From 9791e2e6fd6c09254a0c20e4b12e46928c73fd95 Mon Sep 17 00:00:00 2001 From: nahuhh <50635951+nahuhh@users.noreply.github.com> Date: Thu, 17 Oct 2024 00:10:51 +0000 Subject: [PATCH] interacting: monerod reference fixes --- docs/en/interacting/monerod-reference.md | 31 ++++++++++++------------ 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/docs/en/interacting/monerod-reference.md b/docs/en/interacting/monerod-reference.md index 69f1f18..04193ab 100644 --- a/docs/en/interacting/monerod-reference.md +++ b/docs/en/interacting/monerod-reference.md @@ -97,8 +97,6 @@ The following options will be helpful if you intend to have an always running no | `--pidfile` | Full path to the PID file. Works only with `--detach`. Example:
`./monerod --detach --pidfile=/run/monero/monerod.pid` | `--detach` | Go to background (decouple from the terminal). This is useful for long-running / server scenarios. Typically, you will also want to manage `monerod` daemon with systemd or similar. By default `monerod` runs in a foreground. | `--non-interactive` | Do not require tty in a foreground mode. Helpful when running in a container. By default `monerod` runs in a foreground and opens stdin for reading. This breaks containerization because no tty gets assigned and `monerod` process crashes. You can make it run in a background with `--detach` but this is inconvenient in a containerized environment because the canonical usage is that the container waits on the main process to exist (forking makes things more complicated). -| `--no-zmq` | Disable ZMQ RPC server. You **should** use this option to limit attack surface and number of unnecessarily open ports (the ZMQ server is unfinished thing and you are unlikely to ever use it). -| `--no-igd` | Disable UPnP port mapping on the router ("Internet Gateway Device"). Add this option to improve security if you are **not** behind a NAT (you can bind directly to public IP or you run through Tor). | `--max-txpool-weight` | Set maximum transactions pool size in bytes. By default 648000000 (~618MB). These are transactions pending for confirmations (not included in any block). | `--enforce-dns-checkpointing` | The emergency checkpoints set by [MoneroPulse](../infrastructure/monero-pulse.md) operators will be enforced. It is probably a good idea to set enforcing for unattended nodes.

If encountered block hash does not match corresponding checkpoint, the local blockchain will be rolled back a few blocks, effectively blocking following what MoneroPulse operators consider invalid fork. The log entry will be produced: `ERROR` `Local blockchain failed to pass a checkpoint, rolling back!` Eventually, the alternative ("fixed") fork will get heavier and the node will follow it, leaving the "invalid" fork behind.

By default checkpointing only notifies about discrepancy by producing the following log entry: `ERROR` `WARNING: local blockchain failed to pass a MoneroPulse checkpoint, and you could be on a fork. You should either sync up from scratch, OR download a fresh blockchain bootstrap, OR enable checkpoint enforcing with the --enforce-dns-checkpointing command-line option`.

Reference: [source code](https://github.com/monero-project/monero/blob/22a6591a70151840381e327f1b41dc27cbdb2ee6/src/cryptonote_core/blockchain.cpp#L3614). | `--disable-dns-checkpoints` | The [MoneroPulse](../infrastructure/monero-pulse.md) checkpoints set by core developers will be discarded. The checkpoints are apparently still fetched though. @@ -119,12 +117,15 @@ The node and peer words are used interchangeably. | `--p2p-bind-ipv6-address` | IPv6 network interface to bind to for p2p network protocol. Default value `::` binds to all network interfaces. | `--p2p-bind-port-ipv6` | TCP port to listen for p2p network connections. By default same as IPv4 port for given nettype. | `--p2p-ignore-ipv4` | Ignore unsuccessful IPv4 bind for p2p. Useful if you only want to use IPv6. -| `--igd` | Set UPnP port mapping on the router ("Internet Gateway Device"). One of: `disabled` \| `enabled` \| `delayed` (=`delayed` by default). Relevant if you are behind NAT and want to accept incoming P2P network connections. The `delayed` value means it will wait for incoming connections in hope UPnP may not be necessary. After a while w/o incoming connections found it will attempt to map ports with UPnP. If you know you need UPnP change it to `enabled` to fast track the process. +| `--no-igd` | Disable UPnP port mapping on the router ("Internet Gateway Device"). Add this option to improve security if you are **not** behind a NAT (you can bind directly to public IP or you run through Tor). +| `--igd` | Set UPnP port mapping on the router ("Internet Gateway Device"). One of: `disabled` \| `enabled` \| `delayed` (=`delayed` by default). Relevant if you are behind NAT and want to accept incoming P2P network connections. The `delayed` value means it will wait for incoming connections in hope UPnP may not be necessary. After a while w/o incoming connections found it will attempt to map ports with UPnP. If you know you need UPnP change it to `e;nabled` to fast track the process. | `--hide-my-port` | `monerod` will still open and listen on the p2p port. However, it will not announce itself as a peer list candidate. Technically, it will return port `0` in a response to p2p handshake (`node_data.my_port = 0` in `get_local_node_data` function). In effect nodes you connect to won't spread your IP to other nodes. To sum up, it is not really hiding, it is more like "do not advertise". | `--seed-node` | Connect to a node to retrieve other nodes' addresses, and disconnect. If not specified, `monerod` will use hardcoded seed nodes on the first run, and peers cached on disk on subsequent runs. | `--add-peer` | Manually add node to local peer list, `host:port`. Syntax supports IP addresses, domain names, onion and i2p hosts. | `--add-priority-node` | Specify list of nodes to connect to and then attempt to keep the connection open.

To add multiple nodes use the option several times. Example:
`./monerod --add-priority-node=178.128.192.138:18081 --add-priority-node=144.76.202.167:18081` | `--add-exclusive-node` | Specify list of nodes to connect to only. If this option is given the options `--add-priority-node` and `--seed-node` are ignored.

To add multiple nodes use the option several times. Example:
`./monerod --add-exclusive-node=178.128.192.138:18081 --add-exclusive-node=144.76.202.167:18081` +| `--ban-list` | Specify ban list file, one IP address per line. This was introduced as an emergency measure to deal with large DDoS attacks on Monero p2p network in Dec 2020 / Jan 2021. Example:
`./monerod --ban-list=block.txt`. Here is the popular [block.txt](https://gui.xmr.pm/files/block.txt) file.

It is **not recommended** to statically ban any IP addresses unless you absolutely need to. Banning IPs often excludes the most vulnerable users who are forced to operate entirely behind Tor or other anonymity networks. +| `--enable-dns-blocklist` | Similar to `--ban-list` but instead of a static file uses dynamic IP blocklist available as DNS TXT entries. The DNS blocklist is centrally managed by Monero contributors. | `--out-peers` | Set max number of outgoing connections to other nodes. By default 12. Value `-1` represents the code default. | `--in-peers` | Set max number of incoming connections (nodes actively connecting to you). By default unlimited. Value `-1` represents the code default. | `--limit-rate-up` | Set outgoing data transfer limit [kB/s]. By default 2048 kB/s. Value `-1` represents the code default. @@ -140,8 +141,8 @@ This is experimental. It may be best to start with this [guide](https://github.c | Option | Description |------------------------|-------------------------------------------------------------------------------------------------------------------------------------- -| `--tx-proxy` | Send out your local transactions through SOCKS5 proxy (Tor or I2P). Format:
`,[,max_connections][,disable_noise]`

Example:
`./monerod --tx-proxy "tx-proxy=tor,127.0.0.1:9050,16"`

This was introduced to make publishing transactions over Tor easier (no need for torsocks) while allowing clearnet for blocks at the same time (while torsocks affected everything).

Adding `,disable_noise`: If the user disables "noise" (i.e. `--tx-proxy=tor,127.0.0.1:9050,disable_noise`), then the tx is "fluffed" to outbound Onion and I2P peers, and the receiving hidden service will immediately fluff the transaction to ipv4/6 peers. This will speed up tx broadcast. [more info](https://github.com/monero-project/monero/pull/6354#pullrequestreview-399554356)

Note that forwarded transactions (those not originating from the connected wallet(s)) will still be relayed over clearnet.
See this [guide](https://github.com/monero-project/monero/blob/master/docs/ANONYMITY_NETWORKS.md#p2p-commands) and [commit](https://github.com/monero-project/monero/pull/6021). -| `--anonymous-inbound` | Allow anonymous incoming connections to your onionized P2P interface. Format:
`,<[bind-ip:]port>[,max_connections]`

Example:
`./monerod --anonymous-inbound "rveahdfho7wo4b2m.onion:18083,127.0.0.1:18083,100"`.

Obviously, you first need to setup the hidden service in your Tor config. See the [guide](https://github.com/monero-project/monero/blob/master/ANONYMITY_NETWORKS.md#p2p-commands). +| `--tx-proxy` | Send out your local transactions through SOCKS5 proxy (Tor or I2P). Format:
`,[,max_connections][,disable_noise]`

Example:
`./monerod --tx-proxy=tor,127.0.0.1:9050,16`

This was introduced to make publishing transactions over Tor easier (no need for torsocks) while allowing clearnet for blocks at the same time (while torsocks affected everything).

Adding `,disable_noise`: If the user disables "noise" (i.e. `--tx-proxy=tor,127.0.0.1:9050,disable_noise`), then the tx is "fluffed" to outbound Onion and I2P peers, and the receiving hidden service will immediately fluff the transaction to ipv4/6 peers. This will speed up tx broadcast. [more info](https://github.com/monero-project/monero/pull/6354#pullrequestreview-399554356)

Note that forwarded transactions (those not originating from the connected wallet(s)) will still be relayed over clearnet.
See this [guide](https://github.com/monero-project/monero/blob/master/docs/ANONYMITY_NETWORKS.md#p2p-commands) and [commit](https://github.com/monero-project/monero/pull/6021). +| `--anonymous-inbound` | Allow anonymous incoming connections to your Onion or I2P hidden service's P2P interface. Format:
`,<[bind-ip:]port>[,max_connections]`

Example:
`./monerod --anonymous-inbound yourlongv3onionaddress.onion:18084,127.0.0.1:18084,100`.

Note: You'll also need to setup a hidden service in the respective Tor or I2P config. See the setup guide [here](../running-node/monerod-tori2p.md). | `--pad-transactions` | Pad relayed transactions to next 1024 bytes to help defend against traffic volume analysis. This only makes sense if you are behind Tor or I2P. See [commit](https://github.com/monero-project/monero/pull/4787). | `--proxy` | Network communication through proxy. Works with any service that supports SOCKS4, including Tor, i2p, and commercial VPN/proxy services. SOCKS5 support is anticipated in the future. Enabling this setting sends all traffic through this proxy. Can be used in conjunction with `--tx-proxy`, in which case transaction broadcasts originating from the connected wallet(s) will be sent through Tor or i2p as specified in `--tx-proxy`, and all other traffic will be sent through the SOCKS proxy. Format:
`` @@ -167,8 +168,8 @@ The following options define how the API behaves. | `--rpc-use-ipv6` | Enable IPv6 for RPC server (disabled by default). | `--rpc-ignore-ipv4` | Ignore unsuccessful IPv4 bind for RPC. Useful if you only want to use IPv6. | `--rpc-restricted-bind-ip` | IP to listen on with the limited version of API. The limited API can be made public to create an Open Node. By default `127.0.0.1`, set it to `0.0.0.0` to listen on all interfaces. -| `--rpc-restricted-bind-ipv6-address` | IPv6 to listen on with the limited version of API. The limited API can be made public to create an Open Node. By default `::1` (localhost). Set it to `::` to listen on all interfaces. | `--rpc-restricted-bind-port` | TCP port to listen on with the limited version of API. To be used in combination with `--rpc-restricted-bind-ip`. +| `--rpc-restricted-bind-ipv6-address` | IPv6 to listen on with the limited version of API. The limited API can be made public to create an Open Node. By default `::1` (localhost). Set it to `::` to listen on all interfaces. | `--confirm-external-bind` | Confirm you consciously set `--rpc-bind-ip` to non-localhost IP and you understand the consequences. | `--restricted-rpc` | Restrict API to view only commands and do not return privacy sensitive data. Note this does not make sense with `--rpc-restricted-bind-port` because you would end up with two restricted APIs. | `--rpc-ssl` | Enable TLS on RPC connections. One of: `enabled` \| `disabled` \| `autodetect` (`=autodetect` by default). You **should** enable this if you connect a remote wallet. @@ -181,10 +182,14 @@ The following options define how the API behaves. | `--rpc-login` | Specify `username[:password]` required to connect to API. | `--rpc-access-control-origins` | Specify a comma separated list of origins to allow cross origin resource sharing. This is useful if you want to use `monerod` API directly from a web browser via JavaScript (say in a pure-fronted web appp scenario). With this option `monerod` will put proper HTTP CORS headers to its responses. You will also need to set `--rpc-login` if you use this option. Normally though, the API is used by backend app and this option isn't necessary. | `--disable-rpc-ban` | Do not ban hosts on RPC errors. May help to prevent monerod from banning traffic originating from the Tor daemon. -| `rpc-payment-address` | Restrict RPC to clients sending micropayment to this address. -| `rpc-payment-difficulty` | Restrict RPC to clients sending micropayment at this difficulty in thousands. -| `rpc-payment-credits` | Restrict RPC to clients sending micropayment, yields that many credits per payment in hundreds. -| `rpc-payment-allow-free-loopback` | Allow free access from the loopback address (ie, the local host). +| `--rpc-payment-address` | Restrict RPC to clients sending micropayment to this address. +| `--rpc-payment-difficulty` | Restrict RPC to clients sending micropayment at this difficulty in thousands. +| `--rpc-payment-credits` | Restrict RPC to clients sending micropayment, yields that many credits per payment in hundreds. +| `--rpc-payment-allow-free-loopback` | Allow free access from the loopback address (ie, the local host). +| `--zmq-rpc-bind-ip` | IP for ZMQ RPC server to listen on. By default `127.0.0.1`. This is not yet widely used as ZMQ interface currently does not provide meaningful advantage over classic JSON-RPC interface. +| `--zmq-rpc-bind-port` | Port for ZMQ RPC server to listen on. By default `18082` for mainnet, `38082` for stagenet, and `28082` for testnet. +| `--zmq-pub` | Address for ZMQ pub - `tcp://ip:port` or `ipc://path` +| `--no-zmq` | Disable ZMQ RPC server. You **should** use this option to limit attack surface and number of unnecessarily open ports (the ZMQ server is unfinished thing and you are unlikely to ever use it). #### Accepting Monero @@ -256,15 +261,9 @@ These options should no longer be necessary. They are still present in `monerod` | Option | Description |-----------------------|-------------------------------------------------------------------------------------------------------------------------------------- -| `--ban-list` | Specify ban list file, one IP address per line. This was introduced as an emergency measure to deal with large DDoS attacks on Monero p2p network in Dec 2020 / Jan 2021. Example:
`./monerod --ban-list=block.txt`. Here is the popular [block.txt](https://gui.xmr.pm/files/block.txt) file.

It is **not recommended** to statically ban any IP addresses unless you absolutely need to. Banning IPs often excludes the most vulnerable users who are forced to operate entirely behind Tor or other anonymity networks. -| `--enable-dns-blocklist` | Similar to `--ban-list` but instead of a static file uses dynamic IP blocklist available as DNS TXT entries. The DNS blocklist is centrally managed by Monero contributors. It is **not recommended** unless in emergency situations. | `--fluffy-blocks` | Relay compact blocks. Default. Compact block is just a header and a list of transaction IDs. | `--no-fluffy-blocks` | Relay classic full blocks. Classic block contains all transactions. | `--show-time-stats` | Official docs say "Show time-stats when processing blocks/txs and disk synchronization" but it does not seem to produce any output during usual blockchain synchronization. -| `--zmq-rpc-bind-ip` | IP for ZMQ RPC server to listen on. By default `127.0.0.1`. This is not yet widely used as ZMQ interface currently does not provide meaningful advantage over classic JSON-RPC interface. -| `--zmq-rpc-bind-port` | Port for ZMQ RPC server to listen on. By default `18082` for mainnet, `38082` for stagenet, and `28082` for testnet. -| `--zmq-pub` | Address for ZMQ pub - `tcp://ip:port` or `ipc://path` -| `--db-type` | Specify database type. The default and only available: `lmdb`. ## Commands