feat: add bootstrap peers auto-discovery from shipped config file

Introduce `bootstrap_peers.toml`, a dedicated config file that provides
initial bootstrap peer addresses for joining the production network.
The file is auto-discovered on startup from well-known locations (next
to the binary, platform config dir, /etc/ant/) when no --bootstrap CLI
argument is provided.

- Add BootstrapPeersConfig struct with TOML parsing and search-path discovery
- Integrate into Cli::into_config() with clear precedence:
  --bootstrap CLI > --config file > auto-discovered bootstrap_peers.toml
- Log which bootstrap source was used on startup
- Ship bootstrap_peers.toml in release archives alongside binaries
- Add 7 production bootstrap node addresses
- Add unit tests for parsing, discovery, and edge cases
- Update README with bootstrap peers file format and search paths
- Clean up stale saorsa bootstrap references from CLAUDE.md

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jacderida

.github/workflows/release.yml

@@ -166,15 +166,19 @@ jobs:
       - name: Create archive (Unix)
         if: matrix.archive == 'tar.gz'
         run: |
+          cp config/bootstrap_peers.toml target/${{ matrix.target }}/release/
           cd target/${{ matrix.target }}/release
-          tar -czvf ../../../ant-node-cli-${{ matrix.friendly_name }}.tar.gz ${{ matrix.binary }} ant-keygen
+          tar -czvf ../../../ant-node-cli-${{ matrix.friendly_name }}.tar.gz ${{ matrix.binary }} ant-keygen bootstrap_peers.toml
           cd ../../..
 
       - name: Create archive (Windows)
         if: matrix.archive == 'zip'
         shell: pwsh
         run: |
-          Compress-Archive -Path "target/${{ matrix.target }}/release/${{ matrix.binary }}", "target/${{ matrix.target }}/release/ant-keygen.exe" -DestinationPath "ant-node-cli-${{ matrix.friendly_name }}.zip"
+          Copy-Item "config/bootstrap_peers.toml" "target/${{ matrix.target }}/release/bootstrap_peers.toml"
+          Push-Location "target/${{ matrix.target }}/release"
+          Compress-Archive -Path "${{ matrix.binary }}", "ant-keygen.exe", "bootstrap_peers.toml" -DestinationPath "../../../ant-node-cli-${{ matrix.friendly_name }}.zip"
+          Pop-Location
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4

CLAUDE.md

@@ -32,9 +32,6 @@ cargo run --release -- --listen 0.0.0.0:10000 --bootstrap
 # Run additional instance (use any port in range 10000-10999)
 cargo run --release -- --listen 0.0.0.0:10001
 
-# Run as regular node connecting to bootstrap
-cargo run --release -- --listen 0.0.0.0:10000 --connect saorsa-2.saorsalabs.com:10000
-
 # Run with debug logging
 RUST_LOG=debug cargo run --release -- --listen 0.0.0.0:10000
 ```
@@ -97,31 +94,15 @@ When testing or developing ant-node:
 # CORRECT - ant-node operations (within 10000-10999)
 cargo run --release -- --listen 0.0.0.0:10000
 cargo run --release -- --listen 0.0.0.0:10001  # Second instance OK
-ssh root@saorsa-2.saorsalabs.com "systemctl restart ant-node-bootstrap"
-
-# WRONG - Would disrupt other networks
-ssh root@saorsa-2.saorsalabs.com "pkill -f ':9'"    # NEVER - matches ant-quic ports
-ssh root@saorsa-2.saorsalabs.com "pkill -f ':11'"   # NEVER - matches communitas ports
-ssh root@saorsa-2.saorsalabs.com "systemctl restart ant-quic-bootstrap"  # NOT OUR SERVICE
 ```
 
-### Bootstrap Endpoints (ant-node)
-```
-saorsa-2.saorsalabs.com:10000  (NYC - 142.93.199.50)
-saorsa-3.saorsalabs.com:10000  (SFO - 147.182.234.192)
-```
+### Bootstrap Peers Configuration
+
+Production bootstrap peer addresses are defined in `config/bootstrap_peers.toml`.
+This file is shipped alongside the binary in release archives and is auto-discovered
+on startup when no `--bootstrap` CLI argument is provided.
 
 ### Before Any VPS Operations
 1. Verify you're targeting ports 10000-10999 only
 2. Double-check service names contain "ant-node"
 3. Never run broad `pkill` commands that could affect other services
-
-### Deploy New Binary
-```bash
-# Build release binary
-cargo build --release
-
-# Deploy to bootstrap node
-scp target/release/ant-node root@saorsa-2.saorsalabs.com:/opt/ant-node/
-ssh root@saorsa-2.saorsalabs.com "systemctl restart ant-node-bootstrap"
-```

README.md

@@ -739,19 +739,32 @@ For production deployments, run ant-node under a service manager so it restarts
 
 ### systemd (Linux)
 
-A service file is included at `systemd/ant-node.service` and installed automatically by RPM/DEB packages.
+Create a service file at `/etc/systemd/system/ant-node.service`:
+
+```ini
+[Unit]
+Description=Ant Node
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/ant-node --stop-on-upgrade
+Restart=always
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target
+```
 
 ```bash
-# Install and enable
-sudo cp systemd/ant-node.service /etc/systemd/system/
 sudo systemctl daemon-reload
 sudo systemctl enable --now ant-node
 ```
 
 Key settings:
 - `--stop-on-upgrade` tells the node to exit cleanly after applying an upgrade
 - `Restart=always` ensures systemd restarts the node after the upgrade exit
-- Security hardening (NoNewPrivileges, ProtectSystem, etc.) is pre-configured
 
 ### launchd (macOS)
 
@@ -869,24 +882,25 @@ cargo build --release
 ./target/release/ant-node
 ```
 
-### Join Testnet
+### Join the Network
+
+On first startup, the node needs bootstrap peers to join the network.
+Production bootstrap peers are shipped in `bootstrap_peers.toml` alongside
+the binary and are loaded automatically:
 
 ```bash
-# Connect to testnet bootstrap nodes
-./target/release/ant-node --testnet
+# Starts and auto-discovers bootstrap_peers.toml next to the binary
+./target/release/ant-node
+```
+
+You can also specify bootstrap peers explicitly:
 
-# Or specify bootstrap peers manually
+```bash
 ./target/release/ant-node \
-    --bootstrap "165.22.4.178:12000" \
-    --bootstrap "164.92.111.156:12000"
+    --bootstrap "10.0.0.1:10000" \
+    --bootstrap "10.0.0.2:10000"
 ```
 
-**Testnet Bootstrap Nodes:**
-| Node | Location | Address |
-|------|----------|---------|
-| ant-bootstrap-1 | NYC (DigitalOcean) | `165.22.4.178:12000` |
-| ant-bootstrap-2 | SFO (DigitalOcean) | `164.92.111.156:12000` |
-
 ### Full Configuration
 
 ```bash
@@ -920,8 +934,8 @@ Options:
         [default: dual]
 
     --bootstrap <ADDR>
-        Bootstrap peer multiaddresses (can be specified multiple times)
-        Example: /ip4/1.2.3.4/udp/12000/quic-v1
+        Bootstrap peer socket addresses (can be specified multiple times)
+        Example: 1.2.3.4:10000
 
     --migrate-ant-data <PATH>
         Path to legacy ant-node data directory to migrate
@@ -948,9 +962,41 @@ Options:
 
 Configuration sources (highest to lowest priority):
 
-1. **Command-line arguments**
+1. **Command-line arguments** (e.g., `--bootstrap`)
 2. **Environment variables** (`ANT_*`)
-3. **Configuration file** (`~/.ant-node/config.toml`)
+3. **Configuration file** (`--config path/to/config.toml`)
+4. **Bootstrap peers file** (auto-discovered `bootstrap_peers.toml`)
+
+### Bootstrap Peers File
+
+The `bootstrap_peers.toml` file provides initial peers for joining the network.
+It is shipped alongside the binary in release archives and auto-discovered on startup
+when no `--bootstrap` CLI argument is provided.
+
+**Format:**
+```toml
+peers = [
+    "10.0.0.1:10000",
+    "10.0.0.2:10000",
+]
+```
+
+**Search order** (first match wins):
+
+| Priority | Source | Path |
+|----------|--------|------|
+| 1 | `$ANT_BOOTSTRAP_PEERS_PATH` env var | Explicit path to file |
+| 2 | Executable directory | `<exe_dir>/bootstrap_peers.toml` |
+| 3 | Platform config dir | Linux: `~/.config/ant/bootstrap_peers.toml` |
+|   |                      | macOS: `~/Library/Application Support/ant/bootstrap_peers.toml` |
+|   |                      | Windows: `%APPDATA%\ant\bootstrap_peers.toml` |
+| 4 | System config (Unix) | `/etc/ant/bootstrap_peers.toml` |
+
+**Bootstrap peer precedence** (highest wins):
+1. `--bootstrap` CLI argument or `ANT_BOOTSTRAP` env var
+2. `bootstrap = [...]` in a `--config` file
+3. Auto-discovered `bootstrap_peers.toml`
+4. Empty (node cannot join an existing network)
 
 ### Environment Variables
 
@@ -968,15 +1014,12 @@ export ANT_UPGRADE_CHANNEL=stable
 `~/.ant-node/config.toml`:
 
 ```toml
-[node]
 root_dir = "~/.ant-node"
 port = 0  # Auto-select
-
-[network]
 ip_version = "dual"
 bootstrap = [
-    "/ip4/165.22.4.178/udp/12000/quic-v1",
-    "/ip4/164.92.111.156/udp/12000/quic-v1"
+    "10.0.0.1:10000",
+    "10.0.0.2:10000",
 ]
 
 [upgrade]

config/bootstrap_peers.toml

@@ -0,0 +1,17 @@
+# Autonomi Network — Bootstrap Peers
+#
+# This file provides initial peers for joining the production network.
+# It is loaded automatically when no --bootstrap CLI argument is provided.
+#
+# Format: "ip:port" socket addresses.
+# Port range for ant-node: 10000-10999.
+
+peers = [
+    "207.148.94.42:10000",
+    "45.77.50.10:10000",
+    "66.135.23.83:10000",
+    "149.248.9.2:10000",
+    "167.235.201.229:10000",
+    "178.156.129.121:10000",
+    "18.228.202.183:10000",
+]

src/bin/ant-node/cli.rs

@@ -1,8 +1,8 @@
 //! Command-line interface definition.
 
 use ant_node::config::{
-    BootstrapCacheConfig, EvmNetworkConfig, IpVersion, NetworkMode, NodeConfig, PaymentConfig,
-    UpgradeChannel,
+    BootstrapCacheConfig, BootstrapPeersConfig, BootstrapSource, EvmNetworkConfig, IpVersion,
+    NetworkMode, NodeConfig, PaymentConfig, UpgradeChannel,
 };
 use clap::{Parser, ValueEnum};
 use std::net::SocketAddr;
@@ -185,30 +185,45 @@ pub enum CliNetworkMode {
 }
 
 impl Cli {
-    /// Convert CLI arguments into a `NodeConfig`.
+    /// Convert CLI arguments into a `NodeConfig` and the source of bootstrap peers.
+    ///
+    /// # Bootstrap peer precedence (highest to lowest)
+    ///
+    /// 1. `--bootstrap` CLI argument (or `ANT_BOOTSTRAP` env var)
+    /// 2. `bootstrap` field in a `--config` file
+    /// 3. Auto-discovered `bootstrap_peers.toml` from well-known paths
+    /// 4. Empty list
     ///
     /// # Errors
     ///
     /// Returns an error if a config file is specified but cannot be loaded.
-    pub fn into_config(self) -> color_eyre::Result<NodeConfig> {
+    pub fn into_config(self) -> color_eyre::Result<(NodeConfig, BootstrapSource)> {
         // Start with default config or load from file
+        let has_config_file = self.config.is_some();
         let mut config = if let Some(ref path) = self.config {
             NodeConfig::from_file(path)?
         } else {
             NodeConfig::default()
         };
 
+        // Track whether CLI provided bootstrap peers.
+        let cli_bootstrap_provided = !self.bootstrap.is_empty();
+
         // Override with CLI arguments
         if let Some(root_dir) = self.root_dir {
             config.root_dir = root_dir;
         }
 
         config.port = self.port;
         config.ip_version = self.ip_version.into();
-        config.bootstrap = self.bootstrap;
         config.log_level = self.log_level.into();
         config.network_mode = self.network_mode.into();
 
+        // Apply CLI bootstrap peers if provided; otherwise keep config file value.
+        if cli_bootstrap_provided {
+            config.bootstrap = self.bootstrap;
+        }
+
         // Upgrade config
         config.upgrade.channel = self.upgrade_channel.into();
         config.upgrade.stop_on_upgrade = self.stop_on_upgrade;
@@ -229,7 +244,25 @@ impl Cli {
             ..config.bootstrap_cache
         };
 
-        Ok(config)
+        // Determine bootstrap source and apply auto-discovery if needed.
+        let bootstrap_source = if cli_bootstrap_provided {
+            BootstrapSource::Cli
+        } else if !config.bootstrap.is_empty() && has_config_file {
+            BootstrapSource::ConfigFile
+        } else if config.bootstrap.is_empty() {
+            // No peers from CLI or config file — try auto-discovery.
+            if let Some((peers_config, path)) = BootstrapPeersConfig::discover() {
+                config.bootstrap = peers_config.peers;
+                BootstrapSource::AutoDiscovered(path)
+            } else {
+                BootstrapSource::None
+            }
+        } else {
+            // Config had peers from default (e.g., testnet preset) but no --config file.
+            BootstrapSource::None
+        };
+
+        Ok((config, bootstrap_source))
     }
 }
 

src/bin/ant-node/main.rs

@@ -3,6 +3,7 @@
 mod cli;
 mod platform;
 
+use ant_node::config::BootstrapSource;
 use ant_node::NodeBuilder;
 use clap::Parser;
 use cli::{Cli, CliLogFormat};
@@ -97,7 +98,32 @@ async fn main() -> color_eyre::Result<()> {
     };
 
     // Build configuration
-    let config = cli.into_config()?;
+    let (config, bootstrap_source) = cli.into_config()?;
+
+    match &bootstrap_source {
+        BootstrapSource::Cli => {
+            info!(
+                count = config.bootstrap.len(),
+                "Bootstrap peers provided via CLI"
+            );
+        }
+        BootstrapSource::ConfigFile => {
+            info!(
+                count = config.bootstrap.len(),
+                "Bootstrap peers loaded from config file"
+            );
+        }
+        BootstrapSource::AutoDiscovered(path) => {
+            info!(
+                count = config.bootstrap.len(),
+                path = %path.display(),
+                "Bootstrap peers loaded from discovered config"
+            );
+        }
+        BootstrapSource::None => {
+            warn!("No bootstrap peers configured — node will not be able to join an existing network");
+        }
+    }
 
     // Build and run the node
     let mut node = NodeBuilder::new(config).build().await?;