VPS One-Liner Install

TL;DR

One command, Ubuntu 22.04+, 10 minutes from empty box to active validator:

The installer handles dependencies, wallet creation, chain snapshot download, sync, bond funding, and bonding. A chain snapshot is included so your node starts near the current tip - no full replay from block 0. A systemd unit is installed and enabled so the node keeps running after you disconnect.

Provision the VPS

Any Ubuntu 22.04+ VPS meeting the validator minimums works. The reference cluster runs on Hetzner CX22 (€4/mo) - that's the canonical spec.

1. Spin up an Ubuntu 22.04 or 24.04 box with at least 2 cores, 4 GB RAM, 40 GB SSD.
2. SSH in as root or a sudoer.
3. Run the one-liner.

The one-liner

The script:

• Installs curl, jq, ufw and Node.js 22 if not present.
• Downloads the validator bundle (the node software) and the light chain snapshot.
• Writes the node configuration, locks the firewall down to SSH, RPC and the four relay peers, and installs the systemd service.
• Drops you into the interactive onboarding.

Interactive onboarding

Once dependencies are in place, the installer runs a wizard in your terminal:

1. Create the validator key. The node generates a Dilithium3 (ML-DSA-65) keypair on first start. There is no password: the 32 byte seed lives in /opt/asentum/data/validator.key and the installer prints its hex form once so you can back it up.
2. Load snapshot + sync. Chain snapshot loads instantly, then the node syncs the remaining blocks from peers. Progress bar shows catch-up - typically under a minute.
3. Fund wallet. Shows your validator address, requests the bond amount for it automatically, and polls the balance until the ASE arrives. No manual faucet step; see Get Test ASE if it stalls.
4. Stake. Auto-builds the bond transaction, signs, submits. Watches the chain until your validator transitions pending → active. The 500 ASE bond makes you a candidate; the node signs and earns only while its stake holds one of the 100 signing committee seats, which go to the largest stakes each epoch (cutoff currently about 1,350 ASE; check the explorer's validators page). Below it, status shows waiting. Raise your stake with asentum-validator bond.
5. Done. systemd unit is enabled so the node survives reboots.

The asentum-validator command

After install, a dedicated asentum-validator command is on your $PATH:

Run asentum-validator help to see the list on your box. If a command above is missing, your copy is older than the docs: seeUpdate only the command.

Use an existing wallet

Moving to a new server, or rebuilding one? Install with the wallet you already have and your address, bond and history carry over. Have its 64-character hex key ready (a previous install saved it in /opt/asentum/data/validator.key.hex, and asentum-validator keys export prints it), then run:

curl -fsSL https://explorer.asentum.com/install/validator | ASENTUM_IMPORT_KEY_HEX=ask bash

The installer asks for the key with the input hidden, so it never lands in your shell history. If that wallet is already bonded, the faucet and bond steps are skipped and the node rejoins as a candidate with the bond it has.

Run a key on one server only. Stop the old validator before the new one starts: two nodes signing with the same key can be slashed.

Switch wallets

asentum-validator reset changes the wallet an installed validator uses, without reinstalling. Run it without a flag and it asks which you want, or pick directly:

asentum-validator reset --create    # a brand new wallet
asentum-validator reset --import    # a wallet you already have (asks for the key, hidden)

• The current key is never deleted. It is moved to /opt/asentum/data/key-backups/ first, with a note of its address, so you can always import it back.
• A bond belongs to the wallet that made it. Switching wallets does not move it. To get that ASE back, run asentum-validator unstake before switching (it unlocks after 14 days), or import the old wallet again later.
• A new wallet has no bond, so reset registers it for you: it requests 505 ASE from the faucet and bonds 500, like a fresh install. Add --no-bond to skip that and run asentum-validator register when you are ready.
• An imported wallet that is already bonded rejoins on its own, and signs again if its stake clears the committee cutoff.
• After --create the new key is printed once. Save it in a password manager.

Update only the command

Sometimes only the asentum-validator command changes, for example when a new subcommand is added. You can update it without touching the node, the chain data or your wallet:

asentum-validator self-update

The rpc, register, self-update, resync and reset commands came with the 29 Sep 2026 kit. If your install is older and does not have them, re-run the install command. It keeps your existing key:

curl -fsSL https://explorer.asentum.com/install/validator | bash

asentum-validator update also refreshes the command, but it additionally downloads new chain code and a snapshot and restarts the node. Use it when there is a chain upgrade.

systemd & background run

The installer drops a systemd unit at /etc/systemd/system/asentum-validator.service. It runs under a dedicated system user, restarts on failure, and starts on boot. asentum-validator logs is a wrapper around journalctl. For the full monitoring story see Monitoring & Logs.

Firewall

The installer configures ufw with the minimum open ports:

• 22 - SSH.
• 8545: your node's RPC. Open to everyone by default; choose who can use it with ASENTUM_RPC_ACCESS at install or asentum-validator rpc later.
• 9000: block and vote gossip between validators, open only to the network's core nodes.

Making the RPC private never affects block production: validators talk on 9000. To serve RPC on your own domain, see Run your own RPC endpoint.