From b6bbe77dff61f3e1e8bcfebbda3d79d6307ffa80 Mon Sep 17 00:00:00 2001
From: rob <sebastian.heyden@gmail.com>
Date: Sun, 13 Sep 2026 13:23:26 +0000
Subject: [PATCH] traefik: second, env-named network so non-RPC services can be
 routed off `chains`

Traefik now also listens on `extra`, whose name comes from TRAEFIK_EXTRA_NETWORK
and defaults to rpc_extra (matching the rpc_chains convention). It is not
`external: true`, so compose creates it; hosts that never use it just get an
empty bridge.

Why: anything that wants a traefik route currently has to sit on `chains`, which
on a typical host means 26 containers including unauthenticated redis:6379,
traefik:8080 (--api.insecure=true) and several unauthenticated :8545 endpoints.
A public site accepting anonymous uploads does not belong there. With this it
can be routed from an isolated network that only traefik bridges into.

Validated with `docker compose config` against a real host .env: unset ->
rpc_extra, TRAEFIK_EXTRA_NETWORK=vientiane_net -> vientiane_net, traefik on
[chains, extra] in both.

Operational note: changing traefik's network list means the NEXT rpc-update on a
host recreates the traefik container, briefly interrupting all HTTP/HTTPS routing
on that host, RPC endpoints included. Nothing pulls /root/rpc on its own, so this
lands host by host and should ride the serving gate.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KjqejYycVyVvrxV9aTDhgX
---
 base.yml | 7 +++++++
 rpc.yml  | 1 +
 2 files changed, 8 insertions(+)

diff --git a/base.yml b/base.yml
index a1ae596a..b1e62480 100644
--- a/base.yml
+++ b/base.yml
@@ -1,4 +1,11 @@
 networks:
+  # Second network Traefik also listens on, so a service can be routed WITHOUT
+  # sitting on `chains` next to the RPC nodes, Redis and the Traefik API (a
+  # public-facing site next to unauthenticated :8545 endpoints is a foothold we
+  # do not want to hand out). Overridable per host via TRAEFIK_EXTRA_NETWORK;
+  # the default is an empty bridge, so hosts that do not use it are unaffected.
+  extra:
+    name: ${TRAEFIK_EXTRA_NETWORK:-rpc_extra}
   chains:
     driver: bridge
     ipam:
diff --git a/rpc.yml b/rpc.yml
index a9e62a19..195cf95d 100644
--- a/rpc.yml
+++ b/rpc.yml
@@ -38,6 +38,7 @@ services:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
     networks:
       - chains
+      - extra
     labels:
       - "traefik.enable=true"
       - "traefik.http.middlewares.ipallowlist.ipallowlist.sourcerange=$WHITELIST"