From cb7bb804900693efccfcd8ec49cbd7429cd9662d Mon Sep 17 00:00:00 2001 From: Claude Agent Date: Thu, 2 Jul 2026 16:03:51 +0000 Subject: [PATCH] fix: bitcoin rpcallowip IPv4, babylon BLS pre-create, tac peers+cosmos RPC - Add -rpcallowip=0.0.0.0/0 family-wide via bitcoind template regen - Pre-create empty-password BLS key in babylon init.sh (v4.3.0 EOF fix) - TAC: seeds+persistent_peers, CometBFT :26657 traefik, protocol cosmos Co-authored-by: Cursor --- babylon/scripts/init.sh | 7 +++++++ .../bitcoind/bitcoin-cash-mainnet-bitcoind-full.yml | 1 + .../bitcoind/bitcoin-cash-testnet-bitcoind-full.yml | 1 + bitcoin/bitcoind/bitcoin-mainnet-bitcoind-full.yml | 1 + bitcoin/bitcoind/bitcoin-testnet-bitcoind-full.yml | 1 + dash/dashd/dash-mainnet-dashd-full.yml | 1 + .../digibyted/digibyte-mainnet-digibyted-full.yml | 1 + .../dogecoind/dogecoin-mainnet-dogecoind-full.yml | 1 + .../dogecoind/dogecoin-testnet-dogecoind-full.yml | 1 + .../litecoind/litecoin-mainnet-litecoind-full.yml | 1 + .../litecoind/litecoin-testnet-litecoind-full.yml | 1 + reference-rpc-endpoint.json | 4 ++-- tac/scripts/init.sh | 4 ++++ tac/tacchaind/tac-mainnet-tacchaind-pruned.yml | 13 +++++++------ tac/tacchaind/tac-spb-tacchaind-pruned.yml | 10 +++++----- 15 files changed, 35 insertions(+), 13 deletions(-) diff --git a/babylon/scripts/init.sh b/babylon/scripts/init.sh index 41f1a270..519ef07d 100644 --- a/babylon/scripts/init.sh +++ b/babylon/scripts/init.sh @@ -25,6 +25,13 @@ else ct_log "already initialized, continuing" fi +# v4.x start prompts for a BLS password if no key exists; RPC replicas never sign +# checkpoints, so pre-create an empty-password key before the first start. +if [ ! -f "$CONFIG_DIR/bls_key.json" ]; then + ct_log "pre-creating BLS key (no password — RPC replica)" + babylond create-bls-key --home "$HOME_DIR" --no-bls-password +fi + # Serve RPC on all interfaces (dshackle/traefik upstream); default is 127.0.0.1. sed -i '/^\[rpc\]/,/^\[/{s|^laddr = .*|laddr = "tcp://0.0.0.0:26657"|}' "$CONFIG_DIR/config.toml" diff --git a/bitcoin-cash/bitcoind/bitcoin-cash-mainnet-bitcoind-full.yml b/bitcoin-cash/bitcoind/bitcoin-cash-mainnet-bitcoind-full.yml index c0476e59..96c38c8f 100644 --- a/bitcoin-cash/bitcoind/bitcoin-cash-mainnet-bitcoind-full.yml +++ b/bitcoin-cash/bitcoind/bitcoin-cash-mainnet-bitcoind-full.yml @@ -60,6 +60,7 @@ services: - -externalip=${IP} - -port=10863 - -printtoconsole + - -rpcallowip=0.0.0.0/0 - -rpcallowip=::/0 - -rpcauth=username:0b6623bdebb516ced10631668833e42a$$c478b38890678c51b9f013174a20addb317c2046b68c05e0250ff86e31a505f7 - -rpcbind=0.0.0.0 diff --git a/bitcoin-cash/bitcoind/bitcoin-cash-testnet-bitcoind-full.yml b/bitcoin-cash/bitcoind/bitcoin-cash-testnet-bitcoind-full.yml index 6c8abded..e94ccae7 100644 --- a/bitcoin-cash/bitcoind/bitcoin-cash-testnet-bitcoind-full.yml +++ b/bitcoin-cash/bitcoind/bitcoin-cash-testnet-bitcoind-full.yml @@ -60,6 +60,7 @@ services: - -externalip=${IP} - -port=14363 - -printtoconsole + - -rpcallowip=0.0.0.0/0 - -rpcallowip=::/0 - -rpcauth=username:0b6623bdebb516ced10631668833e42a$$c478b38890678c51b9f013174a20addb317c2046b68c05e0250ff86e31a505f7 - -rpcbind=0.0.0.0 diff --git a/bitcoin/bitcoind/bitcoin-mainnet-bitcoind-full.yml b/bitcoin/bitcoind/bitcoin-mainnet-bitcoind-full.yml index ac00998f..96a042ef 100644 --- a/bitcoin/bitcoind/bitcoin-mainnet-bitcoind-full.yml +++ b/bitcoin/bitcoind/bitcoin-mainnet-bitcoind-full.yml @@ -63,6 +63,7 @@ services: - -maxconnections=64 - -port=12518 - -printtoconsole + - -rpcallowip=0.0.0.0/0 - -rpcallowip=::/0 - -rpcauth=username:0b6623bdebb516ced10631668833e42a$$c478b38890678c51b9f013174a20addb317c2046b68c05e0250ff86e31a505f7 - -rpcbind=0.0.0.0 diff --git a/bitcoin/bitcoind/bitcoin-testnet-bitcoind-full.yml b/bitcoin/bitcoind/bitcoin-testnet-bitcoind-full.yml index fce31f43..015de8c0 100644 --- a/bitcoin/bitcoind/bitcoin-testnet-bitcoind-full.yml +++ b/bitcoin/bitcoind/bitcoin-testnet-bitcoind-full.yml @@ -63,6 +63,7 @@ services: - -maxconnections=64 - -port=13668 - -printtoconsole + - -rpcallowip=0.0.0.0/0 - -rpcallowip=::/0 - -rpcauth=username:0b6623bdebb516ced10631668833e42a$$c478b38890678c51b9f013174a20addb317c2046b68c05e0250ff86e31a505f7 - -rpcbind=0.0.0.0 diff --git a/dash/dashd/dash-mainnet-dashd-full.yml b/dash/dashd/dash-mainnet-dashd-full.yml index 9f3793af..7c7c0674 100644 --- a/dash/dashd/dash-mainnet-dashd-full.yml +++ b/dash/dashd/dash-mainnet-dashd-full.yml @@ -62,6 +62,7 @@ services: - -externalip=${IP} - -port=11650 - -printtoconsole + - -rpcallowip=0.0.0.0/0 - -rpcallowip=::/0 - -rpcauth=username:0b6623bdebb516ced10631668833e42a$$c478b38890678c51b9f013174a20addb317c2046b68c05e0250ff86e31a505f7 - -rpcbind=0.0.0.0 diff --git a/digibyte/digibyted/digibyte-mainnet-digibyted-full.yml b/digibyte/digibyted/digibyte-mainnet-digibyted-full.yml index 72c59323..92bb7720 100644 --- a/digibyte/digibyted/digibyte-mainnet-digibyted-full.yml +++ b/digibyte/digibyted/digibyte-mainnet-digibyted-full.yml @@ -66,6 +66,7 @@ services: - -externalip=${IP} - -port=11254 - -printtoconsole + - -rpcallowip=0.0.0.0/0 - -rpcallowip=::/0 - -rpcauth=username:0b6623bdebb516ced10631668833e42a$$c478b38890678c51b9f013174a20addb317c2046b68c05e0250ff86e31a505f7 - -rpcbind=0.0.0.0 diff --git a/dogecoin/dogecoind/dogecoin-mainnet-dogecoind-full.yml b/dogecoin/dogecoind/dogecoin-mainnet-dogecoind-full.yml index 446a97d4..8fb65737 100644 --- a/dogecoin/dogecoind/dogecoin-mainnet-dogecoind-full.yml +++ b/dogecoin/dogecoind/dogecoin-mainnet-dogecoind-full.yml @@ -60,6 +60,7 @@ services: - -externalip=${IP} - -port=12577 - -printtoconsole + - -rpcallowip=0.0.0.0/0 - -rpcallowip=::/0 - -rpcauth=username:0b6623bdebb516ced10631668833e42a$$c478b38890678c51b9f013174a20addb317c2046b68c05e0250ff86e31a505f7 - -rpcbind=0.0.0.0 diff --git a/dogecoin/dogecoind/dogecoin-testnet-dogecoind-full.yml b/dogecoin/dogecoind/dogecoin-testnet-dogecoind-full.yml index 09ae1d24..d4fb439d 100644 --- a/dogecoin/dogecoind/dogecoin-testnet-dogecoind-full.yml +++ b/dogecoin/dogecoind/dogecoin-testnet-dogecoind-full.yml @@ -60,6 +60,7 @@ services: - -externalip=${IP} - -port=10859 - -printtoconsole + - -rpcallowip=0.0.0.0/0 - -rpcallowip=::/0 - -rpcauth=username:0b6623bdebb516ced10631668833e42a$$c478b38890678c51b9f013174a20addb317c2046b68c05e0250ff86e31a505f7 - -rpcbind=0.0.0.0 diff --git a/litecoin/litecoind/litecoin-mainnet-litecoind-full.yml b/litecoin/litecoind/litecoin-mainnet-litecoind-full.yml index 835466ca..b0e136dd 100644 --- a/litecoin/litecoind/litecoin-mainnet-litecoind-full.yml +++ b/litecoin/litecoind/litecoin-mainnet-litecoind-full.yml @@ -60,6 +60,7 @@ services: - -externalip=${IP} - -port=10159 - -printtoconsole + - -rpcallowip=0.0.0.0/0 - -rpcallowip=::/0 - -rpcauth=username:0b6623bdebb516ced10631668833e42a$$c478b38890678c51b9f013174a20addb317c2046b68c05e0250ff86e31a505f7 - -rpcbind=0.0.0.0 diff --git a/litecoin/litecoind/litecoin-testnet-litecoind-full.yml b/litecoin/litecoind/litecoin-testnet-litecoind-full.yml index 0b532e48..6ea2907a 100644 --- a/litecoin/litecoind/litecoin-testnet-litecoind-full.yml +++ b/litecoin/litecoind/litecoin-testnet-litecoind-full.yml @@ -60,6 +60,7 @@ services: - -externalip=${IP} - -port=10051 - -printtoconsole + - -rpcallowip=0.0.0.0/0 - -rpcallowip=::/0 - -rpcauth=username:0b6623bdebb516ced10631668833e42a$$c478b38890678c51b9f013174a20addb317c2046b68c05e0250ff86e31a505f7 - -rpcbind=0.0.0.0 diff --git a/reference-rpc-endpoint.json b/reference-rpc-endpoint.json index 4c9e9ac6..c6911c2d 100644 --- a/reference-rpc-endpoint.json +++ b/reference-rpc-endpoint.json @@ -3409,7 +3409,7 @@ ] }, "tac": { - "protocol": "eth", + "protocol": "cosmos", "id": 239, "block_time_ms": 1000, "lagging_lag": 2, @@ -3422,7 +3422,7 @@ ] }, "tac-spb": { - "protocol": "eth", + "protocol": "cosmos", "id": 2391, "block_time_ms": 1000, "lagging_lag": 2, diff --git a/tac/scripts/init.sh b/tac/scripts/init.sh index 164b6d4c..4a178436 100755 --- a/tac/scripts/init.sh +++ b/tac/scripts/init.sh @@ -24,7 +24,11 @@ else ct_log "already initialized, continuing" fi +# Serve CometBFT RPC on all interfaces (dshackle/traefik upstream); default is 127.0.0.1. +sed -i '/^\[rpc\]/,/^\[/{s|^laddr = .*|laddr = "tcp://0.0.0.0:26657"|}' "$CONFIG_DIR/config.toml" + ct_patch_p2p "$CONFIG_DIR/config.toml" "$IP" "${P2P_PORT:-26656}" +ct_merge_seeds "$CONFIG_DIR/config.toml" "$SEEDS" ct_set_persistent_peers "$CONFIG_DIR/config.toml" "$PERSISTENT_PEERS" ct_set_moniker "$CONFIG_DIR/config.toml" "$MONIKER" ct_configure_statesync "$CONFIG_DIR/config.toml" "$STATESYNC_RPC" diff --git a/tac/tacchaind/tac-mainnet-tacchaind-pruned.yml b/tac/tacchaind/tac-mainnet-tacchaind-pruned.yml index 618b99fa..ea81f853 100644 --- a/tac/tacchaind/tac-mainnet-tacchaind-pruned.yml +++ b/tac/tacchaind/tac-mainnet-tacchaind-pruned.yml @@ -53,8 +53,7 @@ services: - 10283:10283 - 10283:10283/udp expose: - - 8545 - - 8546 + - 26657 - 6065 environment: - API=eth,net,web3,txpool,debug @@ -64,7 +63,8 @@ services: - MIN_GAS=25000000000utac - MONIKER=d${DOMAIN:-local} - P2P_PORT=10283 - - PERSISTENT_PEERS=d0a80c43a10a6b60475864728db6d9ba4ead42d2@107.6.113.60:58960,10550a03e4f7fa487c78fbd07e0770e2b0f085c7@64.46.115.78:58960,0efae9d157f0ef60ad7d25507d6939799f832e34@173.244.202.99:58960,78079166d06e345dbf4a5c932ee3c69a04148e92@107.6.91.38:58960 + - PERSISTENT_PEERS=d0a80c43a10a6b60475864728db6d9ba4ead42d2@107.6.113.60:58960,10550a03e4f7fa487c78fbd07e0770e2b0f085c7@64.46.115.78:58960,0efae9d157f0ef60ad7d25507d6939799f832e34@69.4.239.26:58960,78079166d06e345dbf4a5c932ee3c69a04148e92@107.6.91.38:58960,6b30bd943854f7e6bb1719e47e225db1b82d50b0@89.168.125.111:26656,d88a9cbab1cdf51735854bf5a527aaed9c4bb0ee@95.217.208.137:26656 + - SEEDS=186e207d2c95e94a44ff613770aa269dac876013@65.108.201.240:32156 - STATESYNC_RPC=https://tendermint.rpc.tac.build restart: unless-stopped stop_grace_period: 5m @@ -81,7 +81,7 @@ services: - prometheus-scrape.path=/metrics - traefik.enable=true - traefik.http.middlewares.tac-mainnet-tacchaind-pruned-stripprefix.stripprefix.prefixes=/tac-mainnet - - traefik.http.services.tac-mainnet-tacchaind-pruned.loadbalancer.server.port=8545 + - traefik.http.services.tac-mainnet-tacchaind-pruned.loadbalancer.server.port=26657 - ${NO_SSL:-traefik.http.routers.tac-mainnet-tacchaind-pruned.entrypoints=websecure} - ${NO_SSL:-traefik.http.routers.tac-mainnet-tacchaind-pruned.tls.certresolver=myresolver} - ${NO_SSL:-traefik.http.routers.tac-mainnet-tacchaind-pruned.rule=Host(`$DOMAIN`) && (Path(`/tac-mainnet`) || Path(`/tac-mainnet/`))} @@ -89,14 +89,15 @@ services: - traefik.http.routers.tac-mainnet-tacchaind-pruned.middlewares=tac-mainnet-tacchaind-pruned-stripprefix, ipallowlist - traefik.http.routers.tac-mainnet-tacchaind-pruned.priority=50 # gets any request that is not GET with UPGRADE header - traefik.http.routers.tac-mainnet-tacchaind-pruned-ws.priority=100 # answers GET requests first - - traefik.http.services.tac-mainnet-tacchaind-pruned-ws.loadbalancer.server.port=8546 + - traefik.http.middlewares.tac-mainnet-tacchaind-pruned-set-ws-path.replacepath.path=/websocket + - traefik.http.services.tac-mainnet-tacchaind-pruned-ws.loadbalancer.server.port=26657 - traefik.http.routers.tac-mainnet-tacchaind-pruned-ws.service=tac-mainnet-tacchaind-pruned-ws - traefik.http.routers.tac-mainnet-tacchaind-pruned.service=tac-mainnet-tacchaind-pruned - ${NO_SSL:-traefik.http.routers.tac-mainnet-tacchaind-pruned-ws.entrypoints=websecure} - ${NO_SSL:-traefik.http.routers.tac-mainnet-tacchaind-pruned-ws.tls.certresolver=myresolver} - ${NO_SSL:-traefik.http.routers.tac-mainnet-tacchaind-pruned-ws.rule=Host(`$DOMAIN`) && (Path(`/tac-mainnet`) || Path(`/tac-mainnet/`)) && HeadersRegexp(`Upgrade`, `(?i)websocket`)} - ${NO_SSL:+traefik.http.routers.tac-mainnet-tacchaind-pruned-ws.rule=(Path(`/tac-mainnet`) || Path(`/tac-mainnet/`)) && HeadersRegexp(`Upgrade`, `(?i)websocket`)} - - traefik.http.routers.tac-mainnet-tacchaind-pruned-ws.middlewares=tac-mainnet-tacchaind-pruned-stripprefix, ipallowlist + - traefik.http.routers.tac-mainnet-tacchaind-pruned-ws.middlewares=tac-mainnet-tacchaind-pruned-stripprefix, tac-mainnet-tacchaind-pruned-set-ws-path, ipallowlist volumes: tac-mainnet-tacchaind-pruned: diff --git a/tac/tacchaind/tac-spb-tacchaind-pruned.yml b/tac/tacchaind/tac-spb-tacchaind-pruned.yml index c8aa3299..4032a85b 100644 --- a/tac/tacchaind/tac-spb-tacchaind-pruned.yml +++ b/tac/tacchaind/tac-spb-tacchaind-pruned.yml @@ -53,8 +53,7 @@ services: - 14331:14331 - 14331:14331/udp expose: - - 8545 - - 8546 + - 26657 - 6065 environment: - API=eth,net,web3,txpool,debug @@ -81,7 +80,7 @@ services: - prometheus-scrape.path=/metrics - traefik.enable=true - traefik.http.middlewares.tac-spb-tacchaind-pruned-stripprefix.stripprefix.prefixes=/tac-spb - - traefik.http.services.tac-spb-tacchaind-pruned.loadbalancer.server.port=8545 + - traefik.http.services.tac-spb-tacchaind-pruned.loadbalancer.server.port=26657 - ${NO_SSL:-traefik.http.routers.tac-spb-tacchaind-pruned.entrypoints=websecure} - ${NO_SSL:-traefik.http.routers.tac-spb-tacchaind-pruned.tls.certresolver=myresolver} - ${NO_SSL:-traefik.http.routers.tac-spb-tacchaind-pruned.rule=Host(`$DOMAIN`) && (Path(`/tac-spb`) || Path(`/tac-spb/`))} @@ -89,14 +88,15 @@ services: - traefik.http.routers.tac-spb-tacchaind-pruned.middlewares=tac-spb-tacchaind-pruned-stripprefix, ipallowlist - traefik.http.routers.tac-spb-tacchaind-pruned.priority=50 # gets any request that is not GET with UPGRADE header - traefik.http.routers.tac-spb-tacchaind-pruned-ws.priority=100 # answers GET requests first - - traefik.http.services.tac-spb-tacchaind-pruned-ws.loadbalancer.server.port=8546 + - traefik.http.middlewares.tac-spb-tacchaind-pruned-set-ws-path.replacepath.path=/websocket + - traefik.http.services.tac-spb-tacchaind-pruned-ws.loadbalancer.server.port=26657 - traefik.http.routers.tac-spb-tacchaind-pruned-ws.service=tac-spb-tacchaind-pruned-ws - traefik.http.routers.tac-spb-tacchaind-pruned.service=tac-spb-tacchaind-pruned - ${NO_SSL:-traefik.http.routers.tac-spb-tacchaind-pruned-ws.entrypoints=websecure} - ${NO_SSL:-traefik.http.routers.tac-spb-tacchaind-pruned-ws.tls.certresolver=myresolver} - ${NO_SSL:-traefik.http.routers.tac-spb-tacchaind-pruned-ws.rule=Host(`$DOMAIN`) && (Path(`/tac-spb`) || Path(`/tac-spb/`)) && HeadersRegexp(`Upgrade`, `(?i)websocket`)} - ${NO_SSL:+traefik.http.routers.tac-spb-tacchaind-pruned-ws.rule=(Path(`/tac-spb`) || Path(`/tac-spb/`)) && HeadersRegexp(`Upgrade`, `(?i)websocket`)} - - traefik.http.routers.tac-spb-tacchaind-pruned-ws.middlewares=tac-spb-tacchaind-pruned-stripprefix, ipallowlist + - traefik.http.routers.tac-spb-tacchaind-pruned-ws.middlewares=tac-spb-tacchaind-pruned-stripprefix, tac-spb-tacchaind-pruned-set-ws-path, ipallowlist volumes: tac-spb-tacchaind-pruned: