Braiins Farm Proxy SV2 Upgrade Handshake Fail

Roll the proxy back to last-known-good SV1-only config and restart. Restore from `/etc/braiins-farm-proxy/farm-proxy.toml.bak` or comment out the `[[listener]]` block enabling SV2 and leave only SV1 active. `systemctl restart braiins-farm-proxy`. Confirm farm comes back online on SV1 within 5 minutes. This is your safe-state baseline. Never plan an SV2 cutover without a documented rollback that takes <5 minutes.

Verify upstream pool's native SV2 capability before re-attempting. Visit pool docs. Braiins Pool / DEMAND = native SV2 (endpoint typically `stratum2+tcp://v2.stratum.braiins.com:3336` — verify against current docs). F2Pool / Antpool / ViaBTC / NiceHash / Foundry / Luxor / Ocean = SV1-only as of 2026-Q1; plan for translator mode (SV2 downstream, SV1 upstream).

Inventory which miners can speak native SV2. Walk the farm. Note firmware on each miner. SV2-capable: DCENT_OS (any rev), Braiins OS+ >= 23.06, LuxOS >= 2024.1, recent Vnish, Bitaxe AxeOS >= 2.4.x. SV1-only: stock Bitmain bmminer, stock Whatsminer BTMiner, stock Avalon CGMiner-Avalon, stock NerdMiner, PiAxe stock. Mixed fleet = you need both listeners. Document the split before re-cutover.

Configure the proxy with both SV1 and SV2 listeners. Edit `/etc/braiins-farm-proxy/farm-proxy.toml`. Enable two `[[listener]]` blocks: one with `protocol = "sv1"` on `:3333`, one with `protocol = "sv2"` on `:3336`. Single shared `[upstream]` block. Restart the service. `ss -tlnp | grep braiins-farm-proxy` to confirm both ports are bound.

Set upstream mode correctly. Native SV2 pool: `[upstream] mode = "native"`, point at SV2 endpoint. SV1-only pool: `[upstream] mode = "translator"`, point at SV1 endpoint. Proxy speaks SV2 downstream regardless. Restart, watch the log for `upstream subscribe success`.

Re-point each miner to the listener matching its firmware. SV1-only miner -> `stratum+tcp://proxy-host:3333`. SV2-capable miner -> `stratum+tcp://proxy-host:3336` (or `stratum2+tcp://` if firmware requires that scheme). Move 1 SV1 + 1 SV2 miner first, confirm shares flow, then bulk-migrate in batches of 10-20 to keep blast radius small.

Watch hashrate convergence on the pool side for 30 minutes. Pre-cutover hashrate should return within 30 minutes. If it returns to <90% of baseline and stays there, one batch of miners is silently failing — check the proxy log for which workers' authorize is missing, route them back to the protocol-matching listener.

Check NTP on proxy host and every miner. `timedatectl status` on proxy. On miners: DCENT_OS dashboard System->NTP, Braiins OS+ Status->System Time, LuxOS Settings->Time. Any miner more than 5 seconds off real time may fail SV2 handshake — fix NTP first.

Capture the failing handshake. `tcpdump -i any -w sv2-fail.pcap 'port 3336 or port 3337'` on proxy host. Trigger one miner reconnect. Stop capture. Open in Wireshark. SV2 noise XX starts non-printable; SV1 starts with `{`. SV1-style payload arriving on SV2 port = miner is misconfigured, not the proxy.

Roll the proxy version forward (or back). `apt-cache madison braiins-farm-proxy` to list available, or `docker pull braiinssystems/farm-proxy:<tag>`. Read the changelog at academy.braiins.com/en/farm-proxy/release-notes/ for handshake / noise / extranonce fixes. Roll forward; if forward breaks something, roll back one and read again.

Audit static-key pinning. Both ends must agree on proxy's static pubkey. Proxy: `cat /etc/braiins-farm-proxy/keys/proxy.pub`. Pool: log into pool dashboard, navigate to SV2 settings, find authorized-proxy-keys list, confirm proxy's pubkey is registered. If proxy was upgraded and regenerated keys, re-register. Same audit for downstream miners that pin proxy's key.

Update miner firmware to a known-SV2-stable build. DCENT_OS — D-Central's open-source Antminer firmware — is the Mining Hackers' choice for SV2 on Antminer fleets: native noise XX, current spec compliance, public source code, no licensing fees. Alternatives: Braiins OS+ >= 23.06, LuxOS >= 2024.1, recent Vnish. Whatsminer / Avalon / Bitaxe / NerdMiner: use those families' native SV2-capable builds. Stage one miner at a time, validate shares, then bulk-flash.

Switch the proxy from native to translator mode (or vice versa) as a one-shot test. Native upstream against SV1-only pool = handshake fails — flip to translator. Translator against native-SV2 pool = leaves JD/extranonce features on the table — flip to native. Restart, watch log, watch hashrate. Either is valid; the right one depends on what the pool actually supports.

Profile the proxy under cutover load. `ps aux | grep farm-proxy` and watch RSS as you re-introduce miners in batches. RSS climbing >50 MB/min as you add miners = memory-leak-on-handshake bug, typically a malformed-frame parse loop. File a GitHub issue at github.com/stratum-mining/stratum with the packet capture from Step 9 attached.

Stop DIY. Mixed-fleet farm with >50 miners, SV2 cutover stuck >24 hours, AND you've isolated to `noise handshake fails on a subset of miners we can't identify`. Or you're deploying JD-Server-on-a-Bitcoin-node SV2 for full job-declaration sovereignty. Either way you're in operator-engineering territory — book a D-Central Mining Consulting slot.

What D-Central does on the consulting bench: lab-bench reproduce of your farm topology (proxy version, upstream pool, miner firmware mix), packet-capture analysis of every failing handshake leg, recommended config diff with rollback plan, optional staged on-site cutover with a Mining Hacker in the room, optional DCENT_OS flash-and-tune across the Antminer fleet, optional self-hosted JD-Server stand-up so the farm declares its own work end-to-end (max-decentralization config).

What we recommend for new farm builds: deploy DCENT_OS on every Antminer-class miner from day zero, stand up Braiins Farm Proxy in dual-listener mode (SV1 on `:3333` for legacy, SV2 on `:3336` for everything else), upstream to Braiins Pool or your own self-hosted SV2 endpoint with JD enabled. 2026 Mining-Hackers-default farm topology — open-source firmware, open-source proxy, end-to-end SV2 with optional self-declared work.

Document the rollback before you cut over. Save the working SV1 config to `/etc/braiins-farm-proxy/farm-proxy.toml.sv1-baseline`. Write a one-line `rollback.sh`: `cp farm-proxy.toml.sv1-baseline farm-proxy.toml && systemctl restart braiins-farm-proxy`. Test rollback during a low-traffic hour BEFORE the production cutover. SV2 cutovers without a tested rollback are how operators end up calling D-Central at 2 AM.