rostrum 14.0.1

An efficient implementation of Electrum Server with token support
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121

# SSL/TLS Setup Guide

This guide covers setting up SSL/TLS support for Rostrum using the built-in SSL/TLS features.

## Overview

Rostrum provides built-in SSL/TLS support for:
- **TCP SSL (ElectrumS)**: Secure TCP connections
- **WebSocket SSL (WSS)**: Secure WebSocket connections
- **HTTPS**: Secure HTTP connections

## Prerequisites

- A domain name pointing to your server
- Root or sudo access to your server
- Port 80 and 443 open (for Let's Encrypt verification)

## Install Certbot

It is recommended that you set up certbot with auto-renewal of certificates.
However, the following is to help you get started.

Certbot is the recommended tool for obtaining free SSL certificates from Let's Encrypt.

### Ubuntu/Debian
```bash
sudo apt update
sudo apt install certbot
```

### CentOS/RHEL
```bash
sudo yum install certbot
# or for newer versions
sudo dnf install certbot
```

### macOS
```bash
brew install certbot
```

## Obtaining SSL Certificate

### Standalone Method (Recommended)
```bash
sudo certbot certonly --standalone -d yourdomain.com
```

### Webroot Method (Alternative)
If you have a web server running, you can use the webroot method:
```bash
sudo certbot certonly --webroot -w /var/www/html -d yourdomain.com
```

## Configure Rostrum with SSL

### Basic SSL Configuration
When you provide SSL certificate files, Rostrum automatically enables SSL/TLS endpoints:

```bash
rostrum \
  --ssl-cert-file=/etc/letsencrypt/live/yourdomain.com/fullchain.pem \
  --ssl-key-file=/etc/letsencrypt/live/yourdomain.com/privkey.pem
```

**Enabled by default: With the above configuration, Rostrum will automatically enable:
- TCP SSL (ElectrumS) on the default SSL port
- WebSocket SSL (WSS) on the default WSS port  

HTTPS needs to be explicitly enabled using the `--https` flag.

**Note**: TCP SSL and WebSocket SSL are enabled by default when SSL certificate files are provided. You only need to specify `--https` to enable the HTTPS endpoint. To disable any of these SSL endpoints, use the corresponding `--no-` flag (e.g., `--no-tcp-ssl`, `--no-websocket-ssl`).

### Enable All SSL Endpoints
```bash
rostrum \
  --ssl-cert-file=/etc/letsencrypt/live/yourdomain.com/fullchain.pem \
  --ssl-key-file=/etc/letsencrypt/live/yourdomain.com/privkey.pem \
  --https
```

### Custom Port Configuration
```bash
rostrum \
  --ssl-cert-file=/etc/letsencrypt/live/yourdomain.com/fullchain.pem \
  --ssl-key-file=/etc/letsencrypt/live/yourdomain.com/privkey.pem \
  --electrum-rpc-ssl-addr=0.0.0.0:50002 \
  --electrum-ws-ssl-addr=0.0.0.0:50004 \
  --https \
  --electrum-https-addr=0.0.0.0:51001
```

**Note**: The ports shown above are the default Bitcoin Cash mainnet ports. For other networks (Nexa, testnet, etc.), see the [ports documentation](ports.md) for the correct default ports.

## Step 6: Firewall Configuration

Ensure your firewall allows the SSL ports:

### UFW (Ubuntu)
```bash
sudo ufw allow 50002/tcp  # TCP SSL
sudo ufw allow 50004/tcp  # WSS
sudo ufw allow 50001/tcp  # HTTPS
```

### iptables
```bash
sudo iptables -A INPUT -p tcp --dport 50002 -j ACCEPT  # TCP SSL
sudo iptables -A INPUT -p tcp --dport 50004 -j ACCEPT  # WSS
sudo iptables -A INPUT -p tcp --dport 50001 -j ACCEPT  # HTTPS
```

### firewalld (CentOS/RHEL)
```bash
sudo firewall-cmd --permanent --add-port=50002/tcp  # TCP SSL
sudo firewall-cmd --permanent --add-port=50004/tcp  # WSS
sudo firewall-cmd --permanent --add-port=50001/tcp  # HTTPS
sudo firewall-cmd --reload
```