Canton Network TestNet Validator Installation Guide

About Canton Network

Canton Network is the first public permissionless blockchain platform designed for institutional finance, combining privacy, interoperability, and scalability.

Key Features:

• Privacy-preserving architecture
• Atomic cross-domain transactions
• BFT consensus
• Institutional-grade security

Network Details:

• Network: TestNet
• Version: 0.8.0 (verified 2026-09-18)
• Migration ID: 1
• Purpose: Pre-production testing

Never trust a version number written in a guide, including this one. Read it from the network before installing or upgrading: curl -s https://docs.test.global.canton.network.sync.global/info | jq .

TestNet is reset roughly every three months. A change in migration_id is a network reset, not an upgrade — see the Backup & Recovery tab.

Requirements

Hardware

Component	Minimum	Recommended
CPU	4 cores	8 cores
RAM	8 GB	16 GB
Storage	100 GB SSD	250 GB NVMe
Network	100 Mbps	1 Gbps

Software

• Docker 20.10+
• Docker Compose 2.0+
• curl, jq

⚠️ Important: Unique IP required (cannot be shared with DevNet or MainNet)

Onboarding Process

1. Submit Validator Form

Fill out the validator request form with corporate email (not Gmail/free email): https://sync.global/validator-request/

2. IP Whitelist

1. Contact SV sponsor in Slack
2. Provide your dedicated IP address for TestNet
3. Wait 2-7 days for approval (2/3 Super Validators must approve)

3. Verify IP Whitelist

bash -c 'CURL="curl -fsS -m 5 --connect-timeout 5"
for url in $($CURL https://scan.sv-2.test.global.canton.network.digitalasset.com/api/scan/v0/scans | jq -r ".scans[].scans[].publicUrl"); do
  echo -n "$url: "
  $CURL "$url"/api/scan/version | jq -r ".version" 2>&1 || echo "TIMEOUT"
done'

All SVs should respond with version (not TIMEOUT) = IP is whitelisted ✅

4. Get Onboarding Secret

Request from your SV sponsor in Slack (valid for 48 hours).

Installation

Step-by-Step Installation

1. System Preparation

# Update system
apt update && apt upgrade -y

# Install dependencies
apt install -y curl iptables build-essential git wget jq make gcc \
  nano tmux htop pkg-config libssl-dev tar clang ncdu unzip

# Install Docker
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable"
apt update && apt install -y docker-ce
docker --version

# Install Docker Compose
curl -L "https://github.com/docker/compose/releases/download/v2.24.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose
docker-compose --version

2. Check Network Status

curl -s https://docs.test.global.canton.network.sync.global/info | jq .

{"network":"testnet","sv":{"migration_id":1,"serial_id":2,"version":"0.8.0"},
 "synchronizer":{"current":{"chain_id_suffix":"5","serial_id":2,"version":"0.8.0"},
 "legacy":null,"successor":null}}

Note sv.version and sv.migration_id — you need both below. This endpoint is public and needs no API key and no IP whitelisting, so it works before your node exists.

Do not use https://lighthouse.testnet.cantonloop.com/api/stats for this. It now returns 401 API key required. Any guide or script still polling it for the network version is broken.

3. Download Canton Node

VERSION="0.5.10"
mkdir -p ~/.canton/${VERSION}
cd ~/.canton/${VERSION}

wget https://github.com/digital-asset/decentralized-canton-sync/releases/download/v${VERSION}/${VERSION}_splice-node.tar.gz
tar xzf ${VERSION}_splice-node.tar.gz
cd splice-node/docker-compose/validator

4. Start Validator

cd ~/.canton/0.5.10/splice-node/docker-compose/validator

# Enable unsafe auth (if needed for scripts/monitoring)
# echo "COMPOSE_FILE=compose.yaml:compose-disable-auth.yaml" >> .env

export IMAGE_TAG=0.5.10

./start.sh \
  -s "https://sv.sv-2.test.global.canton.network.digitalasset.com" \
  -c "https://scan.sv-2.test.global.canton.network.digitalasset.com" \
  -o "YOUR_ONBOARDING_SECRET_FROM_SV" \
  -p "YOUR_VALIDATOR_NAME" \
  -m "1" \
  -w

Parameters:

• -s - Sponsor SV URL
• -o - Onboarding secret from SV sponsor (use "" after first start)
• -p - Party hint (validator name)
• -m - Migration ID (1 for TestNet)
• -w - Enable wallet

⚠️ Important: Always use .digitalasset.com domain for TestNet sv-2 — the .sync.global domain has a broken SSL certificate.

If sv-2 is unavailable, try sv-1:

./start.sh \
  -s "https://sv.sv-1.test.global.canton.network.sync.global" \
  -o "YOUR_ONBOARDING_SECRET_FROM_SV" -p "YOUR_VALIDATOR_NAME" -m "1" -w

5. Check Status

# Container status
docker ps --filter "name=splice-validator"

# Logs
docker logs splice-validator-validator-1 -f --tail 100

# Health check
docker ps --filter "name=splice-validator-validator" --format "{{.Names}}: {{.Status}}"
# Should show: Up X minutes (healthy)

Unsafe Auth Mode (Optional)

If you need to disable authentication for local scripts or monitoring (NOT recommended for production exposed ports):

cat >> .env << 'EOF'
COMPOSE_FILE=compose.yaml:compose-disable-auth.yaml
AUTH_URL=https://unsafe.auth
SPLICE_APP_UI_NETWORK_FAVICON_URL=https://www.canton.network/hubfs/cn-favicon-05%201-1.png
SPLICE_APP_UI_NETWORK_NAME="Canton Network"
EOF

# Restart validator
./stop.sh && ./start.sh ...

⚠️ Even with compose-disable-auth.yaml, Wallet UI validates AUTH_URL and NETWORK_FAVICON_URL as URLs. Empty/missing values cause a Zod validation error.

Management

Stop

cd ~/.canton/0.5.10/splice-node/docker-compose/validator
./stop.sh

Restart

cd ~/.canton/0.5.10/splice-node/docker-compose/validator
export IMAGE_TAG=0.5.10

./start.sh \
  -s "https://sv.sv-2.test.global.canton.network.digitalasset.com" \
  -c "https://scan.sv-2.test.global.canton.network.digitalasset.com" \
  -o "" \
  -p "YOUR_VALIDATOR_NAME" \
  -m "1" \
  -w

View Logs

cd ~/.canton/0.5.10/splice-node/docker-compose/validator

# All containers
docker compose logs -f

# Validator only
docker compose logs -f validator

# Last 100 lines
docker logs splice-validator-validator-1 --tail 100

Backup & Recovery

Backup Database

# Create PostgreSQL dump
docker exec splice-validator-postgres-splice-1 pg_dump -U cnadmin validator \
  > ~/canton_testnet_backup_$(date +%Y%m%d).sql

# Or backup entire volume
docker run --rm -v splice-validator_postgres-splice:/data -v $(pwd):/backup \
  ubuntu tar czf /backup/testnet_postgres_$(date +%Y%m%d).tar.gz /data

Monitoring

Prometheus Metrics

Canton exports metrics on port 10013. The validator image ships wget, not curl — a curl exec fails with executable file not found in $PATH and returns an empty body, which reads exactly like a dead metrics port:

docker exec splice-validator-validator-1 \
  wget -q -O - --timeout=10 http://localhost:10013/metrics | head -20

The Monitoring tab covers which of those metrics actually indicate health, and which obvious alert rule silently never fires.

Alerting

Set up monitoring alerts for:

• Container health status
• Database availability
• Disk space usage
• Network connectivity
• Sync status

Example Telegram alert:

cat > /root/canton_testnet_monitor.sh << 'SCRIPT'
#!/bin/bash
BOT_TOKEN="YOUR_BOT_TOKEN"
CHAT_ID="YOUR_CHAT_ID"

MONIKER="CANTON - POSTHUMAN-TestNet-Validator"

if ! docker ps --format '{{.Names}} {{.Status}}' | grep -q 'splice-validator-validator.*healthy'; then
    curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
        -d chat_id="${CHAT_ID}" \
        -d text="🔴 ${MONIKER} DOWN - $(hostname)"
fi
SCRIPT

chmod +x /root/canton_testnet_monitor.sh

# Add to cron (every 5 minutes)
(crontab -l; echo "*/5 * * * * /root/canton_testnet_monitor.sh") | crontab -

Security

Firewall Configuration

A Canton validator has no external ingress requirements — Splice states it does not need to whitelist any SVs or validators inbound. It needs egress on 443 to the Super Validators, which is usually allowed already. So the correct policy admits nothing from the internet except your own SSH:

ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp                          # restrict to your admin CIDR
ufw insert 1 allow out to 172.19.0.0/16   # Docker internal, if needed locally
ufw enable

Do not open 443 inbound. Nothing on a validator listens on it.

See the Security Hardening tab for the full treatment, including why a published Docker port bypasses ufw entirely.

Restrict Web UI Access

By default, wallet UI is publicly accessible. Secure it:

Step 1: Bind to localhost only (in compose.yaml nginx ports):

ports:
  - "127.0.0.1:8888:80"

Step 2: Nginx uses virtual hosts + basic auth. Access via:

1. /etc/hosts on local machine: 127.0.0.1 wallet.localhost ans.localhost
2. SSH tunnel: ssh -L 8888:127.0.0.1:8888 user@validator_ip -N
3. Open http://wallet.localhost:8888, enter basic auth credentials

Useful Links

• TestNet Explorer: https://lighthouse.testnet.cantonloop.com/
• Documentation: https://docs.sync.global/
• GitHub: https://github.com/digital-asset/decentralized-canton-sync
• Validator Form: https://sync.global/validator-request/
• Network Status: https://sync.global/sv-network/

Troubleshooting

IP Whitelist Issues

# Verify your IP is whitelisted (use .digitalasset.com — .sync.global has broken SSL)
curl -s https://scan.sv-2.test.global.canton.network.digitalasset.com/api/scan/version

# Should return version number, not error/403

Onboarding Secret Expired

Contact your SV sponsor in Slack to get a new secret (48h validity).

Container Restarts

# Check logs for errors
docker logs splice-validator-validator-1 --tail 100

# Common issues:
# 1. Wrong migration_id
# 2. Expired onboarding secret
# 3. IP not whitelisted

---

Created by POSTHUMAN validators

Website: https://posthuman.digital