diff --git a/.env b/.env index 060f7b4a61..1de3a0555b 100644 --- a/.env +++ b/.env @@ -1 +1,24 @@ +# Your data directory setting HOST_DATA_DIR=./reth-data + +# Network Configuration +RETH_CHAIN=base +BASE_NODE_NETWORK=base +RETH_SEQUENCER_HTTP=https://mainnet-sequencer.base.org + +# L1 (Ethereum) Configuration +# You need to enter your own L1 provider URLs (Alchemy, Infura, etc.) here. +BASE_NODE_L1_ETH_RPC= +BASE_NODE_L1_BEACON= +BASE_NODE_L1_TRUST_RPC="false" + +# Engine Configuration +BASE_NODE_L2_ENGINE_RPC=ws://execution:8551 +BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt +# [CRITICAL] Your unique 64-character hex secret goes here. +# You can generate this in your terminal using the command: openssl rand -hex 32 +BASE_NODE_L2_ENGINE_AUTH_RAW= + +# Secure RPC Restrictions (tightened by the PR) +RETH_HTTP_CORS_DOMAINS=http://localhost +RETH_WS_ORIGINS=http://localhost diff --git a/.env.example b/.env.example new file mode 100644 index 0000000000..53920b13bc --- /dev/null +++ b/.env.example @@ -0,0 +1,5 @@ +# Copy a network-specific example before starting the node: +# cp .env.mainnet.example .env.mainnet +# cp .env.sepolia.example .env.sepolia +# Then set BASE_NODE_L1_ETH_RPC, BASE_NODE_L1_BEACON, and a unique +# BASE_NODE_L2_ENGINE_AUTH_RAW value containing exactly 64 hexadecimal characters. diff --git a/.env.mainnet b/.env.mainnet index ac9e52b665..29eebbaeb3 100644 --- a/.env.mainnet +++ b/.env.mainnet @@ -21,7 +21,8 @@ BASE_NODE_L1_TRUST_RPC="false" # -------------------- BASE_NODE_L2_ENGINE_RPC=ws://execution:8551 BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt -BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a +# Generate a unique 32-byte hexadecimal secret for this deployment. +BASE_NODE_L2_ENGINE_AUTH_RAW= # P2P CONFIGURATION # ----------------- @@ -53,3 +54,9 @@ STATSD_ADDRESS="172.17.0.1" # NOTE: The node type that was chosen when first running a node cannot be changed after the initial sync. Turning Archive into Pruned, or Pruned into Full is not supported [source](https://reth.rs/run/faq/pruning/). # NOTE: The pruned snapshots provided are set with a distance of 1_339_200 (~31 days). # RETH_PRUNING_ARGS="--prune.senderrecovery.distance=50000 --prune.transactionlookup.distance=50000 --prune.receipts.distance=50000 --prune.accounthistory.distance=50000 --prune.storagehistory.distance=50000 --prune.bodies.distance=50000" + +# Comma-separated browser origins allowed to access the HTTP RPC. +RETH_HTTP_CORS_DOMAINS=http://localhost +# Comma-separated browser origins allowed to access the WebSocket RPC. +RETH_WS_ORIGINS=http://localhost + diff --git a/.env.sepolia b/.env.sepolia index e518129fbd..9599e149fe 100644 --- a/.env.sepolia +++ b/.env.sepolia @@ -21,7 +21,8 @@ BASE_NODE_L1_TRUST_RPC="false" # -------------------- BASE_NODE_L2_ENGINE_RPC=http://execution:8551 BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt -BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a +# Generate a unique 32-byte hexadecimal secret for this deployment. +BASE_NODE_L2_ENGINE_AUTH_RAW= # P2P CONFIGURATION # ----------------- @@ -53,3 +54,9 @@ STATSD_ADDRESS="172.17.0.1" # NOTE: The node type that was chosen when first running a node cannot be changed after the initial sync. Turning Archive into Pruned, or Pruned into Full is not supported [source](https://reth.rs/run/faq/pruning/). # NOTE: The pruned snapshots provided are set with a distance of 1_339_200 (~31 days). # RETH_PRUNING_ARGS="--prune.senderrecovery.distance=50000 --prune.transactionlookup.distance=50000 --prune.receipts.distance=50000 --prune.accounthistory.distance=50000 --prune.storagehistory.distance=50000 --prune.bodies.distance=50000" + +# Comma-separated browser origins allowed to access the HTTP RPC. +RETH_HTTP_CORS_DOMAINS=http://localhost +# Comma-separated browser origins allowed to access the WebSocket RPC. +RETH_WS_ORIGINS=http://localhost + diff --git a/.gitignore b/.gitignore index 1dc513860f..f481358a01 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,9 @@ /reth-data/ /dependency_updater/dependency_updater .DS_Store +# Local environment files may contain RPC credentials and engine JWT secrets. +.env +.env.* +!.env.example +!.env.mainnet.example +!.env.sepolia.example diff --git a/README.md b/README.md index 2e0b629989..c7b437241d 100644 --- a/README.md +++ b/README.md @@ -14,9 +14,9 @@ Base is a secure, low-cost, developer-friendly Ethereum L2 built on Optimism's [ 1. Ensure you have an Ethereum L1 full node RPC and beacon endpoint available. 2. Choose your network: - - For mainnet: use `.env.mainnet` - - For testnet: use `.env.sepolia` -3. Configure your L1 endpoints in the appropriate `.env` file: + - For mainnet: copy `.env.mainnet.example` to `.env.mainnet` + - For testnet: copy `.env.sepolia.example` to `.env.sepolia` +3. Generate a unique engine JWT secret and configure your L1 endpoints in the copied `.env` file: ```bash BASE_NODE_L1_ETH_RPC= BASE_NODE_L1_BEACON= @@ -82,7 +82,7 @@ The following are the hardware specifications we use in production: - Follow mode: set `BASE_NODE_SOURCE_L2_RPC` - Pruning: set `RETH_PRUNING_ARGS` -For full configuration options, see `.env.mainnet` or `.env.sepolia`. +For full configuration options, see `.env.mainnet.example` or `.env.sepolia.example`. The example files never contain a usable engine secret. ### Testing Flashblocks RPC Methods @@ -113,4 +113,4 @@ For support please join our [Discord](https://discord.gg/buildonbase) and post i THE NODE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. We make no guarantees about asset protection or security. Usage is subject to applicable laws and regulations. -For more information, visit [docs.base.org](https://docs.base.org/). +For more information, visit [docs.base.org](https://docs.base.org/).