Reef chain

[anukulpandey]

What is this PR about?

New PR of Reef Chain

This PR updates the Reef Chain templates to the new stable2512 deployment flow and switches all runtime-fetched scripts to the dedicated scripts repository:

• https://github.com/anukulpandey/dokploy-reef-chain-scripts

Included changes

• Updated reef-bootnode to fetch bootstrap/runtime scripts from the new scripts repo
• Updated reef-validator to fetch the validator startup script from the new scripts repo
• Updated reef-rpc to fetch the RPC startup script from the new scripts repo
• Updated reef-spec-gen to fetch the spec generator API and helper scripts from the new scripts repo
• Updated reef-dev-cluster to stop downloading the old Makefile-based workflow and instead use the new non-tmux cluster launcher script
• Exposed 8545 in reef-dev-cluster for bundled eth-rpc
• Added a new reef-faucet template
• Updated Reef metadata and Docker Hub links in meta.json
• Removed dependency on the old reef-dokploy-templates-v2 raw GitHub paths

Why this change

This aligns the Reef templates with the newer stable2512 chain workflow and centralizes all runtime scripts in a single dedicated repository so Dokploy services fetch a stable, maintained source at startup.

Checklist

Before submitting this PR, please make sure that:

• I have read the suggestions in the README.md file https://github.com/Dokploy/templates?tab=readme-ov-file#general-requirements-when-creating-a-template
• I have tested the template in my instance, so the maintainers don't spend time trying to figure out what's wrong.
• I have added tests that demonstrate that my correction works or that my new feature works.

Issues related (if applicable)

Close automatically the related issues using the keywords: closes #ISSUE_NUMBER

Screenshots or Videos

N/A

Greptile Summary

This PR updates all Reef Chain templates to the stable2512 workflow, centralizes runtime scripts in a dedicated external repository, and adds a new reef-faucet template. Several structural issues conflict with the project's Docker Compose conventions documented in AGENTS.md and need to be addressed before merging:

• Every template uses ports instead of the required expose, missing restart policy, and most lack the required version: \"3.8\" header.
• The reef-spec-gen service is named reef-spec-api, breaking the mandatory folder-name match and the domain config in its template.toml.
• Multiple template.toml files hardcode the same validator private-key seeds as default values (including FAUCET_SEED), violating the "never hardcode secrets" rule.
• All templates download startup scripts from the mutable main branch of an external repo without hash verification, creating a supply-chain risk.

Confidence Score: 3/5

Not safe to merge — multiple P1 violations of documented Dokploy conventions, a service naming mismatch that breaks domain routing, hardcoded validator private-key seeds, and unpinned external script downloads creating supply-chain exposure.

Five P1 findings are present: (1) all templates use ports instead of the mandatory expose, (2) none have a restart policy, (3) five templates omit version: "3.8" and one uses "3.9", (4) the reef-spec-gen service name mismatch will break its domain config, and (5) hardcoded default private-key seeds across four templates violate the no-secrets rule and introduce a real security risk on any default deployment.

All docker-compose.yml files (ports/restart/version), blueprints/reef-spec-gen/docker-compose.yml (service name), and all template.toml files that hardcode seed values (reef-bootnode, reef-dev-cluster, reef-validator, reef-faucet).

Vulnerabilities

• Hardcoded private-key seeds: reef-bootnode, reef-dev-cluster, reef-validator, and reef-faucet all ship the same three validator seeds as default template.toml values. A default deployment controls a live chain with publicly-known signing keys and a known faucet treasury key.
• Supply-chain risk via unpinned external scripts: Every template downloads shell/Python/JS scripts from anukulpandey/dokploy-reef-chain-scripts on the main branch at startup with no checksum validation. A compromised or modified push to that repo will silently affect all running deployments on next restart.

_{Reviews (1): Last reviewed commit: "Wire Reef templates to external scripts ..." | Re-trigger Greptile}

Greptile also left 6 inline comments on this PR.

_{(3/5) Reply to the agent's comments like "Can you suggest a fix for this @greptileai?" or ask follow-up questions!}

Context used:

• Context used - AGENTS.md (source)

[Siumauricio]

Automated template check 🤖

This PR's template was imported into a test Dokploy instance (using the docker-compose.yml + template.toml from the PR head) and deployed, and its configured domains were then checked over HTTP.

Result: ❌ some issues need attention

reef-bootnode

• Deploy: done (37s)
• Domain checks:
  • reef-bootnode:8000 → HTTP 404 ❌
  • reef-bootnode:8000 → HTTP 404 ❌
• Container states at failure time: reef-bootnode-1: restarting
• Issues:
  • domain check failed for service reef-bootnode:8000 (path /): kept returning HTTP 404 for 3 minutes after the deploy finished
  • domain check failed for service reef-bootnode:8000 (path /): kept returning HTTP 404 for 3 minutes after the deploy finished

reef-dev-cluster

• Deploy: done (195s)
• Domain checks:
  • reef-dev-cluster:8001 → HTTP 200 ✅
  • reef-dev-cluster:8001 → HTTP 200 ✅
  • reef-dev-cluster:9945 → HTTP 405 ✅
  • reef-dev-cluster-eth-rpc:8545 → HTTP 405 ✅
  • reef-dev-cluster:8080 → HTTP 200 ✅

reef-eth-rpc

• Deploy: done (12s)
• Domain checks:
  • reef-eth-rpc:8545 → HTTP 502 ❌
  • reef-eth-rpc:8545 → HTTP 502 ❌
• Container states at failure time: reef-eth-rpc-1: running
• Issues:
  • domain check failed for service reef-eth-rpc:8545 (path /): kept returning HTTP 502 for 3 minutes after the deploy finished
  • domain check failed for service reef-eth-rpc:8545 (path /): kept returning HTTP 502 for 3 minutes after the deploy finished

reef-faucet

• Deploy: done (12s)
• Domain checks:
  • reef-faucet:8080 → HTTP 502 ❌
  • reef-faucet:8080 → HTTP 404 ❌
• Container states at failure time: reef-faucet-1: restarting
• Issues:
  • domain check failed for service reef-faucet:8080 (path /): kept returning HTTP 502 for 3 minutes after the deploy finished
  • domain check failed for service reef-faucet:8080 (path /): kept returning HTTP 404 for 3 minutes after the deploy finished

reef-keygen

• Deploy: done (12s)
• Domain checks:
  • reef-keygen:48765 → HTTP 200 ✅

reef-rpc

• Deploy: done (12s)
• Domain checks:
  • reef-rpc:9994 → HTTP 404 ❌
  • reef-rpc:9994 → HTTP 404 ❌
• Container states at failure time: reef-rpc-1: restarting
• Issues:
  • domain check failed for service reef-rpc:9994 (path /): kept returning HTTP 404 for 3 minutes after the deploy finished
  • domain check failed for service reef-rpc:9994 (path /): kept returning HTTP 404 for 3 minutes after the deploy finished

reef-spec-gen

• Deploy: done (12s)
• Domain checks:
  • reef-spec-gen:8000 → HTTP 404 ❌
  • reef-spec-gen:8000 → HTTP 404 ❌

reef-validator

• Deploy: done (12s)

The test service is removed automatically after verification. Happy to re-test once the PR is updated.

[Siumauricio]

Thanks for the contribution — and for your patience on this one. I re-tested all 8 templates on a clean Dokploy instance and did a scope review. Summary below.

Test results (fresh deploys, defaults only)

Template	Result	Notes
reef-dev-cluster	✅ Works	Self-contained network: spec server (8001), WS RPC (9945), ETH RPC (8545) and faucet (8080) all respond on their domains. Verified over JSON-RPC: system_health → 4 peers / not syncing, eth_blockNumber → blocks being produced, eth_chainId → 0x3673; faucet reports status: ok.
reef-keygen	✅ Works	HTTP 200, serves the generated validator keys.
reef-bootnode	❌ Not one-click	run.sh exits immediately: V1_ADDR/V1_SEED/... are required but the template defaults are empty. The user must first deploy keygen and hand-copy 6 values.
reef-rpc	❌ Broken defaults	SPEC_URL/BOOTNODE_NODE_KEY default to http://spec.reef.host/... and BOOTNODE_IP=72.60.35.83 — spec.reef.host does not resolve (DNS) and the bootnode port on that IP is closed, so the node can never start with defaults.
reef-validator	❌ Broken defaults	Same dead spec.reef.host / 72.60.35.83 defaults, plus it needs a seed from keygen.
reef-eth-rpc	❌ Broken defaults	NODE_RPC_URL=ws://ws.reef.host does not resolve → container can't connect (this is the 502 seen in earlier testing).
reef-faucet	❌ Broken defaults	ws://ws.reef.host / http://eth.reef.host are dead, and FAUCET_SEED is required but empty.
reef-spec-gen	⚠️ Only useful as part of the multi-VPS kit	Runs standalone, but has no purpose outside the bootnode/validator wiring flow.

Scope decision

Dokploy templates need to work one-click with their defaults. Six of the eight templates form a multi-VPS "build your own network" kit that requires manual cross-deployment wiring (keygen → bootnode → spec URL → validators/RPC), and their defaults point at personal infrastructure (*.reef.host, 72.60.35.83) that is currently offline. Those can't be shipped as one-click templates.

Since maintainer edits are allowed on this PR, I've reduced it to the subset that genuinely works out of the box:

• Kept: reef-dev-cluster (the real product here — a full self-contained Reef dev network with validators, WS/ETH RPC and faucet) and reef-keygen (standalone key-generation utility).
• Removed: reef-bootnode, reef-rpc, reef-validator, reef-spec-gen, reef-eth-rpc, reef-faucet. If you want to resubmit the distributed kit later, it would need self-sufficient defaults (no dependency on external hosts you run) — happy to review that as a separate PR.

Also pushed: merge of latest canary and a minor TOML formatting fix. The runtime script downloads are pinned to commit d8a8242, which is part of this PR's history and stays fetchable through the upstream repo network, so the kept templates are reproducible.

One note for users of reef-keygen: the generated keys are served on a public unauthenticated domain — fine for throwaway dev keys, which is its stated purpose, but worth keeping in mind.

Verified: @anukulpandey is a Reef core contributor (member of the reef-chain org with 1k+ commits there); the anukulpandey/reef-chain-node / reef-chain-eth-rpc images are his builds of reef-chain/chain-upgrade — there is currently no official Reef image for this branch.