<p>First off, the wallet API is not secure. It should never ever be open to the public without TLS client based authentication.</p>
<p>Second, by default it only listen on 127.0.0.1 (localhost loopback) to prevent people from accidentally running it on a public server open to the world. If you're absolutely sure you want to do this (which I would only do if you run in TLS mode with a CA authorizing a client certificate like Daedalus does by default), you would use this parameter:</p>
<pre><code>  --listen-address HOST    Specification of which host to the bind API server
                           to. Can be an IPv[46] address, hostname, or '*'.
                           (default: 127.0.0.1)
</code></pre>

CC BY-SA 4.0
2022-01-30T21:49:04.457Z
Yes, that's the next thing I need to figure out. I didn't want to install Apache, thinking it might conflict with the service. But SSL requires Apache on Ubuntu? Still researching, any pointers would be appreciated.
Jeffrey Berthiaume
CC BY-SA 4.0
2022-01-31T02:18:13.067Z
I personally would secure it with nginx doing ssl termination and a reverse proxy. Then you can also institute things like allow/deny lists, rate limiting, etc... at the service level before it hits the wallet webserver.
Samuel Leathers
CC BY-SA 4.0
2022-02-01T03:11:44.663Z
THANK YOU. That's actually in line with the advice I got from a dev ops friend this afternoon (he didn't know the details about Cardano, but he knows servers and security)
Jeffrey Berthiaume
CC BY-SA 4.0
2022-01-30T19:30:14.610Z
2022-01-30T19:30:14.610Z
Samuel Leathers
<p>I've set up a Cardano node using DigitalOcean's droplet, and I've gotten to the point where I can run:</p>
<pre><code>cardano-wallet serve
 --port 1337
 --mainnet 
 --database ~/cardano/db
 --node-socket ~/cardano/db/node.socket
</code></pre>
<p>However, I'm not able to access it publicly either via a web browser or using CURL.</p>
<pre><code>curl --url http://&lt;public ip address&gt;:1337/v2/network/information | jq
</code></pre>
<p>I've made sure the firewall rules allow inbound connections via TCP to port 1337 (all ipv4 and ipv6). Outbound supports all TCP and all UDP for all ports.</p>
<p>Any ideas?</p>

<wallet><cardano-cli><api>
How to enable cardano CLI REST API on DigitalOcean?
# How to enable cardano CLI REST API on DigitalOcean?

(Asked by: username_0 on 2022-01-30)

I've set up a Cardano node using DigitalOcean's droplet, and I've gotten to the point where I can run:
cardano-wallet serve
 --port 1337
 --mainnet 
 --database ~/cardano/db
 --node-socket ~/cardano/db/node.socket

However, I'm not able to access it publicly either via a web browser or using CURL.
curl --url http://:1337/v2/network/information | jq

I've made sure the firewall rules allow inbound connections via TCP to port 1337 (all ipv4 and ipv6). Outbound supports all TCP and all UDP for all ports.
Any ideas?

**Tags:** wallet, cardano-cli, api

---

## 1 answers

### Answer by username_1 on 2022-01-30. Score: 2 | Accepted answer

First off, the wallet API is not secure. It should never ever be open to the public without TLS client based authentication.
Second, by default it only listen on 127.0.0.1 (localhost loopback) to prevent people from accidentally running it on a public server open to the world. If you're absolutely sure you want to do this (which I would only do if you run in TLS mode with a CA authorizing a client certificate like Daedalus does by default), you would use this parameter:
  --listen-address HOST    Specification of which host to the bind API server
                           to. Can be an IPv[46] address, hostname, or '*'.
                           (default: 127.0.0.1)

> **Comments:**
> **username_0**: Yes, that's the next thing I need to figure out. I didn't want to install Apache, thinking it might conflict with the service. But SSL requires Apache on Ubuntu? Still researching, any pointers would be appreciated.  
> **username_1**: I personally would secure it with nginx doing ssl termination and a reverse proxy. Then you can also institute things like allow/deny lists, rate limiting, etc... at the service level before it hits the wallet webserver.  
> **username_0**: THANK YOU. That's actually in line with the advice I got from a dev ops friend this afternoon (he didn't know the details about Cardano, but he knows servers and security)  

---

