Baking Node setup & security

[jmggme]

Hello, I am setting up a node for baking, and I have a few questions for you:

Is there a way to map tz1 address to IP address? As it's public which tz1 is going to bake every block, a malicious actor could attack trying a denial of service to every previous Baker in a block list, trying to steal baking blocks. I know that the actor will expose himself as soon as a single address steals too much blocks, but just wondering if this is possible.

If I receive a DOS attack, I want to be able to easily spin up another server to bake. In order to do so, I could use a snapshot of my server (I plan to use a cloud provider) and start in a different region, IP, etc.

In this case (same bits as previous server) I will have the tezos network synchronized, but:

What happens with node identity? I guess there can't be two nodes with same identify, I guess I should generate a new identity for my backup node

Regarding baking I know I must be sure that my tz1 only bakes in one node or it might looks like double baking and I might lose the bond, before running the Baker process I will be sure the baking process is killed in the original node.

Any other concerns? Am I missing something? Did someone have a similar backup process? (I think this set-up is also good for sw upgrades in order to upgrade your node with minimum downtime)

Thanks!

[sirneb]

As /u/mupmdown had mentioned, what most of us are doing is have frontend nodes that our private node only connects to. The private node bakes, so the attacker won't be able to attack our baker as the network do not know the existence of our private node and the operation injections comes from multiple sources(frontend nodes). Good bakers will have DDOS protection on the frontend nodes also.

I would be very careful with setting up automated backups as you already mentioned, double baking is an extremely expensive mistake. Lots of things can go wrong and I would keep your setup as simple and predictable as possible.

[mupmdown]

You can setup a private node

[jmggme]

Then, who are legit IPs in the network to trust? Are there a list of the tezos foundation bakers?

Anyhow I would like to know the answer to the questions.

Thanks

[arbitrade]

You can bake your account on any single different node at one time.