gridlabs-science · keegreil · Sep 13, 2026 · Sep 13, 2026
diff --git a/boot.tests/NodeSetupTests.cs b/boot.tests/NodeSetupTests.cs
@@ -101,7 +101,7 @@ public void SetupModeAllowsOnlySetupAndHealthPaths()
     {
         Assert.IsTrue(NodeSetupPolicy.IsAllowedSetupPath("/setup"));
         Assert.IsTrue(NodeSetupPolicy.IsAllowedSetupPath("/setup.css"));
-        Assert.IsTrue(NodeSetupPolicy.IsAllowedSetupPath("/setup.js"));
+        Assert.IsFalse(NodeSetupPolicy.IsAllowedSetupPath("/setup.js"));
         Assert.IsTrue(NodeSetupPolicy.IsAllowedSetupPath("/health/live"));
         Assert.IsTrue(NodeSetupPolicy.IsAllowedSetupPath("/health/ready"));
         Assert.IsFalse(NodeSetupPolicy.IsAllowedSetupPath("/api/mining/share"));

diff --git a/boot.tests/SecurityHardeningTests.cs b/boot.tests/SecurityHardeningTests.cs
@@ -69,6 +69,27 @@ public void PrivateDashboardEnvironmentOverrideSupportsPackageUpgrades()
         }
     }
 
+    [TestMethod]
+    public void NativeSv2AuthorityEnvironmentOverrideSupportsPackageUpgrades()
+    {
+        const string variable = "GRIDPOOL_NATIVE_SV2_AUTHORITY_PUBLIC_KEY";
+        const string publicKey = "9exampleAuthorityPublicKey";
+        string? previous = Environment.GetEnvironmentVariable(variable);
+        try
+        {
+            var config = ValidConfig();
+            Environment.SetEnvironmentVariable(variable, $"  {publicKey}  ");
+
+            Program.ApplyPoolConfigEnvironmentOverrides(config);
+
+            Assert.AreEqual(publicKey, config.NativeSv2AuthorityPublicKey);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable(variable, previous);
+        }
+    }
+
     [TestMethod]
     public void StoredMinerLabelIsBoundedAndMarkupFree()
     {

diff --git a/boot_portal/Models/DashboardModels.cs b/boot_portal/Models/DashboardModels.cs
@@ -40,6 +40,7 @@ public sealed class DashboardNativeSv2Dto
     public bool Enabled { get; set; }
     public string PublicHost { get; set; } = string.Empty;
     public int PublicPort { get; set; } = 34265;
+    public string AuthorityPublicKey { get; set; } = string.Empty;
     public string Scheme { get; set; } = "stratum2+noise";
     public string UsernameGuidance { get; set; } =
         "Use a Bitcoin payout address for per-miner slot-0 attribution, or a worker label to use the node payout address.";

diff --git a/boot_portal/Models/PoolConfig.cs b/boot_portal/Models/PoolConfig.cs
@@ -328,6 +328,9 @@ public class PoolConfig
     [JsonPropertyName("native_sv2_public_port")]
     public int NativeSv2PublicPort { get; set; } = 34265;
 
+    [JsonPropertyName("native_sv2_authority_public_key")]
+    public string NativeSv2AuthorityPublicKey { get; set; } = string.Empty;
+
     [JsonPropertyName("admin_rate_limit_per_minute")]
     public int AdminRateLimitPerMinute { get; set; } = 12;
 

diff --git a/boot_portal/Pages/Setup.cshtml b/boot_portal/Pages/Setup.cshtml
@@ -46,19 +46,22 @@
                         <dl>
                             <div><dt>Host</dt><dd>@Model.NativeSv2Host</dd></div>
                             <div><dt>Port</dt><dd>@Model.NativeSv2Port</dd></div>
+                            <div><dt>Authority key</dt><dd><code>@Model.NativeSv2AuthorityPublicKey</code></dd></div>
                             <div><dt>Username</dt><dd>Your payout address or worker label</dd></div>
                         </dl>
+                        <p>AxeOS users must paste the authority key into <strong>SV2 Authority Pubkey</strong> under the pool's advanced options.</p>
                         <p>If <code>@Model.NativeSv2Host</code> does not resolve from your miner, use this Umbrel device's LAN IP with port @Model.NativeSv2Port.</p>
                     </section>
                 }
                 @if (Model.AutomaticRestart)
                 {
-                    <p class="safety-note" id="restart-status">Waiting for the node to become ready. This page will open the dashboard automatically.</p>
+                    <p class="safety-note">GridPool is restarting. Wait a few seconds, then open the dashboard.</p>
                 }
                 else
                 {
                     <p class="safety-note">GridPool will remain in setup-only mode until it restarts. No mining work or peer relay is active yet.</p>
                 }
+                <a class="dashboard-button" href="/">Open GridPool dashboard</a>
             }
             else
             {
@@ -77,9 +80,5 @@
             }
         </section>
     </main>
-    @if (Model.AutomaticRestart)
-    {
-        <script src="/setup.js" defer></script>
-    }
 </body>
 </html>
diff --git a/boot_portal/Pages/Setup.cshtml.cs b/boot_portal/Pages/Setup.cshtml.cs
@@ -53,6 +53,8 @@ public string NativeSv2Host
 
     public int NativeSv2Port => _poolConfig.NativeSv2PublicPort;
 
+    public string NativeSv2AuthorityPublicKey => _poolConfig.NativeSv2AuthorityPublicKey;
+
     public string NativeSv2Url => $"stratum2+noise://{NativeSv2Host}:{NativeSv2Port}";
 
     public IActionResult OnGet()

diff --git a/boot_portal/Program.cs b/boot_portal/Program.cs
@@ -795,6 +795,13 @@
         {
             config.TrustedPrivateDashboardEnabled = enabled;
         }
+
+        string? nativeSv2AuthorityPublicKey =
+            Environment.GetEnvironmentVariable("GRIDPOOL_NATIVE_SV2_AUTHORITY_PUBLIC_KEY");
+        if (!string.IsNullOrWhiteSpace(nativeSv2AuthorityPublicKey))
+        {
+            config.NativeSv2AuthorityPublicKey = nativeSv2AuthorityPublicKey.Trim();
+        }
     }
 
     private static RateLimitPartition<string> CreateRateLimitPartition(HttpContext context, PoolConfig poolConfig, string policyName, int permitLimit)
@@ -1856,7 +1863,7 @@
            // Truncate input to actual length
            var cipherText = encryptedBody.AsSpan(0, bytesRead).ToArray();
            byte[] combinedCiphertext = new byte[bytesRead + LibSodium.CryptoBox.NonceLen];
            Array.Copy(_sessionNonceReceiver, 0, combinedCiphertext, 0, LibSodium.CryptoBox.NonceLen);
            Array.Copy(encryptedBody, 0, combinedCiphertext, LibSodium.CryptoBox.NonceLen, bytesRead);



diff --git a/boot_portal/Services/DashboardReadModelService.cs b/boot_portal/Services/DashboardReadModelService.cs
@@ -115,7 +115,8 @@ public DashboardSummaryDto BuildSummary(string? windowKey)
                 {
                     Enabled = _poolConfig.NativeSv2Enabled,
                     PublicHost = _poolConfig.NativeSv2PublicHost,
-                    PublicPort = _poolConfig.NativeSv2PublicPort
+                    PublicPort = _poolConfig.NativeSv2PublicPort,
+                    AuthorityPublicKey = _poolConfig.NativeSv2AuthorityPublicKey
                 }
             },
             Capabilities = new DashboardCapabilitiesDto

diff --git a/boot_portal/Utils/NodeSetupPolicy.cs b/boot_portal/Utils/NodeSetupPolicy.cs
@@ -6,7 +6,6 @@ public static bool IsAllowedSetupPath(PathString path)
     {
         return path.StartsWithSegments("/setup", StringComparison.OrdinalIgnoreCase) ||
                path.Equals("/setup.css", StringComparison.OrdinalIgnoreCase) ||
-               path.Equals("/setup.js", StringComparison.OrdinalIgnoreCase) ||
                path.Equals("/health/live", StringComparison.OrdinalIgnoreCase) ||
                path.Equals("/health/ready", StringComparison.OrdinalIgnoreCase);
     }

diff --git a/boot_portal/boot_portal_config.json b/boot_portal/boot_portal_config.json
@@ -60,6 +60,7 @@
   "native_sv2_enabled": false,
   "native_sv2_public_host": "",
   "native_sv2_public_port": 34265,
+  "native_sv2_authority_public_key": "",
   "stratum_v1_proxy_host": "",
   "stratum_v1_proxy_port": 0,
   "grid_labs_support_fee_enabled": true,

diff --git a/boot_portal/ui/AGENTS.md b/boot_portal/ui/AGENTS.md
@@ -66,7 +66,8 @@ stay in React memory only and must not enter URLs, browser storage, logs, or
 exports.
 
 Miner-facing endpoints are explicit non-secret summary data. Packaged nodes set
-`native_sv2_enabled`, `native_sv2_public_host`, and `native_sv2_public_port`;
+`native_sv2_enabled`, `native_sv2_public_host`, `native_sv2_public_port`, and
+`native_sv2_authority_public_key`;
 when the host is blank the dashboard suggests the browser hostname and explains
 that a reachable LAN hostname or IP may be substituted. Appliance wrappers may
 explicitly set `trusted_private_dashboard_enabled` when their authenticated

diff --git a/boot_portal/ui/src/components/MinerConnection.test.tsx b/boot_portal/ui/src/components/MinerConnection.test.tsx
@@ -8,6 +8,7 @@ describe("MinerConnectionPanel", () => {
     render(<MinerConnectionPanel summary={summaryFixture} />);
 
     expect(screen.getByText("stratum2+noise://node.gridpool.test:34265")).toBeInTheDocument();
+    expect(screen.getByText("9exampleAuthorityPublicKey")).toBeInTheDocument();
     expect(screen.getByText("Your payout address, or a worker label")).toBeInTheDocument();
   });
 

diff --git a/boot_portal/ui/src/components/MinerConnection.tsx b/boot_portal/ui/src/components/MinerConnection.tsx
@@ -5,6 +5,7 @@ const unavailableSv2 = {
   enabled: false,
   publicHost: "",
   publicPort: 34265,
+  authorityPublicKey: "",
   scheme: "stratum2+noise",
   usernameGuidance: "Use a Bitcoin payout address or worker label."
 };
@@ -49,10 +50,14 @@ export function MinerConnectionPanel({ summary }: { summary: DashboardSummary })
       <dl className="connection-fields">
         <div><dt>Host</dt><dd>{connectionHost(sv2.publicHost)}</dd></div>
         <div><dt>Port</dt><dd>{sv2.publicPort}</dd></div>
+        <div><dt>Authority key</dt><dd><code>{sv2.authorityPublicKey || "Not advertised"}</code></dd></div>
         <div><dt>Protocol</dt><dd>Native Stratum V2 with Noise</dd></div>
         <div><dt>Username</dt><dd>Your payout address, or a worker label</dd></div>
       </dl>
       <p className="explain">{sv2.usernameGuidance}</p>
+      <p className="explain">
+        AxeOS users must paste the authority key into <strong>SV2 Authority Pubkey</strong> under the pool&apos;s advanced options.
+      </p>
       <p className="explain">
         The miner must be on a network that can reach this node. If the suggested
         hostname does not resolve from the miner, use the Umbrel device&apos;s LAN IP.

diff --git a/boot_portal/ui/src/test/fixture.ts b/boot_portal/ui/src/test/fixture.ts
@@ -89,6 +89,7 @@ export const summaryFixture: DashboardSummary = {
       enabled: true,
       publicHost: "node.gridpool.test",
       publicPort: 34265,
+      authorityPublicKey: "9exampleAuthorityPublicKey",
       scheme: "stratum2+noise",
       usernameGuidance: "Use a payout address or worker label."
     }

diff --git a/boot_portal/ui/src/types.ts b/boot_portal/ui/src/types.ts
@@ -71,6 +71,7 @@ export interface DashboardSummary {
       enabled: boolean;
       publicHost: string;
       publicPort: number;
+      authorityPublicKey: string;
       scheme: string;
       usernameGuidance: string;
     };

diff --git a/boot_portal/wwwroot/setup.css b/boot_portal/wwwroot/setup.css
@@ -166,6 +166,21 @@ button {
 
 button:hover { transform: translateY(-1px); }
 
+.dashboard-button {
+    display: block;
+    margin-top: 1rem;
+    border: 1px solid var(--line-strong);
+    border-radius: 3px;
+    padding: 0.9rem 1.1rem;
+    background: var(--text);
+    color: var(--bg);
+    font-weight: 650;
+    text-align: center;
+    text-decoration: none;
+}
+
+.dashboard-button:hover { transform: translateY(-1px); }
+
 .field-validation,
 .validation-summary { display: block; margin-top: 0.6rem; color: var(--bad); }
 

diff --git a/boot_portal/wwwroot/setup.js b/boot_portal/wwwroot/setup.js