Skip to content

Infra: testnet RPC offline + IP serves an unrelated TLS cert (CN=alugha.dev) #204

@deepanshutr

Description

@deepanshutr

Problem

`https://rpc.testnet.assetmantle.one\` and `https://rest.testnet.assetmantle.one\` are non-functional as of 2026-04-28:

```
$ curl -skI https://rpc.testnet.assetmantle.one/status
HTTP/2 404

$ curl -sv https://rpc.testnet.assetmantle.one/ 2>&1 | grep "subject:"

  • subject: CN=alugha.dev
  • expire date: Jul 10 13:23:27 2026 GMT
    ```

The hostname's A record points at `95.217.174.208` (`static.208.174.217.95.clients.your-server.de` — Hetzner). The Hetzner IP currently terminates with a Let's Encrypt cert for `alugha.dev` (a video translation startup). Almost certainly an IP-recycling artifact: we released the box, Hetzner re-leased it to alugha, alugha provisioned LE on their domain, our DNS still points at it.

In #198 the wallet was switched from `http://` to `https://` for testnet. That makes the cert mismatch visible (TLS error → fail-closed) instead of silently 301'ing into the broken HTTPS endpoint, which is the right safety choice. But it doesn't fix the underlying issue: testnet is dead, and from the public-facing DNS we're "pointing at" a third party.

Proposed fix

One of:

  1. Stand testnet back up. Provision a new mantle-testnet RPC + REST somewhere (Akash deployment? side-server?). Update DNS A/CNAME records.
  2. Decommission the testnet config. Remove `assetmantleTestChainRPCProxy` / `assetmantleTestChainRESTProxy` from `config/defaults.js` and the `mantleTestChainConfig` chain entry from `config/mantleChain.js`. Also remove DNS records.
  3. Park the DNS pointing at a no-op endpoint we control, so we're not advertising someone else's TLS cert against our subdomain.

Option 2 is cheapest. Option 1 is best if there's actually a use for testnet (chain-upgrade rehearsal, contract testing).

Where to look (in this repo)

  • `config/defaults.js:35-43` — `assetmantleTestChainRPCProxy` / `...RESTProxy` (now `https://`)
  • `config/mantleChain.js:567-583` — chain registry `apis.rpc[0].address` / `apis.rest[0].address`

Plus DNS-as-code in `assetmantle-infra` (or wherever Vercel zone is mirrored): the `rpc.testnet.assetmantle.one` + `rest.testnet.assetmantle.one` records currently point at `95.217.174.208`.

Why now

  • A user who runs testnet today gets a TLS-error wall (visible) — better than silent failure but still broken UX.
  • Slightly bad optics that an unrelated company's cert serves for our subdomain.
  • Zero-risk to remove if testnet is unused.

Acceptance

Pick one of the three options above. If 2 or 3, also nuke the DNS records.

Background: surfaced when re-running the wallet's Playwright suite for #198 after the rpc.assetmantle.one CORS fix.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions