vaultsigner

Standalone CometBFT remote signer backed by HashiCorp Vault Transit.

What It Does

• dials the validator's priv_validator_laddr
• enforces CometBFT-style last-sign-state checks before signing
• calls Vault Transit only after the request is safe
• persists last_sign_state.json outside the validator process

Generated-Key Localnet

The generated-key localnet uses one vaultsignerd container per validator and one Vault container per validator. The default helper writes signer configs like this:

• node0 signer -> http://127.0.0.1:18200, key consensus-key
• node1 signer -> http://127.0.0.1:18201, key consensus-key
• node2 signer -> http://127.0.0.1:18202, key consensus-key
• node3 signer -> http://127.0.0.1:18203, key consensus-key

Start all localnet signers for that layout with:

cd vaultsigner
VALIDATOR_COUNT=4 PER_VALIDATOR_VAULTS=1 VAULT_NODES_DIR=/home/anubha/xaults_code/xvm_vault_generated/vault-local/.nodes VAULT_HOST_PORT_BASE=18200 KEY_NAME=consensus-key ./scripts/start-all-localnet-signers.sh --reset-state

The full generated-key flow is documented in ../VAULT_GENERATED_LOCALNET.md. Signer logs are available through Docker, for example:

docker logs vaultsignerd-node0

Run One Signer Manually

cd vaultsigner
PER_VALIDATOR_VAULTS=1 VAULT_NODES_DIR=/home/anubha/xaults_code/xvm_vault_generated/vault-local/.nodes VAULT_HOST_PORT_BASE=18200 KEY_NAME=consensus-key ./scripts/start-remote-signer-node.sh 0 --detach

The validator listens on priv_validator_laddr. vaultsignerd dials it and serves signing requests.

State Migration

The signer state file intentionally uses the same JSON field names as CometBFT's priv_validator_state.json, so you can seed the signer from the existing validator state before cutover.

Importing an Existing Validator Key

The older import flow is still available through vaultimport when you want to migrate an existing priv_validator_key.json into a Vault Transit key. The new generated-key localnet does not use vaultimport; it creates keys directly inside each validator's own Vault.

Notes:

• for same-host development, unix:// or local TCP both work depending on the validator config
• for remote signer deployment, prefer a private network or tunnel
• raw TCP transport in this CometBFT version has weak validator-side authentication