Harden node configuration, prevent secret leakage, and restrict RPC defaults

.env

@@ -1 +1,24 @@
+# Your data directory setting
 HOST_DATA_DIR=./reth-data
+
+# Network Configuration
+RETH_CHAIN=base
+BASE_NODE_NETWORK=base
+RETH_SEQUENCER_HTTP=https://mainnet-sequencer.base.org
+
+# L1 (Ethereum) Configuration
+# You need to enter your own L1 provider URLs (Alchemy, Infura, etc.) here.
+BASE_NODE_L1_ETH_RPC=<your-preferred-l1-rpc>
+BASE_NODE_L1_BEACON=<your-preferred-l1-beacon>
+BASE_NODE_L1_TRUST_RPC="false"
+
+# Engine Configuration
+BASE_NODE_L2_ENGINE_RPC=ws://execution:8551
+BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
+# [CRITICAL] Your unique 64-character hex secret goes here.
+# You can generate this in your terminal using the command: openssl rand -hex 32
+BASE_NODE_L2_ENGINE_AUTH_RAW=<your-64-character-random-hex-secret>
+
+# Secure RPC Restrictions (tightened by the PR)
+RETH_HTTP_CORS_DOMAINS=http://localhost
+RETH_WS_ORIGINS=http://localhost

.env.example

@@ -0,0 +1,5 @@
+# Copy a network-specific example before starting the node:
+#   cp .env.mainnet.example .env.mainnet
+#   cp .env.sepolia.example .env.sepolia
+# Then set BASE_NODE_L1_ETH_RPC, BASE_NODE_L1_BEACON, and a unique
+# BASE_NODE_L2_ENGINE_AUTH_RAW value containing exactly 64 hexadecimal characters.

.env.mainnet

@@ -21,7 +21,8 @@ BASE_NODE_L1_TRUST_RPC="false"
 # --------------------
 BASE_NODE_L2_ENGINE_RPC=ws://execution:8551
 BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
-BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
+# Generate a unique 32-byte hexadecimal secret for this deployment.
+BASE_NODE_L2_ENGINE_AUTH_RAW=
 
 # P2P CONFIGURATION
 # -----------------
@@ -53,3 +54,9 @@ STATSD_ADDRESS="172.17.0.1"
 # NOTE: The node type that was chosen when first running a node cannot be changed after the initial sync. Turning Archive into Pruned, or Pruned into Full is not supported [source](https://reth.rs/run/faq/pruning/).
 # NOTE: The pruned snapshots provided are set with a distance of 1_339_200 (~31 days).
 # RETH_PRUNING_ARGS="--prune.senderrecovery.distance=50000 --prune.transactionlookup.distance=50000 --prune.receipts.distance=50000 --prune.accounthistory.distance=50000 --prune.storagehistory.distance=50000 --prune.bodies.distance=50000"
+
+# Comma-separated browser origins allowed to access the HTTP RPC.
+RETH_HTTP_CORS_DOMAINS=http://localhost
+# Comma-separated browser origins allowed to access the WebSocket RPC.
+RETH_WS_ORIGINS=http://localhost
+

.env.sepolia

@@ -21,7 +21,8 @@ BASE_NODE_L1_TRUST_RPC="false"
 # --------------------
 BASE_NODE_L2_ENGINE_RPC=http://execution:8551
 BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
-BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
+# Generate a unique 32-byte hexadecimal secret for this deployment.
+BASE_NODE_L2_ENGINE_AUTH_RAW=
 
 # P2P CONFIGURATION
 # -----------------
@@ -53,3 +54,9 @@ STATSD_ADDRESS="172.17.0.1"
 # NOTE: The node type that was chosen when first running a node cannot be changed after the initial sync. Turning Archive into Pruned, or Pruned into Full is not supported [source](https://reth.rs/run/faq/pruning/).
 # NOTE: The pruned snapshots provided are set with a distance of 1_339_200 (~31 days).
 # RETH_PRUNING_ARGS="--prune.senderrecovery.distance=50000 --prune.transactionlookup.distance=50000 --prune.receipts.distance=50000 --prune.accounthistory.distance=50000 --prune.storagehistory.distance=50000 --prune.bodies.distance=50000"
+
+# Comma-separated browser origins allowed to access the HTTP RPC.
+RETH_HTTP_CORS_DOMAINS=http://localhost
+# Comma-separated browser origins allowed to access the WebSocket RPC.
+RETH_WS_ORIGINS=http://localhost
+

.gitignore

@@ -2,3 +2,9 @@
 /reth-data/
 /dependency_updater/dependency_updater
 .DS_Store
+# Local environment files may contain RPC credentials and engine JWT secrets.
+.env
+.env.*
+!.env.example
+!.env.mainnet.example
+!.env.sepolia.example

README.md

@@ -14,9 +14,9 @@ Base is a secure, low-cost, developer-friendly Ethereum L2 built on Optimism's [
 
 1. Ensure you have an Ethereum L1 full node RPC and beacon endpoint available.
 2. Choose your network:
-   - For mainnet: use `.env.mainnet`
-   - For testnet: use `.env.sepolia`
-3. Configure your L1 endpoints in the appropriate `.env` file:
+   - For mainnet: copy `.env.mainnet.example` to `.env.mainnet`
+   - For testnet: copy `.env.sepolia.example` to `.env.sepolia`
+3. Generate a unique engine JWT secret and configure your L1 endpoints in the copied `.env` file:
    ```bash
    BASE_NODE_L1_ETH_RPC=<your-preferred-l1-rpc>
    BASE_NODE_L1_BEACON=<your-preferred-l1-beacon>
@@ -82,7 +82,7 @@ The following are the hardware specifications we use in production:
 - Follow mode: set `BASE_NODE_SOURCE_L2_RPC`
 - Pruning: set `RETH_PRUNING_ARGS`
 
-For full configuration options, see `.env.mainnet` or `.env.sepolia`.
+For full configuration options, see `.env.mainnet.example` or `.env.sepolia.example`. The example files never contain a usable engine secret.
 
 ### Testing Flashblocks RPC Methods
 
@@ -113,4 +113,4 @@ For support please join our [Discord](https://discord.gg/buildonbase) and post i
 
 THE NODE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. We make no guarantees about asset protection or security. Usage is subject to applicable laws and regulations.
 
-For more information, visit [docs.base.org](https://docs.base.org/).
+For more information, visit [docs.base.org](https://docs.base.org/).