Operations and security
Public exposure, rate limits, backups, observability, and scaling boundaries.
Bind and proxy
The reference service binds to 127.0.0.1 by default. Keep it private and place an HTTPS reverse proxy or tunnel in front. Configure an explicit CORS_ALLOWED_ORIGINS list. Leave TRUST_PROXY_HEADERS=0 unless the only direct caller is a proxy you control.
Built-in limits
- per-IP in-memory HTTP rate buckets;
- maximum WebSocket and SSE clients;
- maximum WebSocket payload size;
- GET/OPTIONS-only HTTP methods;
- HTTP and WebSocket origin checks;
- bounded logo size and SVG content checks; and
- RPC request throttling through
RPC_MAX_REQUESTS_PER_SECOND.
These controls protect one Node process. A public or multi-process installation needs equivalent edge limits, connection caps, request-size limits, process supervision, and monitoring.
Health
Monitor /api/health per profile. Verify expected chain/start block, indexed vs latest block, meta.stale, WebSocket configured/live state, fallback state, storage writability, and public RPC counters.
A healthy API may still have a transient provider error in historical diagnostics. Readiness should be based on current status, freshness, storage, and source state rather than one old error string.
Backup and recovery
Keep tested copies of each network state file. To rebuild, stop the profile, move the old file aside, restart from the manifest start block, and compare launch/locker/event counts before switching clients.
Scaling boundary
The reference implementation is intentionally single-process and JSON-backed. It has no multi-writer coordination, horizontal replication, or distributed durability. For sustained public traffic or high retention, preserve the documented API contract while replacing storage and edge limiting with infrastructure sized for the workload.
Authentication
Do not embed a permanent secret in browser JavaScript; bundled credentials are public. For private access, authenticate at a server-side gateway and issue client-appropriate credentials. The D17 API itself has no user account or token system.