Revise Siren documentation

book/src/SUMMARY.md

@@ -33,9 +33,8 @@
     * [Signature Header](./api-vc-sig-header.md)
   * [Prometheus Metrics](./advanced_metrics.md)
 * [Lighthouse UI (Siren)](./lighthouse-ui.md)
-  * [Installation](./ui-installation.md)
-  * [Authentication](./ui-authentication.md)
   * [Configuration](./ui-configuration.md)
+  * [Authentication](./ui-authentication.md)
   * [Usage](./ui-usage.md)
   * [FAQs](./ui-faqs.md)
 * [Advanced Usage](./advanced.md)

book/src/api-vc-auth-header.md

@@ -20,11 +20,11 @@ Authorization: Bearer hGut6B8uEujufDXSmZsT0thnxvdvKFBvh
 The API token is stored as a file in the `validators` directory. For most users
 this is `~/.lighthouse/{network}/validators/api-token.txt`, unless overridden using the
 `--http-token-path` CLI parameter. Here's an
-example using the `cat` command to print the token to the terminal, but any
+example using the `cat` command to print the token for mainnet to the terminal, but any
 text editor will suffice:
 
 ```bash
-cat api-token.txt
+cat ~/.lighthouse/mainnet/validators/api-token.txt
 hGut6B8uEujufDXSmZsT0thnxvdvKFBvh
 ```
 

book/src/lighthouse-ui.md

@@ -21,7 +21,6 @@ The UI is currently in active development. It resides in the
 See the following Siren specific topics for more context-specific
 information:
 
-- [Installation Guide](./ui-installation.md) - Information to install and run the Lighthouse UI.
 - [Configuration Guide](./ui-configuration.md) - Explanation of how to setup
  and configure Siren.
 - [Authentication Guide](./ui-authentication.md) - Explanation of how Siren authentication works and protects validator actions.

book/src/ui-authentication.md

@@ -2,12 +2,12 @@
 
 ## Siren Session
 
-For enhanced security, Siren will require users to authenticate with their session password to access the dashboard. This is crucial because Siren now includes features that can permanently alter the status of user validators. The session password must be set during the [installation](./ui-installation.md) process before running the Docker or local build, either in an `.env` file or via Docker flags.
+For enhanced security, Siren will require users to authenticate with their session password to access the dashboard. This is crucial because Siren now includes features that can permanently alter the status of the user's validators. The session password must be set during the [configuration](./ui-configuration.md) process before running the Docker or local build, either in an `.env` file or via Docker flags.
 
 ![exit](imgs/ui-session.png)
 
 ## Protected Actions
 
-Prior to executing any sensitive validator action, Siren will request authentication of the session password. If you wish to update your password please refer to the Siren [installation process](./ui-installation.md).
+Prior to executing any sensitive validator action, Siren will request authentication of the session password. If you wish to update your password please refer to the Siren [configuration process](./ui-configuration.md).
 
 ![exit](imgs/ui-auth.png)

book/src/ui-configuration.md

@@ -1,37 +1,116 @@
-# Configuration
+# 📦 Installation
 
-Siren requires a connection to both a Lighthouse Validator Client and a Lighthouse Beacon Node.  
-To enable connection, you must generate .env file based on the provided .env.example
+Siren supports any operating system that supports container runtimes and/or NodeJS 18, this includes Linux, MacOS, and Windows. The recommended way of running Siren is by launching the [docker container](https://hub.docker.com/r/sigp/siren).
+
+## Version Requirement
+
+To ensure proper functionality, the Siren app requires Lighthouse v4.3.0 or higher. You can find these versions on the [releases](https://github.com/sigp/lighthouse/releases) page of the Lighthouse repository.
 
-## Connecting to the Clients
+## Configuration
+
+Siren requires a connection to both a Lighthouse Validator Client and a Lighthouse Beacon Node.  
 
 Both the Beacon node and the Validator client need to have their HTTP APIs enabled.  
-These ports should be accessible from Siren.  
+These ports should be accessible from Siren. This means adding the flag `--http` on both beacon node and validator client.
 
 To enable the HTTP API for the beacon node, utilize the `--gui` CLI flag. This action ensures that the HTTP API can be accessed by other software on the same machine.
 
 > The Beacon Node must be run with the `--gui` flag set.
 
-If you require accessibility from another machine within the network, configure the `--http-address` to match the local LAN IP of the system running the Beacon Node and Validator Client.
+## Running the Docker container (Recommended)
+
+We recommend running Siren's container next to your beacon node (on the same server), as it's essentially a webapp that you can access with any browser.
+
+ 1. Create a directory to run Siren:
+
+    ```bash
+    cd ~
+    mkdir Siren
+    cd Siren
+    ```
+
+ 1. Create a configuration file in the `Siren` directory: `nano .env` and insert the following fields to the `.env` file. The field values are given here as an example, modify the fields as necessary. For example, the `API_TOKEN` can be obtained from [`Validator Client Authorization Header`](./api-vc-auth-header.md)
+
+    A full example with all possible configuration options can be found [here](https://github.com/sigp/siren/blob/stable/.env.example).  
+
+    ```
+    BEACON_URL=http://localhost:5052
+    VALIDATOR_URL=http://localhost:5062
+    API_TOKEN=R6YhbDO6gKjNMydtZHcaCovFbQ0izq5Hk
+    SESSION_PASSWORD=your_password
+    ```
+
+ 1. You can now start Siren with:
+
+    ```bash
+    docker run --rm -ti --name siren --env-file $PWD/.env --net host sigp/siren
+    ```
+
+    Note that, due to the `--net=host` flag, this will expose Siren on ports 3000, 80, and 443. Preferably, only the latter should be accessible. Adjust your firewall and/or skip the flag wherever possible.  
+
+    If it fails to start, an error message will be shown. For example, the error
+
+    ```
+    http://localhost:5062 unreachable, check settings and connection
+    ```
+
+    means that the validator client is not running, or the `--http` flag is not provided, or otherwise unaccessible from within the container. Another common error is:
+
+    ```
+    validator api issue, server response: 403
+    ```
+
+    which means that the API token is incorrect. Check that you have provided the correct token in the field `API_TOKEN` in `.env`.
+
+    When Siren has successfully started, you should see the log `LOG [NestApplication] Nest application successfully started +118ms`, indicating that Siren has started.
+
+ 1. Siren is now accessible at `https://<the-servers-ip>` (when used with `--net=host`). You will get a warning about an invalid certificate, this can be safely ignored.
+
+    > Note: We recommend setting a strong password when running Siren to protect it from unauthorized access.
+
+Advanced users can mount their own certificates or disable SSL altogether, see the `SSL Certificates` section below.
+
+## Building From Source
+
+### Docker
+
+The docker image can be built with the following command:
+`docker build -f Dockerfile -t siren .`
+
+### Building locally
+
+To build from source, ensure that your system has `Node v18.18` and `yarn` installed.
+
+#### Build and run the backend
+
+Navigate to the backend directory `cd backend`. Install all required Node packages by running `yarn`. Once the installation is complete, compile the backend with `yarn build`. Deploy the backend in a production environment, `yarn start:production`. This ensures optimal performance.
+
+#### Build and run the frontend
+
+After initializing the backend, return to the root directory. Install all frontend dependencies by executing `yarn`. Build the frontend using `yarn build`. Start the frontend production server with `yarn start`.
+
+This will allow you to access siren at `http://localhost:3000` by default.
+
+## Advanced configuration
+
+### About self-signed SSL certificates
+
+By default, internally, Siren is running on port 80 (plain, behind nginx), port 3000 (plain, direct) and port 443 (with SSL, behind nginx)). Siren will generate and use a self-signed certificate on startup. This will generate a security warning when you try to access the interface. We recommend to only disable SSL if you would access Siren over a local LAN or otherwise highly trusted or encrypted network (i.e. VPN).
+
+#### Generating persistent SSL certificates and installing them to your system
 
-> To access from another machine on the same network (192.168.0.200) set the Beacon Node and Validator Client `--http-address` as `192.168.0.200`. When this is set, the validator client requires the flag `--beacon-nodes http://192.168.0.200:5052` to connect to the beacon node.
+[mkcert](https://github.com/FiloSottile/mkcert) is a tool that makes it super easy to generate a self-signed certificate that is trusted by your browser.
 
-In a similar manner, the validator client requires activation of the `--http` flag, along with the optional consideration of configuring the `--http-address` flag. If `--http-address` flag is set on the Validator Client, then the `--unencrypted-http-transport` flag is required as well. These settings will ensure compatibility with Siren's connectivity requirements.
+To use it for `siren`, install it following the instructions. Then, run `mkdir certs; mkcert -cert-file certs/cert.pem -key-file certs/key.pem 127.0.0.1 localhost` (add or replace any IP or hostname that you would use to access it at the end of this command).  
+To use these generated certificates, add this to to your `docker run` command: `-v $PWD/certs:/certs`
 
-If you run the Docker container, it will fail to startup if your BN/VC are not accessible, or if you provided a wrong API token.
+The nginx SSL config inside Siren's container expects 3 files: `/certs/cert.pem` `/certs/key.pem` `/certs/key.pass`. If `/certs/cert.pem` does not exist, it will generate a self-signed certificate as mentioned above. If `/certs/cert.pem` does exist, it will attempt to use your provided or persisted certificates.
 
-## API Token
+### Configuration through environment variables
 
-The API Token is a secret key that allows you to connect to the validator
-client. The validator client's HTTP API is guarded by this key because it
-contains sensitive validator information and the ability to modify
-validators. Please see [`Validator Authorization`](./api-vc-auth-header.md)
-for further details.
+For those who prefer to use environment variables to configure Siren instead of using an `.env` file, this is fully supported. In some cases this may even be preferred.
 
-Siren requires this token in order to connect to the Validator client.
-The token is located in the default data directory of the validator
-client. The default path is
-`~/.lighthouse/<network>/validators/api-token.txt`.
+#### Docker installed through `snap`
 
-The contents of this file for the desired validator client needs to be
-entered.
+If you installed Docker through a snap (i.e. on Ubuntu), Docker will have trouble accessing the `.env` file. In this case it is highly recommended to pass the config to the container with environment variables.
+Note that the defaults in `.env.example` will be used as fallback, if no other value is provided.

book/src/ui-faqs.md

@@ -10,15 +10,16 @@ The required Api token may be found in the default data directory of the validat
 
 ## 3. How do I fix the Node Network Errors?
 
-If you receive a red notification with a BEACON or VALIDATOR NODE NETWORK ERROR you can refer to the lighthouse ui configuration and [`connecting to clients section`](./ui-configuration.md#connecting-to-the-clients).
+If you receive a red notification with a BEACON or VALIDATOR NODE NETWORK ERROR you can refer to the lighthouse ui [`configuration`](./ui-configuration.md#configuration).
 
 ## 4. How do I connect Siren to Lighthouse from a different computer on the same network?
 
-Siren is a webapp, you can access it like any other website. We don't recommend exposing it to the internet; if you require remote access a VPN or (authenticated) reverse proxy is highly recommended.
+Siren is a webapp, you can access it like any other website. We don't recommend exposing it to the internet; if you require remote access a VPN or (authenticated) reverse proxy is highly recommended.  
+That being said, it is entirely possible to have it published over the internet, how to do that goes well beyond the scope of this document but we want to emphasize once more the need for *at least* ssl encryption if you choose to do so.
 
 ## 5. How can I use Siren to monitor my validators remotely when I am not at home?
 
-Most contemporary home routers provide options for VPN access in various ways. A VPN permits a remote computer to establish a connection with internal computers within a home network. With a VPN configuration in place, connecting to the VPN enables you to treat your computer as if it is part of your local home network. The connection process involves following the setup steps for connecting via another machine on the same network on the Siren configuration page and [`connecting to clients section`](./ui-configuration.md#connecting-to-the-clients).
+Most contemporary home routers provide options for VPN access in various ways. A VPN permits a remote computer to establish a connection with internal computers within a home network. With a VPN configuration in place, connecting to the VPN enables you to treat your computer as if it is part of your local home network. The connection process involves following the setup steps for connecting via another machine on the same network on the Siren configuration page and [`configuration`](./ui-configuration.md#configuration).
 
 ## 6. Does Siren support reverse proxy or DNS named addresses?