feat(core/config): enable override of rpc.host and grpc.host, and add ability to use secure connections #3242
Conversation
…rminology vs ip, allow setting/overriding scheme by passing in as part of host, allow (untested) setting of a grpc cert
ramin
added
kind:feat
|
running into issues CLI command to start: Then I try to |
$ celestia light start --p2p.network mocha --core.grpc.host grpc-mocha.pops.one --core.rpc.host full.consensus.mocha-4.celestia-mocha.com
$ export CEL_AUTH_TOKEN=$(celestia light auth admin --p2p.network mocha)
$ celestia state account-address --token $CEL_AUTH_TOKENboth endpoints are not secured and pointing to 9090 and 26657 respectively $ celestia light start --p2p.network mocha --core.grpc.host grpc.celestia-mocha.com --core.grpc.port 443 --core.rpc.host https://rpc-mocha.pops.one --core.rpc.port 443
$ export CEL_AUTH_TOKEN=$(celestia light auth admin --p2p.network mocha)
$ celestia state account-address --token $CEL_AUTH_TOKENboth endpoints are secured here |
produces these errors 2024-04-03T16:01:36.872+0200 WARN rpc go-jsonrpc@v0.3.1/handler.go:444 error in RPC call to 'state.Balance': post failed: Post "https://46.166.170.198:443": tls: failed to verify certificate: x509: cannot validate certificate for 46.166.170.198 because it doesn't contain any IP SANs
2024-04-03T16:02:30.759+0200 WARN rpc go-jsonrpc@v0.3.1/handler.go:444 error in RPC call to 'state.Balance': post failed: Post "https://151.115.15.15:443": tls: failed to verify certificate: x509: certificate signed by unknown authority |
|
@Bidon15 try like this:
so flags as
sets two separate hosts (1 for grpc, one for rpc) and then allows https for RPC lets pair and get this over line tomorrow |
produces this error as an example that the rpc works |
@Bidon15 your curl command does not work for me either. but looking at the error you shared this indicates that node is trying to lookup the cert for the IP while your curl command uses a valid domain-name. Your browser would or at least also should complain about https://151.115.15.15/ while it would not for https://rpc.celestia-mocha.com |
…core.go, state/core_access.go, state/core_access_test.go, state/integration_test.go
|
@Bidon15 Do you still want this PR for BNs ? We will be removing need for rpc flag for FNs and LNs in v0.14.0, but likely not for BNs in that release. |
Hey @renaynay. Fine for me if we achieve the following result:
Reasoning: when we ship #3295, most RaaS teams will utilise a single DA BN for their EEs |
|
@Bidon15 So should we close this PR? |
|
Yes, the follow-up is here #3359 |
core.grpc.hostinstead ofcore.grpc.ipas it just makes more sense as we are using DNS)httpschema, modifying the url validation to expect a host with a scheme and falling back to http, so we can make http and https requests to core over RPC and grpcref: #2931