plugins/aztec/docker-compose.yml.example (1)

21-22: NET_BIND_SERVICE is unnecessary here

All exposed ports are >1024, so NET_BIND_SERVICE is not needed. Dropping it reduces config noise.

Apply this diff:

-    cap_add:                                # Add only required capabilities
-      - NET_BIND_SERVICE                    # Needed for binding to ports
+    # No cap_add needed for high ports

plugins/aztec/plugin_aztec.sh (1)

140-161: URL validation only checks the first entry in comma‑separated lists

Subsequent URLs aren’t validated. Split on commas and validate each to catch bad entries early.

Example:

validate_list() {
  IFS=',' read -ra items <<<"$1"
  for u in "${items[@]}"; do [[ "$u" =~ ^https?:// ]] || return 1; done
}

Use validate_list for ETH_RPC and BEACON_RPC.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

helpers/install_docker.sh (2)

43-48: Ensure non-root usage works when installed as root (docker group).

If the script runs as root, later non-sudo docker calls will fail for the regular user unless they’re in the docker group.

Apply this diff:

 if [ "$(id -u)" -eq 0 ]; then
   echo "🚦 Enabling and starting Docker service..."
   sudo systemctl enable --now docker
+  # Allow current login user to use docker without sudo (effective after re-login)
+  if id -nG "${SUDO_USER:-$USER}" | grep -qw docker; then
+    :
+  else
+    sudo usermod -aG docker "${SUDO_USER:-$USER}" || true
+    echo "ℹ️ Added ${SUDO_USER:-$USER} to docker group. Please log out/in for group changes to take effect."
+  fi
 else

---

29-41: Optional: surface DOCKER_HOST guidance for rootless.

Some environments won’t auto-detect the rootless socket. Consider exporting DOCKER_HOST in the user’s shell profile after setup.

Apply this diff:

     dockerd-rootless-setuptool.sh install
     # enable user service (best-effort) and allow running after logout
     sudo loginctl enable-linger "$USER" || true
-    systemctl --user enable docker || true
-    systemctl --user restart docker || true
+    systemctl --user enable docker || true
+    systemctl --user restart docker || true
+    # Hint for non-interactive/CI shells where autodetect may fail
+    SOCK="unix:///run/user/$(id -u)/docker.sock"
+    if ! grep -q 'DOCKER_HOST=' "$HOME/.profile" 2>/dev/null; then
+      echo "export DOCKER_HOST=${SOCK}" >> "$HOME/.profile"
+    fi

ethpillar.sh (2)

37-65: Add sane defaults and slightly harden .env parsing.

Avoid “http://:” when env is unset and be resilient to spaces. Also quote vars.

Apply this diff:

 initializeNetwork(){
-  # Consensus client or beacon node HTTP Endpoint
-  export API_BN_ENDPOINT="http://${CL_IP_ADDRESS}:${CL_REST_PORT}"
-
-  # Execution layer RPC API
-  export EL_RPC_ENDPOINT="http://${EL_IP_ADDRESS}:${EL_RPC_PORT}"
+  # Defaults if not provided
+  : "${CL_IP_ADDRESS:=127.0.0.1}"
+  : "${CL_REST_PORT:=5052}"
+  : "${EL_IP_ADDRESS:=127.0.0.1}"
+  : "${EL_RPC_PORT:=8545}"
+  # Consensus client or beacon node HTTP Endpoint
+  export API_BN_ENDPOINT="http://${CL_IP_ADDRESS}:${CL_REST_PORT}"
+  # Execution layer RPC API
+  export EL_RPC_ENDPOINT="http://${EL_IP_ADDRESS}:${EL_RPC_PORT}"
 
   # Handle Aztec remote RPC nodes
   if [[ -d /opt/ethpillar/aztec ]] && [[ ! -f /etc/systemd/system/consensus.service ]]; then
     # Load RPC URLs from .env
     if [[ -f /opt/ethpillar/aztec/.env ]]; then
-      consensus_beacon_rpc=$(grep ^L1_CONSENSUS_HOST_URLS /opt/ethpillar/aztec/.env | sed 's/L1_CONSENSUS_HOST_URLS=//g')
-      execution_l1_rpc=$(grep ^ETHEREUM_HOSTS /opt/ethpillar/aztec/.env | sed 's/ETHEREUM_HOSTS=//g')
+      consensus_beacon_rpc=$(sed -n 's/^L1_CONSENSUS_HOST_URLS=\(.*\)/\1/p' /opt/ethpillar/aztec/.env | tr -d '[:space:]')
+      execution_l1_rpc=$(sed -n 's/^ETHEREUM_HOSTS=\(.*\)/\1/p' /opt/ethpillar/aztec/.env | tr -d '[:space:]')
     fi
 
     # If there's a list of comma separated rpc nodes, use the first node
     consensus_beacon_rpc=${consensus_beacon_rpc%%,*}
     execution_l1_rpc=${execution_l1_rpc%%,*}
 
-    if [[ -n "$consensus_beacon_rpc" && -n "$execution_l1_rpc" ]]; then
-      export API_BN_ENDPOINT="$consensus_beacon_rpc"
-      export EL_RPC_ENDPOINT="$execution_l1_rpc"
+    if [[ -n "$consensus_beacon_rpc" && -n "$execution_l1_rpc" ]]; then
+      export API_BN_ENDPOINT="$consensus_beacon_rpc"
+      export EL_RPC_ENDPOINT="$execution_l1_rpc"
     fi
   fi
 
   # Initialize network variables
   getNetworkConfig
   getNetwork
 }

---

227-228: Compose logs flags: avoid ambiguous short-option bundling.

Use separate flags for clarity/compatibility.

Apply this diff:

-              cd  /opt/ethpillar/aztec && docker compose logs -fn 233
+              cd /opt/ethpillar/aztec && docker compose logs -f -n 233

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

plugins/aztec/docker-compose.yml.example (1)

16-17: Drop unnecessary NET_BIND_SERVICE capability

You’re only using high ports (>1024). NET_BIND_SERVICE isn’t needed and can be removed to keep the container least‑privileged.

Apply this diff:

-    cap_add:                                # Add only required capabilities
-      - NET_BIND_SERVICE                    # Needed for binding to ports
+    # No capabilities needed for ports >1024
+    # cap_add: []

plugins/aztec/menu.sh (2)

166-171: More robust rootless detection

docker info output varies; match formatted info to reduce false negatives.

Apply this diff:

-      if docker info 2>&1 | grep -q "rootless"; then
+      if docker info --format '{{json .SecurityOptions}}' 2>/dev/null | grep -qi rootless; then
           echo -e "${g}   ✅ ROOTLESS Docker mode is active${nc}"
       else
           echo -e "${r}   ⚠️ Container is running as root. Re-install Docker with non-root user.${nc}"
       fi

---

435-436: Avoid double pull + ensure atomic update

Use up with --pull=always and recreate to minimize race conditions and avoid pulling twice.

Apply this diff:

-          if docker compose pull; then echo "$TAG" | sudo tee $PLUGIN_INSTALL_PATH/current_version; fi
-          startCommand
+          if docker compose up -d --pull=always --no-deps aztec-node; then
+            echo "$TAG" | sudo tee $PLUGIN_INSTALL_PATH/current_version
+          fi

plugins/aztec/plugin_aztec.sh (2)

62-67: Adding user to docker group is unnecessary in rootless mode

Not harmful, but it’s redundant and can confuse users about which daemon they’re talking to.

Apply this diff:

 function install_docker() {
   bash -c "$SOURCE_DIR/../../helpers/install_docker.sh"
-  info "Adding current user to docker group..."
-  sudo usermod -aG docker "$USER"
+  # Rootless path does not require docker group membership
 }

---

288-293: Nit: stray parenthesis in usage text

Minor typo.

Apply this diff:

-About $APP_NAME)
+About $APP_NAME

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

ethpillar.sh (2)

49-63: Harden .env parsing and quote expansions in initializeNetwork

Current grep/sed will break on spaces, quotes, or inline comments. Use anchored keys, trim whitespace/quotes, and quote vars on export.

Apply:

-    if [[ -f /opt/ethpillar/aztec/.env ]]; then
-      consensus_beacon_rpc=$(grep ^L1_CONSENSUS_HOST_URLS /opt/ethpillar/aztec/.env | sed 's/L1_CONSENSUS_HOST_URLS=//g')
-      execution_l1_rpc=$(grep ^ETHEREUM_HOSTS /opt/ethpillar/aztec/.env | sed 's/ETHEREUM_HOSTS=//g')
-    fi
+    if [[ -f /opt/ethpillar/aztec/.env ]]; then
+      consensus_beacon_rpc=$(grep -m1 -E '^\s*L1_CONSENSUS_HOST_URLS\s*=' /opt/ethpillar/aztec/.env | sed -E 's/^\s*L1_CONSENSUS_HOST_URLS\s*=\s*"?([^"#]+).*/\1/' | tr -d " ")
+      execution_l1_rpc=$(grep -m1 -E '^\s*ETHEREUM_HOSTS\s*=' /opt/ethpillar/aztec/.env | sed -E 's/^\s*ETHEREUM_HOSTS\s*=\s*"?([^"#]+).*/\1/' | tr -d " ")
+    fi
@@
-    consensus_beacon_rpc=${consensus_beacon_rpc%%,*}
-    execution_l1_rpc=${execution_l1_rpc%%,*}
+    consensus_beacon_rpc="${consensus_beacon_rpc%%,*}"
+    execution_l1_rpc="${execution_l1_rpc%%,*}"
@@
-    if [[ -n "$consensus_beacon_rpc" && -n "$execution_l1_rpc" ]]; then
-      export API_BN_ENDPOINT="$consensus_beacon_rpc"
-      export EL_RPC_ENDPOINT="$execution_l1_rpc"
+    if [[ -n "$consensus_beacon_rpc" && -n "$execution_l1_rpc" ]]; then
+      export API_BN_ENDPOINT="$consensus_beacon_rpc"
+      export EL_RPC_ENDPOINT="$execution_l1_rpc"
     fi

---

87-87: Avoid changing the parent shell’s CWD in testAndPluginCommand

cd persists and may break subsequent relative paths. Use a subshell.

-    test -d /opt/ethpillar/"${_DIRNAME[i]}" && cd "/opt/ethpillar/${_DIRNAME[i]}" && docker compose "$1"
+    test -d /opt/ethpillar/"${_DIRNAME[i]}" && ( cd "/opt/ethpillar/${_DIRNAME[i]}" && docker compose "$1" )

plugins/aztec/docker-compose.yml.example (1)

6-17: Resource limits and hardening look good; cap_add likely unnecessary

NET_BIND_SERVICE isn’t needed for ports >1024 (8080/40400). Consider dropping to minimize surface.

-    cap_add:                                # Add only required capabilities
-      - NET_BIND_SERVICE                    # Needed for binding to ports
+    # cap_add not required for ports >1024; keep minimal privileges
+    # cap_add:
+    #   - NET_BIND_SERVICE

plugins/aztec/menu.sh (1)

41-44: Make startCommand independent of CWD

Pass compose file explicitly to avoid relying on prior cd.

-    docker compose --env-file "$PLUGIN_INSTALL_PATH"/.env up -d || error "Error starting command"
+    docker compose -f "$PLUGIN_INSTALL_PATH"/docker-compose.yml --env-file "$PLUGIN_INSTALL_PATH"/.env up -d || error "Error starting command"

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

ethpillar.sh (2)

37-69: Centralizing endpoint init is good; sanitize .env-derived URLs

initializeNetwork is a nice consolidation. Minor: when grepping Aztec .env, values may be quoted; strip any surrounding quotes to avoid literal quotes in endpoints.

Apply this diff:

-      consensus_beacon_rpc=$(grep ^L1_CONSENSUS_HOST_URLS /opt/ethpillar/aztec/.env | sed 's/L1_CONSENSUS_HOST_URLS=//g')
-      execution_l1_rpc=$(grep ^ETHEREUM_HOSTS /opt/ethpillar/aztec/.env | sed 's/ETHEREUM_HOSTS=//g')
+      consensus_beacon_rpc=$(grep ^L1_CONSENSUS_HOST_URLS /opt/ethpillar/aztec/.env | sed 's/^L1_CONSENSUS_HOST_URLS=//; s/^"//; s/"$//')
+      execution_l1_rpc=$(grep ^ETHEREUM_HOSTS /opt/ethpillar/aztec/.env | sed 's/^ETHEREUM_HOSTS=//; s/^"//; s/"$//')

---

87-88: Avoid changing the caller’s CWD; run docker compose in a subshell

cd inside this helper mutates global CWD and can break later file-relative paths.

Apply this diff:

-    test -d /opt/ethpillar/"${_DIRNAME[i]}" && cd "/opt/ethpillar/${_DIRNAME[i]}" && docker compose "$1"
+    test -d /opt/ethpillar/"${_DIRNAME[i]}" && ( cd "/opt/ethpillar/${_DIRNAME[i]}" && docker compose "$1" )

plugins/aztec/plugin_aztec.sh (1)

140-161: Validate each comma-separated RPC URL

Current check only validates the first URL. Split on commas and ensure every entry starts with http(s)://; give actionable error.

Apply this diff:

-  while true; do
+  while true; do
       ETH_RPC=$(whiptail --title "Ethereum RPC URL(s) (ETHEREUM_HOSTS)" --inputbox "🔗 Enter one or more URLs, comma-separated (e.g. https://sepolia.rpc.url,http://192.168.1.123:8545):" 9 78 --ok-button "Submit" 3>&1 1>&2 2>&3)
       if [ -z "$ETH_RPC" ]; then exit; fi #pressed cancel
       # sanitize: strip spaces
       ETH_RPC=$(echo "$ETH_RPC" | tr -d '[:space:]')
-      if [[ "$ETH_RPC" =~ ^https?:// ]]; then
+      invalid=0
+      IFS=',' read -r -a arr <<< "$ETH_RPC"
+      for u in "${arr[@]}"; do
+        [[ "$u" =~ ^https?:// ]] || invalid=1
+      done
+      if [[ $invalid -eq 0 ]]; then
           break
       else
           whiptail --title "Error" --msgbox "ETHEREUM_HOSTS must be one or more http(s):// URLs, comma-separated" 8 78
       fi
   done
-  while true; do
+  while true; do
       BEACON_RPC=$(whiptail --title "Beacon RPC URL(s) (L1_CONSENSUS_HOST_URLS)" --inputbox "🔗 Enter one or more URLs, comma-separated (e.g. https://beacon.rpc.url,http://192.168.1.123:5052):" 9 78 --ok-button "Submit" 3>&1 1>&2 2>&3)
       if [ -z "$BEACON_RPC" ]; then exit; fi #pressed cancel
       # sanitize: strip spaces
       BEACON_RPC=$(echo "$BEACON_RPC" | tr -d '[:space:]')
-      if [[ "$BEACON_RPC" =~ ^https?:// ]]; then
+      invalid=0
+      IFS=',' read -r -a arr <<< "$BEACON_RPC"
+      for u in "${arr[@]}"; do
+        [[ "$u" =~ ^https?:// ]] || invalid=1
+      done
+      if [[ $invalid -eq 0 ]]; then
         break
       else
-          whiptail --title "Error" --msgbox "L1_CONSENSUS_HOST_URLS must start with http(s)://" 8 78
+          whiptail --title "Error" --msgbox "L1_CONSENSUS_HOST_URLS must be one or more http(s):// URLs, comma-separated" 8 78
       fi
   done

plugins/aztec/menu.sh (2)

143-152: Peer ID/peer count scraping is OK; consider a slightly longer window

Using -n 100 may miss recent lines on quiet nodes. Optional: increase to 300 for resiliency.

Apply this diff:

-      peercount=$(docker logs aztec-sequencer -n 100 2>&1 | grep 'peer_manager' | tail -n1 | sed "s/.*Connected to \([0-9]*\).*/\1/")
+      peercount=$(docker logs aztec-sequencer -n 300 2>&1 | grep 'peer_manager' | tail -n1 | sed "s/.*Connected to \([0-9]*\).*/\1/")

---

177-191: Minor nit: stray tcp_check_ok toggled in UDP loop

tcp_check_ok is set true on UDP success and not used later; drop it or rename to udp_check_ok to avoid confusion.

Apply this diff:

-      tcp_check_ok=false
+      # tcp_json presence decides TCP; no separate flag needed
       tcp_json=$(curl -s --connect-timeout 3 --max-time 5 --fail "${checker_url}${tcp_ports}") || true
@@
-          if nc -z -u localhost "$port" &>/dev/null; then
+          if nc -z -u localhost "$port" &>/dev/null; then
               ((udp_open_ports++))
               open_udp_ports+=("$port")
-              tcp_check_ok=true
           fi

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro