Run a holder

Run a chain holder with Docker.

Help keep OneEur safe by keeping a full copy of every chain on your own machine. One command, no open ports, and it catches up by itself.

What a holder does

Keep a full copy of every chain.

Mirrors every chain

A holder keeps a full copy of every wallet’s chain and adds new blocks as the network confirms them, so the chains survive if any machine is lost.

Checks every block

It checks each block’s signature and the ledger rules itself and refuses anything that does not fit. It does not confirm payments; the primary does.

Only connects out

It connects to wss://gateway.oneeur.com over an encrypted WebSocket. No open ports, so it works behind a home router.

Before you start

What you need.

Requirements

Docker on Linux, macOS or Windows (Docker Desktop is fine). The image is built for amd64 and arm64.
Disk space that grows with the network: about 400 bytes per block.
An internet connection. No port forwarding or public IP is needed.
A name for your holder: 1 to 32 of a-z, 0-9, _ and -, unique in the network, for example your nickname and a number.

Run it

Four steps.

01 Start the container

Replace alice1 with your holder’s name:

docker run -d --name oneeur-holder --restart unless-stopped \
  -e ONEEUR_HOLDER_NAME=alice1 \
  -v oneeur-data:/data \
  -p 127.0.0.1:4100:4100 \
  maiduule/oneeur:latest

Or with Docker Compose: save this as docker-compose.yml, set the name, then run docker compose up -d.

services:
  holder:
    image: maiduule/oneeur:latest
    restart: unless-stopped
    environment:
      ONEEUR_HOLDER_NAME: change-me      # 1-32 of a-z 0-9 _ -
      # ONEEUR_STATUS_PASSWORD: pick-one # protect the status page
    volumes:
      - oneeur-data:/data                # the holder's key and chains: keep it
    ports:
      - "127.0.0.1:4100:4100"            # status page: http://127.0.0.1:4100
    stop_grace_period: 30s

volumes:
  oneeur-data:

02 Send your line to the network operator

On first start the holder creates its own key and prints its name and public key. Read it with docker logs oneeur-holder (or docker compose logs holder):

To be let in, send this line to the network operator:

    alice1=e73c9c2b10ff2fb8d5ca6e41396429cab605687e1a7963e579aed6d65edf2de2

Send that line to the network operator. It holds only the public key; the secret key never leaves the /data volume.

03 Wait to be added

Until the operator adds you, the holder retries every 30 seconds and its status page says “refused by the proxy”. You don’t need to do anything. Once added, it connects by itself, downloads every chain (a few minutes) and then keeps up.

04 Keep the volume

The /data volume holds the holder’s key (its identity) and the chains. Without it, a new key is made and has to be added again.

Watch it

The status page.

http://127.0.0.1:4100

Open it on the machine running the container. It shows whether the holder is online, catching up or offline, its blocks, wallets, disk use and blocks per minute, and its link to the network with the last connects and losses.

Publish the port only to 127.0.0.1 as above, or set ONEEUR_STATUS_PASSWORD to make the page ask for a password (user oneeur).

Settings

Environment variables.

ONEEUR_HOLDER_NAME: The holder’s name in the network.Required
ONEEUR_PROXY_URL: Where the holder connects.Default: wss://gateway.oneeur.com/holder/socket
ONEEUR_STATUS_PASSWORD: Password for the status page (user oneeur).Default: none
ONEEUR_STATUS_PORT: Status page port inside the container. 0 turns it off (and the health check then fails).Default: 4100

Keep it current

Updating.

Pull and restart

docker pull maiduule/oneeur:latest
docker rm -f oneeur-holder
docker run ...   # the same command as before

The key and chains stay in the volume. The restarted holder reads its chains in the background and catches up on what it missed.

What is in the image

The image holds no keys, secrets or chain data. It runs as an unprivileged user (oneeur, uid 10001) on Debian bookworm slim, and has a built-in health check on the status page.

Keep reading