Gateway Setup

Run a gateway when the hosted tiers stop fitting: your application needs dedicated read capacity, you want to offer read service to others, or you want your own limits and your own cache (when to escalate). A gateway follows the chain, reads slices from storage nodes as a staked peer, and serves the read API. What the role is and why it exists is on the gateways page; this page gets one running.

Joining the public network as an operator starts with the staking program. and we’ll help you get set up.

Prerequisites

A machine where memory and disk match your cache plans; the gateway’s disk footprint is mostly its slice cache and its indexes.
A reliable Solana RPC endpoint.
A wallet with SOL and enough TAPE to stake past the network’s access threshold, the voted minimum stake storage nodes require before they’ll serve a peer (why stake gates reads). See Tapenet funding.

Install

Install Tapedrive on the machine that will run the gateway.

Stake

A gateway registers and stakes like a node but never joins the committee. It holds no spools, casts no votes, and owes no storage. The stake is what opens reads from storage nodes.

tape-node keygen --out ~/.tape --name my-gateway

tape-admin node register \
  --identity ~/.tape/identity.json \
  --bls ~/.tape/bls.json \
  --tls ~/.tape/tls.json \
  --address gw.example.com:4040 \
  --name my-gateway

tape-admin node stake --identity ~/.tape/identity.json --amount 1000

Note the missing step: no join-committee. Registered and staked without joining is exactly what a gateway is. Stake activates over two epochs. Check the current access threshold before you size your stake.

Configuration

The same node.yaml drives the gateway; the gateway section is where its own behavior lives:

gateway:
  cache:
    max_bytes: 500000000000   # slice cache budget; 0 disables the persistent cache
  metering:                   # request and byte buckets for public traffic
http:                         # the public listener users hit
https:                        # the mTLS side that talks to storage nodes

The two listeners have different jobs and should be treated that way: expose http to the world, and firewall the https peer side the same way you would a storage node’s. Size the cache to your working set; the gateway caches slices, so cached content costs about what the decoded objects would (how gateway caching works). Rate limits and access tiers are yours to set. The defaults match Tapenet’s hosted public tier; loosen or tighten them to match the service you’re running (rate limits).

Run

tape-gateway --config ~/.tape/node.yaml

First start bootstraps the indexes by replay, then follows the chain live. A gateway’s local state is disposable: delete it and the next start rebuilds it from the chain. That’s also what makes scaling out simple. Run more instances behind a load balancer; there’s no shared state to coordinate (the architecture). For unattended operation, run it under systemd. The restart policy pairs with the gateway’s disposable state: a crash or a kill restarts clean and re-bootstraps if needed.

[Unit]
Description=Tapedrive gateway
After=network-online.target

[Service]
ExecStart=/usr/local/bin/tape-gateway --config /home/tape/.tape/node.yaml
Restart=on-failure
TimeoutStopSec=30

[Install]
WantedBy=multi-user.target

Serving under load

At saturation the gateway sheds load at the edges instead of buffering without limit. Queues and connection counts are capped, so latency degrades predictably and memory stays flat. The knobs that matter when tuning: the cache budget, the concurrent-request caps, and the per-IP metering.

Fronting with a CDN

For public content at web scale, put a CDN in front. Tapedrive content caches unusually well, and the integration pattern, cache policies, and caveats live on the CDN page.

Metrics

A build with the metrics cargo feature serves /v1/metrics on the HTTP listener (telemetry lists every identifier). The alerts worth paging on:

# Falling behind the chain (serving stale state)
tape_node_ingest_lag_slots > 300

# Cache no longer absorbing reads
sum(rate(tape_gw_cache_requests_total{result="hit"}[15m]))
  / sum(rate(tape_gw_cache_requests_total[15m])) < 0.5

# Objects failing to decode: not enough verified slices from storage nodes
rate(tape_gw_decode_total{result="insufficient_slices"}[10m]) > 0

# Latency and errors
histogram_quantile(0.99, sum by (le) (rate(tape_http_request_duration_seconds_bucket[5m]))) > 1
sum(rate(tape_http_request_duration_seconds_count{status_class="5xx"}[5m]))
  / sum(rate(tape_http_request_duration_seconds_count[5m])) > 0.01

The pairing to watch is sync lag against serving metrics; telemetry explains why those two belong together.

Network

Run Infrastructure

Private Network

Prerequisites

Install

Stake

Configuration

Run

Serving under load

Fronting with a CDN

Metrics

​Prerequisites

​Install

​Stake

​Configuration

​Run

​Serving under load

​Fronting with a CDN

​Metrics

Prerequisites

Install

Stake

Configuration

Run

Serving under load

Fronting with a CDN

Metrics