80 lines
3.2 KiB
Markdown
80 lines
3.2 KiB
Markdown
# Nym node — koopa (`koopa-nym`)
|
|
|
|
Podman container **`koopa-nym`** runs a [**nym-node**](https://nym.com/docs/operators/nodes/nym-node)
|
|
from [nym.com](https://nym.com/) (Nym mixnet / NymVPN network).
|
|
Host layout (live): `~/koopa-nym/`.
|
|
Mirror in this repo: `configs/nym/`.
|
|
|
|
| Setting | Value |
|
|
|---------|--------|
|
|
| Container | `koopa-nym` |
|
|
| Image | `localhost/koopa-nym:latest` |
|
|
| Process user | **non-root** `nym` **uid/gid 1000** (`USER` + compose `userns_mode: keep-id`) |
|
|
| Default mode | **`mixnode`** (safest on a home host; no open-internet exit) |
|
|
| Optional modes | `entry-gateway`, `exit-gateway` (+ WireGuard for dVPN) — see env |
|
|
| Local ID | `koopa-nym` |
|
|
| Data | `~/.nym/nym-nodes/koopa-nym/` inside volume `./data` |
|
|
| Operator T&Cs | must pass `--accept-operator-terms-and-conditions` every run |
|
|
|
|
## Ports (host) — avoid Caddy **9000/9001** and Tor **8080**
|
|
|
|
| Role | nym-node default | Host publish |
|
|
|------|------------------|--------------|
|
|
| HTTP API / swagger | `8080` | **9080** |
|
|
| Mixnet Sphinx | `1789` | **1789** |
|
|
| Verloc | `1790` | **1790** |
|
|
| Entry client WS | `9000` | **19000** (only if gateway mode) |
|
|
| WireGuard | `51822` | **51822** (only if WG enabled) |
|
|
|
|
VeciGate / firewall: open only what the chosen mode needs.
|
|
**Exit-gateway** and **WireGuard** expose the host IP to abuse complaints — read
|
|
[Nym exit counsel](https://nym.com/docs/operators/community-counsel/exit-gateway)
|
|
before enabling.
|
|
|
|
## Files
|
|
|
|
| File | Role |
|
|
|------|------|
|
|
| `Containerfile` | Debian slim + nym-node binary |
|
|
| `entrypoint.sh` | env → `nym-node run …` |
|
|
| `compose.yml` | podman/docker compose |
|
|
| `.env.example` | non-secret knobs |
|
|
| `container-koopa-nym.service` | systemd --user unit template |
|
|
|
|
## Ops (sketch)
|
|
|
|
```bash
|
|
cd ~/koopa-nym # or this mirror
|
|
cp .env.example .env # edit PUBLIC_IPS, LOCATION, MODE
|
|
# host data must be writable by uid 1000 (hernani)
|
|
mkdir -p data && chown -R "$(id -u):$(id -g)" data
|
|
# sync compose + entrypoint from admin-log if this tree is a copy
|
|
podman build -t localhost/koopa-nym:latest -f Containerfile .
|
|
# IMPORTANT: port maps only apply on create — not on plain podman start
|
|
podman compose down
|
|
podman compose up -d --force-recreate --build
|
|
podman exec koopa-nym id # expect uid=1000(nym)
|
|
podman port koopa-nym # must list 1789/tcp+udp and 1790/tcp
|
|
ss -lntp | grep -E '1789|1790|9080'
|
|
# bonding: use Nym wallet / harbourmaster; node must accept operator T&Cs
|
|
curl -sS http://127.0.0.1:9080/api/v1/roles | jq .
|
|
```
|
|
|
|
### If WAN `1790` is “connection refused” but `1789` works
|
|
|
|
Almost always **container publish/bind**, not VeciGate:
|
|
|
|
1. Old container created without a solid `1790/tcp` map → **recreate** (above).
|
|
2. Process bound only on `[::]:1790` while host proxy expects IPv4 → defaults are now **`0.0.0.0:1790`**.
|
|
3. Confirm: `podman port koopa-nym` shows `1790/tcp -> 0.0.0.0:1790`, then `nc -vz WAN 1790`.
|
|
|
|
Secrets layout (values in **koopa-admin-secrets**):
|
|
|
|
| Live | Secrets mirror |
|
|
|------|----------------|
|
|
| `~/koopa-nym/.env` | `koopa-admin-secrets/koopa/home-hernani/koopa-nym/.env` |
|
|
| `~/koopa-nym/data/` | host-only (node identity; not git) |
|
|
|
|
Path map: `koopa-admin-log/SECRETS.md`.
|
|
|
|
**Public listing (explorers):** see [`PUBLIC-LISTING.md`](PUBLIC-LISTING.md).
|