+  ssl_certificate_key <PATH_TO>/privkey.pem;
+
+  access_log /var/log/nginx/access.log;
+  error_log /var/log/nginx/error.log;
+
+  location / {
+    proxy_pass http://127.0.0.1:8080;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  }
+}
+
+server {
+  listen 80;
+  listen [::]:80;
+
+  if ($host = nym-exit.<YOUR_DOMAIN>) {
+    return 301 https://$host$request_uri;
+  }
+
+  server_name <YOUR_DOMAIN> www.<YOUR_DOMAIN>;
+
+  return 301 https://<YOUR_DOMAIN>$request_uri;
+}
+```
+
+```
+sudo ln -s /etc/nginx/sites-available/nym-exit.<YOUR_DOMAIN> /etc/nginx/sites-enabled/
+sudo nginx -t
+sudo systemctl restart nginx
+```
+
+When done with the customization needs as described below, you'll need to upload the file and reference it as the `landing_page_assets_path` on the `[http]` section of the config.toml file that you'll find in the `~/.nym/gateways/<YOUR_GATEWAY_ID>/config/config.toml` file
+```
+nano ${HOME}/.nym/gateways/<YOUR_GATEWAY_ID>/config/config.toml
+```
+change
+```
+landing_page_assets_path = '<PATH_TO_YOUR_CUSTOM_FILE>'
+```
+
+If you're running the Gateway as a service as described [here](https://nymtech.net/operators/nodes/maintenance.html#systemd) and [here](https://nymtech.net/operators/nodes/maintenance.html#following-steps-for-nym-nodes-running-as-systemd-service) you may just restart your service
+```
+service nym-gateway stop
+service nym-gateway start
+```
+and check for the page being served either checking the service logs
+```
+sudo journalctl -u  nym-gateway.service | grep 8080
+```
+where you should read out
+```
+... Started NymNodeHTTPServer on 0.0.0.0:8080
+```
+or just point your browser to the URI which you set above, such as https://nym-exit.<YOUR_DOMAIN>
+
+<!--
+## Run Web Secure Socket (WSS) on Gateway
+
+Now you can run WSS on your `nym-node` with an Exit Gateway functionality.
+
+### WSS on a new Gateway
+
+These steps are for an operator who is setting up a [Gateway](gateway-setup.md) for the first time and wants to run it with WSS.
+
+1. Make sure to enable all necessary [ports](maintenance.md#configure-your-firewall) on the Gateway:
+
+```sh
+sudo ufw allow 1789,1790,8000,9000,9001,22/tcp, 9001/tcp
+```
+
+The Gateway will then be accessible on something like: *http://85.159.211.99:8080/api/v1/swagger/index.html*
+
+Are you seeing something like: *this node attempted to announce an invalid public address: 0.0.0.0.*?
+
+Please modify `[host.public_ips]` section of your config file stored as `~/.nym/gateways/<ID>/config/config.toml`.
+
+### WSS on an existing Gateway
+
+In case you already run a working Gateway and want to add WSS on it, here are the pre-requisites to running WSS on Gateways:
+
+* You need to use the latest `nym-gateway` binary [version](./gateway-setup.md#current-version) and restart it.
+* That will add the relevant fields to update your config.
+* These two values will be added and need to be amended in your config.toml:
+
+```sh
+clients_wss_port = 0
+hostname = ""
+```
+
+Then you can run this:
+
+```sh
+port=$1 // in the example below we will use 9001
+host=$2 = // this would be a domain name registered for your Gateway for example: mainnet-gateway2.nymtech.net
+
+
+sed -i "s/clients_wss_port = 0/clients_wss_port = ${port}/" ${HOME}/.nym/gateways/*/config/config.toml
+sed -i "s|hostname = ''|hostname = '${host}'|" ${HOME}/.nym/gateways/*/config/config.toml
+```
+The following shell script can be run:
+
+```sh
+#!/bin/bash
+
+if [ "$#" -ne 2 ]; then
+    echo "Usage: sudo ./install_run_caddy.sh <host_name> <port_to_run_wss>"
+    exit 1
+fi
+
+host=$1
+port_value=$2
+
+apt install -y debian-keyring debian-archive-keyring apt-transport-https
+apt --fix-broken install
+
+curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+
+curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
+
+apt update
+apt install caddy
+
+systemctl enable caddy.service
+
+cd /etc/caddy
+
+# check if Caddyfile exists, if it does, remove and insert a new one
+if [ -f Caddyfile ]; then
+    echo "removing caddyfile inserting a new one"
+    rm -f Caddyfile
+fi
+
+cat  <<EOF >> Caddyfile
+${host}:${port_value} {
+	@websockets {
+		header Connection *Upgrade*
+		header Upgrade websocket
+	}
+	reverse_proxy @websockets localhost:9000
+}
+EOF
+
+cat Caddyfile
+
+echo "script completed successfully!"
+
+systemctl restart caddy.service
+echo "have a nice day!"
+exit 0
+
+```
+
+Although your Gateway is Now ready to use its `wss_port`, your server may not be ready - the following commands will allow you to set up a properly configured firewall using `ufw`:
+
+```sh
+ufw allow 9001/tcp
+```
+
+Lastly don't forget to restart your Gateway, now the API will render the WSS details for this Gateway:
+
+-->

documentation/operators/src/nodes/setup-guides.md

@@ -1,11 +0,0 @@
-# Node Setup Guides
-
-To setup any type of Nym's node, start with building [Nym's platform](../binaries/building-nym.md) on the machine (VPS) where you want to run the node. Nodes will need to be bond to Nym's wallet, setup one [here](https://nymtech.net/docs/wallet/desktop-wallet.html).
-
-This section contains setup guides for the following node types:
-* [Mix Node](./mix-node-setup.md)
-* [Gateway](./gateway-setup.md)
-* [Network Requester](./network-requester-setup.md)
-* [Validator](./validator-setup.md)
-
-

documentation/operators/src/nodes/setup.md

@@ -0,0 +1,312 @@
+# Nym Node Setup & Run
+
+This documentation page provides a guide on how to set up and run a [NYM NODE](nym-node.md), along with explanations of available flags, commands, and examples.
+
+## Current version
+
+```
+<!-- cmdrun ../../../../target/release/nym-node --version -->
+```
+
+```admonish info
+**Migrating an existing node to a new `nym-node` is simple. The steps are documented [below](#migrate).**
+```
+
+```admonish note
+If you are a `nym-mixnode` or `nym-gateway` operator and you are not familiar with the binary changes called *Project Smoosh*, you can read the archived [Smoosh FAQ](../archive/faq/smoosh-faq.md) page.
+```
+
+## Summary
+
+> Any syntax in `<>` brackets is a user's unique variable. Exchange with a corresponding name without the `<>` brackets.
+
+To run a new node, you can simply execute the `nym-node` command without any flags. By default, the node will set necessary configurations. If you later decide to change a setting, you can use the `-w` flag.
+
+The most crucial aspect of running the node is specifying the `--mode`, which can be one of three: `mixnode`, `entry-gateway`, and `exit-gateway`.
+
+Currently `nym-node` binary enables to run only one `--mode` at a time. In the future the operators will be able to specify multiple modes within one `nym-node`. Our goal is to have as many nodes each running all the available modes enabled and let the Nym API to position the node acoording the network needs in the beginning of each epoch.
+
+Every `exit-gateway` mode is basically an `entry-gateway` with NR (Network Requester) and IPR (IP Packet Router) enabled. This means that every `exit-gateway` is automatically seen as an `entry-gateway` but not the opposite.
+
+Gateway operators can check out the performance, connectivity and much more in our new tool [harbourmaster.nymtech.net](https://harbourmaster.nymtech.net/).
+
+To determine which mode your node is running, you can check the `:8080/api/v1/roles` endpoint. For example:
+```
+# for http
+http://<IP_ADDRESS>:8080/api/v1/roles
+
+# for https reversed proxy
+https://<DOMAIN>/api/v1/roles
+```
+
+Everything necessary will exist on your node by default. For instance, if you're running a mixnode, you'll find that a NR (Network Requester) and IPR (IP Packet Router) address exist, but they will be ignored in `mixnode` mode.
+
+For more information about available endpoints and their status, you can refer to:
+```
+# for http
+http://<IP>:8080/api/v1/swagger/#/
+
+# for https reversed proxy
+https://<DOMAIN>/api/v1/swagger/#/
+```
+
+## Usage
+
+### Help Command
+
+There are a few changes from the individual binaries used in the past. For example by default `run` command does `init` function as well, local node `--id` will be set by default unless specified otherwise etcetera.
+
+Run `./nym-node --help` to see all available commands:
+
+~~~admonish example collapsible=true title="`./nym-node --help` output:"
+```
+<!-- cmdrun ../../../../target/release/nym-node --help -->
+```
+~~~
+
+<!--
+IN CASE CMD-RUN DOESN'T WORK HAR PASTE THIS:
+
+Usage: nym-node [OPTIONS] <COMMAND>
+
+Commands:
+  build-info           Show build information of this binary
+  bonding-information  Show bonding information of this node depending on its currently selected mode
+  node-details         Show details of this node
+  migrate              Attempt to migrate an existing mixnode or gateway into a nym-node
+  run                  Start this nym-node
+  sign                 Use identity key of this node to sign provided message
+  help                 Print this message or the help of the given subcommand(s)
+
+Options:
+  -c, --config-env-file <CONFIG_ENV_FILE>
+          Path pointing to an env file that configures the nym-node and overrides any preconfigured values [env: NYMNODE_CONFIG_ENV_FILE_ARG=]
+      --no-banner
+          Flag used for disabling the printed banner in tty [env: NYMNODE_NO_BANNER=]
+  -h, --help
+          Print help
+  -V, --version
+          Print version
+-->
+
+To list all available flags for each command, run `./nym-node <COMMAND> --help` for example `./nym-node run --help`:
+
+~~~admonish example collapsible=true title="`./nym-node run --help` output:"
+```
+<!-- cmdrun ../../../../target/release/nym-node run --help  -->
+```
+~~~
+
+<!-- IN CASE CMD-RUN DOESN'T WORK HAR PASTE THIS:
+
+Start this nym-node
+
+Usage: nym-node run [OPTIONS]
+
+Options:
+      --id <ID>
+          Id of the nym-node to use [env: NYMNODE_ID=] [default: default-nym-node]
+      --config-file <CONFIG_FILE>
+          Path to a configuration file of this node [env: NYMNODE_CONFIG=]
+      --deny-init
+          Forbid a new node from being initialised if configuration file for the provided specification doesn't already exist [env: NYMNODE_DENY_INIT=]
+      --init-only
+          If this is a brand new nym-node, specify whether it should only be initialised without actually running the subprocesses [env: NYMNODE_INIT_ONLY=]
+      --mode <MODE>
+          Specifies the current mode of this nym-node [env: NYMNODE_MODE=] [possible values: mixnode, entry-gateway, exit-gateway]
+  -w, --write-changes
+          If this node has been initialised before, specify whether to write any new changes to the config file [env: NYMNODE_WRITE_CONFIG_CHANGES=]
+      --bonding-information-output <BONDING_INFORMATION_OUTPUT>
+          Specify output file for bonding information of this nym-node, i.e. its encoded keys. NOTE: the required bonding information is still a subject to change and this argument should be treated only as a preview of future features [env: NYMNODE_BONDING_INFORMATION_OUTPUT=]
+  -o, --output <OUTPUT>
+          Specify the output format of the bonding information (`text` or `json`) [env: NYMNODE_OUTPUT=] [default: text] [possible values: text, json]
+      --public-ips <PUBLIC_IPS>
+          Comma separated list of public ip addresses that will be announced to the nym-api and subsequently to the clients. In nearly all circumstances, it's going to be identical to the address you're going to use for bonding [env: NYMNODE_PUBLIC_IPS=]
+      --hostname <HOSTNAME>
+          Optional hostname associated with this gateway that will be announced to the nym-api and subsequently to the clients [env: NYMNODE_HOSTNAME=]
+      --location <LOCATION>
+          Optional **physical** location of this node's server. Either full country name (e.g. 'Poland'), two-letter alpha2 (e.g. 'PL'), three-letter alpha3 (e.g. 'POL') or three-digit numeric-3 (e.g. '616') can be provided [env: NYMNODE_LOCATION=]
+      --http-bind-address <HTTP_BIND_ADDRESS>
+          Socket address this node will use for binding its http API. default: `0.0.0.0:8080` [env: NYMNODE_HTTP_BIND_ADDRESS=]
+      --landing-page-assets-path <LANDING_PAGE_ASSETS_PATH>
+          Path to assets directory of custom landing page of this node [env: NYMNODE_HTTP_LANDING_ASSETS=]
+      --http-access-token <HTTP_ACCESS_TOKEN>
+          An optional bearer token for accessing certain http endpoints. Currently only used for prometheus metrics [env: NYMNODE_HTTP_ACCESS_TOKEN=]
+      --expose-system-info <EXPOSE_SYSTEM_INFO>
+          Specify whether basic system information should be exposed. default: true [env: NYMNODE_HTTP_EXPOSE_SYSTEM_INFO=] [possible values: true, false]
+      --expose-system-hardware <EXPOSE_SYSTEM_HARDWARE>
+          Specify whether basic system hardware information should be exposed. default: true [env: NYMNODE_HTTP_EXPOSE_SYSTEM_HARDWARE=] [possible values: true, false]
+      --expose-crypto-hardware <EXPOSE_CRYPTO_HARDWARE>
+          Specify whether detailed system crypto hardware information should be exposed. default: true [env: NYMNODE_HTTP_EXPOSE_CRYPTO_HARDWARE=] [possible values: true, false]
+      --mixnet-bind-address <MIXNET_BIND_ADDRESS>
+          Address this node will bind to for listening for mixnet packets default: `0.0.0.0:1789` [env: NYMNODE_MIXNET_BIND_ADDRESS=]
+      --nym-api-urls <NYM_API_URLS>
+          Addresses to nym APIs from which the node gets the view of the network [env: NYMNODE_NYM_APIS=]
+      --nyxd-urls <NYXD_URLS>
+          Addresses to nyxd chain endpoint which the node will use for chain interactions [env: NYMNODE_NYXD=]
+      --wireguard-enabled <WIREGUARD_ENABLED>
+          Specifies whether the wireguard service is enabled on this node [env: NYMNODE_WG_ENABLED=] [possible values: true, false]
+      --wireguard-bind-address <WIREGUARD_BIND_ADDRESS>
+          Socket address this node will use for binding its wireguard interface. default: `0.0.0.0:51822` [env: NYMNODE_WG_BIND_ADDRESS=]
+      --wireguard-private-gw-ip <WIREGUARD_PRIVATE_IP>
+          Private IP address of the wireguard gateway. default: `10.1.0.1` [env: NYMNODE_WG_IP=]
+      --wireguard-announced-port <WIREGUARD_ANNOUNCED_PORT>
+          Port announced to external clients wishing to connect to the wireguard interface. Useful in the instances where the node is behind a proxy [env: NYMNODE_WG_ANNOUNCED_PORT=]
+      --wireguard-private-network-prefix <WIREGUARD_PRIVATE_NETWORK_PREFIX>
+          The prefix denoting the maximum number of the clients that can be connected via Wireguard. The maximum value for IPv4 is 32 and for IPv6 is 128 [env: NYMNODE_WG_PRIVATE_NETWORK_PREFIX=]
+      --verloc-bind-address <VERLOC_BIND_ADDRESS>
+          Socket address this node will use for binding its verloc API. default: `0.0.0.0:1790` [env: NYMNODE_VERLOC_BIND_ADDRESS=]
+      --entry-bind-address <ENTRY_BIND_ADDRESS>
+          Socket address this node will use for binding its client websocket API. default: `0.0.0.0:9000` [env: NYMNODE_ENTRY_BIND_ADDRESS=]
+      --announce-ws-port <ANNOUNCE_WS_PORT>
+          Custom announced port for listening for websocket client traffic. If unspecified, the value from the `bind_address` will be used instead [env: NYMNODE_ENTRY_ANNOUNCE_WS_PORT=]
+      --announce-wss-port <ANNOUNCE_WSS_PORT>
+          If applicable, announced port for listening for secure websocket client traffic [env: NYMNODE_ENTRY_ANNOUNCE_WSS_PORT=]
+      --enforce-zk-nyms <ENFORCE_ZK_NYMS>
+          Indicates whether this gateway is accepting only coconut credentials for accessing the mixnet or if it also accepts non-paying clients [env: NYMNODE_ENFORCE_ZK_NYMS=] [possible values: true, false]
+      --mnemonic <MNEMONIC>
+          Custom cosmos wallet mnemonic used for zk-nym redemption. If no value is provided, a fresh mnemonic is going to be generated [env: NYMNODE_MNEMONIC=]
+      --upstream-exit-policy-url <UPSTREAM_EXIT_POLICY_URL>
+          Specifies the url for an upstream source of the exit policy used by this node [env: NYMNODE_UPSTREAM_EXIT_POLICY=]
+      --open-proxy <OPEN_PROXY>
+          Specifies whether this exit node should run in 'open-proxy' mode and thus would attempt to resolve **ANY** request it receives [env: NYMNODE_OPEN_PROXY=] [possible values: true, false]
+  -h, --help
+          Print help
+-->
+
+The Wireguard flags currently have limited functionality, with `--wireguard-enabled` being the most relevant, enabling or disabling wireguard functionality.
+
+#### Flags Summary
+
+Some of the most useful flags and their explanation:
+
+- `--id <YOUR_ID>`: Local identifier of your node. This `<ID>` determines your config path located at `~/.nym/nym-nodes/<ID>/config/config.toml`, default value is `default-nym-node`
+- `--config-file <PATH>`: Used for the migrate command to indicate the location of the existing node config file. Default path is `~/.nym/nym-nodes/default-nym-node/config/config.toml`
+- `--deny-init`: Use this flag to prevent a new node from being initialized. It's recommended to use this after the first run to avoid accidental spinning up of a second node.
+- `--init-only`: Use this flag if you want to set up a node without starting it.
+- `--mode`: Determines the mode of the node and is always required.
+- `--write-changes`: Used to change values within the `config.toml` file after the node has been run.
+- `--mnemonic`: This is for when gateways are coconut-credentials-enforced, and this mnemonic is used as the `double_spend` prevention. This account needs credit in order for it to work.
+- `--expose-system-info <true/false>`: Sets your system info visibility on the network.
+- `--expose-system-hardware <true/false>`: Sets your system hardware info visibility on the network.
+- `--expose-crypto-hardware <true/false>`: Sets your crypto hardware info visibility on the network.
+
+
+## Commands & Examples
+
+**`nym-node` introduces a default human readible ID (local only) `default-nym-node`, which is used if there is not an explicit custom `--id <ID>` specified. All configuration is stored in `~/.nym/nym-nodes/default-nym-node/config/config.toml` or `~/.nym/nym-nodes/<ID>/config/config.toml` respectively.**
+
+### Initialise & Run
+
+When we use `run` command the node will do `init` as well, unless we specify with a flag `--deny-init`. Below are some examples of initialising and running `nym-node` with different modes (`--mode`) like `mixnode`, `entry-gateway`, `exit-gateway`.
+
+Please keep in mind that currently you can run only one functionality (`--mode`) per a `nym-node` instance. We are yet to finalise implement the multi-functionality solution under one node bonded to one Nyx account. Every `exit-gateway` can function as `entry-gateway` by default, not vice versa.
+
+```admonish success title=""
+**We recommend operators to setup an [automation](configuration.md#systemd) flow for their nodes!**
+
+In such case, you can `run` a node to initalise it or try if everything works, but then stop the proces and paste your entire `run` command syntax (below) to the `ExecStart` line of your `/etc/systemd/system/nym-node.service` and start the node as a [service](configuration.md#following-steps-for-nym-nodes-running-as-systemd-service).
+```
+
+```admonish note
+To prevent over-flooding of our documentation we cannot provide with every single command syntax as there is a large combination of possibilities. Please use a common sense and the explanation in `--help` option.
+```
+
+#### Mode: `exit-gateway`
+
+As part of the transition, `allowed.list` on Exit Gateway embedded Network Requester was depreciated.
+
+**Initialise and run:**
+```sh
+# simple default
+./nym-node  run  --mode exit-gateway
+
+# with other options
+./nym-node run --id <ID> --mode exit-gateway --public-ips "$(curl -4 https://ifconfig.me)" --hostname "<YOUR_DOMAIN>" --http-bind-address 0.0.0.0:8080 --mixnet-bind-address 0.0.0.0:1789 --wireguard-enabled true
+```
+
+Initialise only with a custom `--id` and `--init-only` command :
+
+```sh
+./nym-node run --id <ID> --init-only --mode exit-gateway --public-ips "$(curl -4 https://ifconfig.me)" --hostname "<YOUR_DOMAIN>" --http-bind-address 0.0.0.0:8080 --mixnet-bind-address 0.0.0.0:1789 true --wireguard-enabled true
+```
+
+Run the node with custom `--id` without initialising
+```sh
+./nym-node run --id <ID> --deny-init --mode exit-gateway
+```
+
+#### Mode: `entry-gateway`
+
+**Initialise and run:**
+```sh
+./nym-node run --mode entry-gateway
+```
+
+Initialise only with a custom `--id` and `--init-only` command:
+```sh
+./nym-node run --id <ID> --init-only --mode entry-gateway --public-ips "$(curl -4 https://ifconfig.me)" --hostname "<YOUR_DOMAIN>" --http-bind-address 0.0.0.0:8080 --mixnet-bind-address 0.0.0.0:1789
+```
+
+Run the node with custom `--id` without initialising:
+```sh
+./nym-node run --id <ID> --deny-init --mode entry-gateway
+```
+
+#### Mode: `mixnode`
+
+**Initialise and run:**
+```sh
+./nym-node run --mode mixnode
+```
+
+Initialise only with a custom `--id` and `--init-only` command:
+```sh
+./nym-node run --id <ID> --init-only --mode mixnode --verloc-bind-address 0.0.0.0:1790 --public-ips "$(curl -4 https://ifconfig.me)"
+```
+
+Run the node with custom `--id` without initialising:
+```sh
+./nym-node run --id <ID> --deny-init --mode mixnode
+```
+
+Run the node with custom `--id` without initialising:
+```sh
+./nym-node run --id <ID> --deny-init --mode entry-gateway
+```
+
+### Migrate
+
+```admonish caution
+Migration is a must for all deprecated nodes (`nym-mixnode`, `nym-gateway`). For backward compatibility we created an [archive section](../archive/nodes/setup-guides.md) with all the guides for individual binaries. However, the binaries from version 1.1.35 (`nym-gateway`) and 1.1.37 (`nym-mixnode`) onwards will no longer have `init` command.
+```
+
+Operators who are about to migrate their nodes need to configure their [VPS](vps-setup.md) and setup `nym-node` which can be downloaded as a [pre-built binary](../binaries/pre-built-binaries.md) or compiled from [source](../binaries/building-nym.md).
+
+To migrate a `nym-mixnode` or a `nym-gateway` to `nym-node` is fairly simple, use the `migrate` command with `--config-file` flag pointing to the original `config.toml` file, with a conditional argument defining which type of node this configuration belongs to. Examples are below.
+
+Make sure to use `--deny-init` flag to prevent initialisation of a new node.
+
+#### Mode: `mixnode`
+```sh
+# move relevant infor from config.toml
+./nym-node migrate --config-file ~/.nym/mixnodes/<MIXNODE_ID>/config/config.toml mixnode
+
+# initialise with the new nym-node config
+./nym-node run --mode mixnode --id <NYM-NODE_ID> --deny-init
+```
+
+#### Mode: `entry-gateway` and `exit-gateway`
+```sh
+# move relevant infor from config.toml
+./nym-node migrate --config-file ~/.nym/gateways/<GATEWAY_ID>/config/config.toml gateway
+
+# initialise with the new nym-node config
+./nym-node run --mode exit-gateway --id <NYM-NODE_ID> --deny-init # or change to entry-gateway
+```
+
+### Next steps
+
+If there are any problems checkout the troubleshooting section or report an issue.
+
+Follow up with [configuration](configuration.md) page for automation, reversed proxy setup and other tweaks, then head straight to [bonding](bonding.md) page to finalise your setup.

documentation/operators/src/nodes/vps-setup.md

@@ -0,0 +1,251 @@
+# VPS Setup & Configuration
+
+We aim for Nym Mixnet to be reliable and quality base layer of privacy accross the globe, while growing as distributed as possible. It's essential to have a fine tuned machine as a foundation for the nodes to meet the requirements and be rewarded for their work.
+
+```admonish info
+A suboptimally configured VPS often results in a non-functional node. To follow these steps carefully will save you time and money later on.
+```
+
+## VPS Hardware Specs
+
+You will need to rent a VPS to run your node on. One key reason for this is that your node **must be able to send TCP data using both IPv4 and IPv6** (as other nodes you talk to may use either protocol).
+
+Tor community created a very helpful table called [*Good Bad ISPs*](https://community.torproject.org/relay/community-resources/good-bad-isps/), use that one as a guideline for your choice of ISP for your VPS.
+
+Currently we run [performance testing](../testing/performance.md) events to find out the best optimization. Sphinx packet decryption is CPU-bound, so more fast cores the better throughput.
+
+### `nym-node`
+
+Before we conclude the testing with exact results, these are the rough specs:
+
+| **Hardware** | **Minimum Specification** w
+| :---         | ---:                      |
+| CPU Cores    | 4                         |
+| Memory       | 4 GB RAM                  |
+| Storage      | 40 GB                     |
+| Connectivity | IPv4, IPv6, TCP/IP, UDP   |
+| Bandwidth    | 1Tb                       |
+| Port speed   | 1Gbps                     |
+
+### Nyx validator
+
+The specification mentioned below is for running a full node alongside the nym-api. It is recommended to run `nym-api` and a full Nyx node on the same machine for optimum performance.
+
+Bear in mind that credential signing is primarily CPU-bound, so choose the fastest CPU available to you.
+
+#### Minimum Requirements
+
+| Hardware | **Minimum Specification**                      |
+|----------|--------------------------------------------|
+| CPU      | 8-cores, 2.8GHz base clock speed or higher |
+| RAM      | 16GB DDR4+                                 |
+| Disk     | 500 GiB+ NVMe SSD                          |
+
+#### Recommended Requirements
+
+| Hardware | **Minimum Specification**                       |
+|----------|---------------------------------------------|
+| CPU      | 16-cores, 2.8GHz base clock speed or higher |
+| RAM      | 32GB DDR4+                                  |
+| Disk     | 1 TiB+ NVMe SSD                             |
+
+
+#### Full node configuration (validator)
+
+To install a full node from scratch, refer to the [validator setup guide](validator-setup.md) and follow the steps outlined there.
+
+## VPS Configuration
+
+Before node or validator setup, the VPS needs to be configured and tested, to verify your connectivity and make sure that your provider wasn't dishonest with the offered services.
+
+### Install Dependencies
+
+SSH to your server as `root` or become one running `sudo -i` or `su`. If you prefer to administrate your VPS from a user environment, supply the commands with prefix `sudo`.
+
+Start with setting up the essential tools on your server.
+```sh
+# get your system up to date
+apt update -y && apt --fix-broken install
+
+# install dependencies
+apt -y install ca-certificates jq curl wget ufw jq tmux pkg-config build-essential libssl-dev git
+
+# double check ufw is installed correctly
+apt install ufw --fix-missing
+```
+
+### Configure your Firewall
+
+For a `nym-node` or Nyx validator to recieve traffic, you need to open ports on the server. The following commands will allow you to set up a firewall using `ufw`.
+
+1. Check `ufw`:
+```sh
+# check if you have ufw installed
+ufw version
+
+# if it is not installed, install with
+apt install ufw -y
+
+# enable ufw
+ufw enable
+
+# check the status of the firewall
+ufw status
+```
+
+2. Open all needed ports to have your firewall working correctly:
+```sh
+# for nym-node
+ufw allow 1789,1790,8000,9000,9001,22/tcp
+
+# in case of planning to setup a WSS (for Gateway functionality)
+ufw allow 9001/tcp
+
+# in case of reverse proxy for the swagger page (for Gateway optionality)
+ufw allow 8080,80,443
+
+# for validator
+ufw allow 1317,26656,26660,22,80,443/tcp
+```
+
+3. Check the status of the firewall:
+```sh
+ufw status
+```
+
+For more information about your node's port configuration, check the [port reference table](#ports-reference-table) below.
+
+## Setting the ulimit
+
+Linux machines limit how many open files a user is allowed to have. This is called a `ulimit`.
+
+`ulimit` is 1024 by default on most systems. It needs to be set higher, because Nym Nodes make and receive a lot of connections with each others.
+
+If you see errors such as:
+
+```sh
+Failed to accept incoming connection - Os { code: 24, kind: Other, message: "Too many open files" }
+```
+
+This means that the operating system is preventing network connections from being made.
+
+### Set the `ulimit` via `systemd` service file
+
+> **Replace `<NODE>` variable with the name of your service, for example `nym-node`** as we migrated from `nym-mixnode`, `nym-gateway` and `nym-network-requester`.
+
+The ulimit setup is relevant for maintenance of Nym Node only.
+
+Query the `ulimit` of your `<NODE>` with:
+
+```sh
+# for nym-node
+grep -i "open files" /proc/$(ps -A -o pid,cmd|grep <NODE> | grep -v grep |head -n 1 | awk '{print $1}')/limits
+
+# for nyx validator
+grep -i "open files" /proc/$(ps -A -o pid,cmd|grep nymd | grep -v grep |head -n 1 | awk '{print $1}')/limits
+```
+
+You'll get back the hard and soft limits, which looks something like this:
+
+```sh
+Max open files            65536                65536                files
+```
+
+If your output is **the same as above**, your node will not encounter any `ulimit` related issues.
+
+However if either value is `1024`, you must raise the limit via the systemd service file. Add the line:
+
+```sh
+LimitNOFILE=65536
+```
+
+Reload the daemon:
+
+```sh
+systemctl daemon-reload
+```
+
+or execute this as root for system-wide setting of `ulimit`:
+
+```sh
+echo "DefaultLimitNOFILE=65535" >> /etc/systemd/system.conf
+```
+
+Reboot your server, and restart your node. When it comes back, use:
+```sh
+# for nym-node
+cat /proc/$(pidof <NODE>)/limits | grep "Max open files"
+
+# for validator
+cat /proc/$(pidof nym-validator)/limits | grep "Max open files"
+```
+Make sure the limit has changed to `65535`.
+
+### Set the ulimit on `non-systemd` based distributions
+
+In case you chose tmux option for Nym Node automation, see your `ulimit` list by running:
+
+```sh
+ulimit -a
+
+# watch for the output line -n
+-n: file descriptors          1024
+```
+
+You can change it either by running a command:
+
+```sh
+ulimit -u -n 4096
+```
+
+or editing `etc/security/conf` and add the following lines:
+
+```sh
+# Example hard limit for max opened files
+username        hard nofile 4096
+
+# Example soft limit for max opened files
+username        soft nofile 4096
+```
+
+Then reboot your server and restart your node.
+
+
+## Ports reference tables
+
+All node-specific port configuration can be found in `$HOME/.nym/<NODE>/<YOUR_ID>/config/config.toml`. If you do edit any port configs, remember to restart your client and node processes.
+
+### Nym node port reference
+
+#### Mix Node functionality ports
+
+| Default port | Use                       |
+| ------------ | ------------------------- |
+| `1789`       | Listen for Mixnet traffic |
+| `1790`       | Listen for VerLoc traffic |
+| `8000`       | Metrics http API endpoint |
+
+#### Gateway functionality ports
+
+| Default port    | Use                           |
+|-----------------|-------------------------------|
+| `1789`          | Listen for Mixnet traffic     |
+| `9000`          | Listen for Client traffic     |
+| `9001`          | WSS                           |
+| `8080, 80, 443` | Reversed Proxy & Swagger page |
+
+#### Embedded Network Requester functionality ports
+
+| Default port | Use                       |
+|--------------|---------------------------|
+| `9000`       | Listen for Client traffic |
+
+### Validator port reference
+
+All validator-specific port configuration can be found in `$HOME/.nymd/config/config.toml`. If you do edit any port configs, remember to restart your validator.
+
+| Default port | Use                                  |
+|--------------|--------------------------------------|
+| `1317`         | REST API server endpoint             |
+| `26656`        | Listen for incoming peer connections |
+| `26660`        | Listen for Prometheus connections    |

documentation/operators/src/nodes/wallet-preparation.md

@@ -0,0 +1,17 @@
+# Nym Wallet Preparation
+
+## Mainnet
+
+Head to our [website](https://nymtech.net/download/) and download the Nym wallet for your operating system. If pre-compiled binaries for your operating system aren't available, you can build the wallet yourself with instructions [here](https://nymtech.net/docs/wallet/desktop-wallet.html).
+
+If you don't already have one, please create a Nym address using the wallet, and fund it with NYM tokens. The minimum amount required to bond a node is 100 `NYM`, but make sure you have a bit more to account for gas costs.
+
+`NYM` can be purchased via Bity from the wallet itself with BTC or fiat, and is currently present on several [exchanges](https://www.coingecko.com/en/coins/nym#markets).
+
+> Remember that you can **only** use Cosmos `NYM` tokens to bond your node. You **cannot** use ERC20 representations of `NYM` to run a node.
+
+
+## Sandbox testnet
+
+Make sure to download a wallet and create an account as outlined above. Then head to our [Operators Element channel](https://matrix.to/#/#operators:nymtech.chat) and request testnet tokens.
+