Node setup - Arcium Docs

Overview

As a Node Operator, you’ll set up your own Arx node to participate in the Arcium Network. This guide walks you through each step of the process. First, you’ll prepare your environment by installing the necessary tools and generating security keys. Then, you’ll get your node registered onchain and configure it to run. Finally, you’ll connect to other nodes in a cluster and start doing computations. By the end, you will:

Install the Arcium tooling
Generate required keypairs
Fund accounts with SOL
Initialize onchain node accounts
Configure your node
Join or create a cluster
Deploy your node with Docker

Prerequisites

Before starting, ensure you have the following installed:

Rust: Install from rustup.rs
Solana CLI 3.1.10: Install from Solana’s documentation
Docker & Docker Compose: Install from Docker’s documentation
OpenSSL: Install from OpenSSL’s documentation (usually pre-installed on macOS/Linux)
Git: For cloning repositories and version control

You’ll also need:

A reliable internet connection
Basic familiarity with command-line tools

Recommended system requirements:

Resource	Recommendation
RAM	32GB+
CPU	12+ cores, 2.8GHz+ base
Bandwidth	1 Gbit/s minimum
Disk	Minimal (node is not disk-intensive)
GPU	Not required

Network requirements - open these ports:

Port	Protocol	Purpose
8001	TCP & UDP	MPC protocol communication
8002	TCP & UDP	BLS signature aggregation
8012	TCP & UDP	TD preprocessing
8013	TCP & UDP	TD registration
9091	TCP	Prometheus metrics

Windows users: Arcium doesn’t run natively on Windows yet. Use Windows Subsystem for Linux (WSL2) with Ubuntu to follow this guide.

Step 1: Set up your workspace

Create a dedicated folder for your node setup to keep everything organized:

mkdir arcium-node-setup
cd arcium-node-setup

Stay in this directory for all remaining steps. All file paths and Docker commands assume you’re working from arcium-node-setup/.

You’ll also need to know your public IP address for the next steps. Here’s a quick way to find it:

curl https://ipecho.net/plain ; echo

Step 2: Install Arcium tooling

The Arcium tooling suite includes the CLI and Arx node software. Install it using the automated installer:

curl --proto '=https' --tlsv1.2 -sSfL https://install.arcium.com/ | bash

This script will:

Check for all required dependencies
Install arcup (Arcium’s version manager)
Install the latest Arcium CLI
Install the Arx node software

Verify the installation:

arcium --version && arcup --version

If you prefer manual installation, see the installation guide for detailed instructions.

Step 3: Generate required keypairs

Your Arx node needs five different keypairs for secure operation. Create these in your arcium-node-setup directory:

3.1 Node authority keypair

This Solana keypair identifies your node and handles onchain operations:

solana-keygen new --outfile node-keypair.json --no-bip39-passphrase

The --no-bip39-passphrase flag creates a keypair without a passphrase for easier automation.

3.2 Callback authority keypair

This Solana keypair signs callback computations and must be different from your node keypair for security separation:

solana-keygen new --outfile callback-kp.json --no-bip39-passphrase

3.3 Identity keypair

This keypair handles node-to-node communication and must be in PKCS#8 format:

openssl genpkey -algorithm Ed25519 -out identity.pem

3.4 BLS keypair

This keypair is used for BLS (Boneh-Lynn-Shacham) threshold signatures on MPC computation callbacks. Generate it using the Arcium CLI:

arcium gen-bls-key bls-keypair.json

This creates a 32-byte private key stored as a JSON array format.

3.5 X25519 keypair

This keypair is used for encrypted communication between nodes:

arcium generate-x25519 -o x25519-keypair.json

This creates a 32-byte X25519 private key stored in JSON array format.

Keep these keypairs safe and private. Back them up to a secure location outside your VPS - you’ll need them to restore your node if something goes wrong. Never share them with anyone.

Step 4: Fund your accounts

Your node and callback accounts need SOL for transaction fees. Transfer SOL to both accounts and verify balances:

# Check your account addresses
solana address --keypair node-keypair.json
solana address --keypair callback-kp.json

# Verify balances
solana balance "$(solana address --keypair node-keypair.json)"
solana balance "$(solana address --keypair callback-kp.json)"

On devnet, you can use solana airdrop 2 <address> -u devnet or the web faucet to get free SOL for testing.

On mainnet, SOL has real economic value. Ensure you have sufficient funds before proceeding.

Step 5: Initialize node accounts

Now we’ll register your node with the Arcium Network by creating its onchain accounts. This step tells the blockchain about your node and its capabilities.

Always pass --rpc-url <your-rpc-url> to arcium commands. solana config set --url ... affects Solana CLI commands only; arcium defaults to mainnet when --rpc-url is omitted.

For guidance on choosing a reliable endpoint, see the RPC Provider Recommendations. Use the init-arx-accs command to initialize all required onchain accounts for your node:

arcium init-arx-accs \
  --keypair-path node-keypair.json \
  --callback-keypair-path callback-kp.json \
  --peer-keypair-path identity.pem \
  --bls-keypair-path bls-keypair.json \
  --x25519-keypair-path x25519-keypair.json \
  --node-offset <your-node-offset> \
  --ip-address <your-public-ip> \
  --rpc-url <your-rpc-url>

Required parameters:

--keypair-path: Path to your node authority keypair
--callback-keypair-path: Path to your callback authority keypair
--peer-keypair-path: Path to your identity keypair (PEM format)
--bls-keypair-path: Path to your BLS keypair (JSON array format)
--x25519-keypair-path: Path to your X25519 keypair (JSON array format)
--node-offset: Your node’s unique ID number on the network. Choose any unique number. If you get an error during setup saying your number is already taken, just pick a different one and try again.
--ip-address: Your node’s public IP address
--rpc-url: Solana RPC endpoint (mainnet or devnet)

If successful, you’ll see confirmation that your node accounts have been initialized onchain.

Step 6: Configure your node

The configuration file specifies which network to connect to, how to communicate with other nodes, and various operational settings. Create a node-config.toml file in your arcium-node-setup directory:

[node]
offset = <your-node-offset>  # Your node offset from step 5
computations_limit = 10  # Max computations the node executes concurrently

[solana]
endpoint_rpc = "<your-rpc-provider-url-here>"  # e.g., https://api.mainnet-beta.solana.com or https://api.devnet.solana.com
endpoint_wss = "<your-rpc-websocket-url-here>"   # Replace with your RPC provider WebSocket URL (e.g., wss://api.mainnet-beta.solana.com)
secondary_endpoint_rpc = "<your-fallback-rpc-url-here>"   # Failover RPC, ideally a different provider
secondary_endpoint_wss = "<your-fallback-websocket-url-here>"  # Failover WebSocket, ideally a different provider

On v0.11.x, computations_limit, secondary_endpoint_rpc, and secondary_endpoint_wss are required: the config fails to parse without them. The node fails over to the secondary endpoints when the primary RPC lags or stops responding, so point them at a different provider than your primary endpoints.

Upgrading from v0.7.0? The [network] section, cluster, commitment, hardware_claim, starting_epoch, and ending_epoch fields have been removed. Update your node-config.toml to the simplified format above.

Trusted dealer config

If you operate a trusted dealer, the config expects every field under [dealer] and requires master_seed_path:

[dealer]
private_key_path = "/usr/trusted-dealer/identity.json"
master_seed_path = "/usr/trusted-dealer/master_seed.json"
cluster_offsets = [456]
solana_rpc_url = "<your-rpc-url>"
n_peers = 4
local_ip = "0.0.0.0"
rate_limit_initial_tokens = 10000000
rate_limit_tokens_per_second = 100000
rate_limit_max_tokens = 10000000

Replace 456 and 4 with your cluster offset and peer count.

local_addr was renamed to local_ip. Treat master_seed_path as the highest-sensitivity host secret; leaking it compromises keyshares.

Step 7: Cluster operations

Clusters are groups of nodes that collaborate on MPC computations. For background on cluster concepts, see Clusters overview. Most operators should join an existing cluster. Only create your own cluster if you’re coordinating a group of nodes.

Join Existing Cluster
Create New Cluster

To join an existing cluster, you must first be proposed by the cluster authority. Once proposed, accept the invitation:

arcium join-cluster true \
  --keypair-path node-keypair.json \
  --node-offset <your-node-offset> \
  --cluster-offset <cluster-offset> \
  --rpc-url <your-rpc-url>

Parameters:

true: Accept the join request (use false to reject)
--node-offset: Your node’s unique identifier (chosen during node initialization)
--cluster-offset: The cluster’s unique identifier (different from node offset - clusters and nodes have separate ID spaces)

You cannot join a cluster unless the cluster owner has first proposed you using propose-join-cluster.

If you want to create a new cluster and invite other nodes:1. Create the Cluster

arcium init-cluster \
  --keypair-path node-keypair.json \
  --offset <cluster-offset> \
  --max-nodes <max-nodes> \
  --rpc-url <your-rpc-url>

Parameters:

--offset: Unique identifier for your cluster (different from your node offset)
--max-nodes: Maximum number of nodes in the cluster

Optional parameters:

--mempool-size: Size of the mempool (Tiny, Small, Medium, Large). Defaults to Tiny
--price-per-cu: Initial price per compute unit in micro-lamports. Defaults to 1
--propose-node: Automatically propose a node to join after creation

2. Propose Nodes to JoinAfter creating the cluster, you must propose each node that should join. Nodes cannot join without being proposed first:

arcium propose-join-cluster \
  --keypair-path node-keypair.json \
  --cluster-offset <cluster-offset> \
  --node-offset <node-to-propose-offset> \
  --rpc-url <your-rpc-url>

Parameters:

--cluster-offset: Your cluster’s offset
--node-offset: The offset of the node you’re inviting

You can also propose a node inline when creating the cluster using --propose-node <node-offset>

3. Wait for Nodes to AcceptOnce proposed, each node must accept the invitation using join-cluster true (see Join tab).

Submit aggregated BLS key (required after cluster is full)

The command will verify that all cluster slots are filled before submitting. If nodes are still pending, it will fail with an error.

Once all nodes have joined the cluster, all nodes must aggregate and submit the combined BLS public key. This enables threshold BLS signatures for computation callbacks:

arcium submit-aggregated-bls-key \
  --keypair-path node-keypair.json \
  --cluster-offset <cluster-offset> \
  --node-offset <your-node-offset> \
  --rpc-url <your-rpc-url>

Parameters:

--keypair-path: Your node authority keypair (must be a node in the cluster)
--cluster-offset: The cluster’s offset
--node-offset: Your node’s offset within the cluster

All nodes need to run this command. The CLI will automatically fetch all node BLS public keys from the cluster and aggregate them.

Activate the cluster (cluster authority only)

After all nodes have submitted the aggregated BLS key, the cluster authority must activate the cluster:

arcium activate-cluster \
  --keypair-path <cluster-authority-keypair> \
  --cluster-offset <cluster-offset> \
  --rpc-url <your-rpc-url>

Parameters:

--keypair-path: A keypair that has authority over the cluster
--cluster-offset: The cluster’s offset

Only the cluster authority can run this command. The cluster must have all BLS keys submitted before activation will succeed.

Step 8: Deploy your node

Before running Docker, prepare your environment and verify you have all required files:

mkdir -p arx-node-logs private-shares public-inputs
ls node-keypair.json callback-kp.json identity.pem bls-keypair.json x25519-keypair.json node-config.toml

Create a docker-compose.yml file in your arcium-node-setup directory:

services:
  arx-node:
    image: arcium/arx-node:v0.12.0
    container_name: arx-node
    restart: unless-stopped
    environment:
      NODE_IDENTITY_FILE: /usr/arx-node/node-keys/node_identity.pem
      NODE_KEYPAIR_FILE: /usr/arx-node/node-keys/node_keypair.json
      CALLBACK_AUTHORITY_KEYPAIR_FILE: /usr/arx-node/node-keys/callback_authority_keypair.json
      BLS_PRIVATE_KEY_FILE: /usr/arx-node/node-keys/bls_keypair.json
      X25519_PRIVATE_KEY_FILE: /usr/arx-node/node-keys/x25519_keypair.json
      ARX_METRICS_HOST: 0.0.0.0
      ARX_METRICS_PORT: 9091
      ASYNC_MPC_STREAM_WINDOW_MB: 64
      ASYNC_MPC_CONN_WINDOW_MB: 512
      ASYNC_MPC_CC: bbr
    volumes:
      - ./node-config.toml:/usr/arx-node/arx/node_config.toml
      - ./node-keypair.json:/usr/arx-node/node-keys/node_keypair.json:ro
      - ./callback-kp.json:/usr/arx-node/node-keys/callback_authority_keypair.json:ro
      - ./identity.pem:/usr/arx-node/node-keys/node_identity.pem:ro
      - ./bls-keypair.json:/usr/arx-node/node-keys/bls_keypair.json:ro
      - ./x25519-keypair.json:/usr/arx-node/node-keys/x25519_keypair.json:ro
      - ./arx-node-logs:/usr/arx-node/logs
      - ./private-shares:/usr/arx-node/private-shares
      - ./public-inputs:/usr/arx-node/public-inputs
    ports:
      - "8001:8001/tcp"
      - "8001:8001/udp"
      - "8002:8002/tcp"
      - "8002:8002/udp"
      - "8012:8012/tcp"
      - "8012:8012/udp"
      - "8013:8013/tcp"
      - "8013:8013/udp"
      - "9091:9091/tcp"

Key configuration:

image: arcium/arx-node:v0.12.0: pinned version for stability
restart: unless-stopped: auto-restarts on crashes or server reboot
Volume mounts with :ro: read-only access for keypair files
ASYNC_MPC_STREAM_WINDOW_MB, ASYNC_MPC_CONN_WINDOW_MB, ASYNC_MPC_CC: recommended QUIC transport tuning for MPC throughput (per-stream and per-connection flow-control windows in MB, and the bbr congestion controller)

Start the node:

docker compose up -d
docker compose ps
docker compose logs -f arx-node

Ensure ports 8001, 8002, 8012, and 8013 are open for TCP and UDP. Port 9091 is TCP-only for metrics. The metrics endpoint has no authentication - restrict access to trusted networks only.

Alternative: docker run command

If you prefer using docker run directly:

docker run -d \
  --name arx-node \
  -e NODE_IDENTITY_FILE=/usr/arx-node/node-keys/node_identity.pem \
  -e NODE_KEYPAIR_FILE=/usr/arx-node/node-keys/node_keypair.json \
  -e CALLBACK_AUTHORITY_KEYPAIR_FILE=/usr/arx-node/node-keys/callback_authority_keypair.json \
  -e BLS_PRIVATE_KEY_FILE=/usr/arx-node/node-keys/bls_keypair.json \
  -e X25519_PRIVATE_KEY_FILE=/usr/arx-node/node-keys/x25519_keypair.json \
  -e ARX_METRICS_HOST=0.0.0.0 \
  -e ARX_METRICS_PORT=9091 \
  -e ASYNC_MPC_STREAM_WINDOW_MB=64 \
  -e ASYNC_MPC_CONN_WINDOW_MB=512 \
  -e ASYNC_MPC_CC=bbr \
  -v "$(pwd)/node-config.toml:/usr/arx-node/arx/node_config.toml" \
  -v "$(pwd)/node-keypair.json:/usr/arx-node/node-keys/node_keypair.json:ro" \
  -v "$(pwd)/callback-kp.json:/usr/arx-node/node-keys/callback_authority_keypair.json:ro" \
  -v "$(pwd)/identity.pem:/usr/arx-node/node-keys/node_identity.pem:ro" \
  -v "$(pwd)/bls-keypair.json:/usr/arx-node/node-keys/bls_keypair.json:ro" \
  -v "$(pwd)/x25519-keypair.json:/usr/arx-node/node-keys/x25519_keypair.json:ro" \
  -v "$(pwd)/arx-node-logs:/usr/arx-node/logs" \
  -v "$(pwd)/private-shares:/usr/arx-node/private-shares" \
  -v "$(pwd)/public-inputs:/usr/arx-node/public-inputs" \
  -p 8001:8001/tcp -p 8001:8001/udp \
  -p 8002:8002/tcp -p 8002:8002/udp \
  -p 8012:8012/tcp -p 8012:8012/udp \
  -p 8013:8013/tcp -p 8013:8013/udp \
  -p 9091:9091/tcp \
  arcium/arx-node:v0.12.0

Step 9: Verify node operation

Check that your node is running correctly:

Check node status

arcium arx-info <your-node-offset> --rpc-url <your-rpc-url>

Check if node is active

arcium arx-active <your-node-offset> --rpc-url <your-rpc-url>

Metrics and health

The node exposes Prometheus-compatible metrics on port 9091:

Endpoint	Description
`GET /metrics`	Prometheus-format metrics
`GET /health`	Health check (returns “OK”)

Verify:

curl -s http://localhost:9091/metrics | grep arx_
curl -s http://localhost:9091/health

Scrape with Prometheus and visualize with Grafana:

# prometheus.yml snippet
scrape_configs:
  - job_name: 'arx-node'
    static_configs:
      - targets: ['localhost:9091']

Monitor logs

docker compose logs -f arx-node

Extract internal logs

If you need detailed logs for debugging:

docker cp arx-node:/usr/arx-node/logs ./node-logs
ls ./node-logs/  # Shows arx_log_<datetime>_<offset>.log

RPC provider recommendations

For better reliability, consider using dedicated RPC providers instead of the default public endpoints. Recommended providers:

Troubleshooting

Node fails with 'missing environment variable'

All 5 environment variables are required. Verify your docker-compose.yml includes:

NODE_KEYPAIR_FILE
CALLBACK_AUTHORITY_KEYPAIR_FILE
NODE_IDENTITY_FILE
BLS_PRIVATE_KEY_FILE
X25519_PRIVATE_KEY_FILE

Node fails with 'X25519 key invalid'

Regenerate the X25519 keypair:

arcium generate-x25519 -o x25519-keypair.json

Node Not Starting

Verify all 5 keypair files exist and are readable
Check that node-config.toml is valid TOML with all required fields
Ensure your IP address is accessible from the internet

Node can't reach peers

Verify firewall allows inbound TCP and UDP on ports 8001, 8002, 8012, 8013, plus TCP on 9091 if exposing metrics
Check RPC endpoint is responsive
Verify node is active: arcium arx-active <your-node-offset> --rpc-url <your-rpc-url>

Account Initialization Failed

Verify you have sufficient SOL for transaction fees
Check that your RPC endpoint is working
Ensure node offset is unique (try a different number)

Cannot Join Cluster

Verify you’ve been invited by the cluster authority
Check that cluster has available slots
Ensure your node is properly initialized

BLS aggregation failing

All cluster nodes need valid BLS keys. After all nodes join:

arcium submit-aggregated-bls-key \
  --keypair-path node-keypair.json \
  --cluster-offset <cluster-offset> \
  --node-offset <your-node-offset> \
  --rpc-url <your-rpc-url>

Callback authority out of funds

Check the balance and top up your callback account:

solana balance "$(solana address -k callback-kp.json)"
# On devnet:
solana airdrop 2 "$(solana address -k callback-kp.json)" -u devnet
# On mainnet: transfer SOL from your funded wallet

Docker Issues

Verify Docker is running
Check file permissions on mounted volumes
Ensure ports 8001, 8002, 8012, 8013 (TCP & UDP) and 9091 (TCP) are not already in use

Need more help? Join the Arcium Discord for community support, or review the installation troubleshooting guide.

What’s next?

Once your node is running successfully:

Join the community: Connect with other Node Operators on Discord
Stay updated: Keep your Arcium tooling updated with arcup self update && arcup update
Learn more: Read the Arcium Network overview or installation guide

​Overview

​Prerequisites

​Step 1: Set up your workspace

​Step 2: Install Arcium tooling

​Step 3: Generate required keypairs

​3.1 Node authority keypair

​3.2 Callback authority keypair

​3.3 Identity keypair

​3.4 BLS keypair

​3.5 X25519 keypair

​Step 4: Fund your accounts

​Step 5: Initialize node accounts

​Required parameters:

​Step 6: Configure your node

​Trusted dealer config

​Step 7: Cluster operations

​Submit aggregated BLS key (required after cluster is full)

​Activate the cluster (cluster authority only)

​Step 8: Deploy your node

​Step 9: Verify node operation

​Check node status

​Check if node is active

​Metrics and health

​Monitor logs

​Extract internal logs

​RPC provider recommendations

​Troubleshooting

​What’s next?

Overview

Prerequisites

Step 1: Set up your workspace

Step 2: Install Arcium tooling

Step 3: Generate required keypairs

3.1 Node authority keypair

3.2 Callback authority keypair

3.3 Identity keypair

3.4 BLS keypair

3.5 X25519 keypair

Step 4: Fund your accounts

Step 5: Initialize node accounts

Required parameters:

Step 6: Configure your node

Trusted dealer config

Step 7: Cluster operations

Submit aggregated BLS key (required after cluster is full)

Activate the cluster (cluster authority only)

Step 8: Deploy your node

Step 9: Verify node operation

Check node status

Check if node is active

Metrics and health

Monitor logs

Extract internal logs

RPC provider recommendations

Troubleshooting

What’s next?