Running a sequencer (validator) on the Aztec testnet involves more than just launching a container; you must install Docker, generate a proper keystore, configure your environment, and register your node on L1.  Below is a step‑by‑step narrative that captures the entire process, including installing Docker and Docker Compose, and introduces how to incorporate a dRPC RPC endpoint for your Ethereum RPC needs.

Before you can run any Aztec node, you need Docker and Docker Compose installed.  On a fresh Linux server, you can install them with these commands (run as root or with sudo):

# Update and upgrade your system
apt-get update && apt-get upgrade -y

# Install prerequisites
apt-get install -y ca-certificates curl lsb-release gnupg

# Remove any old Docker packages
for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do \
  apt-get remove --purge -y "$pkg" || true; \
done
apt-get autoremove -y

# Add Docker’s official GPG key
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
chmod a+r /etc/apt/keyrings/docker.gpg

# Add the Docker repository
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \
  > /etc/apt/sources.list.d/docker.list

# Install Docker Engine and Docker Compose plugin
apt-get update
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Enable and start the Docker service
systemctl enable docker
systemctl start docker

# Verify installation
docker --version
docker compose version

This sequence updates your system, removes old Docker packages, adds Docker’s official repository, installs the latest Docker and Docker Compose, and verifies that both are available.  Once installed, you’re ready to set up the Aztec keystore and node.

Before generating a keystore, you must install the Aztec CLI.  Aztec provides an installation script that downloads the binaries and sets up the CLI in ~/.aztec/bin.  Run the following command on your server:

bash -i <(curl -s https://install.aztec.network)

The script may prompt you to add ~/.aztec/bin to your PATH.  If it does, or if you find that aztec is not found after installation, update your shell profile manually.  For example, add this line to your ~/.bashrc or ~/.bash_profile:

echo 'export PATH="$HOME/.aztec/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc

After installation, verify that the CLI works:

aztec --version

You should see the CLI version number printed.  With the CLI installed and on your PATH, you can proceed to generate your keystore.

Aztec sequencers require both an Ethereum signing key and a BLS key for attestation.  These are bundled together in a keystore.  Use the Aztec CLI to generate it.  Because the protocol doesn’t yet use fee recipients, you can pass the 32‑byte zero address for the --fee‑recipient flag (the CLI rejects 20‑byte addresses).  The command writes a JSON keystore file to ~/.aztec/keystore and prints the attester’s Ethereum address and BLS key

aztec validator-keys new \
  --fee-recipient 0x0000000000000000000000000000000000000000000000000000000000000000

The resulting key1.json file contains objects such as attester.eth and attester.bls.  These are your validator’s Ethereum address and BLS private key.  It also includes an optional coinbase field (the L1 address where rewards are sent) and a feeRecipient field for L2 fees (currently unused) 

Aztec’s v2.1.x releases replace the older ETHEREUM_RPC_URL and CONSENSUS_BEACON_URL with new variables that accept comma‑separated lists of endpoints.  A minimal .env file should specify the data and key directories, the L1 execution and consensus hosts, and network ports 

# Core paths and logging
DATA_DIRECTORY=/root/.aztec/data
KEY_STORE_DIRECTORY=/root/.aztec/keystore
LOG_LEVEL=info

# L1 RPC endpoints — replace these with your own URLs
ETHEREUM_HOSTS=<YOUR_ETHEREUM_RPC_ENDPOINT>
L1_CONSENSUS_HOST_URLS=<YOUR_BEACON_CONSENSUS_RPC>

# P2P and API configuration — fill in your own IP address and change ports if necessary
P2P_IP=<YOUR_PUBLIC_IP>
P2P_PORT=40400
AZTEC_PORT=8080
AZTEC_ADMIN_PORT=8880

If you include a COINBASE variable, Aztec will pay L1 rewards there; if omitted, the rewards default to your attester’s address .  The keystore file is mounted into the container via KEY_STORE_DIRECTORY, so the node can read the private keys.

To run your sequencer, you need a compose file that uses the latest stable Aztec image and references the environment variables defined in your .env.  Below is an example docker-compose.yml that works with the v2.1.5 release and uses the new KEY_STORE_DIRECTORY and DATA_DIRECTORY variables .  You can place this file alongside your .env:

version: "3.8"

services:
  aztec-sequencer:
    container_name: aztec-sequencer
    image: aztecprotocol/aztec:2.1.5
    restart: unless-stopped
    network_mode: host
    environment:
      KEY_STORE_DIRECTORY: ${KEY_STORE_DIRECTORY}
      DATA_DIRECTORY: ${DATA_DIRECTORY}
      LOG_LEVEL: ${LOG_LEVEL}
      ETHEREUM_HOSTS: ${ETHEREUM_HOSTS}
      L1_CONSENSUS_HOST_URLS: ${L1_CONSENSUS_HOST_URLS}
      P2P_IP: ${P2P_IP}
      P2P_PORT: ${P2P_PORT}
      AZTEC_PORT: ${AZTEC_PORT}
      AZTEC_ADMIN_PORT: ${AZTEC_ADMIN_PORT}
    entrypoint: >-
      node --no-warnings /usr/src/yarn-project/aztec/dest/bin/index.js start --network testnet --node --archiver --sequencer
    ports:
      - "${P2P_PORT}:${P2P_PORT}/tcp"
      - "${P2P_PORT}:${P2P_PORT}/udp"
      - "${AZTEC_PORT}:${AZTEC_PORT}"
    volumes:
      - ${DATA_DIRECTORY}:/var/lib/data
      - ${KEY_STORE_DIRECTORY}:/var/lib/keystore

Once this file is saved, run the following commands to download the new image and start the node:

docker compose pull     # fetch the v2.1.5 image from Docker Hub [oai_citation:5‡docs.aztec.network](https://docs.aztec.network/the_aztec_network/operation/operator_faq#:~:text=)
docker compose down     # stop any existing container to apply configuration changes
docker compose up -d    # recreate and start the sequencer in the background

These commands ensure you always run the updated image rather than reusing a cached version.  If you have already pulled the image, you can omit docker compose pull, but it’s good practice to include it when upgrading.

Once your node is running and has caught up with the L2 chain, you must register it as a validator.  Use a funding account (an Ethereum wallet with Sepolia ETH) to pay for the transaction; do not use your validator’s private key .  The command requires your L1 RPC endpoint, network name (testnet for Sepolia), the funding key, your attester’s Ethereum address, a withdrawer address (often the same as the attester), your BLS private key and the rollup contract address .  For the Sepolia testnet the rollup contract is 0xebd99ff0ff6677205509ae73f93d0ca52ac85d67 

aztec add-l1-validator \
  --l1-rpc-urls <YOUR_L1_RPC_URL> \
  --network testnet \
  --private-key <FUNDING_PRIVATE_KEY> \
  --attester <YOUR_ATTESTER_ETH_ADDRESS> \
  --withdrawer <YOUR_WITHDRAWER_ETH_ADDRESS> \
  --bls-secret-key <YOUR_BLS_PRIVATE_KEY> \
  --rollup 0xebd99ff0ff6677205509ae73f93d0ca52ac85d67

After submitting the transaction, monitor it on a Sepolia block explorer.  Once confirmed, your node becomes an official validator and can propose/attest blocks 

Instead of relying on public RPC endpoints, you can provision your own endpoint through dRPC.  dRPC’s documentation explains that you first need to create an account or log in using a wallet, email or Google .  Once authenticated, you create a new dRPC key.  dRPC keys separate different applications, allow you to set daily request limits and provide usage statistics .  Each key has its own set of endpoints; an endpoint consists of the base dRPC URL, the selected network and your key value .

To configure your Aztec node to use a dRPC endpoint, take the following steps:

1. Create the key: In the dRPC dashboard (after logging in), choose Create key, specify a name and desired rate limit, and save.  dRPC will display a list of base URLs for different networks; copy the one for sepolia.

2. Replace your RPC URLs: In your .env, update ETHEREUM_HOSTS with the dRPC Sepolia URL followed by your key value.  If dRPC provides a separate consensus endpoint, also update L1_CONSENSUS_HOST_URLS.  This routes all L1 calls through dRPC’s infrastructure.

3. Restart the node: Run docker compose down and docker compose up -d to apply the new endpoints.  Your node will now use the dRPC backend for Ethereum calls.

   If you don’t yet have a dRPC account, sign up and obtain a key via https://drpc.org?ref=5ee4ac.  The referral link above takes you directly to dRPC’s signup page, where you can generate keys for multiple networks and monitor their usage.  Once you’ve created a key, follow the steps above to integrate it into your Aztec configuration.

By using a dedicated dRPC endpoint, you gain more stable throughput and better monitoring of your request usage compared with public RPC services.  Because the endpoint includes your private key token, make sure you keep the URL secret and rotate it if you suspect compromise.

When configuring your sequencer, ensure that every address and RPC endpoint corresponds to the Sepolia network.  Your funding account, attester address and withdrawer address must all be Sepolia wallets; using a mainnet address or RPC will result in failed transactions or incorrect behaviour.  In particular:

• L1 RPC URLs: ETHEREUM_HOSTS and L1_CONSENSUS_HOST_URLS should point to Sepolia endpoints (for example, dRPC’s Sepolia RPC or another reliable provider).  Do not point them at mainnet or Görli RPCs.

• Funding account: The --private-key flag in the registration step must be a Sepolia account funded with Sepolia ETH .

• Attester/withdrawer: These addresses come from your keystore’s attester.eth field; they are also Sepolia accounts.  Never re‑use mainnet addresses here.

If you need Sepolia ETH, you can mine it using the official PoW faucet.  Visit the mining page (for example, Sepolia PoW Faucet) and follow the instructions to start mining.  The page displays your mining reward, hashrate, minimum and maximum claim values, remaining session time and other statistics.  Once you accumulate enough shares, click Stop Mining & Claim Rewards to send Sepolia ETH to your specified address.  This faucet is the recommended method to obtain Sepolia ETH for validator registration and staking.

Running a sequencer (validator) on the Aztec testnet involves more than just launching a container; you must install Docker, generate a proper keystore, configure your environment, and register your node on L1.  Below is a step‑by‑step narrative that captures the entire process, including installing Docker and Docker Compose, and introduces how to incorporate a dRPC RPC endpoint for your Ethereum RPC needs.

Before you can run any Aztec node, you need Docker and Docker Compose installed.  On a fresh Linux server, you can install them with these commands (run as root or with sudo):

# Update and upgrade your system
apt-get update && apt-get upgrade -y

# Install prerequisites
apt-get install -y ca-certificates curl lsb-release gnupg

# Remove any old Docker packages
for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do \
  apt-get remove --purge -y "$pkg" || true; \
done
apt-get autoremove -y

# Add Docker’s official GPG key
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
chmod a+r /etc/apt/keyrings/docker.gpg

# Add the Docker repository
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \
  > /etc/apt/sources.list.d/docker.list

# Install Docker Engine and Docker Compose plugin
apt-get update
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Enable and start the Docker service
systemctl enable docker
systemctl start docker

# Verify installation
docker --version
docker compose version

This sequence updates your system, removes old Docker packages, adds Docker’s official repository, installs the latest Docker and Docker Compose, and verifies that both are available.  Once installed, you’re ready to set up the Aztec keystore and node.

Before generating a keystore, you must install the Aztec CLI.  Aztec provides an installation script that downloads the binaries and sets up the CLI in ~/.aztec/bin.  Run the following command on your server:

bash -i <(curl -s https://install.aztec.network)

The script may prompt you to add ~/.aztec/bin to your PATH.  If it does, or if you find that aztec is not found after installation, update your shell profile manually.  For example, add this line to your ~/.bashrc or ~/.bash_profile:

echo 'export PATH="$HOME/.aztec/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc

After installation, verify that the CLI works:

aztec --version

You should see the CLI version number printed.  With the CLI installed and on your PATH, you can proceed to generate your keystore.

Aztec sequencers require both an Ethereum signing key and a BLS key for attestation.  These are bundled together in a keystore.  Use the Aztec CLI to generate it.  Because the protocol doesn’t yet use fee recipients, you can pass the 32‑byte zero address for the --fee‑recipient flag (the CLI rejects 20‑byte addresses).  The command writes a JSON keystore file to ~/.aztec/keystore and prints the attester’s Ethereum address and BLS key

aztec validator-keys new \
  --fee-recipient 0x0000000000000000000000000000000000000000000000000000000000000000

The resulting key1.json file contains objects such as attester.eth and attester.bls.  These are your validator’s Ethereum address and BLS private key.  It also includes an optional coinbase field (the L1 address where rewards are sent) and a feeRecipient field for L2 fees (currently unused) 

Aztec’s v2.1.x releases replace the older ETHEREUM_RPC_URL and CONSENSUS_BEACON_URL with new variables that accept comma‑separated lists of endpoints.  A minimal .env file should specify the data and key directories, the L1 execution and consensus hosts, and network ports 

# Core paths and logging
DATA_DIRECTORY=/root/.aztec/data
KEY_STORE_DIRECTORY=/root/.aztec/keystore
LOG_LEVEL=info

# L1 RPC endpoints — replace these with your own URLs
ETHEREUM_HOSTS=<YOUR_ETHEREUM_RPC_ENDPOINT>
L1_CONSENSUS_HOST_URLS=<YOUR_BEACON_CONSENSUS_RPC>

# P2P and API configuration — fill in your own IP address and change ports if necessary
P2P_IP=<YOUR_PUBLIC_IP>
P2P_PORT=40400
AZTEC_PORT=8080
AZTEC_ADMIN_PORT=8880

If you include a COINBASE variable, Aztec will pay L1 rewards there; if omitted, the rewards default to your attester’s address .  The keystore file is mounted into the container via KEY_STORE_DIRECTORY, so the node can read the private keys.

To run your sequencer, you need a compose file that uses the latest stable Aztec image and references the environment variables defined in your .env.  Below is an example docker-compose.yml that works with the v2.1.5 release and uses the new KEY_STORE_DIRECTORY and DATA_DIRECTORY variables .  You can place this file alongside your .env:

version: "3.8"

services:
  aztec-sequencer:
    container_name: aztec-sequencer
    image: aztecprotocol/aztec:2.1.5
    restart: unless-stopped
    network_mode: host
    environment:
      KEY_STORE_DIRECTORY: ${KEY_STORE_DIRECTORY}
      DATA_DIRECTORY: ${DATA_DIRECTORY}
      LOG_LEVEL: ${LOG_LEVEL}
      ETHEREUM_HOSTS: ${ETHEREUM_HOSTS}
      L1_CONSENSUS_HOST_URLS: ${L1_CONSENSUS_HOST_URLS}
      P2P_IP: ${P2P_IP}
      P2P_PORT: ${P2P_PORT}
      AZTEC_PORT: ${AZTEC_PORT}
      AZTEC_ADMIN_PORT: ${AZTEC_ADMIN_PORT}
    entrypoint: >-
      node --no-warnings /usr/src/yarn-project/aztec/dest/bin/index.js start --network testnet --node --archiver --sequencer
    ports:
      - "${P2P_PORT}:${P2P_PORT}/tcp"
      - "${P2P_PORT}:${P2P_PORT}/udp"
      - "${AZTEC_PORT}:${AZTEC_PORT}"
    volumes:
      - ${DATA_DIRECTORY}:/var/lib/data
      - ${KEY_STORE_DIRECTORY}:/var/lib/keystore

Once this file is saved, run the following commands to download the new image and start the node:

docker compose pull     # fetch the v2.1.5 image from Docker Hub [oai_citation:5‡docs.aztec.network](https://docs.aztec.network/the_aztec_network/operation/operator_faq#:~:text=)
docker compose down     # stop any existing container to apply configuration changes
docker compose up -d    # recreate and start the sequencer in the background

These commands ensure you always run the updated image rather than reusing a cached version.  If you have already pulled the image, you can omit docker compose pull, but it’s good practice to include it when upgrading.

Once your node is running and has caught up with the L2 chain, you must register it as a validator.  Use a funding account (an Ethereum wallet with Sepolia ETH) to pay for the transaction; do not use your validator’s private key .  The command requires your L1 RPC endpoint, network name (testnet for Sepolia), the funding key, your attester’s Ethereum address, a withdrawer address (often the same as the attester), your BLS private key and the rollup contract address .  For the Sepolia testnet the rollup contract is 0xebd99ff0ff6677205509ae73f93d0ca52ac85d67 

aztec add-l1-validator \
  --l1-rpc-urls <YOUR_L1_RPC_URL> \
  --network testnet \
  --private-key <FUNDING_PRIVATE_KEY> \
  --attester <YOUR_ATTESTER_ETH_ADDRESS> \
  --withdrawer <YOUR_WITHDRAWER_ETH_ADDRESS> \
  --bls-secret-key <YOUR_BLS_PRIVATE_KEY> \
  --rollup 0xebd99ff0ff6677205509ae73f93d0ca52ac85d67

After submitting the transaction, monitor it on a Sepolia block explorer.  Once confirmed, your node becomes an official validator and can propose/attest blocks 

Instead of relying on public RPC endpoints, you can provision your own endpoint through dRPC.  dRPC’s documentation explains that you first need to create an account or log in using a wallet, email or Google .  Once authenticated, you create a new dRPC key.  dRPC keys separate different applications, allow you to set daily request limits and provide usage statistics .  Each key has its own set of endpoints; an endpoint consists of the base dRPC URL, the selected network and your key value .

To configure your Aztec node to use a dRPC endpoint, take the following steps:

1. Create the key: In the dRPC dashboard (after logging in), choose Create key, specify a name and desired rate limit, and save.  dRPC will display a list of base URLs for different networks; copy the one for sepolia.

2. Replace your RPC URLs: In your .env, update ETHEREUM_HOSTS with the dRPC Sepolia URL followed by your key value.  If dRPC provides a separate consensus endpoint, also update L1_CONSENSUS_HOST_URLS.  This routes all L1 calls through dRPC’s infrastructure.

3. Restart the node: Run docker compose down and docker compose up -d to apply the new endpoints.  Your node will now use the dRPC backend for Ethereum calls.

   If you don’t yet have a dRPC account, sign up and obtain a key via https://drpc.org?ref=5ee4ac.  The referral link above takes you directly to dRPC’s signup page, where you can generate keys for multiple networks and monitor their usage.  Once you’ve created a key, follow the steps above to integrate it into your Aztec configuration.

By using a dedicated dRPC endpoint, you gain more stable throughput and better monitoring of your request usage compared with public RPC services.  Because the endpoint includes your private key token, make sure you keep the URL secret and rotate it if you suspect compromise.

When configuring your sequencer, ensure that every address and RPC endpoint corresponds to the Sepolia network.  Your funding account, attester address and withdrawer address must all be Sepolia wallets; using a mainnet address or RPC will result in failed transactions or incorrect behaviour.  In particular:

• L1 RPC URLs: ETHEREUM_HOSTS and L1_CONSENSUS_HOST_URLS should point to Sepolia endpoints (for example, dRPC’s Sepolia RPC or another reliable provider).  Do not point them at mainnet or Görli RPCs.

• Funding account: The --private-key flag in the registration step must be a Sepolia account funded with Sepolia ETH .

• Attester/withdrawer: These addresses come from your keystore’s attester.eth field; they are also Sepolia accounts.  Never re‑use mainnet addresses here.

If you need Sepolia ETH, you can mine it using the official PoW faucet.  Visit the mining page (for example, Sepolia PoW Faucet) and follow the instructions to start mining.  The page displays your mining reward, hashrate, minimum and maximum claim values, remaining session time and other statistics.  Once you accumulate enough shares, click Stop Mining & Claim Rewards to send Sepolia ETH to your specified address.  This faucet is the recommended method to obtain Sepolia ETH for validator registration and staking.