docs(site): stop the external-CL steps handing out 0.0.0.0 - #23086
Merged
Conversation
#23023 added a security warning telling readers to prefer `--authrpc.addr <this-host-LAN-IP>` over `0.0.0.0`, but left the copy/paste step above it still handing out `0.0.0.0`. So the page contradicts itself, and the unsafe branch is the one that is easier to follow: a reader working through the numbered steps gets the broad bind, and only someone who also reads the warning learns not to. This is live on docs.erigon.tech, since this is the branch that publishes. The step now gives the LAN-IP form and points at the warning before mentioning 0.0.0.0 at all. Affects the Ethereum and Gnosis external-CL pages. Found by Copilot on the forward-port PRs (#23084 / #23085), which carry the same content; both already have this fix so they do not reintroduce it. Verified: generate-llms.py --check OK (4 files, 74 pages), build clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Copilot review on #23084: with `--nat=extip:${EXTERNAL_IP}`, Docker Compose substitutes an empty string when EXTERNAL_IP is unset, so the container starts with `--nat=extip:` and Erigon exits on an invalid NAT option. The prose does say to set it or drop both lines, but a reader who copies the file and forgets gets a confusing runtime failure instead of a clear one. Switched to Compose's required-variable form, so the failure happens before the container starts and explains itself: --nat=extip:${EXTERNAL_IP:?set EXTERNAL_IP to this host's public IP, or delete these two lines to run outbound-only} Four occurrences across the Ethereum and Gnosis easy-node pages (a --nat and a --caplin.nat in each). Applies here because #23023 introduced these snippets on this branch, so the behaviour is already live on docs.erigon.tech. main and release/3.6 do not have them yet — the forward-port PRs (#23084 / #23085) carry this fix with them. Verified: generate-llms.py --check OK (74 pages), build clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
bloxster
pushed a commit
that referenced
this pull request
Aug 7, 2026
Copilot review: `--nat=extip:${EXTERNAL_IP}` lets Docker Compose substitute an
empty string when EXTERNAL_IP is unset, so Erigon starts with `--nat=extip:` and
exits on an invalid NAT option. Compose's required-variable form makes the
failure immediate and self-explanatory instead.
Four occurrences across the Ethereum and Gnosis easy-node pages. This branch
introduces these snippets here, so the fix ships with them rather than landing
as a follow-up. Also fixed on release/3.5 (#23086), where they are already live.
Verified: generate-llms.py --check OK, build clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
bloxster
pushed a commit
that referenced
this pull request
Aug 7, 2026
Copilot review: `--nat=extip:${EXTERNAL_IP}` lets Docker Compose substitute an
empty string when EXTERNAL_IP is unset, so Erigon starts with `--nat=extip:` and
exits on an invalid NAT option. Compose's required-variable form makes the
failure immediate and self-explanatory instead.
Four occurrences across the Ethereum and Gnosis easy-node pages. This branch
introduces these snippets here, so the fix ships with them rather than landing
as a follow-up. Also fixed on release/3.5 (#23086), where they are already live.
Verified: generate-llms.py --check OK, build clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
lystopad
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The problem is live on docs.erigon.tech
#23023 added a security warning to the external-CL pages telling readers to prefer
--authrpc.addr <this-host-LAN-IP>over0.0.0.0— but left the copy/paste step directly above it still handing out0.0.0.0.So the page contradicts itself, and the unsafe branch is the easier one to follow: a reader working through the numbered steps gets the broad bind on every interface, and only someone who also reads the admonition below learns not to. This branch is the one that publishes, so it is what users see today.
Why it matters: the Engine API drives block processing, so anything that can reach it and holds the JWT secret controls the node.
0.0.0.0binds every interface, including a public one if the host has it.The fix
The step now hands out the LAN-IP form and points at the warning before
0.0.0.0is mentioned at all:Applies to both affected pages — Ethereum and Gnosis external-CL.
Provenance
Found by Copilot on the forward-port PRs #23084 (
main) and #23085 (release/3.6), which carry the same content. Both already have this fix, so they will not reintroduce it — but the defect originates here, on the published branch, which is why it needs its own PR rather than riding along with a port.Note that
mainandrelease/3.6currently have the0.0.0.0step with no warning at all; the ports add the warning and the corrected step together.Verification
python3 docs/site/scripts/generate-llms.py --check→ OK, 4 files, 74 pagesnpm run build→ clean🤖 Generated with Claude Code