Validator onboarding

The recommended way to list a validator on the 2QUIC Marketplace is the guided funnel at /validator/onboard (sign-in required). It walks you through four steps, Identify, Provision TEE, Register, Live, and prefills the install and register commands with your values. The release-fetch and verification steps from the install guide remain manual.

The funnel is wallet-free by design. Your validator identity key lives on your server and inside the enclave, never in a browser extension, so the funnel never asks you to connect a wallet or sign anything in the page. You prove ownership later with validator-cli, which signs the registration challenge locally with your identity keypair file.

Step 1: Identify

Paste your validator's identity public key (base58). It is public information, the funnel only uses it to read your on-chain stake. The private key never leaves your server.

The funnel calls GET /v1/validators/stake-info?pubkey=... and shows your activated stake and network share. Continue is gated on the pubkey being a staked validator in the current epoch's vote accounts. If it is not, the funnel warns you that registration will be rejected, so double-check that you pasted the validator identity pubkey, not a vote account or withdraw authority.

Step 2: Provision the TEE

This step deploys the Nitro Enclave signer into your own AWS account. You run the commands, AWS bills you.

Region picker. Choose one of 20 supported AWS regions, grouped by continent. Compute, storage, and network costs scale with a per-region multiplier: us-east-1, us-east-2, and us-west-2 are the 1.0x baseline, the most expensive is sa-east-1 at 1.49x. Each AWS region maps to one of three trader-facing listing buckets (us-east-1, eu-west-3, asia-southeast-1), which the funnel pre-selects for you in step 3.

Instance type is not a choice. deploy.sh auto-selects the cheapest Nitro-capable instance in your region, preferring c6a.xlarge (4 vCPU, the Nitro Enclave minimum, plenty for one exclusive trader).

Cost breakdown. The funnel shows an itemized estimate, accurate to about plus or minus 15% of actual billing. For us-east-1 on-demand:

A 1-year Savings Plan cuts the compute line by up to ~30%. The host runs in a public subnet behind a security group, there is no NAT Gateway or VPC endpoint in the bill.

Install commands. The funnel renders these prefilled with your chosen region:

git clone https://github.com/nodexpert-labs/staked-quic-connection-provider
cd staked-quic-connection-provider
./deploy/scripts/build.sh
./deploy/scripts/deploy.sh \
  --identity-keypair /path/to/validator-keypair.json \
  --region us-east-1

This clones the open-source repo, builds the enclave image, and provisions the EC2 instance, the attested enclave, the PCR-bound KMS key, and the host-proxy. deploy.sh runs terraform plan and asks for confirmation before applying anything, and takes roughly 10 to 15 minutes.

Step 3: Register

The listing form collects:

• TEE endpoint URL: the public URL of your deployed host-proxy, for example https://tee.example:443.
• Exclusive price (SOL per epoch). Exclusive is always offered: one trader per epoch, full bandwidth. The form previews your net payout after the marketplace fee.
• Shared offering (optional): a checkbox that additionally sells the same epoch to several traders at a separate, typically lower, price. Enabling it requires both a shared price and a seat cap (max concurrent shared leases). The seat cap bounds the dilution and sets each shared trader's handshake quota. Supplying only one of the two is rejected by the API with 422 register-shared-config-incomplete. You can enable or disable shared any time from the dashboard.
• Bio (max 500 characters, optional marketing copy).
• Listing region: the latency bucket traders see, prefilled from your install region.
• Listing tier (economy, standard, performance): marketplace positioning shown to traders. It does not change the deploy, which auto-selects the instance type.

Submitting the form mints a one-time onboarding session token (POST /v1/validators/onboarding-sessions, bound to your signed-in account) and renders a prefilled register command to run on your validator server:

validator-cli register \
  --identity-keypair /path/to/validator-keypair.json \
  --endpoint-url https://tee.example:443 \
  --price 2.5 \
  --shared-price 0.8 \
  --shared-seats 4 \
  --bio 'Bare-metal validator, Frankfurt' \
  --region eu-west-3 \
  --tier economy \
  --payout-wallet <YOUR_PAYOUT_ADDRESS> \
  --onboard-token <one-time-token>

What happens when you run it:

• The CLI signs the registration challenge locally with your identity keypair file and POSTs the proof, plus the token, to POST /v1/validators. The signature never goes through the enclave: the enclave's signer only accepts TLS CertificateVerify payloads, and a generic signing RPC would break that security boundary.
• --payout-wallet is optional and defaults to your identity pubkey. It receives your share of every payment, paid atomically inside the trader's own transaction. Set a cold wallet here, or change it later with validator-cli set-payout-wallet (future bookings only, see the key rotation runbook).
• The minted API key is written to a <validator_id>.api-key file (mode 0600) next to your identity keypair, and the CLI tells you where. It is never shown again and never returned to the browser, so store it securely.
• The token attributes the listing to your web account, so it shows up in your dashboard at /validator.

Meanwhile the funnel polls GET /v1/validators/onboarding-sessions/{token} every 2 seconds and flips to the success screen as soon as the CLI completes.

Step 4: Live

Your listing is live immediately on successful registration. There is no probe-warmup gate: it appears on the browse page right away, seeded with the on-chain stake read at register time, and the marketplace probe loop (every 60 seconds) keeps its health and uptime fresh from there.

The success screen links to your dashboard at /validator and your public listing page. From the dashboard you can edit the price and bio, toggle the shared offering, watch probe health, and revoke leases.

The pure-CLI path

You can register without the funnel at all. Run the same validator-cli register command and simply omit --onboard-token:

validator-cli register \
  --identity-keypair /path/to/validator-keypair.json \
  --endpoint-url https://tee.example:443 \
  --price 2.5 \
  --bio 'Bare-metal validator, Frankfurt' \
  --region eu-west-3

The same checks apply (the pubkey must be a staked validator, the challenge signature must verify) and the listing goes live the same way. Add --dry-run to preview the signed payload and the redacted request body without registering.

Next steps