Validator Requirements
Everything you need in place before deploying. Read this before renting a server — the CPU requirement rules out the cheapest tier at most providers.
Hardware
This page is the authoritative sizing for a validator. Other pages size development and RPC nodes, which are lighter.
| Component | Minimum | Recommended |
|---|---|---|
| CPU | 4 dedicated cores | 8 dedicated cores |
| RAM | 8 GB | 16 GB |
| Storage | 200 GB NVMe SSD | 500 GB NVMe SSD |
| Network | 100 Mbit, static IPv4 | 1 Gbit, static IPv4 |
| OS | Ubuntu 22.04 | Ubuntu 24.04 LTS |
Orbinum validators verify Groth16 proofs inside block execution. Verification is CPU-bound and arrives in bursts: a block carrying several shielded operations costs far more than an empty one.
Burstable and shared-vCPU instances — the cheap tier at most providers — throttle exactly when a proof-heavy block arrives. A throttled validator misses its slot, and missed slots stall finality for everyone. Use dedicated-vCPU instances (Hetzner CCX or equivalent).
Storage is sized for default pruning plus the shielded pool's Merkle tree, which only grows: every shielded note inserts leaves that are never removed. An archive node needs considerably more — a validator does not run one.
Network ports
| Port | Direction | Who needs it |
|---|---|---|
30333/tcp | inbound, public | Required — libp2p peering |
22/tcp | inbound, your IP | SSH |
9944 | never published | RPC — reachable inside the container only |
9615 | private IP only | Prometheus metrics |
Port 30333 must be reachable from the internet, not merely open in ufw: check
your provider's security group and any NAT in front of the host. A validator that
cannot accept inbound connections still dials the bootnodes, but peers poorly and
propagates its blocks late.
The validator runs with --rpc-methods Unsafe so that key insertion works over
loopback. Anything that can reach that port can insert keys, rotate your session
keys, and read your keystore's public halves.
The shipped Compose file does not map 9944 to the host, and you should not add
it. Every key operation in this guide goes through docker exec.
Accounts and keys
Four distinct pieces of key material, with different homes and different risk:
| Item | Where it comes from | Notes |
|---|---|---|
| Validator account (SS58) | Any Substrate wallet — Polkadot.js, Talisman, SubWallet | The sole argument to addValidator. Needs a little ORB to sign setKeys |
| Session keys (Aura + GRANDPA) | Generated on the node by author_rotateKeys | Private halves never leave the server |
| Node key | openssl rand -hex 32 | Your libp2p identity. Keep it stable across restarts |
Relay key (evmr, ECDSA) | Your own key, inserted after approval | Optional for consensus, required to earn |
Fund the validator account from the faucet before
step 7 — session.setKeys is a signed extrinsic and needs a balance to pay its
fee.
On Orbinum, ValidatorId is the AccountId directly. Your validator account is
an ordinary account and needs no relationship to your Aura key.
You may have read that a validator's account is its sr25519 key — that holds only for the genesis validators, whose accounts were derived from their Aura keys when the chain was built. A validator added later registers session keys under whatever account it already controls.
Telemetry
Reporting to telemetry.orbinum.network is required for validators. It is how the team verifies your node is synced and authoring before approving it, and how the set is monitored afterwards.
The shipped .env already does this at level 1, which is the level that
publishes your validator address to the dashboard. Leave TELEMETRY_URL at its
default — see Telemetry for what the value means and why
editing it needs a container recreate.
Turning telemetry off is supported by the software and fine for an RPC node. For a validator it removes the only signal that your node is alive and in sync, and an application from a node that is not visible cannot be actioned.
Software
Docker with the Compose plugin. That is the only dependency — the node ships as a pre-built image and you do not compile anything.
See Installation for the Docker install and the GitHub Container Registry token you will need to pull the image.
Next Steps
- Run a Validator Node — deploy, sync, and register session keys
- Installation — Docker and GHCR authentication
- Faucet — fund the account that will sign
setKeys