TriportRPCDashboard

Base operations

This page is an operator plan for a future approved release. It is not evidence that Base is mounted, deployed, provider-tested, or available. See the Base API reference and the incident runbook.

Endpoint and plans: Base RPC endpoint.

Release invariants

  • Base mainnet is chain ID 8453 (0x2105). There is no Base Sepolia, Ethereum, or legacy-route fallback.
  • Native Base is the only owner of /rpc/base. The legacy Base route stays disabled, and base must not occur in the legacy routing list.
  • The checked-in/default state is BASE_NATIVE=false. Do not enable it before the hashed release dossier and card 33 approval.
  • upstream_base.yml contains only accepted public candidates and secret:// references. Never place a provider key in a URL, unit, YAML, command line, report, or example env.
  • Origin and edge have different duties. Caddy sends only non-upgrade GET/HEAD /rpc/base to the Next SEO page. POST and every WebSocket Upgrade stay on the portal. At the origin, exact /rpc/base always reaches the native router; a non-POST request returns 405 with Allow: POST before SPA fallback.

Configuration inventory

The source artifacts are internal and not published: the Base upstream inventory (upstream_base.yml), the systemd environment example (proxy-agg.env.example), the installable unit (proxy-agg.service), and the edge Caddy split snippet. Operators with deployment access hold the authoritative copies.

The safe baseline is:

BASE_NATIVE=false
BASE_MESH_CONFIG=configs/upstream_base.yml
BASE_CATALOG=../docs/api/json-rpc/base.openrpc.json
BASE_BLINK_SECRET_REF=

BASE_BLINK_SECRET_REF is a reference, never the key. A native release candidate must have an approved resolvable reference and the shared PostgreSQL provider-budget store. Paid fallback slots remain URL-free, disabled, and key_required until separately approved.

The unit sets MemoryHigh=4G, MemoryMax=5G, and MemorySwapMax=0 around the whole proxy. Together with the bounded two-worker decode pool and GOMEMLIMIT=3GiB, this is the accepted F09-01 baseline—not per-decoder process isolation or measured capacity. Card 32 may require re-sizing.

Planned deployment

  1. Start only from the immutable hashes approved by card 33. Build both bin/proxy and bin/preflight; stage files by copy. Do not rename files that may be Docker bind-mounted.
  2. Fill the target's protected EnvironmentFile with secret references and operator-supplied secret material outside source control. Keep native false.
  3. Run the installer in check-only mode and run bin/preflight -mode=production -root=<install-root> before changing supervision.
  4. Validate the Caddy configuration before reload. WebSocket upgrades must not match the Next handler.
  5. Follow the release dossier's canary order (EU first, then US). Do not use parallel blind restarts or remote calls without bounded timeouts.
  6. Set BASE_NATIVE=true only on the approved canary after every preflight input is present. Keep the legacy Base route disabled and the non-Base legacy routing list unchanged.
  7. Complete the read-only post-deploy checks below before advancing. This page does not authorize signed transactions, provider load, firewall changes, SSH, deployment, or control-plane mutation.

No new public monitoring port is needed; metrics stay on loopback and are reached only through an approved tunnel.

Read-only post-deploy checks

  • Confirm systemctl is-active proxy-agg, the candidate binary/config hashes, and GOMEMLIMIT/cgroup values from systemd.
  • Confirm /healthz and readiness, then one authenticated read-only eth_chainId request returns 0x2105. Never use a write method as a smoke.
  • Confirm edge GET/HEAD /rpc/base is the SEO page, edge POST reaches JSON-RPC, origin GET /rpc/base is 405 with Allow: POST, and upgrades for /ws/base, /ws/base-feed, and /ws/base-auction do not reach Next.
  • Confirm absent/revoked/wrong-scope keys fail before any upstream dial.
  • Confirm the Base sentinel definitions are loaded, the triport-base dashboard has data for the canary PoP, and all eight alert names listed in the runbook exist in the loaded rule inventory.
  • Treat auction key_required, decoder-validation blockers, and unavailable capabilities as explicit states, not successful availability.

Rollback

Run the staged rollback in dry-run mode first. It stages BASE_NATIVE=false, keeps the legacy Base route disabled, removes any Base legacy-route selection, validates the previous-eight network inventory and TLS, and changes nothing. Only an authorized operator may then use --apply; the script copies bytes over the EnvironmentFile, runs preflight before restart, and leaves all non-Base flags unchanged. Re-run the same edge/origin and eight-network regression checks.