base.yml

@@ -1,4 +1,11 @@
 networks:
+  # Second network Traefik also listens on, so a service can be routed WITHOUT
+  # sitting on `chains` next to the RPC nodes, Redis and the Traefik API (a
+  # public-facing site next to unauthenticated :8545 endpoints is a foothold we
+  # do not want to hand out). Overridable per host via TRAEFIK_EXTRA_NETWORK;
+  # the default is an empty bridge, so hosts that do not use it are unaffected.
+  extra:
+    name: ${TRAEFIK_EXTRA_NETWORK:-rpc_extra}
   chains:
     driver: bridge
     ipam:

rpc.yml

@@ -38,6 +38,7 @@ services:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
     networks:
       - chains
+      - extra
     labels:
       - "traefik.enable=true"
       - "traefik.http.middlewares.ipallowlist.ipallowlist.sourcerange=$WHITELIST"