Replicas — 100% Uptime Validators | Amadeus Protocol
All updates

Replicas

One validator identity, several machines, spread across clouds and continents. One produces; the rest stand ready. Shipped in v1.5.8.

Setup lives in the validator guide; this is the deep dive.

01One identity, many machines

A replica group is the same seed pack on several nodes — different machines, different clouds, different continents:

  • Members heartbeat each other every 500ms, encrypted with AES-256-GCM under a shared secret.
  • Only the member that a majority acks as the leader may sign. The lowest REPLICA_ID online wins leadership.
  • No member ever signs a height another member already signed — the high-water mark is on disk and survives restarts. Double-signing is structurally impossible.
AWS US-EAST-1 · ID 1LEADER — producingGCP US-WEST-1 · ID 2standby — acking ID 1HETZNER EU · ID 3standby — acking ID 1one identity · three clouds · heartbeats every 500 ms
The group agrees on one leader; everyone else just heartbeats.

02When us-east-1 goes down — and it will

AWS us-east-1 is the internet's single biggest point of failure, and it has a track record:

2011EBS2015DynamoDB2017S32020Kinesis2021network2023Lambda2025DNS20102026major us-east-1 outages — roughly one every other year
us-east-1's greatest hits. The next one is a matter of when, not if.

When it happens, half the internet goes dark with it. With replicas, the group notices the silence in ~2s, leadership falls to the lowest ID still online, and production continues from another cloud:

AWS US-EAST-1 · ID 1region downGCP US-WEST-1 · ID 2NEW LEADER — producingHETZNER EU · ID 3acking ID 2quorum 2 of 3 intact — failover in ~2 s — the validator never left the networkwhen us-east-1 recovers, ID 1 rejoins, acks the group, and leadership returns to it
An entire region dies; your identity doesn't.

For teams running customer validators behind an SLA, this is the point: an AWS outage can never be your validators' blame. While status pages everywhere turn red, your fleet keeps signing from another cloud — no missed slots, no angry customers, no post-mortem where the answer is "Amazon".

03Sizing the group

Signing needs a majority online, so useful sizes are odd:

  • Group of 3 — survives 1 failure (the standard shape)
  • Group of 5 — survives 2
  • Group of 7 — survives 3

Spread members across providers and regions — three nodes in one datacenter share one failure domain. Lose quorum entirely and the group goes safely silent rather than risk a double-sign.

04Config

Enterprise territory

Producing multiple different entries for the same height is a slashable offense. The replica protocol exists to make that impossible — set it up carefully, on all members, before pointing them at the same seed pack.
# the group: id@ip:port, comma-separated — identical on every member
[email protected]:36969,[email protected]:36969,[email protected]:36969

# this machine's id — must appear in REPLICAS. doubles as leader
# priority: the lowest id online becomes leader
REPLICA_ID=1

# shared secret: 32 random bytes, Base58 — generate once, same on every member
REPLICA_PSK=<32-bytes-base58>

Full node setup — hardware, seeds file, systemd — is in the validator guide.