EthSigner command line

This reference describes the syntax of the EthSigner Command Line Interface (CLI) options.

Specifying options

EthSigner options can be specified:

• On the command line
• As an environment variable
• In a TOML configuration file.

If you specify an option in more than one place, the order of priority is command line, environment variable, configuration file.

Environment variables

For each command line option, the equivalent environment variable is:

• Upper-case
• _ replaces -
• Has an ETHSIGNER_ prefix

For example, set --data-path using the ETHSIGNER_DATA_PATH environment variable.

You can include subcommand options as environment variables as well, for example set multikey-signer --directory using the ETHSIGNER_MULTIKEY_SIGNER_DIRECTORY environment variable.

Options

config-file

The path to the TOML configuration file. The default is none.

Syntax

--config-file=<FILE>

Example

--config-file=/home/me/me_node/config.toml

Environment variable

ETHSIGNER_CONFIG_FILE=/home/me/me_node/config.toml

chain-id

Chain ID of the network to receive the signed transactions.

Syntax

--chain-id=<chainId>

Example

--chain-id=2017

Environment variable

ETHSIGNER_CHAIN_ID=2017

Configuration file

chain-id=2017

data-path

Directory in which to store temporary files.

Syntax

--data-path=<PATH>

Example

--data-path=/Users/me/my_node/data

Environment variable

ETHSIGNER_DATA_PATH=/Users/me/my_node/data

Configuration file

data-path="/Users/me/my_node/data"

downstream-http-host

Host to which received requests are forwarded. Default is localhost.

Syntax

--downstream-http-host=<downstreamHttpHost>

Example

--downstream-http-host=192.168.05.14

Environment variable

ETHSIGNER_DOWNSTREAM_HTTP_HOST=192.168.05.14

Configuration file

downstream-http-host="192.168.05.14"

downstream-http-path

Path to which received requests are forwarded. Default is /.

Might be required if connecting to a cloud-based Ethereum client such as Infura.

Syntax

--downstream-http-path=<downstreamHttpPath>

Example

--downstream-http-path=/v3/d0e63ca5bb1e4eef2284422efbc51a56

Environment variable

ETHSIGNER_DOWNSTREAM_HTTP_PATH=/v3/d0e63ca5bb1e4eef2284422efbc51a56

Configuration file

downstream-http-path="/v3/d0e63ca5bb1e4eef2284422efbc51a56"

downstream-http-port

Port to which received requests are forwarded.

Syntax

--downstream-http-port=<downstreamHttpPort>

Example

--downstream-http-port=6174

Environment variable

ETHSIGNER_DOWNSTREAM_HTTP_PORT=6174

Configuration file

downstream-http-port=6174

downstream-http-request-timeout

Timeout period (in milliseconds) for downstream requests. Default is 5000.

Syntax

--downstream-http-request-timeout=<downstreamHttpRequestTimeout>

Example

--downstream-http-request-timeout=3000

Environment variable

ETHSIGNER_DOWNSTREAM_HTTP_REQUEST_TIMEOUT=3000

Configuration file

downstream-http-request-timeout=3000

downstream-http-tls-enabled

Enable or disable TLS for server connections. Defaults to false.

Syntax

--downstream-http-tls-enabled[=<true|false>]

Example

--downstream-http-tls-enabled

Environment variable

ETHSIGNER_DOWNSTREAM_HTTP_TLS_ENABLED

Configuration file

downstream-http-tls-enabled

downstream-http-tls-ca-auth-enabled

Allow connections to servers with trusted CAs.

Defaults to true.

Syntax

--downstream-http-tls-ca-auth-enabled[=<true|false>]

Example

--downstream-http-tls-ca-auth-enabled=false

Environment variable

ETHSIGNER_DOWNSTREAM_HTTP_TLS_CA_AUTH_ENABLED=false

Configuration file

downstream-http-tls-ca-auth-enabled=false

downstream-http-tls-keystore-file

Keystore file (in PKCS #12 format) that contains the private key and certificate presented to the server during authentication.

Syntax

--downstream-http-tls-keystore-file=<keystoreFile>

Example

--downstream-http-tls-keystore-file=/Users/me/my_node/keystore.pfx

Environment variable

ETHSIGNER_DOWNSTREAM_HTTP_TLS_KEYSTORE_FILE=/Users/me/my_node/keystore.pfx

Configuration file

downstream-http-tls-keystore-file="/Users/me/my_node/keystore.pfx"

downstream-http-tls-keystore-password-file

Password file used to decrypt the keystore.

Syntax

--downstream-http-tls-keystore-password-file=<passwordFile>

Example

--downstream-http-tls-keystore-password-file=/Users/me/my_node/password.txt

Environment variable

ETHSIGNER_DOWNSTREAM_HTTP_TLS_KEYSTORE_PASSWORD_FILE=/Users/me/my_node/password.txt

Configuration file

downstream-http-tls-keystore-password-file=/Users/me/my_node/password.txt

downstream-http-tls-known-servers-file

File containing the hostnames, ports, and SHA256 certificate fingerprints of trusted servers.

Syntax

--downstream-http-tls-known-servers-file=<serversFile>

Example

--downstream-http-tls-known-servers-file=/Users/me/my_node/knownServers

Environment variable

ETHSIGNER_DOWNSTREAM_HTTP_TLS_KNOWN_SERVERS_FILE=/Users/me/my_node/knownServers

Configuration file

downstream-http-tls-known-servers-file="/Users/me/my_node/knownServers"

http-cors-origins

A list of domain URLs for CORS validation. You must enclose the URLs in double quotes and separate them with commas.

Listed domains can access the node using JSON-RPC. If your client interacts with EthSigner using a browser app (such as Remix or a block explorer), you must allow the client domains.

The default value is none. If you do not allow any domains, browser apps cannot interact with your EthSigner node.

Tip

For testing and development purposes, use "all" or "*" to accept requests from any domain. We don’t recommend accepting requests from any domain for production environments.

Syntax

--http-cors-origins=<httpListenHost>

Example

--http-cors-origins="http://remix.ethereum.org","http://medomain.com"

Environment variable

ETHSIGNER_HTTP_CORS_ORIGINS="http://remix.ethereum.org","http://medomain.com"

Configuration file

http-cors-origins=["http://remix.ethereum.org","https://meotherdomain.com"]

http-listen-host

Host on which JSON-RPC HTTP listens. Default is localhost.

Syntax

--http-listen-host=<httpListenHost>

Example

--http-listen-host=10.100.111.1

Environment variable

ETHSIGNER_HTTP_LISTEN_HOST=10.100.111.1

Configuration file

http-listen-host="10.100.111.1"

http-listen-port

Port on which JSON-RPC HTTP listens. Default is 8545.

Syntax

--http-listen-port=<httpListenPort>

Example

--http-listen-port=6174

Environment variable

ETHSIGNER_HTTP_LISTEN_PORT=6174

Configuration file

http-listen-port=6174

logging

Logging verbosity levels. Options are: OFF, FATAL, WARN, INFO, DEBUG, TRACE, ALL. Default is INFO.

Syntax

-l, --logging=<LOG VERBOSITY LEVEL>

Example

--logging=DEBUG

Environment variable

ETHSIGNER_LOGGING=DEBUG

Configuration file

logging="DEBUG"

metrics-enabled

Enables the metrics exporter. The default is false.

Syntax

--metrics-enabled[=<true|false>]

Environment variable

ETHSIGNER_METRICS_ENABLED=true

Configuration file

metrics-enabled=true

metrics-category

Categories for which to track metrics. Options are HTTP, SIGNING, JVM, and PROCESS. All categories are enabled by default.

Note

There are currently no metrics available for the HTTP and SIGNING categories.

Syntax

--metrics-category=<metrics-category>[,metrics-category...]...

Example

--metrics-category=HTTP,SIGNING

Environment variable

ETHSIGNER_METRICS_CATEGORY=HTTP,SIGNING

Configuration file

metrics-category=["HTTP","SIGNING"]

metrics-host

The host on which Prometheus accesses EthSigner metrics. The default is 127.0.0.1.

Syntax

--metrics-host=<HOST>

Example

--metrics-host=127.0.0.1

Environment variable

ETHSIGNER_METRICS_HOST=127.0.0.1

Configuration file

metrics-host="127.0.0.1"

metrics-host-allowlist

A comma-separated list of hostnames to allow access to the EthSigner metrics. By default, EthSigner accepts access from localhost and 127.0.0.1.

Tip

To allow all hostnames, use “*”. We don’t recommend allowing all hostnames for production environments.

Syntax

--metrics-host-allowlist=<hostname>[,<hostname>...]... or "*"

Example

--metrics-host-allowlist=medomain.com,meotherdomain.com

Environment variable

ETHSIGNER_METRICS_HOST_ALLOWLIST=medomain.com,meotherdomain.com

Configuration file

metrics-host-allowlist=["medomain.com", "meotherdomain.com"]

metrics-port

The port (TCP) on which Prometheus accesses EthSigner metrics. The default is 8546.

Syntax

--metrics-port=<PORT>

Example

--metrics-port=6174

Environment variable

ETHSIGNER_METRICS_PORT=6174

Configuration file

metrics-port=6174

tls-allow-any-client

Allows any client to connect.

Important

Cannot be used with --tls-allow-ca-clients and --tls-known-clients-file

Syntax

--tls-allow-any-client

Environment variable

ETHSIGNER_TLS_ALLOW_ANY_CLIENT

Configuration file

tls-allow-any-client

tls-allow-ca-clients

Allows clients signed with trusted CA certificates to connect.

Syntax

--tls-allow-ca-clients

Environment variable

ETHSIGNER_TLS_ALLOW_CA_CLIENTS

Configuration file

tls-allow-ca-clients

tls-keystore-file

PKCS #12 formatted keystore. Used to enable TLS for client connections.

Syntax

--tls-keystore-file=<keystoreFile>

Example

--tls-keystore-file=/Users/me/my_node/certificate.pfx

Environment variable

ETHSIGNER_TLS_KEYSTORE_FILE=/Users/me/my_node/certificate.pfx

Configuration file

tls-keystore-file="/Users/me/my_node/certificate.pfx"

tls-keystore-password-file

Password file used to decrypt the keystore.

Syntax

--tls-keystore-password-file=<passwordFile>

Example

--tls-keystore-password-file=/Users/me/my_node/password.txt

Environment variable

ETHSIGNER_TLS_KEYSTORE_PASSWORD_FILE=/Users/me/my_node/password.txt

Configuration file

tls-keystore-password-file=/Users/me/my_node/password.txt

tls-known-clients-file

File containing the SHA-256 fingerprints of authorized clients.

Syntax

--tls-known-clients-file=<clientsFile>

Example

--tls-known-clients-file=/Users/me/my_node/knownClients

Environment variable

ETHSIGNER_TLS_KNOWN_CLIENTS_FILE=/Users/me/my_node/knownClients

Configuration file

tls-known-clients-file="/Users/me/my_node/knownClients"

help

Displays the help and exits.

Syntax

-h, --help

version

Displays the version and exits.

Syntax

-V, --version