# Node setup guide

Install a Validator, Guardian or Oracle node with the Noderr installer and an install token. Micro nodes run on the Micro Node app instead. See [Micro Node Setup](./micro-nodes/setup-and-installation.md).

> Open self-registration is not live yet. See [Testnet Status](../introduction/testnet-status.md).

## How to join

1. **Apply.** Fill in the [Node Operator Application](https://form.typeform.com/to/I6klvjKG). It asks for your wallet address and the RPC endpoint your node will use.
2. **Get approved and pay for a tier.** The team reviews each application. Once you are approved and have paid for a tier, the team sets up your node and sends you an install token.
3. **Run the installer** with that token, as shown below.

## Before you start

- An install token from the team. The token sets your tier, so all three tiers use the same installer.
- A Linux or Windows machine that meets the hardware for your tier: [Validator](./validator-nodes/README.md), [Guardian](./guardian-nodes/README.md) or [Oracle](./oracle-nodes/README.md). The installer checks CPU, RAM and disk before it starts.

## Install

### Linux

```bash
curl -fsSL https://install.noderr.xyz/linux | bash -s -- <INSTALL_TOKEN>
```

### Windows (PowerShell)

```powershell
irm https://install.noderr.xyz/windows | iex
```

The Windows installer asks for your install token.

### What the installer does

- Checks your hardware against your tier
- Installs Docker if it is missing
- Reads your wallet address and RPC endpoint from your install token
- Generates the node's operational wallet, so you never pass a private key by hand. This hot wallet is separate from your personal wallet.
- Starts the node as the `noderr-node` service

On Linux, configuration and keys live in `/etc/noderr/`. Keep `credentials.json` and `hot_wallet.json` private.

## Check your node (Linux)

```bash
systemctl status noderr-node
journalctl -u noderr-node -f
```

Oracle nodes also run an ML service. Check it with `docker logs noderr-ml-service -f`.

## Updates

Node software ships as signed releases. The node reads the current version from the onchain VersionBeacon, downloads that release and loads it only if its signature checks out. If a new version fails its health check, the node rolls back. There is nothing to pull by hand.

## Onchain roles

Role admins grant the Guardian and Oracle roles onchain. They are the protocol wallet and the Timelock. There is no onchain election today. See [Governance](../protocol/governance/README.md).

## Security

The node container publishes TCP ports 4001 and 4002. If you run a firewall, allow them.

Disable SSH password login:

```bash
sudo nano /etc/ssh/sshd_config
# Set: PasswordAuthentication no
sudo systemctl restart sshd
```

## If something fails

- **Installer stops at the hardware check:** the machine is below the minimum for your tier. Check your tier page.
- **Install token rejected:** ask the team in [Discord](https://discord.com/invite/bPznF37J2e).
- **Node will not start:** read the logs with `journalctl -u noderr-node -f`.

## Next

- [Performance Monitoring](./performance-monitoring.md)
- [Troubleshooting](../resources/troubleshooting.md)
- [FAQ](../resources/faq.md)
- [Compare the tiers](./README.md)