Lido CSM+SSV+Obol (Testnet)
Overall Workflow
SSV: Set up
SSV node
+SSV DKG
services &Execution + Consensus Clients
using Eth DockerObol: Set up
Obol Charon
service &Validator Client
using Eth Docker to import Obol-compatible validator keysharesLido CSM: Set up a second and
Dedicated Validator Client
using EthPillar to import Lido CSM-compatible validator keys
Hardware Setup (Testnet)
Spin up a virtual machine on a cloud service with the following specifications using the reference page below.
CPU: 4 cores
RAM: 8GB
SSD: 250GB
OS: Ubuntu 24.04
Example:
Google CloudTip: Open these reference pages in a new tab/window so that you can switch between them easily
Installing ETH Docker
Go to the ETH Docker repository and to get and run the installation commands. Run the next 2 commands in sequence.
cd ~ && git clone https://github.com/eth-educators/eth-docker.git && cd eth-docker
sudo usermod -aG sudo $USER
Exit your virtual machine/hardware and re-login to add your host user into the sudo & docker user group.
exit
cd eth-docker
./ethd install
Enable ethd to be called from anywhere on your terminal.
source ~/.profile
SSV Setup
ethd config
Follow along the prompts in the terminal UI (TUI) to:
Choose
Hoodi Testnet
>>SSV node - consensus, execution and ssv-node
Select
yes
for Do you want to participate in DKG ceremonies as an operator?Once you see the screen below, select
<Cancel>
as we don't have our Operator ID yet.

Then copy your SSV node public key from your terminal output and save it on a text editor

Register SSV Operator
Go to the SSV webapp, connect your wallet, and set the network to Hoodi.
Select
Join as Operator
>>Register Operator
Paste your SSV node public key into the
Operator Public Key
field. Make sure there are no whitespaces in your pasted string.Keep
Operator Status
to PublicSet the annual fee to 1.5 SSV per validator key, representing ~1.5% staking rewards fee at current $ETH and $SSV prices ($2650 & $23).
Register operator and sign the transaction on your wallet
Your SSV Operator ID will then be generated. Copy it and save it in a text editor file.

Complete ETH Docker Setup
Go back to the terminal of your VM.
ethd config
Choose
Hoodi Testnet
>>SSV node - consensus, execution and ssv-node
Select
yes
for Do you want to participate in DKG ceremonies as an operator?Because you now have your
SSV Operator ID
, you can paste it in the requested fieldSelect the consensus and execution client of your choice
Use the
provided URL
for Checkpoint Sync, selectyes
for MEV Boost,yes
for Grafana dashboardsSet
Rewards Address
to an ERC-20 wallet address that you control (e.g., Metamask, hardware wallet)use default
Graffiti,yes
for generate validator keys
Start ETH Docker
cd
ethd up
Configure DKG endpoint
Find the external IP address of your VM on your Cloud account >> Console >> Compute Engine >> Look under "External IP".
Your DKG endpoint will be <EXTERNAL_IP_ADDRESS>:3030
,without the pointy brackets. Note that down and save it in a text editor file.
Verify that your DKG endpoint is accessible from external sources.
cd ~/eth-docker
sudo docker compose run --rm ssv-dkg ping --ip https://<External_IP>:3030
Expected output:

View logs
ethd logs ssv-node -f --tail 20
ethd logs consensus -f --tail 20
ethd logs execution -f --tail 20
Complete SSV Operator Metadata
Obol Setup
Go back to your Home folder.
cd
Cluster Creation
Go to the Obol Hoodi Launchpad, scroll down and select "Create a distributed validator alone"
Read and click through the Advisories
Input your cluster details as follows
Cluster Name: Any
Cluster Size: 4
Validators: 1
Withdrawal & Fee Recipient Address: Your own wallet address
Create your cluster by signing an onchain transaction on your wallet
Copy the resulting "Create Cluster" command generated on the Obol Launchpad and run it on your terminal.
Preparing your cluster
Set the necessary permissions to your newly generated Obol ENR private key and cluster file.
sudo chmod 644 ~/cluster/node0/charon-enr-private-key
sudo chmod 644 ~/cluster/node0/cluster-lock.json
Copy the following files from one of the cluster folders (e.g., node0
) above into the ~/eth-docker/.eth
folder and set the necessary permissions.
sudo cp ~/cluster/node0/validator_keys/* ~/eth-docker/.eth/validator_keys
sudo cp ~/cluster/node0/* ~/eth-docker/.eth
sudo chown -R $USER:$USER ~/eth-docker/.eth
Edit the .env
file of Eth Docker.
nano ~/eth-docker/.env
In the COMPOSE_FILE
line:
Append
:lido-obol.yml
and:cl-shared.yml
Edit the
"consensus"-cl-only.yml
file to"consensus".yml
. e.g., Fromnimbus-cl-only.yml
tonimbus.yml
Example:

Press CTRL+W
, type "CL_NODE" and hit ENTER
.
Change the
CL_NODE
line to http://charon:3600 (from http://consensus:5052)
Example:

CTRL+O
, ENTER
, CTRL+X
to save and exit.
Restart ETH Docker
ethd down && ethd up
Print the generated password of your Obol validator key shard and copy the output to your clipboard.
cat ~/eth-docker/.eth/validator_keys/keystore*.txt && echo
After all your services running via Docker "warmed up" for ~5 minutes, import your validator key shard and paste the password when prompted.
ethd keys import
Monitoring Charon
Print the logs of the Obol Charon & Validator Client.
ethd logs charon -f --tail 20
ethd logs validator -f --tail 20
Lido CSM Setup
Go to the Coincashew website and copy the latest 1-line installation command and paste it into your terminal.
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/coincashew/EthPillar/main/install.sh)"
Then, type + enter ethpillar
and follow along the prompts in the terminal UI (TUI) to:
Select the
Nimbus-Nethermind
optionWait for the installation to be done and then select
2 - Hoodi
for your network (Press "2
" &ENTER
)Select the
4 - Lido CSM Validator Client only
optionEnter
http://127.0.0.1:5052
as your Consensus Client endpointGenerate validator keys to participate in the Lido CSM
Do not choose to disable internet connection when prompted
Select Hoodi
Enter the Lido's CSM Withdrawal Vault address as the Withdrawal Address:
0x4473dCDDbf77679A643BdB654dbd86D67F8d32f2
Set the password for your validator keys
Save the 24-word mnemonic securely
Import the generated validator keys onto your validator client
Verify the fee recipient and withdrawal address on the CSM Operator Portal
Copy the deposit data generated by the command below for uploading onto the Lido CSM Widget.
The links below include the referral IDs of the tools that we are using today to join Lido CSM. Your rewards will not be affected by using these.
Mainnet: https://csm.lido.fi/?ref=ethpillar
cat $(find ~/ethstaker_deposit-cli -name "deposit*.json" 2>/dev/null) && echo
Example output:
[{"pubkey": "8b29b853aef47eb3da93287a83b4625b418bf5a785bb506086e9f315478170cdb452fb63f32f8134835fc4ebea3313a7", "withdrawal_credentials": "0100000000000000000000004473dcddbf77679a643bdb654dbd86d67f8d32f2", "amount": 32000000000, "signature": "abcff77128a76dff62529f2a081f2143f77404c29087da1f4e12a8c6e8506dfb079085fdf72da8903e9c8c63ddf04129143090e92b6a17c993919e62047880cf54160f350271dff1b70e616e4210a5521836334d1139ece549ba513d503d0d90", "deposit_message_root": "03d0eb169a3c1a5551484185163b3e409dde01ec00515b7e594a6430ff398f69", "deposit_data_root": "961113829f6537828c5f06e69df8b76cf2a6904de03c4d1a25939ab1da9b5a14", "fork_version": "10000910", "network_name": "hoodi", "deposit_cli_version": "11.1.0"}]
View logs
Run the ethpillar
command and select the view logs
option
Exiting validator keys
Lido CSM
Find the file path of your validator keystores.
cat $(find /var/lib -name "keystore*.json" 2>/dev/null)
Copy the output file path.
Run ethpillar
and navigate to validator client
>> exit keys
and input the file path of your validator keystore.
Enter the password set for your validator keystore when prompted.
Securing your device
Firewall Rules
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp # for SSH
sudo ufw allow 30303 # for the EL
sudo ufw allow 9000 # for the CL
sudo ufw allow 3000 # for the native Grafana
sudo ufw allow 3030 # for SSV DKG
sudo ufw allow 12001/udp # for SSV node UDP
sudo ufw allow 13001/tcp # for SSV node TCP
sudo ufw allow 3610/tcp # for Obol Charon TCP
sudo ufw enable
Make sure to also configure port forwarding on the ports allowed above.
Advanced networkingOther Security SOPs
Networking & network securityDevice level security setupSupport
Last updated