Add Seismic rate limiting

bin/seismic-reth/src/main.rs

@@ -6,10 +6,14 @@ use clap::Parser;
 use jsonrpsee_http_client::HttpClientBuilder;
 use reth::cli::Cli;
 use reth_cli_commands::node::NoArgs;
+use reth_node_builder::Node;
 use reth_node_core::node_config::NodeConfig;
 use reth_seismic_cli::chainspec::SeismicChainSpecParser;
 use reth_seismic_node::node::SeismicNode;
-use reth_seismic_rpc::ext::{EthApiExt, EthApiOverrideServer, SeismicApi, SeismicApiServer};
+use reth_seismic_rpc::{
+    ext::{EthApiExt, EthApiOverrideServer, SeismicApi, SeismicApiServer},
+    rate_limiter::{RateLimitConfig, SeismicRateLimiter},
+};
 use reth_tracing::tracing::*;
 
 use seismic_enclave::{
@@ -84,8 +88,33 @@ fn main() {
         // building additional endpoints seismic api
         let seismic_api = SeismicApi::new(purpose_keys.clone());
 
+        // Configure rate limiting
+        let rate_limiter = SeismicRateLimiter::new(RateLimitConfig {
+            requests_per_second: 100, // 100 requests per second per IP
+            burst_size: 50,           // Allow bursts of up to 50 requests
+            limited_methods: None,    // Empty = limit all methods (except exempt)
+            exempt_methods: vec![
+                "eth_chainId".to_string(),
+                "eth_blockNumber".to_string(),
+                "net_version".to_string(),
+                "web3_clientVersion".to_string(),
+                "seismic_getTeePublicKey".to_string(),
+            ],
+            exempt_ips: vec![
+                // Add internal service IPs here if needed
+                // "127.0.0.1".parse().unwrap(),
+            ],
+        });
+
+        info!(target: "reth::cli", "Rate limiting configured: 100 req/s, burst 50");
+
+        let seismic_node = SeismicNode::default();
+        let add_ons = seismic_node.add_ons().with_rpc_middleware(rate_limiter);
+
         let node = builder
-            .node(SeismicNode::default())
+            .with_types::<SeismicNode>()
+            .with_components(seismic_node.components_builder())
+            .with_add_ons(add_ons)
             .extend_rpc_modules(move |ctx| {
                 // replace eth_ namespace
                 ctx.modules.replace_configured(

crates/rpc/rpc-builder/Cargo.toml

@@ -30,6 +30,7 @@ reth-transaction-pool.workspace = true
 reth-storage-api.workspace = true
 reth-chain-state.workspace = true
 reth-evm.workspace = true
+reth-seismic-rpc.workspace = true
 
 # rpc/net
 jsonrpsee = { workspace = true, features = ["server"] }

crates/rpc/rpc-builder/src/lib.rs

@@ -75,8 +75,8 @@ pub use reth_ipc::server::{
     Builder as IpcServerBuilder, RpcServiceBuilder as IpcRpcServiceBuilder,
 };
 pub use reth_rpc_server_types::{constants, RethRpcModule, RpcModuleSelection};
+use reth_seismic_rpc::rate_limiter::ClientIpExtractorLayer;
 pub use tower::layer::util::{Identity, Stack};
-
 /// Auth server utilities.
 pub mod auth;
 
@@ -1317,6 +1317,7 @@ impl<RpcMiddleware> RpcServerConfig<RpcMiddleware> {
                 let server = ServerBuilder::new()
                     .set_http_middleware(
                         tower::ServiceBuilder::new()
+                            .layer(ClientIpExtractorLayer)
                             .option_layer(Self::maybe_cors_layer(cors)?)
                             .option_layer(Self::maybe_jwt_layer(self.jwt_secret))
                             .option_layer(Self::maybe_compression_layer(
@@ -1371,6 +1372,7 @@ impl<RpcMiddleware> RpcServerConfig<RpcMiddleware> {
                 .set_config(config.ws_only().build())
                 .set_http_middleware(
                     tower::ServiceBuilder::new()
+                        .layer(ClientIpExtractorLayer)
                         .option_layer(Self::maybe_cors_layer(self.ws_cors_domains.clone())?)
                         .option_layer(Self::maybe_jwt_layer(self.jwt_secret)),
                 )
@@ -1396,6 +1398,7 @@ impl<RpcMiddleware> RpcServerConfig<RpcMiddleware> {
                 .set_config(config.http_only().build())
                 .set_http_middleware(
                     tower::ServiceBuilder::new()
+                        .layer(ClientIpExtractorLayer)
                         .option_layer(Self::maybe_cors_layer(self.http_cors_domains.clone())?)
                         .option_layer(Self::maybe_jwt_layer(self.jwt_secret))
                         .option_layer(Self::maybe_compression_layer(self.http_disable_compression)),

crates/rpc/rpc-builder/tests/it/main.rs

@@ -3,6 +3,7 @@
 mod auth;
 mod http;
 mod middleware;
+mod rate_limiter;
 mod serde;
 mod startup;
 pub mod utils;