Security Model
SQLite is mounted read-only into each node container. Credentials are validated against the existing users table without touching nerot.sid or the main Nerot platform session.
API & Architecture
HTTPS API is proxied by nginx to the blockchain nodes on 127.0.0.1. If /api/v1/health returns 502, the Docker stack is not running — start it with docker-compose up -d in the blockchain project directory (systemd: nerot-blockchain.service).
Base URL: https://blockchain.nerot.me/api/v1/
- Health: GET /api/v1/health
- OpenAPI JSON: GET /api/v1/docs
- Auth: POST /api/v1/auth/login · POST /api/v1/auth/logout · GET /api/v1/auth/me
- Chain: GET /api/v1/chain/info
- Sessions: cookie blockchain.sid (Secure, HttpOnly, SameSite=Strict)
Cluster Ports (internal)
These bind on 127.0.0.1 for nginx upstreams — not exposed publicly as separate URLs.
| Node 1 | REST 7001 · WS 7011 · P2P 30301 |
|---|---|
| Node 2 | REST 7002 · WS 7012 · P2P 30302 |
| Node 3 | REST 7003 · WS 7013 · P2P 30303 |