dvt-lite/clanServices/dirk

Usage

inventory.instances = {
  dirk = {

    module = {
      name = "dirk";
      input = "dvt-lite";
    };

    # Admin machines get full wallet permissions (auto-derived from role membership)
    roles.admin.machines.admin = { };

    # Signer machines get sign-only permissions (auto-derived from role membership)
    roles.signer.machines.signer = { };

    # Server machines — serverId and peers are auto-generated
    roles.server.machines = {
      dirk-one = { };
      dirk-two = { };
      dirk-three = { };
    };

    # Shared settings across all servers
    roles.server.settings = {
      logLevel = "Debug";
    };
  };
};

Overview

Dirk is an Ethereum 2 distributed remote key manager that provides threshold signing. It exposes a gRPC interface for wallet operations while protecting validator private keys. Multiple dirk instances cooperate via distributed key generation (DKG) so that no single server ever holds a complete signing key.

CA Distribution

The shared certificate authority (CA) is applied to every machine that uses this service via perMachine.nixosModule. The CA key is generated once and used to sign all server and client certificates. It is never deployed to any machines.

Roles

1. Admin

Machines with full access to dirk servers (e.g. wallet creation, account management). Each admin receives a TLS certificate signed by the CA and the ethdo CLI for wallet operations. Permissions are automatically set to DistributedWallet = "All".

2. Signer

Machines with sign-only access to dirk servers (e.g. validator signing requests). Each signer receives a TLS certificate signed by the CA and the ethdo CLI for wallet operations. Permissions are automatically set to DistributedWallet = ["Access account" "Sign"].

3. Server

Dirk signing server instances. Each server participates in distributed key generation and threshold signing. Server IDs and the peers map are auto-generated from alphabetical machine order. Permissions are auto-derived from admin and signer role membership — no manual permissions configuration is needed.

Configurable settings:

Option	Default	Description
serverId	auto-generated	Unique numeric ID for this server
listenPort	9091	gRPC listen port
listenAddress	0.0.0.0	gRPC bind address
metricsPort	9099	Prometheus metrics port
logLevel	"Information"	One of Fatal, Error, Warning, Information, Debug, Trace
storagePath	/var/lib/dirk	Path for wallets and slashing protection DB
permissions	{}	Additional per-client overrides merged on top of auto-derived permissions

Available permission operations:

• "All"
• "None"
• "Sign"
• "Sign beacon attestation"
• "Sign beacon proposal"
• "Access account"
• "Create account"
• "Lock wallet"
• "Unlock wallet"
• "Lock account"
• "Unlock account"

Prefix with ~ to deny.