How to Setup a Quorum Block Explorer in ECS?

As promised from the previous post, once the Quorum nodes are done setting up, we need a blockchain explorer to visualize the block activity. In this post, I will share how to setup Cakeshop, a set of tools and APIs for working with Quorum.

First, you can consider either setting it up on your existing ECS which is hosting with 4 Quorum nodes, or provision a separate new ECS from Alibaba Cloud.

Next, I would suggest go to the /mnt directory then create a new directory call cakeshop, then download the latest version of Cakeshop WAR file by issuing the following command:

wget https://github.com/jpmorganchase/cakeshop/releases/download/v0.11.0/cakeshop-0.11.0.war

I expect you have installed Java if you followed my previous post installing Tessera, otherwise please install Java by executing the following command. 

sudo apt install openjdk-11-jre-headless

Due to the reason that we already had an existing Quorum node running, hence we install the Cakeshop with attach mode. Therefore, execute the following command to extract the WAR file:

java -jar cakeshop-0.11.0.war example

Now go to diretory /mnt/cakeshop/data/local, open file editor with application.properties, change the geth.auto.start=false and geth.auto.stop=false


Alternatively, if you want to enable auto start, then change the following value accordingly to your Quorum node startup script which is located at /mnt:

For instance, the above setting is base on my following Geth startup script:

#!/bin/bash
PRIVATE_CONFIG=ignore nohup geth --datadir node1 --nodiscover --verbosity 5 --networkid 33333 --raft --raftport 50401 --rpc --rpcaddr 0.0.0.0 --rpcport 22001 --rpcapi admin,db,eth,debug,miner,net,shh,txpool,personal,web3,quorum,raft --emitcheckpoints --port 21001 >> node1.log 2>&1 &

After saving the application.properties file, execute the following command to start the blockchain explorer:

java -jar cakeshop-0.11.0.war

Wait for a while until you see this screen:

Now, your blockchain explorer is up and running, open your browser, then navigate to your server IP at port 8080, or browse the blockchain explorer at http://localhost:8080/

Look for the function Manage Nodes on the top right corner of the explorer. Then, click the Add Node button. Enter the Node Name, then Geth RPC Url which for my case is 21001 where you can find it in the Geth startup script. I also setup my Tessera which the default port is unchanged, or you can find it in my previous post that mentioning the Tessera config file at /mnt/node1t/config.json.

Once you are done, click the View button, it will bring you to the Dashboard page, and you will see blockchain explorer should attach to your existing Quorum node.

Enjoy playing around with the blockchain explorer, you can deploy contract, transfer ETH from wallet to wallet and even check who are the peers connecting and also managing your node.

How to Setup Transaction Privacy Between Quorum Nodes using Tessara?

Continue from the previous blog post about setting up Quorum node on Alibaba Cloud ECS instance, there is an optional module available for us to protect our transaction data privacy by limiting the data being exposed to certain authorized nodes.

Tessera is an independent software developed using Java and what it does is to perform data encryption for transaction dedicated to authorized nodes, and this software is sitting on top of Quorum node. The following diagram explain well how it perform the data encryption and decryption of the transaction:

As you can see Node A and B are in the same context but not Node C. When there is a transaction data being fed into the Node A, the transaction being encrypted and save the data into the private store.

The Node B Tessera is being configured to recognized Node A Tessera, and both share the same encryption key so that the authorized nodes manage to encrypt and decrypt the private store data.

So, today we are going to setup Node 1 and Node 2 to have Tessera protect their transaction privacy from the Quorum blockchain that I had setup from the previous post.

Environment

As mentioned earlier, Tessara is developed using Java, therefore, we need to make sure our node is installed with JDK 11 or latest by executing the following command:

sudo apt install openjdk-11-jre-headless

Installation

First, download Tessera installation file by executing the following command:

wget https://oss.sonatype.org/service/local/repositories/releases/content/com/jpmorgan/quorum/tessera-app/0.10.4/tessera-app-0.10.4-app.jar

Alternatively, you can also download the installation file manually at https://github.com/jpmorganchase/tessera/releases

Next, go to the mounted data disk directory, make directory for 4 nodes.

Then, move the Tessera software to the /mnt path, then execute the following command to create the key sets.

java -jar tessera-app-0.10.4-app.jar -keygen -filename t1
java -jar tessera-app-0.10.4-app.jar -keygen -filename t2 

Now, move the key files to the node1t and node2t folder:

Create a file call config.json, then copy and paste the follow content to the config file:

{
   "useWhiteList": false,
   "jdbc": {
       "username": "sa",
       "password": "",
       "url": "jdbc:h2:/mnt/node1t/db;MODE=Oracle;TRACE_LEVEL_SYSTEM_OUT=0",
       "autoCreateTables": true
   },
   "serverConfigs":[
       {
           "app":"ThirdParty",
           "enabled": true,
           "serverAddress": "http://localhost:9081",
           "communicationType" : "REST"
       },
       {
           "app":"Q2T",
           "enabled": true,
            "serverAddress":"unix:/mnt/node1t/tm.ipc",
           "communicationType" : "REST"
       },
       {
           "app":"P2P",
           "enabled": true,
           "serverAddress":"http://localhost:9001",
           "sslConfig": {
               "tls": "OFF"
           },
           "communicationType" : "REST"
       }
   ],
   "peer": [
       {
           "url": "http://localhost:9001"
       },
       {
           "url": "http://localhost:9002"
       },
       {
           "url": "http://localhost:9003"
       },
       {
           "url": "http://localhost:9004"
       }
   ],
   "keys": {
       "passwords": [],
       "keyData": [
           {
               "privateKeyPath": "/mnt/node1t/t1.key",
               "publicKeyPath": "/mnt/node1t/t1.pub"
           }
       ]
   },
   "alwaysSendTo": []
}

Save the file, then exit. Then, execute the following command to kick start the Tessera process:

java -jar ../tessera-app-0.10.4-app.jar -configfile config.json >> tessera.log 2>&1 & 

When you see the tm.ipc file is exist in the node1t folder, it indicate that you have done it correctly and the Tessera process is running now. If you do not see, not to worry, wait for a few more seconds, or check the tessera.log file to see what went wrong.

Repeat the above config file creation step for the node2t, refer to the color highlighted value that need to be modified accordingly to the right node config.

Now, go to your data disk mount directory which is located at /mnt, open the file startnode1.sh with file editor, then modify the PRIVATE_CONFIG value to the Tessera ipc file path.

To:

After modifying and saving the startnode1.sh and startnode2.sh, straight away execute both scripts.

Testing

First, let's get Node 2 public key because it is required for setting up private smart contract by executing the following script at the /mnt/node2t:

cat t2.pub

You will get the public key value which look like this:

Then, go to the /mnt directory, create a test sample smart contract called private-contract.js, then copy and paste the following content to the new file, but remember to change the value for privateFor to your node 2 Tessera public key which you got it from previous step:

a = eth.accounts[0]
web3.eth.defaultAccount = a;

// abi and bytecode generated from simplestorage.sol:
// > solcjs --bin --abi simplestorage.sol
var abi = [{"constant":true,"inputs":[],"name":"storedData","outputs":[{"name":"","type":"uint256"}],"payable":false,"type":"function"},{"constant":false,"inputs":[{"name":"x","type":"uint256"}],"name":"set","outputs":[],"payable":false,"type":"function"},{"constant":true,"inputs":[],"name":"get","outputs":[{"name":"retVal","type":"uint256"}],"payable":false,"type":"function"},{"inputs":[{"name":"initVal","type":"uint256"}],"payable":false,"type":"constructor"}];

var bytecode = "0x6060604052341561000f57600080fd5b604051602080610149833981016040528080519060200190919050505b806000819055505b505b610104806100456000396000f30060606040526000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff1680632a1afcd914605157806360fe47b11460775780636d4ce63c146097575b600080fd5b3415605b57600080fd5b606160bd565b6040518082815260200191505060405180910390f35b3415608157600080fd5b6095600480803590602001909190505060c3565b005b341560a157600080fd5b60a760ce565b6040518082815260200191505060405180910390f35b60005481565b806000819055505b50565b6000805490505b905600a165627a7a72305820d5851baab720bba574474de3d09dbeaabc674a15f4dd93b974908476542c23f00029";

var simpleContract = web3.eth.contract(abi);
var simple = simpleContract.new(42, {from:web3.eth.accounts[0], data: bytecode, gas: 0x47b760, privateFor: ["83vHGB2IGbmObH8Dl/tHWadA5KUQ3u7DxIs2byOuiQU="]}, function(e, contract) {
    if (e) {
        console.log("err creating contract", e);
    } else {
        if (!contract.address) {
            console.log("Contract transaction send: TransactionHash: " + contract.transactionHash + " waiting to be mined...");
        } else {
            console.log("Contract mined! Address: " + contract.address);
            console.log(contract);
        }
    }
}); 

Once done, save and exit from the file editor.

Now, attach geth to the Node 1 by executing the following command:

geth attach node1/geth.ipc

Then, before we could deploy smart contract, we need to unlock our account first by issuing the following geth command:

personal.unlockAccount(eth.accounts[0])

You will be prompted to key in the passphrase of your account which you had setup following my previous post.

Once you have unlocked your account, load the private contract script by issuing following geth command:

loadScript("private-contract.js") 

You will notice the returned transaction hashed and mined contract address which indicate the success of deploying smart contract.

Up to this stage, you are considered as successfully setup Tessera in your Quorum. However, we need a block explorer to further visualize how your blockchain work. In my next post, I will share how to setup a Quorum block explorer. Stay tuned!

How to Setup Quorum Blockchain Node in Alibaba Cloud ECS?

Blockchain becoming a hot topic recently as I find that it is a good technology to form trust between businesses whereby the data are being distributed and governed by the stakeholders together but still the data are temper proof which demonstrate reliability and security.

Quorum is an Ethereum-based blockchain technology which had removed the mining and gas fee requirement for deploying and executing smart contract. Quorum is being designed to share data and contracts within a closed group or known as consortium chain. We can control the accessibility of the blockchain network to desire parties only.

There are 3 types of consensus algorithm available to setup in Quorum blockchain:

1. Raft-based Consensus: A consensus model for faster blocktimes, transaction finality, and on-demand block creation.
2. Istanbul BFT (Byzantine Fault Tolerance) Consensus: A PBFT-inspired consensus algorithm with immediate transaction finality, by AMIS.
3. Clique POA Consensus: a default POA consensus algorithm bundled with Go Ethereum.

Let's start with how to setup your own Quorum nodes in Raft consensus algorithm first. I will cover the other 2 consensus implementation next time when I am free. For more information about those consensus algorithms mentioned above, you may find them in the Quorum official documentation site here.

Choosing the Right Spec of Your ECS Instance for Quorum Testing

In order to do quick start with Quorum, the minimum number of required nodes is 4. However, we do not need to purchase 4 ECS, but 1 will do the trick for testing and development purpose. I would recommend the following Alibaba Cloud ECS spec:

In order to minimize the cost spent on learning, I like the Pay As You Go feature in Alibaba Cloud whereby you only be charged base on the resource that you actually used. The Entry Level (Shared) category server give us even lower cost solution especially for our development and testing server which most of the time is idle. If the server CPU exceed the average baseline CPU performance, then only we will be charged for CPU credit. For more info how burstable type instance work, please refer to this link.

So, one server with 2 CPU and 4GB of RAM is sufficient to deploy 4 nodes for testing, please refer to the details in the following article. As for the operating system, I would recommend Ubuntu 18.04 64-bit. Then, add a 20GB data disk to keep the Quorum data instead of system disk. 

Setting Up Environment

After you have provisioned your server, we need to install the Quorum dependency which is Go language first by running the following command.

sudo apt install golang

By default, the server data disk is not mount yet. We need to mount it first. Please refer to this post. Then, we will setup the Quorum node in the data disk mount instead of system disk.

If you have not install Git, you need to install it now as we need it to clone Quorum code.

sudo apt install git

Clone from Github

Now, change the directory to the data disk path at /mnt. Then, begin with cloning and downloading the latest source code from the git by following command:

git clone https://github.com/jpmorganchase/quorum.git
cd quorum
make all
export PATH=/mnt/quorum/build/bin:$PATH 

Ensure that PATH contains geth and bootnode.

Create Folder for Each Node

Create 4 folders at the /mnt data disk path by running the following command:

mkdir node1
mkdir node2
mkdir node3
mkdir node4

Initialize Node

Initialize the node with new account for every node by running the following command from the node folder:

cd /mnt/node1
geth --datadir node1 account new

cd /mnt/node2
geth --datadir node2 account new

cd /mnt/node3
geth --datadir node3 account new

cd /mnt/node4
geth --datadir node4 account new

When you run the account new command, you will be prompted with asking for entering the password for the new account. Upon successful account creation, you will be given an account address which belong to the new account. You need to take note and keep it safely along with the password.

After you have created an account for every 4 different nodes, we shall proceed to create a general genesis setting file which will be shared with all the nodes. Therefore, create a new file call genesis.json at the /mnt path by executing the following command:

vi /mnt/genesis.json

The genesis.json file can be downloaded from here from the Quorum website. Copy and paste the content to the file editor, then edit the setting accordingly to below:

{
  "alloc": {
    "0x<account address created from node1>": {
      "balance": "1000000000000000000000000000"
    },

    "0x<account address created from node2>": {      "balance": "1000000000000000000000000000"
    },
    "0x<account address created from node3>": {      "balance": "1000000000000000000000000000"
    },
    "0x<account address created from node4>": {      "balance": "1000000000000000000000000000"
    }
  },
  "coinbase": "0x0000000000000000000000000000000000000000",
  "config": {
    "homesteadBlock": 0,
    "byzantiumBlock": 0,
    "constantinopleBlock": 0,
    "chainId": 10,
    "eip150Block": 0,
    "eip155Block": 0,
    "eip150Hash": "0x0000000000000000000000000000000000000000000000000000000000000000",
    "eip158Block": 0,
    "maxCodeSize": 35,
    "maxCodeSizeChangeBlock" : 0,
    "isQuorum": true
  },
  "difficulty": "0x0",
  "extraData": "0x0000000000000000000000000000000000000000000000000000000000000000",
  "gasLimit": "0xE0000000",
  "mixhash": "0x00000000000000000000000000000000000000647572616c65787365646c6578",
  "nonce": "0x0",
  "parentHash": "0x0000000000000000000000000000000000000000000000000000000000000000",
  "timestamp": "0x00"
}

Save the genesis.json then quit the editor.

Now, create node key for every node by executing the following command:

bootnode --genkey=nodekey1
bootnode --genkey=nodekey2
bootnode --genkey=nodekey3
bootnode --genkey=nodekey4 

Then, move the node key to the node folder:

mv nodekey1 node1/nodekey
mv nodekey2 node2/nodekey
mv nodekey3 node3/nodekey
mv nodekey4 node4/nodekey

Now, we need to get the enode id of the new node for the next setup. The --nodekey parameter is the path of the nodekey that you had moved from the previous step.

bootnode --nodekey=node1/nodekey --writeaddress
bootnode --nodekey=node2/nodekey --writeaddress
bootnode --nodekey=node3/nodekey --writeaddress
bootnode --nodekey=node4/nodekey --writeaddress  

Copy down the enode id of every nodekey above. Then, create a new file call static-nodes.json using file editor:

vi /mnt/static-nodes.json

Then, either copy the file content below or download from the Quorum website here:

[
  "enode://<node1 nodekey>@127.0.0.1:21001?discport=0&raftport=50401",
  "enode://<node2 nodekey>@127.0.0.1:21002?discport=0&raftport=50402",
  "enode://<node3 nodekey>@127.0.0.1:21003?discport=0&raftport=50403",
  "enode://<node4 nodekey>@127.0.0.1:21004?discport=0&raftport=50404"
]

Save the static-nodes.json then copy the file to every node directory:

cp static-nodes.json /mnt/node1
cp static-nodes.json /mnt/node2
cp static-nodes.json /mnt/node3
cp static-nodes.json /mnt/node4

Now, we can begin to initialize the first node and create the genesis block by issuing following command:

geth --datadir node1 init genesis.json

We need to prepare a automated script to start the node by creating a new file call startnode1.sh by executing following command:

vi /mnt/startnode1.sh

Copy the following content to the startnode1.sh script.

#!/bin/bash
PRIVATE_CONFIG=ignore nohup geth --datadir node1 --nodiscover --verbosity 5 --networkid 33333 --raft --raftport 50401 --rpc --rpcaddr 0.0.0.0 --rpcport 22001 --rpcapi admin,db,eth,debug,miner,net,shh,txpool,personal,web3,quorum,raft --emitcheckpoints --port 21001 >> node1.log 2>&1 &

$ chmod +x startnode1.sh 
$ ./startnode1.sh

Repeat above step to create startnode2.sh, startnode3.sh and startnode4.sh. There are a few parameters you need to take note and modify accordingly:

--datadir #your node folder which is node1, node2, node3 and node4
--networkid #need to be consistent for one blockchain one networkid
--raftport #follow as you setup in the static-nodes.json
--rpcport #shall be unique for each node in order to prevent port conflict
--port #follow as you setup in the static-nodes.json

Once done, grant execution privilege to the startnode scripts:

chmod +x startnode1.sh
chmod +x startnode2.sh
chmod +x startnode3.sh
chmod +x startnode4.sh

Now, execute all the start nodes script:

./mnt/node1/startnode1.sh
./mnt/node2/startnode2.sh
./mnt/node3/startnode3.sh
./mnt/node4/startnode4.sh

Upon executing the script, you can verify whether the script is running fine or not by checking if there is a geth.ipc file exist in the node folder.

Next, attach the geth process by executing the following process:

geth attach /mnt/node1/geth.ipc

Then, enter the command raft.cluster to check the other node statuses.

The node1 is active now, but not the other 3. Since I can confirm that the node is working fine, I shall proceed to make the other 3 nodes online as well by finishing what's left out which is the run geth on the other 3 nodes.

Finally, start the other 3 nodes by executing the startnode2.sh, startnode3.sh and startnode4.sh.

As you can see, all 4 nodes are in active status now. The Quorum installation and deployment is considered as complete.