You install a node with one command, and setup verifies paxd, all three native runtimes, genesis and your chosen configuration against the published checksums before anything lands on the host. Your node announces its CometBFT id, receives every known peer in return, and refreshes the list hourly, so nobody hand-maintains persistent peers. The chain is pruned, so the registry hands a fresh node the state-sync height, hash and RPC servers it needs.

What it does

Node distribution is the public install and discovery path for Paxeer X nodes. A publisher stages a release of the paxd binary, its native libraries, genesis and the full-node and validator configuration, writes a sorted SHA-256 manifest, and serves it from a single public origin. A registry service serves those declared artifacts and keeps the live peer list: a node announces its CometBFT node id once it is up and receives every known peer in return. A set of fleet scripts generates a per-host operator account, funds it and ramps validator self-stake across the fleet.

Key capabilities

• Installer verifies the node CLI against a published checksum file before installing it.
• Setup verifies paxd, all three native runtimes, genesis and the chosen configuration before install.
• Publisher stages each release, writes a sorted SHA-256 manifest, then atomically moves the current symlink.
• Registry records each node's CometBFT id at its observed public address and returns the live peer list.
• A state-sync endpoint computes a trusted height and hash from a live RPC for fresh nodes.
• Fleet scripts create per-host operator accounts, fund them and ramp self-stake in rounds.

Differentiators

The registry serves only an explicitly declared set of artifact paths: filesystem traversal and directory indexes are unavailable, and anything else returns 404. A registering node's peer address is always the address observed by the local reverse proxy, never an address the caller supplies, so a caller cannot poison peer discovery. The publisher refuses to publish unless the binary, all six x86-64 and AArch64 native libraries, genesis, both configuration files and every lifecycle script are present, and it checks that the staged binary can report its build identity against those libraries; a failed staging run never changes the served release.

Outcomes

• Every artifact is checksum-verified before it reaches the host
• The registry uses the observed peer address, not a supplied one
• A fresh node joins by state sync instead of block sync

Technical notes

• Linux only, x86-64 or AArch64, run as root; the installer needs curl and jq and installs them through apt or yum.
• Node commands cover setup, status, info, logs, start, stop, restart, update, peers, register, state sync, validator keygen, validator stake, validator status and removal. Standard ports are 26656 for p2p and 26657 for RPC, and a systemd timer refreshes peers 10 minutes after boot and hourly after that.
• The registry is a dependency-free Go service holding state in one JSON file behind a mutex. It is deployed as an unprivileged loopback-only systemd service behind Nginx, which overwrites forwarded-address headers and rate-limits registration. Changes to its source trigger a repository workflow that publishes linux/amd64 and linux/arm64 executables as release assets plus a matching multi-architecture container image.
• Registration is public unless a token is configured, in which case the caller must send a matching token header. A node id must be 40 lowercase hex characters, the source address must be a public unicast address, moniker and version are capped at 64 characters, and the request body is capped at 64 KiB.
• Validator staking ramps toward a target self-stake in steps that stay under the chain's max_voting_power_ratio, falling back to 20 per cent if the staking parameters cannot be read.
• Not fully implemented: the fleet staking script's money phases are dry runs unless explicitly confirmed, the create-validator step inside the per-host stake command is printed for an operator to run, and the script is written around one 81M PAX founder distribution that reaches each host over SSH using a fixed local keyring directory and key name. The release contents themselves are published outside Git to an external origin host.

More in Network