> For the complete documentation index, see [llms.txt](https://docs.on.nexus/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.on.nexus/dotswap/developers/nexus-protocol/deployment-guide/node-deployment.md).

# Node Deployment

### Deployment Methods Overview

This guide provides three deployment methods. If you are not sure which one to pick, start with **Method 1: One-Command Deployment**.

| Method                                                     | Best for                                                    | Trade-off                                                 |
| ---------------------------------------------------------- | ----------------------------------------------------------- | --------------------------------------------------------- |
| **Method 1: One-Command Deployment (Recommended)**         | First-time deployment and fastest bootstrap                 | Less manual control                                       |
| **Method 2: Advanced Quick Deployment (Manual Variables)** | Fast deployment with explicit environment variable control  | Sensitive variables are handled directly in shell session |
| **Method 3: Manual Deployment**                            | Teams that need full control and manual review of each step | More setup time and manual work                           |

Before running any method, review [Preparation - Server Infrastructure](/dotswap/developers/nexus-protocol/deployment-guide/preparation.md#server-infrastructure).

### Network Endpoints

The current `dotswap-ext` installer uses the following endpoint mapping. When deploying with a downloaded Compose file, set `APP_ENV` and the endpoint variables from the same row.

| Network  | `APP_ENV` | `DOTSWAP_HOST`                     | `ORD_URL`                          | Bitcoin RPC host                         |
| -------- | --------- | ---------------------------------- | ---------------------------------- | ---------------------------------------- |
| Testnet4 | `test`    | `https://api-testnet4.mempool.com` | `https://ord-testnet4.mempool.com` | `btc-testnet4.mempool.com:443`           |
| Signet   | `signet`  | `https://api-signet.mempool.com`   | `https://ord-signet.mempool.com`   | `btc-signet.mempool.com:443`             |
| Mainnet  | `prod`    | `https://api.dotswap.app`          | `https://rune-ord.mempool.com`     | Configure your Bitcoin Core RPC endpoint |

For Testnet4 and Signet, the current installer configures the RPC username as `jerry`, the password as `abc123`, and leaves ZMQ unset. If you use a different Bitcoin node, configure its RPC credentials and ZMQ endpoint.

### Pool Configuration

Configure CLMM, single-sided liquidity, and taker trading pairs after the service starts through the Nexus Web console or API. Pool configuration is no longer stored in `.env` or Compose environment variables.

* `POST /api/nexus/pools/list` — view the current configuration.
* `POST /api/nexus/pools` — submit or append trading pairs; API Key authentication is required.

### Method 1: One-Command Deployment (Recommended)

For a fast bootstrap, run:

```shell
curl -fsSL https://on.nexus/install.sh | bash
```

For a fast upgrade, run:

```shellscript
curl -fsSL https://on.nexus/install.sh | bash -s upgrade
```

{% hint style="info" %}
Run this command on your target server. For production environments, review the script before execution.
{% endhint %}

### Method 2: Advanced Quick Deployment (Manual Variables)

```shell
# Log in to the remote server
ssh root@xxx.xxx.xxx.xx
```

```shell
# See below for environment variable configuration requirements
export APP_ENV=test
export DOTSWAP_HOST=https://api-testnet4.mempool.com
export ORD_URL=https://ord-testnet4.mempool.com
export NODES_BTC_NODE_CONFIG_HOST=btc-testnet4.mempool.com:443
export NODES_BTC_NODE_CONFIG_USER=jerry
export NODES_BTC_NODE_CONFIG_PASS=abc123
export NODES_BTC_NODE_ZMQ_HOST=
export DOTSWAP_ACCOUNT_ADDRESS=tb1qmlp2ghv2xfv6h2ypmg9gt58uhmegse6c3tyhzq
export DOTSWAP_ACCOUNT_PRIVATE_KEY_HEX=853ac0c5ba7f629c20a8df8a86ae98e18a47c1262502e8a6ad0d074f3c2cf1af
export MNEMONIC='trumpet ten limb stay exact seven digital verify chronic solve face syrup'

# Taker config
export TAKER_MNEMONIC='trumpet ten limb stay exact seven digital verify chronic solve face syrup'

# Optional: enable Safeheron MPC signer
export MPC_SIGNER=safeheron
# Safeheron detailed variables (SAFEHERON_*) are documented in:
# en/nexus-dex/deployment-guide/safeheron-configuration.md

curl -fsSL https://get.docker.com | bash -s docker
env | grep -E '^(APP_ENV|DOTSWAP_|ORD_URL|NODES_BTC_NODE_|MNEMONIC|TAKER_MNEMONIC|MPC_SIGNER|FIREBLOCKS_|SAFEHERON_)' > .env
curl -fsSL https://on.nexus/docker-compose-v3.yml | docker compose -p dotswap-dex -f - up --wait --force-recreate --pull always
```

Use `sudo` only if your current user cannot run Docker commands directly.

{% hint style="info" %}
Remember to use your own address/private key/mnemonics
{% endhint %}

### Method 3: Manual Deployment

#### Docker Installation

The recommended way to deploy DOTSWAP DEX is using Docker. To install Docker, please refer to Docker's [Installation Guide](https://docs.docker.com/get-started/get-docker/). For questions regarding Docker installation, please refer to [Docker's Troubleshooting Guide](https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/).

```shell
# Install Docker
curl -fsSL https://get.docker.com | bash -s docker
```

#### Get Deployment Script

Download the latest configuration file `docker-compose.yml` from [DOTSWAP](https://on.nexus/docker-compose-v3.yml).

#### Environment Variable Configuration

Before running DEX, you need to modify the following environment variables in `docker-compose.yml`:

* `APP_ENV`: Runtime environment. `test` maps to Testnet4, `signet` maps to Signet, and `prod` maps to mainnet.
* `DOTSWAP_HOST` and `ORD_URL`: Set these to the matching values in the [Network Endpoints](#network-endpoints) table.
* `NODES_BTC_NODE_CONFIG_HOST`: Bitcoin node RPC endpoint (`host:port`). Use the matching test network endpoint in the table, or configure your own endpoint on mainnet.
* `NODES_BTC_NODE_CONFIG_USER` and `NODES_BTC_NODE_CONFIG_PASS`: Bitcoin node RPC credentials. For the current Testnet4 and Signet installer defaults, use `jerry` and `abc123`; for another node, use its credentials.
* `NODES_BTC_NODE_ZMQ_HOST`: Bitcoin node ZMQ endpoint (`tcp://host:port`). The current installer leaves this unset for Testnet4 and Signet; configure it when required by your own node.
* `MPC_SIGNER`: Signing backend. Use `local` (default, local private key), `fireblocks`, or `safeheron`.
* `DOTSWAP_ACCOUNT_ADDRESS`: The wallet address to register with Nexus as the Market Making Account.
* `DOTSWAP_ACCOUNT_PRIVATE_KEY_HEX`: The private key (hex) of the wallet address to register with Nexus, used to prove ownership of this address.
* `MNEMONIC`: The wallet mnemonic phrase for allowing the independent Nexus instance to sign transaction and provide liquidity.
* `TAKER_MNEMONIC`: Optional wallet mnemonic for signing swaps. It defaults to `MNEMONIC` when omitted.

If `MPC_SIGNER=safeheron`, see [Safeheron Configuration](/dotswap/developers/nexus-protocol/deployment-guide/safeheron-configuration.md) for the complete variable list and key format options (PEM content or file path).

**Configuration Example**

Pay attention to the indentation level of the YAML configuration to ensure it is correct. If the value of a configuration item is a multi-line string, use `|` or `>` correctly to maintain the format and follow YAML's indentation rules.

```dotenv
services:
  service:
    environment:
      APP_ENV: test
      DOTSWAP_HOST: https://api-testnet4.mempool.com
      ORD_URL: https://ord-testnet4.mempool.com
      NODES_BTC_NODE_CONFIG_HOST: btc-testnet4.mempool.com:443
      NODES_BTC_NODE_CONFIG_USER: jerry
      NODES_BTC_NODE_CONFIG_PASS: abc123
      NODES_BTC_NODE_ZMQ_HOST: ""
      DOTSWAP_ACCOUNT_ADDRESS: tb1qmlp2ghv2xfv6h2ypmg9gt58uhmegse6c3tyhzq
      DOTSWAP_ACCOUNT_PRIVATE_KEY_HEX: 853ac0c5ba7f629c20a8df8a86ae98e18a47c1262502e8a6ad0d074f3c2cf1af
      MNEMONIC: trumpet ten limb stay exact seven digital verify chronic solve face syrup
```

#### Start Service

Check the `docker-compose` version; it needs to be greater than `1.21.0`.

```shell
docker-compose -v
# docker-compose version 1.17.1 ❌
# or
docker compose version
# Docker Compose version v2.32.4 ✅
```

Execute the following command in the terminal to start DOTSWAP DEX:

```shell
# Execute in the command line
docker compose -f docker-compose.yml up --wait --pull always
# or 
docker-compose -f docker-compose.yml up --wait --pull always
```

**Access Service**

After successful startup, you can access it via [http://:17610](https://github.com/DotSwap-Dev/dotswap-doc/blob/doc-en/en/nexus-dex/deployment-guide/http:/%3CYour-Server-IP%3E:17610/README.md).

**Security Operations**

```shell
# Clear environment variables
unset APP_ENV
unset DOTSWAP_HOST
unset ORD_URL
unset NODES_BTC_NODE_CONFIG_HOST
unset NODES_BTC_NODE_CONFIG_USER
unset NODES_BTC_NODE_CONFIG_PASS
unset NODES_BTC_NODE_ZMQ_HOST
unset MPC_SIGNER
unset DOTSWAP_ACCOUNT_PRIVATE_KEY_HEX
unset MNEMONIC
unset TAKER_MNEMONIC

# Clear command history
history -c 
```

**Security Hardening**

After you have confirmed that your node is deployed and running stably, you **must perform the following critical step**:

* **Remove SSH Access Rule:** Return to your firewall settings and **delete or disable** the rule allowing SSH (port 22) access that you created in Stage 1.

<figure><img src="https://images.swap.dotwallet.com/web_restrict/gitbook_api_img/image%20(2-1).png" alt=""><figcaption></figcaption></figure>

* **How to manage the server after closing SSH?** You will no longer connect via public SSH. Instead, you should **rely exclusively on the secure, in-browser management tools provided by your cloud provider** (e.g., AWS Session Manager, Linode Lish Console), which is the industry-recommended best practice.

<figure><img src="https://images.swap.dotwallet.com/web_restrict/gitbook_api_img/image%20(7).png" alt=""><figcaption></figcaption></figure>

{% hint style="danger" %}
Never expose your private keys/mnemonics. And take the security of your server seriously.
{% endhint %}