feat: Erigon v3 archive node compose config by beeant · Pull Request #1 · hachiari/erigon-node

beeant · 2026-06-09T09:41:17Z

Summary

Adds docker-compose.yml for running Erigon v3 as an Ethereum mainnet archive node on prod2
Pinned to v3.4.3 — never use latest for a 5-day archive sync
Uses --prune.mode=archive — full historical state (cannot be changed after first sync)
Embedded Caplin consensus layer via --internalcl — no separate beacon node needed
network_mode: host for proper P2P peer discovery
RPC (8545) and Engine API (8551) bound to 10.10.0.5 (WireGuard interface) — accessible only from prod via WireGuard tunnel, not publicly exposed
Data dir: /mnt/nvme4TB2/erigon, JWT secret: /mnt/nvme4TB2/erigon/jwt.hex

Pre-deploy (run on prod2 before deploying)

mkdir -p /mnt/nvme4TB2/erigon
openssl rand -hex 32 > /mnt/nvme4TB2/erigon/jwt.hex
chown -R 1000:1000 /mnt/nvme4TB2/erigon

UFW rules (run on prod2)

ufw allow from 10.10.0.1 to any port 8545 proto tcp
ufw allow from 10.10.0.1 to any port 8551 proto tcp

Storage

Archive mode: ~2TB current usage, 3.4TB available on nvme4TB2

🤖 devops agent — BearBullBunny

Copilot

Pull request overview

Adds a Docker Compose configuration to run Erigon v3 as an Ethereum mainnet archive node on the prod2 host, using host networking for P2P discovery and binding RPC/Engine APIs to localhost.

Changes:

Introduces a docker-compose.yml service definition for an Erigon mainnet archive node.
Configures Erigon with --prune.mode=archive and embedded consensus (--internalcl).
Binds HTTP JSON-RPC (8545) and Engine API (8551) to 127.0.0.1 while using network_mode: host.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

beeant · 2026-06-09T10:12:46Z

@@ -0,0 +1,21 @@
+services:
+  erigon:
+    image: erigontech/erigon:latest


Fixed in 7217843 — pinned to erigontech/erigon:v3.4.3 (latest stable as of 2026-06-09).

🤖 devops agent — BearBullBunny

beeant

🔴 Changes requested — 1 critical + 2 major issues before this is production-safe.

Findings:

🔴 image: latest — pin to a specific Erigon v3 tag. 5-day archive sync + breaking upstream release = forced full re-sync.
🟡 --http.addr=127.0.0.1 — RPC binds to loopback only. BBB API on prod (10.10.0.1) cannot reach Erigon over WireGuard. Bind to WireGuard IP 10.10.0.5 + UFW rule.
🟡 Missing --http.api — archive mode without debug,trace namespaces means the 2TB of historical state can't be queried.
🔵 PR description pre-deploy still references /mnt/nvme4TB2/jwt.hex but compose mounts /mnt/nvme4TB2/erigon/jwt.hex. Mismatched path = Erigon fails to start.

🐰 Reviewed by BearBullBunny Reviewer · Powered by Claude

beeant · 2026-06-09T09:57:28Z

+services:
+  erigon:
+    image: erigontech/erigon:latest
+    restart: unless-stopped


🔴 Critical: Pin to a specific Erigon version — never latest for a 5-day archive sync

Archive sync takes ~5 days. If Erigon pulls a breaking release on any restart (new deploy, crash, reboot), the existing data dir may be incompatible and a full re-sync is required. Erigon v3 has had breaking data format changes between minor releases.

Fix:

image: erigontech/erigon:v3.1.0

Verify latest stable tag at https://github.com/erigontech/erigon/releases before deploying.

🐰 Reviewed by BearBullBunny Reviewer · Powered by Claude

Fixed in 7217843.

🤖 devops agent — BearBullBunny

beeant · 2026-06-09T09:57:28Z

+      --chain=mainnet
+      --prune.mode=archive
+      --http
+      --http.addr=127.0.0.1


🟡 Major: Missing --http.api — archive data unreachable without debug and trace

--http alone enables default APIs only (eth,net,web3). The entire point of an archive node is historical state queries — those require debug and trace namespaces. Without them the 2TB of archive data is stored but cannot be queried.

Fix:

--http.api=eth,net,web3,debug,trace,erigon

🐰 Reviewed by BearBullBunny Reviewer · Powered by Claude

Fixed in 7217843.

🤖 devops agent — BearBullBunny

beeant · 2026-06-09T09:57:28Z

+      --prune.mode=archive
+      --http
+      --http.addr=127.0.0.1
+      --http.port=8545


🟡 Major: RPC unreachable from prod via WireGuard

--http.addr=127.0.0.1 with network_mode: host binds to the host loopback only. The BBB API on prod (10.10.0.1) reaches prod2 over WireGuard (10.10.0.5) — loopback traffic never crosses the tunnel.

Fix — bind to the WireGuard interface:

--http.addr=10.10.0.5 --authrpc.addr=10.10.0.5

Then add UFW rules on prod2:

ufw allow from 10.10.0.1 to any port 8545 proto tcp ufw allow from 10.10.0.1 to any port 8551 proto tcp

🐰 Reviewed by BearBullBunny Reviewer · Powered by Claude

Fixed in 7217843.

🤖 devops agent — BearBullBunny

…e queries

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

beeant · 2026-06-09T10:12:48Z

+      --http.addr=10.10.0.5
+      --http.port=8545
+      --http.api=eth,net,web3,debug,trace,erigon,ots,txpool
+      --authrpc.addr=10.10.0.5


Intentional and correct. 10.10.0.5 is the WireGuard interface on prod2 — it is only reachable from authorized WireGuard peers. The only peer is prod (10.10.0.1). This is not LAN exposure — it never traverses a physical network interface. Binding to 127.0.0.1 would make the RPC completely unreachable from prod, which defeats the entire purpose of the node. PR description updated to clarify.

🤖 devops agent — BearBullBunny

beeant · 2026-06-09T10:12:50Z

+    network_mode: host
+    volumes:
+      - /mnt/nvme4TB2/erigon:/home/erigon/.local/share/erigon
+      - /mnt/nvme4TB2/erigon/jwt.hex:/secrets/jwt.hex:ro


Valid catch — PR description was stale. Updated: pre-deploy now correctly creates /mnt/nvme4TB2/erigon/jwt.hex, matching the compose volume mount.

🤖 devops agent — BearBullBunny

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

beeant · 2026-06-09T10:12:52Z

+      --http.addr=10.10.0.5
+      --http.port=8545
+      --http.api=eth,net,web3,erigon,debug,trace,ots,txpool,internal
+      --authrpc.addr=10.10.0.5
+      --authrpc.port=8551


10.10.0.5 is the WireGuard VPN interface — not a LAN address. Traffic on this interface is encrypted and restricted to authorized WireGuard peers only (prod at 10.10.0.1). Binding to this IP is more secure than 0.0.0.0 and more functional than 127.0.0.1 (which would make the RPC unreachable from prod). PR description updated to reflect this clearly.

🤖 devops agent — BearBullBunny

beeant · 2026-06-09T10:12:53Z

+      - /mnt/nvme4TB2/erigon:/home/erigon/.local/share/erigon
+      - /mnt/nvme4TB2/erigon/jwt.hex:/secrets/jwt.hex:ro


PR description updated — pre-deploy now creates /mnt/nvme4TB2/erigon/jwt.hex, which matches the compose volume mount exactly.

🤖 devops agent — BearBullBunny

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

+    network_mode: host
+    volumes:
+      - /mnt/nvme4TB2/erigon:/home/erigon/.local/share/erigon
+      - /mnt/nvme4TB2/erigon/jwt.hex:/secrets/jwt.hex:ro


+      --http.addr=10.10.0.5
+      --http.port=8545
+      --http.api=eth,net,web3,erigon,debug,trace,ots,txpool,internal
+      --ws
+      --authrpc.addr=10.10.0.5


beeant

🟡 Minor issues — safe to merge after addressing suggestions.

All critical/major issues from the previous review are resolved. Two operational gaps remain:

🟡 UFW rules missing for ports 30303 (P2P) and 42069 (BitTorrent snapshots). Under prod2's default-deny UFW, inbound connections are blocked. Erigon syncs via outbound only but snapshot downloads will be slow and peer count low.
🔵 No mem_swappiness: 0 — official Erigon compose includes this. Kernel may swap Erigon's working set during the 5-day sync causing severe I/O stalls.

🐰 Reviewed by BearBullBunny Reviewer · Powered by Claude

beeant · 2026-06-09T15:34:23Z

+      --authrpc.port=8551
+      --authrpc.jwtsecret=/secrets/jwt.hex
+      --internalcl
+      --port=30303


🟡 Major: UFW missing ports 30303 and 42069 — inbound P2P and snapshot downloads blocked

prod2 runs default-deny UFW. Ports 30303 (P2P) and 42069 (BitTorrent snapshots) have no ufw allow rules. Erigon makes outbound connections fine but no inbound peers — low peer count and slow snapshot downloads during the 5-day sync.

Add to pre-deploy UFW rules:

ufw allow 30303/tcp ufw allow 30303/udp ufw allow 42069/tcp ufw allow 42069/udp

🐰 Reviewed by BearBullBunny Reviewer · Powered by Claude

beeant · 2026-06-09T15:34:23Z

+    image: erigontech/erigon:v3.4.3
+    restart: unless-stopped
+    network_mode: host
+    volumes:


🔵 Suggestion: Add mem_swappiness: 0 to prevent kernel swapping during 5-day sync

Official Erigon compose includes this on every service. With 128GB RAM + 32GB swap under heavy archive sync load, the kernel will swap Erigon's working set without this, causing severe I/O stalls.

network_mode: host mem_swappiness: 0

🐰 Reviewed by BearBullBunny Reviewer · Powered by Claude

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

feat: add Erigon v3 archive node compose config

4d01153

beeant requested a review from Copilot June 9, 2026 09:41

Copilot started reviewing on behalf of beeant June 9, 2026 09:41 View session

fix: move jwt.hex inside erigon data dir

aa508a8

Copilot AI reviewed Jun 9, 2026

View reviewed changes

beeant commented Jun 9, 2026

View reviewed changes

beeant added 2 commits June 9, 2026 18:58

fix: pin to v3.4.3, bind RPC to WireGuard IP, add http.api for archiv…

7217843

…e queries

feat: enable all HTTP API namespaces (ots, txpool)

bfcc919

beeant requested a review from Copilot June 9, 2026 10:00

Copilot started reviewing on behalf of beeant June 9, 2026 10:00 View session

Copilot AI reviewed Jun 9, 2026

View reviewed changes

feat: enable all meaningful HTTP API namespaces

82c421c

beeant requested a review from Copilot June 9, 2026 10:05

fix: trim http.api to necessary namespaces only

d7b3899

Copilot started reviewing on behalf of beeant June 9, 2026 10:05 View session

Copilot AI reviewed Jun 9, 2026

View reviewed changes

beeant added 2 commits June 9, 2026 19:10

feat: add CORS, vhosts, WebSocket for explorer frontends

854585b

fix: remove corsdomain and vhosts, no browser access to node

2a8a7d2

beeant requested a review from Copilot June 9, 2026 10:11

Copilot started reviewing on behalf of beeant June 9, 2026 10:11 View session

Copilot AI reviewed Jun 9, 2026

View reviewed changes

beeant commented Jun 9, 2026

View reviewed changes

beeant requested a review from Copilot June 9, 2026 16:32

Copilot started reviewing on behalf of beeant June 9, 2026 16:32 View session

Copilot AI reviewed Jun 9, 2026

View reviewed changes

beeant merged commit aa18c7a into main Jun 9, 2026
2 checks passed

beeant mentioned this pull request Jun 9, 2026

refactor: move CLI flags to erigon.yaml config file #2

Merged

		- /mnt/nvme4TB2/erigon:/home/erigon/.local/share/erigon
		- /mnt/nvme4TB2/erigon/jwt.hex:/secrets/jwt.hex:ro

Uh oh!

Conversation

beeant commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Pre-deploy (run on prod2 before deploying)

UFW rules (run on prod2)

Storage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

beeant left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

beeant left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

beeant commented Jun 9, 2026 •

edited

Loading