I've seen a lot of people mention tezos setups for baking. The general idea would be to run a handful of FE nodes, likely geographically dispersed, and then having a private node which connects to just your FE nodes. And if possible, the private node would use a Ledger for baking/signing operations.
Such a system would be economically infeasible for me. I'm also itinerant enough that I can't just setup a home system. So I wanted to ask about general thoughts regarding the security of my setup.
I run a single node in a VPS. It runs in private mode and its peers are only the TF peers. The node talks to a signer running in another VPS via a private network. The signer's firewall is completely blocked off except for the signer port I chose and ssh is only available via a tunnel machine that is also part of the private network.
The the signer's firewall only allows connections to the signer port from the node VPS who's IP I whitelisted. Because of this, I didn't feel it was necessary to setup signer authentication.
The signer signs for my delegate address and the delegate address contains just enough tezzies (and a little extra for breathing room) to put up the deposits for PRESERVED_CYCLES as output by the estimated-rights.py script.
The rest of the tezzies live in an originated account elsewhere that delegates to my delegate, with the account keys stored on a Ledger.
A few questions:
- Does this sound like a reasonably secure setup?
- Any holes or anything I'm missing?
- Is connecting to just the TF nodes enough to give me a high probability that blocks I bake are propagated through the network quickly and successfully injected?
Bonus points: Does anyone know if there is an AWS blockchain template in the works, similar to how there is for Ethereum? See: Using the AWS Blockchain Template for Ethereum
(This question has a diagram of the exact setup that is economically infeasible for me given that I am just a solo baker)