As part of the faucet migration to using a network account (0xMiden/faucet#261), for testnet and devnet at least, the genesis configuration needs to support creating the native faucet as a network account instead of a regular public account using AuthSingleSig.
Today, GenesisConfig builds the native faucet with AuthSingleSig and writes its secret key to a file for the faucet service to import.
Under the new model, the faucet account is executed by the ntx builder, while the faucet service only needs the network faucet account ID and the funded operator wallet. The config should now contain the native faucet with a AuthNetworkAccount component (via something like NetworkAccount::builder), with the mint-request note script included in its allowlist. We might want some other config-related notes to be allowed as well.
Also, the genesis should no longer emit a secret key for the network faucet. Instead, an operator wallet should be prefunded using the existing [[wallet]] mechanism, and the faucet service should import that wallet and use its credentials to sign transactions that create the network notes.
The main open questions for me are:
- Do we want other components set for the token faucet?
- Do we want to allow config-related notes in the network faucet as well? And does the operator have permissions over all of it?
- Is the operator a normal single sig account? Do we want to add a script allowlist to it for safety?
- Will the setup diverge a lot for mainnet vs the testnet/devnet one?
As part of the faucet migration to using a network account (0xMiden/faucet#261), for testnet and devnet at least, the genesis configuration needs to support creating the native faucet as a network account instead of a regular public account using
AuthSingleSig.Today,
GenesisConfigbuilds the native faucet withAuthSingleSigand writes its secret key to a file for the faucet service to import.Under the new model, the faucet account is executed by the ntx builder, while the faucet service only needs the network faucet account ID and the funded operator wallet. The config should now contain the native faucet with a
AuthNetworkAccountcomponent (via something likeNetworkAccount::builder), with the mint-request note script included in its allowlist. We might want some other config-related notes to be allowed as well.Also, the genesis should no longer emit a secret key for the network faucet. Instead, an operator wallet should be prefunded using the existing
[[wallet]]mechanism, and the faucet service should import that wallet and use its credentials to sign transactions that create the network notes.The main open questions for me are: