Skip to content

The Sovereign Stack: A Complete Guide to Bitcoin Core Full Nodes

Created: 2026-11-06  ·  Last updated: 2026-11-06  ·  Nejat Hakan

Foreword — The Final Step in the Bitcoin Journey: You have studied Bitcoin's monetary properties and acquired your first satoshis. Yet as long as you rely on third-party exchanges, public block explorers, or vendor-hosted wallet backends to tell you your balance and broadcast your transactions, you are a guest in someone else's system—leaking your IP address, linking your UTXOs, and trusting external servers to follow consensus rules. This technical book is your blueprint for becoming a first-class, sovereign participant in the Bitcoin network using an uncompromising Dual-Citadel Hardware Architecture.

  • 100% Independent Validation

    Verify every block, script signature, and consensus rule from the 2009 Genesis Block to the chain tip (bitcoind with txindex=1) on your own hardware.

  • Dual-Citadel Air-Gap Isolation

    Physically separate your always-on Node Server from a permanently offline Client Citadel used exclusively for inspecting and signing PSBTs.

  • Tor-Only Network Privacy

    Conceal your residential IP address and ISP metadata by routing peer propagation and remote watch-only wallet connections over Tor v3 Onion Services.

  • Cryptographic Supply-Chain Verification

    Never run an unverified binary. Authenticate both Bitcoin Core (SHA256SUMS.asc) and Sparrow Wallet against developer PGP keys before installation.

Part 1: The Foundation & Dual-Citadel Architecture

1.1 The Three Pillars of a Full Node

A Bitcoin Core Full Node (bitcoind) does not mine blocks; it enforces the rules on miners and peers alike:

  1. The Guardian (Consensus Validation): Independently verifies that no block creates coins beyond the halving schedule, no UTXO is double-spent, and every ECDSA/Schnorr (secp256k1) signature is mathematically valid.
  2. The Historian (Private Ledger & Mempool): Maintains a local, indexed copy of the entire blockchain (~700 GB+) and unconfirmed transaction mempool so you never query a public block explorer.
  3. The Sovereign Broadcaster (Peer Propagation): Injects your signed transactions directly into the peer-to-peer gossip network over Tor without an intermediary gatekeeper.

1.2 The Dual-Citadel Security Model

General-purpose laptops and smartphones are exposed to browser exploits, supply-chain npm/pip packages, and telemetry daemons. True operational security demands strict physical role separation across dedicated single-purpose devices:

%%{init: {'flowchart': {'wrappingWidth': 350, 'subGraphTitleMargin': {'top': 15, 'bottom': 15}}}}%%
flowchart TB
    subgraph OnlineZone["Online Network (Tor)"]
        TOR["🧅 Bitcoin P2P (Tor v3)"]
        NODE["🛡️ Node Server (Pi 5)<br/>bitcoind + 2TB SSD"]
        DAILY["💻 Daily Driver PC<br/>Watch-Only Wallet"]
        TOR <--> NODE
        NODE <--> DAILY
    end

    SNEAK["💾 Sneakernet microSD<br/>(Air-Gapped PSBT)"]

    subgraph AirGapZone["Air-Gapped Vault"]
        CITADEL["🏰 Cold Citadel (Pi 5)<br/>Offline / No Radios"]
        HWW["🔑 Hardware Wallet<br/>(Coldcard / BitBox02)"]
        CITADEL <--> HWW
    end

    DAILY ==>|"1. Export PSBT"| SNEAK
    SNEAK ==>|"2. Sign Offline"| CITADEL
    CITADEL ==>|"3. Return Signed"| SNEAK
    SNEAK ==>|"4. Broadcast"| NODE

1.3 Bill of Materials (Hardware Blueprint)

Component Machine 1: The Node Server (24/7 Headless) Machine 2: The Client Citadel (Air-Gapped Signer) Engineering Rationale
Compute Board Raspberry Pi 5 (8 GB RAM) Raspberry Pi 4 (4 GB) or Pi 5 (4 GB/8 GB) Pi 5 includes ARMv8.2 Crypto Extensions (hardware SHA256/AES), accelerating Initial Block Download (IBD) by >3×.
Power Supply Official 27W USB-C PD (5.1V / 5A) Official USB-C PSU Prevents under-voltage I/O errors during heavy LevelDB chainstate compaction.
OS Boot Media 32 GB Industrial High-Endurance microSD 32 GB High-Endurance microSD Separates the Debian OS from the high-write blockchain data drive.
Primary Storage 2 TB NVMe SSD (PCIe HAT) or SATA SSD 8 GB – 16 GB Sneakernet microSD + USB Reader Never store the blockchain on a microSD card; 2 TB provides years of growth headroom for blocks/ and txindex.
Network State Wired Gigabit Ethernet (eth0) + Tor 100% Disconnected (rfkill + dtoverlay=disable-wifi) Eliminates remote exfiltration vectors on the signing machine.

Part 2: Building Machine 1 — The Hardened Node Server

2.1 Base OS Provisioning & Storage Preparation

Flash Raspberry Pi OS Lite (64-bit / Debian 12 Bookworm) onto the Node Server's microSD card, connect the 2 TB SSD and Ethernet cable, and log in via SSH.

# File: /opt/bitcoin-ops/01_prepare_node_server.sh
#!/usr/bin/env bash
set -euo pipefail

# 1. Update Debian packages and install security, Tor, and verification tooling
sudo apt update && sudo apt full-upgrade -y
sudo apt install -y ufw fail2ban tor gpg curl jq wget libevent-dev

# 2. Harden UFW firewall (Allow SSH from local LAN only; block all unsolicited inbound)
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp comment 'LAN SSH'
sudo ufw allow from 192.168.1.0/24 to any port 8332 proto tcp comment 'LAN Sparrow RPC'
sudo ufw --force enable

# 3. Create dedicated unprivileged system user 'bitcoin' (no login shell)
if ! id -u bitcoin >/dev/null 2>&1; then
    sudo useradd --system --home-dir /var/lib/bitcoin --create-home --shell /usr/sbin/nologin bitcoin
fi

Format the 2 TB SSD (/dev/nvme0n1 or /dev/sda) with ext4 (reserving 1% root blocks instead of 5% to reclaim ~80 GB of usable space, and using noatime to eliminate unnecessary metadata writes):

# File: /opt/bitcoin-ops/02_mount_blockchain_ssd.sh
# WARNING: Verify block device name with 'lsblk' before formatting!
SSD_PART="/dev/nvme0n1p1"
sudo mkfs.ext4 -m 1 -L "bitcoin-data" "$SSD_PART"

# Mount persistently at /var/lib/bitcoin via UUID
SSD_UUID=$(sudo blkid -s UUID -o value "$SSD_PART")
echo "UUID=${SSD_UUID} /var/lib/bitcoin ext4 defaults,noatime,nodiratime,nofail 0 2" | sudo tee -a /etc/fstab
sudo mount -a
sudo chown -R bitcoin:bitcoin /var/lib/bitcoin
sudo chmod 0750 /var/lib/bitcoin

2.2 Cryptographic Verification & Installation of Bitcoin Core

Never install bitcoind from unverified third-party PPAs. Download the official aarch64-linux-gnu release tarball, SHA256SUMS, and SHA256SUMS.asc, then verify them against the Bitcoin Core Guix Builder PGP keys.

%%{init: {'flowchart': {'wrappingWidth': 350}}}%%
flowchart TB
    TAR["📦 bitcoin-28.0<br/>Release Archive"]
    ASC["✍️ SHA256SUMS.asc<br/>Guix Builder PGP Sigs"]
    SUM["📄 SHA256SUMS<br/>Verified Checksums"]
    INSTALL["✅ /usr/local/bin/<br/>bitcoind & CLI"]

    TAR -->|"sha256sum"| SUM
    ASC -->|"gpg --verify"| SUM
    SUM -->|"Verified OK"| INSTALL
# File: /opt/bitcoin-ops/03_verify_install_bitcoin_core.sh
#!/usr/bin/env bash
set -euo pipefail

VERSION="28.0"
ARCH="aarch64-linux-gnu"
mkdir -p /tmp/bitcoin-verify && cd /tmp/bitcoin-verify

# 1. Download official binary tarball, checksums, and multi-builder PGP signatures
curl -fLO "https://bitcoincore.org/bin/bitcoin-core-${VERSION}/bitcoin-${VERSION}-${ARCH}.tar.gz"
curl -fLO "https://bitcoincore.org/bin/bitcoin-core-${VERSION}/SHA256SUMS"
curl -fLO "https://bitcoincore.org/bin/bitcoin-core-${VERSION}/SHA256SUMS.asc"

# 2. Verify SHA-256 hash of the downloaded archive (Must output: OK)
sha256sum --ignore-missing --check SHA256SUMS

# 3. Import official Bitcoin Core Guix builder keys & verify PGP signatures
git clone --depth 1 https://github.com/bitcoin-core/guix.sigs.git
gpg --import guix.sigs/builder-keys/*
gpg --verify SHA256SUMS.asc SHA256SUMS

# 4. Install verified binaries into /usr/local/bin with root:root 0755 permissions
tar -xzf "bitcoin-${VERSION}-${ARCH}.tar.gz"
sudo install -m 0755 -o root -g root -t /usr/local/bin "bitcoin-${VERSION}/bin/"*
bitcoind --version

2.3 Production bitcoin.conf & Hardened systemd Unit

Configure bitcoind with a full transaction index (txindex=1), optimized dbcache (2048 MB for an 8 GB Pi), wallet disabled on the server (disablewallet=1), and Tor proxy integration.

# File: /etc/bitcoin/bitcoin.conf
# --- Server & Indexing ---
server=1
daemon=0
txindex=1
blockfilterindex=1
peerblockfilters=1
disablewallet=1

# --- Memory & Performance Tuning (8 GB RAM Pi 5) ---
dbcache=2048
maxmempool=300
maxconnections=40

# --- Tor Privacy & Network Isolation ---
proxy=127.0.0.1:9050
listen=1
bind=127.0.0.1
onlynet=onion
onlynet=cjdns

# --- Local RPC for Watch-Only Sparrow Wallet ---
rpcbind=127.0.0.1
rpcbind=192.168.1.50
rpcallowip=127.0.0.1
rpcallowip=192.168.1.0/24

# File: /etc/systemd/system/bitcoind.service
[Unit]
Description=Bitcoin Core Full Node Daemon
After=network-online.target tor.service
Wants=network-online.target

[Service]
ExecStart=/usr/local/bin/bitcoind -conf=/etc/bitcoin/bitcoin.conf -datadir=/var/lib/bitcoin -pid=/run/bitcoind/bitcoind.pid
ExecStop=/usr/local/bin/bitcoin-cli -conf=/etc/bitcoin/bitcoin.conf -datadir=/var/lib/bitcoin stop

User=bitcoin
Group=bitcoin
Type=simple
Restart=on-failure
TimeoutStartSec=infinity
TimeoutStopSec=600

RuntimeDirectory=bitcoind
RuntimeDirectoryMode=0710

# --- Mandatory systemd Security Hardening ---
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
NoNewPrivileges=true
PrivateDevices=true
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target

# File: /etc/tor/torrc (Append to bottom)
ControlPort 9051
CookieAuthentication 1
CookieAuthFileGroupReadable 1

# Expose Bitcoin RPC privately over Tor v3 for remote watch-only wallets
HiddenServiceDir /var/lib/tor/bitcoin-rpc/
HiddenServiceVersion 3
HiddenServicePort 8332 127.0.0.1:8332

Enable the service and allow the bitcoin user to read Tor's authentication cookie:

# File: /opt/bitcoin-ops/04_enable_bitcoind.sh
sudo usermod -aG debian-tor bitcoin
sudo systemctl restart tor
sudo systemctl daemon-reload
sudo systemctl enable --now bitcoind

# Monitor real-time verification progress:
sudo -u bitcoin bitcoin-cli -datadir=/var/lib/bitcoin getblockchaininfo

Part 3: Building Machine 2 — The Air-Gapped Client Citadel

The Client Citadel is your offline signing terminal. It runs Raspberry Pi OS with Desktop (64-bit) and Sparrow Wallet to inspect transaction inputs/outputs, verify change addresses, and coordinate hardware wallet signatures.

3.1 Permanent Radio Disablement (/boot/firmware/config.txt)

Before booting the Client Citadel into its permanent air-gapped life, disable onboard Wi-Fi and Bluetooth at the hardware Device Tree level so they cannot be enabled in software:

# File: /boot/firmware/config.txt (On Machine 2: Client Citadel)
dtoverlay=disable-wifi
dtoverlay=disable-bt

3.2 Initial Controlled Installation & Verification of Sparrow Wallet

During initial build, connect an Ethernet cable briefly to update the base Debian packages and verify the Sparrow Wallet ARM64 .deb package against developer Craig Raw's PGP key:

# File: /opt/citadel-ops/install_sparrow_verified.sh
#!/usr/bin/env bash
set -euo pipefail

SPARROW_VER="2.0.0"
mkdir -p ~/sparrow-verify && cd ~/sparrow-verify

# 1. Update OS security packages
sudo apt update && sudo apt full-upgrade -y
sudo apt install -y gpg curl

# 2. Import Craig Raw's PGP public key and download Sparrow ARM64 release + manifest
curl -fLO https://keybase.io/craigraw/pgp_keys.asc
gpg --import pgp_keys.asc

curl -fLO "https://github.com/sparrowwallet/sparrow/releases/download/${SPARROW_VER}/sparrow_${SPARROW_VER}-1_arm64.deb"
curl -fLO "https://github.com/sparrowwallet/sparrow/releases/download/${SPARROW_VER}/sparrow-${SPARROW_VER}-manifest.txt"
curl -fLO "https://github.com/sparrowwallet/sparrow/releases/download/${SPARROW_VER}/sparrow-${SPARROW_VER}-manifest.txt.asc"

# 3. Verify PGP signature on manifest and SHA-256 checksum of .deb installer
gpg --verify "sparrow-${SPARROW_VER}-manifest.txt.asc" "sparrow-${SPARROW_VER}-manifest.txt"
sha256sum --ignore-missing --check "sparrow-${SPARROW_VER}-manifest.txt"

# 4. Install verified package, then shut down and disconnect Ethernet permanently!
sudo apt install -y "./sparrow_${SPARROW_VER}-1_arm64.deb"
echo "Verification & installation complete. Shutting down to sever network..."

Enforcing the Air Gap

Once sparrow is installed, run sudo poweroff, physically unplug the Ethernet cable, and boot the Client Citadel back up. From this moment forward, the Client Citadel's default state is 100% offline.

Part 4: Sovereign Operations — The Air-Gapped PSBT Workflow

With your stack operational, private keys remain inside your Hardware Wallet, transaction inspection happens on your offline Client Citadel, and blockchain indexing/broadcasting happens on your Node Server.

Step Device Used Action Performed Security Guarantee
1. Watch-Only Setup Daily Driver PC + Node Server Import only the xpub (Extended Public Key) into Sparrow on your Daily Driver PC, connected via RPC to your Node Server Pi. Daily Driver PC can see balances and UTXOs privately via your node, but cannot spend a single satoshi.
2. Draft Unsigned PSBT Daily Driver PC Select UTXOs, set recipient address and fee rate (sat/vB), and click Save Transaction → tx_unsigned.psbt onto the Sneakernet microSD. No private keys exist on the online PC.
3. Offline Audit & Sign Air-Gapped Client Citadel + Hardware Wallet Insert the microSD into the offline Client Citadel. Open tx_unsigned.psbt in Sparrow, visually verify the recipient address, change address, and fee on both Sparrow and the Hardware Wallet screen, then sign → tx_signed.psbt. Even if your Daily Driver PC had clipboard malware, the offline Citadel + Hardware Wallet screen expose the tampered address before signing.
4. Private Broadcast Daily Driver PC → Node Server → Tor Move the microSD back to the Daily Driver PC, load tx_signed.psbt, and click Broadcast Transaction. Your Node Server relays it over Tor. Zero third-party block explorers or web servers ever learn your IP or UTXO graph.

Part 5: Lifecycle Maintenance & The Secure Update Ritual

5.1 Auditing Your Own Ledger via bitcoin-cli

Replace public block explorers (mempool.space, blockstream.info) with direct CLI queries on your Node Server:

# File: /opt/bitcoin-ops/node_explorer_cli.sh
# 1. Inspect sync height, disk usage, and active soft-forks
sudo -u bitcoin bitcoin-cli getblockchaininfo

# 2. Check Tor onion peer connections and local onion address
sudo -u bitcoin bitcoin-cli getnetworkinfo
sudo -u bitcoin bitcoin-cli getpeerinfo | jq '.[] | {addr, subver, network, synced_headers}'

# 3. Inspect current mempool size and minimum relay fee
sudo -u bitcoin bitcoin-cli getmempoolinfo

# 4. Look up any raw transaction across the entire history (enabled by txindex=1)
# sudo -u bitcoin bitcoin-cli getrawtransaction "<txid>" true

5.2 The Ritualized Offline Update Protocol (Every 3–6 Months)

How do you patch an air-gapped machine without compromising its security posture? By executing a strict, disciplined Controlled Update Ritual:

  1. Disconnect All Signing Media: Ensure your Hardware Wallet and Sneakernet microSD card are physically unplugged and stored away from the Client Citadel before powering it on.
  2. Prepare Commands Offline: Boot the Client Citadel, open a terminal, and prepare the exact update commands (sudo apt update && sudo apt full-upgrade -y).
  3. Brief Controlled Online Window: Plug in the Ethernet cable, execute the GPG-verified package updates immediately, and never open a web browser for general browsing.
  4. Sever & Reboot: Run sudo poweroff, unplug the Ethernet cable, wait 10 seconds, and boot back into pure air-gapped operation.

5.3 What to Back Up (And What Never to Back Up)

Asset Backup Strategy Why
24-Word Seed Phrase + Passphrase Physical Metal/Paper Backup ONLY (Stored in geographically separate safes; NEVER typed into any computer or photographed). Your seed phrase is your Bitcoin. Everything else is replaceable hardware.
Wallet Descriptor / Output File Export the public wallet descriptor (xpub + derivation path, especially critical for Multisig) onto an encrypted USB/microSD backup. Required alongside seed words to reconstruct multisig scripts (wsh(sortedmulti(...))).
Node Config (bitcoin.conf, torrc) Back up to your infrastructure Git repository. Allows rapid node rebuild in < 15 minutes if hardware fails.
Blockchain Data (/var/lib/bitcoin/blocks) NEVER BACK UP. The 700 GB+ blockchain is public data that your node can re-verify from peers at any time.

Where to Go Next

Explore the cryptographic foundations of Bitcoin and the underlying Linux hardware and security guides:

  • Bitcoin Architecture & Economics

    Deep dive into the UTXO model, SHA-256 Proof-of-Work, halving monetary policy, and technical counterarguments to common criticisms.

    Bitcoin Introduction

  • Raspberry Pi Hardware Engineering

    Master ARM64 NVMe booting, vcgencmd power/thermal diagnostics, and SD card endurance hardening for your node hardware.

    Raspberry Pi Masterclass

  • Linux Security & Hardening

    Harden SSH, ufw, AppArmor, and kernel sysctl parameters across your Debian Linux servers.

    Linux Hardening