Skip to main content

Serve remote RPC

The node HTTP/WebSocket listener remains on IPv4 loopback. joltzu_rpc_gateway is a separate TLS 1.3 process for remote RPC access.

Current authentication profile​

Clients supply Authorization: Bearer with a configured credential, compared in constant time. Each client has a request budget and an exact method allowlist; optional certificate fingerprint pinning adds a possession check. The node should configure matching credentials so that upstream calls preserve client accounting.

Gateway requests must use POST /, JSON content type and one valid Host. This development gateway accepts a single JSON-RPC object, refusing batches even though local RPC supports batches. It relays authenticated WebSocket sessions and applies allowlists/budgets to their messages too. Calls whose jsonrpc member is not a string are rejected.

Abuse limits​

  • The gateway accepts TLS 1.3 only.
  • Each source address has its own request budget, spent before any other check.
  • A source address whose connections close eight times in a row without a valid credential is blocked for 60 seconds, doubling up to one hour. Blocked connections are closed before any TLS work.
  • A credential that breaks its allowlist or the request shape 16 times in a row is suspended, again doubling up to one hour.

Addresses shared through NAT or proxies share these limits.

The profile does not provide a public account signup, automatic peer discovery or an anonymous wallet RPC. Ordinary wallet extensions cannot attach a bearer credential; supply a trusted local tunnel/proxy or deploy an explicitly designed wallet-compatible access layer.

Command shape​

Build the joltzu_rpc_gateway target. Its inspected CLI is:

joltzu_rpc_gateway CERT KEY IPV4 PORT UPSTREAM_PORT CLIENTS_FILE RUN_MS [BLOCK_FILE [BLOCK_SYNC_MS [PEERS_FILE]]]

RUN_MS is 1–86,400,000 milliseconds, or 0 to serve until SIGTERM/SIGINT. Either signal stops accepting, drains connections and saves the block file.

Configure the gateway with a TLS certificate, matching private key and client credentials. Trust peer block-sync sources explicitly. Keep keys and credentials in private files, outside source control.

An authenticated request template:

# Substitute your deployed host and credential; this host is illustrative.
curl https://rpc.example.com \
  -H "Authorization: Bearer $JOLTZU_RPC_TOKEN" \
  -H 'Content-Type: application/json' \
  --data '{"jsonrpc":"2.0","id":1,"method":"eth_chainId","params":[]}'

Proposed public endpoints​

The network directory proposes HTTP and WebSocket hosts for testnet/mainnet. It does not establish DNS, TLS, credentials, anonymous access, CORS, rate limits or an SLA. Publish those details with the actual deployment.