> ## Documentation Index
> Fetch the complete documentation index at: https://docs.skale.space/llms.txt
> Use this file to discover all available pages before exploring further.

# Run a Supernode on Base

> Setup Process for a SKALE Validator Supernode on Base Mainnet

## Setup Validator

1. **Prepare for Validator Registration**

   Before registering as a validator, complete the following preparations:

   **Obtain Ethereum Software Wallet or Hardware wallet**

   Get a Ledger, Hardware or Software wallet ready like Metamask/Portis/Bitski/Torus/myetherwallet.

   **Fund Validator Wallet with ETH (on Base)**

   Be ready to have some ETH on Base to link your validator supernode.
   These are transactions with SKALE Manager deployed on Base Mainnet, and therefore require ETH on Base.

   *Minimum ETH: 1.0*

   **Get SKALE Manager contract ABIs from SKALE:** [Github](https://github.com/skalenetwork/skale-network/blob/master/releases/base-mainnet/skale-manager/1.12.0/skale-manager-1.12.0-stable.0-abi.json)

   **Fund SRW Wallet with ETH**

   Be ready to fund ETH in your self-recharging wallet (SRW). See [Self-recharging wallet documentation](/validators/validator-cli/self-recharging-wallets).

2. **Install SKALE Validator CLI**

   SKALE Validator CLI is the validator client interface for registering a new validator into the network. These are the type of
   operations that can be done with the Validator CLI:

   * Register Validator (Set Commission Rate)
   * Link all validator supernode addresses to a validator wallet address

   [See the SKALE Validator CLI documentation](/validators/validator-cli/overview)

   <Note>
     Validator CLI doesn't have to be installed in the same server as the node-cli. This can be set up on Mac or Linux.
     This does not need to be included in every supernode. Setting up once per validator organization is sufficient.
   </Note>

   Download the SKALE Validator CLI binary:

   ```shell theme={null}
   VERSION_NUM=1.3.3 && sudo -E bash -c "curl -L https://github.com/skalenetwork/validator-cli/releases/download/$VERSION_NUM/sk-val-$VERSION_NUM-`uname -s`-`uname -m` >  /usr/local/bin/sk-val"
   ```

   Apply executable permissions to the binary:

   ```shell theme={null}
   chmod +x /usr/local/bin/sk-val
   ```

   Set SKALE Manager contracts info and set the Base Mainnet endpoint:

   ```shell theme={null}
   sk-val init -e [BASE_ENDPOINT] -c [ABI] --wallet [software/ledger]
   ```

   Required arguments:

   * `--endpoint/-e` - RPC endpoint of the Base Mainnet network where SKALE Manager is deployed (http or https)
   * `--contracts-url/-c` - URL to SKALE Manager contracts ABI and addresses
   * `-w/--wallet` - Type of the wallet that will be used for signing transactions (software or ledger)

   The SKALE Manager ABI for Base Mainnet is available at:

   ```
   https://raw.githubusercontent.com/skalenetwork/skale-network/master/releases/base-mainnet/skale-manager/1.12.0/skale-manager-1.12.0-stable.0-abi.json
   ```

3. **Setup Wallet**

   For software wallet, save private key into a file (replace `[YOUR PRIVATE KEY]` with your wallet private key):

   ```shell theme={null}
   echo [YOUR PRIVATE KEY] > ./pk.txt
   ```

   For Ledger wallet, install ETH ledger application and initialize device with `setup-ledger` command:

   ```shell theme={null}
   sk-val wallet setup-ledger --address-index [ADDRESS_INDEX] --keys-type [KEYS_TYPE]
   ```

   Required arguments:

   * `--address-index` - Index of the address to use (starting from `0`)
   * `--keys-type` - Type of the Ledger keys (live or legacy)

   <Note>
     Make sure you enabled blind signing on ETH application settings. Otherwise transactions won't work
   </Note>

4. **Register as a new SKALE validator**

   <Warning>
     DON'T REGISTER A NEW VALIDATOR IF YOU ALREADY HAVE ONE ON BASE! check : `sk-val validator ls`. For additional supernode set up, please go to Step 3.
   </Warning>

   ```shell theme={null}
   sk-val validator register -n [NAME] -d [DESCRIPTION] -c [COMMISSION_RATE]
   ```

   Required arguments:

   * `--name/-n` - Validator name
   * `--description/-d` - Validator description (preferably organization info)
   * `--commission-rate/-c` - Commission rate (percent %)

   Optional arguments:

   * `--pk-file` - Path to file with private key (only for `software` wallet type)
   * `--gas-price` - Gas price value in Gwei for transaction (if not specified doubled average network value will be used)
   * `--yes` - Confirmation flag

5. **Ensure validator is added to the trusted list**

   To ensure that your validator is added to trusted contact SKALE team.

   <Note>
     This is a temporary process, which will be removed as the community matures.
   </Note>

## Setup SGX

6. **SGX Overview**

   SGX is a secure storage for BLS private key shares, which are used in consensus to sign new blocks.
   SGX is also used for private key shares.

   SKALE DKG uses Intel® SGX server to store account and BLS keys and all the data related to DKG process
   and it also uses the random number generator provided by Intel® SGX. For more information,
   please check [here](/developers/dkg-with-bls).

   Clients connect to the server, authenticate to it using TLS 1.0 protocol with client certificates, and then
   issue requests to the server to generate crypto keys and perform cryptographic operations. The keys are
   generated inside the secure SGX enclave and never leave the enclave unencrypted.

7. **Prepare SGX Server**

   To be able to set up an SGXWallet, validators are required to have SGX compatible servers. Before installing SGXWallet, validators must make sure that SGX is enabled in the server.

   **Server Requirements:**

   * Ubuntu 22.04 LTS (Jammy Jellyfish)
   * SGX-enabled Intel processor
   * Minimum 8 GB
   * Swap size equals to half (1/2) of RAM size

8. **Configure Network for SGX**

   It's required to setup VPN between supernodes and SGX server. Ports 1026-1031 should open only to SKALE supernodes, not public ports should be accessible by supernode.

9. **Install and Configure Packages for SGX**

   Before running SGXWallet install the following packages

   **Install general tools:**

   ```shell theme={null}
   sudo apt-get install -y build-essential make cmake gcc g++ yasm  python libprotobuf10 flex bison automake libtool texinfo libgcrypt20-dev libgnutls28-dev
   ```

   **Install Docker:**

   ```shell theme={null}
   sudo apt-get install -y docker
   ```

   **Install docker.io:**

   ```shell theme={null}
   sudo apt-get install -y docker.io
   ```

   **Install docker compose:**

   ```shell theme={null}
   sudo apt-get install -y docker-compose-plugin
   ```

   **Install cpuid and libelf-dev packages:**

   ```shell theme={null}
   sudo apt-get install -y libelf-dev cpuid
   ```

   **Verify your processor supports Intel SGX with:**

   ```shell theme={null}
   cpuid | grep SGX:
   ```

   <Warning>
     After installing docker make sure that `live-restore` option
     is enabled in `/etc/docker/daemon.json`. See more info in the [docker docs](https://docs.docker.com/config/containers/live-restore/).
   </Warning>

   **Disable automatic updates**

   It's recommended to only update the SGXWallet server if there are critical security fixes. This is because SGXWallet is based on new low
   level technology, and kernel updates may break the system. Currently SGX is tested on 5.15\* kernels. It's best to avoid minor version updates too.

   To make sure `apt update` won't update the kernel you should use apt-mark hold command:

   ```shell theme={null}
   sudo apt-mark hold linux-generic linux-image-generic linux-headers-generic
   ```

   Also if you configured unattended upgrades, you should make sure kernel won't update automatically. To do this, add the following lines to `/etc/apt/apt.conf.d/50unattended-upgrades` file:

   ```shell theme={null}
   Unattended-Upgrade::Package-Blacklist {
           "linux-generic";
           "linux-image-generic";
           "linux-headers-generic";
   };
   ```

   **Output**

   ```shell theme={null}
   SGX: Software Guard Extensions supported = true
   ```

10. **Download SGXWallet source code**

    Clone SGX Wallet Repository to your SGX compatible Server:

    ```shell theme={null}
    git clone https://github.com/skalenetwork/sgxwallet/
    cd sgxwallet
    git checkout tags/1.10.3
    ```

11. **Enable SGX**

    SGX Wallet repository includes the sgx\_enable utility. To enable SGX run:

    ```shell theme={null}
    sudo ./sgx_enable
    ```

    **Install SGX Library:**

    ```shell theme={null}
    cd scripts
    sudo ./sgx_linux_x64_driver_2.5.0_2605efa.bin
    cd ..
    ```

    **System Reboot:**

    <Note>
      Reboot your machine after driver install!
    </Note>

    **Check driver installation:**
    To check that isgx device is properly installed run this command:

    ```shell theme={null}
    ls /dev/isgx
    ```

    For newer machine device should be

    ```shell theme={null}
    ls /dev/sgx_enclave
    ```

    If you don't see the neither of isgx and sgx\_enclave device, you need to troubleshoot your driver installation from [here](https://github.com/skalenetwork/sgxwallet/blob/develop/docs/common/enabling-sgx.md).

    **Another way to verify Intel SGX is enabled in BIOS:**

    <Note>
      ***If you already executed the previous steps please move to STEP 3***
    </Note>

    Enter BIOS by pressing the BIOS key during boot. The BIOS key varies by manufacturer and could be F10, F2, F12, F1, DEL, or ESC.

    Usually Intel SGX is disabled by default.

    To enable:

    find the Intel SGX feature in BIOS Menu (it's usually under the "Advanced" or "Security" menu)
    Set SGX in BIOS as enabled (preferably) or software-controlled.
    save your BIOS settings and exit BIOS.
    Enable "software-controlled" SGX
    Software-controlled means that SGX needs to be enabled by running a utility.

12. **Update docker-compose.yaml**

    Open run\_sgx directory

    ```shell theme={null}
    cd sgxwallet/run_sgx;
    ```

    On some machines, the SGX device isn't **/dev/mei0** but a different device, such as **/dev/bs0** or **/dev/sg0**. In this case please edit docker-compose.yml on your machine to specify the correct device to use:

    ```shell theme={null}
    vi docker-compose.yml
    ```

    make sure `image` is skalenetwork/sgxwallet:\<1.10.3> in docker-compose and it will look like:

    ```shell theme={null}
    version: '3'
    services:
      sgxwallet:
        image: skalenetwork/sgxwallet:1.10.3
        network_mode: host
        devices:
          - "/dev/isgx" # leave on of them
          - "/dev/sgx_enclave"
        volumes:
          - ./sgx_data:/usr/src/sdk/sgx_data
          -  /dev/urandom:/dev/random
        logging:
          driver: json-file
          options:
            max-size: "10m"
            max-file: "4"
        restart: unless-stopped
        command: -y -V
        healthcheck:
          test: ["CMD", "ls", "/dev/isgx", "/dev/sgx_enclave"]
    ```

13. **Spin up SGXWallet Container**

    **Start SGX Wallet Containers**
    To run the server as a daemon:

    ```shell theme={null}
    sudo docker compose up -d
    ```

14. **Securely save generated backup key**

    The backup key is automatically stored in *sgx\_data* directory.

    The filename of the key is sgx\_wallet\_backup\_key.txt, and is generated the first time the SGX wallet is started.

    <Warning>
      **This key must be securely recorded and stored.**
      Be sure to store this key in a safe place, then go into a docker container and securely remove it with the following command:
    </Warning>

    ```shell theme={null}
    docker exec -it <SGX_CONTAINER_NAME> bash && apt-get install secure-delete && srm -vz backup_key.txt
    ```

    <Note>
      You should enable SSL/TLS for your SGX supernode. Make sure you finalize this before you move on to your next step.
    </Note>

15. **Backup sgx data**

    It's strongly recommended to backup sgx data regularly. The guide can be found [here](https://github.com/skalenetwork/sgxwallet/blob/stable/docs/backup-procedure.md).

## Supernode Setup

16. **Prepare Supernode Server**

    After Setting up SGX Wallet and create certifications, validators can download the SKALE Node CLI executables register and maintain your SKALE supernode.
    This process downloads docker container images from docker hub and spins up SKALE supernode functionalities. Some base containers such as SKALE Admin,
    Bounty, TransactionManager will be created during installation for each supernode.

    This document contains instructions on how to setup supernode using SKALE Node CLI.

    Supernode server should follow compliance requirements which will be checked during installing SKALE supernode software.
    Please make sure:

    **General requirements**

    * A Linux x86\_64 machine
    * Ubuntu 22.04 LTS (Jammy Jellyfish)
    * Separate not mounted block device - 2 Tb
    * 8 physical cores
    * 32GB RAM
    * 16GB Swap

    More information can be found here: [Compliance requirements](/validators/compliance-requirements)

17. **Install Packages for Supernode**

    Before setting up supernode you should make sure that the following software is installed:

    * docker
    * docker-compose
    * nftables
    * lvm2

    <Note>
      After docker installation make sure that the `live-restore` option is enabled in `/etc/docker/daemon.json`. See more info in the [docker docs](https://docs.docker.com/config/containers/live-restore/).
    </Note>

    If you have any concerns or questions, please don't hesitate to reach out to SKALE Team leads on [Discord](http://discord.gg/skale).

18. **Install Node CLI**

    Download the Node CLI binary:

    ```shell theme={null}
    curl -L https://github.com/skalenetwork/node-cli/releases/download/3.2.0/skale-3.2.0-Linux-x86_64 > /usr/local/bin/skale
    ```

    Apply executable permissions and test the installation:

    ```shell theme={null}
    chmod +x /usr/local/bin/skale
    sudo skale --help
    ```

    <Note>
      You should run node-cli commands using sudo
    </Note>

    More information can be found [here](/validators/node-cli/overview).

19. **Configure .env**

    Configuration parameters are passed to Node CLI through `.env` file. It should contain the following variables:

    * `ENDPOINT` - RPC endpoint of Base Mainnet where SKALE Manager is deployed (`http` or `https`)
    * `NODE_VERSION` - SKALE node branch to use (set to `base-mainnet`)
    * `FILEBEAT_HOST` - URL to the Filebeat log server
    * `MANAGER_CONTRACTS` - SKALE Manager contract address on Base Mainnet
    * `IMA_CONTRACTS` - IMA contract address on Base Mainnet
    * `BLOCK_DEVICE` - Attached storage block device (e.g. `/dev/nvme1n1`)
    * `SGX_URL` - URL to the SGX server (e.g. `https://host:port`, do not add a trailing "/" after the port number)
    * `ENV_TYPE` - Network type (`mainnet`)
    * `BITE` - Enable BITE (Blockchain Integrated Threshold Encryption) programmable privacy for the node (`True`)

    For the Base Mainnet, your `.env` will look like:

    ```txt theme={null}
    ENDPOINT=[BASE_ENDPOINT]
    NODE_VERSION="base-mainnet"
    FILEBEAT_HOST="base-elk-mainnet.skalenodes.com:5000"
    MANAGER_CONTRACTS="0x9E2aE995dfa2928C144291A0dFf15458E10779e8"
    IMA_CONTRACTS="0x2C3cae1A2143De33F7fe887ad0428d33BBBd0A62"
    BLOCK_DEVICE="/dev/nvme1n1"
    SGX_URL=[SGX_URL]
    ENV_TYPE="mainnet"
    BITE="True"
    ```

    It's possible to configure Telegram based alert system by providing the following options:

    * `TG_API_KEY` - Telegram API key
    * `TG_CHAT_ID` - Telegram chat ID

20. **Enable SGX wallet autosign**

    Switch back to sgx server and go to `sgxwallet/run_sgx` folder

    ```shell theme={null}
    cd sgxwallet/run_sgx
    ```

    Set `-s` option in docker-compose.yml

    ```shell theme={null}
    sed -i -E 's/(command: .*) *$/\1 -s/g' docker-compose.yml
    ```

    Restart the container

    ```shell theme={null}
    docker compose down && docker compose up -d
    ```

21. **Initialize Supernode**

    To install supernode on your server you should run `skale node init`. It will create necessary configuration files and run base services and containers.

    ```shell theme={null}
    sudo skale node init .env
    ```

    **Example Output:**

    ```shell theme={null}
    48914619bcd3: Pull complete
    db7a07cce60c: Pull complete
    d285532a5ada: Pull complete
    8646278c4014: Pull complete
    3a12d6e582e7: Pull complete
    0a3d98d81a07: Pull complete
    43b3a182ba00: Pull complete
    Creating monitor_filebeat          ... done
    Creating sk_transaction-manager ... done
    Creating sk_watchdog            ... done
    Creating sk_admin               ... done
    Creating sk_bounty              ... done
    Creating sk_api                 ... done
    ```

    You can verify installation procedure by running:

    ```shell theme={null}
    sudo skale wallet info

    ```

    **Output:**

    ```shell theme={null}
    Address: <your-skale-node-wallet-address>
    ETH balance: 1.0 ETH
    SKALE balance: 0 SKALE

    ```

    The common problem is network misconfiguration between the supernode and SGXWallet. You can recheck connection status using `skale health sgx`:

    ```shell theme={null}
    sudo skale health sgx

    ```

    **Output:**

    ```shell theme={null}
    SGX server status:
    ┌────────────────┬──────────────────────────┐
    │ SGX server URL │ <sgx-url>                │
    ├────────────────┼──────────────────────────┤
    │ Status         │ CONNECTED                │
    └────────────────┴──────────────────────────┘

    ```

22. **Disable SGX wallet autosign**

    Switch back to sgx server and go to `sgxwallet/run_sgx` folder

    ```shell theme={null}
    cd sgxwallet/run_sgx
    ```

    Remove `-s` option in docker-compose.yml

    ```shell theme={null}
    sed -i -E 's/(command: .*) -s( .*)?$/\1\2/g' docker-compose.yml
    ```

    Restart the container

    ```shell theme={null}
    docker compose down && docker compose up -d
    ```

23. **Setup SSL Certificates**

    You will need to setup redirects from each supernode IP to the supernode domain, and issue SSL certs from a Trusted CA.
    You can issue a separate certificate for each subdomain (node-0.awesome-validator.com, node-1.awesome-validator.com) or
    issue a single Wildcard SSL for all supernodes (\*.awesome-validator.com). As a result, you should have 2 main files saved and
    copied to the respective supernodes:

    * Certificate file (for example, fullchain.pem or cert.pem)
    * Private key file (for example, privkey.pem, pk.pem)

    Upload certificates to the SKALE Node:

    ```shell theme={null}
    sudo skale ssl upload -c $PATH_TO_CERT_FILE -k $PATH_TO_KEY_FILE
    ```

    Check SSL status:

    ```shell theme={null}
    sudo skale ssl status
    ```

    For more details, please see [Node SSL docs](/validators/node-cli/node-ssl-setup).

24. **Fund Node wallet with ETH**

    Some of the supernode operations send Base Mainnet transactions (e.g. chain creation). So the supernode wallet should have at least 1 ETH on Base.

    To get the address you should run `skale wallet info` command.

    <Note>
      Spent ETH is reimbursed after the transaction was completed.
    </Note>

25. **Sign Validator ID using SGXWallet**

    Using *validator-cli* check your validator ID:

    ```shell theme={null}
    sk-val validator ls
    ```

    Get your SKALE supernode signature by running Node CLI command.

    ```shell theme={null}
    sudo skale node signature [VALIDATOR_ID]

    ```

    **Output:**

    ```shell theme={null}
    Signature: <your-signature>
    ```

26. **Link SKALE wallet address to your validator account using Validator CLI**

    To successfully register new supernode you should bind supernode address and validator entity using *validator-cli* `link-address`:

    ```shell theme={null}
    sk-val validator link-address [NODE_ADDRESS] [SIGNATURE]
    ```

    <Note>
      You can find supernode address by executing `skale wallet info` command
    </Note>

    Optional arguments:

    * `--pk-file` - Path to file with private key (only for `software` wallet type)
    * `--gas-price` - Gas price value in Gwei for transaction (if not specified doubled average network value will be used)
    * `--yes` - Confirmation flag

27. **Backup Node**

    We strongly recommend to regularly backup supernode data. The critical information stored `~/.skale` directory.

    The `skale node backup` command archives the data which you can download and store somewhere else.

    To restore the supernode you should use `skale node restore`

    More information can be found [here](/validators/node-cli/releases/v2-0#node-backup).

## Register Node in SKALE Network

29. **Register Node with Node CLI**

    <Note>
      Before proceeding, you will need to have at least  **1 ETH** on Base. Also amount of staked SKL tokens need to be more or equal to minimum staking amount.
    </Note>

    To register with the network, you will need to provide the following:

    * Node name
    * Machine public IP
    * Domain name

    ```shell theme={null}
    sudo skale node register --name [NODE_NAME] --ip [NODE_IP] --domain [DOMAIN_NAME]

    ```

    Optional arguments:

    * `--port` - beginning of the port range that will be used for skale SKALE Chains (`10000` by default)

    **Output:**

    ```shell theme={null}
    Node registered in SKALE manager. For more info run: skale node info
    ```

30. **Check Node Status**

    You can check the status of your supernode, and ensure that it's properly registered with the SKALE Network.

    ```shell theme={null}
    sudo skale node info
    ```

    **Output:**

    ```shell theme={null}
    # Node info
    Name: <Node name>
    ID: <Node ID>
    IP: <IP of Machine>
    Public IP: <Public IP of Machine>
    Port: <Node port>
    Domain name: <Node domain name>
    Status: Active
    ```

## Post Registration Checks

31. **Post Registration Checks**

    * [ ] Private and backup keys are secured in a safe place.
    * [ ] VPN is configured on all SGXWallet servers.
    * [ ] Ensure node wallets have sufficient ETH on Base.
    * [ ] Check telegram notifications (if you enabled them).
    * [ ] Use [watchdog](/validators/watchdog/overview) to monitor node status.
    * [ ] Get support from the SKALE validator community.