Node Flags

node-deploy sets these for you in each role's Compose file. This page is for reading what is already there, or diverging from it deliberately.

---

Common flags

Flag	Description	Default
--chain	Chain specification	dev
--base-path	Data directory	platform-specific
--name	Node name, shown in telemetry	random
--port	P2P port	30333
--rpc-port	RPC port — serves both HTTP and WebSocket	9944
--validator	Author blocks	false
--state-pruning	How much state to keep (archive, or a block count)	256
--blocks-pruning	How many block bodies to keep	256
--prometheus-port	Metrics port	9615

There is no --ws-port

Substrate unified HTTP and WebSocket onto one port. --pruning still parses, but only as an alias for --state-pruning — it does not control block-body pruning, so use the canonical pair.

---

What each role sets

Flag	Public RPC	Indexer archive	Validator
--validator	—	—	✅
--rpc-external	✅ always	—	optional, empty by default
--rpc-cors all	✅	—	—
--rpc-max-connections	5000	200	default
--state-pruning archive	✅	✅	— (default pruning)
--blocks-pruning archive	✅	✅	—
--prometheus-external	✅	✅	✅
--in-peers / --out-peers	64 / 16	default	default
--db-cache / --trie-cache-size	—	✅ tuned	—
--no-mdns	✅	✅	✅

Bootnodes come from the chain spec, so no role passes --bootnodes.

---

--rpc-methods does nothing

The binary overrides it

Orbinum forces --rpc-methods Unsafe at startup, so that remote relayers can reach the ISMP query methods — which are not in Substrate's Safe set. Passing Safe has no effect, on any role.

What actually protects an endpoint:

• Where it binds. The validator and indexer keep the RPC on loopback, so the unsafe namespace is unreachable from outside the host.
• What sits in front of it. The public RPC is reachable only through Caddy, which allowlists methods and rate-limits per client IP.

This is why RPC_BIND=127.0.0.1 on the validator is not a nicety. It is the control — and the reason its .env.example says leave this at 127.0.0.1, never 0.0.0.0.

---

Peering

Variable	Effect
PUBLIC_ADDR	Advertise a specific address to peers
RESERVED_NODES	Activates --reserved-only when non-empty

RESERVED_NODES is not additive

Setting it makes the node refuse every peer not on the list — the bootnodes included. A public node with a non-empty value silently ends up with zero peers. Leave it empty unless you are running a private network.

---

Logging

# raise verbosity
docker run --rm -e RUST_LOG=debug $ORB --dev --tmp

# one module only
docker run --rm -e RUST_LOG=pallet_shielded_pool=trace $ORB --dev --tmp

---

Chain spec

All three testnet roles mount the same file read-only and point --chain at it:

../chainspec/testnet-spec.json  →  /chain-specs/testnet-spec.json

The spec is generated in the node repo and copied into node-deploy, which only consumes it. It carries the bootnodes, and an empty telemetryEndpoints so that opting out of telemetry does not silently redirect elsewhere.