Restricted Access / Authentication for a Remote Geth Node

Question

I have setup remote geth nodes that are constantly running as web3 providers to support my DApp.

What is the best way to restrict access to make sure that only authorized clients (my server) are connecting to this geth node?

For example, infura requires an access key for users: https://mainnet.infura.io/{ACCESS_KEY}.

How would I set something like that up for my geth node?

The RPC port of the geth node is 8545 and I am using an nginx reverse proxy to serve an SSL/TLS connection on port 443 since my DApp is secured (https).

Answer 1

OK I figured this out, using basic HTTP/HTTPs auth. Posting in case this helps anyone else:

1. AWS: disabled inbound TCP access to 8545 port (in AWS security groups)
2. Added auth_basic in nginx
3. Used openssl to create a password file
4. New web3 URL: https://<USERNAME>:<PASSWORD>@mydomain.com:443

nginx config

server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;

    # ADDED THESE TWO LINES FOR AUTHENTICATION
    auth_basic "Protected Geth";
    auth_basic_user_file /path/to/passwords;

    server_name subdomain.mydomain.com;

    ssl                 on;
    ssl_certificate     /path/to/mydomain-bundle.crt;
    ssl_certificate_key /path/to/mydomain.key;
    #ssl_session_cache  shared:SSL:10m;

    location / {
      proxy_pass http://localhost:8545;
      proxy_set_header Host $host;
      proxy_redirect http:// https://;
    }
}

Create password file

printf "<USERNAME>:$(openssl passwd -crypt <PASSWORD>)" > passwords