使用公开的RPC托管Tezos节点的最佳实践是什么？

要么:

• 完全不公开RPC(！),或
• 在代理服务器前面放置一个限制最大的 whitelist .

当然,要获得白名单的帮助,您一定不能在白名单中包括潜在有害的端点...甚至看似无害的端点也可能被用于拒绝服务,并且某些端点出人意料地有害.

Either:

• don't expose the RPC at all (!), or
• put a proxy in front with a maximally restrictive whitelist.

Of course, for a whitelist to help, you must not include potentially harmful endpoints in your whitelist... Even seemingly harmless endpoints might be used for denial of service, and some endpoints are surprisingly harmful.

我们为TezRPC(为TezBox供电)所做的工作是在每台服务器上运行一个代理.然后,您可以在此代理中阻止,限制和定制面向公众的端点.

我们当前使用的是NodeJS内置的轻量级代理,但将切换到Nginx样式的代理(性能更好).

这是一个node.js代理的示例,该代理阻止了几乎所有端点(侦听端口8732上的本地RPC API):

 var express = require('express');  
var request = require('request');
var app = express();  
var cors = require('cors')
var apiServerHost = "http://localhost:8732";
app.use(cors())
app.use('/', function(req, res) {
    // Whitelist. Be afraid.
    if (req.url === '/chains/main/blocks/head'
          || req.url === '/chains/main/blocks/head/hash') {
        var url = apiServerHost + req.url;
        req.pipe(request(url)).pipe(res);
    } else {
        res.status(404).send('Not available');
    }
});
app.listen(process.env.PORT || 3000, function () {
  console.log('TZProxy running')
})  
 

What we do for TezRPC (which powers TezBox) is run a proxy on each server. Within this proxy, you can then block, restrict and customize public facing endpoints.

We currently use a light proxy built with NodeJS, but will switch over to a nginx style proxy (better performance).

Here is an example of a node.js proxy that blocks almost all endpoints (listening to the local RPC API on port 8732):

var express = require('express');  
var request = require('request');
var app = express();  
var cors = require('cors')
var apiServerHost = "http://localhost:8732";
app.use(cors())
app.use('/', function(req, res) {
    // Whitelist. Be afraid.
    if (req.url === '/chains/main/blocks/head'
          || req.url === '/chains/main/blocks/head/hash') {
        var url = apiServerHost + req.url;
        req.pipe(request(url)).pipe(res);
    } else {
        res.status(404).send('Not available');
    }
});
app.listen(process.env.PORT || 3000, function () {
  console.log('TZProxy running')
})  

我能想到的替代方法之一是使用Conseil: https://github.com/Cryptonomic/Conseil

根据我的拙见,Conseil的作用是在tezos-node/rpc之上提供扩展的API.也许(?)一些额外的功能可以允许启用/禁用端点或其他安全措施.

以下是一些示例

One of the alternatives i could think of, is using Conseil: https://github.com/Cryptonomic/Conseil

In my humble understanding what Conseil does, is provide an extended API on top of a tezos-node/rpc. And perhaps (?) some extra features which could allow enabling/disabling endpoints or other security measures.

Here's a few examples

当您只需要RPC时,还可以使用ssh本地端口转发将RPC从远程计算机的本地主机转发到本地计算机的本地主机.

例如,作为后台进程:

 ssh -fNT -L 8732:localhost:8732 user@hostname
 

我不知道这有多安全.

When you only need the RPC for yourself you could also use ssh local port forwarding to forward the RPC from the localhost of your remote machine to the localhost of your local machine.

For instance, as a background process:

ssh -fNT -L 8732:localhost:8732 user@hostname

I don't know how safe this is though.