The rskj compose has an nginx proxy wrapper in front of the rskj client.
The wrapper listens on port 80 and proxies to rskj:8545 internally (this is
required because rskj's hosts whitelist is hard-coded to localhost only,
so traefik forwards must look local to rskj). Traefik labels were pointing
to port 8545, hitting the rskj client directly, which rejected the request
because the Host header didn't match localhost.
Fix: traefik loadbalancer.server.port now 80 for both rootstock-mainnet
and rootstock-bamboo (mirrors the parent rpc-client.yml template's
existing client_proxy_required logic, which the rskj client template
inadvertently dropped).
Verified on de-31: rootstock-mainnet eth_blockNumber returns block
8,872,189 after the fix.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
These flags were removed in Nitro v3.10 and cause Fatal config errors on
startup. Affected chains use AnyTrust DAS via REST aggregator without a
separate relay (orbit-no-relay branch):
- alephzero (mainnet+sepolia)
- connext-sepolia
- everclear-mainnet
- opencampuscodex-sepolia
- playblock-mainnet
- plume (mainnet+testnet)
- real-mainnet
The parent-chain node URL and sequencer-inbox-address are now auto-derived
from --parent-chain.connection.url. The --node.da-provider.* flag family is
gone entirely.
Verified live on rpc-de-13 (everclear): container Up, REST aggregator URL
accepted, head block loaded, RPC listening.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
${?DOMAIN} substitution caused rskj to crash with 'Can't read config'.
Hardcoding the host-specific domain for now (rootstock only runs on
de-31). For multi-host deployment later, would need a per-host
templated node.conf or a proxy that rewrites Host header.
rskj's hosts whitelist is exact-match (no wildcards). Use HOCON env-var
substitution ${?DOMAIN} to inject the per-host public domain into the
allowed list. Pass DOMAIN env var into the container via the rskj
template.
Allowed hosts list: [localhost, 127.0.0.1, ::1, ${?DOMAIN}]
- localhost variants for direct/internal access
- DOMAIN for traefik-forwarded requests (Host header = public domain)
Setting hosts via -Dhosts.0=*, -Dhosts.1=*, etc creates an OBJECT in
HOCON (indexed entries), but rskj's schema expects LIST. Result: rskj
warns and falls back to default whitelist (localhost only).
Drop the hosts.X JVM properties entirely. The file /etc/rsk/node.conf
already declares hosts = ["*"] which IS a HOCON LIST. Without the JVM
override, the file value wins.
