Common configuration

SignerConfig

The SignerConfig struct is the primary configuration object used to initialize a signer. It’s defined in the go_signer library and specifies how and where cryptographic signing operations are performed.

The configuration supports multiple signer types. To use it, set the desired signer type in the Method field. The remaining configuration parameters will vary depending on the selected method.

The main methods are:

Keystore (local)

Use this method to sign with a local keystore file.

Example:

[AggSender]
AggsenderPrivateKey = { Method="local", Path="/opt/private_key.kestore", Password="xdP6G8gV9PYs" }

Google Cloud KMS (GCP)

Use this method to sign using the Google Cloud KMS infrastructure.

Example:

[AggSender]
AggsenderPrivateKey = { Method="GCP", KeyName="projects/your-prj-name/locations/your_location/keyRings/name_of_your_keyring/cryptoKeys/key-name/cryptoKeyVersions/version"}

Amazon Web Services KMS (AWS)

Use this method to sign using the AWS KMS infrastructure. The key type must be ECC_SECG_P256K1 to ensure compatibility.

Example:

[AggSender]
AggsenderPrivateKey = { Method="AWS", KeyName="a47c263b-6575-4835-8721-af0bbb97XXXX"}

Others

Additional signing methods are available. For a complete list and detailed configuration options, please refer to the go_signer library documentation (v0.0.7)

ClientConfig

The ClientConfig structure configures the gRPC client connection. It includes the following fields:

RetryConfig

The RetryConfig structure configures the retry behavior for failed gRPC requests:

Example:

[AggSender]
    [AggSender.AgglayerClient]
		URL = "http://localhost:9000"
		MinConnectTimeout = "5s"
		RequestTimeout = "300s" 
		UseTLS = false
		[AggSender.AgglayerClient.Retry]
			InitialBackoff = "1s"
			MaxBackoff = "10s"
			BackoffMultiplier = 2.0
			MaxAttempts = 16

Method

The Method type represents a gRPC method configuration with the following fields:

This type is used to specify methods that should be excluded from retry policies. The ServiceName field is required and should include both the package and service name.

Example:

[AggSender]
    [AggSender.AgglayerClient]
        [AggSender.AgglayerClient.Retry]
            Excluded = [
                { Service = "agglayer.Agglayer", Method = "SubmitCertificate" },
                { Service = "agglayer.Agglayer", Method = "GetStatus" }
            ]

RateLimitConfig

The RateLimitConfig structure configures rate limiting behavior. If either NumRequests or Interval is set to 0, rate limiting is disabled.

Example:

[AggSender]
    [AggSender.MaxSubmitCertificateRate]
        NumRequests = 20
        Interval = "1h"

When rate limiting is enabled, if the number of requests exceeds NumRequests within the specified Interval, the system will wait until the next interval before allowing more requests. This helps prevent overwhelming the system with too many requests in a short period.

RESTConfig

RESTConfig configures a shared Gin-based HTTP server. It backs the REST sections in the config: [PublicREST], [AdminREST], and the proxy’s [REST].

MaxRequestsPerIPAndSecond is not enforced: aggkit does not rate-limit requests in-process. Its default is 0 (unlimited). If you need per-IP request throttling, apply it at the fronting reverse proxy / API gateway / ingress — that is also where it is most effective, since a service sitting behind a proxy typically sees every client as the proxy’s single IP, making in-process per-IP limiting ineffective anyway.

CORSConfig

CORSConfig configures Cross-Origin Resource Sharing headers, so the REST service can be called from a browser-based client hosted on a different origin. Disabled by default, which preserves the current behavior (no CORS headers, so browsers block cross-origin requests).

Example, enabling CORS for the proxy’s [REST] section for a frontend hosted at https://example.com:

[REST.CORS]
Enabled = true
AllowedOrigins = ["https://example.com"]
AllowedMethods = ["GET", "POST", "OPTIONS"]
AllowedHeaders = ["Content-Type", "Authorization"]
AllowCredentials = false
MaxAge = "12h"

Note that the [RPC] section is not a RESTConfig: it is the JSON-RPC server config from github.com/0xPolygon/cdk-rpc, whose MaxRequestsPerIPAndSecond is enforced (via tollbooth). There, 0 does not mean unlimited — tollbooth.NewLimiter(0, ...) produces a limiter with a burst of 1 and no refill, i.e. one request per IP ever. Its default stays 10.

RPCClientConfig

RPCClientConfig configures the JSON-RPC client used to connect to Ethereum nodes. It is used in multiple places, notably [L1NetworkConfig.RPC] (L1 node) and [Common.L2RPC] (L2 node).

Example:

[L1NetworkConfig.RPC]
URL = "http://localhost:8545"
Mode = "basic"
HashFromJSON = false
BatchBlockHeaderRetrieval = true
RetryMode = "backoff"
MaxRetries = 5
InitialBackoff = "5s"
MaxBackoff = "60s"
BackoffMultiplier = 2.0

[Common.L2RPC]
URL = "http://localhost:8123"
Mode = "basic"
HashFromJSON = true
BatchBlockHeaderRetrieval = true
RetryMode = "delays"
MaxRetries = 6
Delays = ["1s", "2s", "5s", "10s", "30s", "60s"]

AutoClaim

AutoClaim configures the optional Auto Claim runtime, which automates both L1-to-L2 and L2-to-Lx (L2-to-L1, L2-to-L2) bridge claims. It is disabled by default. To enable it, select the autoclaim component (there is no separate enable flag), configure storage, and add at least one enabled EVM claimer for the destination network.

Auto Claim requires l1bridgesync and l1infotreesync when enabled. [AutoClaim.BridgeServiceFinder].RollupManagerAddr is required whenever [AutoClaim.L2ToLxBridgeDetector].Enabled = true or any enabled claimer has an L2 destination (NetworkID != 0), in either direction — the finder resolves rollup bridge service URLs both as sources (bridge discovery and claim-proof fetch) and as destinations (the per-claimer GER-injection readiness gate, which replaced the previous per-claimer l2gersync instance). There are no longer per-claimer BlockFinality / InitialBlockNum config keys, since claimers no longer run their own GER syncer. The optional REST API uses /autoclaim/v1 for request inspection and manual approvals.

See Auto Claim Service for the complete configuration table, policy behavior, lifecycle, and API workflow.