Nethermind + Lighthouse

This guide walks you through setting up your own Ethereum Mainnet node with both execution and consensus layers. You will:

1. Install Docker, Nginx, and Certbot
2. Configure Nethermind (execution) and Lighthouse (consensus) clients
3. Set up reverse proxy with SSL
4. Monitor and maintain your node

This setup provides you with your own dedicated RPC endpoints for Ethereum Mainnet (ETH & Beacon).

1. Hardware requirements

2. Installation

a. Install dependencies

Ensure you have the required software installed:

• Prerequisites
• Docker

Install Nginx:

sudo apt update -qy
sudo apt install nginx -y

Start and enable Nginx:

sudo systemctl start nginx
sudo systemctl enable nginx

Check status:

sudo systemctl status nginx

Install Certbot for SSL:

sudo apt install certbot python3-certbot-nginx -y

b. Setup Ethereum node

Create project directory:

mkdir ethereum-rpc && cd ethereum-rpc

Create Docker Compose file:

nano docker-compose.yml

Add Docker Compose configuration:

services:
  nethermind:
    image: nethermind/nethermind:latest
    container_name: nethermind-mainnet
    restart: unless-stopped
    stop_grace_period: 5m
    stop_signal: SIGINT

    mem_limit: 16g
    cpus: "4"

    ports:
      - "127.0.0.1:8545:8545"     # HTTP RPC
      - "127.0.0.1:8546:8546"     # WS RPC
      - "30303:30303"             # p2p
      - "30303:30303/udp"

    volumes:
      - ./data/nethermind:/var/lib/nethermind
      - ./data/jwt.hex:/jwt.hex:ro

    command: >-
      --config=mainnet
      --datadir=/var/lib/nethermind
      --JsonRpc.Enabled=true
      --JsonRpc.Host=0.0.0.0
      --JsonRpc.Port=8545
      --JsonRpc.EnabledModules=eth,net,subscribe
      --Init.WebSocketsEnabled=true
      --JsonRpc.WebSocketsPort=8546
      --JsonRpc.EngineHost=0.0.0.0
      --JsonRpc.EnginePort=8551
      --JsonRpc.JwtSecretFile=/jwt.hex
      --Sync.SnapSync=true
      --Pruning.Mode=Full
      --Network.MaxActivePeers=100
      --Init.MemoryHint=16000000000

  lighthouse:
    image: sigp/lighthouse:latest
    container_name: lighthouse-beacon
    restart: unless-stopped
    depends_on:
      - nethermind

    ports:
      - "127.0.0.1:5052:5052"   # HTTP API
      - "9000:9000"             # p2p
      - "9000:9000/udp"

    volumes:
      - ./data/lighthouse:/root/.lighthouse
      - ./data/jwt.hex:/jwt.hex:ro

    command: >-
      lighthouse bn
      --network mainnet
      --datadir /root/.lighthouse
      --execution-endpoint http://nethermind-mainnet:8551
      --execution-jwt /jwt.hex
      --checkpoint-sync-url https://sync-mainnet.beaconcha.in
      --checkpoint-sync-url-timeout 300
      --http
      --http-address 0.0.0.0
      --port 9000
      --target-peers 100

networks:
  default:
    name: eth-mainnet-network
    driver: bridge

c. Initialize and start services

Create the JWT secret file:

mkdir -p data
openssl rand -hex 32 > data/jwt.hex

Start the services:

docker compose up -d

View Nethermind logs:

docker logs -f nethermind-mainnet

View Lighthouse logs:

docker logs -f lighthouse-mainnet

Monitor both services:

docker compose logs -f

3. Nginx reverse proxy setup

a. Configure Nginx for Nethermind (execution layer)

Create Nginx configuration:

sudo nano /etc/nginx/sites-available/eth-mainnet-rpc

Add the following configuration:

server {
    server_name eth.yourdomain.com;

    access_log /var/log/nginx/eth_mainnet_rpc_access.log;
    error_log /var/log/nginx/eth_mainnet_rpc_error.log;

    location / {
        # IP whitelist - replace with your actual IPs
        allow 172.16.0.0/12;     # Docker networks
        allow 10.0.0.0/8;        # Private networks
        allow 192.168.0.0/16;    # Private networks
        allow 203.0.113.1;       # Your specific IP
        allow 198.51.100.0/24;   # Your network range

        # Deny all other traffic
        deny all;

        proxy_pass http://127.0.0.1:8545;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;

        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;

        client_max_body_size 1M;
        limit_req zone=api burst=10 nodelay;
    }
}

b. Configure Nginx for Lighthouse (consensus layer)

Create Nginx configuration:

sudo nano /etc/nginx/sites-available/beacon-mainnet-rpc

Add the following configuration:

server {
    server_name beacon.yourdomain.com;

    access_log /var/log/nginx/beacon_mainnet_rpc_access.log;
    error_log /var/log/nginx/beacon_mainnet_rpc_error.log;

    location / {
        # IP whitelist - same as above
        allow 172.16.0.0/12;
        allow 10.0.0.0/8;
        allow 192.168.0.0/16;
        allow 203.0.113.1;
        allow 198.51.100.0/24;

        deny all;

        proxy_pass http://127.0.0.1:5052;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;

        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;

        client_max_body_size 1M;
        limit_req zone=api burst=10 nodelay;
    }
}

c. Enable Nginx sites

Add rate limiting to main Nginx config:

sudo nano /etc/nginx/nginx.conf

Add this inside the http block:

# Rate limiting zone
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

Create symbolic links:

sudo ln -s /etc/nginx/sites-available/eth-mainnet-rpc /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/beacon-mainnet-rpc /etc/nginx/sites-enabled/

Test configuration:

sudo nginx -t

Reload Nginx:

sudo systemctl reload nginx

d. Setup SSL with Certbot

Obtain SSL certificate for Nethermind endpoint:

sudo certbot --nginx -d eth.yourdomain.com

Obtain SSL certificate for Lighthouse endpoint:

sudo certbot --nginx -d beacon.yourdomain.com

Test certificate renewal:

sudo certbot renew --dry-run

4. Service configuration details

a. Nethermind (execution client)

• Image: nethermind/nethermind:latest
• Network: Ethereum mainnet
• Sync Mode: Snap sync with full pruning
• RPC Endpoint: https://eth.yourdomain.com
• WebSocket Endpoint: wss://eth.yourdomain.com
• Available APIs: eth, net, subscribe
• Memory: 16GB allocated

b. Lighthouse (consensus client)

• Image: sigp/lighthouse:latest
• Network: Ethereum mainnet
• HTTP API: https://beacon.yourdomain.com
• Memory: 8GB allocated
• Checkpoint Sync: Enabled for faster initial sync

c. Port configuration

5. Verification and testing

a. Check sync status

1. Check Nethermind sync status:

   Direct (localhost)

   curl -s -X POST --data '{"jsonrpc":"2.0","method":"eth_syncing","params":[],"id":1}' \
   -H "Content-Type: application/json" http://localhost:8545 | jq

   Through Nginx proxy

   curl -s -X POST --data '{"jsonrpc":"2.0","method":"eth_syncing","params":[],"id":1}' \
   -H "Content-Type: application/json" https://eth.yourdomain.com | jq

   Expected output when synced:

   {
       "jsonrpc": "2.0",
       "id": 1,
       "result": false
   }

2. Check Lighthouse sync status:

   Direct (localhost)

   curl -s http://localhost:5052/eth/v1/node/syncing | jq

   Through Nginx proxy

   curl -s https://beacon.yourdomain.com/eth/v1/node/syncing | jq

   Expected output when synced:

   {
       "data": {
           "head_slot": "10000000",
           "sync_distance": "0",
           "is_syncing": false,
           "is_optimistic": false,
           "el_offline": false
       }
   }

b. Health checks

Nethermind block number

curl -s -X POST --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}' \
-H "Content-Type: application/json" https://eth.yourdomain.com | jq

Lighthouse health

curl -s https://beacon.yourdomain.com/eth/v1/node/health

6. Monitoring and maintenance

a. Check service status

Docker containers status

docker compose ps

Container resource usage

docker stats nethermind-mainnet lighthouse-mainnet

Container logs

docker compose logs --tail=100 nethermind
docker compose logs --tail=100 lighthouse

b. Service management

Restart all services:

docker compose restart

Restart individual services:

docker compose restart nethermind
docker compose restart lighthouse

Update services:

docker compose pull
docker compose up -d

c. Data persistence

All blockchain data is persisted in the ./data directory:

• ./data/nethermind/: Nethermind blockchain data
• ./data/lighthouse/: Lighthouse beacon chain data
• ./data/jwt.hex: JWT secret for client authentication

d. Backup strategy

Create quick backup (while services running):

tar -czf eth-backup-$(date +%Y%m%d).tar.gz data/

Create full backup (consistent, services stopped):

docker compose down
tar -czf eth-full-backup-$(date +%Y%m%d).tar.gz data/
docker compose up -d

Restore from backup:

docker compose down
tar -xzf eth-backup-YYYYMMDD.tar.gz
docker compose up -d

7. Troubleshooting

a. Common issues

1. Port conflicts

Check port usage:

netstat -tulpn | grep -E ':(8545|8546|5052|30303|9000)'

Kill processes using required ports:

sudo lsof -ti:8545 | xargs kill -9

2. Insufficient memory

Check system memory:

free -h

Check Docker memory limits:

docker stats

Increase swap if needed:

sudo fallocate -l 8G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

3. Sync issues

Check network connectivity:

ping mainnet.checkpoint.sigp.io

Reset and resync (WARNING: deletes data):

docker compose down
sudo rm -rf data/nethermind data/lighthouse
docker compose up -d

4. SSL certificate issues

Check certificate status:

sudo certbot certificates

Renew certificates manually:

sudo certbot renew

Test Nginx configuration:

sudo nginx -t

5. Access denied (403)

Check your IP:

curl https://ipinfo.io/ip

Update Nginx IP whitelist and reload:

sudo nano /etc/nginx/sites-available/eth-mainnet-rpc
sudo systemctl reload nginx

b. Log analysis

Search for errors in container logs

docker compose logs nethermind | grep -i error
docker compose logs lighthouse | grep -i error

Check Nginx logs

sudo tail -f /var/log/nginx/eth_mainnet_rpc_access.log
sudo tail -f /var/log/nginx/eth_mainnet_rpc_error.log

Check system logs

sudo journalctl -f -u docker
sudo journalctl -f -u nginx

c. Recovery commands

Full service restart

docker compose down
docker compose up -d

Full service restart with image updates

docker compose down
docker compose pull
docker compose up -d --force-recreate

Emergency cleanup (removes all data)

docker compose down -v
sudo rm -rf data/
mkdir -p data
openssl rand -hex 32 > data/jwt.hex
docker compose up -d

8. Security considerations

a. Network security

• Local Binding: RPC endpoints bound to localhost only
• Reverse Proxy: Nginx provides controlled external access
• IP Whitelisting: Only specified IPs can access endpoints
• SSL/TLS: All external traffic encrypted
• Rate Limiting: Protection against abuse

b. Firewall configuration

Allow SSH

sudo ufw allow ssh

Allow Nginx (HTTP/HTTPS)

sudo ufw allow 'Nginx Full'

Allow P2P ports for blockchain

sudo ufw allow 30303
sudo ufw allow 9000
sudo ufw allow 9000/udp

Deny all other traffic

sudo ufw --force enable

c. Access control best practices

1. Regular Updates: Keep Docker images and system updated
2. Strong Authentication: Use SSH keys, disable password auth
3. Monitor Access: Review Nginx logs regularly
4. Backup Security: Encrypt backups, store securely
5. Network Segmentation: Consider VPN for additional security

d. Monitoring setup

Set up log rotation

sudo nano /etc/logrotate.d/eth-mainnet-logs

Add content:

/var/log/nginx/eth_mainnet_rpc_*.log
/var/log/nginx/beacon_mainnet_rpc_*.log {
    daily
    missingok
    rotate 52
    compress
    delaycompress
    notifempty
    create 644 www-data www-data
    postrotate
        systemctl reload nginx
    endscript
}

9. Sync time expectations

• Initial Sync: 12-24 hours depending on hardware and network
• Nethermind Snap Sync: Faster than full sync, pruning keeps storage manageable
• Lighthouse Checkpoint Sync: Starts from recent checkpoint, much faster
• Storage Growth: ~50-80GB per month for mainnet

10. Post-setup checklist

Verify the following before considering your setup complete:

• Both Nethermind and Lighthouse are syncing successfully
• RPC endpoints respond to health checks
• SSL certificates are installed and working
• IP whitelist configured correctly
• Firewall rules are properly configured
• Log rotation is set up
• Backup strategy is implemented
• Monitoring is in place

11. Resources

• Documentation: Nethermind Documentation · Lighthouse Documentation
• Explorer: Ethereum Beacon Chain Explorer
• Checkpoint Sync: Ethereum Checkpoint Sync
• Web Server: Nginx Documentation