ObolNetwork/lido-charon-distributed-validator-node v0.3.12 on GitHub

This is LCDVN's v0.3.12 release and is a recommended update for all operators. It makes the bundled monitoring private by default. Charon and the clients are unchanged from v0.3.11. Feedback is welcome and appreciated, please use github issues or discord if you have trouble with this release.

Update

# Stop the node
docker compose down
# Save your local .env / custom overrides
git stash
# Update your local copy of this repo
git pull
# Checkout this release
git checkout v0.3.12
# Re-apply your stashed changes
git stash apply
# Restart the node
docker compose up -d

Monitoring is now private by default

This release tightens the default monitoring setup. Charon, the clients and remote-write to Obol's monitoring are unaffected.

Grafana listens on 127.0.0.1 only. To view it from another machine, use an SSH tunnel and open http://localhost:3000:
```
ssh -L 3000:127.0.0.1:3000 <user>@<node>
```
If you need Grafana on another address, set MONITORING_IP_GRAFANA, and only behind a provider or network firewall: ports published by Docker are not filtered by host firewalls such as ufw.
Grafana is read-only. Visitors can view every dashboard, but can't make changes, and there is no login form. Dashboards and datasources are provisioned from this repository.
Grafana starts with a fresh database in a Docker volume (grafana-data) and runs as a non-root user. Your old data/grafana folder is no longer used.
The log collector (the monitoring-log-collector profile) now reads container logs through a read-only Docker API proxy (a new docker-socket-proxy container) instead of mounting the Docker socket.

Important

Anything you created in the Grafana UI, such as custom dashboards, alert rules or contact points, does not carry over to the fresh Grafana. Export custom dashboards before updating (Share > Export). The README's Security section explains how to set them up again, either as files under grafana/dashboards/ or by re-enabling logins with your own admin password.

After updating

Check your previous Grafana data. The script lists any accounts, tokens, datasources or plugins in the old data/grafana that this stack doesn't create. It may need sudo:
```
./grafana/security-check.sh
```
If it reports anything, please let us know at security@obol.tech.
Delete the old Grafana data, which is no longer used:
```
sudo rm -rf data/grafana
```

What's Changed

Full Changelog: v0.3.11...v0.3.12