# MFENX Node Operator Guide

Release scope: Power House v0.3.3.

This guide starts a public observer. Validator admission additionally requires
a consensus identity approved by the active membership policy.

## Requirements

- Ubuntu 24.04 or another current Linux distribution
- 2 CPU cores, 4 GB RAM, 60 GB SSD minimum
- Stable public IPv4 or DNS
- TCP `7001` reachable for validator transport
- Rust stable when building from source

Keep RPC, metrics, private keys, and blob administration bound to localhost
unless a firewall and authenticated reverse proxy explicitly protect them.

## Install

```bash
cargo install power_house --version 0.3.3 --features net --locked
julian --version
```

Or use the release container:

```bash
docker pull ghcr.io/jrochub/power_house:0.3.3
```

## Create An Identity

```bash
install -d -m 0700 "$HOME/.powerhouse"
head -c 32 /dev/urandom >"$HOME/.powerhouse/node.key"
chmod 0600 "$HOME/.powerhouse/node.key"
julian key-info "$HOME/.powerhouse/node.key" --json
```

Never send the private key. Share only the peer ID and public key when
requesting validator admission.

## Start An Observer

```bash
julian net start \
  --node-id external-observer-1 \
  --log-dir "$HOME/.powerhouse/logs" \
  --blob-dir "$HOME/.powerhouse/data" \
  --listen /ip4/0.0.0.0/tcp/7001 \
  --bootstrap /dns4/<bootstrap-host>/tcp/7001/p2p/<peer-id> \
  --key "$HOME/.powerhouse/node.key" \
  --metrics 127.0.0.1:9100
```

An observer verifies and relays network data but does not count toward
validator quorum.

## Run Under systemd

Use `infra/systemd/powerhouse-node@.service` and the examples under
`infra/systemd/`. The unit enforces:

- restart on failure
- restricted filesystem access
- private temporary storage
- explicit state and log directories
- bounded file descriptors

Enable the health, metrics, backup, and log-export timers supplied with the
repository.

## Upgrade

Build or download the exact release, verify `julian --version`, back up state,
then use the rolling deployment helper. Never regenerate
`native_chain_state.json`, the membership policy, or a validator key during an
upgrade.

## Troubleshooting

1. Confirm `systemctl status powerhouse-node@<name>`.
2. Confirm local `/healthz` and `/metrics`.
3. Confirm at least one `powerhouse_connected_peers`.
4. Compare chain ID, block height, hash, and state root with a public RPC.
5. Preserve logs and state before resynchronizing.

See [Incident Response](incident_response.md) before deleting or replacing
state.
