> For the complete documentation index, see [llms.txt](/llms.txt)

# Configure environment

**Time:** \~5 minutes.

<!-- -->

<!-- -->

<!-- -->

## 1. Create the directory

```bash
mkdir -p aztec-sequencer/data && cd aztec-sequencer
```

## 2. Copy your keystore into the project

Copy only the node keystore files (`key1.json`, `key2.json`, ...) into the directory the node loads. Do **not** copy the `*_staker_output.json` files.

```bash
mkdir -p ./keys
cp ~/.aztec/keystore/key*.json ./keys
rm -f ./keys/*_staker_output.json
```

Keep staker output files out of `KEY_STORE_DIRECTORY`

The node loads every `.json` file in `KEY_STORE_DIRECTORY` and expects each one to be a node keystore. The `key*_staker_output.json` files generated by `aztec validator-keys new --staker-output` are a different format (used for registration, not for running the node), so leaving one in this directory makes the node fail to start. The `rm` above removes them after the copy.

## 3. Create the `.env` file

```bash
# ── Aztec Sequencer Configuration ──

# Data & Keys
DATA_DIRECTORY=./data
KEY_STORE_DIRECTORY=./keys
LOG_LEVEL=info

# Ethereum L1 endpoints
ETHEREUM_HOSTS={{ETH_RPC}}
L1_CONSENSUS_HOST_URLS={{CONSENSUS_RPC}}
ETHEREUM_DEBUG_HOSTS={{DEBUG_RPC}}

# P2P networking
P2P_IP={{P2P_IP}}
P2P_PORT=40400

# Aztec ports
AZTEC_PORT=8080
AZTEC_ADMIN_PORT=8880
```

Don't know your external IP?

Run `curl ipv4.icanhazip.com`.

Never expose port 8880

Port 8880 is the **admin port**: it reads and changes node configuration. It requires an API key by default, and it must still never be exposed. It is intentionally not mapped in the Docker Compose file in the next step.

What does each variable do?

* **`DATA_DIRECTORY`** is where the node stores blockchain data. The directory grows over time.
* **`KEY_STORE_DIRECTORY`** is the path to your validator keystore (the `key1.json` file).
* **`ETHEREUM_HOSTS`** is your L1 execution client. The node reads rollup contract state and submits proofs here.
* **`L1_CONSENSUS_HOST_URLS`** is your L1 consensus client (Beacon API). Needed for blob data access.
* **`ETHEREUM_DEBUG_HOSTS`** is a trace-capable endpoint (`debug_traceTransaction`). It is optional: if you leave it unset, the node uses `ETHEREUM_HOSTS` for trace calls, so set it separately only if your trace-capable endpoint differs from your main execution endpoint. Whichever endpoint the node traces with must serve trace methods: the node refuses to start otherwise, unless you set `ETHEREUM_ALLOW_NO_DEBUG_HOSTS=true`.
* **`P2P_IP`** is your server's public IP so other nodes can connect to you.
* **`P2P_PORT 40400`** is the port for peer-to-peer communication, both TCP and UDP. It must be forwarded through your firewall.