Fix the [peer_private] verification step for validators - #3821
Open
pete-csyn wants to merge 1 commit into
Open
Conversation
Step 6 of "Connect using proxies" tells the operator to check the Peer Crawler and says an absent validator "verifies that your validator's [peer_private] configuration is working". That check cannot distinguish a working configuration from a broken one. The peer-crawler reference on this site already documents why: a server's ip and port are "Omitted if the peer is configured as a validator or a private peer". Validator status alone suppresses the address, so the crawler result is identical whether [peer_private] is 1, 0, or absent. Replaces it with the check the sibling page (peering/configure-a-private-server.md step 6) already uses -- the peers method, confirming no inbound connections and no address outside [ips_fixed] -- which is what [peer_private] 1 uniquely produces. Keeps the crawler behaviour as a note so operators are not surprised by it, and adds the peers method to See Also.
mDuo13
requested changes
Aug 6, 2026
mDuo13
left a comment
Collaborator
There was a problem hiding this comment.
I wonder if the behavior of the Peer Crawler changed after this was written or if this was always the case. In any case, I left a minor formatting suggestion but this PR otherwise looks good. 👍 I'll approve after it's applied.
| 6. Use the [Peer Crawler](../../../references/http-websocket-apis/peer-port-methods/peer-crawler.md) endpoint on one of your stock `xrpld` servers. The response should not include your validator. This verifies that your validator's `[peer_private]` configuration is working. One of the effects of enabling `[peer_private]` on your validator is that your validator's peers do not include it in their Peer Crawler results. | ||
| 6. Use the [peers method][] on your validator to confirm that `[peer_private]` is working. The `peers` array should contain _only_ the stock `xrpld` servers you configured: no inbound connections, and no `address` outside the `[ips_fixed]` stanza. If other peers appear, double-check your config file and restart the validator. | ||
|
|
||
| {% admonition type="info" name="Note" %}The [Peer Crawler](../../../references/http-websocket-apis/peer-port-methods/peer-crawler.md) does not confirm this setting. A server's `ip` and `port` are omitted from crawler results if it is configured **as a validator _or_ as a private peer**, so your validator's address is suppressed whether or not `[peer_private]` is set.{% /admonition %} |
Collaborator
There was a problem hiding this comment.
Looks fine, though we discovered a little bit ago that making the admonition all one line causes a minor error in our docs toolchain.
Suggested change
| {% admonition type="info" name="Note" %}The [Peer Crawler](../../../references/http-websocket-apis/peer-port-methods/peer-crawler.md) does not confirm this setting. A server's `ip` and `port` are omitted from crawler results if it is configured **as a validator _or_ as a private peer**, so your validator's address is suppressed whether or not `[peer_private]` is set.{% /admonition %} | |
| {% admonition type="info" name="Note" %} | |
| The [Peer Crawler](../../../references/http-websocket-apis/peer-port-methods/peer-crawler.md) does not confirm this setting. A server's `ip` and `port` are omitted from crawler results if it is configured **as a validator _or_ as a private peer**, so your validator's address is suppressed whether or not `[peer_private]` is set. | |
| {% /admonition %} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Step 6 of "Connect using proxies" says to check the Peer Crawler, and that an
absent validator "verifies that your validator's
[peer_private]configuration isworking."
That check returns the same result either way, so it can't confirm the setting.
The peer-crawler reference on this site already explains why —
ipandportare:Validator status alone suppresses the address, so the crawler output is identical
whether
[peer_private]is1,0, or absent.This swaps in the check the sibling page already uses
(
peering/configure-a-private-server.md, step 6): thepeersmethod, confirmingno inbound connections and no
addressoutside[ips_fixed]— which is what[peer_private]actually changes for a validator. The crawler behaviour stays asa note so it isn't surprising, and
peers methodis added to See Also.Happy to adjust the wording if you'd rather keep the crawler step and just
re-scope what it claims to prove.