Run a SOV Node

Anyone can run a SOV node, join the peer mesh as a fully-equal peer, and earn the
operator payout for keeping the network alive. The hardware bar is deliberately low
— "a person with a small free VPS" qualifies. This guide takes you from nothing to a
converged, earning node, on any of the common hosts.

This is the same operator walkthrough shown in the SOV app's Academy, expanded with
copy-pasteable commands for a technical reader.

Contents

1. Where to run it — pick a host
2. The firewall — the part that actually blocks people
3. Google Cloud — stand up a free node
4. Amazon AWS — stand up a node
5. Oracle Cloud — free-forever node (recommended)
6. Install the node software (the snap)
7. Run a node on Windows — no VPS, no Linux
8. Earning — the operator payout

1. Where to run it — pick a host

Any provider works — a paid droplet, a home server, any box with a public IPv4 and
ports you can open.

🔴 The one hard rule: choose x86_64, not ARM

The node ships an x86_64 Node.js runtime and a native AES SQLite module. It will
not start on an ARM machine. Avoid Oracle Ampere A1 (VM.Standard.A1.Flex)
and AWS Graviton — pick an Intel/AMD (x86_64) shape.

Minimum spec: Ubuntu 20.04+ (22.04 LTS recommended), 1 GB RAM (2 GB comfortable),
10 GB disk, a public IPv4.

2. The firewall — the part that actually blocks people

The single most common reason a node "installs fine but nobody can reach it" is the
firewall. Cloud providers block inbound ports in two separate places, and you must
open both.

• Door 1 — the cloud firewall (in the provider console): a Security List on
  Oracle, a Security Group on AWS, or a VPC firewall rule on Google.
• Door 2 — the machine's own firewall (Ubuntu iptables/ufw on the box).
  Oracle images in particular ship this closed — it's the number-one "the console
  says the port is open but the box still drops it" cause.

Open these inbound, TCP, source 0.0.0.0/0:

Never expose 8080 to the internet — it is the private node dashboard and is meant
to stay on localhost.

Get these ports right and the rest of running a node is easy. The three cloud sections
below show exactly where each provider hides Door 1.

3. Google Cloud — stand up a free node

Create the instance

1. Compute Engine → VM instances → Create. Region us-west1 / us-central1 /
   us-east1, machine type e2-micro (always-free-eligible).
2. Boot disk Ubuntu 22.04 LTS (x86_64). Allow HTTP/HTTPS if asked. Create, and copy
   the External IP.

Open the ports (VPC firewall — Door 1)

3. VPC network → Firewall → Create firewall rule.
4. Direction Ingress · Targets All instances · Source IPv4 ranges 0.0.0.0/0.
5. Protocols and ports → TCP → 443,7771,80,22 → Create.
6. GCP's Ubuntu images don't ship an extra host firewall, so Door 2 is usually already
   open — but verify you can reach port 443 after installing.

⚠️ GCP free instances have been billing-terminated before. Set a Budget alert
(e.g. at \$1) so an accident can't silently run up a bill.

4. Amazon AWS — stand up a node

Launch the instance

1. EC2 → Launch instance. AMI Ubuntu 22.04 LTS (64-bit x86), type t3.micro
   or t2.micro (free-tier eligible).
2. Create/choose a key pair and download the .pem — that's your SSH key. Launch,
   and note the Public IPv4.

Open the ports (Security Group — Door 1)

3. EC2 → Network & Security → Security Groups → select this instance's group →
   Inbound rules → Edit.
4. Add rule → Custom TCP → port 443 → source Anywhere-IPv4 (0.0.0.0/0). Repeat
   for 7771 and 80.
5. Keep the SSH (22) rule but tighten its source to My IP. Save rules.

⏳ AWS free tier is only 12 months — great to learn on, but for a permanent node
prefer Oracle Always Free (no expiry).

5. Oracle Cloud — free-forever node (recommended)

Oracle Cloud Infrastructure "Always Free" is the recommended host: free forever with no
12-month expiry.

Create the instance

1. Compute → Instances → Create. Image Canonical Ubuntu 22.04.
2. Change shape → AMD → VM.Standard.E2.1.Micro (Always-Free-eligible). Do NOT
   pick Ampere A1 — that is ARM and the node won't run on it.
3. Assign a public IPv4 = Yes. Paste your SSH public key. Create, and copy the
   Public IP.

Door 1 — cloud Security List

4. Networking → Virtual Cloud Networks → your VCN → Security Lists → Default → Add
   Ingress Rules.
5. For each of 22, 80, 443, 7771: Source 0.0.0.0/0 · IP Protocol TCP · that
   Destination Port.

Door 2 — the box's own firewall (Oracle images block these by default)

sudo iptables -I INPUT 6 -m state --state NEW -p tcp --dport 443  -j ACCEPT
sudo iptables -I INPUT 6 -m state --state NEW -p tcp --dport 7771 -j ACCEPT
sudo iptables -I INPUT 6 -m state --state NEW -p tcp --dport 80   -j ACCEPT
sudo netfilter-persistent save     # persists across reboot

❗ Skipping Door 2 is the classic Oracle mistake — the console shows the ports "open"
while the box still silently drops them.

6. Install the node software (the snap)

The node software is distributed by the network itself — there is no GitHub repo and
no app store to trust. You download it straight from a running node, and you verify it
yourself.

Download from a live node

curl -O http://<LIVE_NODE_IP>/sov-relay.snap

Verify it before you install it. Nobody signs this for you and no app store vouched for it, so the checking is yours. It takes about thirty seconds.

Step 1 — hash what you downloaded.

sha256sum sov-relay.snap

Step 2 — fetch the same file from two other nodes and hash those too. One node could be compromised, or one network path tampered with. Three independent sources agreeing is what makes that implausible — an attacker would need all three at once.

curl -s -o b.snap http://<SECOND_NODE_IP>/sov-relay.snap
curl -s -o c.snap http://<THIRD_NODE_IP>/sov-relay.snap
sha256sum sov-relay.snap b.snap c.snap   # all three MUST match
rm b.snap c.snap

If even one differs, stop. Do not install it, and tell the community which node served the odd copy.

Install (--dangerous = not from the Snap Store, by design; --devmode =
unconfined sandbox for now)

sudo apt-get update && sudo apt-get install -y snapd
sudo snap install --dangerous --devmode sov-relay.snap

Step 3 — verify what actually landed on disk. This is the step people skip, and it is the one that matters: it proves the software now installed is the software you checked, not something swapped in between download and install.

snap list sov-relay                                  # note the Rev, e.g. x4
sudo sha256sum /var/lib/snapd/snaps/sov-relay_x4.snap

Real output from a live node:

Name       Version  Rev  Tracking  Publisher  Notes
sov-relay  1.3.1    x4   -         -          devmode

4fb089dffd604112b67fb2ad9280624fc07cc80cb79c1e8d12a2e2dd208743b1

That hash must equal the one all three nodes agreed on in step 2. If it does, the node you are about to run is byte-for-byte the software the network is running. Keep the hash — after any future upgrade, repeat this check against what the network is serving then.

Tell the node who you are

One command. It asks for your Sovereign ID, checks it while you are still sitting there, and writes the configuration itself.

sudo snap run sov-relay.setup

This is real output from an operator setting up a node, including the typo, because mistyping the ID is the mistake that actually happens:

SOV Node — operator setup
------------------------------------------------------------

Your Sovereign ID is the wallet the network pays for your proof of service.
Enrol on the SOV phone app, then copy it from Profile.
Form: SOV- followed by 16 hex characters.
Sovereign ID:   That is not a Sovereign ID. Expected SOV- then 16 hex characters,
  for example SOV-1A2B3C4D5E6F7A8B. Copy it exactly from Profile.

Your Sovereign ID is the wallet the network pays for your proof of service.
Sovereign ID:   Looks right.

A new node needs ONE address to find the network; it learns the rest by gossip.
Get one from whoever gave you the software, or from another operator.
Bootstrap address(es), comma-separated (blank to skip):
Saved to /var/snap/sov-relay/current/.env
  operator : SOV-1A2B3C4D5E6F7A8B

Start the node and watch it join:
  sudo snap restart sov-relay
  sudo snap logs -f sov-relay.sov-relay

The mistake is caught while you are typing rather than three restarts later. That is the entire reason this command exists.

About the bootstrap address. You can leave it blank. A node with no address asks the published pool mirrors where the network is, the same way the wallet app does, and carries on from there. Supplying one is simply faster, and is what you do if someone invited you to run a node and handed you theirs.

A brand-new node refuses to start without a Sovereign ID, on purpose. Left empty, the network has no wallet to credit — you would serve citizens for weeks and earn nothing, with nothing on screen to tell you. A mistyped ID is refused too, because an ID nobody owns sends your payouts nowhere. Upgrading a node that already has an identity only warns, so an update can never take your node down over a config field.

What a refusal actually looks like. Two mistakes account for nearly every failed first boot, and the node names both of them rather than exiting quietly. This is real output, not an illustration.

You left the field blank:

[1/9] Verifying software integrity...
      ✓ Source files verified
      ✓ Source root: fd50c4e5ec915012... (42 files)
[2/9] Loading node identity...

  ==============================================================
   CANNOT START — operator Sovereign ID problem
  ==============================================================
      OPERATOR_SOVEREIGN_ID is not set.
      This node would serve citizens but earn nothing, because the network has
      no wallet to credit for your proof of service.
      Enrol on the SOV phone app, copy your Sovereign ID from Profile, set it in
      your .env, then start the node again.

You mistyped it — here, one character short:

[2/9] Loading node identity...

  ==============================================================
   CANNOT START — operator Sovereign ID problem
  ==============================================================
      OPERATOR_SOVEREIGN_ID is "SOV-CA234DCCA7BDEDE", which is not a Sovereign ID.
      Expected SOV- followed by 16 hex characters, e.g. SOV-1A2B3C4D5E6F7A8B.
      Copy it exactly from your wallet: Profile -> your Sovereign ID.

Refusing is deliberate. A node that started anyway would serve citizens perfectly well for weeks while quietly earning nothing, and you would have no way to notice. A wrong ID is worse than a blank one, because the payouts go somewhere real that simply is not you.

And when it is right, step 2 says so plainly:

[2/9] Loading node identity...
      First run — generating node identity...
      Private key stored in encrypted file (AES-256-GCM)
      ✓ Operator: SOV-CA234DCCA7BDEDEB
      ✓ Node ID: 31dbbe855da81c624c37825a50ac0797...
      ✓ Key: encrypted-file

What the rest of the network does with that ID. Your node does not admit itself. When it first meets the mesh it sends a signup, and the peers that receive it check, on their own copies of the ledger, that the Sovereign ID belongs to a real enrolled citizen and that this citizen is not already running more nodes than the rules allow. A node offering no ID at all is refused outright — anonymous nodes are exactly what a Sybil attack is made of.

It is not put to every node on the network, which would get slower the more the network grew. A small random sample of peers is asked, and a majority of that sample has to agree. The cost stays flat as the network grows, and the security improves rather than degrades: an attacker would have to control most of a randomly chosen group, and cannot know in advance which peers will be picked. The check itself is free — every node already holds the enrollment ledger, so "is this a real citizen" is answered locally, never by asking anyone.

Start it and watch it join

sudo snap start sov-relay.sov-relay
sudo snap logs -f sov-relay.sov-relay

A healthy first boot walks through nine steps. This is real output from a live node — yours should look like this:

══════════════════════════════════════════════════════════
   SOV Node  —  Sovereign Citizen Infrastructure
══════════════════════════════════════════════════════════
[1/9] Verifying software integrity...
      ✓ Source files verified
[2/9] Loading node identity...
      Node key loaded from encrypted file
      ✓ Operator: SOV-1A2B3C4D5E6F7A8B
      ✓ Node ID: b201198e699a6a8fd50ad936432f89a7...
      ✓ Key: encrypted-file
[3/9] Opening node database...
      Node database: /var/snap/sov-relay/current/node.db (AES-256 encrypted)
[4/9] Configuring network reachability...
      ✓ Public IP:     <your-ip>:443
      ✓ Reachability:  circuit-relay
[5/9] Loading node discovery pool...
      ✓ Known nodes in pool: 6
      Peer mesh server listening on :7771
[6/9] Starting phone mesh fragment router...
      ✓ Fragment routing ready (K=3 of N=5)
[7/9] Starting SOV transfer engine...
      ✓ Guard 1 (nonce chain)    active
      ✓ Guard 2 (spend lock)     active
      ✓ Guard 3 (version gate)   active
      ✓ Operator engine initialised
[8/9] Opening citizen gateway...
      ✓ Listening for SOV app connections

How to read it. Step 2 is the one to check first: if it says ! No OPERATOR_SOVEREIGN_ID set — this node earns nothing, stop and fix your .env before walking away. At step 4, Reachability: circuit-relay is normal and fine — it means your box sits behind NAT and reaches the mesh through peers instead of directly. Step 5 binding :7771 is what proves the peer mesh came up; if you see EADDRINUSE retries there instead, a second copy of the node is almost certainly already running.

Once it converges and stays continuously up for the qualifying period (about three weeks), your node begins earning the operator payout.

The default ports are SOV_PORT=443 (citizen WebSocket) and SYNC_PORT=7771 (peer
mesh). If you must move the citizen port (e.g. 443 is already taken by nginx), set
SOV_PORT in the .env and open that port in both firewall layers instead.

7. Run a node on Windows — no VPS, no Linux

You don't need a VPS, Linux, or any firewall edits to be an operator — the SOV Windows
app is itself a full node.

Path A — normal home broadband

1. Install the SOV app (SovNode.exe) and sign in / restore your wallet.
2. Open the Node tab → the "Run a Node" card. Leave Reachability = Auto.
3. Toggle Run a Node → ON. It opens your router by UPnP, or relays through the SOV
   mesh if it can't. When it's serving, the card shows "Reachable at: …".

That's the whole setup for most people. Keep the PC on — uptime is what earns.

Path B — mobile hotspot / CGNAT / "can't port-forward"

Use this if Path A can't make you reachable (common on mobile hotspots and CGNAT ISPs).
Tailscale Funnel gives your node a stable public HTTPS address, free forever, over a
purely outbound connection — no port-forward, no domain, no VPS.

1. Make a free Tailscale account at login.tailscale.com/start and install Tailscale for
   Windows; log in once. (Tailscale uses SSO — there is no in-app password by design.)
2. In the SOV app: Node tab → set Reachability = Tailscale Funnel → toggle ON.
3. The first time only, tap "Enable Tailscale Funnel" and click Approve in the
   browser. The app then serves at wss://<your-pc>.<tailnet>.ts.net.

Behind CGNAT the peer-mesh port (7771) is outbound-only — that's normal; citizens still
reach you inbound on 443 via Funnel.

8. Earning — the operator payout

Running a node earns SOV for the real work of keeping the network running: witnessing
transactions and staying online.

• A node must be continuously up for a qualifying period (a governance-set default of
  about three weeks) before it earns — sleeping or shutting the machine down breaks the
  streak, so payouts reward genuine uptime, not machines that are mostly off.
• Payment is a fixed reward per relay per 30-day period (governance-set), with a
  steep anti-monopoly curve: your first relay earns the full reward, a second and third
  earn a small fraction, and a fourth or beyond earns nothing — so running a farm of
  nodes gives you no advantage, and the network stays spread across many independent
  operators.
• Operators are paid from the fees that flow in first, and only then, capped, from
  the genesis reserve — so as the network grows and fee revenue rises, it funds its own
  operators and the reserve becomes a long-term runway rather than a pot that drains.

You can watch every fee flow into the pool and every payout leave it on the app's live
SOV Economy screen — the ledger is public.

This guide is part of the SOV Network Academy. For what SOV is and how to use it, see
the Knowledge Bank.