Fix purge-backup-trash.sh path bug: use full /backup/trash/<filename> paths instead of basenames only

TAC mainnet halted at block 24,671,475 on 2026-08-22 and RESUMED 2026-09-02 via
one-shot Aug-2026 state-recovery hardfork gated on chain-id tacchain_239-1 +
height 24,671,476. v1.6.0 lacks that migration and cannot cross the fork height.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

.gitignore

@@ -11,3 +11,7 @@ peer-backups/
 snapshots/
 *.bak
 *.swp
+
+# Task C local peer capture state
+peer-state/
+

abcore/abcore.Dockerfile

@@ -0,0 +1,25 @@
+FROM rockylinux:9
+
+COPY ./scripts/init.sh /usr/local/bin/init.sh
+RUN chmod +x /usr/local/bin/init.sh
+
+ARG ABCORE_MAINNET_GETH_VERSION
+
+# Download and verify the geth binary from GitHub releases
+RUN set -eu; \
+    VERSION="${ABCORE_MAINNET_GETH_VERSION}"; \
+    BINARY="geth-${VERSION}"; \
+    URL="https://github.com/ABFoundationGlobal/abcore/releases/download/${VERSION}/${BINARY}"; \
+    SHA256_URL="${URL}.sha256"; \
+    echo "abcore: downloading geth binary from ${URL}"; \
+    curl -fsSL "${URL}" -o "/tmp/${BINARY}"; \
+    echo "abcore: downloading sha256 checksum from ${SHA256_URL}"; \
+    curl -fsSL "${SHA256_URL}" -o "/tmp/${BINARY}.sha256"; \
+    cd /tmp; \
+    sha256sum -c "${BINARY}.sha256" || (echo "abcore: SHA256 verification failed for ${BINARY}" >&2 && exit 1); \
+    chmod +x "${BINARY}"; \
+    mkdir -p /abcore/bin; \
+    mv "${BINARY}" /abcore/bin/geth; \
+    rm -f "${BINARY}" "${BINARY}.sha256"
+
+ENTRYPOINT [ "init.sh" ]

abcore/geth/abcore-mainnet-geth-pruned-pebble-hash.yml

@@ -0,0 +1,151 @@
+---
+x-logging-defaults: &logging-defaults
+  driver: json-file
+  options:
+    max-size: "512m"
+    max-file: "2"
+# ABFoundationGlobal/abcore geth-fork client
+# Distributed as release binaries from https://github.com/ABFoundationGlobal/abcore/releases
+# Version: v1.13.15-abcore-1.2
+
+# Usage:
+#
+# mkdir rpc && cd rpc
+#
+# git init
+# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
+# git fetch origin vibe
+# git checkout origin/vibe
+#
+# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
+#
+# env
+# ...
+# IP=$(curl ipinfo.io/ip)
+# DOMAIN=${IP}.traefik.me
+# COMPOSE_FILE=base.yml:rpc.yml:abcore/geth/abcore-mainnet-geth-pruned-pebble-hash.yml
+#
+# docker compose up -d
+#
+# curl -X POST https://${IP}.traefik.me/abcore-mainnet-geth \
+#   -H "Content-Type: application/json" \
+#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
+
+services:
+  abcore-mainnet-geth:
+    build:
+      context: ./abcore
+      dockerfile: abcore.Dockerfile
+      args:
+        ABCORE_MAINNET_GETH_VERSION: ${ABCORE_MAINNET_GETH_VERSION:-v1.13.15-abcore-1.2}
+    sysctls:
+      # TCP Performance
+      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
+      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
+      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
+      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
+      net.core.somaxconn: 32768                   # Higher connection queue
+      # Memory/Connection Management
+      # net.core.netdev_max_backlog: 50000          # Increase network buffer
+      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
+      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
+    ulimits:
+      nofile: 1048576    # Max open files (for RPC/WS connections)
+    user: root
+    ports:
+      - 13110:13110
+      - 13110:13110/udp
+    expose:
+      - 8545
+      - 6060
+    environment:
+      - CHAIN_NAME=mainnet
+    entrypoint: [/usr/local/bin/init.sh]
+    command:
+      - --config=/config/config.toml
+      - --datadir=/root/.ethereum
+      - --db.engine=pebble
+      - --gcmode=full
+      - --http
+      - --http.addr=0.0.0.0
+      - --http.api=eth,net,web3,debug,admin,txpool,engine
+      - --http.port=8545
+      - --http.vhosts=*
+      - --maxpeers=50
+      - --metrics
+      - --metrics.addr=0.0.0.0
+      - --metrics.port=6060
+      - --nat=extip:${IP}
+      - --networkid=36888
+      - --port=13110
+      - --rpc.gascap=600000000
+      - --rpc.txfeecap=0
+      - --syncmode=full
+      - --ws
+      - --ws.addr=0.0.0.0
+      - --ws.api=eth,net,web3,debug,admin,txpool,engine
+      - --ws.origins=*
+      - --ws.port=8545
+    restart: unless-stopped
+    stop_grace_period: 5m
+    networks:
+      - chains
+    volumes:
+      - ${ABCORE_MAINNET_GETH_PRUNED_PEBBLE_HASH_DATA:-abcore-mainnet-geth-pruned-pebble-hash}:/root/.ethereum
+      - ./abcore/mainnet:/config
+      - /slowdisk:/slowdisk
+    logging: *logging-defaults
+    labels:
+      - prometheus-scrape.enabled=true
+      - prometheus-scrape.port=6060
+      - prometheus-scrape.path=/debug/metrics/prometheus
+      - traefik.enable=true
+      - traefik.http.middlewares.abcore-mainnet-geth-pruned-pebble-hash-stripprefix.stripprefix.prefixes=/abcore-mainnet-geth
+      - traefik.http.services.abcore-mainnet-geth-pruned-pebble-hash.loadbalancer.server.port=8545
+      - ${NO_SSL:-traefik.http.routers.abcore-mainnet-geth-pruned-pebble-hash.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.abcore-mainnet-geth-pruned-pebble-hash.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.abcore-mainnet-geth-pruned-pebble-hash.rule=Host(`$DOMAIN`) && (Path(`/abcore-mainnet-geth`) || Path(`/abcore-mainnet-geth/`))}
+      - ${NO_SSL:+traefik.http.routers.abcore-mainnet-geth-pruned-pebble-hash.rule=Path(`/abcore-mainnet-geth`) || Path(`/abcore-mainnet-geth/`)}
+      - traefik.http.routers.abcore-mainnet-geth-pruned-pebble-hash.middlewares=abcore-mainnet-geth-pruned-pebble-hash-stripprefix, ipallowlist
+
+volumes:
+  abcore-mainnet-geth-pruned-pebble-hash:
+
+x-upstreams:
+  - id: $${ID}
+    labels:
+      provider: $${PROVIDER}
+    connection:
+      generic:
+        rpc:
+          url: $${RPC_URL}
+        ws:
+          frameSize: 20Mb
+          msgSize: 50Mb
+          url: $${WS_URL}
+    chain: abcore
+    method-groups:
+      enabled:
+        - debug
+        - filter
+    methods:
+      disabled:
+      enabled:
+        - name: txpool_content # TODO: should be disabled for rollup nodes
+        # standard geth only
+        - name: debug_getRawBlock
+        - name: debug_getRawTransaction
+        - name: debug_getRawReceipts
+        - name: debug_getRawHeader
+        - name: debug_getBadBlocks
+        # non standard geth only slightly dangerous
+        - name: debug_intermediateRoots
+        - name: debug_dumpBlock
+        # standard geth and erigon
+        - name: debug_accountRange
+        - name: debug_getModifiedAccountsByNumber
+        - name: debug_getModifiedAccountsByHash
+        # non standard geth and erigon
+        - name: eth_getRawTransactionByHash
+        - name: eth_getRawTransactionByBlockHashAndIndex
+...

abcore/mainnet/config.toml

@@ -0,0 +1,33 @@
+[Eth]
+NetworkId = 36888
+SyncMode = "snap"
+NoPruning = false
+NoPrefetch = false
+
+[Eth.Miner]
+GasFloor = 0
+GasCeil = 63000000
+GasPrice = 50000000000000
+Recommit = 2000000000
+NewPayloadTimeout = 2000000000
+
+[Node]
+DataDir = "/root/.ethereum"
+HTTPHost = "0.0.0.0"
+HTTPPort = 8545
+HTTPVirtualHosts = ["*"]
+HTTPModules = ["eth", "net", "web3", "debug", "admin", "txpool", "engine"]
+WSHost = "0.0.0.0"
+WSPort = 8546
+WSModules = ["eth", "net", "web3", "debug", "admin", "txpool", "engine"]
+WSOrigins = ["*"]
+
+[Node.P2P]
+MaxPeers = 50
+NoDiscovery = false
+DiscoveryV4 = true
+ListenAddr = ":33333"
+
+[Metrics]
+HTTP = "127.0.0.1"
+Port = 6060

abcore/mainnet/genesis.json

@@ -0,0 +1,28 @@
+{
+  "config": {
+    "chainId": 36888,
+    "homesteadBlock": 0,
+    "eip150Block": 0,
+    "eip155Block": 0,
+    "eip158Block": 0,
+    "byzantiumBlock": 0,
+    "constantinopleBlock": 0,
+    "petersburgBlock": 0,
+    "istanbulBlock": 0,
+    "muirGlacierBlock": 0,
+    "berlinBlock": 0,
+    "clique": {
+      "period": 3,
+      "epoch": 30000
+    }
+  },
+  "timestamp": "0x67fda368",
+  "difficulty": "1",
+  "gasLimit": "63000000",
+  "extradata": "0x0000000000000000000000000000000000000000000000000000000000000000E9B95948d28EF808a9184d5fC98346EF3e56839c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+  "alloc": {
+    "da8B88027Ac27532E1525DD67974c2377b450A08": {
+      "balance": "100000000000000000000000000000"
+    }
+  }
+}

abcore/scripts/init.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+
+set -e  # Exit on failure
+
+GETH_DATA_DIR="/root/.ethereum"
+CONFIG_FILE="/config/config.toml"
+GENESIS_FILE="/config/genesis.json"
+
+# Initialize geth from genesis if data directory is empty
+if [ -z "$(ls -A "$GETH_DATA_DIR")" ]; then
+    echo "abcore: data directory is empty, initializing from genesis..."
+    if [ -f "$GENESIS_FILE" ]; then
+        /abcore/bin/geth init --datadir "$GETH_DATA_DIR" --db.engine=pebble "$GENESIS_FILE"
+    else
+        echo "abcore: genesis file not found at $GENESIS_FILE" >&2
+        exit 1
+    fi
+else
+    echo "abcore: data directory not empty, continuing..."
+fi
+
+exec /abcore/bin/geth --config "$CONFIG_FILE" --datadir "$GETH_DATA_DIR" "$@"

accesslog-shipper.awk

@@ -0,0 +1,18 @@
+# Streams dshackle access-log lines unchanged, and every 1000 lines OR 30s
+# injects a __shipstat__ checkpoint carrying the cumulative sent-count for this
+# connection. The splits cruncher (claude host) filters these OUT of event
+# processing and uses them to reconcile shipped-vs-ingested per gateway per hour
+# — the completeness signal the time-based floor cannot see (event-loss-by-
+# rotation, 2026-07-10). `sess` = connection-start epoch so the cruncher detects
+# counter resets on shipper reconnect (retry loop resumes at file END).
+BEGIN { sess = systime(); last = sess; n = 0 }
+{
+    n++
+    print
+    now = systime()
+    if (n % 1000 == 0 || now - last >= 30) {
+        printf "{\"__shipstat__\":1,\"sess\":%d,\"sent\":%d,\"ts\":%d}\n", sess, n, now
+        fflush()
+        last = now
+    }
+}

apply-dshackle-overrides.py

@@ -0,0 +1,143 @@
+#!/usr/bin/env python3
+"""apply-dshackle-overrides.py - weave HOST-LOCAL dshackle upstream overrides into
+the generated main_configs/*.yaml so they survive every configure-drpc regeneration.
+
+Override file (NOT in the repo - host-local, like rpc-local/compose.d):
+    /root/rpc-local/dshackle-overrides.yaml
+
+Schema (match by upstream id OR by chain; id wins):
+    upstreams:
+      uk-4-base-mainnet-op-reth-pruned:        # or e.g. "chain:base"
+        method_groups_disabled: [trace, debug] # removed from enabled, added to disabled
+        methods_disabled: [eth_getFilterLogs]  # per-method disables (methods.disabled)
+        options:
+          disable-validation: true             # merged into upstream options
+
+Rationale: heavy methods at flat per-call pay poison the chain's latency scoring
+(operator method-eviction rule 2026-07-10; see method-economics.py). The disable
+decision is local to the gateway's market, so the config lives on the gateway.
+
+Called by reload_dshackle.sh before signaling dshackle - i.e. re-applied on every
+ansible config push. NOTE: dshackle only re-reads upstream method lists on RESTART;
+this keeps the on-disk config permanently correct, the next restart activates it.
+Idempotent. Silent no-op when the override file is absent.
+"""
+import glob
+import os
+import sys
+
+import yaml
+
+OVERRIDES = '/root/rpc-local/dshackle-overrides.yaml'
+CONFIG_DIR = '/root/rpc/main_configs'
+
+
+def apply(upstream, ov):
+    changed = False
+    mg = upstream.setdefault('method-groups', {}) or {}
+    for grp in ov.get('method_groups_disabled') or []:
+        en = mg.get('enabled') or []
+        if grp in en:
+            en.remove(grp)
+            mg['enabled'] = en
+            changed = True
+        dis = mg.get('disabled') or []
+        if grp not in dis:
+            dis.append(grp)
+            mg['disabled'] = dis
+            changed = True
+    if mg:
+        upstream['method-groups'] = mg
+    for meth in ov.get('methods_disabled') or []:
+        methods = upstream.setdefault('methods', {}) or {}
+        dis = methods.get('disabled') or []
+        if not any((d.get('name') if isinstance(d, dict) else d) == meth for d in dis):
+            dis.append({'name': meth})
+            methods['disabled'] = dis
+            upstream['methods'] = methods
+            changed = True
+    for k, v in (ov.get('options') or {}).items():
+        opts = upstream.setdefault('options', {}) or {}
+        if opts.get(k) != v:
+            opts[k] = v
+            upstream['options'] = opts
+            changed = True
+    return changed
+
+
+ENVFILE = '/root/rpc/.env'
+
+
+def env_overrides():
+    """Chain-level overrides from .env (rendered from host_vars env_overrides):
+        DSHACKLE_<CHAIN>_METHOD_GROUPS_DISABLED=trace,debug
+        DSHACKLE_<CHAIN>_METHODS_DISABLED=eth_getFilterLogs
+    <CHAIN> = dshackle chain name, upper, '-' -> '_' (e.g. BASE, ETH_BEACON_CHAIN)."""
+    spec = {}
+    if not os.path.exists(ENVFILE):
+        return spec
+    import re as _re
+    for line in open(ENVFILE):
+        m = _re.match(r'DSHACKLE_([A-Z0-9_]+)_(METHOD_GROUPS|METHODS)_DISABLED=(.*)', line.strip())
+        if not m:
+            continue
+        chain = m.group(1).lower().replace('_', '-')
+        key = 'method_groups_disabled' if m.group(2) == 'METHOD_GROUPS' else 'methods_disabled'
+        vals = [v.strip() for v in m.group(3).split(',') if v.strip()]
+        if vals:
+            spec.setdefault(f'chain:{chain}', {}).setdefault(key, []).extend(vals)
+    return spec
+
+
+def main():
+    spec = env_overrides()
+    if os.path.exists(OVERRIDES):
+        for k, v in ((yaml.safe_load(open(OVERRIDES)) or {}).get('upstreams') or {}).items():
+            cur = spec.setdefault(k, {})
+            for kk, vv in (v or {}).items():
+                if isinstance(vv, list):
+                    cur[kk] = sorted(set((cur.get(kk) or []) + vv))
+                else:
+                    cur.setdefault(kk, vv)
+    if not spec:
+        return
+    total = 0
+    for path in glob.glob(os.path.join(CONFIG_DIR, '*.yaml')):
+        try:
+            doc = yaml.safe_load(open(path))
+        except yaml.YAMLError:
+            continue
+        if not isinstance(doc, dict) or 'upstreams' not in doc:
+            continue
+        changed = False
+        for up in doc['upstreams'] or []:
+            if not isinstance(up, dict):
+                continue
+            ov = spec.get(up.get('id')) or spec.get(f"chain:{up.get('chain')}")
+            if ov and apply(up, ov):
+                changed = True
+        if changed:
+            text = yaml.safe_dump(doc, default_flow_style=False, sort_keys=False)
+            # dshackle silently refuses to hot-reload configs containing TABS
+            # (operator gotcha 2026-07-10) - fail loudly, never write a tabbed file.
+            if '\t' in text:
+                print(f'dshackle-overrides: REFUSING to write {path} - tab in output')
+                continue
+            with open(path, 'w') as f:
+                f.write(text)
+            total += 1
+            print(f'dshackle-overrides: rewove {path}')
+    # tab audit on ALL configs (even unchanged): a tabbed file silently fails
+    # dshackle's hot-reload, so disk and running state diverge invisibly.
+    for path in glob.glob(os.path.join(CONFIG_DIR, '*.yaml')):
+        try:
+            if '\t' in open(path, errors='replace').read():
+                print(f'dshackle-overrides: WARNING {path} contains TABS - dshackle will SILENTLY skip reloading it')
+        except OSError:
+            pass
+    if total:
+        print(f'dshackle-overrides: {total} file(s) rewoven (dshackle hot-reloads on the HUP that follows)')
+
+
+if __name__ == '__main__':
+    main()

arb/nitro/alephzero-mainnet-nitro-archive-pebble-hash.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/alephzero-mainnet-archive
       - --persistent.db-engine=pebble

arb/nitro/alephzero-mainnet-nitro-pruned-pebble-path.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/alephzero-mainnet
       - --persistent.db-engine=pebble

arb/nitro/alephzero-sepolia-nitro-archive-pebble-hash.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/alephzero-sepolia-archive
       - --persistent.db-engine=pebble

arb/nitro/alephzero-sepolia-nitro-pruned-pebble-path.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/alephzero-sepolia
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-nova-nitro-archive-leveldb-hash.yml

@@ -69,6 +69,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-nova-archive
       - --ws.addr=0.0.0.0

arb/nitro/arbitrum-nova-nitro-archive-pebble-path.yml

@@ -69,6 +69,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-nova-archive
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-nova-nitro-minimal-pebble-hash.prune.yml

@@ -70,6 +70,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-nova-minimal
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-nova-nitro-minimal-pebble-hash.yml

@@ -69,6 +69,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-nova-minimal
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-nova-nitro-pruned-pebble-hash.prune.yml

@@ -70,6 +70,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-nova
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-nova-nitro-pruned-pebble-hash.yml

@@ -69,6 +69,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-nova
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-one-nitro-archive-leveldb-hash.yml

@@ -70,6 +70,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-one-archive
       - --ws.addr=0.0.0.0

arb/nitro/arbitrum-one-nitro-archive-pebble-hash.yml

@@ -70,6 +70,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-one-archive
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-one-nitro-archive-pebble-path.yml

@@ -69,6 +69,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-one-archive
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-one-nitro-minimal-pebble-hash.prune.yml

@@ -70,6 +70,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-one-minimal
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-one-nitro-minimal-pebble-hash.yml

@@ -69,6 +69,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-one-minimal
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-one-nitro-pruned-pebble-hash--fireeth.prune.yml

@@ -71,6 +71,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-one
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-one-nitro-pruned-pebble-hash--fireeth.yml

@@ -70,6 +70,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-one
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-one-nitro-pruned-pebble-hash.prune.yml

@@ -70,6 +70,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-one
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-one-nitro-pruned-pebble-hash.yml

@@ -69,6 +69,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-one
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-sepolia-nitro-archive-pebble-hash.yml

@@ -70,6 +70,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-sepolia-archive
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-sepolia-nitro-minimal-pebble-hash.prune.yml

@@ -71,6 +71,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-sepolia-minimal
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-sepolia-nitro-minimal-pebble-hash.yml

@@ -70,6 +70,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-sepolia-minimal
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-sepolia-nitro-pruned-pebble-hash.prune.yml

@@ -71,6 +71,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-sepolia
       - --persistent.db-engine=pebble

arb/nitro/arbitrum-sepolia-nitro-pruned-pebble-hash.yml

@@ -70,6 +70,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/arbitrum-sepolia
       - --persistent.db-engine=pebble

arb/nitro/connext-sepolia-nitro-archive-leveldb-hash.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/connext-sepolia-archive
       - --ws.addr=0.0.0.0
@@ -116,7 +117,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: everclear-sepolia
+    chain:
     method-groups:
       enabled:
         - debug

arb/nitro/connext-sepolia-nitro-pruned-pebble-path.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/connext-sepolia
       - --persistent.db-engine=pebble
@@ -117,7 +118,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: everclear-sepolia
+    chain:
     method-groups:
       enabled:
         - debug

arb/nitro/everclear-mainnet-nitro-archive-leveldb-hash.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/everclear-mainnet-archive
       - --ws.addr=0.0.0.0

arb/nitro/everclear-mainnet-nitro-pruned-pebble-path.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/everclear-mainnet
       - --persistent.db-engine=pebble

arb/nitro/humanity-mainnet-nitro-pruned-pebble-hash.prune.yml

@@ -0,0 +1,144 @@
+---
+x-logging-defaults: &logging-defaults
+  driver: json-file
+  options:
+    max-size: "512m"
+    max-file: "2"
+
+# Usage:
+#
+# mkdir rpc && cd rpc
+#
+# git init
+# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
+# git fetch origin vibe
+# git checkout origin/vibe
+#
+# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
+#
+# env
+# ...
+# IP=$(curl ipinfo.io/ip)
+# DOMAIN=${IP}.traefik.me
+# COMPOSE_FILE=base.yml:rpc.yml:arb/nitro/humanity-mainnet-nitro-pruned-pebble-hash.yml
+#
+# docker compose up -d
+#
+# curl -X POST https://${IP}.traefik.me/humanity-mainnet \
+#   -H "Content-Type: application/json" \
+#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
+
+services:
+  humanity-mainnet:
+    image: ${HUMANITY_NITRO_IMAGE:-offchainlabs/nitro-node}:${HUMANITY_MAINNET_NITRO_VERSION:-v3.11.2-3599aca}
+    sysctls:
+      # TCP Performance
+      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
+      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
+      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
+      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
+      net.core.somaxconn: 32768                   # Higher connection queue
+      # Memory/Connection Management
+      # net.core.netdev_max_backlog: 50000          # Increase network buffer
+      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
+      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
+    ulimits:
+      nofile: 1048576    # Max open files (for RPC/WS connections)
+    user: root
+    expose:
+      - 8545
+    command:
+      - --conf.file=/config/baseConfig.json
+      - --execution.caching.archive=${HUMANITY_MAINNET_ARCHIVE_DB:-false}
+      - --execution.caching.database-cache=${HUMANITY_MAINNET_NITRO_PRUNED_PEBBLE_HASH_DATABASE_CACHE:-2048}
+      - --execution.caching.snapshot-cache=${HUMANITY_MAINNET_NITRO_PRUNED_PEBBLE_HASH_SNAPSHOT_CACHE:-400}
+      - --execution.caching.trie-clean-cache=${HUMANITY_MAINNET_NITRO_PRUNED_PEBBLE_HASH_TRIE_CLEAN_CACHE:-600}
+      - --execution.caching.trie-dirty-cache=${HUMANITY_MAINNET_NITRO_PRUNED_PEBBLE_HASH_TRIE_DIRTY_CACHE:-1024}
+      - --execution.forwarding-target=https://humanity-main.g.alchemy.com/public
+      - --execution.rpc.gas-cap=5500000000
+      - --execution.rpc.log-history=0
+      - --execution.sequencer.enable=false
+      - --http.addr=0.0.0.0
+      - --http.api=eth,net,web3,arb,txpool,debug
+      - --http.corsdomain=*
+      - --http.port=8545
+      - --http.vhosts=*
+      - --init.prune=full
+      - --metrics
+      - --metrics-server.addr=0.0.0.0
+      - --metrics-server.port=6070
+      - --node.batch-poster.enable=false
+      - --node.da.anytrust.enable=true
+      - --node.da.anytrust.rest-aggregator.enable=true
+      - --node.da.anytrust.rest-aggregator.urls=https://humanity-main.g.alchemy.com/public
+      - --node.feed.input.url=wss://humanity-main.g.alchemy.com/public
+      - --node.sequencer=false
+      - --node.staker.enable=false
+      - --parent-chain.connection.url=${ARBITRUM_ONE_EXECUTION_RPC}
+      - --persistent.chain=/root/.arbitrum/humanity-mainnet
+      - --persistent.db-engine=pebble
+      - --ws.addr=0.0.0.0
+      - --ws.origins=*
+      - --ws.port=8545
+    restart: unless-stopped
+    stop_grace_period: 5m
+    networks:
+      - chains
+    volumes:
+      - ${HUMANITY_MAINNET_NITRO_PRUNED_PEBBLE_HASH_DATA:-humanity-mainnet-nitro-pruned-pebble-hash}:/root/.arbitrum
+      - /slowdisk:/slowdisk
+    logging: *logging-defaults
+    labels:
+      - prometheus-scrape.enabled=true
+      - prometheus-scrape.port=6070
+      - prometheus-scrape.path=/debug/metrics/prometheus
+      - traefik.enable=true
+      - traefik.http.middlewares.humanity-mainnet-nitro-pruned-pebble-hash-stripprefix.stripprefix.prefixes=/humanity-mainnet
+      - traefik.http.services.humanity-mainnet-nitro-pruned-pebble-hash.loadbalancer.server.port=8545
+      - ${NO_SSL:-traefik.http.routers.humanity-mainnet-nitro-pruned-pebble-hash.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.humanity-mainnet-nitro-pruned-pebble-hash.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.humanity-mainnet-nitro-pruned-pebble-hash.rule=Host(`$DOMAIN`) && (Path(`/humanity-mainnet`) || Path(`/humanity-mainnet/`))}
+      - ${NO_SSL:+traefik.http.routers.humanity-mainnet-nitro-pruned-pebble-hash.rule=Path(`/humanity-mainnet`) || Path(`/humanity-mainnet/`)}
+      - traefik.http.routers.humanity-mainnet-nitro-pruned-pebble-hash.middlewares=humanity-mainnet-nitro-pruned-pebble-hash-stripprefix, ipallowlist
+
+volumes:
+  humanity-mainnet-nitro-pruned-pebble-hash:
+
+x-upstreams:
+  - id: $${ID}
+    labels:
+      provider: $${PROVIDER}
+    connection:
+      generic:
+        rpc:
+          url: $${RPC_URL}
+        ws:
+          frameSize: 20Mb
+          msgSize: 50Mb
+          url: $${WS_URL}
+    chain: humanity
+    method-groups:
+      enabled:
+        - debug
+        - filter
+    methods:
+      disabled:
+      enabled:
+        - name: txpool_content # TODO: should be disabled for rollup nodes
+        # standard geth only
+        - name: debug_getRawBlock
+        - name: debug_getRawTransaction
+        - name: debug_getRawReceipts
+        - name: debug_getRawHeader
+        - name: debug_getBadBlocks
+        # non standard geth only slightly dangerous
+        - name: debug_intermediateRoots
+        - name: debug_dumpBlock
+        # standard geth and erigon
+        - name: debug_accountRange
+        - name: debug_getModifiedAccountsByNumber
+        - name: debug_getModifiedAccountsByHash
+        # non standard geth and erigon
+        - name: eth_getRawTransactionByHash
+        - name: eth_getRawTransactionByBlockHashAndIndex
+...

arb/nitro/humanity-mainnet-nitro-pruned-pebble-hash.yml

@@ -0,0 +1,143 @@
+---
+x-logging-defaults: &logging-defaults
+  driver: json-file
+  options:
+    max-size: "512m"
+    max-file: "2"
+
+# Usage:
+#
+# mkdir rpc && cd rpc
+#
+# git init
+# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
+# git fetch origin vibe
+# git checkout origin/vibe
+#
+# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
+#
+# env
+# ...
+# IP=$(curl ipinfo.io/ip)
+# DOMAIN=${IP}.traefik.me
+# COMPOSE_FILE=base.yml:rpc.yml:arb/nitro/humanity-mainnet-nitro-pruned-pebble-hash.yml
+#
+# docker compose up -d
+#
+# curl -X POST https://${IP}.traefik.me/humanity-mainnet \
+#   -H "Content-Type: application/json" \
+#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
+
+services:
+  humanity-mainnet:
+    image: ${HUMANITY_NITRO_IMAGE:-offchainlabs/nitro-node}:${HUMANITY_MAINNET_NITRO_VERSION:-v3.11.2-3599aca}
+    sysctls:
+      # TCP Performance
+      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
+      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
+      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
+      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
+      net.core.somaxconn: 32768                   # Higher connection queue
+      # Memory/Connection Management
+      # net.core.netdev_max_backlog: 50000          # Increase network buffer
+      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
+      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
+    ulimits:
+      nofile: 1048576    # Max open files (for RPC/WS connections)
+    user: root
+    expose:
+      - 8545
+    command:
+      - --conf.file=/config/baseConfig.json
+      - --execution.caching.archive=${HUMANITY_MAINNET_ARCHIVE_DB:-false}
+      - --execution.caching.database-cache=${HUMANITY_MAINNET_NITRO_PRUNED_PEBBLE_HASH_DATABASE_CACHE:-2048}
+      - --execution.caching.snapshot-cache=${HUMANITY_MAINNET_NITRO_PRUNED_PEBBLE_HASH_SNAPSHOT_CACHE:-400}
+      - --execution.caching.trie-clean-cache=${HUMANITY_MAINNET_NITRO_PRUNED_PEBBLE_HASH_TRIE_CLEAN_CACHE:-600}
+      - --execution.caching.trie-dirty-cache=${HUMANITY_MAINNET_NITRO_PRUNED_PEBBLE_HASH_TRIE_DIRTY_CACHE:-1024}
+      - --execution.forwarding-target=https://humanity-main.g.alchemy.com/public
+      - --execution.rpc.gas-cap=5500000000
+      - --execution.rpc.log-history=0
+      - --execution.sequencer.enable=false
+      - --http.addr=0.0.0.0
+      - --http.api=eth,net,web3,arb,txpool,debug
+      - --http.corsdomain=*
+      - --http.port=8545
+      - --http.vhosts=*
+      - --metrics
+      - --metrics-server.addr=0.0.0.0
+      - --metrics-server.port=6070
+      - --node.batch-poster.enable=false
+      - --node.da.anytrust.enable=true
+      - --node.da.anytrust.rest-aggregator.enable=true
+      - --node.da.anytrust.rest-aggregator.urls=https://humanity-main.g.alchemy.com/public
+      - --node.feed.input.url=wss://humanity-main.g.alchemy.com/public
+      - --node.sequencer=false
+      - --node.staker.enable=false
+      - --parent-chain.connection.url=${ARBITRUM_ONE_EXECUTION_RPC}
+      - --persistent.chain=/root/.arbitrum/humanity-mainnet
+      - --persistent.db-engine=pebble
+      - --ws.addr=0.0.0.0
+      - --ws.origins=*
+      - --ws.port=8545
+    restart: unless-stopped
+    stop_grace_period: 5m
+    networks:
+      - chains
+    volumes:
+      - ${HUMANITY_MAINNET_NITRO_PRUNED_PEBBLE_HASH_DATA:-humanity-mainnet-nitro-pruned-pebble-hash}:/root/.arbitrum
+      - /slowdisk:/slowdisk
+    logging: *logging-defaults
+    labels:
+      - prometheus-scrape.enabled=true
+      - prometheus-scrape.port=6070
+      - prometheus-scrape.path=/debug/metrics/prometheus
+      - traefik.enable=true
+      - traefik.http.middlewares.humanity-mainnet-nitro-pruned-pebble-hash-stripprefix.stripprefix.prefixes=/humanity-mainnet
+      - traefik.http.services.humanity-mainnet-nitro-pruned-pebble-hash.loadbalancer.server.port=8545
+      - ${NO_SSL:-traefik.http.routers.humanity-mainnet-nitro-pruned-pebble-hash.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.humanity-mainnet-nitro-pruned-pebble-hash.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.humanity-mainnet-nitro-pruned-pebble-hash.rule=Host(`$DOMAIN`) && (Path(`/humanity-mainnet`) || Path(`/humanity-mainnet/`))}
+      - ${NO_SSL:+traefik.http.routers.humanity-mainnet-nitro-pruned-pebble-hash.rule=Path(`/humanity-mainnet`) || Path(`/humanity-mainnet/`)}
+      - traefik.http.routers.humanity-mainnet-nitro-pruned-pebble-hash.middlewares=humanity-mainnet-nitro-pruned-pebble-hash-stripprefix, ipallowlist
+
+volumes:
+  humanity-mainnet-nitro-pruned-pebble-hash:
+
+x-upstreams:
+  - id: $${ID}
+    labels:
+      provider: $${PROVIDER}
+    connection:
+      generic:
+        rpc:
+          url: $${RPC_URL}
+        ws:
+          frameSize: 20Mb
+          msgSize: 50Mb
+          url: $${WS_URL}
+    chain: humanity
+    method-groups:
+      enabled:
+        - debug
+        - filter
+    methods:
+      disabled:
+      enabled:
+        - name: txpool_content # TODO: should be disabled for rollup nodes
+        # standard geth only
+        - name: debug_getRawBlock
+        - name: debug_getRawTransaction
+        - name: debug_getRawReceipts
+        - name: debug_getRawHeader
+        - name: debug_getBadBlocks
+        # non standard geth only slightly dangerous
+        - name: debug_intermediateRoots
+        - name: debug_dumpBlock
+        # standard geth and erigon
+        - name: debug_accountRange
+        - name: debug_getModifiedAccountsByNumber
+        - name: debug_getModifiedAccountsByHash
+        # non standard geth and erigon
+        - name: eth_getRawTransactionByHash
+        - name: eth_getRawTransactionByBlockHashAndIndex
+...

arb/nitro/humanity-testnet-nitro-pruned-pebble-hash.prune.yml

@@ -0,0 +1,144 @@
+---
+x-logging-defaults: &logging-defaults
+  driver: json-file
+  options:
+    max-size: "512m"
+    max-file: "2"
+
+# Usage:
+#
+# mkdir rpc && cd rpc
+#
+# git init
+# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
+# git fetch origin vibe
+# git checkout origin/vibe
+#
+# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
+#
+# env
+# ...
+# IP=$(curl ipinfo.io/ip)
+# DOMAIN=${IP}.traefik.me
+# COMPOSE_FILE=base.yml:rpc.yml:arb/nitro/humanity-testnet-nitro-pruned-pebble-hash.yml
+#
+# docker compose up -d
+#
+# curl -X POST https://${IP}.traefik.me/humanity-testnet \
+#   -H "Content-Type: application/json" \
+#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
+
+services:
+  humanity-testnet:
+    image: ${HUMANITY_NITRO_IMAGE:-offchainlabs/nitro-node}:${HUMANITY_TESTNET_NITRO_VERSION:-v3.11.2-3599aca}
+    sysctls:
+      # TCP Performance
+      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
+      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
+      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
+      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
+      net.core.somaxconn: 32768                   # Higher connection queue
+      # Memory/Connection Management
+      # net.core.netdev_max_backlog: 50000          # Increase network buffer
+      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
+      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
+    ulimits:
+      nofile: 1048576    # Max open files (for RPC/WS connections)
+    user: root
+    expose:
+      - 8545
+    command:
+      - --conf.file=/config/baseConfig.json
+      - --execution.caching.archive=${HUMANITY_TESTNET_ARCHIVE_DB:-false}
+      - --execution.caching.database-cache=${HUMANITY_TESTNET_NITRO_PRUNED_PEBBLE_HASH_DATABASE_CACHE:-2048}
+      - --execution.caching.snapshot-cache=${HUMANITY_TESTNET_NITRO_PRUNED_PEBBLE_HASH_SNAPSHOT_CACHE:-400}
+      - --execution.caching.trie-clean-cache=${HUMANITY_TESTNET_NITRO_PRUNED_PEBBLE_HASH_TRIE_CLEAN_CACHE:-600}
+      - --execution.caching.trie-dirty-cache=${HUMANITY_TESTNET_NITRO_PRUNED_PEBBLE_HASH_TRIE_DIRTY_CACHE:-1024}
+      - --execution.forwarding-target=https://rpc.testnet.humanity.org
+      - --execution.rpc.gas-cap=5500000000
+      - --execution.rpc.log-history=0
+      - --execution.sequencer.enable=false
+      - --http.addr=0.0.0.0
+      - --http.api=eth,net,web3,arb,txpool,debug
+      - --http.corsdomain=*
+      - --http.port=8545
+      - --http.vhosts=*
+      - --init.prune=full
+      - --metrics
+      - --metrics-server.addr=0.0.0.0
+      - --metrics-server.port=6070
+      - --node.batch-poster.enable=false
+      - --node.da.anytrust.enable=true
+      - --node.da.anytrust.rest-aggregator.enable=true
+      - --node.da.anytrust.rest-aggregator.urls=https://rpc.testnet.humanity.org
+      - --node.feed.input.url=wss://rpc.testnet.humanity.org
+      - --node.sequencer=false
+      - --node.staker.enable=false
+      - --parent-chain.connection.url=${ARBITRUM_ONE_EXECUTION_RPC}
+      - --persistent.chain=/root/.arbitrum/humanity-testnet
+      - --persistent.db-engine=pebble
+      - --ws.addr=0.0.0.0
+      - --ws.origins=*
+      - --ws.port=8545
+    restart: unless-stopped
+    stop_grace_period: 5m
+    networks:
+      - chains
+    volumes:
+      - ${HUMANITY_TESTNET_NITRO_PRUNED_PEBBLE_HASH_DATA:-humanity-testnet-nitro-pruned-pebble-hash}:/root/.arbitrum
+      - /slowdisk:/slowdisk
+    logging: *logging-defaults
+    labels:
+      - prometheus-scrape.enabled=true
+      - prometheus-scrape.port=6070
+      - prometheus-scrape.path=/debug/metrics/prometheus
+      - traefik.enable=true
+      - traefik.http.middlewares.humanity-testnet-nitro-pruned-pebble-hash-stripprefix.stripprefix.prefixes=/humanity-testnet
+      - traefik.http.services.humanity-testnet-nitro-pruned-pebble-hash.loadbalancer.server.port=8545
+      - ${NO_SSL:-traefik.http.routers.humanity-testnet-nitro-pruned-pebble-hash.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.humanity-testnet-nitro-pruned-pebble-hash.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.humanity-testnet-nitro-pruned-pebble-hash.rule=Host(`$DOMAIN`) && (Path(`/humanity-testnet`) || Path(`/humanity-testnet/`))}
+      - ${NO_SSL:+traefik.http.routers.humanity-testnet-nitro-pruned-pebble-hash.rule=Path(`/humanity-testnet`) || Path(`/humanity-testnet/`)}
+      - traefik.http.routers.humanity-testnet-nitro-pruned-pebble-hash.middlewares=humanity-testnet-nitro-pruned-pebble-hash-stripprefix, ipallowlist
+
+volumes:
+  humanity-testnet-nitro-pruned-pebble-hash:
+
+x-upstreams:
+  - id: $${ID}
+    labels:
+      provider: $${PROVIDER}
+    connection:
+      generic:
+        rpc:
+          url: $${RPC_URL}
+        ws:
+          frameSize: 20Mb
+          msgSize: 50Mb
+          url: $${WS_URL}
+    chain: humanity-testnet
+    method-groups:
+      enabled:
+        - debug
+        - filter
+    methods:
+      disabled:
+      enabled:
+        - name: txpool_content # TODO: should be disabled for rollup nodes
+        # standard geth only
+        - name: debug_getRawBlock
+        - name: debug_getRawTransaction
+        - name: debug_getRawReceipts
+        - name: debug_getRawHeader
+        - name: debug_getBadBlocks
+        # non standard geth only slightly dangerous
+        - name: debug_intermediateRoots
+        - name: debug_dumpBlock
+        # standard geth and erigon
+        - name: debug_accountRange
+        - name: debug_getModifiedAccountsByNumber
+        - name: debug_getModifiedAccountsByHash
+        # non standard geth and erigon
+        - name: eth_getRawTransactionByHash
+        - name: eth_getRawTransactionByBlockHashAndIndex
+...

arb/nitro/humanity-testnet-nitro-pruned-pebble-hash.yml

@@ -0,0 +1,143 @@
+---
+x-logging-defaults: &logging-defaults
+  driver: json-file
+  options:
+    max-size: "512m"
+    max-file: "2"
+
+# Usage:
+#
+# mkdir rpc && cd rpc
+#
+# git init
+# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
+# git fetch origin vibe
+# git checkout origin/vibe
+#
+# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
+#
+# env
+# ...
+# IP=$(curl ipinfo.io/ip)
+# DOMAIN=${IP}.traefik.me
+# COMPOSE_FILE=base.yml:rpc.yml:arb/nitro/humanity-testnet-nitro-pruned-pebble-hash.yml
+#
+# docker compose up -d
+#
+# curl -X POST https://${IP}.traefik.me/humanity-testnet \
+#   -H "Content-Type: application/json" \
+#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
+
+services:
+  humanity-testnet:
+    image: ${HUMANITY_NITRO_IMAGE:-offchainlabs/nitro-node}:${HUMANITY_TESTNET_NITRO_VERSION:-v3.11.2-3599aca}
+    sysctls:
+      # TCP Performance
+      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
+      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
+      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
+      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
+      net.core.somaxconn: 32768                   # Higher connection queue
+      # Memory/Connection Management
+      # net.core.netdev_max_backlog: 50000          # Increase network buffer
+      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
+      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
+    ulimits:
+      nofile: 1048576    # Max open files (for RPC/WS connections)
+    user: root
+    expose:
+      - 8545
+    command:
+      - --conf.file=/config/baseConfig.json
+      - --execution.caching.archive=${HUMANITY_TESTNET_ARCHIVE_DB:-false}
+      - --execution.caching.database-cache=${HUMANITY_TESTNET_NITRO_PRUNED_PEBBLE_HASH_DATABASE_CACHE:-2048}
+      - --execution.caching.snapshot-cache=${HUMANITY_TESTNET_NITRO_PRUNED_PEBBLE_HASH_SNAPSHOT_CACHE:-400}
+      - --execution.caching.trie-clean-cache=${HUMANITY_TESTNET_NITRO_PRUNED_PEBBLE_HASH_TRIE_CLEAN_CACHE:-600}
+      - --execution.caching.trie-dirty-cache=${HUMANITY_TESTNET_NITRO_PRUNED_PEBBLE_HASH_TRIE_DIRTY_CACHE:-1024}
+      - --execution.forwarding-target=https://rpc.testnet.humanity.org
+      - --execution.rpc.gas-cap=5500000000
+      - --execution.rpc.log-history=0
+      - --execution.sequencer.enable=false
+      - --http.addr=0.0.0.0
+      - --http.api=eth,net,web3,arb,txpool,debug
+      - --http.corsdomain=*
+      - --http.port=8545
+      - --http.vhosts=*
+      - --metrics
+      - --metrics-server.addr=0.0.0.0
+      - --metrics-server.port=6070
+      - --node.batch-poster.enable=false
+      - --node.da.anytrust.enable=true
+      - --node.da.anytrust.rest-aggregator.enable=true
+      - --node.da.anytrust.rest-aggregator.urls=https://rpc.testnet.humanity.org
+      - --node.feed.input.url=wss://rpc.testnet.humanity.org
+      - --node.sequencer=false
+      - --node.staker.enable=false
+      - --parent-chain.connection.url=${ARBITRUM_ONE_EXECUTION_RPC}
+      - --persistent.chain=/root/.arbitrum/humanity-testnet
+      - --persistent.db-engine=pebble
+      - --ws.addr=0.0.0.0
+      - --ws.origins=*
+      - --ws.port=8545
+    restart: unless-stopped
+    stop_grace_period: 5m
+    networks:
+      - chains
+    volumes:
+      - ${HUMANITY_TESTNET_NITRO_PRUNED_PEBBLE_HASH_DATA:-humanity-testnet-nitro-pruned-pebble-hash}:/root/.arbitrum
+      - /slowdisk:/slowdisk
+    logging: *logging-defaults
+    labels:
+      - prometheus-scrape.enabled=true
+      - prometheus-scrape.port=6070
+      - prometheus-scrape.path=/debug/metrics/prometheus
+      - traefik.enable=true
+      - traefik.http.middlewares.humanity-testnet-nitro-pruned-pebble-hash-stripprefix.stripprefix.prefixes=/humanity-testnet
+      - traefik.http.services.humanity-testnet-nitro-pruned-pebble-hash.loadbalancer.server.port=8545
+      - ${NO_SSL:-traefik.http.routers.humanity-testnet-nitro-pruned-pebble-hash.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.humanity-testnet-nitro-pruned-pebble-hash.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.humanity-testnet-nitro-pruned-pebble-hash.rule=Host(`$DOMAIN`) && (Path(`/humanity-testnet`) || Path(`/humanity-testnet/`))}
+      - ${NO_SSL:+traefik.http.routers.humanity-testnet-nitro-pruned-pebble-hash.rule=Path(`/humanity-testnet`) || Path(`/humanity-testnet/`)}
+      - traefik.http.routers.humanity-testnet-nitro-pruned-pebble-hash.middlewares=humanity-testnet-nitro-pruned-pebble-hash-stripprefix, ipallowlist
+
+volumes:
+  humanity-testnet-nitro-pruned-pebble-hash:
+
+x-upstreams:
+  - id: $${ID}
+    labels:
+      provider: $${PROVIDER}
+    connection:
+      generic:
+        rpc:
+          url: $${RPC_URL}
+        ws:
+          frameSize: 20Mb
+          msgSize: 50Mb
+          url: $${WS_URL}
+    chain: humanity-testnet
+    method-groups:
+      enabled:
+        - debug
+        - filter
+    methods:
+      disabled:
+      enabled:
+        - name: txpool_content # TODO: should be disabled for rollup nodes
+        # standard geth only
+        - name: debug_getRawBlock
+        - name: debug_getRawTransaction
+        - name: debug_getRawReceipts
+        - name: debug_getRawHeader
+        - name: debug_getBadBlocks
+        # non standard geth only slightly dangerous
+        - name: debug_intermediateRoots
+        - name: debug_dumpBlock
+        # standard geth and erigon
+        - name: debug_accountRange
+        - name: debug_getModifiedAccountsByNumber
+        - name: debug_getModifiedAccountsByHash
+        # non standard geth and erigon
+        - name: eth_getRawTransactionByHash
+        - name: eth_getRawTransactionByBlockHashAndIndex
+...

arb/nitro/plume-mainnet-nitro-archive-leveldb-hash.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/plume-mainnet-archive
       - --ws.addr=0.0.0.0

arb/nitro/plume-mainnet-nitro-archive-pebble-hash.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/plume-mainnet-archive
       - --persistent.db-engine=pebble

arb/nitro/plume-mainnet-nitro-pruned-leveldb-hash.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/plume-mainnet
       - --ws.addr=0.0.0.0

arb/nitro/plume-mainnet-nitro-pruned-pebble-path.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/plume-mainnet
       - --persistent.db-engine=pebble

arb/nitro/plume-testnet-nitro-archive-leveldb-hash.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/plume-testnet-archive
       - --ws.addr=0.0.0.0

arb/nitro/plume-testnet-nitro-archive-pebble-hash.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/plume-testnet-archive
       - --persistent.db-engine=pebble

arb/nitro/plume-testnet-nitro-pruned-leveldb-hash.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/plume-testnet
       - --ws.addr=0.0.0.0

arb/nitro/plume-testnet-nitro-pruned-pebble-path.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/plume-testnet
       - --persistent.db-engine=pebble

arb/nitro/real-mainnet-nitro-archive-leveldb-hash.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/real-mainnet-archive
       - --ws.addr=0.0.0.0

arb/nitro/real-mainnet-nitro-archive-pebble-hash.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/real-mainnet-archive
       - --persistent.db-engine=pebble

arb/nitro/real-mainnet-nitro-pruned-pebble-path.yml

@@ -74,6 +74,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/real-mainnet
       - --persistent.db-engine=pebble

arb/nitro/robinhood-mainnet-nitro-archive-pebble-hash.yml

@@ -0,0 +1,143 @@
+---
+x-logging-defaults: &logging-defaults
+  driver: json-file
+  options:
+    max-size: "512m"
+    max-file: "2"
+
+# Usage:
+#
+# mkdir rpc && cd rpc
+#
+# git init
+# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
+# git fetch origin vibe
+# git checkout origin/vibe
+#
+# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
+#
+# env
+# ...
+# IP=$(curl ipinfo.io/ip)
+# DOMAIN=${IP}.traefik.me
+# COMPOSE_FILE=base.yml:rpc.yml:arb/nitro/robinhood-mainnet-nitro-archive-pebble-hash.yml
+#
+# docker compose up -d
+#
+# curl -X POST https://${IP}.traefik.me/robinhood-mainnet-archive \
+#   -H "Content-Type: application/json" \
+#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
+
+services:
+  robinhood-mainnet-archive:
+    image: ${ROBINHOOD_NITRO_IMAGE:-offchainlabs/nitro-node}:${ROBINHOOD_MAINNET_NITRO_VERSION:-v3.11.2-3599aca}
+    sysctls:
+      # TCP Performance
+      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
+      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
+      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
+      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
+      net.core.somaxconn: 32768                   # Higher connection queue
+      # Memory/Connection Management
+      # net.core.netdev_max_backlog: 50000          # Increase network buffer
+      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
+      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
+    ulimits:
+      nofile: 1048576    # Max open files (for RPC/WS connections)
+    user: root
+    expose:
+      - 8545
+    command:
+      - --conf.file=/config/baseConfig.json
+      - --execution.caching.archive=true
+      - --execution.caching.database-cache=${ROBINHOOD_MAINNET_NITRO_ARCHIVE_PEBBLE_HASH_DATABASE_CACHE:-2048}
+      - --execution.caching.snapshot-cache=${ROBINHOOD_MAINNET_NITRO_ARCHIVE_PEBBLE_HASH_SNAPSHOT_CACHE:-400}
+      - --execution.caching.trie-clean-cache=${ROBINHOOD_MAINNET_NITRO_ARCHIVE_PEBBLE_HASH_TRIE_CLEAN_CACHE:-600}
+      - --execution.caching.trie-dirty-cache=${ROBINHOOD_MAINNET_NITRO_ARCHIVE_PEBBLE_HASH_TRIE_DIRTY_CACHE:-1024}
+      - --execution.forwarding-target=https://rpc.mainnet.chain.robinhood.com
+      - --execution.rpc.filter-log-cache-size=${ROBINHOOD_MAINNET_NITRO_ARCHIVE_PEBBLE_HASH_FILTER_LOG_CACHE:-32}
+      - --execution.rpc.gas-cap=5500000000
+      - --execution.rpc.log-history=0
+      - --execution.sequencer.enable=false
+      - --http.addr=0.0.0.0
+      - --http.api=eth,net,web3,arb,txpool,debug
+      - --http.corsdomain=*
+      - --http.port=8545
+      - --http.vhosts=*
+      - --metrics
+      - --metrics-server.addr=0.0.0.0
+      - --metrics-server.port=6070
+      - --node.batch-poster.enable=false
+      - --node.feed.input.url=wss://feed.mainnet.chain.robinhood.com
+      - --node.sequencer=false
+      - --node.staker.enable=false
+      - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
+      - --persistent.chain=/root/.arbitrum/robinhood-mainnet-archive
+      - --persistent.db-engine=pebble
+      - --ws.addr=0.0.0.0
+      - --ws.origins=*
+      - --ws.port=8545
+    restart: unless-stopped
+    stop_grace_period: 5m
+    networks:
+      - chains
+    volumes:
+      - ${ROBINHOOD_MAINNET_NITRO_ARCHIVE_PEBBLE_HASH_DATA:-robinhood-mainnet-nitro-archive-pebble-hash}:/root/.arbitrum
+      - ./arb/robinhood/mainnet:/config
+      - /slowdisk:/slowdisk
+    logging: *logging-defaults
+    labels:
+      - prometheus-scrape.enabled=true
+      - prometheus-scrape.port=6070
+      - prometheus-scrape.path=/debug/metrics/prometheus
+      - traefik.enable=true
+      - traefik.http.middlewares.robinhood-mainnet-nitro-archive-pebble-hash-stripprefix.stripprefix.prefixes=/robinhood-mainnet-archive
+      - traefik.http.services.robinhood-mainnet-nitro-archive-pebble-hash.loadbalancer.server.port=8545
+      - ${NO_SSL:-traefik.http.routers.robinhood-mainnet-nitro-archive-pebble-hash.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.robinhood-mainnet-nitro-archive-pebble-hash.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.robinhood-mainnet-nitro-archive-pebble-hash.rule=Host(`$DOMAIN`) && (Path(`/robinhood-mainnet-archive`) || Path(`/robinhood-mainnet-archive/`))}
+      - ${NO_SSL:+traefik.http.routers.robinhood-mainnet-nitro-archive-pebble-hash.rule=Path(`/robinhood-mainnet-archive`) || Path(`/robinhood-mainnet-archive/`)}
+      - traefik.http.routers.robinhood-mainnet-nitro-archive-pebble-hash.middlewares=robinhood-mainnet-nitro-archive-pebble-hash-stripprefix, ipallowlist
+
+volumes:
+  robinhood-mainnet-nitro-archive-pebble-hash:
+
+x-upstreams:
+  - id: $${ID}
+    labels:
+      provider: $${PROVIDER}
+    connection:
+      generic:
+        rpc:
+          url: $${RPC_URL}
+        ws:
+          frameSize: 20Mb
+          msgSize: 50Mb
+          url: $${WS_URL}
+    chain: robinhood
+    method-groups:
+      enabled:
+        - debug
+        - filter
+    methods:
+      disabled:
+      enabled:
+        - name: txpool_content # TODO: should be disabled for rollup nodes
+        # standard geth only
+        - name: debug_getRawBlock
+        - name: debug_getRawTransaction
+        - name: debug_getRawReceipts
+        - name: debug_getRawHeader
+        - name: debug_getBadBlocks
+        # non standard geth only slightly dangerous
+        - name: debug_intermediateRoots
+        - name: debug_dumpBlock
+        # standard geth and erigon
+        - name: debug_accountRange
+        - name: debug_getModifiedAccountsByNumber
+        - name: debug_getModifiedAccountsByHash
+        # non standard geth and erigon
+        - name: eth_getRawTransactionByHash
+        - name: eth_getRawTransactionByBlockHashAndIndex
+...

arb/nitro/robinhood-mainnet-nitro-pruned-pebble-path.yml

@@ -71,6 +71,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_MAINNET_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/robinhood-mainnet
       - --persistent.db-engine=pebble

arb/nitro/robinhood-testnet-nitro-archive-pebble-hash.yml

@@ -0,0 +1,143 @@
+---
+x-logging-defaults: &logging-defaults
+  driver: json-file
+  options:
+    max-size: "512m"
+    max-file: "2"
+
+# Usage:
+#
+# mkdir rpc && cd rpc
+#
+# git init
+# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
+# git fetch origin vibe
+# git checkout origin/vibe
+#
+# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
+#
+# env
+# ...
+# IP=$(curl ipinfo.io/ip)
+# DOMAIN=${IP}.traefik.me
+# COMPOSE_FILE=base.yml:rpc.yml:arb/nitro/robinhood-testnet-nitro-archive-pebble-hash.yml
+#
+# docker compose up -d
+#
+# curl -X POST https://${IP}.traefik.me/robinhood-testnet-archive \
+#   -H "Content-Type: application/json" \
+#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
+
+services:
+  robinhood-testnet-archive:
+    image: ${ROBINHOOD_NITRO_IMAGE:-offchainlabs/nitro-node}:${ROBINHOOD_TESTNET_NITRO_VERSION:-v3.11.2-3599aca}
+    sysctls:
+      # TCP Performance
+      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
+      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
+      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
+      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
+      net.core.somaxconn: 32768                   # Higher connection queue
+      # Memory/Connection Management
+      # net.core.netdev_max_backlog: 50000          # Increase network buffer
+      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
+      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
+    ulimits:
+      nofile: 1048576    # Max open files (for RPC/WS connections)
+    user: root
+    expose:
+      - 8545
+    command:
+      - --conf.file=/config/baseConfig.json
+      - --execution.caching.archive=true
+      - --execution.caching.database-cache=${ROBINHOOD_TESTNET_NITRO_ARCHIVE_PEBBLE_HASH_DATABASE_CACHE:-2048}
+      - --execution.caching.snapshot-cache=${ROBINHOOD_TESTNET_NITRO_ARCHIVE_PEBBLE_HASH_SNAPSHOT_CACHE:-400}
+      - --execution.caching.trie-clean-cache=${ROBINHOOD_TESTNET_NITRO_ARCHIVE_PEBBLE_HASH_TRIE_CLEAN_CACHE:-600}
+      - --execution.caching.trie-dirty-cache=${ROBINHOOD_TESTNET_NITRO_ARCHIVE_PEBBLE_HASH_TRIE_DIRTY_CACHE:-1024}
+      - --execution.forwarding-target=https://rpc.testnet.chain.robinhood.com
+      - --execution.rpc.filter-log-cache-size=${ROBINHOOD_TESTNET_NITRO_ARCHIVE_PEBBLE_HASH_FILTER_LOG_CACHE:-32}
+      - --execution.rpc.gas-cap=5500000000
+      - --execution.rpc.log-history=0
+      - --execution.sequencer.enable=false
+      - --http.addr=0.0.0.0
+      - --http.api=eth,net,web3,arb,txpool,debug
+      - --http.corsdomain=*
+      - --http.port=8545
+      - --http.vhosts=*
+      - --metrics
+      - --metrics-server.addr=0.0.0.0
+      - --metrics-server.port=6070
+      - --node.batch-poster.enable=false
+      - --node.feed.input.url=wss://feed.testnet.chain.robinhood.com
+      - --node.sequencer=false
+      - --node.staker.enable=false
+      - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
+      - --persistent.chain=/root/.arbitrum/robinhood-testnet-archive
+      - --persistent.db-engine=pebble
+      - --ws.addr=0.0.0.0
+      - --ws.origins=*
+      - --ws.port=8545
+    restart: unless-stopped
+    stop_grace_period: 5m
+    networks:
+      - chains
+    volumes:
+      - ${ROBINHOOD_TESTNET_NITRO_ARCHIVE_PEBBLE_HASH_DATA:-robinhood-testnet-nitro-archive-pebble-hash}:/root/.arbitrum
+      - ./arb/robinhood/testnet:/config
+      - /slowdisk:/slowdisk
+    logging: *logging-defaults
+    labels:
+      - prometheus-scrape.enabled=true
+      - prometheus-scrape.port=6070
+      - prometheus-scrape.path=/debug/metrics/prometheus
+      - traefik.enable=true
+      - traefik.http.middlewares.robinhood-testnet-nitro-archive-pebble-hash-stripprefix.stripprefix.prefixes=/robinhood-testnet-archive
+      - traefik.http.services.robinhood-testnet-nitro-archive-pebble-hash.loadbalancer.server.port=8545
+      - ${NO_SSL:-traefik.http.routers.robinhood-testnet-nitro-archive-pebble-hash.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.robinhood-testnet-nitro-archive-pebble-hash.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.robinhood-testnet-nitro-archive-pebble-hash.rule=Host(`$DOMAIN`) && (Path(`/robinhood-testnet-archive`) || Path(`/robinhood-testnet-archive/`))}
+      - ${NO_SSL:+traefik.http.routers.robinhood-testnet-nitro-archive-pebble-hash.rule=Path(`/robinhood-testnet-archive`) || Path(`/robinhood-testnet-archive/`)}
+      - traefik.http.routers.robinhood-testnet-nitro-archive-pebble-hash.middlewares=robinhood-testnet-nitro-archive-pebble-hash-stripprefix, ipallowlist
+
+volumes:
+  robinhood-testnet-nitro-archive-pebble-hash:
+
+x-upstreams:
+  - id: $${ID}
+    labels:
+      provider: $${PROVIDER}
+    connection:
+      generic:
+        rpc:
+          url: $${RPC_URL}
+        ws:
+          frameSize: 20Mb
+          msgSize: 50Mb
+          url: $${WS_URL}
+    chain: robinhood-testnet
+    method-groups:
+      enabled:
+        - debug
+        - filter
+    methods:
+      disabled:
+      enabled:
+        - name: txpool_content # TODO: should be disabled for rollup nodes
+        # standard geth only
+        - name: debug_getRawBlock
+        - name: debug_getRawTransaction
+        - name: debug_getRawReceipts
+        - name: debug_getRawHeader
+        - name: debug_getBadBlocks
+        # non standard geth only slightly dangerous
+        - name: debug_intermediateRoots
+        - name: debug_dumpBlock
+        # standard geth and erigon
+        - name: debug_accountRange
+        - name: debug_getModifiedAccountsByNumber
+        - name: debug_getModifiedAccountsByHash
+        # non standard geth and erigon
+        - name: eth_getRawTransactionByHash
+        - name: eth_getRawTransactionByBlockHashAndIndex
+...

arb/nitro/robinhood-testnet-nitro-pruned-pebble-path.yml

@@ -71,6 +71,7 @@ services:
       - --node.sequencer=false
       - --node.staker.enable=false
       - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.blob-client.secondary-beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST_FALLBACK}
       - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       - --persistent.chain=/root/.arbitrum/robinhood-testnet
       - --persistent.db-engine=pebble

arc/reth/arc-mainnet-reth-archive-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   arc-mainnet-archive-consensus-init:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-0.8.0}
     user: 0:0
     entrypoint: [/usr/local/bin/arc-node-consensus, init]
     command:
@@ -45,7 +45,7 @@ services:
   arc-mainnet-archive-sockets-init:
     image: debian:bookworm-slim
     entrypoint: [/bin/sh, -c]
-    command: [rm -f /sockets/*.ipc && chown 999:999 /sockets]
+    command: [chown 999:999 /sockets]
     restart: no
     depends_on:
       arc-mainnet-archive-consensus-init:
@@ -57,7 +57,7 @@ services:
     logging: *logging-defaults
 
   arc-mainnet-archive:
-    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_MAINNET_RETH_VERSION:-0.7.2}
+    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_MAINNET_RETH_VERSION:-0.8.0}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -119,7 +119,7 @@ services:
     shm_size: 2gb
 
   arc-mainnet-archive-node:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-0.8.0}
     user: 0:0
     expose:
       - 31000
@@ -160,6 +160,9 @@ volumes:
   arc-mainnet-reth-archive-trace-execution:
   arc-mainnet-reth-archive-trace-sockets:
 
+x-ephemeral-volumes:
+  - arc-mainnet-reth-archive-trace-sockets
+
 x-upstreams:
   - id: $${ID}
     labels:

arc/reth/arc-mainnet-reth-pruned-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   arc-mainnet-consensus-init:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-0.8.0}
     user: 0:0
     entrypoint: [/usr/local/bin/arc-node-consensus, init]
     command:
@@ -45,7 +45,7 @@ services:
   arc-mainnet-sockets-init:
     image: debian:bookworm-slim
     entrypoint: [/bin/sh, -c]
-    command: [rm -f /sockets/*.ipc && chown 999:999 /sockets]
+    command: [chown 999:999 /sockets]
     restart: no
     depends_on:
       arc-mainnet-consensus-init:
@@ -57,7 +57,7 @@ services:
     logging: *logging-defaults
 
   arc-mainnet:
-    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_MAINNET_RETH_VERSION:-0.7.2}
+    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_MAINNET_RETH_VERSION:-0.8.0}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -92,6 +92,7 @@ services:
       - --ipcpath=/sockets/reth.ipc
       - --log.file.directory=/data/execution/logs
       - --metrics=0.0.0.0:9001
+      - --prune.block-interval=5000
       - --rpc.forwarder=https://rpc.arc.network/
     restart: unless-stopped
     stop_grace_period: 5m
@@ -120,7 +121,7 @@ services:
     shm_size: 2gb
 
   arc-mainnet-node:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-0.8.0}
     user: 0:0
     expose:
       - 31000
@@ -161,6 +162,9 @@ volumes:
   arc-mainnet-reth-pruned-trace-execution:
   arc-mainnet-reth-pruned-trace-sockets:
 
+x-ephemeral-volumes:
+  - arc-mainnet-reth-pruned-trace-sockets
+
 x-upstreams:
   - id: $${ID}
     labels:

arc/reth/arc-testnet-reth-archive-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   arc-testnet-archive-consensus-init:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.8.0}
     user: 0:0
     entrypoint: [/usr/local/bin/arc-node-consensus, init]
     command:
@@ -45,7 +45,7 @@ services:
   arc-testnet-archive-sockets-init:
     image: debian:bookworm-slim
     entrypoint: [/bin/sh, -c]
-    command: [rm -f /sockets/*.ipc && chown 999:999 /sockets]
+    command: [chown 999:999 /sockets]
     restart: no
     depends_on:
       arc-testnet-archive-consensus-init:
@@ -57,7 +57,7 @@ services:
     logging: *logging-defaults
 
   arc-testnet-archive:
-    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_TESTNET_RETH_VERSION:-0.7.2}
+    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_TESTNET_RETH_VERSION:-0.8.0}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -119,7 +119,7 @@ services:
     shm_size: 2gb
 
   arc-testnet-archive-node:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.8.0}
     user: 0:0
     expose:
       - 31000
@@ -160,6 +160,9 @@ volumes:
   arc-testnet-reth-archive-trace-execution:
   arc-testnet-reth-archive-trace-sockets:
 
+x-ephemeral-volumes:
+  - arc-testnet-reth-archive-trace-sockets
+
 x-upstreams:
   - id: $${ID}
     labels:

arc/reth/arc-testnet-reth-pruned-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   arc-testnet-consensus-init:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.8.0}
     user: 0:0
     entrypoint: [/usr/local/bin/arc-node-consensus, init]
     command:
@@ -45,7 +45,7 @@ services:
   arc-testnet-sockets-init:
     image: debian:bookworm-slim
     entrypoint: [/bin/sh, -c]
-    command: [rm -f /sockets/*.ipc && chown 999:999 /sockets]
+    command: [chown 999:999 /sockets]
     restart: no
     depends_on:
       arc-testnet-consensus-init:
@@ -57,7 +57,7 @@ services:
     logging: *logging-defaults
 
   arc-testnet:
-    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_TESTNET_RETH_VERSION:-0.7.2}
+    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_TESTNET_RETH_VERSION:-0.8.0}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -92,6 +92,7 @@ services:
       - --ipcpath=/sockets/reth.ipc
       - --log.file.directory=/data/execution/logs
       - --metrics=0.0.0.0:9001
+      - --prune.block-interval=5000
       - --rpc.forwarder=https://rpc.quicknode.testnet.arc.network/
     restart: unless-stopped
     stop_grace_period: 5m
@@ -120,7 +121,7 @@ services:
     shm_size: 2gb
 
   arc-testnet-node:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.8.0}
     user: 0:0
     expose:
       - 31000
@@ -161,6 +162,9 @@ volumes:
   arc-testnet-reth-pruned-trace-execution:
   arc-testnet-reth-pruned-trace-sockets:
 
+x-ephemeral-volumes:
+  - arc-testnet-reth-pruned-trace-sockets
+
 x-upstreams:
   - id: $${ID}
     labels:

arc/reth/arc-testnet-reth-pruned.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   arc-testnet-consensus-init:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.8.0}
     user: 0:0
     entrypoint: [/usr/local/bin/arc-node-consensus, init]
     command:
@@ -45,7 +45,7 @@ services:
   arc-testnet-sockets-init:
     image: debian:bookworm-slim
     entrypoint: [/bin/sh, -c]
-    command: [rm -f /sockets/*.ipc && chown 999:999 /sockets]
+    command: [chown 999:999 /sockets]
     restart: no
     depends_on:
       arc-testnet-consensus-init:
@@ -57,7 +57,7 @@ services:
     logging: *logging-defaults
 
   arc-testnet:
-    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_TESTNET_RETH_VERSION:-0.7.2}
+    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_TESTNET_RETH_VERSION:-0.8.0}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -92,6 +92,7 @@ services:
       - --ipcpath=/sockets/reth.ipc
       - --log.file.directory=/data/execution/logs
       - --metrics=0.0.0.0:9001
+      - --prune.block-interval=5000
       - --rpc.forwarder=https://rpc.quicknode.testnet.arc.network/
     restart: unless-stopped
     stop_grace_period: 5m
@@ -120,7 +121,7 @@ services:
     shm_size: 2gb
 
   arc-testnet-node:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.8.0}
     user: 0:0
     expose:
       - 31000
@@ -161,6 +162,9 @@ volumes:
   arc-testnet-reth-pruned-execution:
   arc-testnet-reth-pruned-sockets:
 
+x-ephemeral-volumes:
+  - arc-testnet-reth-pruned-sockets
+
 x-upstreams:
   - id: $${ID}
     labels:

avalanche/fuji/pruned/C/config.json

@@ -1,4 +1,6 @@
 {
     "rpc-gas-cap": 2500000000,
-    "eth-rpc-gas-limit": 2500000000
+    "eth-rpc-gas-limit": 2500000000,
+    "state-sync-enabled": true,
+    "state-sync-skip-resume": true
 }

avalanche/go/avalanche-fuji-go-archive-leveldb.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   avalanche-fuji-archive:
-    image: ${AVALANCHE_GO_IMAGE:-avaplatform/avalanchego}:${AVALANCHE_FUJI_GO_VERSION:-v1.14.2}
+    image: ${AVALANCHE_GO_IMAGE:-avaplatform/avalanchego}:${AVALANCHE_FUJI_GO_VERSION:-v1.15.0-fuji}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -107,7 +107,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: avalanche
+    chain: avalanche-fuji
     method-groups:
       enabled:
         - debug

avalanche/go/avalanche-fuji-go-pruned-leveldb.prune.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   avalanche-fuji:
-    image: ${AVALANCHE_GO_IMAGE:-avaplatform/avalanchego}:${AVALANCHE_FUJI_GO_VERSION:-v1.14.2}
+    image: ${AVALANCHE_GO_IMAGE:-avaplatform/avalanchego}:${AVALANCHE_FUJI_GO_VERSION:-v1.15.0-fuji}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -107,7 +107,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: avalanche
+    chain: avalanche-fuji
     method-groups:
       enabled:
         - debug

avalanche/go/avalanche-fuji-go-pruned-leveldb.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   avalanche-fuji:
-    image: ${AVALANCHE_GO_IMAGE:-avaplatform/avalanchego}:${AVALANCHE_FUJI_GO_VERSION:-v1.14.2}
+    image: ${AVALANCHE_GO_IMAGE:-avaplatform/avalanchego}:${AVALANCHE_FUJI_GO_VERSION:-v1.15.0-fuji}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -107,7 +107,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: avalanche
+    chain: avalanche-fuji
     method-groups:
       enabled:
         - debug

avalanche/go/avalanche-fuji-go-pruned-pebbledb.prune.yml

@@ -1,119 +0,0 @@
----
-x-logging-defaults: &logging-defaults
-  driver: json-file
-  options:
-    max-size: "512m"
-    max-file: "2"
-
-# Usage:
-#
-# mkdir rpc && cd rpc
-#
-# git init
-# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
-# git fetch origin vibe
-# git checkout origin/vibe
-#
-# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
-#
-# env
-# ...
-# IP=$(curl ipinfo.io/ip)
-# DOMAIN=${IP}.traefik.me
-# COMPOSE_FILE=base.yml:rpc.yml:avalanche/go/avalanche-fuji-go-pruned-pebbledb.yml
-#
-# docker compose up -d
-#
-# curl -X POST https://${IP}.traefik.me/avalanche-fuji \
-#   -H "Content-Type: application/json" \
-#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
-
-services:
-  avalanche-fuji:
-    image: ${AVALANCHE_GO_IMAGE:-avaplatform/avalanchego}:${AVALANCHE_FUJI_GO_VERSION:-v1.14.2}
-    sysctls:
-      # TCP Performance
-      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
-      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
-      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
-      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
-      net.core.somaxconn: 32768                   # Higher connection queue
-      # Memory/Connection Management
-      # net.core.netdev_max_backlog: 50000          # Increase network buffer
-      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
-      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
-    ulimits:
-      nofile: 1048576    # Max open files (for RPC/WS connections)
-    user: root
-    ports:
-      - 10350:10350
-      - 10350:10350/udp
-    expose:
-      - 9650
-    entrypoint: [/bin/sh, -c, mkdir -p /root/.avalanchego/offline-pruning && exec /avalanchego/build/avalanchego "$@", --]
-    command:
-      - --chain-config-dir=/config/prune
-      - --db-type=pebbledb
-      - --http-allowed-hosts=*
-      - --http-host=
-      - --network-id=fuji
-      - --public-ip=${IP}
-      - --staking-port=10350
-    restart: unless-stopped
-    stop_grace_period: 5m
-    networks:
-      - chains
-    volumes:
-      - ${AVALANCHE_FUJI_GO_PRUNED_PEBBLEDB_DATA:-avalanche-fuji-go-pruned-pebbledb}:/root/.avalanchego
-      - ./avalanche/fuji:/config
-      - /slowdisk:/slowdisk
-    logging: *logging-defaults
-    labels:
-      - prometheus-scrape.enabled=false
-      - traefik.enable=true
-      - traefik.http.middlewares.avalanche-fuji-go-pruned-pebbledb-set-path.replacepath.path=/ext/bc/C/rpc
-      - traefik.http.middlewares.avalanche-fuji-go-pruned-pebbledb-stripprefix.stripprefix.prefixes=/avalanche-fuji
-      - traefik.http.services.avalanche-fuji-go-pruned-pebbledb.loadbalancer.server.port=9650
-      - ${NO_SSL:-traefik.http.routers.avalanche-fuji-go-pruned-pebbledb.entrypoints=websecure}
-      - ${NO_SSL:-traefik.http.routers.avalanche-fuji-go-pruned-pebbledb.tls.certresolver=myresolver}
-      - ${NO_SSL:-traefik.http.routers.avalanche-fuji-go-pruned-pebbledb.rule=Host(`$DOMAIN`) && (Path(`/avalanche-fuji`) || Path(`/avalanche-fuji/`))}
-      - ${NO_SSL:+traefik.http.routers.avalanche-fuji-go-pruned-pebbledb.rule=Path(`/avalanche-fuji`) || Path(`/avalanche-fuji/`)}
-      - traefik.http.routers.avalanche-fuji-go-pruned-pebbledb.middlewares=avalanche-fuji-go-pruned-pebbledb-stripprefix, avalanche-fuji-go-pruned-pebbledb-set-path, ipallowlist
-      - traefik.http.routers.avalanche-fuji-go-pruned-pebbledb.priority=50   # gets any request that is not GET with UPGRADE header
-      - traefik.http.routers.avalanche-fuji-go-pruned-pebbledb-ws.priority=100   # answers GET requests first
-      - traefik.http.middlewares.avalanche-fuji-go-pruned-pebbledb-set-ws-path.replacepath.path=/ext/bc/C/ws
-      - traefik.http.services.avalanche-fuji-go-pruned-pebbledb-ws.loadbalancer.server.port=9650
-      - traefik.http.routers.avalanche-fuji-go-pruned-pebbledb-ws.service=avalanche-fuji-go-pruned-pebbledb-ws
-      - traefik.http.routers.avalanche-fuji-go-pruned-pebbledb.service=avalanche-fuji-go-pruned-pebbledb
-      - ${NO_SSL:-traefik.http.routers.avalanche-fuji-go-pruned-pebbledb-ws.entrypoints=websecure}
-      - ${NO_SSL:-traefik.http.routers.avalanche-fuji-go-pruned-pebbledb-ws.tls.certresolver=myresolver}
-      # case-insensitive Upgrade: python websocket-client sends "WebSocket" (capital W)
-      - ${NO_SSL:-traefik.http.routers.avalanche-fuji-go-pruned-pebbledb-ws.rule=Host(`$DOMAIN`) && (Path(`/avalanche-fuji`) || Path(`/avalanche-fuji/`)) && HeadersRegexp(`Upgrade`, `(?i)websocket`)}
-      - ${NO_SSL:+traefik.http.routers.avalanche-fuji-go-pruned-pebbledb-ws.rule=(Path(`/avalanche-fuji`) || Path(`/avalanche-fuji/`)) && HeadersRegexp(`Upgrade`, `(?i)websocket`)}
-      - traefik.http.routers.avalanche-fuji-go-pruned-pebbledb-ws.middlewares=avalanche-fuji-go-pruned-pebbledb-stripprefix, avalanche-fuji-go-pruned-pebbledb-set-ws-path, ipallowlist
-
-volumes:
-  avalanche-fuji-go-pruned-pebbledb:
-
-x-upstreams:
-  - id: $${ID}
-    labels:
-      provider: $${PROVIDER}
-    connection:
-      generic:
-        rpc:
-          url: $${RPC_URL}
-        ws:
-          frameSize: 20Mb
-          msgSize: 50Mb
-          url: $${WS_URL}
-    chain: avalanche
-    method-groups:
-      enabled:
-        - debug
-        - filter
-    methods:
-      disabled:
-      enabled:
-        - name: txpool_content # TODO: should be disabled for rollup nodes
-...

avalanche/go/avalanche-fuji-go-pruned-pebbledb.yml

@@ -1,119 +0,0 @@
----
-x-logging-defaults: &logging-defaults
-  driver: json-file
-  options:
-    max-size: "512m"
-    max-file: "2"
-
-# Usage:
-#
-# mkdir rpc && cd rpc
-#
-# git init
-# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
-# git fetch origin vibe
-# git checkout origin/vibe
-#
-# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
-#
-# env
-# ...
-# IP=$(curl ipinfo.io/ip)
-# DOMAIN=${IP}.traefik.me
-# COMPOSE_FILE=base.yml:rpc.yml:avalanche/go/avalanche-fuji-go-pruned-pebbledb.yml
-#
-# docker compose up -d
-#
-# curl -X POST https://${IP}.traefik.me/avalanche-fuji \
-#   -H "Content-Type: application/json" \
-#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
-
-services:
-  avalanche-fuji:
-    image: ${AVALANCHE_GO_IMAGE:-avaplatform/avalanchego}:${AVALANCHE_FUJI_GO_VERSION:-v1.14.2}
-    sysctls:
-      # TCP Performance
-      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
-      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
-      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
-      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
-      net.core.somaxconn: 32768                   # Higher connection queue
-      # Memory/Connection Management
-      # net.core.netdev_max_backlog: 50000          # Increase network buffer
-      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
-      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
-    ulimits:
-      nofile: 1048576    # Max open files (for RPC/WS connections)
-    user: root
-    ports:
-      - 10350:10350
-      - 10350:10350/udp
-    expose:
-      - 9650
-    entrypoint: [/avalanchego/build/avalanchego]
-    command:
-      - --chain-config-dir=/config/pruned
-      - --db-type=pebbledb
-      - --http-allowed-hosts=*
-      - --http-host=
-      - --network-id=fuji
-      - --public-ip=${IP}
-      - --staking-port=10350
-    restart: unless-stopped
-    stop_grace_period: 5m
-    networks:
-      - chains
-    volumes:
-      - ${AVALANCHE_FUJI_GO_PRUNED_PEBBLEDB_DATA:-avalanche-fuji-go-pruned-pebbledb}:/root/.avalanchego
-      - ./avalanche/fuji:/config
-      - /slowdisk:/slowdisk
-    logging: *logging-defaults
-    labels:
-      - prometheus-scrape.enabled=false
-      - traefik.enable=true
-      - traefik.http.middlewares.avalanche-fuji-go-pruned-pebbledb-set-path.replacepath.path=/ext/bc/C/rpc
-      - traefik.http.middlewares.avalanche-fuji-go-pruned-pebbledb-stripprefix.stripprefix.prefixes=/avalanche-fuji
-      - traefik.http.services.avalanche-fuji-go-pruned-pebbledb.loadbalancer.server.port=9650
-      - ${NO_SSL:-traefik.http.routers.avalanche-fuji-go-pruned-pebbledb.entrypoints=websecure}
-      - ${NO_SSL:-traefik.http.routers.avalanche-fuji-go-pruned-pebbledb.tls.certresolver=myresolver}
-      - ${NO_SSL:-traefik.http.routers.avalanche-fuji-go-pruned-pebbledb.rule=Host(`$DOMAIN`) && (Path(`/avalanche-fuji`) || Path(`/avalanche-fuji/`))}
-      - ${NO_SSL:+traefik.http.routers.avalanche-fuji-go-pruned-pebbledb.rule=Path(`/avalanche-fuji`) || Path(`/avalanche-fuji/`)}
-      - traefik.http.routers.avalanche-fuji-go-pruned-pebbledb.middlewares=avalanche-fuji-go-pruned-pebbledb-stripprefix, avalanche-fuji-go-pruned-pebbledb-set-path, ipallowlist
-      - traefik.http.routers.avalanche-fuji-go-pruned-pebbledb.priority=50   # gets any request that is not GET with UPGRADE header
-      - traefik.http.routers.avalanche-fuji-go-pruned-pebbledb-ws.priority=100   # answers GET requests first
-      - traefik.http.middlewares.avalanche-fuji-go-pruned-pebbledb-set-ws-path.replacepath.path=/ext/bc/C/ws
-      - traefik.http.services.avalanche-fuji-go-pruned-pebbledb-ws.loadbalancer.server.port=9650
-      - traefik.http.routers.avalanche-fuji-go-pruned-pebbledb-ws.service=avalanche-fuji-go-pruned-pebbledb-ws
-      - traefik.http.routers.avalanche-fuji-go-pruned-pebbledb.service=avalanche-fuji-go-pruned-pebbledb
-      - ${NO_SSL:-traefik.http.routers.avalanche-fuji-go-pruned-pebbledb-ws.entrypoints=websecure}
-      - ${NO_SSL:-traefik.http.routers.avalanche-fuji-go-pruned-pebbledb-ws.tls.certresolver=myresolver}
-      # case-insensitive Upgrade: python websocket-client sends "WebSocket" (capital W)
-      - ${NO_SSL:-traefik.http.routers.avalanche-fuji-go-pruned-pebbledb-ws.rule=Host(`$DOMAIN`) && (Path(`/avalanche-fuji`) || Path(`/avalanche-fuji/`)) && HeadersRegexp(`Upgrade`, `(?i)websocket`)}
-      - ${NO_SSL:+traefik.http.routers.avalanche-fuji-go-pruned-pebbledb-ws.rule=(Path(`/avalanche-fuji`) || Path(`/avalanche-fuji/`)) && HeadersRegexp(`Upgrade`, `(?i)websocket`)}
-      - traefik.http.routers.avalanche-fuji-go-pruned-pebbledb-ws.middlewares=avalanche-fuji-go-pruned-pebbledb-stripprefix, avalanche-fuji-go-pruned-pebbledb-set-ws-path, ipallowlist
-
-volumes:
-  avalanche-fuji-go-pruned-pebbledb:
-
-x-upstreams:
-  - id: $${ID}
-    labels:
-      provider: $${PROVIDER}
-    connection:
-      generic:
-        rpc:
-          url: $${RPC_URL}
-        ws:
-          frameSize: 20Mb
-          msgSize: 50Mb
-          url: $${WS_URL}
-    chain: avalanche
-    method-groups:
-      enabled:
-        - debug
-        - filter
-    methods:
-      disabled:
-      enabled:
-        - name: txpool_content # TODO: should be disabled for rollup nodes
-...

avalanche/go/avalanche-mainnet-go-firewood-firewood.yml

@@ -0,0 +1,120 @@
+---
+x-logging-defaults: &logging-defaults
+  driver: json-file
+  options:
+    max-size: "512m"
+    max-file: "2"
+
+# Usage:
+#
+# mkdir rpc && cd rpc
+#
+# git init
+# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
+# git fetch origin vibe
+# git checkout origin/vibe
+#
+# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
+#
+# env
+# ...
+# IP=$(curl ipinfo.io/ip)
+# DOMAIN=${IP}.traefik.me
+# COMPOSE_FILE=base.yml:rpc.yml:avalanche/go/avalanche-mainnet-go-firewood-firewood.yml
+#
+# docker compose up -d
+#
+# curl -X POST https://${IP}.traefik.me/avalanche-mainnet-firewood \
+#   -H "Content-Type: application/json" \
+#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
+
+services:
+  avalanche-mainnet-firewood:
+    image: ${AVALANCHE_GO_IMAGE:-avaplatform/avalanchego}:${AVALANCHE_MAINNET_GO_VERSION:-v1.14.2}
+    sysctls:
+      # TCP Performance
+      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
+      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
+      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
+      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
+      net.core.somaxconn: 32768                   # Higher connection queue
+      # Memory/Connection Management
+      # net.core.netdev_max_backlog: 50000          # Increase network buffer
+      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
+      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
+    ulimits:
+      nofile: 1048576    # Max open files (for RPC/WS connections)
+    user: root
+    ports:
+      - 13144:13144
+      - 13144:13144/udp
+    expose:
+      - 9650
+    entrypoint: [/avalanchego/build/avalanchego]
+    command:
+      - --chain-config-dir=/config/firewood
+      - --coreth-state-scheme=firewood
+      - --db-type=firewood
+      - --http-allowed-hosts=*
+      - --http-host=
+      - --network-id=mainnet
+      - --public-ip=${IP}
+      - --staking-port=13144
+    restart: unless-stopped
+    stop_grace_period: 5m
+    networks:
+      - chains
+    volumes:
+      - ${AVALANCHE_MAINNET_GO_FIREWOOD_FIREWOOD_DATA:-avalanche-mainnet-go-firewood-firewood}:/root/.avalanchego
+      - ./avalanche/mainnet:/config
+      - /slowdisk:/slowdisk
+    logging: *logging-defaults
+    labels:
+      - prometheus-scrape.enabled=false
+      - traefik.enable=true
+      - traefik.http.middlewares.avalanche-mainnet-go-firewood-firewood-set-path.replacepath.path=/ext/bc/C/rpc
+      - traefik.http.middlewares.avalanche-mainnet-go-firewood-firewood-stripprefix.stripprefix.prefixes=/avalanche-mainnet-firewood
+      - traefik.http.services.avalanche-mainnet-go-firewood-firewood.loadbalancer.server.port=9650
+      - ${NO_SSL:-traefik.http.routers.avalanche-mainnet-go-firewood-firewood.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.avalanche-mainnet-go-firewood-firewood.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.avalanche-mainnet-go-firewood-firewood.rule=Host(`$DOMAIN`) && (Path(`/avalanche-mainnet-firewood`) || Path(`/avalanche-mainnet-firewood/`))}
+      - ${NO_SSL:+traefik.http.routers.avalanche-mainnet-go-firewood-firewood.rule=Path(`/avalanche-mainnet-firewood`) || Path(`/avalanche-mainnet-firewood/`)}
+      - traefik.http.routers.avalanche-mainnet-go-firewood-firewood.middlewares=avalanche-mainnet-go-firewood-firewood-stripprefix, avalanche-mainnet-go-firewood-firewood-set-path, ipallowlist
+      - traefik.http.routers.avalanche-mainnet-go-firewood-firewood.priority=50   # gets any request that is not GET with UPGRADE header
+      - traefik.http.routers.avalanche-mainnet-go-firewood-firewood-ws.priority=100   # answers GET requests first
+      - traefik.http.middlewares.avalanche-mainnet-go-firewood-firewood-set-ws-path.replacepath.path=/ext/bc/C/ws
+      - traefik.http.services.avalanche-mainnet-go-firewood-firewood-ws.loadbalancer.server.port=9650
+      - traefik.http.routers.avalanche-mainnet-go-firewood-firewood-ws.service=avalanche-mainnet-go-firewood-firewood-ws
+      - traefik.http.routers.avalanche-mainnet-go-firewood-firewood.service=avalanche-mainnet-go-firewood-firewood
+      - ${NO_SSL:-traefik.http.routers.avalanche-mainnet-go-firewood-firewood-ws.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.avalanche-mainnet-go-firewood-firewood-ws.tls.certresolver=myresolver}
+      # case-insensitive Upgrade: python websocket-client sends "WebSocket" (capital W)
+      - ${NO_SSL:-traefik.http.routers.avalanche-mainnet-go-firewood-firewood-ws.rule=Host(`$DOMAIN`) && (Path(`/avalanche-mainnet-firewood`) || Path(`/avalanche-mainnet-firewood/`)) && HeadersRegexp(`Upgrade`, `(?i)websocket`)}
+      - ${NO_SSL:+traefik.http.routers.avalanche-mainnet-go-firewood-firewood-ws.rule=(Path(`/avalanche-mainnet-firewood`) || Path(`/avalanche-mainnet-firewood/`)) && HeadersRegexp(`Upgrade`, `(?i)websocket`)}
+      - traefik.http.routers.avalanche-mainnet-go-firewood-firewood-ws.middlewares=avalanche-mainnet-go-firewood-firewood-stripprefix, avalanche-mainnet-go-firewood-firewood-set-ws-path, ipallowlist
+
+volumes:
+  avalanche-mainnet-go-firewood-firewood:
+
+x-upstreams:
+  - id: $${ID}
+    labels:
+      provider: $${PROVIDER}
+    connection:
+      generic:
+        rpc:
+          url: $${RPC_URL}
+        ws:
+          frameSize: 20Mb
+          msgSize: 50Mb
+          url: $${WS_URL}
+    chain: avalanche
+    method-groups:
+      enabled:
+        - debug
+        - filter
+    methods:
+      disabled:
+      enabled:
+        - name: txpool_content # TODO: should be disabled for rollup nodes
+...

avalanche/mainnet/firewood/C/config.json

@@ -0,0 +1,24 @@
+{
+    "snowman-api-enabled": false,
+    "coreth-admin-api-enabled": false,
+    "net-api-enabled": true,
+    "rpc-gas-cap": 2500000000,
+    "rpc-tx-fee-cap": 100,
+    "eth-rpc-gas-limit": 2500000000,
+    "eth-api-enabled": true,
+    "personal-api-enabled": false,
+    "tx-pool-api-enabled": false,
+    "debug-api-enabled": false,
+    "web3-api-enabled": true,
+    "local-txs-enabled": false,
+    "pruning-enabled": false,
+    "api-max-duration": 0,
+    "api-max-blocks-per-request": 0,
+    "allow-unfinalized-queries": false,
+    "log-level": "info",
+    "state-sync-enabled": true,
+    "state-sync-skip-resume": true,
+    "state-scheme": "firewood",
+    "populate-missing-tries": null,
+    "snapshot-cache": 0
+}

avalanche/mainnet/prune/C/config.json

@@ -1,23 +1,6 @@
 {
-    "snowman-api-enabled": false,
-    "coreth-admin-api-enabled": false,
-    "net-api-enabled": true,
     "rpc-gas-cap": 2500000000,
-    "rpc-tx-fee-cap": 100,
     "eth-rpc-gas-limit": 2500000000,
-    "eth-api-enabled": true,
-    "personal-api-enabled": false,
-    "tx-pool-api-enabled": false,
-    "debug-api-enabled": false,
-    "web3-api-enabled": true,
-    "local-txs-enabled": false,
-    "pruning-enabled": true,
-    "api-max-duration": 0,
-    "api-max-blocks-per-request": 0,
-    "allow-unfinalized-queries": false,
-    "log-level": "info",
-    "state-sync-enabled": false,
-    "state-sync-skip-resume": true,
     "offline-pruning-enabled": true,
     "offline-pruning-data-directory": "/root/.avalanchego/offline-pruning"
 }

avalanche/mainnet/pruned/C/config.json

@@ -16,6 +16,6 @@
     "api-max-blocks-per-request": 0,
     "allow-unfinalized-queries": false,
     "log-level": "info",
-    "state-sync-enabled": false,
+    "state-sync-enabled": true,
     "state-sync-skip-resume": true
 }

aztec/aztec/aztec-mainnet-aztec-pruned.yml

@@ -0,0 +1,112 @@
+---
+x-logging-defaults: &logging-defaults
+  driver: json-file
+  options:
+    max-size: "512m"
+    max-file: "2"
+# Aztec full node. See https://docs.aztec.network/network/setup/running_a_node
+# Admin port (8880) is not exposed; use docker exec for admin API.
+
+# Usage:
+#
+# mkdir rpc && cd rpc
+#
+# git init
+# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
+# git fetch origin vibe
+# git checkout origin/vibe
+#
+# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
+#
+# env
+# ...
+# IP=$(curl ipinfo.io/ip)
+# DOMAIN=${IP}.traefik.me
+# COMPOSE_FILE=base.yml:rpc.yml:aztec/aztec/aztec-mainnet-aztec-pruned.yml
+#
+# docker compose up -d
+#
+# curl -X POST https://${IP}.traefik.me/aztec-mainnet-pruned \
+#   -H "Content-Type: application/json" \
+#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
+
+services:
+  aztec-mainnet-pruned:
+    image: ${AZTEC_AZTEC_IMAGE:-aztecprotocol/aztec}:${AZTEC_MAINNET_AZTEC_VERSION:-5.0.1}
+    sysctls:
+      # TCP Performance
+      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
+      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
+      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
+      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
+      net.core.somaxconn: 32768                   # Higher connection queue
+      # Memory/Connection Management
+      # net.core.netdev_max_backlog: 50000          # Increase network buffer
+      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
+      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
+    ulimits:
+      nofile: 1048576    # Max open files (for RPC/WS connections)
+    user: root
+    ports:
+      - 13840:13840
+      - 13840:13840/udp
+    expose:
+      - 8545
+    environment:
+      AZTEC_ADMIN_PORT: '8880'
+      AZTEC_PORT: '8545'
+      DATA_DIRECTORY: /var/lib/data
+      ETHEREUM_DEBUG_HOSTS: ${ETHEREUM_MAINNET_DEBUG_HOSTS:-${ETHEREUM_MAINNET_EXECUTION_RPC}}
+      ETHEREUM_HOSTS: ${ETHEREUM_MAINNET_EXECUTION_RPC}
+      L1_CONSENSUS_HOST_URLS: ${ETHEREUM_MAINNET_BEACON_REST}
+      LOG_LEVEL: ${AZTEC_LOG_LEVEL:-info}
+      P2P_IP: ${IP}
+      P2P_PORT: '13840'
+    entrypoint: [node, --no-warnings, /usr/src/yarn-project/aztec/dest/bin/index.js, start]
+    command:
+      - --node
+      - --network=mainnet
+    restart: unless-stopped
+    stop_grace_period: 5m
+    networks:
+      - chains
+    volumes:
+      - ${AZTEC_MAINNET_AZTEC_PRUNED_DATA:-aztec-mainnet-aztec-pruned}:/var/lib/data
+      - /slowdisk:/slowdisk
+    logging: *logging-defaults
+    labels:
+      - prometheus-scrape.enabled=false
+      - traefik.enable=true
+      - traefik.http.middlewares.aztec-mainnet-aztec-pruned-stripprefix.stripprefix.prefixes=/aztec-mainnet-pruned
+      - traefik.http.services.aztec-mainnet-aztec-pruned.loadbalancer.server.port=8545
+      - ${NO_SSL:-traefik.http.routers.aztec-mainnet-aztec-pruned.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.aztec-mainnet-aztec-pruned.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.aztec-mainnet-aztec-pruned.rule=Host(`$DOMAIN`) && (Path(`/aztec-mainnet-pruned`) || Path(`/aztec-mainnet-pruned/`))}
+      - ${NO_SSL:+traefik.http.routers.aztec-mainnet-aztec-pruned.rule=Path(`/aztec-mainnet-pruned`) || Path(`/aztec-mainnet-pruned/`)}
+      - traefik.http.routers.aztec-mainnet-aztec-pruned.middlewares=aztec-mainnet-aztec-pruned-stripprefix, ipallowlist
+
+volumes:
+  aztec-mainnet-aztec-pruned:
+
+x-upstreams:
+  - id: $${ID}
+    labels:
+      provider: $${PROVIDER}
+    connection:
+      generic:
+        rpc:
+          url: $${RPC_URL}
+        ws:
+          frameSize: 20Mb
+          msgSize: 50Mb
+          url: $${WS_URL}
+    chain: aztec-mainnet
+    method-groups:
+      enabled:
+        - debug
+        - filter
+    methods:
+      disabled:
+      enabled:
+        - name: txpool_content # TODO: should be disabled for rollup nodes
+...

aztec/aztec/aztec-testnet-aztec-pruned.yml

@@ -32,7 +32,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   aztec-testnet-pruned:
-    image: ${AZTEC_AZTEC_IMAGE:-aztecprotocol/aztec}:${AZTEC_TESTNET_AZTEC_VERSION:-5.0.0-rc.1}
+    image: ${AZTEC_AZTEC_IMAGE:-aztecprotocol/aztec}:${AZTEC_TESTNET_AZTEC_VERSION:-5.0.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -56,6 +56,7 @@ services:
       AZTEC_ADMIN_PORT: '8880'
       AZTEC_PORT: '8545'
       DATA_DIRECTORY: /var/lib/data
+      ETHEREUM_DEBUG_HOSTS: ${ETHEREUM_SEPOLIA_DEBUG_HOSTS:-${ETHEREUM_SEPOLIA_EXECUTION_RPC}}
       ETHEREUM_HOSTS: ${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       L1_CONSENSUS_HOST_URLS: ${ETHEREUM_SEPOLIA_BEACON_REST}
       LOG_LEVEL: ${AZTEC_LOG_LEVEL:-info}

backup-node.sh

@@ -157,8 +157,15 @@ for key in $keys; do
     folder_size_gb=$(printf "%.0f" "$folder_size")
 
     if (( folder_size_gb < 1 )) && [[ "$FORCE_SMALL" != true ]]; then
-	echo "FATAL: existing datadir too small for backup (${folder_size_gb}G at $source_folder); use --force if intentional" >&2
-	exit 1
+	# The torn-backup floor applies to the MAIN data volume only (key == compose
+	# basename). Sidecar volumes (eigenda-proxy, configs, ...) are legitimately
+	# tiny — a 0G sidecar aborting the whole backup left no manifest and blocked
+	# the refresh lane on every ronin bench-retire (4 cycles, 2026-07).
+	if [[ "$key" == "$(basename "$compose_name")" ]]; then
+	    echo "FATAL: existing datadir too small for backup (${folder_size_gb}G at $source_folder); use --force if intentional" >&2
+	    exit 1
+	fi
+	echo "NOTE: sidecar volume rpc_$key is ${folder_size_gb}G — allowing small backup (floor guards the main data volume only)"
     fi
     
     timestamp=$(date +'%Y-%m-%d-%H-%M-%S')

berachain/geth/berachain-mainnet-geth-pruned-pebble-path.yml

@@ -112,7 +112,7 @@ services:
       context: ./berachain
       dockerfile: beacon-kit.Dockerfile
       args:
-        BEACONKIT_VERSION: ${BERACHAIN_MAINNET_BEACON_KIT_VERSION:-v1.4.0-rc3}
+        BEACONKIT_VERSION: ${BERACHAIN_MAINNET_BEACON_KIT_VERSION:-v1.4.1}
         BEACONKIT_IMAGE: ${BERACHAIN_MAINNET_BEACON_KIT_IMAGE:-ghcr.io/berachain/beacon-kit}
     ports:
       - 16562:16562

berachain/reth/berachain-bartio-reth-archive-trace.yml

@@ -61,7 +61,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   berachain-bartio-reth:
-    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BARTIO_RETH_VERSION:-v1.4.0}
+    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BARTIO_RETH_VERSION:-v1.4.4}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

berachain/reth/berachain-bartio-reth-pruned-trace.yml

@@ -61,7 +61,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   berachain-bartio-reth-pruned:
-    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BARTIO_RETH_VERSION:-v1.4.0}
+    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BARTIO_RETH_VERSION:-v1.4.4}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

berachain/reth/berachain-bepolia-reth-archive-trace.yml

@@ -61,7 +61,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   berachain-bepolia-reth:
-    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BEPOLIA_RETH_VERSION:-v1.4.2}
+    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BEPOLIA_RETH_VERSION:-v1.4.4}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

berachain/reth/berachain-bepolia-reth-pruned-trace.yml

@@ -61,7 +61,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   berachain-bepolia-reth-pruned:
-    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BEPOLIA_RETH_VERSION:-v1.4.2}
+    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BEPOLIA_RETH_VERSION:-v1.4.4}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

berachain/reth/berachain-mainnet-reth-archive-trace.yml

@@ -61,7 +61,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   berachain-mainnet-reth:
-    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_MAINNET_RETH_VERSION:-v1.4.0}
+    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_MAINNET_RETH_VERSION:-v1.4.4}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -89,10 +89,10 @@ services:
       - CHAINID=80094
       - CHAINNAME=mainnet
       - CHAIN_SPEC=mainnet
-    entrypoint: [/bin/bash, -c, "trap 'exit 0' SIGTERM; while [ ! -f /config/eth-genesis.json ] && [ ! -f /tmp/stop ]; do sleep 1 & wait $!; done; exec bera-reth node \"$@\"", --]
+    entrypoint: [bera-reth, node]
     command:
       - --bootnodes=enode://0c5a4a3c0e81fce2974e4d317d88df783731183d534325e32e0fdf8f4b119d7889fa254d3a38890606ec300d744e2aa9c87099a4a032f5c94efe53f3fcdfecfe@34.64.176.79:30303,enode://b6a3137d3a36ef37c4d31843775a9dc293f41bcbde33b6309c80b1771b6634827cd188285136a57474427bd8845adc2f6fe2e0b106bd58d14795b08910b9c326@34.64.181.70:30303,enode://0b6633300614bc2b9749aee0cace7a091ec5348762aee7b1d195f7616d03a9409019d9bef336624bab72e0d069cd4cf0b0de6fbbf53f04f6b6e4c5b39c6bdca6@34.64.39.31:30303,enode://552b001abebb5805fcd734ad367cd05d9078d18f23ec598d7165460fadcfc51116ad95c418f7ea9a141aa8cbc496c8bea3322b67a5de0d3380f11aab1a797513@34.64.183.158:30303,enode://5b037f66099d5ded86eb7e1619f6d06ceb15609e8cc345ced22a4772b06178004e1490a3cd32fd1222789de4c6e4021c2d648a3d750f6d5323e64b771bbd8de7@34.87.142.180:30303,enode://846db253c53753d3ea1197aec296306dc84c25f3afdf142b65cb0fe0f984de55072daa3bbf05a9aea046a38a2292403137b6eafefd5646fcf62120b74e3b898d@34.142.170.110:30303,enode://64b7f6ee9bcd942ad4949c70f2077627f078a057dfd930e6e904e12643d8952f5ae87c91e24559765393f244a72c9d5c011d7d5176e59191d38f315db85a20f5@34.126.161.16:30303,enode://cf4d19bfb8ec507427ec882bac0bac85a0c8c9ddaa0ec91b773bb614e5e09d107cd9fbe323b96f62f31c493f8f42cc5495c18b87c08560c5dea1dfd25256dcf6@35.247.162.2:30303,enode://bb7e44178543431feac8f0ee3827056b7b84d8235b802a8bdbbcd4939dab7f7dd2579ff577a38b002bb0139792af67abd2dd5c9f4f85b8da6e914fa76dca82bc@35.198.150.35:30303,enode://8fef1f5df45e7b31be00a21e1da5665d5a5f5bf4c379086b843f03eade941bdd157f08c95b31880c492577edb9a9b185df7191eaebf54ab06d5bd683b289f3af@34.107.7.241:30303,enode://ce9c87cfe089f6811d26c96913fa3ec10b938d9017fc6246684c74a33679ee34ceca9447180fb509e37bf2b706c2877a82085d34bfd83b5b520ee1288b0fc32f@35.198.109.49:30303,enode://713657eb6a53feadcbc47e634ad557326a51eb6818a3e19a00a8111492f50a666ccbf2f5d334d247ecf941e68d242ef5c3b812b63c44d381ef11f79c2cdb45c7@34.141.15.100:30303,enode://d071fa740e063ce1bb9cdc2b7937baeff6dc4000f91588d730a731c38a6ff0d4015814812c160fab8695e46f74b9b618735368ea2f16db4d785f16d29b3fb7b0@35.203.2.210:30303,enode://ffc452fe451a2e5f89fe634744aea334d92dcd30d881b76209d2db7dbf4b7ee047e7c69a5bb1633764d987a7441d9c4bc57ccdbfd6442a2f860bf953bc89a9b9@34.152.50.224:30303,enode://da94328302a1d1422209d1916744e90b6095a48b2340dcec39b22002c098bb4d58a880dab98eb26edf03fa4705d1b62f99a8c5c14e6666e4726b6d3066d8a4d7@34.95.61.106:30303,enode://19c7671a4844699b481e81a5bcfe7bafc7fefa953c16ebbe1951b1046371e73839e9058de6b7d3c934318fe7e7233dde3621c1c1018eb8b294ea3d4516147150@35.203.82.137:30303
-      - --chain=/config/eth-genesis.json
+      - --chain=mainnet
       - --datadir=/root/.local/share/reth
       - --discovery.port=12881
       - --engine.always-process-payload-attributes-on-canonical-head
@@ -131,7 +131,6 @@ services:
       - ${BERACHAIN_MAINNET_RETH_ARCHIVE_TRACE_DATA:-berachain-mainnet-reth-archive-trace}:/root/.local/share/reth
       - .jwtsecret:/jwtsecret:ro
       - /slowdisk:/slowdisk
-      - berachain-mainnet-reth-archive-trace_config:/config
     logging: *logging-defaults
     labels:
       - prometheus-scrape.enabled=true
@@ -152,7 +151,7 @@ services:
       context: ./berachain
       dockerfile: beacon-kit.Dockerfile
       args:
-        BEACONKIT_VERSION: ${BERACHAIN_MAINNET_BEACON_KIT_VERSION:-v1.4.0-rc3}
+        BEACONKIT_VERSION: ${BERACHAIN_MAINNET_BEACON_KIT_VERSION:-v1.4.1}
         BEACONKIT_IMAGE: ${BERACHAIN_MAINNET_BEACON_KIT_IMAGE:-ghcr.io/berachain/beacon-kit}
     ports:
       - 17881:17881

berachain/reth/berachain-mainnet-reth-pruned-trace.yml

@@ -61,7 +61,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   berachain-mainnet-reth-pruned:
-    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_MAINNET_RETH_VERSION:-v1.4.0}
+    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_MAINNET_RETH_VERSION:-v1.4.4}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -153,7 +153,7 @@ services:
       context: ./berachain
       dockerfile: beacon-kit.Dockerfile
       args:
-        BEACONKIT_VERSION: ${BERACHAIN_MAINNET_BEACON_KIT_VERSION:-v1.4.0-rc3}
+        BEACONKIT_VERSION: ${BERACHAIN_MAINNET_BEACON_KIT_VERSION:-v1.4.1}
         BEACONKIT_IMAGE: ${BERACHAIN_MAINNET_BEACON_KIT_IMAGE:-ghcr.io/berachain/beacon-kit}
     ports:
       - 15900:15900

bitcoin-cash/bitcoind/bitcoin-cash-mainnet-bitcoind-full.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   bitcoin-cash-mainnet:
-    image: ${BITCOIN_CASH_BITCOIND_IMAGE:-bitcoinabc/bitcoin-abc}:${BITCOIN_CASH_MAINNET_BITCOIND_VERSION:-0.33.7}
+    image: ${BITCOIN_CASH_BITCOIND_IMAGE:-bitcoinabc/bitcoin-abc}:${BITCOIN_CASH_MAINNET_BITCOIND_VERSION:-0.33.8}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

bitcoin-cash/bitcoind/bitcoin-cash-testnet-bitcoind-full.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   bitcoin-cash-testnet:
-    image: ${BITCOIN_CASH_BITCOIND_IMAGE:-bitcoinabc/bitcoin-abc}:${BITCOIN_CASH_TESTNET_BITCOIND_VERSION:-0.33.7}
+    image: ${BITCOIN_CASH_BITCOIND_IMAGE:-bitcoinabc/bitcoin-abc}:${BITCOIN_CASH_TESTNET_BITCOIND_VERSION:-0.33.8}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

bootstrap-peers.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+# bootstrap-peers.sh — fetch curated third-party bootstrap enodes for a network.
+#
+# Secondary seed source for peer-reinject / restore flows. Primary source remains
+# the node's own peer-capture state. Same public JSON customers curl:
+#   https://stakesquid.eu/bootstrap/<network>.json
+#
+# Usage:
+#   bootstrap-peers.sh <network>              # print enodes (one per line)
+#   bootstrap-peers.sh <network> --json       # print full JSON
+#   bootstrap-peers.sh --from-compose <path>  # derive network from compose path
+#   bootstrap-peers.sh ... --dry-run          # show URL + count, no failure on empty
+#
+# Env:
+#   BOOTSTRAP_BASE_URL  default https://stakesquid.eu/bootstrap
+#   BOOTSTRAP_MAX       max enodes to emit (default 25)
+set -euo pipefail
+
+BASE_URL="${BOOTSTRAP_BASE_URL:-https://stakesquid.eu/bootstrap}"
+MAX="${BOOTSTRAP_MAX:-25}"
+DRY_RUN=false
+JSON_OUT=false
+NETWORK=""
+COMPOSE=""
+
+usage() {
+    echo "Usage: $0 <network> [--json] [--dry-run]" >&2
+    echo "       $0 --from-compose <compose-path> [--json] [--dry-run]" >&2
+    exit 1
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --from-compose)
+            COMPOSE="${2:-}"; shift 2 || usage
+            ;;
+        --json) JSON_OUT=true; shift ;;
+        --dry-run) DRY_RUN=true; shift ;;
+        -h|--help) usage ;;
+        -*)
+            echo "Unknown option: $1" >&2
+            usage
+            ;;
+        *)
+            NETWORK="$1"; shift
+            ;;
+    esac
+done
+
+network_from_compose() {
+    local path="$1"
+    local base
+    base="$(basename "$path" | sed 's/--.*//')"
+    # strip client/variant suffixes (same idea as fleet-peers network_from_path)
+    for sep in -op-reth -op-geth -op-erigon -op-nethermind \
+               -reth -geth -erigon -erigon3 -besu -nethermind \
+               -bsc -nitro -l2geth -bor -external-node -gaiad \
+               -juno -rskj -avalanche -maru; do
+        case "$base" in
+            *"$sep"*) base="${base%%$sep*}"; break ;;
+        esac
+    done
+    # common leftover: -pruned / -archive / -pebble / -path / -trace / -bonsai
+    base="$(echo "$base" | sed -E 's/-(pruned|archive|full|pebble|path|trace|bonsai|snap|hash).*//')"
+    echo "$base"
+}
+
+if [[ -n "$COMPOSE" ]]; then
+    NETWORK="$(network_from_compose "$COMPOSE")"
+fi
+if [[ -z "$NETWORK" ]]; then
+    usage
+fi
+
+URL="${BASE_URL%/}/${NETWORK}.json"
+TMP="$(mktemp)"
+trap 'rm -f "$TMP"' EXIT
+
+if ! curl -fsS --max-time 15 "$URL" -o "$TMP" 2>/dev/null; then
+    if [[ "$DRY_RUN" == true ]]; then
+        echo "bootstrap-peers: dry-run fetch failed for $URL" >&2
+        exit 0
+    fi
+    echo "bootstrap-peers: fetch failed: $URL" >&2
+    exit 1
+fi
+
+COUNT="$(jq -r '.peers | length // 0' "$TMP" 2>/dev/null || echo 0)"
+UPDATED="$(jq -r '.updated // empty' "$TMP" 2>/dev/null || true)"
+
+if [[ "$DRY_RUN" == true ]]; then
+    echo "bootstrap-peers: network=$NETWORK url=$URL peers=$COUNT updated=$UPDATED"
+    jq -r '.peers[:3][]? | "  \(.stability.tier // "?") score=\(.stability.score // "?") n_vantage=\(.stability.n_vantage_nodes // "?") \(.enode[0:60])…"' "$TMP" 2>/dev/null || true
+    exit 0
+fi
+
+if [[ "$JSON_OUT" == true ]]; then
+    cat "$TMP"
+    exit 0
+fi
+
+jq -r --argjson m "$MAX" '.peers[:$m][]?.enode // empty' "$TMP" 2>/dev/null | grep -E '^enode://' || true

bsc/bsc/bsc-chapel-bsc-pruned-pebble-path.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   bsc-chapel:
-    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_CHAPEL_BSC_VERSION:-1.7.3}
+    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_CHAPEL_BSC_VERSION:-1.7.8}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

bsc/bsc/bsc-mainnet-bsc-minimal-pebble-hash.yml

@@ -32,7 +32,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   bsc-mainnet-minimal:
-    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_MAINNET_BSC_VERSION:-1.7.3}
+    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_MAINNET_BSC_VERSION:-1.7.8}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

bsc/bsc/bsc-mainnet-bsc-minimal-pebble-path.yml

@@ -32,7 +32,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   bsc-mainnet-minimal:
-    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_MAINNET_BSC_VERSION:-1.7.3}
+    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_MAINNET_BSC_VERSION:-1.7.8}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

bsc/bsc/bsc-mainnet-bsc-pruned-pebble-path.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   bsc-mainnet:
-    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_MAINNET_BSC_VERSION:-1.7.3}
+    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_MAINNET_BSC_VERSION:-1.7.8}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

bsc/reth/bsc-chapel-reth-archive-trace-triedb.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_CHAPEL_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}
@@ -102,7 +102,6 @@ services:
       - --rpc.max-connections=50000
       - --rpc.max-logs-per-response=0
       - --rpc.max-trace-filter-blocks=10000
-      - --statedb.triedb
       - --ws
       - --ws.addr=0.0.0.0
       - --ws.api=admin,debug,eth,net,trace,txpool,web3,rpc,reth,ots,flashbots,mev

bsc/reth/bsc-chapel-reth-archive-trace.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_CHAPEL_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}

bsc/reth/bsc-chapel-reth-pruned-trace-triedb.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_CHAPEL_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}
@@ -103,7 +103,6 @@ services:
       - --rpc.max-connections=50000
       - --rpc.max-logs-per-response=0
       - --rpc.max-trace-filter-blocks=10000
-      - --statedb.triedb
       - --ws
       - --ws.addr=0.0.0.0
       - --ws.api=admin,debug,eth,net,trace,txpool,web3,rpc,reth,ots,flashbots,mev

bsc/reth/bsc-chapel-reth-pruned-trace.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_CHAPEL_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}

bsc/reth/bsc-mainnet-reth-archive-trace-triedb.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_MAINNET_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}
@@ -103,7 +103,6 @@ services:
       - --rpc.max-connections=50000
       - --rpc.max-logs-per-response=0
       - --rpc.max-trace-filter-blocks=10000
-      - --statedb.triedb
       - --ws
       - --ws.addr=0.0.0.0
       - --ws.api=admin,debug,eth,net,trace,txpool,web3,rpc,reth,ots,flashbots,mev

bsc/reth/bsc-mainnet-reth-archive-trace.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_MAINNET_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}

bsc/reth/bsc-mainnet-reth-pruned-trace-triedb.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_MAINNET_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}
@@ -103,7 +103,6 @@ services:
       - --rpc.max-connections=50000
       - --rpc.max-logs-per-response=0
       - --rpc.max-trace-filter-blocks=10000
-      - --statedb.triedb
       - --ws
       - --ws.addr=0.0.0.0
       - --ws.api=admin,debug,eth,net,trace,txpool,web3,rpc,reth,ots,flashbots,mev

bsc/reth/bsc-mainnet-reth-pruned-trace.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_MAINNET_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}

clone-backup.sh

@@ -7,6 +7,7 @@
 #   --no-slowdisk : do NOT offload static files to /slowdisk (no symlinks);
 #                   extract everything onto the local disk instead. Required to
 #                   proceed when /slowdisk is too small for the static files.
+#   KEEP_NODE_KEYS=1 : keep the restored identity keys (default: delete via node-key-globs.txt)
 
 # Pull the --no-slowdisk flag out of the args so the positional <config>/<dest>
 # parsing below is unaffected regardless of where the flag is placed.
@@ -224,6 +225,7 @@ setup_slowdisk_structure() {
         return 1
     fi
     
+    SLOWDISK_TRANSFORMS=""
     echo "Setting up SLOWDISK structure for $key"
     echo "  Static size: $((static_size_kb / 1024))MB"
     echo "  Static paths: ${#static_paths[@]}"
@@ -253,6 +255,11 @@ setup_slowdisk_structure() {
         local slowdisk_path="${slowdisk_base}/rpc_${key}__data_${path//\//__}"
         local target_path="${volume_path}/${path}"
         local target_dir=$(dirname "$target_path")
+        # tar cannot extract THROUGH a symlink to another device (EXDEV
+        # "Invalid cross-device link", reproduced GNU tar 1.34+1.35 2026-07-11 -
+        # killed the katana->uk-4 provision). Collect --transform rewrites so tar
+        # writes directly into /slowdisk; the symlink remains for runtime.
+        SLOWDISK_TRANSFORMS+=" --transform='s|^\\(\\./\\)\\?var/lib/docker/volumes/rpc_${key}/_data/${path}|slowdisk/rpc_${key}__data_${path//\//__}|'"
         
         # Create parent directories in volume
         $SSH_CMD "$DEST_HOST" "mkdir -p '$target_dir'"
@@ -292,6 +299,7 @@ cleanup_all_ports() {
 # Transfer backup file using screen method with better error handling
 transfer_backup() {
     local key=$1
+    local compose_file=$2
     local volume_name="rpc_$key"
     
     # Find the newest restorable backup file (skip near-empty artifacts)
@@ -299,6 +307,17 @@ transfer_backup() {
     backup_file=$(select_newest_local_backup "$backup_dir" "$volume_name")
     
     if [[ -z "$backup_file" ]] || [[ ! -f "$backup_file" ]]; then
+        if [[ "$volume_name" == *-secrets || "$volume_name" == *-jwt ]]; then
+            echo "Note: no backup for secrets/jwt volume $volume_name (regenerated at create-node), skipping"
+            return 2
+        fi
+        # Check if this volume is optional or ephemeral - if so, skip gracefully
+        if [[ -n "$compose_file" && -f "$compose_file" ]]; then
+            if is_ephemeral_volume_key "$key" "$compose_file" || is_optional_volume_key "$key" "$compose_file"; then
+                echo "Note: no backup for optional/ephemeral volume $volume_name (will be created empty at destination), skipping"
+                return 2
+            fi
+        fi
         echo "Warning: No restorable backup file found for $volume_name, skipping"
         return 1
     fi
@@ -327,7 +346,7 @@ transfer_backup() {
                     # Use --skip-old-files to avoid overwriting existing symlinks/directories
                     # and --keep-directory-symlink so tar extracts THROUGH the pre-created dir symlinks
                     # instead of trying to mkdir over them (which fails with 'Cannot mkdir: File exists')
-                    tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink"
+                    tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink${SLOWDISK_TRANSFORMS}"
                     echo "SLOWDISK structure ready, will extract respecting symlinks"
                 else
                     echo "Warning: Failed to setup SLOWDISK structure, falling back to normal extraction"
@@ -344,6 +363,17 @@ transfer_backup() {
         echo "No metadata file found, using normal extraction"
     fi
     
+
+    # AFTER SLOWDISK_TRANSFORMS: rewrite remaining var/lib/docker/ members onto
+    # the target's real docker root when it is a cross-device symlink (see
+    # docker_root_transform in volume-utils.sh).
+    local _drt
+    _drt=$(docker_root_transform)
+    if [[ -n "$_drt" ]]; then
+        echo "Target /var/lib/docker is a symlink; appending docker-root --transform (after slowdisk)"
+        tar_extract_opts="${tar_extract_opts}${_drt}"
+    fi
+
     local file_size=$(stat -f%z "$backup_file" 2>/dev/null || stat -c%s "$backup_file" 2>/dev/null)
     
     # Find an available port
@@ -367,15 +397,17 @@ transfer_backup() {
     if $SSH_CMD "$DEST_HOST" "which screen" >/dev/null 2>&1; then
         echo "Starting screen listener on port $port..."
         
-        # Start listener in screen session with proper escaping
-        # The backup file is already zstd compressed, so we just decompress and extract
-        # Use tar_extract_opts which may include --skip-old-files for SLOWDISK mode
-        $SSH_CMD "$DEST_HOST" "
-            screen -dmS transfer_${key} bash -c '
-                nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
-                echo \$? > /tmp/transfer_${key}.done
-            '
-        "
+        # Ship the listener as a SCRIPT FILE. tar_extract_opts can contain quoted
+        # --transform expressions with '|' which inline bash -c quoting cannot
+        # survive across the ssh+screen layers (broke the katana retry,
+        # 2026-07-11). The heredoc expands locally; the target parses the script
+        # exactly once.
+        $SSH_CMD "$DEST_HOST" "cat > /tmp/transfer_${key}.sh && chmod +x /tmp/transfer_${key}.sh" <<LISTENER
+#!/bin/bash
+nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
+echo \$? > /tmp/transfer_${key}.done
+LISTENER
+        $SSH_CMD "$DEST_HOST" "screen -dmS transfer_${key} /tmp/transfer_${key}.sh"
         
         # Give it time to start
         sleep 2
@@ -389,15 +421,13 @@ transfer_backup() {
     else
         echo "Screen not available, using nohup method..."
         
-        # Use nohup with proper backgrounding
-        # Use tar_extract_opts which may include --skip-old-files for SLOWDISK mode
-        $SSH_CMD "$DEST_HOST" "
-            nohup bash -c '
-                nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
-                echo \$? > /tmp/transfer_${key}.done
-            ' > /tmp/transfer_${key}.log 2>&1 < /dev/null &
-            echo \$! > /tmp/transfer_${key}.pid
-        "
+        # Script-file listener for the same quoting reason as the screen branch.
+        $SSH_CMD "$DEST_HOST" "cat > /tmp/transfer_${key}.sh && chmod +x /tmp/transfer_${key}.sh" <<LISTENER
+#!/bin/bash
+nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
+echo \$? > /tmp/transfer_${key}.done
+LISTENER
+        $SSH_CMD "$DEST_HOST" "nohup /tmp/transfer_${key}.sh > /tmp/transfer_${key}.log 2>&1 < /dev/null & echo \$! > /tmp/transfer_${key}.pid"
         
         sleep 2
         
@@ -481,6 +511,7 @@ transfer_backup() {
 # Fallback: Direct SSH pipe
 transfer_backup_ssh() {
     local key=$1
+    local compose_file=$2
     local volume_name="rpc_$key"
     
     # Find the newest restorable backup file (skip near-empty artifacts)
@@ -488,6 +519,17 @@ transfer_backup_ssh() {
     backup_file=$(select_newest_local_backup "$backup_dir" "$volume_name")
     
     if [[ -z "$backup_file" ]] || [[ ! -f "$backup_file" ]]; then
+        if [[ "$volume_name" == *-secrets || "$volume_name" == *-jwt ]]; then
+            echo "Note: no backup for secrets/jwt volume $volume_name (regenerated at create-node), skipping"
+            return 2
+        fi
+        # Check if this volume is optional or ephemeral - if so, skip gracefully
+        if [[ -n "$compose_file" && -f "$compose_file" ]]; then
+            if is_ephemeral_volume_key "$key" "$compose_file" || is_optional_volume_key "$key" "$compose_file"; then
+                echo "Note: no backup for optional/ephemeral volume $volume_name (will be created empty at destination), skipping"
+                return 2
+            fi
+        fi
         echo "Warning: No restorable backup file found for $volume_name, skipping"
         return 1
     fi
@@ -513,7 +555,7 @@ transfer_backup_ssh() {
             if setup_slowdisk_structure "$key" "$static_size_kb" "${static_paths[@]}"; then
                 # and --keep-directory-symlink so tar extracts THROUGH the pre-created dir symlinks
                 # instead of trying to mkdir over them (which fails with 'Cannot mkdir: File exists')
-                tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink"
+                tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink${SLOWDISK_TRANSFORMS}"
                 echo "SLOWDISK structure ready, will extract respecting symlinks"
             else
                 echo "Warning: Failed to setup SLOWDISK structure, falling back to normal extraction"
@@ -523,6 +565,17 @@ transfer_backup_ssh() {
         fi
     fi
     
+
+    # AFTER SLOWDISK_TRANSFORMS: rewrite remaining var/lib/docker/ members onto
+    # the target's real docker root when it is a cross-device symlink (see
+    # docker_root_transform in volume-utils.sh).
+    local _drt
+    _drt=$(docker_root_transform)
+    if [[ -n "$_drt" ]]; then
+        echo "Target /var/lib/docker is a symlink; appending docker-root --transform (after slowdisk)"
+        tar_extract_opts="${tar_extract_opts}${_drt}"
+    fi
+
     echo "Using direct SSH transfer for $key (file: $(basename "$backup_file"), size: $((file_size / 1048576))MB)"
     
     pv -pterb -s "$file_size" -N "$key" < "$backup_file" | \
@@ -601,18 +654,26 @@ main() {
     echo "----------------------------------------"
     
     success_count=0
+    skipped_volumes=""
     failed_volumes=""
-    
+
     for key in $keys; do
         # Try nc method first
-        transfer_backup "$key"
-        
-        if [[ $? -ne 0 ]]; then
+        transfer_backup "$key" "$dir/$1.yml"
+        rc=$?
+
+        if [[ $rc -eq 2 ]]; then
+            # secrets volume with no backup — regenerated at create-node, not a failure
+            skipped_volumes="$skipped_volumes $key"
+        elif [[ $rc -ne 0 ]]; then
             echo "NC transfer failed, trying direct SSH..."
-            transfer_backup_ssh "$key"
-            
-            if [[ $? -eq 0 ]]; then
+            transfer_backup_ssh "$key" "$dir/$1.yml"
+            rc=$?
+
+            if [[ $rc -eq 0 ]]; then
                 success_count=$((success_count + 1))
+            elif [[ $rc -eq 2 ]]; then
+                skipped_volumes="$skipped_volumes $key"
             else
                 failed_volumes="$failed_volumes $key"
             fi
@@ -626,8 +687,20 @@ main() {
     echo ""
     echo "Transfer Summary:"
     echo "  Successful: $success_count/$volume_count"
+    [[ -n "$skipped_volumes" ]] && echo "  Skipped (no backup by design):$skipped_volumes"
     [[ -n "$failed_volumes" ]] && echo "  Failed:$failed_volumes"
     
+    # Regenerate the node's P2P identity on the destination (2026-09-04, rpc-us-50 avalanche
+    # incident): a restored volume carries the SOURCE node's identity keys (avalanchego
+    # staking/*, geth nodekey, ...). If the source still runs elsewhere, the copy is a
+    # duplicate NodeID and never peers. restore-volumes.sh already does this as its last
+    # step; the fast path skipped it. Patterns: node-key-globs.txt. KEEP_NODE_KEYS=1 opts out.
+    if [[ -z "$failed_volumes" && "${KEEP_NODE_KEYS:-0}" != "1" ]]; then
+        echo "Deleting node identity keys on $DEST_HOST (node-key-globs.txt) ..."
+        $SSH_CMD "$DEST_HOST" "cd /root/rpc && ./delete-node-keys.sh '$1'" \
+            || echo "WARNING: delete-node-keys.sh failed on $DEST_HOST - the restored node may carry a duplicate identity; run ./delete-node-keys <host> $1 manually"
+    fi
+    
     # Restore Network buffer and congestion control settings.
     # These are better for your 0.2-1.4ms environment
 
@@ -655,7 +728,7 @@ main() {
     $SSH_CMD -O exit "$DEST_HOST" 2>/dev/null
     
     # Exit with appropriate status (cleanup will be handled by trap)
-    [[ $success_count -eq $volume_count ]] && exit 0 || exit 1
+    [[ -z "$failed_volumes" ]] && exit 0 || exit 1
 }
 
 main "$@"

clone-node.sh

@@ -200,6 +200,7 @@ setup_slowdisk_structure() {
         return 1
     fi
     
+    SLOWDISK_TRANSFORMS=""
     echo "Setting up SLOWDISK structure for $key"
     echo "  Static size: $((static_size_kb / 1024))MB"
     echo "  Static paths: ${#static_paths[@]}"
@@ -229,6 +230,9 @@ setup_slowdisk_structure() {
         local slowdisk_path="${slowdisk_base}/rpc_${key}__data_${path//\//__}"
         local target_path="${volume_path}/${path}"
         local target_dir=$(dirname "$target_path")
+        # tar cannot extract through a cross-device dir symlink (EXDEV) - rewrite
+        # member paths to land directly on /slowdisk (same fix as clone-backup).
+        SLOWDISK_TRANSFORMS+=" --transform='s|^\\(\\./\\)\\?var/lib/docker/volumes/rpc_${key}/_data/${path}|slowdisk/rpc_${key}__data_${path//\//__}|'"
         
         # Create parent directories in volume
         $SSH_CMD "$DEST_HOST" "mkdir -p '$target_dir'"
@@ -299,7 +303,7 @@ transfer_volume() {
                         # Use --skip-old-files to avoid overwriting existing symlinks/directories
                         # and --keep-directory-symlink so tar extracts THROUGH the pre-created dir symlinks
                         # instead of trying to mkdir over them (which fails with 'Cannot mkdir: File exists')
-                        tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink"
+                        tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink${SLOWDISK_TRANSFORMS}"
                         echo "SLOWDISK structure ready, will extract respecting symlinks"
                     else
                         echo "Warning: Failed to setup SLOWDISK structure, falling back to normal extraction"
@@ -315,6 +319,17 @@ transfer_volume() {
         fi
     fi
     
+
+    # AFTER SLOWDISK_TRANSFORMS: rewrite remaining var/lib/docker/ members onto
+    # the target's real docker root when it is a cross-device symlink (see
+    # docker_root_transform in volume-utils.sh).
+    local _drt
+    _drt=$(docker_root_transform)
+    if [[ -n "$_drt" ]]; then
+        echo "Target /var/lib/docker is a symlink; appending docker-root --transform (after slowdisk)"
+        tar_extract_opts="${tar_extract_opts}${_drt}"
+    fi
+
     # Find an available port
     local port=$(find_available_port)
     if [[ $? -ne 0 ]]; then
@@ -338,12 +353,14 @@ transfer_volume() {
         
         # Start listener in screen session with proper escaping
         # Use tar_extract_opts which may include --skip-old-files for SLOWDISK mode
-        $SSH_CMD "$DEST_HOST" "
-            screen -dmS transfer_${key} bash -c '
-                nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
-                echo \$? > /tmp/transfer_${key}.done
-            '
-        "
+        # Script-file listener: tar_extract_opts may carry quoted --transform args
+        # that no inline bash -c quoting survives (same fix as clone-backup).
+        $SSH_CMD "$DEST_HOST" "cat > /tmp/transfer_${key}.sh && chmod +x /tmp/transfer_${key}.sh" <<LISTENER
+#!/bin/bash
+nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
+echo \$? > /tmp/transfer_${key}.done
+LISTENER
+        $SSH_CMD "$DEST_HOST" "screen -dmS transfer_${key} /tmp/transfer_${key}.sh"
         
         # Give it time to start
         sleep 2
@@ -359,13 +376,12 @@ transfer_volume() {
         
         # Use nohup with proper backgrounding
         # Use tar_extract_opts which may include --skip-old-files for SLOWDISK mode
-        $SSH_CMD "$DEST_HOST" "
-            nohup bash -c '
-                nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
-                echo \$? > /tmp/transfer_${key}.done
-            ' > /tmp/transfer_${key}.log 2>&1 < /dev/null &
-            echo \$! > /tmp/transfer_${key}.pid
-        "
+        $SSH_CMD "$DEST_HOST" "cat > /tmp/transfer_${key}.sh && chmod +x /tmp/transfer_${key}.sh" <<LISTENER
+#!/bin/bash
+nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
+echo \$? > /tmp/transfer_${key}.done
+LISTENER
+        $SSH_CMD "$DEST_HOST" "nohup /tmp/transfer_${key}.sh > /tmp/transfer_${key}.log 2>&1 < /dev/null & echo \$! > /tmp/transfer_${key}.pid"
         
         sleep 2
         
@@ -479,7 +495,7 @@ transfer_volume_ssh() {
                     if setup_slowdisk_structure "$key" "$static_size_kb" "${static_paths[@]}"; then
                         # and --keep-directory-symlink so tar extracts THROUGH the pre-created dir symlinks
                         # instead of trying to mkdir over them (which fails with 'Cannot mkdir: File exists')
-                        tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink"
+                        tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink${SLOWDISK_TRANSFORMS}"
                         echo "SLOWDISK structure ready, will extract respecting symlinks"
                     else
                         echo "Warning: Failed to setup SLOWDISK structure, falling back to normal extraction"
@@ -495,6 +511,17 @@ transfer_volume_ssh() {
         fi
     fi
     
+
+    # AFTER SLOWDISK_TRANSFORMS: rewrite remaining var/lib/docker/ members onto
+    # the target's real docker root when it is a cross-device symlink (see
+    # docker_root_transform in volume-utils.sh).
+    local _drt
+    _drt=$(docker_root_transform)
+    if [[ -n "$_drt" ]]; then
+        echo "Target /var/lib/docker is a symlink; appending docker-root --transform (after slowdisk)"
+        tar_extract_opts="${tar_extract_opts}${_drt}"
+    fi
+
     echo "Using direct SSH transfer for $key (size: $((folder_size / 1048576))MB)"
     
     tar -cf - --dereference "$source_folder" 2>/dev/null | \

connect-peers.sh

@@ -9,6 +9,11 @@
 #   target-compose-file: Optional. If provided, use this compose file for target node
 #                        If not provided, use the same compose file for both source and target
 #
+# Secondary seed (optional): --seed-bootstrap pulls third-party enodes from the
+# public bootstrap API (https://stakesquid.eu/bootstrap/<network>.json) into the
+# source node after the pairwise connect — same JSON customers use; own peerset
+# remains primary via peer-reinject.sh / peer-capture.
+#
 # Exit codes:
 #   0 - At least one node connected successfully (bidirectional or one-way)
 #   1 - Failed to connect to both nodes (see output for details)
@@ -65,6 +70,7 @@ fi
 
 TIMEOUT=5
 DRY_RUN=false
+SEED_BOOTSTRAP=false
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
@@ -76,6 +82,10 @@ while [[ $# -gt 0 ]]; do
             DRY_RUN=true
             shift
             ;;
+        --seed-bootstrap)
+            SEED_BOOTSTRAP=true
+            shift
+            ;;
         *)
             echo "Unknown option: $1"
             usage
@@ -600,6 +610,30 @@ fi
 echo -e "${CYAN}--- Summary ---${NC}"
 echo ""
 
+# Optional secondary seed from public bootstrap list (after pairwise connect).
+if [[ "$SEED_BOOTSTRAP" == true ]]; then
+    echo -e "${CYAN}--- Bootstrap secondary seed ---${NC}"
+    if [[ -x "$BASEPATH/bootstrap-peers.sh" ]]; then
+        if [[ "$DRY_RUN" == true ]]; then
+            "$BASEPATH/bootstrap-peers.sh" --from-compose "$COMPOSE_FILE" --dry-run || true
+        else
+            mapfile -t BOOT_ENODES < <("$BASEPATH/bootstrap-peers.sh" --from-compose "$COMPOSE_FILE" 2>/dev/null | grep -E '^enode://' | head -n 25 || true)
+            BOOT_OK=0
+            for be in "${BOOT_ENODES[@]:-}"; do
+                [[ -z "$be" ]] && continue
+                RESULT=$(add_static_peer "$SOURCE_URL" "$be" "$SOURCE_CLIENT")
+                if check_rpc_success "$RESULT"; then
+                    BOOT_OK=$((BOOT_OK + 1))
+                fi
+            done
+            echo -e "  Added ${GREEN}${BOOT_OK}${NC}/${#BOOT_ENODES[@]} bootstrap enodes to source"
+        fi
+    else
+        echo -e "${YELLOW}bootstrap-peers.sh not found — skip${NC}"
+    fi
+    echo ""
+fi
+
 if [[ "$DRY_RUN" == true ]]; then
     echo -e "${GREEN}Dry run completed - no changes made${NC}"
     echo ""

core/core/core-buffalo-core-pruned-pebble-path.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   core-buffalo:
-    image: ${CORE_CORE_IMAGE:-ghcr.io/coredao-org/core-chain}:${CORE_BUFFALO_CORE_VERSION:-1.0.22}
+    image: ${CORE_CORE_IMAGE:-ghcr.io/coredao-org/core-chain}:${CORE_BUFFALO_CORE_VERSION:-1.0.26}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -115,7 +115,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: core-testnet
+    chain:
     method-groups:
       enabled:
         - debug