public node endpoints: one name per chain on oolon, throttled, routed to bob #53
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Parent: #3. The infrastructure half of #20's decision (see the correction there dated 2026-09-15).
Scope
quantus.blackbeard.observerandplanck.blackbeard.observer(perarchitecture/public-dns.md), pointing at oolon.architecture/external-tls.md), and oneupstreamper chain inconf.d/so adding a server is one line:quantus_node: bob's node over the mesh (the only node we run). The two public mainnet archive nodes the observer already uses as fallbacks may join asbackupservers.planck_node:a1-planck.quantus.catanda2-planck.quantus.cat, the official Quantus endpoints. We run no testnet node. This is a TLS upstream, soproxy_pass https://,proxy_ssl_server_name on, andproxy_ssl_nameper server so SNI is right.POST /and the WebSocket upgrade on the same name, withproxy_read_timeoutlong enough for subscriptions and a health check that removes a dead upstream server.limit_req_zonekeyed on client address for HTTP RPC,limit_conn_zonefor concurrent WebSockets per client (limit_reqonly sees the upgrade handshake), sane bursts, and a429/503the wallet reads as "throttled, back off" rather than "node down". Record the chosen numbers in the vhost comments. Throttling on the Planck name also protects Quantus's public nodes from us.architecture/internal-tls.mdif the hop is encrypted),--rpc-methods safe,--rpc-corsfor the public name,--rpc-max-connectionssized for the throttle.blackbeard/observer's workflow today. Put the vhost, upstream and firewalld files in that repo'sasset/and deploy job, and link the commit here, unless a wallet-owned deploy is preferred (say why on this issue if so).Why Planck at all
Planck is in the wallet only to prove the multi-chain UX end to end, until a real post-quantum mainnet that is not Quantus exists. Heisenberg is not needed; if Planck is ever retired, the same pattern proxies whichever testnet Quantus keeps.
Acceptance
websocat wss://quantus.blackbeard.observeranswerssystem_chainwithQuantus;planck.blackbeard.observeranswersPlanck. Taking one Planck upstream out of DNS or having it time out does not break the name. Hammering either name from one address gets throttled while a second address is unaffected. The certificate renews unattended. The wallet's profile for each chain lists only that name.Depends on
Nothing in the wallet code; #20 consumes the result.
Done, 2026-09-16. The files live where the issue asked:
54db950:asset/nginx/blackbeard-nodes.conf(upstreamsquantus_node→ bob:9944 over the mesh,planck_node→ a1/a2-planck.quantus.cat:443 withmax_fails=3 fail_timeout=30s;limit_req_zone node_rpc 20r/s,limit_conn_zone node_conn),asset/nginx/quantus.blackbeard.observer.confandplanck.blackbeard.observer.conf(LE cert, TLS 1.2+1.3,limit_req burst=40 nodelay,limit_conn 16, 429 on both, 3600 s socket timeouts, 1 MiB bodies; the Planck one isproxy_pass httpswithproxy_ssl_server_name on,proxy_ssl_name a1-planck.quantus.cat, verification against the system CA bundle, since both hosts sit behind one*.quantus.catcertificate), and anodesrole inscript/infra-setup.shthat creates the CNAME tobl.thgttg.com, issues the certificate, installs the vhosts and enables them only afternginx -tpasses.404c65a: bob's matrix entry gainsrpc_extra_sources: "oolon.kosherinata.internal", resolved on the node into a/32rich rule forquantus-node-rpcbeside the site-subnet rule. Applied by hand on bob with the same command, then codified.Acceptance, as run:
system_chainover HTTPSQuantusandPlancksystem_chainover WSSchain_subscribeNewHeadson the quantus name delivered a headcertbot-renew.timerenabled and active on oolon, host-wide reload hook presentwss://quantus.blackbeard.observer/wss://planck.blackbeard.observer; the ignoredplanck_accepts_the_signature…test passes against the public nameTwo notes. nginx open source has no active health checks, so "taking one Planck upstream out of DNS" is covered by passive
max_fails/fail_timeout(a failing server is skipped for 30 s) rather than tested by pulling a record; and a resolver that looked the quantus name up before the record existed caches the miss for a while, which is what the script's own final curl hit.