Dara DocsTestnet deployment and end-to-end test
Stages 28–29. Runs the platform on the public Testnet in the launch layout (owner decisions of 2026-10-31,
../decisions/OWNER_DECISIONS_20261031.md): one human signer for the issuer and the cold Treasury, online keys in
Vault Transit, our own two RPC nodes, GOLD only, 8 AUTO and 3 GOV channels.
Separation from everything else
| Item | Testnet |
|---|---|
| Issuer, Treasury and channel accounts | Created on Testnet only by dara bootstrap-local with Friendbot funding (refused on Mainnet) |
| Human signer | A Testnet-only key in a key file (TESTNET_HUMAN_KEYS_FILE, lines H1=S… and T1=S…); never a Mainnet key. signer.KeyfileHumans refuses Mainnet |
| Online keys | Vault/OpenBao Transit with PREFIX=dara-testnet- (deploy/vault/setup-transit.sh), exactly as production |
| Database | Its own PostgreSQL database, never shared |
| Asset identity | A throwaway Testnet GOLD issuer per run |
stellar.toml | No public domain exists yet (Q-13). STELLAR_TOML_TEST_RESOLVE=<domain>=<host:port> makes activation fetch the issuer's stellar.toml over HTTP from our own scan API; config refuses it unless STELLAR_NETWORK=testnet and APP_ENV=test. The real HTTPS fetch is checked on the Mainnet canary |
| Configuration | STELLAR_NETWORK=testnet, APP_ENV=test, ISSUER_SIGNERS = TREASURY_SIGNERS = the Testnet signer's public key, STELLAR_RPC_NODES = our two nodes |
Our RPC nodes
Each node is stellar-rpc with captive core (the binary and core ship in the Quickstart image). On this host
rootless container networking stalled the large history-archive downloads, so the nodes run on the host network
with their own ports:
stellar-rpc --network testnet --endpoint 127.0.0.1:8100 --admin-endpoint 127.0.0.1:8110 \
--captive-core-config-path captive-core.cfg # PEER_PORT=11735
--captive-core-storage-path core --stellar-captive-core-http-port 11736 \
--stellar-captive-core-http-query-port 11738 --db-path rpc.sqliteThe second node uses different ports (8101, 8111, peer 11745, 11746, 11748). The first sync downloads Testnet's
bucket list from the SDF history archives (a few GB, about 1 MB/s here); a second node can start from a copy of
the first node's core/ directory.
Procedure
- Start the two nodes; wait for
getHealth= healthy on both. - Vault:
VAULT_ADDR=… VAULT_TOKEN=<admin> PREFIX=dara-testnet- deploy/vault/setup-transit.sh→ signer token file. dara migrate,dara keys(online public keys from Vault),dara bootstrap-localwithBOOTSTRAP_ASSETS=GOLD,BOOTSTRAP_CHANNELS=8,BOOTSTRAP_GOV_CHANNELS=3,BOOTSTRAP_HOME_DOMAIN=<test domain>: issuer, COLD, HOT, sponsor, funder and 11 channels in the launch layouts; the manifest is written.dara allanddara scan-api: startup verification of every account against the manifest must pass.dara demowithDEMO_HOME_DOMAIN=<test domain>: the scripted end-to-end below, with the Testnet signer signing each proposal after decoding and checking it, and uploading the signed envelope as the CLI would.
End-to-end test
| # | Step | Expected |
|---|---|---|
| 1 | Create GOLD, register the ceremony's issuer, unit definition, activate | ACTIVE; activation re-verified the issuer layout and fetched stellar.toml |
| 2 | Backing snapshot, four-eyes | EFFECTIVE |
| 3 | ISSUE to COLD (one signature) | Supply on Dara Scan = issued; COLD = issued |
| 4 | REFILL to HOT (one signature) | HOT = refill |
| 5 | Customers register, KYC | Sponsored accounts with authorized trustlines |
| 6 | BUY, SELL, TRANSFER | Exact amounts; orders COMPLETED |
| 7 | Freeze, two-officer unfreeze | Trustline revoked then re-authorized on-chain |
| 8 | BURN from COLD (one signature) | Supply falls by the burn |
| 9 | Clawback (one signature) | Supply falls |
| 10 | Reconciliation, Dara Scan | PASS for every check; Scan shows issuer master weight 0, clawback enabled |
Status 2026-10-31: tooling, configuration and runbook ready; the run has not completed yet (our first Testnet node
was still downloading the bucket list). Record results in ../testing/evidence/TESTNET_E2E_<date>.md.