Nyx Validator & Nym API Configuration
Our documentation often refers to syntax annotated in <> brackets. We use this expression for variables that are unique to each user (like path, local moniker, versions et cetera).
Any syntax in <> brackets needs to be substituted with your correct name or version, without the <> brackets. If you are unsure, please check our table of essential parameters and variables (opens in a new tab).
This page covers systemd automation, reverse proxy configuration, Prometheus metrics and the port reference shared by Nyx validators and the Nym API.
Automation
Validator systemd automation
Save this init service file as /etc/systemd/system/nyxd.service and follow the steps below, running all commands with root permissions.
1. Create an init service file
- Open a text editor:
nano /etc/systemd/system/nyxd.service- Paste this file:
[Unit]
Description=Nyxd
StartLimitInterval=350
StartLimitBurst=10
[Service]
User=<USER> # change to your user
Type=simple
Environment="LD_LIBRARY_PATH=/lib/x86_64-linux-gnu"
ExecStart=<PATH>/nyxd start # change to correct path
Restart=on-failure
RestartSec=30
LimitNOFILE=infinity
[Install]
WantedBy=multi-user.target2. Start the validator as a systemd service
- Pick up the new unit file:
systemctl daemon-reload- Enable and start the service:
systemctl enable nyxd
systemctl start nyxd- Optionally monitor the logs:
journalctl -f -u nyxd3. After any changes to the systemd script
- Run:
systemctl daemon-reloadThis lets your operating system know it is ok to reload the service configuration. Then restart your validator.
Nym API systemd automation
Save this init service file as /etc/systemd/system/nym-api.service and follow the steps below, running all commands with root permissions.
1. Create an init service file
- Open a text editor:
nano /etc/systemd/system/nym-api.service- Paste this file:
[Unit]
Description=Nym API
StartLimitInterval=350
StartLimitBurst=10
[Service]
User=<USER> # change to your user
Type=simple
ExecStart=<PATH>/nym-api run # change to correct path
Restart=on-failure
RestartSec=30
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target2. Start your API as a systemd service
- Pick up the new unit file:
systemctl daemon-reload- Enable and start the service:
systemctl enable nym-api
systemctl start nym-api- Optionally monitor the logs:
journalctl -f -u nym-api3. After any changes to the systemd script
- Run:
systemctl daemon-reloadThen restart your API.
Nym API endpoints
Numerous API endpoints are documented on the Nym API Swagger documentation (opens in a new tab). There you can try requests from your browser and download the response. Swagger also shows the commands it runs, so you can run them from an app or your CLI.
Reverse proxy
Setting up a reverse proxy with a webserver such as nginx allows you to configure SSL certificates for the endpoints. On mainnet it is recommended to encrypt all web traffic to your node.
- Allow nginx through the firewall:
ufw allow 'Nginx Full'- Check nginx is running:
systemctl status nginxFull node configuration
Proxy full node services by creating /etc/nginx/sites-enabled/nyxd-webrequests.conf:
### To expose the RPC server
server {
listen 80;
listen [::]:80;
server_name "<rpc.nyx.yourdomain.tld>";
location / {
proxy_pass http://127.0.0.1:26657;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location /websocket {
proxy_pass http://127.0.0.1:26657;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_set_header Host $host;
}
}
### To expose the Cosmos API server
server {
server_name "<api.nyx.yourdomain.tld>";
location / {
proxy_pass http://127.0.0.1:1317;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header Host $http_host;
proxy_set_header Upgrade websocket;
proxy_set_header Connection Upgrade;
}
}
### To expose the gRPC endpoint
server {
server_name "<grpc.nyx.yourdomain.tld>";
location / {
grpc_pass 127.0.0.1:9090;
}
}This exposes RPC publicly, which is correct for a full node serving applications. A node backing a Nym API signer should keep RPC on loopback instead - see the local RPC setup.
Nym API configuration
### To expose the nym-api webserver
server {
listen 80;
listen [::]:80;
server_name "<nym-api.nyx.yourdomain.tld>";
add_header 'Access-Control-Allow-Origin' '*';
location / {
proxy_pass http://127.0.0.1:8000;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}- Followed by:
apt install certbot python3-certbot-nginx
certbot --nginx -m <YOUR_EMAIL> --agree-tosThese commands get you an HTTPS encrypted nginx proxy in front of the endpoints.
Configuring Prometheus metrics (optional)
Configure Prometheus with the following, adapted from NodesGuru's Agoric setup guide (opens in a new tab):
echo 'export OTEL_EXPORTER_PROMETHEUS_PORT=9464' >> $HOME/.bashrc
source ~/.bashrc
sed -i '/\[telemetry\]/{:a;n;/enabled/s/false/true/;Ta}' $HOME/.nyxd/config/app.toml
sed -i "s/prometheus-retention-time = 0/prometheus-retention-time = 60/g" $HOME/.nyxd/config/app.toml
ufw allow 9464
echo 'Metrics URL: http://'$(curl -s ifconfig.me)':26660/metrics'Your validator's metrics will be available at the returned metrics URL.
Validator port reference
Validator port configuration lives in $HOME/.nyxd/config/config.toml and app.toml. If you edit any port configs, remember to restart your validator.
| Default port | Use |
|---|---|
| 1317 | Cosmos REST API server endpoint |
| 8000 | nym-api HTTP, loopback only on a signer |
| 9090 | gRPC endpoint |
| 26656 | Listen for incoming peer connections |
| 26657 | CometBFT RPC, loopback only on a signer |
| 26660 | Listen for Prometheus connections |