Best Practices

CCSPA

CCSPA Best Practices

Each member's pool configuration is peer reviewed via the rest of the CCSPA members to verify and increase the security of their pool and procedures. Since each pool has a unique configuration, every peer review session may also improve the rest of the members' procedures in ways not previously considered.

Kelowna Staking was the first CCSPA member to go through the peer review process and became approved on December 19, 2020.

CCSPA Best Practices

Since Dec 19, 2020

Kelowna Staking Best Practices

Kelowna Staking Best Practices

Security / Firewall

Security / Firewall

Block Producer

Whitelisted relay nodes, monitoring server, and SSH access from trusted networks. Every other incoming connection is dropped.

SSH Security

All nodes have SSH enabled with separate password protected SSH keys and password based authentication is disabled. All incoming SSH connections are dropped with the exception from my home and office networks. I have access to both networks through separate VPN connections as well as access to the hosting platform with password protected direct access to all three nodes. If there is ever an emergency I will be able to access all Kelowna Staking nodes. SSH keys are backed up on an encrypted device and with direct access to the nodes, a new set of keys can be created to replace lost SSH keys.

Private Key Management

Private keys are contained on a USB encrypted with a password longer than 15 characters containing uppercase, lowercase, numbers and symbols. Transactions are signed from an air gapped machine and transferred via USB to be submitted to the blockchain from a live machine. There are a total of four backups of all private keys on separate storage mediums with various methods of encryption.

Grafana Monitoring

Grafana Monitoring

All nodes are monitored using Grafana which sends email alerts for various triggers such as uptime and block sync speed.

Cardano RTView Monitoring

Cardano RTView Monitoring

All nodes are monitored usingĀ Cardano RTView which provides useful information that is not available on Grafana such as connected peers.

High Availability

High Availability Cluster

Each KLWNA node is running in a high availability cluster that is spread across multiple physical servers which allows each KLWNA node to migrate across the cluster. If one of the physical servers containing a node fails, the effected node will be brought back online automatically by a separate server in the cluster.

If a server has a hypothetical malfunction, any affected node will automatically come back online via another server.

Other Practices

Other Practices

Relay Topology

Both relays have unique peers and contain many official CCSPA member nodes in their topology. The Block Producer contains only Kelowna Staking relays in its topology.

Separate Instances

Each node is a separate virtualized instance, meaning that each stake pool node runs independently.

KES Rotation

KES keys are renewed at least 10 days before expiry to ensure the continuation of block production.

Crypto Prices

Name Price24H (%)
Bitcoin (BTC)
C$39,030.41
-2.77%
Ethereum (ETH)
C$2,330.24
-3.38%
Cardano (ADA)
C$1.47
-4.29%

Explore KLWNA