ObolNetwork/lido-charon-distributed-validator-node v0.3.14

on GitHub

This is LCDVN's v0.3.14 release and is a recommended update for all operators. It updates Charon to v1.11.3 and further tightens the defaults introduced in v0.3.12. Feedback is welcome and appreciated, please use github issues or discord if you have trouble with this release.

Update

# Stop the node
docker compose down
# Save your local .env / custom overrides
git stash
# Update your local copy of this repo
git pull
# Checkout this release
git checkout v0.3.14
# Re-apply your stashed changes
git stash apply
# Restart the node
docker compose up -d
# Check your node (may need sudo)
./grafana/security-check.sh

If you are updating from a release before v0.3.12, also read the v0.3.12 release notes.

Changes

• Charon v1.11.3 redacts credentials and API keys in beacon node and execution client URLs from its logs. If any of your beacon node or execution client URLs contain a password or API key, rotate it: earlier versions logged these URLs in full.
• Only P2P ports should face the internet. Ports that Docker publishes are not filtered by host firewalls such as ufw. On a VPS or bare-metal host, only the EL, CL and charon P2P ports need to accept incoming connections; keep everything else on 127.0.0.1. The example ports in docker-compose.override.yml.sample now bind to 127.0.0.1, so copy them as they are.
• security-check.sh checks more. It lists every non-P2P port your node publishes on a public address, and finds more signs of changes in the old data/grafana, including on recent Grafana versions. Files you added under grafana/ yourself, such as custom dashboards, are listed for review rather than reported as findings.
• Read-only mounts. Grafana's provisioning files and dashboards, and the validator ejector's exit messages, are mounted read-only. validator-ejector/ is now in .gitignore.
• Nethermind's JSON-RPC no longer enables the Trace and Parity modules, which nothing in this stack uses.
• Re-enabling Grafana logins: the README's example now turns anonymous access off and asks you to reset the admin password before restarting. If you followed the old example, run docker compose exec grafana grafana cli admin reset-admin-password '<a strong password>'.

What's Changed

• feat: hardening follow up by @OisinKyne in #342

Full Changelog: v0.3.13...v0.3.14