Nonceworks
MenuClose

One Compose project per team

The control plane turns your files into a Docker Compose project and has no part in the traffic after that. The processes that talk to your chain are the upstream binaries as published.

Yours Nonceworks host Yours Your config monitors, triggers, networks Your secrets RPC URLs, webhook URLs, tokens Your KMS AWS, Google Cloud or Turnkey the key stays here Control plane checks, renders and applies Your stack: its own network and volumes Monitor 1.6.0, as shipped Relayer 1.8.0, as shipped Redis state store another team's stack, kept apart Your alerts Slack, Telegram, webhooks Your chain your RPC endpoints upload compose up env files sign alerts blocks tx
Your config monitors, triggers, networks Your secrets RPC URLs, webhook URLs, tokens Nonceworks host Control plane checks, renders and applies Your stack: its own network and volumes Monitor 1.6.0, as shipped Relayer 1.8.0, as shipped Redis Your alerts Slack, email Your chain your RPC endpoints Your KMS the key stays here upload env files compose up alerts blocks tx sign

Inside a stack

ProcessImageRole
Monitoropenzeppelin/openzeppelin-monitor:v1.6.0Watches blocks on your networks, evaluates your monitors/, fires your triggers/.
Relayeropenzeppelin/openzeppelin-relayer:v1.8.0Takes transaction requests on its API, prices them, signs through your KMS, submits, tracks status, and posts webhooks.
Redisredis:bookwormThe relayer's transaction store and nonce counter, with append-only persistence, so a restart keeps pending transactions. One per team.
ReceivernoneWebhooks go to your endpoint, signed with your WEBHOOK_SIGNING_KEY. Nonceworks is not in that path.

All three images are pinned by digest; the digests are on the operations page.

The control plane

  1. Unpacks your export, checks that every file parses and that every monitor references a network and triggers that exist, and lists every secret reference it finds (environment for the Monitor, env for the relayer).
  2. Writes the secret values you send, encrypted to the age key, into two environment files, one per container (mode 0600). The Monitor gets only what its configuration references; provider credentials go to the Relayer alone. Credentials and tokens never land in config/; RPC URLs do, because Relayer 1.8.0 takes them only as plain strings. The relayer config it accepts refuses local signers and any plain-text key field; only aws_kms, google_cloud_kms and turnkey pass.
  3. Recreates only the containers whose inputs changed, so a Monitor config change restarts the Monitor alone (it has no hot reload), and exposes status and logs for that project only, behind an admin token.

Boundaries

Each team has its own containers, network, Redis, environment and logs. The host and the Docker daemon are shared, and we have access to all of it. Your key is never on the host.

Network

A stack only needs to reach your RPC URLs, your KMS endpoint, and your webhook and chat endpoints. Other outbound traffic is not blocked today.

Validator report

The validator page shows the control plane's report on a sample export.