> Modern note: This remains the current RPC reference, but some sections intentionally preserve migration mappings from the retired `2500`-series RPC layout. Treat those mapping tables as historical lineage only. The live authoritative inventory is the combination of this document, `docs/04-configuration/ALL_VMIDS_ENDPOINTS.md`, `docs/02-architecture/DBIS_NODE_ROLE_MATRIX.md`, and `config/ip-addresses.conf`.
**Changelog:** Inventory includes VMID **2103** (Thirdweb admin core); **core tier** = **2101–2103**. Live placement: **2101** and **2103** on **r630-01**, **2102** on **r630-03**. Health script probes **15** LAN RPC HTTP endpoints (`check-chain138-rpc-health.sh`).
This is the **authoritative source** for all RPC endpoint configurations. All other documentation and scripts should reference this document. **Master documentation (source of truth):** [MASTER_DOCUMENTATION_INDEX.md](../00-meta/MASTER_DOCUMENTATION_INDEX.md) lists this doc and [ALL_VMIDS_ENDPOINTS.md](ALL_VMIDS_ENDPOINTS.md) as the Bible for domain → VMID:port; only `explorer.d-bis.org` should point to 192.168.11.140.
**Edge & port forwarding:** UDM Pro (76.53.10.34, replaced ER605). Proxmox hosts: 192.168.11.10 (ml110), 192.168.11.11 (r630-01), 192.168.11.12 (r630-02). NPMplus LXC (VMID 10233) has 192.168.11.166 and 192.168.11.167; **only 192.168.11.167** is used in UDM Pro. Port forward: **76.53.10.36:80** → **192.168.11.167:80**, **76.53.10.36:443** → **192.168.11.167:443**. See [NETWORK_CONFIGURATION_MASTER.md](../11-references/NETWORK_CONFIGURATION_MASTER.md).
- **Public / wallet rule:** Do not publish or paste **raw public-node IPs** for end users. Use **FQDN** URLs from [Public Domain Mappings](#public-domain-mappings-npmplus) (e.g. `https://rpc-http-pub.d-bis.org`, `https://rpc.d-bis.org`, `https://rpc.defi-oracle.io`, `https://rpc.public-0138.defi-oracle.io`). WebSocket: `wss://rpc-ws-pub.d-bis.org` (or `wss://wss.defi-oracle.io` per mapping table).
- **MetaMask:** Even with correct chain id and HTTPS RPC, MetaMask treats Chain 138 as a **user-added network** until/unless Consensys ships it as a built-in or curated default. Use `wallet_addEthereumChain` (EIP-3085) from your dapp and canonical FQDN `rpcUrls` so users never paste unknown endpoints. See [MetaMask: risks of unknown networks](https://support.metamask.io/stay-safe/safety-in-web3/the-risks-of-connecting-to-an-unknown-network/).
- Set in `config/ip-addresses.conf` or `smom-dbis-138/.env`. In smom `.env`, **`RPC_URL`** is an accepted alias for **Core** and is normalized to `RPC_URL_138`. `CHAIN138_RPC_URL` / `CHAIN138_RPC` are derived from `RPC_URL_138`. `WS_URL_138_PUBLIC` on LAN: `ws://192.168.11.221:8546`; **internet-facing:**`wss://rpc-ws-pub.d-bis.org`.
- **Core RPC (VMID 2101) for deploy:** Use **IP and port**, not FQDN. Set `RPC_URL_138=http://192.168.11.211:8545` in `smom-dbis-138/.env` for contract deployment and gas checks. Do not use `https://rpc-core.d-bis.org` for deployment (avoids DNS/tunnel dependency; direct IP is reliable from LAN). See [TODOS_CONSOLIDATED](../00-meta/TODOS_CONSOLIDATED.md) § First (0b).
- **Thirdweb admin core (VMID 2103) — NPM HTTPS FQDN:** **`https://rpc.tw-core.d-bis.org`** (TLS via NPMplus → `192.168.11.217:8545`). **E2E verified (2026-04-09):**`eth_chainId``0x8a`, `eth_blockNumber` OK; Foundry `forge script` dry-run against this URL OK. Use for deploy/tooling when DNS and TLS are acceptable; for air-gapped LAN-only automation use `http://192.168.11.217:8545` or set `RPC_THIRDWEB_ADMIN_LAN_ONLY=1` in `thirdweb-core-2103-test/scripts/rpc-url-2103.sh` consumers. WebSocket NPM host: **`wss.tw-core.d-bis.org`** → `wss://wss.tw-core.d-bis.org`.
If `eth_maxPriorityFeePerGas` is missing, the first fix path is the public node version on VMID `2201`. Besu `24.7.0+` adds support for that method; use [`upgrade-public-rpc-vmid2201.sh`](../../scripts/besu/upgrade-public-rpc-vmid2201.sh) to perform the targeted public-RPC upgrade.
### Obtaining RPC URLs (Infura, Etherscan API, public RPCs)
For **Ethereum mainnet and other public chains**, you can use:
| Source | Type | URL pattern / notes |
|--------|------|----------------------|
| **Infura** | JSON-RPC (key required) | `https://mainnet.infura.io/v3/<PROJECT_ID>` — [infura.io](https://infura.io) dashboard; free tier, one key. Other networks: `https://polygon-mainnet.infura.io/v3/<ID>`, `https://base-mainnet.infura.io/v3/<ID>`, etc. |
| **Alchemy** | JSON-RPC (key required) | `https://eth-mainnet.g.alchemy.com/v2/<API_KEY>` — [alchemy.com](https://alchemy.com); free tier. Use for production when you need higher rate limits. |
| **Etherscan** | REST API (explorer, not RPC) | `https://api.etherscan.io/api?...&apikey=<KEY>` — block explorer API (contract verification, tx history). **Not** JSON-RPC; use Infura/Alchemy/public RPC for `eth_*` calls. |
| **Public RPCs (no key)** | JSON-RPC | `https://eth.llamarpc.com`, `https://ethereum.publicnode.com`, `https://cloudflare-eth.com`, `https://eth.drpc.org` — rate limited; fine for dev/fallback. See [chainlist.org](https://chainlist.org) for more. |
**Usage:** Set `ETHEREUM_MAINNET_RPC` (or `RPC_URL_MAINNET`) in `.env` to one of the above. Prefer Infura/Alchemy with your own key for production; use public RPCs in `.env.example` and as code fallbacks. Never commit API keys.
**CCIP Relay:** The relay service (deployed at `/opt/smom-dbis-138/services/relay` on r630-01) uses **Chain 138 Public RPC** (VMID 2201): set `RPC_URL_138_PUBLIC` (or `RPC_URL_138` for backward compat) to `http://192.168.11.221:8545` in `services/relay/.env` or `smom-dbis-138/.env`. For mainnet it uses `RPC_URL_MAINNET` first, then `ETHEREUM_MAINNET_RPC`. Infura mainnet is recommended to avoid public RPC rate limits (429). See [07-ccip/CCIP_RELAY_DEPLOYMENT.md](../07-ccip/CCIP_RELAY_DEPLOYMENT.md).
**Dotenv:** The project `.env` may contain both **Infura** (RPC URLs, `INFURA_GAS_API`) and **Etherscan/Blockscan** (`ETHERSCAN_API_KEY`) API keys. Use placeholders in `.env.example` only; see `smom-dbis-138/.env.example` for the full list.
**Core RPC tier (VMIDs 2101–2103):** Besu JSON-RPC/WS on **8545/8546**, same chain id **138**. **2101** (`.211`) is the default **`RPC_URL_138` / `RPC_CORE_1`** for deploy and admin. **2102** (`.212`, **`RPC_CORE_2`**) is the second core peer; **Proxmox host: r630-03** (`192.168.11.13`). **2103** (`.217`, **`RPC_THIRDWEB_ADMIN_CORE`**, hostname `besu-rpc-core-thirdweb`) is the Thirdweb admin/core lane; **Proxmox host: r630-01** (`192.168.11.11`) with NPM FQDNs **`rpc.tw-core.d-bis.org`** / **`wss.tw-core.d-bis.org`** (see `scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh`). **2101** and **2103** both run on **r630-01**.
**Health check:** `bash scripts/verify/check-chain138-rpc-health.sh` probes **all 15** LAN HTTP RPC endpoints above (including **2103**; **2103** uses a lower peer threshold than the rest—see script `RPC_ROWS`). Expect head spread within **`RPC_MAX_HEAD_SPREAD`** (default 12) and public capability checks against **`CHAIN138_PUBLIC_RPC_URL`** (default `https://rpc-http-pub.d-bis.org`).
**Important**: Any scripts or configurations referencing the old IPs (192.168.11.250-254, 192.168.11.201-204) must be updated.
Containers 2506, 2507, 2508 were **destroyed 2026-02-08** on all Proxmox hosts. RPC range in use: 2500–2505. IPs .202, .203, .204 freed.
---
## DNS Configuration
**When Option B (RPC via Cloudflare Tunnel) is used:** The 6 RPC HTTP hostnames (rpc-http-pub, rpc, rpc2, rpc-http-prv, rpc.public-0138.defi-oracle.io, rpc.defi-oracle.io) use **CNAME** to <tunnel-id>.cfargotunnel.com (Proxied); they do not use A 76.53.10.36. See [05-network/OPTION_B_RPC_VIA_TUNNEL_RUNBOOK.md](../05-network/OPTION_B_RPC_VIA_TUNNEL_RUNBOOK.md).
**Web/api and RPC WS (direct/Fastly):** All other domains resolve to the public IP `76.53.10.36` (or Fastly CNAME). NPMplus handles SSL termination and routing to internal services.
**Issue**: NPMplus container needed to reach both the UDM Pro gateway (for port forwarding) and the RPC nodes (for backend proxying), but tagged VLAN 11 traffic couldn't reach untagged hosts.
**Root Cause**: UDM Pro treats tagged VLAN 11 and untagged traffic as separate networks.
**Solution**: Dual-NIC configuration with one tagged and one untagged interface.
**NPMplus Container Config** (VMID 10233 on r630-01; NPMplus has .166 and .167; only **.167** is used in UDM Pro port forwarding):
```bash
# eth0: Tagged VLAN 11 - for gateway/external access
| `explorer.d-bis.org` | A | 76.53.10.36 | ✅ Proxied |
| `dbis-admin.d-bis.org` | A | 76.53.10.36 | ✅ Proxied |
| `dbis-api.d-bis.org` | A | 76.53.10.36 | ✅ Proxied |
| `dbis-api-2.d-bis.org` | A | 76.53.10.36 | ✅ Proxied |
| `secure.d-bis.org` | A | 76.53.10.36 | ✅ Proxied |
| `rpc.public-0138.defi-oracle.io` | A or CNAME | 76.53.10.36 or tunnel | ✅ Proxied |
| `rpc.defi-oracle.io` | A or CNAME | 76.53.10.36 or tunnel | ✅ Proxied |
| `wss.defi-oracle.io` | A | 76.53.10.36 | ✅ Proxied |
---
## Verification Commands
### Test All RPC Nodes (Internal)
```bash
for ip in 192.168.11.211 192.168.11.221 192.168.11.233 192.168.11.234 192.168.11.235 192.168.11.236 192.168.11.237 192.168.11.238 192.168.11.240 192.168.11.241 192.168.11.242 192.168.11.243; do
curl -s -X POST -H "Content-Type: application/json" \
for domain in rpc-http-pub.d-bis.org rpc-ws-pub.d-bis.org rpc-http-prv.d-bis.org rpc-ws-prv.d-bis.org rpc.public-0138.defi-oracle.io rpc.defi-oracle.io wss.defi-oracle.io; do
echo -n "$domain: "
dig +short $domain
done
```
---
## Related Documentation
- [PUBLIC_RPC_CHAIN138_LEDGER.md](./PUBLIC_RPC_CHAIN138_LEDGER.md) - Public RPCs for ChainID 138, NPMplus→VM mapping, Ledger App-Ethereum
