@@ -1,75 +1,75 @@
-# ─────────────────────────────────────────────────────────────────────────────
-# Orbinum Mainnet — public RPC node
-#
-# Copy to `.env` on the RPC VPS and fill in the values below:
-#   cp .env.example .env
+# ═══ Orbinum Mainnet — public RPC ════════════════════════════════════════════
+# cp .env.example .env
 #
 # TLS: Caddy terminates HTTPS/WSS with a Cloudflare Origin Certificate. Drop
-# origin.pem / origin.key next to this file before starting. The DNS record
-# must be Proxied (orange cloud) in Cloudflare.
-# ─────────────────────────────────────────────────────────────────────────────
+# origin.pem / origin.key next to this file before starting, and set the DNS
+# record to Proxied (orange cloud).
+# ═════════════════════════════════════════════════════════════════════════════
+
+# ─── Identity ────────────────────────────────────────────────────────────────
 
-# Container image (override to pin a specific tag)
 ORBINUM_IMAGE=ghcr.io/orbinum/node:mainnet-latest
 
-# Friendly name shown in telemetry. Use rpc-1 / rpc-2 / ... per node.
+# Shown in telemetry. Use rpc-1 / rpc-2 / ... per node.
 RPC_NAME=Orbinum-RPC-1
 
-# Report to Orbinum's telemetry — https://telemetry.orbinum.network
+# libp2p node-key, hex 64 chars — unique per node.
+#   openssl rand -hex 32
+RPC_NODE_KEY=
+
+# Public domain. Caddy proxies HTTPS/WSS to localhost on RPC_PORT.
+RPC_DOMAIN=rpc-1.orbinum.io
+
+# ─── Telemetry ───────────────────────────────────────────────────────────────
+
+# https://telemetry.orbinum.network — on by default. Publishes name, version,
+# height, peer count, approximate location. Empty to opt out.
 #
-# On by default. Reporting publishes this node's name, version, block height,
-# peer count and approximate location; set this to empty to opt out.
+# Level 0 is the standard detail; higher levels add per-block chatter. RPCs stay
+# at 0 — they have no validator address to report.
 #
-# The trailing slash and the verbosity level are both required, and the whole
-# value must stay quoted — the node parses "<url> <level>" as one argument.
-# Level 0 is the standard detail level; higher levels add per-block chatter.
+# Keep it quoted and keep the trailing slash — the node parses "<url> <level>"
+# as one argument.
 TELEMETRY_URL=--telemetry-url "wss://telemetry.orbinum.io/submit/ 0"
 
-# This RPC's libp2p node-key (hex, 64 chars). Generate with:
-#   openssl rand -hex 32
-RPC_NODE_KEY=
+# ─── Peering ─────────────────────────────────────────────────────────────────
 
-# Peers this node is allowed to talk to. Empty by default: a public RPC should
-# discover peers freely.
+# Empty by default: a public RPC should discover peers freely.
 #
 # Pin it during a recovery. The chainspec's bootNodes are the RPCs themselves,
 # so a freshly purged RPC discovers whatever is on the network — including a
-# third-party node still serving a dead fork, which it will happily sync from
-# because that chain is longer. Restricting it to your own validators for the
-# duration of the resync is what stops that; clear it again afterwards.
-#
-#   RESERVED_NODES=--reserved-only --reserved-nodes /ip4/<validator-ip>/tcp/30333/p2p/<peer-id> --reserved-nodes /ip4/<validator-ip>/tcp/30333/p2p/<peer-id>
+# third-party node still serving a dead fork, which it will sync from because
+# that chain is longer. Restricting it to your own validators for the duration
+# of the resync is what stops that; clear it again afterwards.
+#   RESERVED_NODES=--reserved-only --reserved-nodes /ip4/<validator-ip>/tcp/30333/p2p/<peer-id>
 RESERVED_NODES=
 
-# Public domain for this RPC. Caddy proxies HTTPS/WSS to localhost on RPC_PORT.
-# Use rpc-1 / rpc-2 / ... per node.
-RPC_DOMAIN=rpc-1.orbinum.io
+# ─── Resources ───────────────────────────────────────────────────────────────
+# Caps for the node container, so a query flood can't starve the host (Caddy,
+# SSH, the OS). Always leave RAM and CPU for the host — never give the container
+# the full core count. Scale to your server.
 
-# Resource caps for the node container, so a query flood can't starve the host.
-# Always leave some RAM and CPU for the host — never give the container the full
-# core count. Scale to match your server.
 RPC_MEM_LIMIT=6g
 RPC_CPUS=1.5
 
-# ─── HOST ports ──────────────────────────────────────────────────────────────
-# This node runs with `network_mode: host`, so these flags bind DIRECTLY on the
-# host — there is no container port mapping in between. Changing a value here
-# moves the real listening socket.
+# ─── Ports ───────────────────────────────────────────────────────────────────
+# This stack runs `network_mode: host`, so these bind DIRECTLY on the host —
+# there is no container port mapping in between. Changing one moves the real
+# listening socket.
 
-# P2P port. If you change it, open it in the firewall: it must stay publicly
-# reachable or this node gets no peers.
-#   P2P_PORT=34105
+# Open it in the firewall: must stay publicly reachable or this node gets no
+# peers.
 P2P_PORT=30333
 
-# RPC port the node listens on, and the port Caddy proxies to over loopback.
-# Both sides read this one variable, so they can never drift apart.
+# The port the node listens on AND the port Caddy proxies to over loopback —
+# both read this one variable, so they cannot drift apart.
 #
-# This is an internal port: public traffic arrives on 443 at RPC_DOMAIN and
-# Caddy forwards it here. Changing it does NOT change the public endpoint.
-# Keep it firewalled (`ufw deny <port>`) — clients must go through Caddy, which
-# is what applies the rate limits.
+# Internal only: public traffic arrives on 443 at RPC_DOMAIN and Caddy forwards
+# it here, so changing this does NOT change the public endpoint. Keep it
+# firewalled (`ufw deny <port>`) — clients must go through Caddy, which is what
+# applies the rate limits.
 RPC_PORT=9944
 
-# Prometheus metrics port. With host networking this binds on the public NIC,
-# so keep it firewalled to the monitoring VPS only.
+# With host networking this binds on the public NIC — firewall it to the
+# monitoring VPS only.
 METRICS_PORT=9615
@@ -1,63 +1,79 @@
-# ─────────────────────────────────────────────────────────────────────────────
-# Orbinum Mainnet — VALIDATOR node
-#
-# Copy to `.env` on the validator VPS and fill in the values below:
-#   cp .env.example .env
-# ─────────────────────────────────────────────────────────────────────────────
+# ═══ Orbinum Mainnet — VALIDATOR ═════════════════════════════════════════════
+# cp .env.example .env
+# ═════════════════════════════════════════════════════════════════════════════
+
+# ─── Identity ────────────────────────────────────────────────────────────────
 
-# Container image (override to pin a specific tag)
 ORBINUM_IMAGE=ghcr.io/orbinum/node:mainnet-latest
 
-# Friendly name shown in telemetry. Pick something identifiable.
+# Shown in telemetry. Pick something identifiable.
 VALIDATOR_NAME=Choose-Your-Validator-Name
 
-# Report to Orbinum's telemetry — https://telemetry.orbinum.network
-#
-# On by default. Reporting publishes this node's name, version, block height,
-# peer count and approximate location; set this to empty to opt out.
+# libp2p node-key, hex 64 chars — unique per node.
+#   openssl rand -hex 32
+VALIDATOR_NODE_KEY=
+
+# ─── Telemetry ───────────────────────────────────────────────────────────────
+
+# https://telemetry.orbinum.network — on by default. Publishes name, version,
+# height, peer count, approximate location. Empty to opt out.
 #
-# The trailing slash and the verbosity level are both required, and the whole
-# value must stay quoted — the node parses "<url> <level>" as one argument.
+# Validators use level 1, not 0: level 1 adds `afg.authority_set`, the only
+# message carrying the validator address the dashboard shows in Address.
 #
-# Validators report at level 1, where the node also sends `afg.authority_set`
-# — the only message carrying its validator address, which the dashboard shows
-# in the Address column. Level 0 omits it, so the column stays empty. The cost
-# is per-block chatter the dashboard discards. RPC nodes stay at 0: they have
-# no address to report.
+# Keep it quoted and keep the trailing slash — the node parses "<url> <level>"
+# as one argument.
 TELEMETRY_URL=--telemetry-url "wss://telemetry.orbinum.io/submit/ 1"
 
-# This validator's libp2p node-key (hex, 64 chars). Generate with:
-#   openssl rand -hex 32
-VALIDATOR_NODE_KEY=
+# ─── Peering ─────────────────────────────────────────────────────────────────
 
-# P2P bind address. The node binds 0.0.0.0 on P2P_PORT (below), auto-detects its
-# public address, and discovers the network through the bootNodes baked into
-# chainspec/mainnet-spec.json. Make sure that TCP port is open and publicly
-# reachable. Leave at 0.0.0.0 unless you bind to a specific interface.
+# Interface to bind. Leave 0.0.0.0 unless pinning to one interface.
 P2P_BIND=0.0.0.0
 
+# Address peers should dial. Only needed when the node cannot auto-detect a
+# reachable one — e.g. a validator on a private VPC advertising its VPC IP.
+#   PUBLIC_ADDR=--public-addr /ip4/10.0.0.20/tcp/30333
+PUBLIC_ADDR=
+
+# Restricts who this node talks to. Empty = discover via chainspec bootNodes.
+#
+# Two uses: validators on a private network pin each other with --reserved-only
+# so they never gossip publicly; and during recovery it stops a purged node from
+# resyncing off a stranger serving a longer-but-dead fork.
+#
+# List every OTHER node this one should reach, not itself.
+#   RESERVED_NODES=--reserved-only --reserved-nodes /ip4/10.0.0.21/tcp/30333/p2p/<peer-id>
+RESERVED_NODES=
+
 # ─── Ports ───────────────────────────────────────────────────────────────────
-# P2P uses ONE value on both sides of the mapping. RPC only moves the HOST side
-# (the container keeps 9944), for validators that already use that port.
-
-# P2P port. Used on BOTH sides of the port mapping and in --listen-addr, so the
-# node listens on it, advertises it, and the host publishes it — one value, no
-# way to drift. If you change it, open it in the firewall: it must stay publicly
-# reachable or this node gets no inbound peers.
-#   P2P_PORT=34105
+# P2P and metrics use ONE value on both sides of their mapping, so the port the
+# node uses and the one the host publishes cannot drift. RPC moves only the host
+# side (the container keeps 9944).
+
+# Open it in the firewall: must stay publicly reachable or no inbound peers.
 P2P_PORT=30333
 
-# RPC port on the host. A local `curl` (author_rotateKeys) targets this one:
-#   RPC_PORT=26722   →   curl http://localhost:26722/
+# A local `curl` (author_rotateKeys) targets this one:
+#   RPC_PORT=26722  →  curl http://localhost:26722/
 RPC_PORT=9944
 
-# WARNING: this node runs `--rpc-methods Unsafe`: author_rotateKeys and
-# author_insertKey take no authentication. Leave RPC_BIND at 127.0.0.1 —
-# NEVER 0.0.0.0 or a public IP.
+# WARNING: this node runs `--rpc-methods Unsafe`. author_rotateKeys and
+# author_insertKey take NO authentication — anyone who reaches the port can read
+# or overwrite your session keys.
+# Leave this at 127.0.0.1. NEVER 0.0.0.0 or a public IP.
 RPC_BIND=127.0.0.1
 
-# Empty = RPC on loopback INSIDE the container only. Set it to --rpc-external
-# only if you need to reach it from the host; RPC_BIND is then the only thing
-# keeping it off the internet.
+# Empty = RPC on loopback INSIDE the container, which is the right default.
+# --rpc-external makes it listen on 0.0.0.0 there, leaving RPC_BIND as the only
+# thing keeping it off the internet.
 #   RPC_EXTERNAL=--rpc-external
 RPC_EXTERNAL=
+
+METRICS_PORT=9615
+
+# Interface metrics are published on, for the monitoring VPS to scrape. The node
+# binds 0.0.0.0 inside the container, so this is what keeps the port off the
+# public NIC. Set it to THIS validator's private IP:
+#   METRICS_BIND=10.0.0.20
+# The 127.0.0.1 default fails closed: forget it and nothing is exposed.
+METRICS_BIND=127.0.0.1