Skip to main content

Indexer Archive Node

An archive node that keeps every historical state and serves exactly one client: the indexer writer running beside it. It publishes no port and sits behind no proxy.

Prerequisites

Docker, a GHCR token, and TCP 30333 reachable. See Installation.

Why this role exists separately​

Sharing the public RPC does not work. An indexer backfilling history issues a continuous stream of state queries. Pointing it at rpc-1 / rpc-2 put that load on the same endpoint serving wallets — which is what caused the explorer to take the public RPC down with it. This node exists so that traffic never leaves the host.

Archive is mandatory, not a preference. The writer must be able to re-read any block to backfill or re-index. A pruned node discards old state and the writer fails with State already discarded — which surfaces long after deployment, midway through a backfill.

Deploy​

cd node-deploy/testnet/indexer-rpc
cp .env.example .env       # set RPC_NODE_KEY
docker compose up -d
docker compose logs -f orbinum-indexer-rpc

The node key is your stable libp2p identity — generate it with openssl rand -hex 32. Everything else in .env has a working default.

Wait for a full sync before pointing the indexer at it. On an archive node that takes considerably longer than on a pruned one, and an indexer started early will read gaps as missing data.

Then point the writer at ws://127.0.0.1:9944.

What makes it different​

SettingValueWhy
--state-pruning archivefull historythe writer re-reads arbitrary blocks
--blocks-pruning archivefull historysame
--rpc-methods Safeno unsafe RPCit holds no keys and needs no key insertion
no --rpc-externalloopback onlythe only client is on this host
no ports: mappingnothing publishednot reachable from the internet, by construction
telemetry level 0minimalit has no validator address to report
RPC_MEM_LIMIT=4g, RPC_CPUS=1.5lighter capsit serves one client, not the public

Because nothing is published, you reach it through the container:

docker exec orbinum-indexer-rpc curl -s -H 'Content-Type: application/json' \
  -d '{"id":1,"jsonrpc":"2.0","method":"system_health"}' \
  http://localhost:9944

Wait for isSyncing: false before starting the indexer.

Firewall​

Only P2P and SSH. There is no RPC port to expose and no HTTP to terminate.

sudo ufw allow 30333/tcp   # P2P
sudo ufw allow 22/tcp      # SSH
sudo ufw enable
Do not add --rpc-external

It would publish an archive node's full state to the internet with no rate limiting in front of it. If you need a public endpoint, run a public RPC node — that role has the protection layers this one deliberately lacks.

Next Steps​