You should follow these steps in order for transforming a validator to horcrux signer. You can use a single sentry (but more are recommended), and three cosigners. If you want to use more sentries/cosigners you should adjust the script and env variables slightly.
There's a .env.example file that you should use as template. Set COSIGNER_X, NODE_URL, and NETWORK mainly. Make use of public ips.
In order for the cosigners and sentry to work properly you need to open ports:
- In the validator/sentry node, open the port specified in the
NODE_URLvariable for each cosigner server. - In each cosigner server, open the port specified in the
COSIGNER_Xvariable in a circular manner (eg. cosigner 1 open ports for cosigner 2 and 3, and so on...)
First we need to setup horcrux, and generate the required keys+shards. This needs to be run locally, and only once.
./init-configure.sh
You need to distribute the keys generated on the previous step to each of the cosigner servers. Keys are generated in folder ./secrets/cosigner_X. Clone the repo, and place each cosigner key on the folder ./horcrux/.horcrux/. You can do it by running:
cp ./secrets/cosigner_X ./horcrux/.horcrux
On each cosigner, place in the folder ./horcrux/.horcrux/state/{chain-id}_priv_validator_state.json (replace {chain-id} for the chain-id). And adjust the values for height, rount, and step according to the ./celestia/data/priv_validator_state.json file in your validator. NOTE: make sure round is set as STRING value.
On each of the servers, once the ./horcrux/.horcrux folder is properly setup, you should start on each server the cosigners roughly at the same time.
docker compose up -d
sed -i 's#priv_validator_laddr = ""#priv_validator_laddr = "tcp://0.0.0.0:12323"#g' $NODE_HOME/config/config.toml
Once all is set, you should be able to restart the celestia 'validator' node, that will act as sentry with external signer (horcrux cosigners).
If need to understand things more, there's a great guide in the official repo: MIGRATING.md