Community Servers

1. Libbitcoin servers#

The libbitcoin community maintains two public bs servers:

Both have two AMD EPYC 7F32 processors (Zen 2), 16 cores and 32 threads in all, and no GPU.

A --hardware-optimized build on either reports (Command Line):

$ bs --hardware
Hardware configuration (x64)...
aesni....... platform:1 compiled:1.
vaes........ platform:0 compiled:0.
shani....... platform:1 compiled:1.
sha512...... platform:0 compiled:0.
sse41....... platform:1 compiled:1.
avx2........ platform:1 compiled:1.
avx512...... platform:0 compiled:0.
avxifma..... platform:0 compiled:0.
avx512ifma.. platform:0 compiled:0.
cuda........ platform:0 compiled:1.

2. Running a community server#

A community server needs a DNS name for its address, a TLS certificate for that name, and a CurveZMQ key pair. This example uses node.example.com on Linux.

1. Get a TLS certificate. Let's Encrypt issues free certificates that clients trust without configuration. Certbot proves control of the name by answering on port 80, which bs does not use. Open port 80 to the machine, then:

$ sudo certbot certonly --standalone --key-type ecdsa \
    --elliptic-curve secp256r1 -d node.example.com

bs accepts ECDSA keys on P-256 or P-384, not RSA. Certbot writes the certificate chain and its key to /etc/letsencrypt/live/node.example.com/, readable only by root. Copy them where bs runs, owned by its user:

$ sudo install -o bitcoin -m 600 \
    /etc/letsencrypt/live/node.example.com/fullchain.pem \
    /etc/letsencrypt/live/node.example.com/privkey.pem ~bitcoin/

2. Renew it. Let's Encrypt certificates last 90 days, and certbot renews them automatically, again over port 80. bs reads its certificates when it starts, so each renewal must copy the new files and restart bs. Certbot runs a deploy hook after each renewal; place the install command above, followed by the restart, in /etc/letsencrypt/renewal-hooks/deploy/bs.sh.

Note. bx is not quite ready yet. The commands used here are not yet available in a bx release.

3. Create the CurveZMQ key pair. bx curve-new makes a server secret key from 256 bits of entropy. bx dice-rolls gives the number of throws, 256 for a coin, and bx dice-entropy converts them. Flip a coin that many times, write the flips down as one string of digits (heads 1, tails 0), and convert them:

$ bx dice-rolls --sides 2 --bits 256
$ bx dice-entropy --sides 2 1101001110...
$ bx curve-new <entropy>
$ bx curve-public '<secret key>'

A die of up to 16 sides also works. Write each roll as one 0-based digit, using a to f above 9, and give its sides to both commands. For example, a six-sided die takes --sides 6 and 102 rolls. dice-entropy rejects a sequence that would bias the entropy, which must then be rolled again.

curve-new prints the secret key and curve-public its public key, both Z85 encoded. Z85 includes #, which a configuration file reads as a comment, so curve-new reports The entropy produced an invalid key. when either key contains one, and the coin must be flipped again. Quote the keys on the command line, as they contain shell characters.

4. Configure the services. Bind each service on every adapter, clear and secure, with the certificate and key from step 1 and the ZMQ secret key from step 3:

[inbound]
bind = 0.0.0.0:8333
bind = [::]:8333

[electrum]
bind = 0.0.0.0:8580
bind = [::]:8580
safe = 0.0.0.0:8543
safe = [::]:8543
cert_path = fullchain.pem
key_path = privkey.pem

[zmq]
bind = 0.0.0.0:8380
bind = [::]:8380
safe = 0.0.0.0:8343
safe = [::]:8343
key = <secret key>

The other client services follow [electrum], each on its own ports (Conventional Ports). With no zmq.cert lines, any ZMQ client may connect. Leave [admin] on the local machine (Admin site).

5. Allow web pages. The HTTP services accept cross-origin requests from web pages on other sites (CORS). With no origin setting, a service accepts a request from any page and returns the page's origin in Access-Control-Allow-Origin, so a block explorer or wallet hosted elsewhere can query the server from a browser. To admit only particular sites, list them:

[native]
origin = explorer.example.org:443

Each origin is a host and port, without a scheme. A service with an origin list also refuses the pages it serves itself, unless its own host and port are listed.

A request from any other page is then refused. Requests that carry no Origin, such as those from wallets and command line tools, are not affected. allow_opaque_origin admits pages opened as local files (HTTP services).

6. Publish the ZMQ public key. TLS clients verify the server by its certificate, but a CurveZMQ client must already hold the server's public key. Publish the curve-public key beside the server's name and ports, for clients to configure as the server key. Never publish the secret key.