config.ini

# Telos mainnet private producer/finalizer template.
#
# This file intentionally contains invalid placeholders. Replace every value in
# angle brackets before starting nodeos. Keep the completed file out of Git and
# install it as root:telos with mode 0640 because it contains private signing
# keys and must be readable, but not writable, by the service account.

# Expected mainnet chain ID (verify after startup; this is not a nodeos option):
# 4667b205c6838ef70ff7988f6e8257e8be0e1284a2f59699054a018f743b1d11

# Private management API only. Do not expose a producer API publicly.
http-server-address = 127.0.0.1:8888
http-validate-host = false

# Bind to a private interface reachable only by operator-controlled relays.
p2p-listen-endpoint = <PRIVATE_PRODUCER_IP>:9876
agent-name = "<BP_ACCOUNT>-producer"

# TelosZero defaults to 1024 MiB, which is too small for current Telos state.
# Keep this below usable physical RAM and re-evaluate as chain state grows.
chain-state-db-size-mb = 32768
protocol-features-dir = /var/lib/telos/mainnet-primary/protocol_features

plugin = eosio::http_plugin
plugin = eosio::chain_plugin
plugin = eosio::chain_api_plugin
plugin = eosio::net_plugin
plugin = eosio::producer_plugin

# K1 block-signing key. Do not use the BP account active key here.
producer-name = <BP_ACCOUNT>
signature-provider = <PUB_K1_BLOCK_KEY>=KEY:<PVT_K1_BLOCK_KEY>

# Savanna finalizer key. Every producer instance needs a unique BLS key.
signature-provider = <PUB_BLS_FINALIZER_KEY>=KEY:<PVT_BLS_FINALIZER_KEY>
vote-threads = 4

# Keep safety.dat outside the disposable chain data directory, on persistent
# local storage. Never copy or restore an older safety.dat.
finalizers-dir = /var/lib/telos/finalizers/mainnet-primary

# Retain the TelosZero default protection that pauses block production if
# finalizer votes are not observed. Never set this to 0 in production.
production-pause-vote-timeout-ms = 6000

# A producer connects only to private, operator-controlled vote relays.
p2p-peer-address = <PRIVATE_RELAY_A>:9876
p2p-peer-address = <PRIVATE_RELAY_B>:9876