All pages
Powered by GitBook
1 of 48

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Validator Node Guides

Operational Guides

Cloud Provider Specific

These documents are specifically tailored for deploying Constellation Network nodes according to the configuration and integration requirements of each provider’s dashboard setup.

🚧Build AWS EC2 Instance🚧Build DigitalOcean Droplet🚧Build Hetzner Server

First Time Configuration

If this is NOT your first time configuring delegated staking, and you are looking for a way to update your delegating staking parameters, you may skip to the next page.

✨ Welcome first time delegators!​

If this is your first time configuring delegated staking on your node, you will be presented with a CONFIGURATION NOTICE screen.

Simply read through the notice and press any key to continue.

Delegated Staking

Node Operator's guide to enable delegated staking on your node.

To offer your node for delegation on the Constellation Network, you must complete the delegated staking configuration.

This process allows Node Operators to make their nodes available for delegation.

Follow the steps in this guide to properly set up and enable delegation.

What is delegated staking?​

Delegated staking on Constellation Network allows any $DAG holder to participate in network security and validation by staking their tokens with validators without needing to run a node. This enables more users to contribute to decentralization and governance while earning staking incentives. By choosing a validator, you help secure the network, support metagraph projects, and receive $DAG incentives for your participation. Some metagraph validators even offer additional L0 token rewards, increasing your potential incentives.

$DAG holders who participate in delegated staking may choose your node based on the commission percentage you set. This allows you, as a Node Operator, to generate additional rewards revenue from delegations.

Build Your Node

Status Command

In order to view your current delegated staking status, you may issue a status command at any time.

sudo nodectl delegate status

For a valid configuration, your node should report all parameter matches as True.

If any match is not True, please review your desired configuration and issue an update as needed to ensure your desired settings and consistency with the cluster.

Duplicate Update

In the event that you have already issued an update with your current settings (no changes were necessary), nodectl will prevent an unnecessary cluster update, and decline your request.

DELEGATED UPDATE REQUEST CANCELLED

If the nodectl utility responds without applying any changes, the most likely reason is that your node is already configured with the delegated staking settings you specified.

If this is not the case, review and update your configuration file and submit another update to ensure your desired changes are applied.

Create Delegated Staking Configuration

nodectl requires you to create a configuration file with the necessary parameters to properly enable delegated staking according to your preferences and requirements.

First time and future updates​

Regardless of whether this is your first time configuring your node for delegation, you must create or update the configuration file to define the specific parameters you want to use when offering your node for delegation.

If you wish to change any delegated staking parameters in the future, you must update the configuration file first before submitting a request to apply those changes to your node’s delegated staking settings.

Important

Configuring delegated staking does not automatically commit your node to accept delegations.

The process involves two steps:

  1. Create or update the configuration with your desired delegation parameters.

Create or Update Configuration

1

Log into your node

2

Authorize to Join Hypergraph or metagaph

Before You Begin

You should now have access to the Constellation Network Official Discord server via an invite provided for Node Operators.

At this point, your VPS should be fully configured and operating as a Constellation Validator Node.

If you believe any steps were missed, please revisit the previous documents to ensure all required tasks are completed before moving forward.

Constellation Network Official Discord Server

Return to or join the Constellation Network Discord server, and reach out to a Discord Administrator who holds the Admin or Team Lead role (visible next to their username).

Important Security Reminder

An Admin or Team Lead will never message you first, ask for money, request that you connect your wallet to third-party sites, or make any financial requests.

When contacting an Admin or Team Lead, be prepared to present your Node ID so they can submit it to the internal team for processing. You may be required to confirm your email, this should only be confirmed by an Official Constellation Network Team Member.

Stargazer Wallet

You will need to create and own a Stargazer Wallet

Production Specific

In order to qualify to run a node on Constellation Network's production MainNet Hypergraph cluster, or Dor metagraph cluster, you will need to collateralize your node through your Stargazer wallet.

Cluster Name
Hypergraph or metagraph
Token
Amount

Please follow guide to import your node’s wallet into your Stargazer Wallet, and transfer $DAG and or $DOR before attempting to join the cluster.

This step is required to meet the staking threshold and ensure your node is eligible for cluster participation.

Modify Existing Configuration

If this is your first time configuring delegated staking you may to the next document page.

⌨️ Modify existing configuration

If delegated staking has already been configured, you will be asked if you would like to update the configuration. You can enter y.

Update Delegated Staking

To update your current delegated staking parameters or to commit them for the first time to the metagraph, you will need to implement an update.

This command finalizes your configuration by submitting it to the metagraph, making your node available for delegated staking based on the parameters you've set.

1

Add/Update Delegating Staking Parameters

You should now be in the configurator and at the section where you're prompted to enter the necessary parameters to enable delegation.

These parameters will define how your node appears to other delegated staking participants, allowing them to discover and delegate to your node based on the options you set.

✅ Enter Delegation Parameters

1

Create Discord Account

Join the Constellation Network Official Discord

To stay fully informed and connected, you must join the Constellation Network Official Discord server.

This is the central hub for:

✅ Cluster update announcements

✅ Scheduled network restarts

✅ Operational instructions and technical alerts

✅ Validator program updates and governance notices

Node Prerequisites

This document suggests what steps you should have in place before you begin to turn a VPS into a Constellation Network Validator Node.

Prerequisite Steps Before Node Creation

Discord Account

You will need a Discord account.


Restart Validator Node Guide

This guide is intended for restarting your Validator node following a Hypergraph or metagraph cluster restart.

Cluster restarts may occur for a variety of operational reasons, including:

✅ Network upgrade

✅ Seed list access updates

✅ Cluster-wide error resolution


🔁 Optional: Auto Restart Feature

The nodectl utility

This section explains how to use the Constellation Network Command Line Interface (CLI) utility, which provides a simplified way to run a node without requiring technical expertise or in-depth knowledge of the Tessellation Protocol’s architecture and operation.

What is nodectl?

Pronounced node control, node-c-t-l, or node-cuttle.

nodectl is a command-line utility designed to simplify the deployment and management of Constellation Network Validator nodes.

It eliminates the need for deep technical knowledge of the Tessellation Protocol, allowing both technical and non-technical users to run and maintain a Validator node on the Hypergraph and/or metagraph networks.

The utility is packed with powerful features that abstract away the complexities of node management.

Password and Passphrase Requirements

Your password or passphrase will require:

  • At least 10 characters

  • At least one number

  • At least on upper case character

  • At least one lower case character

  • At least on special character ( ! @ # % ^ & * ( ) _ + - = )

  • Do NOT use " (double quotes)

  • Do NOT use ' (single quotes)

  • Do NOT use $ (dollar sign)

  • Do NOT use § (sectional sign)

Pre-Installation Execution

You should be:

  • Connected to your VPS remotely

  • VPS is updated, upgraded, and rebooted

  • nodectl is installed.

Create Discord Account
Build Your Node
🚉First Time Connection Guide
💽The nodectl utility

MainNet

Hypergraph

$DAG

250,000

IntegrationNet

Hypergraph

$DAG

250,000

Dor

metagraph

$DOR

this
Stargazer Wallet

1,000,000

Update configuration? [n]: y
skip

Manually submit the configuration to the Metagraph to activate delegated staking.

Enter the configurator
  • -e edit mode

  • -cb confirm backup automatically

  • -d detailed mode

3

Enter delegated staking setup

We will choose option D.

4

Continue to the next section

First Time Configuration

Modifying existing Configuration

​
Issue an update
2

If this is not your first update

You will be presented with a status of the differentials between your node's local configuration and what is present on the metagraph blockchain.

If this is your first time updating the metagraph, you will not see this section.

3

Authenticate with your P12 passphrase

To verify your identity and authorize delegated staking, you will be prompted to enter your p12 passphrase.

For security reasons, the passphrase will not be visible as you type. Simply enter it and press the enter key to continue.

First Time Update Only​

You may skip this step if this is not your first update.

The nodectl utility will attempt to retrieve your current delegated staking parameters and determine whether this is your first update attempt.

If it detects a first-time update, you will receive a warning and be asked to confirm. If you have previously updated your node and still receive this prompt, it may indicate a potential issue (see warning).

Warning

If this is your first time updating the delegated staking settings on your node and you do not receive the first-time confirmation notice, please contact a Constellation Network representative via our official Discord server for assistance.

Likewise, if this is not your first time updating and you do receive a first-time warning, please report the issue as soon as possible through the same channel.

If you are confident that this is the first delegated staking update for this node, you may proceed with acknowledging the prompt.

During the initial update to the metagraph, your reference to your last update (none) will be set to all zeros.

The default option is n so we will change it to y and hit enter.

Short name

You will need to choose a short name for your node.

  • Must be no larger than 140 characters

  • Must be no smaller than 5 characters

This name will be publicly displayed on the DAG Explorer within the Delegated Staking section and should be:

  • Concise – keep it short and simple

  • Descriptive – reflect your identity or purpose

  • Unique – avoid names that could be confused with other nodes

A clear and recognizable name will help users quickly identify and delegate to your node within the Constellation Network ecosystem.

2

Description

  • Must be no larger than 140 characters

  • Must be no smaller than 5 characters

You’ll need to provide a brief description of your node that will be publicly displayed on the DAG Explorer within the Delegated Staking section.

Keep it short and clear, highlighting your node’s strengths, unique features, or anything that sets it apart. This description is your opportunity to attract community members interested in delegated staking to delegate their $DAG to your node.

3

Commission

Decide on the commission percentage you would like to charge for allowing others to delegate to your node.

You must select a number (integer/float) value between 5 and 10. This percentage represents the portion of staking rewards your node will collect as a fee in exchange for providing delegation services. Do not include % sign.

You may use floating point values. 5, 5.1,5.2 ... 9.9, 10.

Choose a rate that aligns with your operational strategy, encourages community participation, and reflects the value your node offers.

4

Confirm Your Entered Parameters

You will be offered a chance to review your new input or changes before they are committed to the configuration file.

Enter y to confirm

🏁 Final Instructions​

Your configuration will be created or updated to match your requested parameters and final instructions will appear.

Press any key and you will be returned the main menu of the configurator.

❌ Quit Configurator​

Your configuration is complete, you may issue a q to exit the configurator and return to your node's command line interface.

​
D) Setup/Update Delegated Staking
sudo nodectl configure -e -cb -d
Please enter your p12 passphrase:
sudo nodectl delegate update
Is this your first update? [n]: y
Q) Quit

✅ Peer collaboration and troubleshooting with other Node Operators

Why It’s Important

Participation in the Discord server ensures that you:

  • Receive real-time updates that may affect your node's performance or connectivity.

  • Get immediate access to official support channels and team leads.

  • Can coordinate with other Validators for best practices and knowledge sharing.

Invite Link

https://discord.gg/9PhXJKeAWC

Make sure to verify your account and introduce yourself in the general channel once inside.

If you have the auto_restart feature enabled, your node may have already recovered automatically.

If auto_restart is active, you can skip directly to the Confirm Status step.


1

SSH Into Your VPS

How to SSH into a VPS

2

Restart All Node Profiles

3

Restart Auto Restart Module (Optional)

If you have auto_restart only:

You should see messages indicating that nodectl is disabling the auto_restart feature at the beginning of the restart process and re-enabling it once the restart is complete.

4

Confirm Node Status

You should see output indicating that all profiles are in the Ready state:

Enable Auto Restart

Prerequisites

Delegated Staking Requirements

nodectl version

Delegated staking is supported by nodectl starting with version v2.17.0.

Verify your version

Issue the version command to output the current version of nodectl.

Upgrade if necessary

Please follow the correct upgrade path to ensure your node remains manageable by nodectl and does not encounter compatibility issues.

If there are multiple versions between your current version and v2.17.0, you must follow the correct upgrade path.

Take note of each intermediate version and run the upgrade_nodectl command sequentially for each version step using the -v <version> option.

Upgrade one version at a time. Do not skip versions until you reach v2.17.0.

This ensures compatibility and prevents potential issues with configuration or functionality.

Example: sudo nodectl upgrade_nodectl -v v2.13.0

When you reach a version that can be directly upgraded to the latest v2.17.0 you may exclude the -v option.

Node internal upgrade

If you are requested to upgrade the node, issue a Y and allow nodectl to upgrade the node so that all the features, changes, and updates can be properly applied.

This is important to ensure that all features of nodectl are enabled.

For Node Operators

As a Node Operator, you can offer your node for delegation by following these steps:

The nodectl utility automates these steps for you. Follow this guide to complete the setup.

P12 Keystore

Delegated staking is tied to your node’s wallet public key (node ID).

If you rebuild or create a new node, your delegated staking status will remain unaffected as long as you retain your current p12 keystore, which holds the private and public keys designated for the Constellation Network Hypergraph or metagraph.

Turn your VPS into a Node

This guide will help you create your node using nodectl.

nodectl Installation Types

Introduction​

The following documentation will help guide a new Node Operator understand the differences between turning a newly created VPS into a Constellation Network validator node with the use of nodectl.

There are three options:

Normal Install

A normal installation is a more detailed and interactive method of installing nodectl on your VPS. The process will guide you through each step of the installation interactively with details on each step, along the way.

Quick Installation

This installation method installs nodectl with minimal prompts or user interaction. You will only be asked a few questions:

  • Which cluster you would like your node to join

  • Whether you want to migrate an existing .p12 keystore

  • Passphrase for the .p12 keystore:

.

Manual Installation

This new installation can be preformed if desired by advanced users.

nodectl is recommended.

Understanding Delegated Staking

Since delegated staking is a financial decision, the configurator will not automatically commit your node to become available for delegated staking.

Generic Build a VPS Guide

This is a generic guide created to assist you in building a Constellation Network validator node.

Recommendation

If you are going to build your VPS on a cloud provider that we offer a specific guide to follow, skip this document and move directly to one of those

  • AWS

Upgrade Tessellation Quick Start

Introduction

This guide walks you through upgrading your Validator node to the latest version of Tessellation using nodectl, leveraging non-interactive mode with recommended defaults. Please refer to the full upgrade guide for a more detailed walk-through.


1

ssh -i /path/to/ssh/private/key nodeadmin@<vps_ip_address> -p <port>
​
Create a new one if needed
  • Enter the passphrase if using an existing keystore

  • New password for the Node Administrator

  • 🐇Quick Install Guide
    🎨Normal Install Guide
    🛠️Manual Installation
    ​
    ​
    Understanding passphrases and passwords
    ​
    manually
    If you believe the auto_restart feature did not restart for any reason—for example, if you did not see the related messages—you may manually restart it to ensure it is functioning correctly.
    enabled
    SSH Into Your VPS

    How to SSH into a VPS

    2

    Begin the Upgrade

    Execute the following command to begin a non-interactive upgrade. This will automatically pull and install the latest Tessellation release using default settings.

    3

    Single Layer Nodes

    If you're running a single-layer Validator (Layer0 or Layer1 only), you can skip directly to the Confirm Status step below.

    4

    Hybrid Node Considerations

    If your node operates in hybrid mode (participating in both Layer0 and Layer1):

    • You must wait for the Layer0 profile to reach the Ready state before attempting to connect Layer1.

    • Layer1 cannot join the cluster until the full Layer0 chain is downloaded and synchronized.

    5

    Auto Restart (If Enabled)

    If you have the auto_restart feature enabled:

    • Your node will detect when Layer0 reaches Ready state.

    • It will automatically initiate the Layer1 connection.

    6

    Watch for Layer0 to Reach Ready

    Use the command below to monitor the Layer0 profile. Adjust the -p flag to match your profile name.

    7

    Manually join Layer1

    Once Layer0 is in the Ready state, attempt to join Layer1:

    8

    Confirm Status

    Check the final status of all profiles:

    Expected output

    🏭Upgrade Tessellation Guide
    sudo nodectl restart -p all
    sudo nodectl status
    JOIN STATE     Ready
    IN CONSENSUS   True
    sudo nodectl version
    sudo nodectl upgrade_path
    sudo nodectl upgrade_nodectl -v <next_version_in_path>
    sudo nodectl upgrade_nodectl
    Press Y then [ENTER] to upgrade or N then [ENTER] to cancel: Y
    sudo nodectl upgrade --ni
    sudo nodectl status -p dag-l0 -w 120
    sudo nodectl join -p dag-l0
    sudo nodectl status
    JOIN STATE     Ready
    IN CONSENSUS   True
    ssh -i /path/to/ssh/private/key nodeadmin@<vps_ip_address> -p <port>

    Delegated staking is permanent and cannot be disabled once it has been enabled.

    There are no downsides to enabling delegated staking it simply allows you to earn additional rewards without impacting your existing node operations.

    High Level Flow

    This is the logical flow of how delegation works on your node.

    1

    Create a Configuration

    You will log into your node and go through the necessary steps to build a configuration file that lives locally on your node.

    2

    Update

    You will instruct nodectl to:

    • Pull your local configuration.

    • Formulate a signed authorization request to delegate.

    • Push (POST) signed request to the metagraph.

    • Review the results of your delegation request.

    3

    Future Updates

    • Update your local configuration to your new setting requirements.

    How Commission Works

    ✅ Key Point: Collateral Requirement

    To operate a node, you are required to allocate 250,000 $DAG as collateral. You will earn 100% of the rewards generated by your own collateral—these rewards are exclusively yours and are not shared.

    👥 Delegators and Additional $DAG

    When other community members choose to delegate their $DAG to your node, the total amount delegated is added to your node's effective stake, increasing your node's influence and overall earning potential.

    💰 Example: Understanding Rewards from Delegation

    Let’s say delegators collectively point X $DAG at your node.

    • Your node will now earn additional rewards based on this delegated stake.

    • You will receive a commission (a percentage you set between 5–10%) from the rewards generated by the delegated X $DAG.

    • The remaining rewards go back to the delegators, proportional to their contribution.

    In Our Example

    • Let's say: 800 $DAG was earned in total from X $DAG delegated to your node for you and your delegators. This does not include rewards earned from your original 250,000 $DAG staked as collateral on your node.

    • You set a 10% commission charge.

    Earning Type
    Daily Earned
    Commission Set
    Your Earnings
    Delegator Earnings

    Delegated Staking

    800 $DAG

    10%

    80 $DAG

    720 $DAG

    Your Node's Collateral

    600 $DAG

    0%

    600 $DAG

    0 $DAG

    Digital Ocean
  • Hetzner

  • Before We Begin

    This guide does not include cloud provider-specific steps or images. You may use the specific cloud provider documentation here.

    There are many cloud providers available to choose from, and unfortunately, we cannot cover each one in these tutorials and guides.

    We encourage you to research and select a provider that best fits your needs in terms of performance, pricing, reliability, and regional availability.

    You may also:

    • Adapt an existing setup guide by intuitively translating the steps to match your chosen provider’s interface.

    • Ask for advice or recommendations in the Constellation Network Official Discord channel, where community members and team members can share their experience and guidance.

    The right provider is the one that aligns best with your technical comfort level and validator node requirements.

    Create SSH Keys

    Cloud Provider Specific

    While this guide provides generic, provider-agnostic steps to help you build a VPS on any cloud service, it is designed so you can follow along using intuitive actions regardless of the platform.

    However, if you prefer a more tailored experience, you may choose to opt into service-specific guides that have been prepared for popular providers. These offer more detailed, platform-specific instructions to streamline the setup process.

    Choose the path that best fits your comfort level and desired level of guidance.

    Create a Firewall

    Create a Firewall (Security Group)

    It's recommended to create your firewall policy (also known as a Security Group) before launching your VPS. Doing this upfront allows you to immediately assign the correct firewall rules when the VPS is created, ensuring proper and secure access from the start.

    IMPORTANT

    Do NOT rely on software firewalls such as UFW (Uncomplicated Firewall) or IP Tables for securing your validator node.

    Because your node will have direct Internet access, these tools are not sufficient as a primary IP packet security layer and can interfere with the proper operation of your node on the VPS.

    Instead, always use your cloud provider’s built-in firewall or security group features to manage port access and protect your server at the network level.

    If your cloud provider of choice does not offer built-in firewall or security group features, it is strongly advised not to use that provider for hosting your validator node.

    Firewall Mappings Chart​

    Advanced Checklist: Manual Node Build Steps

    This checklist is intended for advanced users who are not following a pre-configured cloud provider guide.

    If you’re building your Validator node manually on a custom VPS or bare-metal environment, use this sequence to ensure a complete and secure setup.

    These steps assumes familiarity with manual system setup, firewall management, and node operations. Be sure to follow official documentation closely when applying any configurations related to the Tessellation protocol or node lifecycle.


    1

    Build Your VPS or Bare-Metal Server

    • Refer to the Validator Specifications Document to determine the appropriate system configuration.

    • Choose a provider or hardware setup that meets or exceeds the minimum system requirements.

    2

    Apply Network Access Requirements

    • SSH Access:

    3

    Create and Apply Firewall Rules

    Configure your VPS or provider-level firewall to:

    • Allow only necessary inbound ports (e.g., SSH, Tessellation API ports).

    4

    Build your Node

    Turn your server into a validator node by performing the following:

    • Install all required dependencies.

    5

    Collateralize

    • Stake the required amount of $DAG tokens to activate your validator node.

    6

    Submit Your Node Information

    • Join the Constellation Network Official Discord.

    7

    Dor Metagraph Specific

    • Log in to your Lattice dashboard.

    8

    IntegrationNet Specific

    • Log in to your Lattice dashboard.

    guides
    🔑Create SSH Keys
    🚧Build AWS EC2 Instance
    🚧Build DigitalOcean Droplet
    🚧Build Hetzner Server
    Firewall Settings Table

    Node Specifications

    Constellation Network's Node Spec Requirements.

    TL;DR

    View specs starting here.

    Introduction​

    As with any cryptographic ecosystem, there are specific hardware requirements that must be met to ensure your node operates securely, efficiently, and reliably within the Constellation Network’s ecosystem.

    Meeting these requirements is essential for maintaining node performance, ensuring compatibility with consensus protocols, and avoiding issues related to resource limitations.

    Hardware Requirements​

    Constellation Network currently supports two distinct types of nodes across its Hypergraph and metagraph infrastructure:

    • Constellation Network Hybrid Validator Node

    • Dor Validator Data Layer 1 Node

    Virtual vs Dedicated

    A VPS (Virtual Private Server) is a virtualized environment running on a physical machine that shares resources (tenancies) with other instances. This makes it a more cost-effective option for operators who are just getting started.

    A group of these VPS instances forms what is commonly referred to as the "cloud."


    In contrast, a dedicated bare metal server is a physical machine allocated to a single tenant. It offers exclusive access to all hardware resources and typically provides higher performance and configurability. Many cloud providers offer both VPS and dedicated server options, depending on your needs.

    Constellation Network does not require or prefer one over the other.

    You are free to choose the infrastructure that best fits your technical experience, performance expectations, and budget.

    Bare Metal

    A bare metal server is a physical machine designed to run dedicated services for a single tenant. Unlike virtualized environments, bare metal servers provide full access to the underlying hardware, offering maximum performance, control, and customization.

    You can run a bare metal server from various environments, including:

    • A personal data center

    • A colocation facility

    • A private office

    • Even from your home, if conditions allow


    Because you have full control over both hardware and software, this setup is best suited for advanced operators who need:

    • Greater resource allocation

    • Custom system configurations

    • Specialized networking or storage requirements

    Due to the complexity and responsibility involved, bare metal servers are not recommended for beginners or casual operators


    🔁 Constellation Network Hybrid Node

    A Hybrid Node is required to operate on both the:

    • Global Layer 0 – the global consensus and infrastructure layer

    • DAG Layer 1 – the native currency and transaction layer for the $DAG token

    This dual-role node type is commonly referred to as a Hybrid Validator Node.


    Hybrid Node Hardware Requirements

    To ensure reliable and efficient performance hybrid nodes must meet the following minimum hardware specifications:

    Component
    Requirement
    Preferred

    🔁 Dor Data Layer 1 Node

    A Dor Node is required to operate on both the:

    • Data Layer 1 Metagraph – the data validation layer for the Dor metagraph

    Dor Node Hardware Requirements

    To ensure reliable and efficient performance hybrid nodes must meet the following minimum hardware specifications:

    Component
    Requirement
    Preferred

    Software Specification Requirements

    Distribution

    • Linux Debian-based distribution

    Operation System Recommendations

    • Ubuntu 24.04

    • Debian 12

    Software Specific Version Requirements

    • Java 11


    Considerations

    Constellation Network's Tessellation is developed to run on any Debian distribution with Java 11 installed.

    The nodectl utility was developed to run specifically on Ubuntu 24.04 and Ubuntu 22.04.

    Ubuntu Specific

    Ubuntu uses the convention of .04 to represent versions of their Debian distribution that is LTS (long term support), and .10 for their more "experimental" short term support releases.

    It is highly recommended to use a .04 version release.

    First Time Connection Guide

    How to connect to a brand new VPS created by using one of the Constellation Network VPS build guides.

    Prerequisites

    Assumptions

    • You are using Debian Ubuntu as your distribution. If you are not, please substitute ubuntu for root throughout this document.

    • The username alice or Alice should be replaced with your actual local username on your Windows or Macintosh system.


    💻 Windows, Macintosh or Linux

    1

    Open Terminal

    🪟 Launch Windows Terminal and select a PowerShell tab (or Command Prompt if you prefer).


    🎶 Tips & Best Practices

    • Keep your private key secure: Never share it, and use a strong passphrase.

    • Use Keychain (macOS) or ssh-agent (Windows) to avoid re-entering the passphrase each session. ( Out of scope of this document ).

    • Regularly update your local OpenSSH client and your VPS’s OpenSSH server to the latest stable versions.

    Collateralize Your Node

    This guide outlines the steps required to collateralize your node’s hot wallet, meeting the staking requirements needed to join the Constellation Network Hypergraph or a metagraph.

    1

    Connect to your node

    Follow the connection guide to connect to your node.

    2

    Export your private key

    MainNet

    3

    Supply your p12 passphrase

    Due to the sensitive nature of this command, nodectl will prompt you to manually re-enter your .p12 keystore passphrase before proceeding.

    4

    Record your private key confidentially

    Be careful with this private key

    5

    Connect to your Stargazer Wallet

    Login as normal.

    6

    Enter the "Settings" ⚙️

    7

    Wallets

    8

    Add a new wallet

    9

    Import a wallet

    10

    Constellation wallet type

    11

    Paste your private key

    12

    Import

    13

    Collateralize

    You may begin transferring your $DAG or $DOR tokens to your newly imported wallet.

    🚧 Proceed with caution

    Start by sending a small test amount to ensure the transfer is successful before committing to a full transfer.

    You can continue with multiple transfers or a single lump-sum transfer after the test is confirmed. There should be no fees associated with these transfers.

    Manual Installation

    Manually download all the elements needed to run a node for advanced Node Operators.

    Before you Begin​

    If you’ve chosen to use nodectl to create your node, excellent choice! You should skip this section of the instructions.

    Users leveraging nodectl do not need to perform any of the steps outlined here, as nodectl handles all of them dynamically and automatically.

    Manual Installation

    1

    Setup your user management on your VPS.

    2

    Environment variables chart

    Variable
    Value
    Instructions

    Cluster Removal

    Leave Cluster

    To leave the cluster after a process has been started and joined.

    Stop jar processes

    Find the process(es) associated with your node

    Kill the process(es)

    Build Hetzner Server

    Build a Hetzner specific Cloud Resource Server

    Before we begin

    Please make sure you created your SSH key pairs prior to starting these steps.

    VPS Build Procedure

    Download nodectl

    How to download nodectl for the first time.

    Before Be Begin

    From now on, all instructions will be executed on your remote VPS, not on your local system.

    Please make sure to set up and connect to your remote VPS before continuing.

    Build DigitalOcean Droplet

    Digital Ocean Specific Build Process

    Before we begin

    Please make sure you created your SSH key pairs prior to starting these steps.

    VPS Build Procedure

    Enable Auto Restart

    This guide outlines how to enable nodectl's auto-restart feature along with auto-upgrade support.

    Enabling this configuration allows your node to:

    • Automatically monitor and restart services if they become unresponsive or disconnected from the cluster

    • Automatically check for and apply updates via nodectl when new versions of Tessellation are available (based on your configuration preferences)

    This ensures your node remains healthy, up-to-date, and engaged in network operations with minimal manual intervention.

    Generate a secure key pair.

  • Lock down your SSH configuration to allow access only from known IP addresses.

  • Disable root login.

  • Local Administration:

    • Ensure you have non-root administrative access (e.g., a user in the sudo group).

  • Restrict SSH to trusted IPs only.

  • Deny all other traffic by default.

  • Install the Tessellation binaries and any Constellation-specific tooling.

  • Place and secure your keystore.

  • Configure the API endpoints needed for Layer0 and/or Layer1 connectivity.

  • Follow official guidelines to complete the collateralization process.
    Navigate to the appropriate validator channel and submit your node profile details to the team.
    Navigate to the Dor section.
  • Link your nodid for tax rewards.

  • Navigate to the IntegrationNet section.
  • Link your wallet for rewards.

  • Repeat Step 2.

    Total

    1,400 $DAG

    680 $DAG

    720 $DAG

    Troubleshooting Guides

    Bandwidth

    2 TB/month

    10 TB/month

    OS

    Ubuntu 22.04 LTS (64-bit)

    Ubuntu 24.04 LTS (64-bit)

    Architecture

    x86_64

    x86_64

    Bandwidth

    1 TB/month

    5 TB/month

    OS

    Ubuntu 22.04 LTS (64-bit)

    Ubuntu 24.04 LTS (64-bit)

    Architecture

    x86_64

    x86_64

    CPU

    8 vCPUs

    Greater than 8 vCPUs

    RAM

    16 GB

    32 GB

    Disk

    320Gb

    500Gb

    Storage Type

    SSD

    CPU

    2 vCPUs

    Greater than 2 vCPUs

    RAM

    2 GB

    4 GB

    Disk

    40Gb

    80Gb

    Storage Type

    SSD

    ​
    ​
    ​
    ​
    ​

    NVMe / NVM

    NVMe / NVM

    1

    Enter Configuration Edit Mode​

    2

    Access Auto Restart Options​

    We will choose the R from the Edit Menu.

    3

    Enable All Options​

    • Choose y to enable auto_restart

    • Choose y to enable auto_upgrade

    • Choose y to enable on_boot

    4

    Confirm Selections​

    Choose y to confirm selections.

    5

    ◽ Exit Configurator​

    Choose Q to exit back to the command line interface.

    6

    Confirm Auto Restart is Enabled​

    Understanding the various auto restart options

    The nodectl utility includes several optional features designed to automate node recovery, version compliance, and startup behavior. These options help ensure your Validator node remains online, up-to-date, and resilient without requiring constant manual intervention.


    🔁 auto_restart

    When auto_restart is enabled, nodectl continuously monitors the health and cluster status of your node.

    Key Functionality:

    • Detects if your node drops off the cluster due to issues such as network interruptions, process failures, or misconfigurations.

    • Automatically attempts to restart and rejoin the node to the cluster without user involvement.

    • Automatically attempts to return your node to consensus if it stops participating for a variety of reason.

    This is especially helpful for maintaining high availability and reducing downtime.


    ⬆️ auto_upgrade

    Constellation Network requires all active Validator nodes to run the same version of Tessellation. If your node is not running the correct version during a cluster upgrade, it will be rejected from joining, regardless of its other credentials (e.g., collateral, seed list status).

    When auto_upgrade is enabled:

    • nodectl will monitor the current cluster version.

    • If a version mismatch is detected, it will automatically upgrade your node to match the active cluster version.

    This ensures version compliance and minimizes the risk of node rejection due to outdated software.


    🔄 on_boot

    Enabling on_boot ensures that nodectl's auto-recovery features are initialized automatically when your VPS starts up, such as after:

    • A manual system reboot

    • An unexpected crash

    • Cloud maintenance or hardware restarts

    How it works:

    • On system boot, nodectl launches the auto_restart process.

    • If necessary, auto_upgrade also activates to bring the node back in sync with the cluster version.

    • This setup enables your node to recover and reconnect unattended after the VPS completes its boot sequence.


    These automation features are highly recommended for production Validator nodes, as they enhance stability, uptime, and operational efficiency across the Constellation Network.

    Dor metagraph

    IntegrationNet

    You should not export your private key when participating on IntegrationNet. The $DAG tokens used on IntegrationNet hold no intrinsic value.

    Collateral requirements for this TestNet are validated through a connected wallet within your Lattice account that contains the required 250,000 $DAG collateral.

    sudo nodectl configure -e -cb -d
    sudo nodectl auto_restart status
    sudo nodectl export-private-key -p dag-l0
    
      This command requires manual re-entry of your p12 passphrase
      You may press q + <enter> to quit
      You will not see the q echoed to the screen.
      Please enter your p12 passphrase to validate config_file:
    
     WARNING  THIS IS YOUR PRIVATE KEY
      DO NOT EXPOSE TO ANYONE, AS YOUR HOT WALLET AND NODE CAN BE COMPROMISED!
    
      PRIVATE KEY FOR [constellation-node01.p12]
      =============================================================================================
      13abcdef13abcdef13abcdef13abcdef13abcdef13abcdef13abcdef13abcdef
      =============================================================================================
    suod nodectl export-private-key -p dor-dl1
    e.g. Linux /home/alice/.ssh/node_private_key
    We are using an ed25519 SSH key pair ( replace with rsa otherwise )
    You may also decide to use remote access applications tools such as Termius or PuTTy

    Termius: https://www.termius.com/

    PuTTy: https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html

    🍎 Press ⌘ Space, type Terminal and hit Enter.

    🐧 From the GUI launch a terminal app.

    If on the command line, no action needed.

    2

    Remote Connection to your VPS

    This step assumes root as the default username created by the cloud provider for first time access. Depending on the cloud provider this username may be different. You may need to try all three options through process of elimination to gain initial access.

    Possibility
    Description

    Remember we are using generic names, locations and IP address for your SSH key and VPS external IP address.

    3

    The host-key fingerprint prompt

    We should now be remotely connected to our VPS.

    On FIRST connect you will see a message similar 👇

    4

    Verify the fingerprint

    • Retrieve the expected fingerprint from your VPS provider’s dashboard or control panel (most clouds show it when you create the instance).

    • Compare that value against what your SSH client displays.

    In most cases, because you are manually making this connection, you can be confident you’re connecting to the correct host. However, when handling remote connections, always exercise extra caution.

    5

    Accept the fingerprint

    If everything matches from step 4, you may type in the full word yes and hit enter.

    6

    Confirm your connection

    Once authenticated, your local system prompt should change to your remote system prompt.

    7

    Update your VPS

    Just to make sure everything is nicely updated on your Linux VPS, we will perform some updates and upgrades.

    During the upgrade process, you may encounter a PURPLE dialog box asking you to select a few options. Since our node doesn’t require any special Debian configuration, just keep the default settings.

    If you receive a purple box, on your keyboard hit the tab to move to the OK or CONTINUE, or CONFIRM options and then press Enter.

    8

    Reboot

    Restart your VPS to apply any necessary updates that may require a reboot.

    9

    Reconnect

    Repeat the steps above to reconnect to your VPS, verify connectivity, confirm the upgrade was successful, and ensure everything is in order.

    Verify Specifications

    Please ensure your VPS meets the required specifications to run on Constellation's Hypergraph or metagraph networks.

    Proper sizing is essential for performance, stability, and successful participation in consensus.

    3

    Install dependencies

    4

    Download Tessellation Binaries

    Please replace the download version with the latest available version, as version numbers may have changed between the time this document was written and when you are accessing it.

    • cl-dag-l1.jar - Layer1 Data or Currency jar

    • cl-node.jar - Global Layer0 Node jar

    • cl-keytool.jar - Key tool utility specific to Constellation Network's Tessellation

    5

    Download the latest seed list file

    This is an access list containing public keys (referred to as node's nodeid).

    6

    Firewall Considerations

    Please choose a TCP port for your node’s public ingress/egress traffic, as well as a separate TCP port for peer-to-peer communications.

    Ensure that both selected ports are open and accessible on your firewall or VPS provider to allow proper protocol communication.

    7

    Export environmental variables

    The values shown below are examples only. Do not use them as-is. Refer to the Environment Variable Chart for explanations of each variable.

    8

    Create your P12 keystore file

    The values shown below are examples only. Do not use them as-is.

    9

    Update P12 keystore permissions

    The values shown below are examples only. Do not use them as-is.

    10

    Start your Layer0 Process

    The values shown below are examples only. Do not use them as-is.

    11

    Start your Layer1 Process

    The values shown below are examples only. Do not use them as-is.

    CL_L0_PEER_HTTP_HOST

    <layer0_peer_ipv4>

    This is recommended to be your node's external IP address. Your node will be participating on both Layer0 and Layer1. The Layer1 should link through your Layer0 connection. Your node will be the most reliable node to be UP at the time your attempt to join the Hypergraph.

    CL_L0_PEER_ID

    <layer0_peer_nodeidr>

    he node ID of the node you will be linking with on Layer0.

    CL_L0_PEER_HTTP_PORT

    <public_port>

    The public port of the node you are linking to through Layer0.

    CL_EXTERNAL

    <public_facing_ipv4>

    Our node's remote IP address

    CL_KEYSTORE

    <name_of_keystore>

    This will be placed at the end of the path CL_KEYSTORE line in the file.

    CL_PASSWORD

    <p12_keystore_passphrase>

    The password/passphrase you will use for your p12 keystore.

    CL_KEYALIAS

    <your_keystore_alias>

    Do not use this example, come up with your own.

    https://documentation.ubuntu.com/server/how-to/security/user-management/index.html
    ​
    Creating your account on Hetzner is a simple process similar to all other SaaS model services. At the current time, we will leave this process up to you.
    1

    Sign Up for an Account

    https://www.hetzner.com/

    2

    Create a Project

    Create the project and enter into the Project's dashboard.

    3

    Create Resource

    Click on the Create Resources button.

    Choose Servers

    4

    Location

    Choose either the Nuremberg or Helsinki location.

    These locations provide more server resource types.

    5

    Image

    Choose Ubuntu and make sure that 24.04 is selected from the dropdown box.

    6

    Type

    Select x86 (Intel/AMD)

    Once selected a table of resource types will populate. You may choose a resource name from the list that best meets the specs requirements for your type of validator node.

    Hypergraph Hybrid Nodes

    7

    Networking

    You may leave this section with the defaults

    8

    SSH Keys

    Add SSH key

    Copy and Paste your PUBLIC key to the provided box.

    9

    Volumes

    We can skip this section

    10

    Firewalls

    We can skip this section. We will handle this in the next few steps.

    11

    We can skip all the remaining sections

    Leave set to their defaults

    12

    Create & Buy now

    13

    Creation complete

    Our server should populate into our server dashboard.

    Record the public ip address for later.

    14

    Firewalls

    Rest your mouse over the 🏠 button on the left side panel.

    Choose Firewalls.

    From the Inbound rules

    15

    Create Layer1 Rule

    This rule is designed for validator Hypergraph hybrid DAG layer1 and Dor data layer1 nodes.

    Click on Add rule

    Leave the Any IPv4 and

    16

    Hypergraph Validator Node Only

    Dor data layer1 nodes do not use these port settings. Open these ports will offer attackers an open port to your VPS without a service listening on the inside. This is not recommended.

    17

    Outbound rules

    Skip this section

    18

    Apply to

    Click on Select Resources ➡️ Server.

    Choose our server name from the list.

    19

    Labels

    Skip this section

    20

    Name our firewall policy

    21

    Create our firewall

    Complete

    You have successfully launched a Server instance on Hetzner, Congratulations!

    You are now ready to continue to connect to your node for the first time, install nodectl and turn your VPS into a Constellation Network Validator Node!

    SSH Remote Access
    Download the nodectl binary
    1

    Navigate to to GitHub

    From the web browser navigate to Constellation Network's Stardust Collective GitHub repository dedicated to the development nodectl.

    2

    Find the newest latest release

    It is not recommended to download a pre-release

    3

    Choose the right download link

    On the Releases page you’ll see direct wget commands for various distros.

    For example, for Ubuntu 22.04 and Debian 12 or Ubuntu 24.04.

    4

    Copy & Paste the wget command

    On the right-most side of the code block showing the download wget command you should see a clipboard copy icon

    5

    Paste into your Remote VPS

    Paste the command into your remote VPS terminal session. This command is a combination of several commands linked together with the Linux's bash ; to indicate sequential commands that will be executed in order.

    The commands executed will perform the following:

    6

    Verify the installation

    Once all the steps from Step 5 are completed, the version of your nodectl utility should be displayed on your screen.


    auto_restart disable - Error Explained

    From Step 5.1 from ☝️

    Since the auto_restart command is a background feature, if you're not downloading nodectl for the first time; but instead downloading a newer version manually, instead of using nodectl's built-in upgrade feature, the auto_restart process may still be running.

    This can prevent you from overwriting the nodectl binary, as the Linux system will detect that the binary is in use.

    To avoid this issue, you must disable the auto_restart feature before attempting to overwrite the binary. The command to do this is provided on the releases page. It is safe to run, even if the nodectl binary is not present. It will simply return a harmless error message.

    Build Your Node
    🚉First Time Connection Guide
    Creating your account on DigitalOcean is a simple process similar to all other SaaS model services. At the current time, we will leave this process up to you.

    Before launching your validator node on DigitalOcean, it is recommended to add a valid payment method to your account.

    In some cases, you may need to request access to larger Droplet sizes (i.e., virtual machines with higher CPU, RAM, or disk allocations). The DigitalOcean team may restrict these resources until they’ve verified your account for higher usage limits.

    1

    Sign Up with Digital Ocean

    https://www.digitalocean.com/

    To enhance the security of your validator node, it is strongly recommended to enable Two-Factor Authentication (2FA) on your DigitalOcean account.

    2

    Create a Droplet (VPS)

    Choose Droplets from the Create button on the top right.

    3

    Choose Region

    Choose a Region that is closest to your local location.

    4

    Choose an image

    Select Ubuntu and CHANGE the Version to 24.04 (LTS) x64 ( not 24.10 x64 )

    5

    Choose Size

    You may keep Basic

    Choose Regular Disk type SSD

    Choose no less than 16Gb Memory, 8

    6

    Skip next few sections

    You may leave these with default options

    7

    Choose Authentication Method

    Choose SSH Key

    New SSH Key

    Copy and Paste your PUBLIC key to the provided box.

    8

    Monitoring and alerting (optional)

    Select the check box to enable free metrics and alerting.

    9

    Finalize Details

    Set the Quantity to 1

    You do not need to change the hostname, this will be done for you later.

    You do not need to add tags.

    You may leave the default

    10

    Create Droplet

    11

    Allow your Droplet to be created

    Copy down the IP address to access your system later. In the example above your IP address would be similar to 138.197.99.126

    12

    Under the MANAGE section on the left side

    Expand the section if necessary and choose Networking

    13

    Choose the Firewalls tab from the horizontal top tab

    Click on Create Firewall

    14

    Create a name to identify our firewall rule set

    15

    Create an SSH rule

    In the sources box leave the All IPv4 and All IPv6 if you want to have open access to this Droplet. Otherwise click the x on both the All IPv4 and All IPv6

    16

    Create your Pubic & Peer to Peer rule

    This rule is designed for both a Hypergraph hybrid layer validator DAG layer1 and a Dor data layer 1 nodes.

    Click on the New rule choose Custom

    Under the Port Range

    17

    Hypergraph Global Hybrid Validators ONLY

    This rule is designed for validator Hypergraph layer0 nodes.

    Click on the New rule choose Custom

    Under the Port Range

    18

    Dor data layer1 nodes do not use these port settings. Open these ports will offer attackers an open port to your VPS without a service listening on the inside. This is not recommended.

    Apply to Droplets

    19

    Create Firewall

    Complete

    You have successfully launched a VPS instance on DigitalOcean, Congratulations!

    You are now ready to continue to connect to your node for the first time, install nodectl and turn your Droplet (VPS) into a Constellation Network Validator Node!

    SSH Remote Access

    Node Operator Notes

    Important notes to help remind us about the concepts of the three different passphrase/passwords we need to maintain and use on a daily basis to manage our node.

    Before We Begin

    The following pages are essential reading before proceeding to any technical implementation. They are designed to help you organize your notes, confirm your virtual server specifications, and understand cloud provider requirements. Reviewing this information will ensure a smooth setup process and reduce the likelihood of configuration errors.

    These sections are especially helpful for first-time Node Operators. However, experienced or technically proficient users may choose to skim or skip them as needed.

    Topics covered in this section:

    • Setting Up Your Notes — Guidance on preparing and organizing the information you'll need throughout the node setup process.

    • Understanding Your VPS Specifications — Ensure that your virtual server meets the required hardware and system configuration.

    • Cloud Provider Specific Guides — Reference materials tailored to specific providers like AWS, DigitalOcean, and Heztner.

    Take the time to review this material thoroughly before beginning any technical work.

    Purpose

    This document suggests a method for keeping notes and tips accessible when preparing to or operating your node.

    We hope that referring back to your notes for reminders on managing your node and recalling necessary passphrases or passwords will be time-saving, useful, and efficient.

    Even the most advanced users with the best memory will forget the necessary information to access the various aspects of running a node. Keeping notes is important.


    Understanding Passphrase & Passwords

    There are 3 main passwords that we must have an understand and control of the concepts to make the administration of our nodes simple and less aggravating.

    1

    SSH Remove Access

    Passphrase used to complete the connection authentication.

    This is used to access your VPS/node from your local system. You’ll typically enter it once per session when establishing a connection to your node.

    2

    Password and Note Storage

    The following mediums are a good start to where you should record and maintain your notes.

    Medium
    Description

    Make sure to create backups that will be stored in a safe location.

    Warnings

    🚑 PLEASE DO NOT 🚒

    Do not use the same passphrases or other sensitive values/information as shown in this example.

    These examples are public facing and may be used by a nefarious actor as a first attempt to access your node in a penetration attack.

    The example values in these notes are fictitious, please replace usernames, passwords, passphrases, etc. with your own.

    Notes for Macintosh

    Notes for Windows

    Just in Case

    If you are using a Command Prompt verses PuTTy, you may want to copy the Macintosh notes 👆and replace Terminal with Command Prompt as necessary.

    First Time Cluster Connection

    This guide walks you through connecting a Validator Node to a Constellation Network Hypergraph or metagraph cluster for the first time.

    ⚠️ Guide Usage

    This guide assumes that you have properly created and connected to your VPS successfully and installed the nodectl utility.

    Build Your Node💽The nodectl utility

    🧰 Prerequisites

    Before beginning, ensure you’ve reviewed the full checklist and profile documentation.

    • This guide uses dag-l0 as the profile name.

    • Replace dag-l0 with your node’s actual profile name if it differs.

      • For example dor-dl1 for Dor data layer1 validator nodes.


    🔐 SSH Into Your VPS

    Use the following command to connect to your VPS via SSH:


    📄 Verify Your Node Is on the Seed List

    To confirm that your node is recognized by the network, run:

    Expected Output:

    🛑 If you are not on the seed list, stop here and contact a Discord Administrator Team Lead via the Constellation Network Official Discord. You must wait for the next cluster restart that includes a seed list update before continuing.


    ⬆️ Perform a Node Upgrade

    Use the upgrade command to prepare your node for the cluster connection:

    The -ni flag enables non-interactive mode, accepting default values automatically.


    ⚙️ For Single Layer1 Nodes

    If you're operating a Layer1-only Metagraph Validator, you may skip directly to the Join Layer1 step at the bottom of this guide.


    🧬 For Hybrid Nodes

    Hybrid nodes must reach a Ready state on Layer0 before joining Layer1.

    ⚠️ Expected Behavior:

    After your node completes Layer0 connection steps, it will attempt to join the Layer1 profile and fail. This is expected and not a concern at this stage.

    This happens because Layer1 participation is blocked until your node fully syncs the Layer0 snapshot chain.

    During this period, your node will transition through the following statuses:

    • SessionStarted

    • DownloadInProgress


    📥 Monitor for DownloadInProgress State

    After upgrading, verify your node has reached the correct syncing phase:

    Expected Output:

    If you see SessionStarted, continue running the command periodically until it transitions to DownloadInProgress.


    ⏳ Wait for Ready State

    Your node will now download the entire snapshot chain from the Layer0 cluster. This process may take several days.

    You have two options:

    • Wait for your node to reach the Ready state.

    • Proceed to the optional next step to speed up the snapshot process using the Starchiver utility.


    🚀 Optional: Execute Starchiver to Speed Up Sync

    To accelerate snapshot syncing:

    👀 Monitor your node closely to ensure the process completes without error.

    🚧 Caution: Starchiver is a community-supported tool and not officially supported by Constellation Network. Use at your own risk. For issues, contact the tool's maintainer via GitHub or seek help on the Constellation Discord.


    📊 Verify Node Status

    Once your node has completed downloading the snapshot chain, it will enter the Ready state and begin participating in consensus.

    To verify:

    Look for the following:

    For Layer1:

    🔄 To monitor the transition in real time:

    Use the q key to exit the watch command gracefully.


    🔗 Join Layer1 (For Hybrid Nodes Only)

    If Layer1 displays ReadyToJoin, you may initiate the join process:

    If your node is in any other state, restart the profile before retrying:


    Once the above steps are complete and your node is fully synced and participating in consensus, your first-time connection process is complete.

    Troubleshoot EdgePointDown Message

    Resolve IPv6-related Connection Issues on Your Validator Node

    🧠 Understanding the Issue

    The EdgePointDown status typically indicates a failure in establishing communication between your node and the network’s edge points.

    A known root cause is the system resolving outbound connections using IPv6 instead of IPv4, which can happen in scenarios such as:

    • The cloud provider defaults to IPv6 or uses IPv6-to-IPv4 translation

    • The network infrastructure between your VPS and Constellation’s edge points mishandles IPv6

    • DNS resolution or routing forces IPv6 where IPv4 is required for compatibility

    ⚠️ This guide addresses IPv6-related causes only.

    As new root causes are discovered, this document will be updated.


    1

    Backup Your .p12 Keystore

    ⚠️

    Check IPv6 Status

    ⚠️ If either status is already disabled, your issue is not IPv6-related. Stop here and seek assistance from a Team Lead via the .


    Restart Auto Restart (Optional)

    To ensure the monitoring service is in sync with the updated configuration:


    Conclusion

    ✅ Your node should now resume connection attempts using IPv4.

    If the EdgePointDown issue was caused by IPv6, it should be resolved.

    If problems persist, please reach out to the Constellation Network support team or a Team Lead in Discord.

    Troubleshoot nodectl upgrade

    Resolve Issues When Upgrading Older Versions of nodectl

    Introduction

    As nodectl evolves, the upgrade process also changes.

    This guide helps bring your outdated nodectl installation up to the current recommended version using a versioned, step-by-step upgrade path.


    Upgrade nodectl Version

    Upgrade your node control utility.

    Introduction

    This guide provides a streamlined process to upgrade your nodectl utility to the latest supported version, while following the recommended upgrade path.


    1

    Reinstallation Guide

    Rebuild a Constellation Network node with an existing P12 keystore.

    Introduction

    One of the lesser defining characteristics of a Constellation Network Validator Node is its ephemeral nature. This means that nodes are designed to be easily rebuildable, making re-deployment a cleaner and often more efficient solution compared to deep troubleshooting.

    Whether you're:

    The authenticity of host '13.13.13.13 (13.13.13.13)' can't be established.
    ECDSA key fingerprint is SHA256:AbCdEfGhIjKlMnOpQrStUvWxYz1234567890+=.
    Are you sure you want to continue connecting (yes/no)?
    The authenticity of host '13.13.13.13 (13.13.13.13)' can't be established.
    ECDSA key fingerprint is SHA256:AbCdEfGhIjKlMnOpQrStUvWxYz1234567890+=.
    Are you sure you want to continue connecting (yes/no)? yes
    ubuntu@your-vps-name:~$
    sudo apt -y update && sudo apt -y upgrade
    sudo apt -y install haveged
    sudo apt -y install default-jdk
    sudo wget https://github.com/Constellation-Labs/tessellation/releases/download/v1.0.1/mainnet-seedlist -P /var/tessellation; sudo chmod +x /var/tessellation/cl-wallet.jar -O /var/tessellation/seed-list -o /dev/null
    export CL_EXTERNAL_IP=113.113.113.113
    export CL_KEYALIAS="myConstellationAlias"
    export CL_KEYSTORE="/home/nodeadmin/tessellation/myconstellation.p12"
    export CL_APP_ENV="testnet"
    export CL_PUBLIC_HTTP_PORT=9000
    export CL_P2P_HTTP_PORT=9001
    export CL_PASSWORD="my_p12_keystore_pass"
    java -jar /var/tessellation/cl-keytool.jar generate
    chmod 600 ~/tessellation/myconstellation.p12
    /usr/bin/java -jar '-Xms1024M' '-Xmx7G' '-Xss256K' /var/tessellation/cl-node.jar run-validator --seedlist /var/tessellation/seed-list & 
    /usr/bin/java -jar '-Xms1024M' '-Xmx3G' '-Xss256K' /var/tessellation/cl-dag-l1.jar run-validator --public-port 9010 --p2p-port 9011 --cli-port 9012 &
    curl -X POST http://127.0.0.1:<private_cli_port>/cluster/leave
    ps -ef
    kill <process_no>
    Experiencing inconsistent OS behavior,
  • Choosing to upgrade your distribution via a fresh VPS (rather than an inline upgrade),

  • Switching cloud providers,

  • Or facing any other scenario that requires spinning up a new instance,

  • Rebuilding your node is not only possible, it’s encouraged.


    🔄 Rebuilding with Your Existing .p12 Keystore

    This guide will walk you through the process of reinstalling your existing .p12 keystore on a new VPS instance so your validator node can resume operation quickly and securely.

    By the end of this process, your new instance will be configured with your existing wallet, allowing you to seamlessly rejoin the network without starting from scratch.

    Step 1️⃣

    Connect to your OLD VPS and backup ( obtain ) your current p12 keystore.

    This step is critical for a successful reinstallation.

    If you no longer have access to your old VPS and do not possess a valid backup of your .p12 keystore, please contact a system administrator immediately. In this case, you will need to rebuild a new node from scratch and follow the instructions in the normal installation guide.

    $DAG tokens can still be accessed and recovered through your Stargazer Wallet, provided you retain access there. See the Collateralize Your Node guide for further details.

    Step 2️⃣

    Rebuild your VPS

    Step 3️⃣

    Restore your p12 to the new VPS prior to begin an installation.

    Step 4️⃣

    Follow either the Quick Install or Normal Installation guide up to the migration section.

    At that point:

    1. When prompted, select y to proceed with the keystore migration.

    2. nodectl will automatically scan your VPS for any available .p12 keystore files.

    3. In this scenario, it should detect only one .p12 file, the one you uploaded during the earlier step.

    Select the identified .p12 keystore and continue following the installation guide as normal to complete your validator node setup.

    ♻️Backup/Restore a P12 KeyStore
    🚧Generic Build a VPS Guide
    ♻️Backup/Restore a P12 KeyStore
    🐇Quick Install Guide
    🎨Normal Install Guide

    root

    Digital Ocean or Hetzner may use this as the default.

    ubuntu

    AWS may use this as default.

    admin

    Debian 12 users may need to use the admin username as the default for initial connections.

    ssh -i C:\Users\Alice\.ssh\node_private_key [email protected]
    ssh -i /Users/alice/.ssh/node_private_key [email protected]
    ssh -i /home/alice/.ssh/node_private_key [email protected]

    cl-wallet.jar - Wallet tool utility specific to Constellation Network's Tessellation

    Tessellation Latest Releases
    tagged release. These releases are developmental and may contain bugs that can interfere with your node's operations.

    Please ensure you download the correct version for your Linux distribution. The background libraries required to compile and run nodectl differ between Ubuntu 22.04 and Ubuntu 24.04. Downloading the wrong version will result in an inoperable nodectl utility and numerous error messages.

    Attempt to disable nodectl's auto restart feature if nodectl may already be installed on the system to avoid conflicts when attempting to download the nodectl utility. This command will produce an expected error that we can safely ignore.

  • The next command will use wget to download the nodectl utility and place it in the appropriate directory for seamless execution.

  • Next, the permissions of the nodectl binary will be set to executable, allowing you to run the command.

  • Finally, the last command in the sequence will run the version check, allowing you to verify that nodectl was successfully downloaded, placed in the correct location, has the proper permissions, and is running the expected version.

  • https://github.com/StardustCollective/nodectl/releases

    Administer Your Node

    Password used to confirm authorization.

    When issuing administrative commands on your node, you will be required to enter your sudo password associated with the nodeadmin user whenever a privileged action is executed or your session times out.

    The nodectl utility operates with elevated privileges and therefore requires sudo access to perform many of its core functions.

    3

    P12 Key Store

    PKCS#12, or PFX

    The P12 keystore (also referred to as PKCS#12 or PFX) contains your cryptographic key pair, both the private and public keys. it is used for signing transactions on the node. These keys also serve as authentication credentials for managing your node’s hot wallet.

    The passphrase protecting this keystore is critical: it is required to authorize actions related to rewards, collateral management, and token transfers. Store this passphrase securely, as losing it may result in permanent loss of access to these functions.

    If you have previously imported your node’s private key into the Stargazer wallet, it is possible to recover access to your funds even if the P12 keystore is lost or the keystore passphrase is forgotten. This is because the private key alone is sufficient to restore control over the associated wallet and its assets.

    Secured Software Manager

    There are password managers that allow for keeping passwords, passphrases, notes, and documents. From LastPass, 1Password, Bitwarden, Dashlane, KeePass, to others.

    USB Stick

    Placing your information on a USB stick that is stored in a secure location such as a safe.

    Physical Piece of Paper

    Writing down your notes and storing in a secure location such as a safe.

    ​
    ​
    ​
    SSH Remote Access
    sudo nodectl update && sudo nodectl upgrade
    sudo wget https://github.com/Constellation-Labs/tessellation/releases/download/v1.0.1/cl-node.jar -P /var/tessellation; sudo chmod +x /var/tessellation/cl-node.jar
    sudo wget https://github.com/Constellation-Labs/tessellation/releases/download/v1.0.1/cl-dag-l1.jar -P /var/tessellation; sudo chmod +x /var/tessellation/cl-dag-l1.jar
    sudo wget https://github.com/Constellation-Labs/tessellation/releases/download/v1.0.1/cl-wallet.jar -P /var/tessellation; sudo chmod +x /var/tessellation/cl-wallet.jar
    sudo wget https://github.com/Constellation-Labs/tessellation/releases/download/v1.0.1/cl-keytool.jar -P /var/tessellation; sudo chmod +x /var/tessellation/cl-keytool.jar
    [email protected]:~# sudo nodectl version
      VERSION     MAJOR     MINOR     PATCH    CONFIG
      vX.XX.X     X         X         X        vX.X.X
    Constellation Validator Node Notes:
    
    To access our node:
        open a terminal and enter:
        ssh -i /home/myuser/.ssh/myprivatekey [email protected]
        
        This command will attempt to SSH into our VPS/node 
        We will be challenged for access to supply the passphrase.
        passphrase: efg6abc13efg6
    
        If the command hangs or an error message stating 
        "refused" check to make sure that our firewall 
        on the VPS is properly setup to use the local 
        IP address of our system. During installation, 
        we restricted this down to a specific IP of our 
        local system, that may have changed.   
        www.whatismyip.com
    
    To issue commands using nodectl we use sudo
       We need to use our nodeadmin password here:
       passphrase: efg6abc13efg6
    
    If we need to access our p12 file (hot wallet)
       passphrase: abc13efg6abc13
    
    Reminders:
    ----------
    ssh private key: myprivatekey
    ssh public key: mypublickey.pub
    ssh passphrase: efg6abc13efg6
    location of keys:
       - on this USB stick
       - local mac directory: /home/myuser/.ssh/
    
    p12 keystore name (hot wallet): myp12name.p12
    p12 keystore passphrase: abc13efg6abc13
    
    VPS IP: 113.113.113.113
    VPS SSH port: 22
    VPS username: mynodeadmin
    VPS sudo password: 
    
    Access My Node
    --------------
    1. Open Terminal Session
    2. ssh -i /Users/yourname/.ssh/myprivatekey [email protected]
    
    * After typing in: sudo nodectl
      you can double-tap the tab key for a list
      of commands.
      
    Key Commands
    ------------
    sudo nodectl status
    sudo nodectl restart -p all
    sudo nodectl upgrade
    sudo nodectl check_versions
    sudo nodectl check_consensus
    sudo nodectl dag -p dag-l0
    Constellation Validator Node Notes:
    
    To access our node:
        open PuTTy
        select our saved session from the 
        PuTTy main menu, load, and then open
        (or double click)
        
        This command will attempt to SSH into our VPS/node 
        We will be challenged for access to supply the passphrase.
        passphrase: efg6abc13efg6
    
        If the command hangs or an error message stating 
        "refused" check to make sure that our firewall 
        on the VPS is properly setup to use the local 
        IP address of our system. During installation, 
        we restricted this down to a specific IP of our 
        local system, that may have changed.   
        www.whatismyip.com
    
    To issue commands using nodectl we use sudo
       We need to use our nodeadmin password here:
       passphrase: hij678hij678&*()
    
    If we need to access our p12 file (hot wallet)
       passphrase: abc123abc123!@#
    
    Reminders:
    ----------
    ssh private key: myprivatekey
    ssh public key: mypublickey.pub
    ssh passphrase: efg345efg$%%^
    location of keys:
       - on this USB stick
       - <enter saved location here>
    
    p12 keystore name (hot wallet): myConstellationP12File.p12
    p12 keystore passphrase: abc123abc123!@#
    
    VPS IP: 113.113.113.113
    VPS SSH port: 22
    VPS username: nodeadmin
    VPS sudo password: hij678hij678&*()
    
    Access My Node
    --------------
    1. Open Terminal Session
    2. ssh -i C:\Users\myuser\.ssh\myprivatekey [email protected]
    
    * After typing in: sudo nodectl
      you can double-tap the tab key for a list
      of commands.
    
    Key Commands
    ------------
    sudo nodectl status
    sudo nodectl restart -p all
    sudo nodectl upgrade
    sudo nodectl check_versions
    sudo nodectl check_consensus
    sudo nodectl dag -p dag-l0 (intnet-l0) (dor-dl1)
    ssh -i /path/to/ssh/private/key root@<vps_ip_address>
    sudo nodectl check_seedlist -p dag-l0
    NODE ID FOUND ON SEED LIST
    True
    sudo nodectl upgrade -ni
    sudo nodectl status -p dag-l0
    JOIN STATE
    DownloadInProgress
    sudo nodectl execute_starchiver -p dag-l0 --restart
    sudo nodectl status -p dag-l0
    Layer0
    JOIN STATE       Ready
    IN CONSENSUS     True
    Layer1
    JOIN STATE       ReadyToJoin
    sudo nodectl status -p dag-l0 -w 120
    sudo nodectl join -p dag-l1
    sudo nodectl restart -p dag-l1

    CPX51 is recommended

  • CX52 is also recommended is aviable

  • CPX41 may suffice however, you will run into disk space issues so be cautious.

  • Dor Data Layer 1 Nodes

    • CX22

    • CPX11

    Follow this document Upload SSH Public Key.

    If the Name field does not populate, create a name for the key that will help you identify it later.

    Click the Add SSH key button.

    Select your SSH key if not already checked.

    section, you should see a
    TCP
    ➡️
    22 rule.

    Please refer to Wide Open SSH Access document for details on the security implications of allowing any system that is connected to the internet to have access to your SSH port. This document contains instructions on how to determine your local IP address for entry in this section.

    If you decide to leave your SSH access wide open you can skip to the next step.

    Click on Any IPv4 it will turn red, click the delete to remove it.

    Click on Any IPv6 it will turn red, click the delete to remove it.

    Type in the IP address you retrieved that is allocated to your local system into the same box to replace the Any IPv4 and Any IPv6 entries, and hit enter.

    Replace the Add description with SSH

    Any IPv6
    entries.

    Leave the TCP protocol type

    Replace in 9010 for the Port

    Replace in 9011 in the Port range

    Replace Add description with Layer1

    Repeat the previous step to add a rule for Layer0.

    Ports 9000 and 9001.

    Click on the Create Resource button.

    Choose Servers.

    CPUs, and
    320Gb
    disk.

    Recommended: 32Gb Memory configuration ( available with Premium Intel/AMD )

    Follow this document Upload SSH Public Key.

    If the Name field does not populate, create a name for the key that will help you identify it later.

    Click the Add SSH key button.

    Select your SSH key if not already checked.

    Project
    .
    to remove those items and add your local IP address. In the example the fake IP of
    13.13.13.13/32
    is used.

    Once you enter the IP address you will see an Add "13.13.13.13/32 ( similar ) which you will need to click on to populate the Sources for your SSH remote access.

    Please refer to Wide Open SSH Access document for details on the security implications of allowing any system that is connected to the internet to have access to your SSH port. This document contains instructions on how to determine your local IP address for entry in this section.

    enter in
    9010-9011

    Leave the Sources as All IPv4 and All IPv6

    enter in
    9000-9001

    Leave the Sources as All IPv4 and All IPv6

    If you gave your droplet a hostname during the Finalize Details step above begin to type in that hostname and it should auto populate into the provided box.

    If you left the hostname as default type in u and wait for the box to auto populate with default ubuntu name

    Select the droplet to populate the Apply to Droplets box.

    No spaces allowed
    Important:

    This procedure modifies your VPS’s system configuration. If a misstep occurs, you may lose node connectivity.

    2

    Confirm Your nodectl Version

    You must be running nodectl v2.15.2 or later:

    3

    Check IPv6 Status

    Expected output:

    If you find IPv6 is disabled, you do not need to continue this troubleshooting guide. Please contact an administrator.

    4

    Disable IPv6 with sysctl

    To restrict the system to use IPv4-only routing:

    This updates the system configuration to disable IPv6 via sysctl.

    ⚠️ If either status is already disabled, your issue is not IPv6-related. Stop here and seek assistance from a Team Lead via the .

    ♻️Backup/Restore a P12 KeyStore
    Constellation Network Official Discord
    Directly From The nodectl Utility
    1

    Check Your Current Version

    2

    Determine Upgrade Path

    3

    Follow upgrade path

    Choose the next available version required by the output in the previous step.

    4

    Upgrade your Node

    To verify that everything remains in perfect working order, issue a standard node upgrade.

    You may omit the --ni if you would like an interactive experience.


    Manual Download


    1

    Releases page

    Open your browser and visit the nodectl Releases Page.

    2

    Determine Version

    Locate the version you want to install.

    3

    Obtain Download Link

    Copy the direct download link for the release file that matches the Linux distribution you are running on your VPS.

    4

    Issue an upgrade

    You may omit the --ni if you would like an interactive experience.

    Access your Node
    2

    Begin the Upgrade Process

    3

    Choose the Correct Upgrade Path

    You will be prompted to select between two available versions:

    • The latest version

    • The last known upgrade path version

    ⚠️ Important: Select the version that follows the recommended upgrade path. Skipping versions may result in misconfiguration or compatibility issues.

    • Press the corresponding number key (no need to press Enter).

    • Press y to confirm your selection.

    4

    Verify the Upgrade Signature

    After download, ensure the following message appears:

    🚫 If you see:

    Stop immediately. Do not run additional commands. Report the issue via the Constellation Network Official Discord to verify the integrity of your upgrade and prevent potential malicious activity.

    5

    Tessellation Upgrade (If Prompted)

    You may now be asked whether to upgrade Tessellation as part of the upgrade flow.

    • 🛑 If not required: Skip to next step

    • ✅ If required: Press y and follow the prompts

    You may optionally refer to the full for details before continuing

    6

    Restart Auto Restart Feature (Optional)

    If you’re using the auto_restart feature, it’s recommended to manually restart it to ensure any upgrade-related updates are applied:

    🎉 Congratulations!

    Your node is now running the latest version of nodectl, fully updated and ready for continued participation in the Constellation Network.


    You can confirm your version using:

    ♻️How to SSH into VPS

    Build AWS EC2 Instance

    Amazon Web Services Specific Build Process

    Before we begin

    Please make sure you created your SSH key pairs prior to starting these steps.

    SSH Remote Access

    VPS Build Procedure

    Creating your account on AWS is a simple process similar to all other SaaS model services. At the current time, we will leave this process up to you.

    1

    Sign Up for an AWS account

    2

    Complete

    You have successfully launched a VPS instance in AWS, Congratulations

    You are now ready to continue to connect to your node for the first time, install nodectl and turn your EC2 instance (VPS) into a Constellation Network Validator Node!

    Quick Install Guide

    Turn your VPS into a node using quick install guide

    This guide walks you through the fully automated “quick-install” of a Constellation validator node using nodectl’s --quick-install mode. All defaults are recommended settings, and you’ll see a live progress bar throughout.

    🚩Node Prerequisites

    Begin Quick Install

    1

    Start the installation using quick install

    For advanced users, if you prefer one-command install, supply any of these flags:

    • --p12-passphrase <pass>

    • --p12-alias <alias>

    2

    Verify Specifications

    When you first launch the nodectl utility, it will guide you through selecting the type of validator node you wish to install.

    Choose H to build a Hypergraph validator node or D to build a Dor Data Layer 1 validator node..

    3

    Continue

    If you node meets all the proper you may press any key to continue.

    4

    Build Begins

    You can now sit back and monitor the progress as nodectl begins building your node using all the recommended options.

    5

    Assign Your Cluster

    After a few moments, you will be prompted to select the cluster you wish to join.

    Based on your selection, nodectl will download a predefined configuration tailored to the chosen Hypergraph or metagraph cluster.

    Choose 1 through 4 depending your requirements.

    6

    Migrating an Existing P12

    You may enter n or just press Enter to accept the default [n] option.

    7

    Node Administrator Password

    No action is needed here.

    You will see validation of your choice to join a specific cluster including:

    • Hypergraph or metagraph cluster name

    8

    Create Your nodeadmin Password

    You will be prompted to create a for the nodeadmin user, which will serve as the default user on this VPS/node. This password will be required to execute administrative commands using nodectl going forward.

    9

    P12 Keystore Passphrase

    You will be prompted to enter a for your node’s .p12 keystore (wallet). This passphrase is required to perform signing requests and access your node’s hot wallet on the blockchain.

    10

    Record For Later

    It is important to securely record your username, password, .p12 keystore filename, keystore passphrase, and node alias for future reference. These details are easy to forget and losing them could lead to serious consequences.

    11

    Allow Installation to Complete

    The installer now has all the necessary information to complete the node setup.

    You can sit back and relax while your node is automatically built.

    12

    Completed Install Screen

    The nodectl utility will finish by displaying a final instructional page.

    Review it carefully, record any important information in your .

    The following instructions will be explained in greater detail in the post-seeding documents available on our documentation hub.

    13

    Final instructions

    Now that your VPS has been successfully configured as a Constellation Network node, there are a few final steps to complete before proceeding to the to bring your node online.

    Normal Install Guide

    Turn your VPS into a node using a normal installation.

    This guide will walk you through the steps required to convert a VPS or bare-metal server into a Constellation Validator Node.

    A normal installation provides more customization options during setup, whereas the quick installation only prompts for essential inputs and uses recommended defaults for all other settings outlined in this guide.

    🚩Node Prerequisites

    Begin Installation

    1

    Start the Installer

    For advanced users, if you prefer one-command install, supply any of these flags:

    • --normal

    • --p12-passphrase <pass>

    2

    Verify Specifications

    When you first launch the nodectl utility, it will guide you through selecting the type of validator node you wish to install.

    Choose H to build a Hypergraph validator node or D to build a Dor Data Layer 1 validator node..

    3

    Continue

    If you node meets all the proper you may press any key to continue.

    4

    Quick Install Request

    We will type in n and hit Enter.

    5

    Assign Your Cluster

    Based on your selection, nodectl will download a predefined configuration tailored to the chosen Hypergraph or metagraph cluster.

    Choose 1 through 4 depending your requirements.

    6

    Migrating an Existing P12

    You may enter n or just press Enter to accept the default [n] option.

    7

    Downloads

    You user interaction needed during this step.

    The nodectl utility will being the process of installing your node. You will see output from the installation as nodectl performs the following:

    8

    Continue

    Press any key to continue

    9

    Setup non-root administrator account for our node

    You will be prompted to specify the name of the Node Administrator account you will use for SSH remote access after installation.

    The default username is nodeadmin, and all subsequent documentation will reference this default.

    Enter the a custom user and press Enter

    10

    Create Your nodeadmin Password

    You will be prompted to create a for the nodeadmin user, which will serve as the default user on this VPS/node. This password will be required to execute administrative commands using nodectl going forward.

    11

    SSH Key Pair

    Press Enter to accept the default selection of y.

    Choosing y will transfer the SSH key from the default user (ubuntu or root

    12

    Disable root Access & Special Accounts

    In 99% of the cases, your Constellation Validator Node will have direct access to the Internet.

    To enhance security, it is recommended to disable access for commonly known default accounts, such as the root user and other special system users ( default ubuntu or admin accounts common preconfigured on default VPS images ).

    13

    Disable Password Authentication

    Since SSH keys are being used to securely access your node, it is strongly recommended to disable username and password authentication.

    This prevents unauthorized access through brute-force password attempts and significantly enhances your node’s security.

    14

    Dynamic Structures

    Allow nodectl to create the required directory structures that your node will utilize during standard protocol operations.

    Press any key to continue

    15

    Choose P12 Keystore name

    You will be offered the ability to create a specific name for you p12 keystore that will be used to hold your private and public keys used for signature requests, wallet administration, and other validator node operations.

    You may choose a name of your choosing and press Enter.

    16

    P12 Keystore Passphrase

    You will be prompted to enter a for your node’s .p12 keystore (wallet). This passphrase is required to perform signing requests and access your node’s hot wallet on the blockchain.

    17

    P12 Keystore Alias

    You will be prompted to create an alias for your node’s wallet.

    This alias is required for certain behind-the-scenes operations specific to the Constellation Network.

    Please choose a unique and recognizable alias for your .p12 keystore.

    18

    Encryption Services

    The nodectl utility provides the option to encrypt your .p12 passphrase using the SHA3-512 algorithm.

    This adds an extra layer of security by ensuring the passphrase is not stored in plain text within your configuration file.

    Recommended to choose y

    19

    Record For Later

    It is important to securely record your username, password, .p12 keystore filename, keystore passphrase, and node alias for future reference. These details are easy to forget and losing them could lead to serious consequences.

    20

    Completed Install Screen

    The nodectl utility will finish by displaying a final instructional page.

    Review it carefully, record any important information in your .

    The following instructions will be explained in greater detail in the post-seeding documents available on our documentation hub.

    21

    Final instructions

    Now that your VPS has been successfully configured as a Constellation Network node, there are a few final steps to complete before proceeding to the to bring your node online.

    Troubleshoot Node Alerting

    Diagnose Alert Delivery Issues for the Optional Alerting Extension in nodectl

    Introduction

    This guide provides a series of basic troubleshooting steps to help you resolve issues with the alerting module associated with the auto_restart feature in nodectl.


    sudo nodectl version
    sudo nodectl ipv6 status
    --------- * IPV6 STATUS * ---------
    Interface found ................... eth0
    
    IPv6 sysctl Status   IPv6 GRUB Status
    enabled              enabled
    sudo nodectl ipv6 disable --ni --sysctl
    sudo nodectl auto_restart restart
    sudo nodectl version
    sudo nodectl upgrade_nodectl
    SUCCESS - AUTHENTIC NODECTL
    INVALID SIGNATURE - WARNING
    sudo nodectl auto_restart restart
    nodectl version
    Constellation Network Official Discord
    Tessellation upgrade guide
  • --user <username>

  • --user-password <password>

  • --p12-destination-path <path>

  • --p12-migration-path <path>

  • --confirm (auto-accept warnings)

  • Warning: If you use any of the options/flags to supply a password or passphrase at the command line, these sensitive flags end up in your shell's history.

    It is strongly advised to clear your history after the installation completes with the history -c command ( -c= clear )

    🔵 Coming from the Migration Guide?

    If you are performing a New Node Installation with .p12 Migration, you may press y at this prompt to allow nodectl to automatically scan your VPS for any available .p12 keystore files. Once detected, you will be presented with a list to select from, choose the appropriate file to continue the installation.

    Default username nodeadmin

  • Defaults p12 keystore name nodeadmin-node.p12

  • Default alias nodeadmin-alias

  • Reminder to use proper password requirements.

    Enter and confirm the password.

    Reminder to use proper passphrase requirements.

    Enter and confirm the passphrase.

    Node Operator Notes
    specifications
    password
    passphrase
    notes
    First-Time Connection Guide
  • --p12-alias <alias>

  • --user <username>

  • --user-password <password>

  • --p12-destination-path <path>

  • --p12-migration-path <path>

  • --confirm (auto-accept warnings)

  • 🔵 Coming from the Migration Guide?

    If you are performing a New Node Installation with .p12 Migration, you may press y at this prompt to allow nodectl to automatically scan your VPS for any available .p12 keystore files. Once detected, you will be presented with a list to select from, choose the appropriate file to continue the installation.

  • or just press
    Enter
    to accept the default

    If you choose to use a custom username, please substitute it wherever nodeadmin is mentioned after completing this step.

    Reminder to use proper password requirements.

    Enter and confirm the password.

    ) to the newly created Node Administrator account.

    You will also be prompted to choose whether to disable root access via SSH, enhancing your server’s security.

    Local Bare Metal Server may use advanced methods for access control and should decided accordingly

    Using the strongest security practices is essential in these scenarios to protect your node and its associated wallet.

    We will choose y or just press Enter.

    Local Bare Metal Server may use advanced methods for access control and should decided accordingly

    Reminder to use proper passphrase requirements.
    .

    Allow nodectl a moment to encrypt your passphrase.

    Node Operator Notes
    specifications
    password
    passphrase
    notes
    First-Time Connection Guide
    🚨 Support Disclaimer

    Important

    The alerting module is a community extension of nodectl and not officially supported.

    Use at your own risk. Limited support is available, and advanced troubleshooting may not be provided.


    🔁 Step 1: Clear the Alerting Cache

    Start by clearing the alerting module’s internal cache:

    This resets any internal flags that may be preventing alert dispatch.


    📬 Step 2: Send a Test Report

    To test if the daily reporting mechanism works:

    Check your inbox for the report. If not received, continue with the next steps.


    📣 Step 3: Send a Test Alert

    Trigger an alert manually:

    This simulates a node failure alert. Verify that the message is received by the configured email or SMS gateway.


    🧾 Step 4: Review Logs

    Check the nodectl logs for any errors related to alert dispatch:

    Look for entries that may indicate connection failures, authentication errors, or message rejection.


    📥 Step 5: Check Email Spam Filters

    If alerts are routed to a standard email inbox:

    • Check your Spam or Junk folders

    • Add the configured sender (e.g., your Gmail alert account) to your email whitelist or safe senders list

    • Create filter rules in your email settings to allow all mail from that address to reach your inbox

    • Confirm your email provider hasn’t rate-limited or blacklisted your alerting Gmail account


    📱 Step 6: Mobile SMS/MMS Alerting Considerations

    If you’re routing alerts to a mobile number via email-to-SMS/MMS:

    • ✅ Ensure MMS is supported and enabled on your phone

    • ✅ Test sending a manual email to your mobile email address (e.g., [email protected])

    • ⚠️ Contact your mobile carrier and request approval to receive messages from your node’s Gmail address—some providers block automated or high-frequency alerts

    • 🚫 Mobile providers may "black hole" repetitive or unauthenticated email messages to prevent spam


    🆘 Step 7: Seek Help (Last Resort)

    If you've exhausted all basic troubleshooting steps:

    • Join the Constellation Network Official Discord

    • Navigate to the appropriate validator support channel

    • Provide details such as:

      • Your nodectl version

      • Email provider used for alerts

      • Mobile provider (if applicable)

      • Relevant error logs or symptoms

    sudo nodectl install --quick-install
      ========================================
      =   CONSTELLATION NETWORK HYPERGRAPH   =
      =          VERIFY NODECTL SPECS        =
      =         PRE-INSTALLATION TOOL        =
      ========================================
      Code Name: Princess Warrior
    
      Please choose node type to test:
      H)ybrid Dual Layer
      D)or Validator
      Q)uit
    
      KEY PRESS an option
      HYPERGRAPH or METAGRAPH
      predefined choices
      -------------------------------------------
      1) mainnet [HyperGraph]
      2) integrationnet [HyperGraph]
      3) testnet [HyperGraph]
      4) dor-metagraph-mainnet [metagraph]
    
      Q)uit
    
      KEY PRESS an option
     ------ * INSTALLATION COMPLETE * -------
    
      CONGRATULATIONS!
      Below you will find your nodeid which 
      was derived from your p12 file
      Please report this nodeid to administrative 
      staff to gain access to the network via the 
      access  list permissions.
    
      HyperGraph/metagraph ..................... hypergraph
      Environment .............................. mainnet
      P12 Location ............................. /home/nodeadmin/tessellation
      P12 Name ................................. nodeadmin-node.p12
      P12 Alias ................................ nodeadmin-alias
    
       ----- * CHECK SEED LIST REQUEST * ------
    
      NODE ID
      <your_node_id_here>
      NODE ID FOUND ON SEED LIST
      False
      DAG WALLET ADDRESS
      <your_dag_wallet_address_here>
    sudo nodectl install
      ========================================
      =   CONSTELLATION NETWORK HYPERGRAPH   =
      =          VERIFY NODECTL SPECS        =
      =         PRE-INSTALLATION TOOL        =
      ========================================
      Code Name: Princess Warrior
    
      Please choose node type to test:
      H)ybrid Dual Layer
      D)or Validator
      Q)uit
    
      KEY PRESS an option
      HYPERGRAPH or METAGRAPH
      predefined choices
      -------------------------------------------
      1) mainnet [HyperGraph]
      2) integrationnet [HyperGraph]
      3) testnet [HyperGraph]
      4) dor-metagraph-mainnet [metagraph]
    
      Q)uit
    
      KEY PRESS an option
     ------ * INSTALLATION COMPLETE * -------
    
      CONGRATULATIONS!
      Below you will find your nodeid which 
      was derived from your p12 file
      Please report this nodeid to administrative 
      staff to gain access to the network via the 
      access  list permissions.
    
      HyperGraph/metagraph ..................... hypergraph
      Environment .............................. mainnet
      P12 Location ............................. /home/nodeadmin/tessellation
      P12 Name ................................. nodeadmin-node.p12
      P12 Alias ................................ nodeadmin-alias
    
       ----- * CHECK SEED LIST REQUEST * ------
    
      NODE ID
      <your_node_id_here>
      NODE ID FOUND ON SEED LIST
      False
      DAG WALLET ADDRESS
      <your_dag_wallet_address_here>
    sudo nodectl auto_restart clear_alerts
    sudo nodectl auto_restart send_report
    sudo nodectl auto_restart alert_test
    sudo nodectl logs -l nodectl

    Create SSH Keys

    If you have not yet created your SSH keys, please follow the instructions at the link below to generate your public and private key pair:

    SSH Remote Access

    Once you have successfully generated your SSH keys, return here and continue to the next step.

    3

    Navigate to EC2 Console

    • Enter in ec2 in the search bar at the top left

    • Rest your mouse over EC2 Virtual Services in the Cloud

    • Click on Dashboard in the top features section.

    4

    Access Key Pair Console

    Choose Key Pairs from the Network & Security section

    Choose Actions and Import key pair

    • Decide on a key pair name that you will use to identify your key pair later.

    • You should have already created your , if not, please do so and return to this step.

    • Click the Browse to navigate to your public key on your local system, select that key and choose Open

    • Import key pair

    You will be returned to the Key pairs console and should see your key pair in the list (table) of the console with details about the key.

    5

    Access Security Groups Console

    From the same Network & Security section choose Security Groups .

    • Create a new security group.

    Leave the VPC at the default.

    6

    Create your rules

    From the Inbound rules select Add rule

    • Select Type SSH

      • Please refer to document for details on the security implications of allowing any system that is connected to the internet to have access to your SSH port. This document contains instructions on how to determine your local IP address for entry in this section.

      • Destination choose Custom

    • Choose the Add rule again.

    This rule is designed for both a Hypergraph hybrid layer validator DAG layer1 and a Dor data layer 1 nodes.

    • Select Type Custom TCP

      • Port Range 9010-9011

      • Destination Anywhere-IPv4

    This rule is designed for validator Hypergraph layer0 nodes.

    • Choose the Add rule again

    • Select Type Custom TCP

      • Port Range 9000-9001

    You will be returned to the security group console and you should see your security group in the list table.

    7

    Enter EC2 instances console

    Click on the Instances from the Instances section on the left side panel.

    8

    Enter Launch Instances Wizard

    Click on Launch instances on the top right of the screen.

    9

    Name your VPS

    In the Name and tags section enter the name you would like to call your VPS.

    10

    Choose your Application and OS Image

    Choose Ubuntu

    The AMI will auto populate.

    Ubuntu Server 24.04

    Leave the default options

    11

    Choose your Instance Type

    Click the drop down and type in the search:

    Hypergraph Validator: m7i.2xlarge or t2.2xlarge

    Dor Data Layer 1 Validator: t2.medium

    12

    Choose your key pair (SSH)

    Click on the drop down inside the Key pair section and choose the key pair you uploaded in step 4.

    13

    From the Network Settings section

    Select the Select existing security gruop and select your security group (firewall policy) from the list.

    14

    From the Configure Storage section

    Set the size to 320 GiB gp3

    15

    Launch instance

    Click Launch instance from the left side Summary section.

    16

    Success Confirmation

    Select the link to the instance ID from the green success box.

    17

    Enter the details of your new VPS

    Select the link to the instance ID from the list table

    18

    Record the IP address of your VPS

    AWS Sign Up Page

    Backup/Restore a P12 KeyStore

    Table of Contents

    🔐Backup P12 Keystore File

    Maintaining an up-to-date and secure backup of your .p12 file is essential for protecting access to your Validator node and wallet. This guide will walk you through securely backing up and restoring your .p12 file using a macOS or Windows system.


    1

    Determine Cold Storage Medium

    What and Why Cold Storage?


    🔄 Restore P12 Keystore File

    1

    Obtain p12 keystore backup from cold storage

    • Access your backup device

    Troubleshoot SSH Connection

    Introduction

    This guide is designed to help you troubleshoot and restore SSH access to your Validator node when it was previously working but is now unreachable.

    ♻️How to SSH into VPS

    Common Steps

    ✅ Verify the username for the VPS you're connecting to

    • e.g.) nodeadmin

    ✅ Check your SSH key pair file names

    • Private key must match the server's authorized key.

    ✅ Confirm correct permissions

    • private key should be read-only: chmod 400

    ✅ Ensure the public key exists on the server in the correct location

    ✅ Confirm the private key file exists locally

    • Is it correctly referenced by your SSH command.


    🏠 Local IP address

    Many ISPs assign dynamic IP addresses to customer routers.

    A change in your IP may cause your cloud provider’s firewall to block your SSH attempts.

    🩹Symptoms:

    💡 Example:


    🔧 How to Fix It

    1

    Determine your new IP address

    Open your web browser and navigate to:

    Try connecting again after updating the rules.


    🔐 SSH Key Issues

    📍 Local Key Issues

    Ensure the private key file:

    • Still exists in the expected location

    • Has not been renamed or moved

    • Is intact and not corrupted

    • Has the proper permissions

    📌 Tip:

    If in doubt, restore your key from a known-good backup.

    Important: Once resolved, create a backup of your SSH keys if you haven’t already.


    📡 Remote Key Issues (Accessing via Console)

    If you can still access your VPS through your cloud provider's web console:

    1

    Log into the Web Terminal

    2

    Re-Attempt to create an SSH connection to your node.


    📡 Cloud Provider Outage

    • Visit your cloud provider’s main dashboard

    • Look for service alerts

    • If the console is also unreachable, check external outage reports

      • Google


    🖥️ VPS-Specific Issue

    • From the cloud console, check the status of your VPS instance

    • Ensure it’s running and not reporting hardware or OS-level errors


    🌍 Local Internet Outage

    • If you cannot connect to any external site or service, confirm your own network is online

    • Restart your router/modem if necessary and try again later

    Alerting & Reporting Setup Guide

    Monitor Your Validator Node and Receive Email Alerts

    Introduction

    This guide walks you through configuring basic alerting and reporting for your Validator node using the nodectl utility. It enables email notifications if your node drops from the cluster (excluding local network outages).


    Contents
    sudo nodect upgrade_path
    sudo nodectl upgrade_nodectl -v <version_you_found_here>
    sudo nodectl upgrade --ni
    sudo nodectl upgrade --ni

    We will assume you decided to use a static IP address, in this example our static IP address is 13.13.13.13/32 ( Do NOT use this address, it is an example only. ) Type in 13.13.13.13/32 into the box and the blue CIDR block item will auto-populate, select it.

  • Hypergraph Hybrid Nodes ONLY

  • Destination Anywhere-IPv4

  • Click the Create security group button

  • SSH KEYS
    Wide Open SSH Access
    Give your security group a name and description
    Cold storage refers to keeping your .p12 file offline, minimizing exposure to unauthorized access or system vulnerabilities. Acceptable storage methods include:
    • Encrypted USB drives

    • Hardware wallets with secure storage

    • Air-gapped systems

    • Secured Encrypted Software Vaults

    2

    Open Terminal Application

    Macintosh MacOS Terminal

    Windows 11 Terminal App and make sure the terminal session opens a PowerShell prompt.

    3

    Create Temporary Backup Directory

    4

    Start SFTP Session to Your Validator Node

    Replace values with your actual SSH key and node IP address:

    You'll be prompted to enter your SSH key passphrase.

    5

    Locate your p12 KeyStore

    Example output:

    6

    Download your p12 KeyStore

    Use the get command to download the file to your temporary directory:

    You should see:

    7

    End the SFTP Session

    8

    Confirm p12 Keystore on Local System

    cd ~/constellation-backups
    ls -l
    cd ~/constellation-backup
    dir

    Confirm your p12 keystore is locally found on your system.

    9

    Transfer to Cold Storage

    Move your .p12 file to a secure offline storage device.

    10

    Remove p12 KeyStore from Local System

    Once complete, delete the p12 keystore file from your local system to maintain proper security practices.

    11
    cd ~/constellation-backups
    rm -f my-p12file.p12
    cd ~/constellation-backup
    rm my-p12file.p12
    Locate your backup p12 key store file
    2

    Transfer p12 keystore to local system

    Copy your backed-up p12 keystore file to your local Macintosh or Windows system.

    mkdir ~/constellation-backup
    cp /Volumes/ColdStorage/my-p12file.p12 ~/constellation-backup/
    cd ~/constellation-backup
    ls -l
    • Connect your backup device or connect to your backup medium to your Windows 11 system.

    • Use File Explorer to copy the file into your constellation backup directory under your local user's home directory.

    Verify that you see your p12 file listed.

    3

    Open Terminal Application

    Macintosh MacOS Terminal

    Windows 11 Terminal App and make sure the terminal session opens a PowerShell prompt.

    4

    Connect to Your Node via SFTP

    5

    Navigate to Restore Location

    We need to change directories to the location where we would like to place our p12 keystore file.

    Change directories in your SFTP session:

    6

    Upload our P12 KeyStore

    We will use the SFTP put command.

    Expected output:

    7

    Exit SFTP Session

    Backup Procedure
    Restore Procedure
    www.whatismyip.com
    2

    Record New IP Address

    Copy your current public IPv4 address

    3

    Cloud Provider Console

    Go to your cloud provider's web console.

    4

    Update Firewall Rules

    Update your firewall or security group rules to allow SSH access from your new IP

    • AWS: Update the Security Group

    • DigitalOcean: Update Firewall settings

    • Hetzner: Follow DigitalOcean-style firewall update workflow

    Refer to the .

    Navigate to the .ssh Directory
    3

    Verify Public Key

    Check for the authorized public key file

    authorized_keys or .pub file.

    If the key is missing or incorrect:

    Check alternate directories:

    4

    Identify _backup

    If you find your key with a _backup attached to the name of the file, issue the following command and check again:

    Enable root SSH temporarily:

    5

    Copy SSH Key Back Over

    Copy the key into your nodeadmin’s .ssh directory :

    Change ownership

    6

    Disable Root Access Again

    Twitter

  • Downdetector

  • Your SSH terminal or remote connection application sits idle and eventually shows Connection timed out messages.

    Terminal or remote terminal application will how a blank screen only

    No password or key prompts appear

    Not entering the SSH connection string and attempting to run commands locally instead of through your SSH tunnel.


    ⚠️ Important Limitations

    The nodectl utility's alerting feature depends on your node being reachable. If the VPS goes offline or loses internet access, alerts cannot be transmitted and will not be delivered.


    🖇️ Prerequisites

    • nodectl must be installed and running on your node.

    • A Gmail account with:

      • 2-Step Verification enabled

      • A dedicated App Password (email token) created for nodectl

    This guide will walk you through these steps.


    🏵️ Configure Alerting

    1

    Create or Use a Gmail Account

    You can use an existing Gmail account or create a new one.

    2

    Enable Gmail 2-Step Verification

    If not already enabled, activate 2-Step Verification via your Google Account:

    • Go to: Manage your Google Account

    • Click the Security tab

    • Follow prompts to enable 2-Step Verification

    3

    Generate an App Password

    • In your Google Account > Security > 2-Step Verification section

    4

    Determine Your Timezone

    Your VPS uses UTC, but you can configure alerting in your local timezone.

    Use to look up your exact timezone string (e.g., America/New_York, Europe/Zurich).

    Record your timezone string for later.

    5

    Connect to Your Node

    6

    Launch the Configurator

    7

    Enter Alerting Setup

    You’ll be prompted for the following details:

    Prompt
    Description
    8

    Exit Configurator


    🧪 Test Configuration

    1

    Test an Alert

    2

    Handle Spam

    Check your inbox. If it ends up in spam, mark it as "not spam."

    If you are sending alerts to a mobile provider email, ( sending an email to your mobile phone number in order to obtain text (SMS/MMS) message alerts ). It is important to make sure your carrier allows the message through to your phone. Some carriers may silently block messages they flag as suspicious. This may require contacting your mobile provider support with a request to allow the emails, and remove any flags as non-nefarious.

    3

    Test a Daily Report

    You should receive a formatted status report via email.


    🛠️ Troubleshooting

    If you don’t receive emails:

    • Confirm your App Password was entered correctly

    • Ensure your Gmail account is not blocking outbound activity

    • Double-check that your time zone string matches the official naming convention

    • Use a secondary email address to confirm if messages are being blocked by your provider


    Once configured, your Validator node will monitor its cluster participation status and email you alert messages and daily status reports; helping you stay informed, even when you’re away.

    Migrate V1 to V2 - P12 Keystore

    Convert a Version 1 p12 keystore to Version 2 for operations on Constellation Network.

    Constellation Network has introduced a new version 2 standard for .p12 keystore files. These updated keystores are now required to access the Hypergraph and metagraph clusters.

    Version 1 .p12 files are no longer supported.


    📌 Purpose of This Guide

    This guide is intended to help Node Operators still using version 1 .p12 files migrate their private key to the updated version 2 format, ensuring compatibility with current network requirements.


    🛠️ Setup Requirements

    Option
    Description

    Option 1: Use an Existing Node With nodectl

    If you already have nodectl running:

    • Upload your version 1 .p12 file using the restore process.

      • Refer to platform-specific steps:

        • Restore .p12 from macOS

    ⚠️ Caution: Do not overwrite an existing or active .p12 file in a running Validator node environment.


    Option 2: Create a Temporary VPS

    If you don’t have an existing node:

    1. Provision a new Linux VPS (Debian-based preferred).

    2. Upload your version 1 .p12 file.

    3. Install nodectl following the official documentation.

    💡 Note: This VPS will not be used to run a Validator node. Its purpose is solely to install the required tools for migration.

    ✅ Minimum Requirements:

    • 30GB of disk space

    • Internet connectivity

    • SSH access


    Option 3: Manual Setup

    Alternatively, install the required components manually:

    • java

    • haveged

    • cl-keytool.jar

    • cl-wallet.jar

    📎 Still ensure the VPS or machine has at least 30GB of available disk space.


    🔄 Begin the Conversion Process

    Once setup is complete, proceed with the following steps.


    Step 1: Upload Your .p12 File

    Place your original version 1 .p12 file (from macOS or Windows) into the working directory of your VPS.

    Example path:


    Step 2: Set Environment Variables

    Export the following environment variables using your .p12 file details. Be precise—use double quotes and match spacing exactly.

    Confirm the exports:

    Expected output:


    Step 3: Run the Migration Command

    Run the following command to migrate the .p12 file to version 2 format:

    ✅ If successful, no output will appear. If there's an issue, an error will be printed.


    Step 4: Verify the New File

    List the directory to verify that a new version 2 .p12 file has been created:

    Expected output (example):


    Step 5: Test the New .p12 File

    Update your CL_KEYSTORE variable to point to the new file:

    Now display the public key to confirm the file is valid:

    Example output:


    ✅ Completion

    Your .p12 file is now migrated from version 1 to version 2.

    🔒 Important: Store the original version 1 file in a secure, offline (air-gapped) location temporarily.


    🧪 Final Testing

    To fully validate your new .p12 file:

    • Connect to the appropriate Constellation cluster (Layer0 or Layer1).

    • Export and verify the private key.

    • Use the new file in your validator setup or wallet integration.


    🔁 Optional: Rename the New File

    If you want to use the original filename, rename your new file:


    ⚙️ nodectl Configuration (If Applicable)

    If you're using nodectl and kept the _v2 filename, make sure to update the configuration:

    This ensures nodectl references the correct .p12 file for all future operations.


    You have now successfully migrated and verified your .p12 keystore to the latest version, ensuring your validator remains compatible with Constellation Network's current infrastructure.

    Releases · StardustCollective/nodectlGitHub
    cd ~
    mkdir constellation-backup
    cd ~/constellation-backup
    sftp -i ~/.ssh/my-node-ssh-keyname [email protected]
    cd /home/nodeadmin/tessellation
    ls -l
    -rw-r--r-- 1 nodeadmin nodeadmin 31 Jun 11 14:28 my-p12file.p12
    get my-p12file.p12
    100% 31 0.3KB/s 00:00
    exit
    sftp -i ~/.ssh/my-node-ssh-keyname [email protected]
    cd /home/nodeadmin/tessellation
    put my-p12file.p12
    Uploading my-p12file.p12 to /home/nodeadmin/tessellation/my-p12file.p12
    100% 31 0.6KB/s 00:00
    exit
    ls -l /root/.ssh/
    ls -l /home/ubuntu/.ssh/
    ls -l /home/admin/.ssh/
    sudo nodectl enable_root_ssh
    sudo cp /root/.ssh/mypublickey.pub /home/nodeadmin/.ssh/mypublickey.pub
    sudo chown nodeadmin:nodeadmin /home/nodeadmin/.ssh/mypublickey.pub
    sudo nodectl disable_root_ssh
    ssh -i ~/.ssh/my_identity_file [email protected]
    ssh: connect to host 13.13.13.13 port 22: Operation timed out
    cd ~/.ssh
    ls -l
    sudo nodectl auto_restart alert_test
    Cloud Provider Specific Guides
    constellation-backup
    Scroll to App passwords
  • Click the right-arrow (>) to open

  • Under Select app, choose Other (Custom name)

  • Enter a name (e.g., constellation_alerts)

  • Click Create

  • Copy the generated app password (token) and store it securely

  • ⚠️ This password will only be shown once.

    If lost, delete and recreate it.

    Do not use shortcuts like EST or CET.

    token

    The App Password (token) you generated

    send method

    Use multi (recommended) or single

    recipient emails

    Comma-separated list of emails ([email protected],[email protected])

    time zone

    Your exact timezone string (e.g., America/Los_Angeles)

    begin alerting hour

    Start time for alerts in UTC (e.g., 0 for always)

    end alerting hour

    End time for alerts in UTC (e.g., 0 for always)

    send report hour

    Hour (UTC) to receive daily report (e.g., 13 for 1 PM UTC)

    gmail account

    this reference list
    How to SSH into your Node
    Important Limitations
    Prerequisites
    Configure Alerting
    Test Configuration
    Troubleshooting

    The Gmail address used to send alerts

    Restore .p12 from Windows

    1

    Live Constellation Validator Node

    Utilize an existing Constellation Network validator node with all components already installed.

    2

    Ephemeral VPS with nodectl

    Build a temporary VPS, install nodectl, use its utility to migrate your p12 from version 1 to version 2.

    3

    Load utilities necessary only

    Use an existing or build a temporary VPS and only install the utilities necessary to complete this guide.

    ssh -i /path/to/ssh/private/key nodeadmin@<vps_ip_address>
    sudo nodectl configure -e -cb -d
    N) Setup Alerting
    Q)uit
    sudo nodectl auto_restart send_report
    /home/nodeadmin/tessellation/
    export CL_KEYALIAS="myConstellationAlias"
    export CL_KEYSTORE="/home/nodeadmin/tessellation/myconstellation.p12"
    export CL_PASSWORD="my_password"
    export CL_STOREPASS="my_storepass_passphrase"
    export CL_KEYPASS="my_keystore_passphrase"
    env | grep CL_
    CL_KEYALIAS=myConstellationAlias
    CL_KEYSTORE=/home/nodeadmin/tessellation/myconstellation.p12
    CL_PASSWORD=my_password
    CL_STOREPASS=my_storepass_passphrase
    CL_KEYPASS=my_keystore_passphrase
    java -jar /var/tessellation/cl-keytool.jar migrate
    ls -l
    -rw-r--r-- 1 nodeadmin nodeadmin 1094 May 26 12:17 myconstellation_v2.p12
    export CL_KEYSTORE="/home/nodeadmin/tessellation/myconstellation_v2.p12"
    java -jar /var/tessellation/cl-wallet.jar show-public-key
    EC Public Key [ee:ff:aa:bb:cc:dd:ee:ff:11:22:33:44:55:66:77:88:99:aa:bb:cc]
      X: abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890
      Y: 111222333444555666777888999101010111111121212131313141414151515a
    mv /home/nodeadmin/tessellation/myconstellation_v2.p12 /home/nodeadmin/tessellation/myconstellation.p12
    sudo nodectl configure

    Upgrade Tessellation Guide

    Introduction

    This document will guide you through step-by-step instructions for upgrading your node to the latest version of Tessellation.


    1

    SSH Into Your VPS

    How to SSH into a VPS

    2

    Issue the Upgrade Command

    3

    Migration Considerations

    In some cases, when a new feature is introduced, it may require updating nodectl’s main configuration file, cn-config.yaml.

    If the upgrade in progress does not require this step, you will not see any messages and can skip to the next step.

    The migration ensures that nodectl can support the new features while preserving your existing configuration settings.

    We can press Enter to accept the default y.

    You will see nodectl backup your current configuration before continuing.

    DANGER

    If you did not encrypt you p12 keystore passphrase within the nodectl configuration file, the backup configuration yaml file MAY CONTAIN A CLEAR TEXT P12 PASSPHRASE.

    FOR SECURITY PURPOSES, PLEASE REMOVE AS NECESSARY!

    It is recommended to backup your p12 after the migration and upgrade completes.

    4

    Confirm upgrade

    We will be asked if we are sure we want to continue the installation. We can hit the enter key to accept the default y or type in y + enter to confirm.

    5

    Environment Confirmation

    We will see what environment is being upgraded.

    or

    6

    Configuration Backup

    A backup of our configuration will commence and output:

    7

    Verify Node Upgrade

    The nodectl utility will begin by verifying that the upgrade path is valid.

    If the upgrade path not valid, you will be met with the following message:

    It is recommended upgrade nodectl after the upgrade is complete using the correct upgrade paths.

    8

    Determine p12 details

    The nodectl utility will:

    • Validate the p12 usage for all profiles.

    • Determine if nodectl is using global references.

    • Obtain the nodeid from the p12 file.

    9

    Select Tessellation Version

    The nodectl utility will attempt to identify the current version of Tessellation running on your node, as well as the latest version available on the cluster.

    In most cases, you may simply press Enter to accept the default version.

    Already on latest warning

    If you attempt an upgrade to a version of Tessellation you are already running on your node, you may be presented with a warning message. If you intent is to upgrade to the same version over itself, you may press Enter to continue. Otherwise, you may take another action as desired.

    10

    Understanding Environments

    The nodectl utility organizes your configured profiles into logical groups called environments.

    Each environment typically represents a specific network cluster, such as:

    • MainNet

    • IntegrationNet

    • TestNet

    • DOR

    During an upgrade process, nodectl allows you to upgrade one environment at a time. This ensures consistency and reduces risk when applying updates across network types.

    Most validator nodes only have one environment configured, making the process straightforward.

    When you initiate an upgrade, nodectl will display a summary showing:

    • The environment name

    • The list of associated profiles under that environment

    Review this printout carefully before proceeding to ensure you’re upgrading the correct environment.

    Example) dag-l1 profile.

    11

    Leave the cluster & Stop your node

    Gracefully leaving the cluster is highly recommended before performing upgrades, maintenance, or reboots. This practice helps:

    • Prevent snapshot corruption

    • Reduce unnecessary load on the rest of the cluster

    • Maintain overall network health and stability

    The nodectl utility automates this process by:

    1. Issuing an internal API call to gracefully leave the cluster

    2. Stopping the service(s) associated with the selected profile(s)

    3. Bringing the node offline in a controlled and orderly fashion

    This ensures your node exits the cluster cleanly and avoids disrupting consensus or data synchronization.

    12

    Upgrade Node Internal Elements

    The nodectl utility will begin the upgrade process by performing several important housekeeping and system preparation steps:

    1. Clean up abandoned utility-specific files

      • Removes outdated or unused internal files from previous versions

    2. Rebuild essential configuration and support files

      • Ensures that all components are aligned with the latest version's requirements

    3. Apply system-level updates

      • Installs the latest updates available for your current distribution

      • ⚠️ Note: This does not upgrade the entire Linux distribution

    4. Install or update required 3rd-party utilities

      • Adds or refreshes tools that nodectl depends on for proper operation

    These steps help ensure that your node environment is clean, consistent, and fully prepared to run the latest version of nodectl effectively.

    13

    Clean up backups

    Backup files may contain plaintext P12 keystore passphrases. If you have not encrypted your P12 keystore, please keep this in mind.

    In most cases it is a good idea to clear your backups. If you are in the mist of troubleshooting, you may want to retain your backups.

    14

    Clean up uploads

    Similar to the backups you may have some files that were created in order to upload for diagnostics, logging, accounting, etc. We can clean up these files as well.

    In the event that your node has files located in this special directory, you will be given a list of the files that will be removed and a confirmation prompt.

    In most cases it is a good idea to clear your uploads. If you are in the mist of troubleshooting, you may want to retain these files.

    15

    Clean up logs

    Similar to backups, you may have accumulated a large number of log files.

    Over time, these logs can consume significant disk space on your node.

    Since your node also stores incremental history data and the tip of the blockchain, maintaining sufficient disk space is essential.

    In most cases, it is a good idea to clear old logs; however, if you are actively troubleshooting an issue, you may want to retain these files.

    16

    Upgrade Tessellation Binaries

    The nodectl utility will download the necessary packages that will upgrade your node to the latest version.

    17

    Update Seed List

    It is crucial that your node's seed list matches the latest seed list recognized by the cluster. If there is not an exact match, the node will fail to connect to the network.

    Currently, it is expected that the dag-l1 (Hypergraph Currency DAG L1) profile has a disabled seed list.

    18

    P12 Keystore Passphrase Encryption

    The nodectl utility will attempt to determine whether the passphrase for your P12 keystore is encrypted within the cn-config.yaml configuration file.

    If it detects the passphrase in plaintext, you will be prompted to encrypt it to enhance your node's security.

    While encrypting your P12 passphrase is optional, it is strongly recommended.

    19

    Updating Services

    Now that your node is ready to rejoin the cluster with its newly updated components, the following services will be restarted:

    • Protocol services

    • Auto-restart services

    • Versioning services

    20

    Start Protocol Services

    You will see the node start the layer0 profile (for a Hybrid node) or the Data Layer 1 service for a Dor metagraph (or any other single-layer metagraph node).

    You will a status update confirming your node is in ReadyToJoin status.

    21

    ReadyToJoin

    The configured layer0 profile will rejoin the network. In this case the profile dag-l0 is configured as the layer0 and will attempt to join.

    22

    SessionStarted

    After some initial setup behind the scenes, your node will reach SessionStarted and wait for an opportunity to issue a join against one of the peers of the cluster that is in a state that will allow you to join with the node and become a member of the cluster.

    23

    DownloadInProgress

    Once a successful join is achieved, the node will begin catching up on any historical snapshots that were created while it was offline. It will complete the accumulation of historical data and retrieve the tip of the blockchain, ensuring the node's current state aligns with the cluster.

    24

    Ready

    After your node completes the DownloadInProgress stage, it will transition through several additional states as it finalizes synchronization and prepares to join the network consensus rounds.

    The typical progression is as follows:

    1. WaitingForObserving

    2. Observing

    3. WaitingForReady


    ✅ Final Goal: Ready

    Once your node completes these transitional stages, it will enter the Ready state.

    At this point, your node is fully integrated into the network and eligible to begin participating in consensus and earning rewards.

    25

    Hybrid Nodes

    A hybrid node includes both a Layer 1 (L1) and a Layer 0 (L0) profile running on the same VPS or server.

    • Layer0: DAG L0 global hypergraph layer0

    • Layer1 : DAG L1 currency layer

    In this configuration, it's recommended to link the L1 profile to the local L0 profile. This is beneficial because, in a trustless environment, you can confidently trust the L0 node you control; essentially trusting yourself.


    By linking locally in this way, you take advantage of trusted internal communication between layers while maintaining protocol integrity and minimizing external risk.

    26

    Joining Layer1 on a Hybrid Node

    During the upgrade process, the system will attempt to join the DAG L1 (currency layer) profile to the cluster.

    As explained in the previous step, the Layer 1 profile is configured to link to your local Layer 0 (dag-l0) profile. In order for this to succeed, your Layer 0 profile must first reach the Ready state.


    Timing Considerations

    In most cases, the Layer 0 profile takes longer to complete its startup and synchronization steps.

    This means:

    • The Layer 1 profile may not detect the Layer 0 profile as Ready in time

    • As a result, it may fail to join automatically during the upgrade window

    How nodectl Handles This

    To accommodate this, nodectl will:

    • Present a menu prompt asking whether you’d like to continue waiting or

    • Skip the join process and allow the upgrade to complete without joining Layer 1

    If You Choose to Skip:

    You can manually complete the join process later:

    1. Use the following command to check the Layer 0 status:

      Wait until it reaches Ready.

    2. Once ready, you can either:

      • Run a manual join command for Layer 1:


    This flexible design ensures your node upgrades cleanly, even if the timing of the Layer 0 readiness introduces delays.

    27

    Final Steps

    After the join process completes, nodectl will:

    1. Display summary metrics related to the upgrade operations

    2. Restart the auto_restart feature, if it was enabled prior to the upgrade

      • This ensures your node continues to be monitored and automatically maintained moving forward

    This final step confirms that your upgrade and cluster rejoin were successful, and your node is once again operating in a self-managed, resilient state.

    sudo nodectl upgrade
    Are you sure you want to continue this upgrade? [y]: y
    Using environment ............................. mainnet
    Using environment ............................. integrationnet
    Backing up configuration ......................complete
    Backup Date: YYYY-MM-DD-HH:MM:SSZ
    Backup Location: /var/tessellation/backups/
    Backup File Name: backup_cn-config_YYY-MM-DD-HH:MM:SSZ
    ---- * VERIFY NODE UPGRADE * -----
    Verify upgrade paths .......................... complete
    Check permissions & versioning ................ warning
    This is not a current stable version of nodectl.
    Recommended to:
        - Cancel this upgrade of Tessellation.
        - Issue: sudo nodectl upgrade_nodectl
        - Restart this upgrade of Tessellation.
    WARNING non-interactive mode was detected, developer mode, or extra parameters were supplied to this upgrade.
    It will continue at the node Operator's own risk and decision.
    Press enter to accept the default value between [] brackets.
    Please enter version to upgrade to.........[v3.0.0] :
    Are you sure you want to clear the selected uploads? [n]: y
    Are you sure you want to clear the selected logs? [n]: y
    --------- * HANDLE PACKAGES * ----------
    
    Download Tessellation Binaries................. running
    backup files .................................. complete
    
    Download version .............................. v3.0.0
    Fetch [cl-keytool.jar -> global] .............. complete
    Fetch [cl-wallet.jar -> global] ............... complete
    Fetch [cl-node.jar -> dag-l0] ................. complete
    Fetch [cl-dag-l1.jar -> dag-l1] ............... complete
    Fetch [mainnet-seedlist -> dag-l0] ............ completed
    Fetch [seedlist for -> dag-l1] ................ disabled
    Start request initiated [node_l0] ............. complete
    Fetching Status [dag-l0] ......................
    ssh -i /path/to/ssh/private/key nodeadmin@<vps_ip_address> -p <port>
    Or rely on auto_restart (if enabled) to detect readiness and automatically join Layer 1 when conditions are met
    Backup P12 Keystore
    Attempt update and migrate configuration file? [y]: y
    Backing up cn-config yaml ..................... complete
    Verify upgrade paths .......................... complete
    p12 validated [dag-l0] ........................ using global
    p12 validated [dag-l1] ........................ using global
    Global p12 validated .......................... True
    Obtaining node ID from p12 [global] ........... 11111....11111
    Node IP address ............................... 113.113.113.113
    WARNING Tessellation is already on the latest known version.
    If you are only upgrading the node's internal components because your node is exhibiting undesirable or unexpected behavior, you should accept the default and upgrade your node's version to the same version level by simply hitting <enter> here.
    ====================
    PROFILE:     dag-l1
    ENVIRONMENT: mainnet
    METAGRAPH:   hypergraph
    
    Cluster mainnet for profile dag-l1 using v3.0.0
    Are you sure you want to clear the selected backups? [n]: y
    Do you want to encrypt the passphrase in your cn-config.yaml configuration file?
    Enable encrypt? [y]:
    Reload the Node's services .................... complete
    Starting versioning updater ................... complete
    sudo nodectl status -p dag-l0
    sudo nodectl join -p dag-l1
    Logo