Running Monerod via Systemd¶

Why run this specific setup?¶

You will be able to connect your desktop and mobile Monero wallets to your own trusted Monero node, in a secure and private way over Tor.

Running as a systemd service will allow your node to always remain synced, as opposed to intermittently running node.

Public RPC service - The public-node config option will broadcast your RPC port to your peers, providing a service for anyone to use your node to connect their wallets to the Monero network. This is useful to users who don't run their own nodes. You may enable it by removing the # from #public-node in the config.

Assumptions¶

You possess:

• Basic understanding of Linux administration
• Root access to a Linux server
• Recommended 4 GB+ RAM
• Recommended available SSD storage of
  • 550.0 GB+ for the full node
  • 200.0 GB+ for the pruned

Some commands assume Ubuntu but you will easily translate them to your distribution.

Install Monero¶

1. Create monero user and group:

   useradd --system monero
   

2. Create monero config, data and log directories:

   mkdir -p /etc/monero     # config
   mkdir -p /var/lib/monero # blockchain
   mkdir -p /var/log/monero # logs
   chown monero:monero /etc/monero
   chown monero:monero /var/lib/monero
   chown monero:monero /var/log/monero
   

   Feel free to adjust above to your preferred conventions, just remember to adjust the paths in the systemd and monerod config files accordingly.

3. Download and verify the archive.

4. Extract the binaries (adjust filename if necessary):

   tar -xvf monero-linux-x64-v0.18.3.4.tar.bz2
   rm monero-linux-x64-v0.18.3.4.tar.bz2
   

5. Move binaries to /usr/local/bin/:

   mv monero-x86_64-linux-gnu-v0.18.3.4/* /usr/local/bin/.
   chown monero:monero /usr/local/bin/monero*
   

Monerod Config¶

1. Create /etc/monero/monerod.conf as shown below:

   # /etc/monero/monerod.conf
   #
   # Configuration file for monerod. For all available options see the MoneroDocs:
   # https://docs.getmonero.org/interacting/monerod-reference/
   
   # Data directory (blockchain db and indices)
   data-dir=/var/lib/monero/bitmonero   # Blockchain storage location
   
   # Optional pruning
   #prune-blockchain=1           # Pruning saves 2/3 of disk space w/o degrading functionality but contributes less to the network
   #sync-pruned-blocks=1         # Allow downloading pruned blocks instead of prunning them yourself
   
   # Centralized services
   check-updates=disabled         # Do not check DNS TXT records for a new version
   enable-dns-blocklist=1           # Block known malicious nodes
   
   # Log file
   log-file=/var/log/monero/monero.log
   log-level=0                    # Minimal logs, WILL NOT log peers or wallets connecting
   max-log-file-size=2147483648   # Set to 2GB to mitigate log trimming by monerod; configure logrotate instead
   
   # P2P full node
   #p2p-bind-ip=0.0.0.0            # Bind to all interfaces (the default)
   #p2p-bind-port=18080            # Bind to default port
   #no-igd=1                       # Disable UPnP port mapping
   
   # RPC open node
   #public-node=1                  # Advertise to other users they can use this node for connecting their wallets
   rpc-restricted-bind-ip=0.0.0.0 # Bind to all interfaces (the Open Node)
   rpc-restricted-bind-port=18089 # Bind to a new RESTICTED port (the Open Node)
   
   # RPC TLS
   rpc-ssl=autodetect             # Use TLS if client wallet supports it (Default); A new certificate will be regenerated every restart
   
   # ZMQ
   #zmq-rpc-bind-ip=127.0.0.1      # Default 127.0.0.1
   #zmq-rpc-bind-port=18082        # Default 18082
   zmq-pub=tcp://127.0.0.1:18083  # ZMQ pub
   #no-zmq=1                       # Disable ZMQ RPC server
   
   # Mempool size
   max-txpool-weight=2684354560   # Maximum unconfirmed transactions pool size in bytes (here ~2.5GB, default ~618MB)
   
   # Database sync mode
   #db-sync-mode=safe:sync        # Slow but reliable db writes
   
   # Network limits
   out-peers=24              # This will enable much faster sync and tx awareness; the default 8 is suboptimal nowadays
   in-peers=48               # The default is unlimited; we prefer to put a cap on this
   
   limit-rate-up=1048576     # 1048576 kB/s == 1GB/s; a raise from default 2048 kB/s; contribute more to p2p network
   limit-rate-down=1048576   # 1048576 kB/s == 1GB/s; a raise from default 8192 kB/s; allow for faster initial sync
   
   # Tor/I2P: broadcast transactions originating from connected wallets over Tor/I2P (does not concern relayed transactions)
   #tx-proxy=i2p,127.0.0.1:4447,16.disable_noise  # I2P
   #tx-proxy=tor,127.0.0.1:9050,16,disable_noise  # Tor
   
   # Tor/I2P: tell monerod your onion address so it can be advertised on P2P network
   #anonymous-inbound=PASTE_YOUR_I2P_HOSTNAME,127.0.0.1:18085,64         # I2P
   #anonymous-inbound=PASTE_YOUR_ONION_HOSTNAME:18084,127.0.0.1:18084,64 # Tor
   
   # Tor: be forgiving to connecting wallets
   disable-rpc-ban=1
   

Systemd¶

1. Create /etc/systemd/system/monerod.service as shown below.

   # /etc/systemd/system/monerod.service
   
   [Unit]
   Description=Monero Daemon
   After=network-online.target
   
   [Service]
   ExecStart=/usr/local/bin/monerod --detach --config-file /etc/monero/monerod.conf --pidfile /run/monero/monerod.pid
   ExecStartPost=/bin/sleep 0.1
   PIDFile=/run/monero/monerod.pid
   Type=forking
   
   Restart=on-failure
   RestartSec=30
   
   User=monero
   Group=monero
   RuntimeDirectory=monero
   
   StandardOutput=journal
   StandardError=journal
   
   [Install]
   WantedBy=multi-user.target
   

2. Enable the monerod service:

   systemctl daemon-reload
   systemctl enable monerod
   systemctl restart monerod
   

3. Verify it is up:

   systemctl status monerod
   

4. Verify it is working as intended:

   tail -n100 /var/log/monero/monero.log
   

Open firewall ports¶

If you use a firewall (and you should), open 18080 and 18089 ports for incoming TCP connections. These are for the incoming clearnet connections, P2P and RPC respectively.

You do not need to open any ports for Tor.

For example, for popular ufw firewall, that would be:

ufw allow 18080/tcp
ufw allow 18089/tcp

To verify, use ufw status. The output should be similar to the following (the 22 being default SSH port, unrelated to Monero):

To                         Action      From
--                         ------      ----
22/tcp                     LIMIT       Anywhere
18080/tcp                  ALLOW       Anywhere
18089/tcp                  ALLOW       Anywhere
22/tcp (v6)                LIMIT       Anywhere (v6)
18080/tcp (v6)             ALLOW       Anywhere (v6)
18089/tcp (v6)             ALLOW       Anywhere (v6)

Tor & I2P¶

Testing¶

sudo netstat -lntpu

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
...
tcp        0      0 0.0.0.0:18080           0.0.0.0:*               LISTEN      259255/monerod
tcp        0      0 0.0.0.0:18089           0.0.0.0:*               LISTEN      259255/monerod
tcp        0      0 127.0.0.1:18084         0.0.0.0:*               LISTEN      259255/monerod
tcp        0      0 127.0.0.1:9050          0.0.0.0:*               LISTEN      258786/tor

curl --digest -X POST http://YOUR_IP_ADDRESS_HERE:18089/json_rpc -d '{"jsonrpc":"2.0","id":"0","method":"get_info"}' -H 'Content-Type: application/json'

proxychains nmap -Pn -p 18084 YOUR_ONION_ADDRESS_HERE.onion

curl -x socks5h://127.0.0.1:9050 --digest -X POST http://YOUR_ONION_ADDRESS_HERE.onion:18089/json_rpc -d '{"jsonrpc":"2.0","id":"0","method":"get_info"}' -H 'Content-Type: application/json'`

Debugging¶