# Web3Signer Key Setup Guide

## Overview

Web3Signer is configured and running on VMID 107 (192.168.11.111:9000) with ChainID 138. This guide explains how to import and manage signing keys.

## Prerequisites

- Web3Signer service running (✅ Verified)
- Signing keys (private keys or keystore files)
- Access to VMID 107

## Key Storage Options

### Option 1: File-Based Keys

Store keys in Web3Signer's data directory:

```bash
# SSH to Web3Signer VMID
ssh -i ~/.ssh/proxmox_translator root@192.168.11.111

# Web3Signer data directory
cd /opt/web3signer/data

# Create keys directory (if needed)
mkdir -p keys

# Copy your keystore files here
# Format: keystore-<identifier>.json
```

### Option 2: HashiCorp Vault

Configure Web3Signer to use Vault as a key store (advanced).

## Key Formats

Web3Signer supports:
- **Keystore files**: JSON keystore files (Ethereum format)
- **Azure Key Vault**: Azure Key Vault integration
- **HashiCorp Vault**: Vault integration
- **AWS KMS**: AWS Key Management Service

## Importing Keystore Files

1. **Prepare keystore files**:
   ```bash
   # Keystore files should be named: keystore-<identifier>.json
   # Example: keystore-translator-1.json
   ```

2. **Copy to Web3Signer data directory**:
   ```bash
   ssh -i ~/.ssh/proxmox_translator root@192.168.11.111
   cd /opt/web3signer/data
   # Copy your keystore files here
   ```

3. **Restart Web3Signer** (if needed):
   ```bash
   systemctl restart web3signer
   ```

4. **Verify keys are loaded**:
   ```bash
   curl http://192.168.11.111:9000/api/v1/eth2/publicKeys
   # Or for ETH1:
   curl http://192.168.11.111:9000/api/v1/eth1/publicKeys
   ```

## Listing Loaded Keys

```bash
# List ETH1 public keys
curl http://192.168.11.111:9000/api/v1/eth1/publicKeys

# List ETH2 public keys (if using ETH2)
curl http://192.168.11.111:9000/api/v1/eth2/publicKeys
```

## Signing Transactions

The RPC Translator will automatically use Web3Signer for signing when:
- `eth_sendTransaction` is called
- The `from` address matches a key in Web3Signer
- The transaction passes validation

## Security Considerations

1. **Key Storage**: Store keys securely (encrypted at rest if possible)
2. **Access Control**: Restrict access to Web3Signer data directory
3. **Network Security**: Web3Signer should only be accessible from translator services
4. **Backup**: Regularly backup key files (encrypted)
5. **Rotation**: Implement key rotation policies

## Configuration

Current Web3Signer configuration:
- **Host**: 192.168.11.111
- **Port**: 9000
- **ChainID**: 138
- **Data Path**: /opt/web3signer/data

## Troubleshooting

### Keys Not Loading

```bash
# Check Web3Signer logs
journalctl -u web3signer -n 50

# Check data directory permissions
ls -la /opt/web3signer/data
```

### Signing Failures

```bash
# Check Web3Signer status
curl http://192.168.11.111:9000/upcheck

# Check translator logs
ssh -i ~/.ssh/proxmox_translator root@192.168.11.240 "journalctl -u rpc-translator-138.service -n 50"
```

## Next Steps

1. Generate or import signing keys
2. Copy keys to Web3Signer data directory
3. Verify keys are loaded
4. Test transaction signing via translator

## References

- Web3Signer Documentation: https://docs.web3signer.consensys.net/
- Ethereum Keystore Format: https://github.com/ethereum/wiki/wiki/Web3-Secret-Storage-Definition
