401 Status code while dry-run operation

Question

With hangzhou2net update we've faced weird behaviour regarding acl rpc policy. Request to chains/main/blocks/head/helpers/scripts/run_operation/ fails with 401 status code. We are hosting our node using docker-compose

version: "3"
services:
  testnet:
    image: tezos/tezos:11.0.0
    command: ["tezos-node"]
    hostname: node
    ports:
      - "8732:8732"
      - "9732:9732/udp"
    volumes:
      - "./config.json:/home/tezos/.tezos-node/config.json"
      - "./data/tezos:/var/run/tezos/node/"

The config file is:

{ "data-dir": "/var/run/tezos/node/data",
  "rpc":
    { "listen-addrs": [ ":8732" ],
      "acl":
        [ { "address": ":8732", "blacklist": [] } ] },
  "p2p":
    { "bootstrap-peers":
        [ "hangzhounet.teztnets.xyz", "hangzhounet.kaml.fr",
          "hangzhounet.smartpy.io", "hangzhounet.tezos.co.il",
          "hangzhounet.boot.tez.ie" ], "listen-addr": "[::]:9732",
      "limits":
        { "connection-timeout": 10, "max-download-speed": 2048,
          "max-upload-speed": 2048, "max_known_points": [ 400, 300 ],
          "max_known_peer_ids": [ 400, 300 ] } },
  "shell":
    { "chain_validator": { "synchronisation_threshold": 5 },
      "history_mode": "archive" }, "network": "hangzhounet" }

While node startup we see log message:

Dec  1 12:13:55.685 - node.main: FULL access to RPC enabled; this is very risky. (addresses = :8732)

so i assume the ACL is completely disabled.

Other requests (for instance chains/main/blocks/head runs fine).

Looks like the issue is specific to hangzhou2net, because nearly same setup works as expected at granadanet

EDIT: solved with help @dmirg i've updated docker-compose to:

version: "3"
services:
  testnet:
    image: tezos/tezos:11.0.0
    command: ["tezos-node", "--allow-all-rpc 0.0.0.0:8732", "--rpc-addr 0.0.0.0:8732"]
    hostname: node
    network_mode: host
    volumes:
      - "./config.json:/home/tezos/.tezos-node/config.json"
      - "./data/tezos:/var/run/tezos/node/"

Answer 1

You need to modify your config to allow remote access by adding 0.0.0.0 to listen-addrs and acl address:

{ "data-dir": "/var/run/tezos/node/data",
  "rpc":
    { "listen-addrs": [ "0.0.0.0:8732" ],
      "acl":
        [ { "address": "0.0.0.0:8732", "blacklist": [] } ] },
  "p2p":
    { "bootstrap-peers":
        [ "hangzhounet.teztnets.xyz", "hangzhounet.kaml.fr",
          "hangzhounet.smartpy.io", "hangzhounet.tezos.co.il",
          "hangzhounet.boot.tez.ie" ], "listen-addr": "[::]:9732",
      "limits":
        { "connection-timeout": 10, "max-download-speed": 2048,
          "max-upload-speed": 2048, "max_known_points": [ 400, 300 ],
          "max_known_peer_ids": [ 400, 300 ] } },
  "shell":
    { "chain_validator": { "synchronisation_threshold": 5 },
      "history_mode": "archive" }, "network": "hangzhounet" }

For running node from the sh scrip it will be something like ./mainnet.sh node start --rpc-addr 0.0.0.0:8732 --allow-all-rpc 0.0.0.0:8732