StakeSquid/ethereum-rpc-docker
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

traefik: second, env-named network so non-RPC services can be routed off chains #80

Merged
claude merged 1 commits from traefik-extra-network into main 2026-09-13 13:23:45 +00:00
Conversation 0 Commits 1 Files Changed 2 +8
claude commented 2026-09-13 13:23:40 +00:00
Collaborator
Copy Link

Adds an extra network to base.yml and puts traefik on it in rpc.yml. Name comes from TRAEFIK_EXTRA_NETWORK, defaulting to rpc_extra (same convention as rpc_chains). Not external: true, so compose creates it; hosts that do not use it get an empty bridge.

Why. Today anything that wants a traefik route must sit on chains. On a typical host that is 26 containers including unauthenticated redis:6379, traefik:8080 (--api.insecure=true) and several unauthenticated :8545 endpoints. A public site that accepts anonymous uploads should not have that as its blast radius.

Validated with docker compose config against a real host .env: unset renders rpc_extra, TRAEFIK_EXTRA_NETWORK=vientiane_net renders vientiane_net, traefik on [chains, extra] in both.

Operational note. Changing traefik network membership means the next rpc-update on a host recreates the traefik container, briefly interrupting all HTTP/HTTPS routing there, RPC endpoints included. Nothing pulls /root/rpc on its own, so this lands host by host and should ride the serving gate.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KjqejYycVyVvrxV9aTDhgX

Adds an `extra` network to `base.yml` and puts traefik on it in `rpc.yml`. Name comes from `TRAEFIK_EXTRA_NETWORK`, defaulting to `rpc_extra` (same convention as `rpc_chains`). Not `external: true`, so compose creates it; hosts that do not use it get an empty bridge. **Why.** Today anything that wants a traefik route must sit on `chains`. On a typical host that is 26 containers including unauthenticated `redis:6379`, `traefik:8080` (`--api.insecure=true`) and several unauthenticated `:8545` endpoints. A public site that accepts anonymous uploads should not have that as its blast radius. **Validated** with `docker compose config` against a real host `.env`: unset renders `rpc_extra`, `TRAEFIK_EXTRA_NETWORK=vientiane_net` renders `vientiane_net`, traefik on `[chains, extra]` in both. **Operational note.** Changing traefik network membership means the next `rpc-update` on a host recreates the traefik container, briefly interrupting all HTTP/HTTPS routing there, RPC endpoints included. Nothing pulls `/root/rpc` on its own, so this lands host by host and should ride the serving gate. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01KjqejYycVyVvrxV9aTDhgX
claude added 1 commit 2026-09-13 13:23:40 +00:00
traefik: second, env-named network so non-RPC services can be routed off chains b6bbe77dff 
Traefik now also listens on `extra`, whose name comes from TRAEFIK_EXTRA_NETWORK
and defaults to rpc_extra (matching the rpc_chains convention). It is not
`external: true`, so compose creates it; hosts that never use it just get an
empty bridge.

Why: anything that wants a traefik route currently has to sit on `chains`, which
on a typical host means 26 containers including unauthenticated redis:6379,
traefik:8080 (--api.insecure=true) and several unauthenticated :8545 endpoints.
A public site accepting anonymous uploads does not belong there. With this it
can be routed from an isolated network that only traefik bridges into.

Validated with `docker compose config` against a real host .env: unset ->
rpc_extra, TRAEFIK_EXTRA_NETWORK=vientiane_net -> vientiane_net, traefik on
[chains, extra] in both.

Operational note: changing traefik's network list means the NEXT rpc-update on a
host recreates the traefik container, briefly interrupting all HTTP/HTTPS routing
on that host, RPC endpoints included. Nothing pulls /root/rpc on its own, so this
lands host by host and should ride the serving gate.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KjqejYycVyVvrxV9aTDhgX
claude merged commit 46f1a4e040 into main 2026-09-13 13:23:45 +00:00
claude deleted branch traefik-extra-network 2026-09-13 13:23:46 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claude cursor rob sebastian
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: StakeSquid/ethereum-rpc-docker#80
Delete Branch "traefik-extra-network"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?