Tee-worker is the Masa component to scrape data from a secure TEE enclave. It uses the ego framework to build, run and sign the binary.

​
Hardware Prerequisites

​
Required Hardware

🔒 Intel SGX Support

  • Intel SGX 2.0+ enabled CPU required
  • Hardware-level security enclave
  • Secure computation environment

💻 Compatible Processors

  • 11th Gen+ Intel Core series
  • Modern Intel Xeon processors
  • Must have SGX feature enabled in BIOS

Verify your CPU supports Intel SGX 2.0 or higher before setting up mining operations. The SGX feature must also be enabled in your system BIOS.

​
Cloud Provider Recommendations

For optimal TEE mining performance and reliability, we recommend using Microsoft Azure. This provider has been extensively tested and validated by our team to ensure seamless compatibility with Masa Network’s TEE mining requirements:

Microsoft Azure

✓ Offers SGX-enabled virtual machines
✓ Proven reliability for TEE workloads
✓ Validated for Masa Network mining
✓ Our recommended provider

​
Azure instance capacity planning

When running TEE miners on Azure, it’s important to understand the capacity limits to optimize costs and performance. Here’s what we’ve validated:

Instance Specifications

Standard DC4s v2

  • 4 vCPUs
  • 16 GiB Memory
  • SGX-enabled

Miner Capacity

  • Maximum 4 TEE miners per instance
  • 1 miner per vCPU recommended
  • Attempting to run >4 miners causes automatic termination

To optimize costs, you can run multiple miners on a single Azure instance as long as you stay within the vCPU limits. This approach is more cost-effective than running individual instances for each miner.

​
System Setup & Configuration

​
Prerequisites

Before starting TEE mining operations, ensure you have:

Docker Setup

✓ Docker installed and running
✓ Permissions to run containers

Network Keys

✓ BTCLI to installation to manage your wallet
✓ Generate coldkey and hotkey mnemonics and register your miner

Keep your coldkey and hotkey mnemonics secure and backed up. These are required for mining operations and cannot be recovered if lost.

​
Optional: Delegate with Child Key

If you’re running a validator, you can optionally delegate using a child hotkey for enhanced security. This allows you to:

  • Keep your cold key secure
  • Isolate operational risk
  • Manage multiple delegations
  • Set custom take rates (up to 18% of rewards)

The Masa validator charges 0% take rate - you keep 100% of your rewards when delegating to us! See our Validator Child Key Delegation Guide for detailed instructions on secure delegation with child hotkeys. The take rate is subject to change in the near future.

​
Subnet 42 TEE worker setup

To begin mining on Subnet 42, follow these steps to set up your TEE worker:

1

Clone Repository

First, clone the Subnet 42 repository which contains the TEE mining software:

git clone https://github.com/masa-finance/subnet-42.git
2

Navigate to Directory

Change into the repository directory:

cd subnet-42
3

Copy Environment File

Create your environment configuration file:

cp .env.example .env
4

Edit Environment File

Configure your .env file by updating the following fields:

  1. Your coldkey mnemonic from wallet creation
  2. Your hotkey mnemonic from wallet creation
  3. Your role (miner or validator)
  4. Your machine’s public IP address and port 8080
  5. Network UID (165 for testnet, 42 for mainnet)
  6. Network name (test or finney) finney is for mainnet.
  7. Telemetry Result Worker Address (This is the address of the telemetry result worker)
  8. A comma separated list of twitter credentials to use if you want to scrape twitter data
  9. A comma separated list of twitter Bearer API tokens to use. Takes precedence over TWITTER_ACCOUNTS. This is the most reliable way to scrape twitter data.
# Your coldkey mnemonic
COLDKEY_MNEMONIC="your coldkey mnemonic here"

# Your hotkey mnemonic (Will be used to register your miner on subnet 165)
HOTKEY_MNEMONIC="your hotkey mnemonic here"

# Role Configuration
# Node role (validator or miner)
ROLE=miner

# Your IP address
MINER_TEE_ADDRESS=https://<your-ip-address>:8080

# Network Configuration
# Network UID (165 for testnet, 42 for mainnet)
NETUID=165

# Network name (test or finney) finney is for mainnet.
SUBTENSOR_NETWORK=test

# Telemetry Result Worker Address (This is the address of the telemetry result worker) 
TELEMETRY_RESULT_WORKER_ADDRESS=https://<your-ip-address>:8080

### A comma separated list of twitter credentials to use
TWITTER_ACCOUNTS="foo:bar,foo:baz"

### A comma separated list of twitter Bearer API tokens to use. Takes precedence over TWITTER_ACCOUNTS
TWITTER_API_KEYS="apikey1,apikey2"

The .env file comes pre-configured for the Subnet 165 testnet environment. No additional network configuration is needed.

When running multiple miners on one instance, you will need to create separate configuration files for each miner. Each config file should have unique settings like ports and wallet keys to avoid conflicts between miners.

5

Start Your Node

Start your node with Docker Compose based on your configured role:

For validators:

docker compose --profile validator up -d

For miners:

docker compose --profile miner up -d

This will:

  • Launch the required containers for your node type
  • Initialize your validator or miner node
  • Connect to the subnet network
6

Monitor Logs

Monitor your miner’s logs to ensure everything is running properly:

To see TEE worker logs:

docker logs subnet-42-tee-worker-1

To see miner or validator logs:

docker logs subnet-42-subnet42-1

Watch for:

  • Successful network connections
  • Mining activity
  • Any potential errors or warnings

It may take a few minutes for your miner to fully sync with the network and begin mining operations.

​
Frequently Asked Questions

​
⚙️ Setup & Configuration