Deterministic calculators and pre-flight checklists to size physical hardware, model state growth, budget electricity and cloud expenses, and verify deployment security.
An interactive operational checklist covering server hardening, Linux kernel tuning, JWT cryptography, and observability before putting economic stake onto mainnet.
Disable root password login and password authentication in /etc/ssh/sshd_config.
sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_configKeep P2P ports (30303, 9000) open to public; restrict RPC (8545) and Engine API (8551) to 127.0.0.1.
sudo ufw default deny incoming && sudo ufw allow 22/tcp && sudo ufw allow 30303 && sudo ufw enableNever run execution or consensus client daemons as root. Create a dedicated system user without login shell.
sudo useradd -r -s /usr/sbin/nologin -d /var/lib/ethereum ethereumEnable unattended-upgrades so critical Linux kernel and OpenSSL CVE patches install automatically.
sudo apt-get install -y unattended-upgrades && sudo dpkg-reconfigure -plow unattended-upgradesProof-of-Stake consensus requires sub-second clock accuracy. Out-of-sync clocks cause missed attestations.
sudo apt-get install -y chrony && timedatectl statusBlockchain clients maintain thousands of open TCP socket connections and database LevelDB file locks.
echo '* soft nofile 65536' | sudo tee -a /etc/security/limits.confDisable access-time file tracking in /etc/fstab to eliminate unnecessary NVMe write cycles.
sudo nano /etc/fstab # add noatime option to data drive mountA fast swapfile prevents the Linux kernel OOM-killer from instantly terminating clients during memory spikes.
sudo fallocate -l 8G /swapfile && sudo chmod 600 /swapfile && sudo mkswap /swapfile && sudo swapon /swapfileExecution and consensus clients authenticate over port 8551 via this shared cryptographic token.
openssl rand -hex 32 | sudo tee /var/lib/ethereum/jwt/jwt.hex && sudo chmod 600 /var/lib/ethereum/jwt/jwt.hexVerify sha256 checksums from the client's official release page before running newly downloaded binaries.
sha256sum -c geth-alltools-linux-amd64-*.tar.gz.ascEnsure service files include Restart=always and RestartSec=5s so nodes recover from OS reboots.
sudo systemctl daemon-reload && sudo systemctl enable --now geth lighthouseExpose client metrics on 127.0.0.1:6060 (Geth) and 127.0.0.1:5054 (Lighthouse) for Grafana alerting.
--metrics --metrics.addr 127.0.0.1 --metrics.port 6060Cap systemd journal size to prevent unrotated node logs from consuming 100% of the root disk volume.
echo 'SystemMaxUse=2G' | sudo tee -a /etc/systemd/journald.conf && sudo systemctl restart systemd-journaldRecord validator seed words on offline metal plates or paper. Never store withdrawal keys on the active server.