Run a node

There are two independent implementations of the same protocol. Both read the same ARREKTA_* environment variables and serve the same REST API.

Implementation	Binary	Role
Rust (`node-rs/`)	`arrekta-node-rs`	production node; default on the devnet
Python (`core/`)	`arrekta-node`	normative reference; differential check on every block

Build and start

cd node-rs
cargo build --release -p arrekta-node
ARREKTA_NETWORK=regtest ARREKTA_DATA_DIR=./data ./target/release/arrekta-node-rs

cd core
uv venv -p python3.13 .venv && uv pip install -p .venv/bin/python -e ".[dev]"
ARREKTA_NETWORK=regtest .venv/bin/arrekta-node

./all_svc/arrekta-compose.sh init-env
./all_svc/arrekta-compose.sh build core core-rs
./all_svc/arrekta-compose.sh up              # 3 nodes
./all_svc/arrekta-compose.sh up platform     # + indexer, gateway, wallet, issuer services

The Python node needs the package's node extra (arrekta[node]: FastAPI, Uvicorn and friends); the dev extra above includes it. The consensus library alone, which the Python SDK uses, needs only cryptography.

Release binaries are built reproducibly and co-signed with ML-DSA; verify them as described in Operating nodes → Releases.

Configuration

Variable	Default	Meaning
`ARREKTA_NETWORK`	`regtest`	`mainnet`, `testnet` or `regtest`
`ARREKTA_NODE_NAME`	`arrekta-node`	name in logs and metrics
`ARREKTA_DATA_DIR`	`./data`	chain database directory
`ARREKTA_API_HOST`	`127.0.0.1`	REST API bind address
`ARREKTA_API_PORT`	network default (8332 / 18332 / 28332)	REST API port
`ARREKTA_ADMIN_TOKEN`	unset (admin routes disabled)	Bearer token for `/v1/admin/*`
`ARREKTA_CORS_ORIGINS`	empty	comma-separated allowed origins
`ARREKTA_RATE_LIMIT_PER_MINUTE`	`1200`	per client IP on public routes; 0 disables
`ARREKTA_INTERNAL_TOKEN`	unset	requests with this value in `x-arrekta-internal` skip the rate limit; give it only to your own backend services (the wallet service), never to a public proxy
`ARREKTA_P2P_PORT`	network default (9333 / 19333 / 29333)	P2P port
`ARREKTA_PEERS`	empty	comma-separated `host:port` peers to keep connected
`ARREKTA_MAX_PEERS` / `ARREKTA_MAX_OUTBOUND`	`64` / `8`	connection limits
`ARREKTA_P2P_PEER_BANDWIDTH_KBPS`	`8192`	Rust node: bandwidth each peer may use in each direction (KiB/s); over it the connection slows down instead of dropping; `0` = unlimited
`ARREKTA_ASSUME_VALID`	unset	Rust node: a block hash from the release notes; during sync its ancestors skip signature checks (every other rule is checked), only when it is on the most-work chain and buried two weeks deep
`ARREKTA_MINE`	`false`	run the built-in solo miner (devnets)
`ARREKTA_MINER_ADDRESS`	empty	coinbase address for the miner and `getauxblock`
`ARREKTA_MINE_INTERVAL_SECONDS`	`0`	pause between mined blocks
`ARREKTA_CHECKPOINT_SEED`	unset	32-byte hex seed: makes this node a checkpoint signer
`ARREKTA_CHECKPOINT_INTERVAL` / `ARREKTA_CHECKPOINT_DEPTH`	`10` / `6`	which heights to sign, and how deep
`ARREKTA_MEMPOOL_MAX_MB`	`300`	mempool cap
`ARREKTA_LOG_LEVEL` / `ARREKTA_LOG_JSON`	`INFO` / `true`	logging

Defaults are those of the reference node's settings (core/arrekta_node/config.py); the Rust node reads the same names. The two settings marked Rust node are node policy, not consensus, and only the Rust node has them.

Ports

Network	P2P	REST API
mainnet	9333	8332
testnet	19333	18332
regtest	29333	28332

The Compose devnet publishes node-1 on 127.0.0.1:28332 (P2P 29333), node-2 on 28342 and the Python node-3 on 28352. Keep the REST API on localhost or behind the gateway; admin routes must never be public.

Health and monitoring

GET /healthz (process up) and GET /readyz (ready to serve) for orchestrators.
GET /metrics for Prometheus: height, finality height, reorgs, peers, rejects, replacements. Alert rules and runbooks: Operating nodes → Monitoring.
GET /v1/admin/integrity (admin) verifies the chain state.

Admin routes

With ARREKTA_ADMIN_TOKEN set, Authorization: Bearer <token> unlocks /v1/admin/peers (list/connect), /v1/admin/bans, /v1/admin/mine (regtest and testnet) and /v1/admin/integrity (Admin API).

Faster start

A new node can start from a snapshot instead of verifying from genesis; see Snapshots.