eureka-cpu
665c6ae2da
Adds nethermind as a supported execution client alongside the four beacon
clients (nimbus, prysm, teku, lodestar).
New files:
- clanServices/dvt/tests/el/nethermind.nix: nethermind descriptor
- clanServices/dvt/tests/nethermind-{nimbus,prysm,teku,lodestar}.nix
- clanServices/dvt/roles/ecl/nethermind.nix: nethermind NixOS module
- clanServices/dvt/tests/fixtures/execution/chainspec-nethermind.json:
nethermind requires a chainspec JSON rather than the EIP-1559 genesis
format used by other clients
- nixosModules/nethermind/default.nix: nethermind module fixes for
devnet config
Reviewed-on: #44
Overview
DVT (Distributed Validator Technology) clan service for deploying a full Ethereum validator stack: execution + consensus nodes, threshold signing via dirk, and operator access.
Roles
admin
Full dirk wallet permissions (create accounts, lock/unlock wallets, etc.).
Each admin machine gets a CA-signed mTLS client certificate and a wrapped ethdo CLI.
ecl
Execution + Consensus Layer node — an execution client + beacon node pair
colocated on the same machine, connected via the authenticated Engine API.
The pair is intended to act as a relay that the validator role talks to;
it holds no validator keys of its own (signing happens through the signer
role).
The role is designed to support a choice of client implementations on each
side, but only geth and nimbus are wired up today. executor.package and
beacon.package are the selector options — extend their enums and add a
matching roles/ecl/<name>.nix to onboard another client.
| Option | Default | Description |
|---|---|---|
network |
null |
null / "sepolia" / "holesky" / "hoodi". null means mainnet (or a custom devnet when the deployer supplies genesis + chain id directly). |
executor.package |
"geth" |
Execution client. Currently only "geth". |
beacon.package |
"nimbus" |
Beacon client. Currently only "nimbus". |
signer
Runs the dirk daemon — distributed remote key manager for threshold signing. Multiple signer machines cooperate via DKG so no single server holds a complete signing key. Server IDs and the peers map are auto-generated from alphabetical machine order. Permissions for admin and validator clients are auto-derived from role membership.
| Option | Default | Description |
|---|---|---|
serverId |
auto-generated | Unique numeric ID for this server |
listenPort |
9091 |
gRPC listen port |
listenAddress |
0.0.0.0 |
gRPC bind address |
metricsPort |
9099 |
Prometheus metrics port |
logLevel |
"Information" |
Fatal, Error, Warning, Information, Debug, Trace |
storagePath |
/var/lib/dirk |
Path for wallets and slashing protection DB |
permissions |
{} |
Additional per-client permission overrides |
validator
Runs vouch — the validator client that performs attestation and block proposal
duties. Vouch connects to dirk signers via gRPC for threshold signing and to
beacon nodes on ecl machines for consensus duties. Signer endpoints, beacon
endpoints, and wallet accounts are all auto-discovered from the inventory.
Each validator machine gets a CA-signed mTLS client certificate (sign-only
permissions) and a wrapped ethdo CLI.
| Option | Default | Description |
|---|---|---|
logLevel |
"info" |
none, trace, debug, warn, info, err, fatal |
metricsPort |
8081 |
Prometheus metrics endpoint port (localhost-only) |