devnet-7: tysm beacon canary on prysm-geth-1 wired to bad-tysm

[samcm]

Runs a tysm beacon canary on prysm-geth-1 and registers it with the production bad-tysm control plane. Only the beacon image changes to ethpandaops/tysm:glamsterdam-devnet-7; the validator and geth EL stay on their stock devnet-7 images. epbs-mutator ships disabled and bad-tysm activates it at runtime.

Verified live: the beacon is synced and stable, appears in bad-tysm as a push-discovered node with fresh heartbeats, its control API is reachable on 8675, and epbs-mutator is present with runtime_reconfigurable: true.

What the tysm build needs beyond stock prysm

• a hidden --secret-access-key gate flag — value stored in sops (tysm_secret_access_key), not in this repo; without it the beacon exits with a panda banner and no message.
• --xatu-config-file — mandatory even with the xatu hook disabled. A no-op local output satisfies it; devnet events keep flowing through the existing xatu-sentry sidecar.
• --tysm-hook-config-file — carries the api (control API on 0.0.0.0:8675) and discovery (bad-tysm URL + shared token) blocks. TYSM_TOKEN is injected from the tysm_secret_key sops value.

Image requirement

Needs a tysm:glamsterdam-devnet-7 image built on/after 2026-07-20 (the epbs_mutator merge). The 07-17 image predated the hook. Ansible compares by tag not digest, so a rebuild under the same tag shows changed=0 — watchtower handles the container recreate on these hosts.

Deploying it

The prysm role has no template/copy task, so the two config files are pushed out-of-band into the datadir (they surface at /data in the container via the existing mount):

ansible prysm-geth-1 -b -m copy -a "src=inventories/devnet-7/files/tysm/prysm-geth-1-hooks.yaml dest=/data/prysm/tysm-hooks.yaml owner=prysm group=prysm mode=0644"
ansible prysm-geth-1 -b -m copy -a "src=inventories/devnet-7/files/tysm/prysm-geth-1-xatu-config.yaml dest=/data/prysm/tysm-xatu-config.yaml owner=prysm group=prysm mode=0644"
ansible-playbook playbook.yaml --limit prysm-geth-1 --tags ethereum_node_cl

The 8675/tcp firewall rule (DO + Hetzner, mirroring the 8961 snooper rule) is included. Extending to more prysm nodes is a copy of the host_vars + the two files per host (fix the self_url/instance_id/name).

[samcm]

Live and verified. The tysm:glamsterdam-devnet-7 image had to be rebuilt first — the published image was from 07-17, before epbs_mutator merged onto the branch (07-20), so the hook wasn't in the binary. Rebuilt from current HEAD (tysm run 29798151390); watchtower auto-pulled and recreated the beacon on the new digest.

prysm-geth-1 now: synced, registered + heartbeating in production bad-tysm, control API reachable on 8675, and epbs-mutator present with runtime_reconfigurable: true (shows in the bad-tysm activation picker).

Note for future rolls: this needs an image built on/after 2026-07-20. Ansible compares by tag not digest, so a rebuild under the same tag shows changed=0 — watchtower handles the container recreate on these hosts.