Enable Siren and change how traefik and shared ports are configured

besu.yml

@@ -75,6 +75,31 @@ services:
       - --metrics-port
       - "6060"
       - --nat-method=DOCKER
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.${EL_HOST:-el}.service=${EL_HOST:-el}
+      - traefik.http.routers.${EL_HOST:-el}.entrypoints=websecure
+      - traefik.http.routers.${EL_HOST:-el}.rule=Host(`${EL_HOST:-el}.${DOMAIN}`)
+      - traefik.http.routers.${EL_HOST:-el}.tls.certresolver=letsencrypt
+      - traefik.http.routers.${EL_HOST:-el}lb.service=${EL_HOST:-el}
+      - traefik.http.routers.${EL_HOST:-el}lb.entrypoints=websecure
+      - traefik.http.routers.${EL_HOST:-el}lb.rule=Host(`${EL_LB:-el-lb}.${DOMAIN}`)
+      - traefik.http.routers.${EL_HOST:-el}lb.tls.certresolver=letsencrypt
+      - traefik.http.services.${EL_HOST:-el}.loadbalancer.server.port=${EL_RPC_PORT:-8545}
+      - traefik.http.routers.${EL_WS_HOST:-elws}.service=${EL_WS_HOST:-elws}
+      - traefik.http.routers.${EL_WS_HOST:-elws}.entrypoints=websecure
+      - traefik.http.routers.${EL_WS_HOST:-elws}.rule=Host(`${EL_WS_HOST:-elws}.${DOMAIN}`)
+      - traefik.http.routers.${EL_WS_HOST:-elws}.tls.certresolver=letsencrypt
+      - traefik.http.routers.${EL_WS_HOST:-elws}lb.service=${EL_WS_HOST:-elws}
+      - traefik.http.routers.${EL_WS_HOST:-elws}lb.entrypoints=websecure
+      - traefik.http.routers.${EL_WS_HOST:-elws}lb.rule=Host(`${EL_WS_LB:-elws-lb}.${DOMAIN}`)
+      - traefik.http.routers.${EL_WS_HOST:-elws}lb.tls.certresolver=letsencrypt
+      - traefik.http.services.${EL_WS_HOST:-elws}.loadbalancer.server.port=${EL_WS_PORT:-8546}
+      - traefik.http.routers.${EE_HOST:-ee}.service=${EE_HOST:-ee}
+      - traefik.http.routers.${EE_HOST:-ee}.entrypoints=websecure
+      - traefik.http.routers.${EE_HOST:-ee}.rule=Host(`${EE_HOST:-ee}.${DOMAIN}`)
+      - traefik.http.routers.${EE_HOST:-ee}.tls.certresolver=letsencrypt
+      - traefik.http.services.${EE_HOST:-ee}.loadbalancer.server.port=${EE_PORT:-8551}
 volumes:
   besu-eth1-data:
   jwtsecret:

cl-shared.yml

@@ -2,4 +2,4 @@ version: "3.9"
 services:
   consensus:
     ports:
-      - ${HOST_IP:-}${CL_REST_PORT:-5052}:${CL_REST_PORT:-5052}/tcp
+      - ${SHARE_IP:-}${CL_REST_PORT:-5052}:${CL_REST_PORT:-5052}/tcp

consensus-keyapi-shared.yml

@@ -0,0 +1,5 @@
+version: "3.9"
+services:
+  consensus:
+    ports:
+      - ${SHARE_IP:-}${KEY_API_PORT:-7500}:${KEY_API_PORT:-7500}/tcp

default.env

@@ -42,6 +42,7 @@ CF_ZONE_ID=
 AWS_PROFILE=myprofile
 AWS_HOSTED_ZONE_ID=myzoneid
 GRAFANA_HOST=grafana
+SIREN_HOST=siren
 PROM_HOST=prometheus
 PRYSM_HOST=prysm
 EE_HOST=ee
@@ -51,6 +52,7 @@ EL_WS_HOST=elws
 EL_WS_LB=elws-lb
 CL_HOST=cl
 CL_LB=cl-lb
+VC_HOST=vc
 DDNS_SUBDOMAIN=grafana
 DDNS_PROXY=true
 
@@ -70,6 +72,10 @@ BEACON_STATS_MACHINE=
 # Note if you set it, and only then, you MUST append a colon to the end, like 1.2.3.4: or [2001:1:2::3]:, to work around
 # a limitation of compose V1, even when using compose V2
 HOST_IP=
+# IP address to use when host-mapping port through *-shared.yml. Set this to 127.0.0.1: to restrict the share to localhost
+# Note if you set it, and only then, you MUST append a colon to the end, like 1.2.3.4: or [2001:1:2::3]:, to work around
+# a limitation of compose V1, even when using compose V2
+SHARE_IP=
 
 # P2P ports you will forward to your staking node. Adjust here if you are
 # going to use something other than defaults.
@@ -79,6 +85,8 @@ PRYSM_PORT=9000
 PRYSM_UDP_PORT=9000
 # Local grafana dashboard port. Do not expose to Internet, it is insecure http
 GRAFANA_PORT=3000
+# Local Siren UI port. Do not expose to Internet, it is insecure http
+SIREN_PORT=8080
 # Prometheus port used when exposing directly on host; used for federation
 PROMETHEUS_PORT=9090
 # Local key manager port. Reachable only via localhost. Also doubles as Prysm web port
@@ -189,6 +197,10 @@ LH_DOCKER_TAG=latest-modern
 LH_DOCKER_REPO=sigp/lighthouse
 LH_DOCKERFILE=Dockerfile.binary
 
+# Lighthouse Siren
+SIREN_DOCKER_TAG=latest
+SIREN_DOCKER_REPO=sigmaprime/siren
+
 # Prysm
 # SRC build target can be a tag, a branch, or a pr as "pr-ID"
 PRYSM_SRC_BUILD_TARGET='$(git describe --tags $(git rev-list --tags --max-count=1))'

ee-shared.yml

@@ -4,4 +4,4 @@ version: "3.9"
 services:
   execution:
     ports:
-      - ${HOST_IP:-}${EE_PORT}:${EE_PORT:-8551}/tcp
+      - ${SHARE_IP:-}${EE_PORT}:${EE_PORT:-8551}/tcp

el-shared.yml

@@ -3,5 +3,5 @@ version: "3.9"
 services:
   execution:
     ports:
-      - ${HOST_IP:-}${EL_RPC_PORT}:${EL_RPC_PORT:-8545}/tcp
-      - ${HOST_IP:-}${EL_WS_PORT}:${EL_WS_PORT:-8546}/tcp
+      - ${SHARE_IP:-}${EL_RPC_PORT}:${EL_RPC_PORT:-8545}/tcp
+      - ${SHARE_IP:-}${EL_WS_PORT}:${EL_WS_PORT:-8546}/tcp

erigon.yml

@@ -91,6 +91,31 @@ services:
       # Memory use reduction. Not needed with 32G and does not help with 16G
       #- --batchSize
       #- 64m
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.${EL_HOST:-el}.service=${EL_HOST:-el}
+      - traefik.http.routers.${EL_HOST:-el}.entrypoints=websecure
+      - traefik.http.routers.${EL_HOST:-el}.rule=Host(`${EL_HOST:-el}.${DOMAIN}`)
+      - traefik.http.routers.${EL_HOST:-el}.tls.certresolver=letsencrypt
+      - traefik.http.routers.${EL_HOST:-el}lb.service=${EL_HOST:-el}
+      - traefik.http.routers.${EL_HOST:-el}lb.entrypoints=websecure
+      - traefik.http.routers.${EL_HOST:-el}lb.rule=Host(`${EL_LB:-el-lb}.${DOMAIN}`)
+      - traefik.http.routers.${EL_HOST:-el}lb.tls.certresolver=letsencrypt
+      - traefik.http.services.${EL_HOST:-el}.loadbalancer.server.port=${EL_RPC_PORT:-8545}
+      - traefik.http.routers.${EL_WS_HOST:-elws}.service=${EL_WS_HOST:-elws}
+      - traefik.http.routers.${EL_WS_HOST:-elws}.entrypoints=websecure
+      - traefik.http.routers.${EL_WS_HOST:-elws}.rule=Host(`${EL_WS_HOST:-elws}.${DOMAIN}`)
+      - traefik.http.routers.${EL_WS_HOST:-elws}.tls.certresolver=letsencrypt
+      - traefik.http.routers.${EL_WS_HOST:-elws}lb.service=${EL_WS_HOST:-elws}
+      - traefik.http.routers.${EL_WS_HOST:-elws}lb.entrypoints=websecure
+      - traefik.http.routers.${EL_WS_HOST:-elws}lb.rule=Host(`${EL_WS_LB:-elws-lb}.${DOMAIN}`)
+      - traefik.http.routers.${EL_WS_HOST:-elws}lb.tls.certresolver=letsencrypt
+      - traefik.http.services.${EL_WS_HOST:-elws}.loadbalancer.server.port=${EL_WS_PORT:-8546}
+      - traefik.http.routers.${EE_HOST:-ee}.service=${EE_HOST:-ee}
+      - traefik.http.routers.${EE_HOST:-ee}.entrypoints=websecure
+      - traefik.http.routers.${EE_HOST:-ee}.rule=Host(`${EE_HOST:-ee}.${DOMAIN}`)
+      - traefik.http.routers.${EE_HOST:-ee}.tls.certresolver=letsencrypt
+      - traefik.http.services.${EE_HOST:-ee}.loadbalancer.server.port=${EE_PORT:-8551}
 volumes:
   erigon-el-data:
   jwtsecret:

ethd

@@ -682,10 +682,10 @@ envmigrate() {
 
     ALL_VARS=( COMPOSE_FILE FEE_RECIPIENT EL_NODE GRAFFITI DEFAULT_GRAFFITI NETWORK MEV_BOOST MEV_RELAYS MEV_MIN_BID MEV_NODE \
             CL_MAX_PEER_COUNT CL_MIN_PEER_COUNT EL_MAX_PEER_COUNT EL_MIN_PEER_COUNT DOMAIN ACME_EMAIL AUTOPRUNE_NM LOGS_LABEL \
-            CF_DNS_API_TOKEN CF_ZONE_API_TOKEN CF_ZONE_ID AWS_PROFILE AWS_HOSTED_ZONE_ID GRAFANA_HOST DISTRIBUTED BESU_HEAP TEKU_HEAP \
-            PROM_HOST HOST_IP PRYSM_HOST EE_HOST EL_HOST EL_LB EL_WS_HOST EL_WS_LB CL_HOST CL_LB DDNS_SUBDOMAIN IPV6 \
+            CF_DNS_API_TOKEN CF_ZONE_API_TOKEN CF_ZONE_ID AWS_PROFILE AWS_HOSTED_ZONE_ID GRAFANA_HOST SIREN_HOST DISTRIBUTED BESU_HEAP TEKU_HEAP \
+            PROM_HOST HOST_IP SHARE_IP PRYSM_HOST EE_HOST EL_HOST EL_LB EL_WS_HOST EL_WS_LB CL_HOST CL_LB VC_HOST DDNS_SUBDOMAIN IPV6 \
             DDNS_PROXY RAPID_SYNC_URL CL_NODE BEACON_STATS_API BEACON_STATS_MACHINE EL_P2P_PORT CL_P2P_PORT WEB3SIGNER \
-            PRYSM_PORT DOPPELGANGER PRYSM_UDP_PORT GRAFANA_PORT PROMETHEUS_PORT KEY_API_PORT TRAEFIK_WEB_PORT TRAEFIK_WEB_HTTP_PORT \
+            PRYSM_PORT DOPPELGANGER PRYSM_UDP_PORT GRAFANA_PORT SIREN_PORT PROMETHEUS_PORT KEY_API_PORT TRAEFIK_WEB_PORT TRAEFIK_WEB_HTTP_PORT \
             CL_REST_PORT EL_RPC_PORT EL_WS_PORT EE_PORT ERIGON_TORRENT_PORT LOG_LEVEL JWT_SECRET EL_EXTRAS CL_EXTRAS \
             VC_EXTRAS ARCHIVE_NODE SSV_P2P_PORT SSV_P2P_PORT_UDP ERIGON_P2P_PORT_2 ERIGON_P2P_PORT_3 )
     TARGET_VARS=( NIM_SRC_BUILD_TARGET NIM_SRC_REPO NIM_DOCKER_TAG NIM_DOCKER_VC_TAG NIM_DOCKER_REPO NIM_DOCKER_VC_REPO NIM_DOCKERFILE \
@@ -697,7 +697,8 @@ envmigrate() {
                 GETH_SRC_BUILD_TARGET GETH_SRC_REPO GETH_DOCKER_TAG GETH_DOCKER_REPO TRAEFIK_TAG DDNS_TAG GETH_DOCKERFILE NM_SRC_BUILD_TARGET \
                 NM_SRC_REPO NM_DOCKER_TAG NM_DOCKER_REPO NM_DOCKERFILE BESU_SRC_BUILD_TARGET BESU_SRC_REPO BESU_DOCKER_TAG BESU_DOCKER_REPO \
                 BESU_DOCKERFILE SSV_NODE_TAG SSV2_NODE_TAG DEPCLI_SRC_BUILD_TARGET DEPCLI_SRC_REPO DEPCLI_DOCKER_TAG W3S_DOCKER_TAG W3S_DOCKER_REPO \
-                PG_DOCKER_TAG RETH_SRC_BUILD_TARGET RETH_SRC_REPO RETH_DOCKER_TAG RETH_DOCKER_REPO RETH_DOCKERFILE NODE_EXPORTER_IGNORE_MOUNT_REGEX )
+                PG_DOCKER_TAG RETH_SRC_BUILD_TARGET RETH_SRC_REPO RETH_DOCKER_TAG RETH_DOCKER_REPO RETH_DOCKERFILE SIREN_DOCKER_TAG SIREN_DOCKER_REPO \
+                NODE_EXPORTER_IGNORE_MOUNT_REGEX )
     OLD_VARS=( LH_PORT PRYSM_WEB_PORT EC_NODE REWARDS_TO GETH_CACHE CF_API_TOKEN \
             EC_HOST EC_LB EC_WS_HOST EC_WS_LB CC_HOST CC_LB EC_P2P_PORT CC_NODE CC_P2P_PORT EC_RPC_PORT EC_WS_PORT )
     NEW_VARS=( CL_P2P_PORT KEY_API_PORT EL_NODE FEE_RECIPIENT EL_EXTRAS CF_DNS_API_TOKEN \
@@ -830,8 +831,8 @@ envmigrate() {
 migrate_compose_file() {
 # When this gets called $var is COMPOSE_FILE and $value is what is set in .env for it
 # Some files have been renamed and others removed altogether
-    FROM_YML=( ec-shared.yml ec-traefik.yml cc-shared.yml grafana-insecure.yml prysm-web-insecure.yml lh-base-notz.yml lh-validator-notz.yml lh-slasher.yml teku-base-notz.yml teku-validator-notz.yml lh-consensus.yml lh-validator.yml lodestar-consensus.yml lodestar-validator.yml nimbus-consensus.yml prysm-consensus.yml prysm-consensus-rest.yml prysm-validator.yml teku-consensus.yml teku-validator.yml lh-base.yml lh-vc-only.yml lh-cl-only.yml nm.yml lighthouse-base.yml teku-base.yml nimbus-base.yml prysm-base.yml lodestar-base.yml traefik-cf-v6.yml prysm-web.yml blank-grafana.yml lh-grafana.yml lhcc-grafana.yml nimbus-grafana.yml prysm-grafana.yml teku-grafana.yml geth-grafana.yml erigon-grafana.yml oe.yml teku-stats.yml lh-stats.yml lh-stats-consensus.yml lh-stats-validator.yml traefik-shared.yml lighthouse-slasher.yml prysm-slasher.yml )
-    TO_YML=( el-shared.yml el-traefik.yml cl-shared.yml grafana-shared.yml prysm-web-shared.yml lighthouse-base.yml lighthouse-vc-only.yml lighthouse-slasher.yml teku-base.yml teku-vc-only.yml lighthouse-cl-only.yml lighthouse-vc-only.yml lodestar-cl-only.yml lodestar-vc-only.yml nimbus-cl-only.yml prysm-cl-only.yml prysm-cl-only.yml prysm-vc-only.yml teku-cl-only.yml teku-vc-only.yml lighthouse-base.yml lighthouse-vc-only.yml lighthouse-cl-only.yml nethermind.yml lighthouse.yml teku.yml nimbus.yml prysm.yml lodestar.yml traefik-cf.yml "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" )
+    FROM_YML=( ec-shared.yml ec-traefik.yml cc-shared.yml grafana-insecure.yml prysm-web-insecure.yml lh-base-notz.yml lh-validator-notz.yml lh-slasher.yml teku-base-notz.yml teku-validator-notz.yml lh-consensus.yml lh-validator.yml lodestar-consensus.yml lodestar-validator.yml nimbus-consensus.yml prysm-consensus.yml prysm-consensus-rest.yml prysm-validator.yml teku-consensus.yml teku-validator.yml lh-base.yml lh-vc-only.yml lh-cl-only.yml nm.yml lighthouse-base.yml teku-base.yml nimbus-base.yml prysm-base.yml lodestar-base.yml traefik-cf-v6.yml validator-keyapi-localport.yml consensus-keyapi-localport.yml prysm-web.yml blank-grafana.yml lh-grafana.yml lhcc-grafana.yml nimbus-grafana.yml prysm-grafana.yml teku-grafana.yml geth-grafana.yml erigon-grafana.yml oe.yml teku-stats.yml lh-stats.yml lh-stats-consensus.yml lh-stats-validator.yml traefik-shared.yml lighthouse-slasher.yml prysm-slasher.yml el-traefik.yml ee-traefik.yml prometheus-traefik.yml )
+    TO_YML=( el-shared.yml el-traefik.yml cl-shared.yml grafana-shared.yml prysm-web-shared.yml lighthouse-base.yml lighthouse-vc-only.yml lighthouse-slasher.yml teku-base.yml teku-vc-only.yml lighthouse-cl-only.yml lighthouse-vc-only.yml lodestar-cl-only.yml lodestar-vc-only.yml nimbus-cl-only.yml prysm-cl-only.yml prysm-cl-only.yml prysm-vc-only.yml teku-cl-only.yml teku-vc-only.yml lighthouse-base.yml lighthouse-vc-only.yml lighthouse-cl-only.yml nethermind.yml lighthouse.yml teku.yml nimbus.yml prysm.yml lodestar.yml traefik-cf.yml validator-keyapi-shared.yml validator-keyapi-shared.yml "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "")
 
     __old_grafana=0
     __new_grafana=0

geth.yml

@@ -73,6 +73,31 @@ services:
       - --authrpc.vhosts=*
       - --maxpeers
       - ${EL_MAX_PEER_COUNT:-50}
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.${EL_HOST:-el}.service=${EL_HOST:-el}
+      - traefik.http.routers.${EL_HOST:-el}.entrypoints=websecure
+      - traefik.http.routers.${EL_HOST:-el}.rule=Host(`${EL_HOST:-el}.${DOMAIN}`)
+      - traefik.http.routers.${EL_HOST:-el}.tls.certresolver=letsencrypt
+      - traefik.http.routers.${EL_HOST:-el}lb.service=${EL_HOST:-el}
+      - traefik.http.routers.${EL_HOST:-el}lb.entrypoints=websecure
+      - traefik.http.routers.${EL_HOST:-el}lb.rule=Host(`${EL_LB:-el-lb}.${DOMAIN}`)
+      - traefik.http.routers.${EL_HOST:-el}lb.tls.certresolver=letsencrypt
+      - traefik.http.services.${EL_HOST:-el}.loadbalancer.server.port=${EL_RPC_PORT:-8545}
+      - traefik.http.routers.${EL_WS_HOST:-elws}.service=${EL_WS_HOST:-elws}
+      - traefik.http.routers.${EL_WS_HOST:-elws}.entrypoints=websecure
+      - traefik.http.routers.${EL_WS_HOST:-elws}.rule=Host(`${EL_WS_HOST:-elws}.${DOMAIN}`)
+      - traefik.http.routers.${EL_WS_HOST:-elws}.tls.certresolver=letsencrypt
+      - traefik.http.routers.${EL_WS_HOST:-elws}lb.service=${EL_WS_HOST:-elws}
+      - traefik.http.routers.${EL_WS_HOST:-elws}lb.entrypoints=websecure
+      - traefik.http.routers.${EL_WS_HOST:-elws}lb.rule=Host(`${EL_WS_LB:-elws-lb}.${DOMAIN}`)
+      - traefik.http.routers.${EL_WS_HOST:-elws}lb.tls.certresolver=letsencrypt
+      - traefik.http.services.${EL_WS_HOST:-elws}.loadbalancer.server.port=${EL_WS_PORT:-8546}
+      - traefik.http.routers.${EE_HOST:-ee}.service=${EE_HOST:-ee}
+      - traefik.http.routers.${EE_HOST:-ee}.entrypoints=websecure
+      - traefik.http.routers.${EE_HOST:-ee}.rule=Host(`${EE_HOST:-ee}.${DOMAIN}`)
+      - traefik.http.routers.${EE_HOST:-ee}.tls.certresolver=letsencrypt
+      - traefik.http.services.${EE_HOST:-ee}.loadbalancer.server.port=${EE_PORT:-8551}
   set-prune-marker:
     profiles: ["tools"]
     image: alpine:3

grafana-cloud.yml

@@ -31,6 +31,12 @@ services:
     entrypoint: choose-config.sh
     command: ["/bin/prometheus", "--storage.tsdb.path=/prometheus", "--web.console.libraries=/usr/share/prometheus/console_libraries", "--web.console.templates=/usr/share/prometheus/consoles"]
     <<: *logging
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.prom.entrypoints=web,websecure
+      - traefik.http.routers.prom.rule=Host(`${PROM_HOST}.${DOMAIN}`)
+      - traefik.http.routers.prom.tls.certresolver=letsencrypt
+      - traefik.http.services.prom.loadbalancer.server.port=9090
 
   ethereum-metrics-exporter:
     restart: "unless-stopped"

grafana-shared.yml

@@ -2,7 +2,4 @@ version: "3.9"
 services:
   grafana:
     ports:
-      - ${HOST_IP:-}${GRAFANA_PORT}:${GRAFANA_PORT}/tcp
-#  prometheus:
-#    ports:
-#      - 9090:9090/tcp
+      - ${SHARE_IP:-}${GRAFANA_PORT}:${GRAFANA_PORT}/tcp

grafana.yml

@@ -21,6 +21,12 @@ services:
     entrypoint: choose-config.sh
     command: ["/bin/prometheus", "--storage.tsdb.path=/prometheus", "--web.console.libraries=/usr/share/prometheus/console_libraries", "--web.console.templates=/usr/share/prometheus/consoles"]
     <<: *logging
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.prom.entrypoints=web,websecure
+      - traefik.http.routers.prom.rule=Host(`${PROM_HOST}.${DOMAIN}`)
+      - traefik.http.routers.prom.tls.certresolver=letsencrypt
+      - traefik.http.services.prom.loadbalancer.server.port=9090
 
   ethereum-metrics-exporter:
     restart: "unless-stopped"

lighthouse-vc-only.yml

@@ -63,6 +63,13 @@ services:
       - --unencrypted-http-transport
       - --suggested-fee-recipient
       - ${FEE_RECIPIENT}
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.$(VC_HOST:-vc}.service=${VC_HOST:-vc}
+      - traefik.http.routers.${VC_HOST:-vc}.entrypoints=websecure
+      - traefik.http.routers.${VC_HOST:-vc}.rule=Host(`${VC_HOST:-vc}.${DOMAIN}`)
+      - traefik.http.routers.${VC_HOST:-vc}.tls.certresolver=letsencrypt
+      - traefik.http.services.${VC_HOST:-vc}.loadbalancer.server.port=${KEY_API_PORT:-7500}
 
   validator-exit:
     profiles: ["tools"]