Making Bitcoin RPC Public: Risks and Options

Hey everyone, Just got a pretty powerful server running Bitcoind with txindex=1. Thought it could be useful for others to access it. I've set rpcbindaddress=0.0.0.0 to make it public, currently whitelisting a couple of IPs, but wondering if I should just open it up for everyone? Seems kinda risky based on what I’ve read... I’m sharing my config here to get some advice. I can tweak anything since it's my server.

Yeah, opening up a public RPC server is risky. You could get hit with DoS attacks since people can spam long-running requests like getblock or even flood you with huge data. It’s not just your CPU that takes a hit, also memory and bandwidth. Best practice? Use a reverse proxy like nginx and set a rate limit on the calls.

Oh nice, nginx as a reverse proxy? So I just need to set it up for the 8332 port, right?

Anyone know where I can find a good nginx config example for Bitcoin RPC? I want to lock down wallet access, but allow basic RPC calls over HTTPS. I’ve got a port with a TLS certificate but still trying to figure out how to activate it.

You can definitely create a site config to forward requests from a subdomain to your node. It’ll look something like this: Then use certbot to get that HTTPS certificate.

Thanks! Just to clarify, if I set rpcbind=0.0.0.0:8332 127.0.0.1:8332, that means the original address won’t be accessible, right? But will it still be okay since 0.0.0.0 includes 127.0.0.1? I know it’s more of a general network thing, not just bitcoin.

When you set up a reverse proxy, your original address is still accessible. You’d need it to be functional. 0.0.0.0 just means it listens on all network interfaces Ethernet, wifi, localhost, etc. Even if you’re using Docker, it still binds to that address on port 8332.

But like, if someone makes your RPC public and they decide to shut it down with one command, that’s game over. If you want it public, you gotta limit the calls you allow. And why not just set up SSH access instead of making it public? Seems safer.

For sure! Yeah, I can create user accounts for access, but it adds risk. Got this sweet server that can handle bitcoin with coinstats, txindex, and more. Figured it’d be cool to share it as a community resource. A solid RPC endpoint for experimentation. But yeah, gotta be careful and meet requirements.