### Install a single-node k3s cluster

Source: https://docs.novacula.io/docs/chains/igra

Executes the k3s installation script to set up a lightweight Kubernetes cluster.

```bash
curl -sfL https://get.k3s.io | sh -
```

--------------------------------

### Install Helm

Source: https://docs.novacula.io/docs/chains/igra

Downloads and installs the Helm package manager for Kubernetes.

```bash
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4 | bash
```

--------------------------------

### Install the Operator

Source: https://docs.novacula.io/docs/chains/igra

Deploys the Novacula Operator using Helm and verifies the deployment status.

```bash
helm upgrade --install nvcl-operator oci://ghcr.io/rsquad/nvcl/charts/nvcl-operator \
  --namespace nvcl-system --create-namespace \
  --set image.tag="<version>" \
  --set gateway.tag="<version>" \
  --set hub.url="https://hub.novacula.io" \
  --set-string hub.token="<executor-api-key>" \
  --set hub.name="<executor-name>"
```

```bash
kubectl -n nvcl-system rollout status deploy/nvcl-operator
```

--------------------------------

### GET /nvcl/health

Source: https://docs.novacula.io/docs/nodes/pools

Checks the health status of the executor. Returns 200 if the executor has a qualified member, 200 with a degraded state if routing is stale, or 503 if no eligible member is available.

```APIDOC
## GET /nvcl/health

### Description
Checks the health status of the executor. This endpoint is keyless and is not forwarded to other members.

### Method
GET or HEAD

### Endpoint
/nvcl/health

### Response
#### Success Response (200)
- **ok** - The executor has a member qualified to serve the pool.
- **degraded** - The host is serving but routing information is stale.

#### Error Response (503)
- **no eligible member** - The executor does not have a member qualified to serve the pool.
```

--------------------------------

### Verify Kubernetes cleanup

Source: https://docs.novacula.io/docs/executors/deactivate-executor

Check for remaining resources and optionally delete the namespace.

```bash
kubectl get crd | grep novacula.io
kubectl get clusterrole,clusterrolebinding | grep <release>
kubectl get all,ingress,networkpolicy,pvc -n <namespace>
kubectl delete namespace <namespace>
```

--------------------------------

### Verify agent cleanup

Source: https://docs.novacula.io/docs/executors/deactivate-executor

Confirm that all agent-related services, firewall tables, and directories have been removed.

```bash
systemctl list-units --type=service 'nvcl-*'
systemctl status novacula-agent.service
nft list table inet nvcl
ls /var/lib/novacula /etc/novacula
```

--------------------------------

### Enable Per-IP Guest Limiting on Operator

Source: https://docs.novacula.io/docs/nodes/pools

Configure the Operator chart to enable per-IP guest limiting, which requires that the ingress correctly handles the X-Nvcl-Client-Ip header.

```toml
[gateway.guest_per_ip]
enabled = true
```

--------------------------------

### Point shell at the cluster

Source: https://docs.novacula.io/docs/chains/igra

Sets the KUBECONFIG environment variable to allow kubectl and helm to interact with the k3s cluster.

```bash
export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
```

--------------------------------

### Uninstall agent and clean host files

Source: https://docs.novacula.io/docs/executors/deactivate-executor

Remove the Novacula agent, firewall rules, and associated configuration and data directories.

```bash
sudo novacula-agent uninstall
nft delete table inet nvcl 2>/dev/null || true
systemctl daemon-reload
sudo rm -rf /etc/novacula /var/lib/novacula /opt/novacula
```

--------------------------------

### Authenticate with RPC Key

Source: https://docs.novacula.io/docs/nodes/rpc-exposure

Use a bearer token in the Authorization header to authenticate requests to a proxied RPC endpoint.

```bash
curl -X POST https://rpc.example.com \
  -H "Authorization: Bearer nvcl_your-rpc-key" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
```

--------------------------------

### Authenticate RPC requests with cURL

Source: https://docs.novacula.io/docs/chains/bitcoin

Use this command to perform authenticated RPC calls to a Bitcoin node. The Authorization header must contain the Base64-encoded string 'nvcl:nvcl'.

```bash
curl -X POST http://<host>:<port> \
  -H 'Authorization: Basic bnZjbDpudmNs' \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc": "2.0", "id": "mytest", "method": "getblockchaininfo", "params": []}'
```

--------------------------------

### Stop per-node systemd units

Source: https://docs.novacula.io/docs/executors/deactivate-executor

Identify, disable, and remove systemd service files for nodes running on bare metal or VMs.

```bash
systemctl list-units --type=service 'nvcl-*'
systemctl disable --now 'nvcl-*.service'
rm -f /etc/systemd/system/nvcl-*.service
```

--------------------------------

### Pool RPC Endpoint

Source: https://docs.novacula.io/docs/nodes/pools

The primary entry point for clients to interact with the pool via HTTP JSON-RPC.

```APIDOC
## POST https://<pool-domain>

### Description
Main entry point for clients to send JSON-RPC requests to the pool. Access is controlled by client keys or guest allowances.

### Method
POST

### Endpoint
https://<pool-domain>

### Response Headers
- **X-Nvcl-Pool-Degraded** - Present with value 'stale' when the host is serving on stale routing information.
```