XRPL Node Setup on AWS
By: Tim Rowley
Tags: AWS, Rippled, Ripple, Xrp, Xrpl Node

Let’s set up our very own XRP Ledger Node using AWS. You can totally set this up on any other server provider such as Digital Ocean or even your own machine using software such as VMWare or Oracle’s VirtualBox so long as you know how to configure the networking side of things (eg. opening ports).

Overview

So what are we going to cover?

- System Requirements

- Cost of Hosting on AWS

- XRPL Node Setup & Configuration

- Adding SSL Support

System Requirements

The full requirements depends on what you’ll be using your XRPL node for. As an example, if you intend to run a full history node, you’ll need a lot more storage space.

As for operating systems, you can use:

- CentOS/RedHat (Latest)

- Ubuntu (16.04+)

- Debian (9.x, 10.x)

AWS Costing

With AWS we have the flexibility to choose whatever specifications we desire but here are two options and the estimated costs:

Running Minimum Requirements:

Minimum: T3A.Large | 2 CPU Cores, 8 GB Ram = ~$65 USD/month

Ideal: T3A.XLarge | 4 CPU Cores, 16GB Ram = ~$105 USD/month

Storage: GP3 | 65GB, 8,000 IOPS, 400MB/s Throughput = ~$45 USD /month

EC2 Instance Setup

If you haven’t already, register for an AWS (Amazon Web Services) account here.

Navigate to your EC2 Management Console.

Select which region you wish to host your XRPL node in by selecting the region from the dropdown menu at the top right of the management console.

Navigate to the EC2 dashboard from your management console by clicking EC2 from the Compute category.

Click on Launch Instance from the EC2 dashboard.

Choose AMI

Next, search for Ubuntu and select Ubuntu 18.04 from the search results.

Choose Instance Type

Filter the instance types by the T3A instance family.

Choose the instance with the system specifications you wish to use, I’ll be using the T3A.XLarge. Then click Next: Configure Instance Details at the bottom right of the screen.

Configure Instance Details

When on the Configure Instance Details screen, leave all options as default but optionally enable Termination Protection and/or Cloudwatch Monitoring (both can be enabled at a later time). Then click Next: Add Storage.

Add Storage

Modify the storage values as per below then click Next: Add Tags.

Size: 65GB

Volume Type: General Purpose SSD (GP3)

IOPS: 8000

Throughput: 400

Add Tags

You can optionally add tags to help you identify your instance if you plan to run multiple nodes. Example: Key: XRPL_NODE, Value: 1

Click Next: Configure Security Group

Configure Security Group

1. Allow your own IP address to SSH into your server by selecting My IP in the source column of the SSH row.

2. Click Add Rule and select the type ‘HTTP’ from the dropdown menu and in the Source column select ‘Anywhere’.

3. Click Add Rule and enter 51234 into the Port Range column and select ‘Anywhere’ as the Source, optionally enter the desired source to restrict RPC access.

4. Click Add Rule and enter 51235 into the Port Range column and select ‘Anywhere’ as the Source, this will allow other nodes to peer with yours.

Finally, click Review & Launch then Launch and a window will pop up asking to select or create a keypair.

Select Create a new keypair and enter a name such as ‘XRPLNodeKeyPair’, download the file and store it securely. Finally, click Launch Instances and then View Instances on the newly loaded screen.

Rename Instance

Hover over the dash in the Name column to reveal the edit icon to rename your instance. Name it ‘XRPL Node 1’.

Assign Elastic IP

On the left-hand side of your AWS console, select ‘Elastic IPs’

Click on Allocate Elastic IP address, a new window will open, leave the settings as default and click Allocate.

Select the newly create elastic IP by checking the IP’s box, click on Actions then Associate Elastic IP address. You can optionally name your IP address in the same way we named our instance.

Select the first options that come up in each input then click Associate.

SSH Into Server

Our instance is now configured and it’s time to access our server.

Windows users will need to follow this guide to access their server using Putty.

Linux/Mac based users:

Open your terminal and SSH into your server by:

Navigating to the directory you save your keypair file downloaded when creating your EC2 instance. eg. cd /Users/<username>/Keypairs Run the command sudo chmod 400 <keypair name>

3. Type in ssh -i <keypair name> ubuntu@<ec2-ip> replacing the angled brackets with your information and hit enter.

Install XRPL Node

Follow the official documentation to install your XRPL node using the latest instructions.

Notes:

On Step 5 remember to change the command to reflect which operating system you are using. For example, step 5’s command for users using Ubuntu 18.04 should use:

echo "deb https://repos.ripple.com/repos/rippled-deb bionic stable" |

\ sudo tee -a /etc/apt/sources.list.d/ripple.list

2. Return here once you complete all 8 steps.

Rippled Configuration

Before we continue, make sure to run the command: sudo systemctl status rippled.service to confirm your node is running like below:

The XRPL node keeps its configuration file in the /etc/opt/ripple/ directory in the file rippled.cfg . Since the default configuration is cluttered with comments, we’re going to create a new file to replace it.

Make a backup of the original rippled.cfg by running: sudo mv /etc/opt/ripple/rippled.cfg /etc/opt/ripple/rippled-original.cfg . This will rename the file. Create a new rippled.cfg by running: sudo nano /etc/opt/ripple/rippled.cfg . You’ll now be in the terminals text editor. Paste the following text into the terminal text editor:

This is the configuration that you can modify to suit your specific needs for your XRPL node. You can find the rippled configuration with examples on the Flare Networks Github repository to help guide what to add or change.

You’ll notice in the above configuration, in the [port_rpc_public] & [port_peer] blocks, the port is configured to the port we opened when we first created our EC2 instance.

Now, you could just leave it as is, and reload the rippled service to use the new configuration using sudo systemctl restart rippled.service and it’ll work no problem, but not using https or secure websockets.

For example, you can now run commands to your RPC using your nodes IP address http://<your-nodes-ip>:51234 . As you can see, we’re using the http protocol, then the nodes IP address and finally, the port we opened separated by a colon.

You can open a new terminal window and paste the below command, just changing the angled brackets with your nodes information:

The response you should expect to see if everything is configured correctly is:

Opening Websocket Port

You can optionally open the WebSocket port to allow WebSocket connections to your XRPL node. Go back to your AWS console to view your instances. Select your XRPL node instance and then click the Security tab, and finally the security group.

On the newly opened screen click on Edit inbound rules.

Scroll to the bottom of your rules and click on Add Rule. Leave the Type as ‘Custom TCP’, enter ‘6005’ in the port range, select the desired Source Type, eg. ‘Anywhere’ to allow public access, optionally add a description and click Save rules.

Your WebSocket is now open. If in your rippled.cfg you do not have the port open, add it and then restart your rippled server.

For example, add:

[port_ws_public]

port = 6005

ip = 0.0.0.0

protocol = ws

Then run sudo systemctl restart rippled.service on your server.

Adding SSL Support

You’re XRPL Node is now set up, running and processing ledgers but you can still take it a step further by adding SSL support which gives your server greater security when running RPC commands and utilising WebSocket Secure (WSS).

We’re going to need a domain name. You can register a domain on any domain register but since AWS is easy enough to use and have $5 domain options, I’ll use them.

Register Domain on Route53

Navigate to Route53 Domains and click on Register Domain.

(1) Enter the desired domain name, (2) change the TLD to whichever you like (such as .link which is cheap, (3) click on Check to ensure the domain name is available and (4) finally add it to your card.

Once added to your card click the blue Continue button at the bottom right to proceed. Enter your details on the newly loaded screen, if the option is available at the bottom, enable privacy protection.

Again, click Continue and complete any further required information such as agreeing to the Terms and Conditions then click on Complete Order.

It may take about 30 minutes for your domain to fully register on Route53 so be patient and once you see it in your domains console click it.

On the newly opened screen, click on Manage DNS.

Again, click on your newly registered domain name.

Click on the orange button Create Record and on the newly opened screen enter the details of your server. (1) Enter any subdomain in the Record name field, such as xrpl1 , then enter your servers IP in the Value field and finally click Create records.

You now have a domain (eg. xrpl1.rippledserver.link) that points to your XRPL server. We will now be able to create an SSL certificate on our server.

Install SSL Certificate

We’re going to use CertBot to install an SSL certificate on our server following the instructions found here. Open terminal again and enter the follow commands:

Ensure snapd is up to date: sudo snap install core; sudo snap refresh core Install CertBot: sudo snap install --classic certbot Prepare CertBot command: sudo ln -s /snap/bin/certbot /usr/bin/certbot Run CertBot sudo certbot certonly --standalone

You’ll then need to follow the instructions.

Awesome, our server now has its very own SSL certificates. But we still need to configure our XRPL node to utilize these new certificates.

First, we’re going to move the newly generated certificates to a folder in our home directory for ease of access. In the above image of the final output from CertBot, it displays the location the certificates were saved to (inside the yellow box) for example, /etc/letsencrypt/live/<domain-name>/ , make note of that location.

Navigate to your home directory by running cd $HOME . Make a new directory named ‘SSL’ by running mkdir ssl . Copy all certificates generated from CertBot to this folder, you can list all the certificates by running sudo ls /etc/letsencrypt/live/<domain-name>

4. Run the command sudo cp /etc/letsencrypt/live/<domain-name>/<pem-file> $HOME/ssl for each of the listed files except for fullchain.pem and README.pem.

sudo cp /etc/letsencrypt/live/xrpl1.rippledserver.link/cert.pem $HOME/ssl/cert.pem sudo cp /etc/letsencrypt/live/xrpl1.rippledserver.link/chain.pem $HOME/ssl/chain.pem sudo cp /etc/letsencrypt/live/xrpl1.rippledserver.link/privkey.pem $HOME/ssl/privkey.pem

We now need to ensure our XRPL server daemon can access these files. When our XRPL node was installed, a user was created name rippled . We must grant this user ownership of these SSL files. Run the command:

sudo chown -R rippled:rippled $HOME/ssl

There shouldn't be any output from the command.

Update rippled.cfg

Before we proceed, you will need to know your home directory path. So far we have been using $HOME but if you are unsure of the absolute path to your SSL folder, run echo $HOME/ssl and copy the output (it’ll look something like /home/ubuntu/ssl where ubuntu is your logged-in user).

We must again edit our rippled.cfg .

Run sudo nano /etc/opt/ripple/rippled.cfg Uncomment the ssl_ lines and enter the path to your SSL certificates that you just copied in the SSL folder. For example:

3. Don’t forget to modify your insecure ports and change them to the secure protocols:

Restart your XRPL node again to utilize the new configuration using:

sudo systemctl restart rippled.service Make sure it’s running (no errors): sudo systemctl status rippled.service

If your XRPL node started with no errors, congratulations, you have configured secure access to your XRPL node for both the RPC and WebSocket.

Test HTTPS RPC

You can test your new secure RPC endpoint by running a slightly modified command as last time (notice https instead of http and instead of using our servers IP we’re using our new domain name):

Test WSS (Websocket Secure)

To ensure your secure WebSockets are working, you can use a free website, websocket.org to ensure we can connect to it.

(1) In ‘Location’ enter wss://<your-domain>:6005 , (2) click connect and finally (3) if successful you’ll see ‘Connected’ in the box to the right.

Conclusion

You now have the freedom to change the rippled.cfg as you please to customize your XRPL node to whichever use-case you may have.

If you are unsure about one of the steps and how it is performed, check out the video tutorial on this guide found at the top of the article.