> For the complete documentation index, see [llms.txt](https://skyneticlabs.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://skyneticlabs.gitbook.io/docs/security/tools/editor.md).

# Sentry Topology

The **Sentry Node Architecture** is a best-practice design for securing Cosmos-based validators.\
It isolates the validator node from direct exposure to the internet, reducing the risk of DDoS attacks and unauthorized access.

***

###  Overview

In a sentry topology:

* **Validator node** stays private — only communicates with trusted sentry nodes.
* **Sentry nodes** are public-facing — they connect to other peers in the network and forward traffic to the validator.
* **TMKMS** (or HSM) handles signing remotely over a secure private channel.

```yaml
[Peers] ⇄ [Sentry 1] ⇄

→ [Validator] ⇄ [TMKMS]
/
[Peers] ⇄ [Sentry 2] ⇄
```

***

###  Network Setup

| Node          | Role              | Public IP                   | Access                         |
| ------------- | ----------------- | --------------------------- | ------------------------------ |
| **Validator** | Core signing node | Private IP / Internal LAN   | SSH from internal network only |
| **Sentry 1**  | Public P2P relay  | Public IP (e.g., 45.x.x.x)  | Open for inbound peers         |
| **Sentry 2**  | Public P2P relay  | Public IP (e.g., 213.x.x.x) | Open for inbound peers         |

###  Firewall Rules (UFW / iptables)

#### On the **Validator**

Allow only sentry IPs and TMKMS connections:

```bash
sudo ufw default deny incoming
sudo ufw allow from <SENTRY_1_IP> to any port 26656
sudo ufw allow from <SENTRY_2_IP> to any port 26656
sudo ufw allow from <TMKMS_IP> to any port 26658
sudo ufw enable
```

#### On each **Sentry**

Allow public P2P and internal validator connections:

```bash
sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw allow 26656/tcp        # P2P
sudo ufw allow to <VALIDATOR_IP> port 26656
sudo ufw enable
```

### &#x20;Tendermint Configuration

#### On the **Validator** (`config/config.toml`)

```toml
pex = false
private_peer_ids = "<SENTRY_1_NODE_ID>,<SENTRY_2_NODE_ID>"
persistent_peers = "<SENTRY_1_NODE_ID>@<SENTRY_1_IP>:26656,<SENTRY_2_NODE_ID>@<SENTRY_2_IP>:26656"
```

> Disable PEX (Peer Exchange) — validator should not gossip its address to others.

#### On each **Sentry** (`config/config.toml`)

```toml
pex = true
persistent_peers = "<VALIDATOR_NODE_ID>@<VALIDATOR_IP>:26656"
unconditional_peer_ids = "<VALIDATOR_NODE_ID>"
```

> Sentries connect only to the validator and public peers.

***

### &#x20;Automated Failover

You can use **systemd**, **keepalived**, or **dnsmasq** to automate validator failover between sentries:

* Health checks run every few seconds
* If a sentry becomes unresponsive, traffic reroutes automatically
* Validator peers list updates dynamically through scripts or configuration management tools

Example systemd health check (pseudo):

```bash
if ! nc -z validator.local 26656; then
  systemctl restart tendermint
fi
```

***

### &#x20;Secure Remote Signing (TMKMS)

Validator keys are never stored on the validator node itself.

#### Example TMKMS connection

* TMKMS runs on a separate secured host.
* Validator connects to TMKMS via `priv_validator_laddr = "tcp://0.0.0.0:26558"`

```toml
# Validator config/config.toml
priv_validator_laddr = "tcp://0.0.0.0:26558"
```

```toml
# tmkms.toml
[[providers.softsign]]
key_type = "consensus"
path = "/home/tmkms/keys/uptick_consensus.key"
```

***

### &#x20;Best Practices

* Keep the validator **offline from the public internet**.
* Use **monitoring** (Prometheus + Grafana or TenderDuty) to track all sentry nodes.
* Rotate keys periodically and restrict SSH access to internal management hosts.
* Keep backups encrypted and stored separately from signing infrastructure.