Making RPC Publicly Accessible

Hey everyone, I just set up a pretty powerful server that runs Bitcoind with txindex=1, and I think it could be useful for folks to access it. To allow access, I've turned on rpcbindaddress=0.0.0.0. Right now, I’ve only whitelisted a couple of IPs, but I'm considering making it available to everyone. I’ve seen a lot of warnings about this being risky based on various documents and advice. I’m sharing my configuration here and really want to figure out how to set up endpoints to provide Bitcoin info to anyone. I’ve stripped out some unused options. I control the server, so I can change whatever I need to. Just want to get a grip on this and avoid messing things up too badly.

Yeah, it is dangerous to run a public RPC server. The reason being, is that people can effectively use it to Denial-of-Service your node by spamming a very long running RPC call like getblock or even "bitcoin-cli echo <one gigabyte of ascii garbage that is sent back to the client>". So not only CPU resources being used here, but even memory and network bandwidth. What those who do go about this do is put their RPC service behind a reverse proxy like nginx and rate-limit it to a specific number of calls per second, minute, day, whatever.

Hello, Thanks for your answer. Nginx acts as a reverse proxy? Cool, so I just have to configure nginx about 8332 port communication?

Do you know if I can find somewhere a nginx config example dedicated to Bitcoin RPC which is locking wallets access but allow rest and some basics rpc call everything in https? I'm still figuring out, but I have a port with https TLS certificate for the server. Such that it can be authenticated regarding TLS but I still don't know how to activate it ^^'

Yeah you can create a site configuration for sending requests from a particular (sub-)domain you have to your node, and it will look something like this: And then run certbot on it to get an HTTPS certificate.

Ok thank you! Just to be sure to understand, as I put rpcbind=0.0.0.0:8332 127.0.0.1:8332 address will not be accessible anymore right? Or yes it's still working as usually because 0.0.0.0 maps 127.0.0.1. Sorry it's more a general network question than bitcoin focused...

When you run a reverse proxy, you can still access the original address. (You must be able to, otherwise the reverse proxy would not function properly.) 0.0.0.0 is not an address you can query by CURL or browser, it just means "listen to each address of all of my network interfaces" so that means your Ethernet port (if you use that), your wifi interface, the loopback "localhost" interface and so forth. Also if you have software like Docker that creates new virtual interfaces then it binds to that address on the 8332 port too and so on.

If you RPC is public, what would happen if someone decides to stop the service with: That would be a game over. If you want to make it public you should allow and block some calls, and stop is one of the options that shouldn't be valid at all. And why have it public?, maybe you could just configure SSH on that server and give access to the users that you want to play with your node, that would be a better way.

Yes exactly! Yes indeed I can create users to allow people to play with but more risky. My idea is that I rented recently a quite good server and I can run bitcoin with good configs like coinstats, txindex and I can add other indexes, and I think it can be good to share it with the community. In the idea to provide a pretty good endpoint RPC with good features and understand how to provide such kind of services. Like a first node providing experimentation for the community. But I know that it's dangerous and need to fill some requirements.