Lido CSM+SSV+Obol (Testnet)

Overall Workflow

1. SSV: Set up SSV node + SSV DKG services & Execution + Consensus Clients using Eth Docker

2. Obol: Set up Obol Charon service & Validator Client using Eth Docker to import Obol-compatible validator keyshares

3. Lido CSM: Set up a second and Dedicated Validator Client using EthPillar to import Lido CSM-compatible validator keys

Hardware Setup (Testnet)

Spin up a virtual machine on a cloud service with the following specifications using the reference page below.

• CPU: 4 cores

• RAM: 8GB

• SSD: 250GB

• OS: Ubuntu 24.04

Example:

Installing ETH Docker

Go to the ETH Docker repository and to get and run the installation commands. Run the next 2 commands in sequence.

cd ~ && git clone https://github.com/eth-educators/eth-docker.git && cd eth-docker

sudo usermod -aG sudo $USER

Exit your virtual machine/hardware and re-login to add your host user into the sudo & docker user group.

exit

cd eth-docker
./ethd install

Enable ethd to be called from anywhere on your terminal.

source ~/.profile

SSV Setup

ethd config

Follow along the prompts in the terminal UI (TUI) to:

• Choose Hoodi Testnet >> SSV node - consensus, execution and ssv-node

• Select yes for Do you want to participate in DKG ceremonies as an operator?

• Once you see the screen below, select <Cancel> as we don't have our Operator ID yet.

• Then copy your SSV node public key from your terminal output and save it on a text editor

Register SSV Operator

1. Go to the SSV webapp, connect your wallet, and set the network to Hoodi.

2. Select Join as Operator >> Register Operator

3. Paste your SSV node public key into the Operator Public Key field. Make sure there are no whitespaces in your pasted string.

4. Keep Operator Status to Public

5. Set the annual fee to 1.5 SSV per validator key, representing ~1.5% staking rewards fee at current $ETH and $SSV prices ($2650 & $23).

6. Register operator and sign the transaction on your wallet

7. Your SSV Operator ID will then be generated. Copy it and save it in a text editor file.

Complete ETH Docker Setup

Go back to the terminal of your VM.

ethd config

1. Choose Hoodi Testnet >> SSV node - consensus, execution and ssv-node

2. Select yes for Do you want to participate in DKG ceremonies as an operator?

3. Because you now have your SSV Operator ID, you can paste it in the requested field

4. Select the consensus and execution client of your choice

5. Use the provided URL for Checkpoint Sync, select yes for MEV Boost, yes for Grafana dashboards

6. Set Rewards Address to an ERC-20 wallet address that you control (e.g., Metamask, hardware wallet)

7. use default Graffiti, yes for generate validator keys

Start ETH Docker

cd
ethd up

Configure DKG endpoint

Find the external IP address of your VM on your Cloud account >> Console >> Compute Engine >> Look under "External IP".

Your DKG endpoint will be <EXTERNAL_IP_ADDRESS>:3030,without the pointy brackets. Note that down and save it in a text editor file.

Verify that your DKG endpoint is accessible from external sources.

cd ~/eth-docker
sudo docker compose run --rm ssv-dkg ping --ip https://<External_IP>:3030

Expected output:

View logs

ethd logs ssv-node -f --tail 20

ethd logs consensus -f --tail 20

ethd logs execution -f --tail 20

Complete SSV Operator Metadata

Obol Setup

Go back to your Home folder.

cd

Cluster Creation

1. Go to the Obol Hoodi Launchpad, scroll down and select "Create a distributed validator alone"

2. Read and click through the Advisories

3. Input your cluster details as follows

   1. Cluster Name: Any

   2. Cluster Size: 4

   3. Validators: 1

   4. Withdrawal & Fee Recipient Address: Your own wallet address

1. Create your cluster by signing an onchain transaction on your wallet

2. Copy the resulting "Create Cluster" command generated on the Obol Launchpad and run it on your terminal.

Preparing your cluster

Set the necessary permissions to your newly generated Obol ENR private key and cluster file.

sudo chmod 644 ~/cluster/node0/charon-enr-private-key
sudo chmod 644 ~/cluster/node0/cluster-lock.json

Copy the following files from one of the cluster folders (e.g., node0) above into the ~/eth-docker/.eth folder and set the necessary permissions.

sudo cp ~/cluster/node0/validator_keys/* ~/eth-docker/.eth/validator_keys
sudo cp ~/cluster/node0/* ~/eth-docker/.eth
sudo chown -R $USER:$USER ~/eth-docker/.eth

Edit the .env file of Eth Docker.

nano ~/eth-docker/.env

In the COMPOSE_FILE line:

• Append :lido-obol.yml and :cl-shared.yml

• Edit the "consensus"-cl-only.yml file to "consensus".yml. e.g., From nimbus-cl-only.yml to nimbus.yml

Example:

Press CTRL+W, type "CL_NODE" and hit ENTER.

• Change the CL_NODE line to http://charon:3600 (from http://consensus:5052)

Example:

CTRL+O, ENTER, CTRL+X to save and exit.

Restart ETH Docker

ethd down && ethd up

Print the generated password of your Obol validator key shard and copy the output to your clipboard.

cat ~/eth-docker/.eth/validator_keys/keystore*.txt && echo

After all your services running via Docker "warmed up" for ~5 minutes, import your validator key shard and paste the password when prompted.

ethd keys import

Monitoring Charon

Print the logs of the Obol Charon & Validator Client.

ethd logs charon -f --tail 20

ethd logs validator -f --tail 20

Lido CSM Setup

Go to the Coincashew website and copy the latest 1-line installation command and paste it into your terminal.

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/coincashew/EthPillar/main/install.sh)"

Then, type + enter ethpillar and follow along the prompts in the terminal UI (TUI) to:

1. Select the Nimbus-Nethermind option

2. Wait for the installation to be done and then select 2 - Hoodi for your network (Press "2" & ENTER)

3. Select the 4 - Lido CSM Validator Client only option

4. Enter http://127.0.0.1:5052 as your Consensus Client endpoint

5. Generate validator keys to participate in the Lido CSM

   • Do not choose to disable internet connection when prompted

   • Select Hoodi

   • Enter the Lido's CSM Withdrawal Vault address as the Withdrawal Address: 0x4473dCDDbf77679A643BdB654dbd86D67F8d32f2

   • Set the password for your validator keys

   • Save the 24-word mnemonic securely

6. Import the generated validator keys onto your validator client

Copy the deposit data generated by the command below for uploading onto the Lido CSM Widget.

• Mainnet: https://csm.lido.fi/?ref=ethpillar

• Hoodi: https://csm.testnet.fi/?ref=ethpillar

cat $(find ~/ethstaker_deposit-cli -name "deposit*.json" 2>/dev/null) && echo

Example output:

View logs

Run the ethpillar command and select the view logs option

Exiting validator keys

Lido CSM

Find the file path of your validator keystores.

cat $(find /var/lib -name "keystore*.json" 2>/dev/null)

Copy the output file path.

Run ethpillar and navigate to validator client >> exit keys and input the file path of your validator keystore.

Enter the password set for your validator keystore when prompted.

Securing your device

Firewall Rules

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp # for SSH
sudo ufw allow 30303 # for the EL
sudo ufw allow 9000 # for the CL
sudo ufw allow 3000 # for the native Grafana
sudo ufw allow 3030 # for SSV DKG
sudo ufw allow 12001/udp # for SSV node UDP
sudo ufw allow 13001/tcp # for SSV node TCP
sudo ufw allow 3610/tcp # for Obol Charon TCP
sudo ufw enable

Make sure to also configure port forwarding on the ports allowed above.

Other Security SOPs

Support

Stakesaurus Node Operator AcademyTelegram