From 4360d516c9955f2be65b332c9c76b5eb65edc1d2 Mon Sep 17 00:00:00 2001
From: Julian Meyer <julian.meyer@coinbase.com>
Date: Thu, 5 Mar 2026 10:22:27 -0800
Subject: [PATCH 1/9] feat: replace op-node with base-consensus

---
 .env.mainnet                     | 28 +++++++++++++++---
 .env.sepolia                     | 28 +++++++++++++++---
 .gitignore                       |  2 +-
 base-consensus-entrypoint        | 51 ++++++++++++++++++++++++++++++++
 consensus-entrypoint             | 10 +++++++
 docker-compose.yml               |  2 +-
 geth/Dockerfile                  | 19 ++++++++++++
 geth/geth-entrypoint             |  6 ++--
 nethermind/Dockerfile            | 21 ++++++++++++-
 nethermind/nethermind-entrypoint |  8 ++---
 reth/Dockerfile                  |  5 +++-
 reth/reth-entrypoint             | 32 ++++++++++++++++----
 supervisord.conf                 |  4 +--
 13 files changed, 189 insertions(+), 27 deletions(-)
 create mode 100755 base-consensus-entrypoint
 create mode 100755 consensus-entrypoint

diff --git a/.env.mainnet b/.env.mainnet
index ee9354265..2b689d6ed 100644
--- a/.env.mainnet
+++ b/.env.mainnet
@@ -5,6 +5,7 @@
 # --------------------
 RETH_CHAIN=base
 OP_NODE_NETWORK=base-mainnet
+BASE_NODE_NETWORK=8453
 OP_GETH_OP_NETWORK=base-mainnet
 
 # BASE SEQUENCER ENDPOINTS
@@ -14,13 +15,13 @@ OP_SEQUENCER_HTTP=https://mainnet-sequencer.base.org
 OP_GETH_SEQUENCER_HTTP=https://mainnet-sequencer.base.org
 OP_RETH_SEQUENCER_HTTP=https://mainnet-sequencer.base.org
 
-# SYNC CONFIGURATION
+# SYNC CONFIGURATION (deprecated)
 # -----------------
 OP_NODE_SYNCMODE=execution-layer
 OP_NODE_VERIFIER_L1_CONFS=4
 OP_NODE_ROLLUP_LOAD_PROTOCOL_VERSIONS=true
 
-# [REQUIRED] L1 CONFIGURATION 
+# [REQUIRED] L1 CONFIGURATION
 # --------------------------
 # Replace these values with your L1 (Ethereum) node endpoints
 OP_NODE_L1_ETH_RPC=<your-preferred-l1-rpc>
@@ -30,6 +31,10 @@ OP_NODE_L1_BEACON_FETCH_ALL_SIDECARS="true"
 OP_NODE_L1_RPC_KIND="debug_geth"
 OP_NODE_L1_TRUST_RPC="false"
 
+BASE_NODE_L1_ETH_RPC=<your-preferred-l1-rpc>
+BASE_NODE_L1_BEACON=<your-preferred-l1-beacon>
+BASE_NODE_L1_TRUST_RPC="false"
+
 # ENGINE CONFIGURATION
 # -------------------
 OP_NODE_L2_ENGINE_KIND=reth
@@ -37,6 +42,10 @@ OP_NODE_L2_ENGINE_RPC=ws://execution:8551
 OP_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
 OP_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
 
+BASE_NODE_L2_ENGINE_RPC=ws://execution:8551
+BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
+BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
+
 # P2P CONFIGURATION
 # ---------------
 OP_NODE_P2P_AGENT=base
@@ -46,13 +55,18 @@ OP_NODE_P2P_LISTEN_UDP_PORT=9222
 OP_NODE_INTERNAL_IP="true"
 OP_NODE_P2P_BOOTNODES=enr:-J24QNz9lbrKbN4iSmmjtnr7SjUMk4zB7f1krHZcTZx-JRKZd0kA2gjufUROD6T3sOWDVDnFJRvqBBo62zuF-hYCohOGAYiOoEyEgmlkgnY0gmlwhAPniryHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQKNVFlCxh_B-716tTs-h1vMzZkSs1FTu_OYTNjgufplG4N0Y3CCJAaDdWRwgiQG,enr:-J24QH-f1wt99sfpHy4c0QJM-NfmsIfmlLAMMcgZCUEgKG_BBYFc6FwYgaMJMQN5dsRBJApIok0jFn-9CS842lGpLmqGAYiOoDRAgmlkgnY0gmlwhLhIgb2Hb3BzdGFja4OFQgCJc2VjcDI1NmsxoQJ9FTIv8B9myn1MWaC_2lJ-sMoeCDkusCsk4BYHjjCq04N0Y3CCJAaDdWRwgiQG,enr:-J24QDXyyxvQYsd0yfsN0cRr1lZ1N11zGTplMNlW4xNEc7LkPXh0NAJ9iSOVdRO95GPYAIc6xmyoCCG6_0JxdL3a0zaGAYiOoAjFgmlkgnY0gmlwhAPckbGHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQJwoS7tzwxqXSyFL7g0JM-KWVbgvjfB8JA__T7yY_cYboN0Y3CCJAaDdWRwgiQG,enr:-J24QHmGyBwUZXIcsGYMaUqGGSl4CFdx9Tozu-vQCn5bHIQbR7On7dZbU61vYvfrJr30t0iahSqhc64J46MnUO2JvQaGAYiOoCKKgmlkgnY0gmlwhAPnCzSHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQINc4fSijfbNIiGhcgvwjsjxVFJHUstK9L1T8OTKUjgloN0Y3CCJAaDdWRwgiQG,enr:-J24QG3ypT4xSu0gjb5PABCmVxZqBjVw9ca7pvsI8jl4KATYAnxBmfkaIuEqy9sKvDHKuNCsy57WwK9wTt2aQgcaDDyGAYiOoGAXgmlkgnY0gmlwhDbGmZaHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQIeAK_--tcLEiu7HvoUlbV52MspE0uCocsx1f_rYvRenIN0Y3CCJAaDdWRwgiQG
 
+BASE_NODE_P2P_LISTEN_IP=0.0.0.0
+BASE_NODE_P2P_ADVERTISE_TCP_PORT=9222
+BASE_NODE_P2P_ADVERTISE_UDP_PORT=9222
+BASE_NODE_P2P_BOOTNODES=enr:-J24QNz9lbrKbN4iSmmjtnr7SjUMk4zB7f1krHZcTZx-JRKZd0kA2gjufUROD6T3sOWDVDnFJRvqBBo62zuF-hYCohOGAYiOoEyEgmlkgnY0gmlwhAPniryHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQKNVFlCxh_B-716tTs-h1vMzZkSs1FTu_OYTNjgufplG4N0Y3CCJAaDdWRwgiQG,enr:-J24QH-f1wt99sfpHy4c0QJM-NfmsIfmlLAMMcgZCUEgKG_BBYFc6FwYgaMJMQN5dsRBJApIok0jFn-9CS842lGpLmqGAYiOoDRAgmlkgnY0gmlwhLhIgb2Hb3BzdGFja4OFQgCJc2VjcDI1NmsxoQJ9FTIv8B9myn1MWaC_2lJ-sMoeCDkusCsk4BYHjjCq04N0Y3CCJAaDdWRwgiQG,enr:-J24QDXyyxvQYsd0yfsN0cRr1lZ1N11zGTplMNlW4xNEc7LkPXh0NAJ9iSOVdRO95GPYAIc6xmyoCCG6_0JxdL3a0zaGAYiOoAjFgmlkgnY0gmlwhAPckbGHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQJwoS7tzwxqXSyFL7g0JM-KWVbgvjfB8JA__T7yY_cYboN0Y3CCJAaDdWRwgiQG,enr:-J24QHmGyBwUZXIcsGYMaUqGGSl4CFdx9Tozu-vQCn5bHIQbR7On7dZbU61vYvfrJr30t0iahSqhc64J46MnUO2JvQaGAYiOoCKKgmlkgnY0gmlwhAPnCzSHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQINc4fSijfbNIiGhcgvwjsjxVFJHUstK9L1T8OTKUjgloN0Y3CCJAaDdWRwgiQG,enr:-J24QG3ypT4xSu0gjb5PABCmVxZqBjVw9ca7pvsI8jl4KATYAnxBmfkaIuEqy9sKvDHKuNCsy57WwK9wTt2aQgcaDDyGAYiOoGAXgmlkgnY0gmlwhDbGmZaHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQIeAK_--tcLEiu7HvoUlbV52MspE0uCocsx1f_rYvRenIN0Y3CCJAaDdWRwgiQG
+
 # RETH CONFIGURATION
 # ----------------
 OP_RETH_DISABLE_DISCOVERY="false"
 OP_RETH_DISABLE_TX_POOL_GOSSIP="true"
 OP_RETH_OP_NETWORK="base"
 
-# RPC CONFIGURATION
+# RPC CONFIGURATION (deprecated)
 # ---------------
 OP_NODE_RPC_ADDR=0.0.0.0
 OP_NODE_RPC_PORT=8545
@@ -74,6 +88,12 @@ OP_NODE_SNAPSHOT_LOG=/tmp/op-node-snapshot-log
 OP_NODE_METRICS_ENABLED="true"
 OP_NODE_METRICS_ADDR=0.0.0.0
 OP_NODE_METRICS_PORT="7300"
+
+BASE_NODE_LOG_VERBOSITY=3
+BASE_NODE_LOG_FORMAT="json"
+BASE_NODE_METRICS_ENABLED="true"
+BASE_NODE_METRICS_ADDR=0.0.0.0
+BASE_NODE_METRICS_PORT="7300"
 STATSD_ADDRESS="172.17.0.1"
 
 # OPTIONAL SETTINGS
@@ -85,7 +105,7 @@ STATSD_ADDRESS="172.17.0.1"
 # OP_NETHERMIND_ETHSTATS_NODE_NAME=NethermindNode
 # OP_NETHERMIND_ETHSTATS_ENDPOINT=ethstats_endpoint
 
-# TRUSTED RPC MODE (OPTIONAL - UNCOMMENT TO ENABLE)
+# TRUSTED RPC MODE (OPTIONAL - UNCOMMENT TO ENABLE) (deprecated)
 # OP_NODE_L1_TRUST_RPC=true
 
 # SNAP SYNC (OPTIONAL EXPERIMENTAL FEATURE - UNCOMMENT TO ENABLE)
diff --git a/.env.sepolia b/.env.sepolia
index b78fc8722..7d037c176 100644
--- a/.env.sepolia
+++ b/.env.sepolia
@@ -5,6 +5,7 @@
 # --------------------
 RETH_CHAIN=base-sepolia
 OP_NODE_NETWORK=base-sepolia
+BASE_NODE_NETWORK=84532
 OP_GETH_OP_NETWORK=base-sepolia
 
 # BASE SEQUENCER ENDPOINTS
@@ -14,13 +15,13 @@ OP_SEQUENCER_HTTP=https://sepolia-sequencer.base.org
 OP_GETH_SEQUENCER_HTTP=https://sepolia-sequencer.base.org
 OP_RETH_SEQUENCER_HTTP=https://sepolia-sequencer.base.org
 
-# SYNC CONFIGURATION
+# SYNC CONFIGURATION (deprecated)
 # -----------------
 OP_NODE_SYNCMODE=execution-layer
 OP_NODE_VERIFIER_L1_CONFS=4
 OP_NODE_ROLLUP_LOAD_PROTOCOL_VERSIONS=true
 
-# [REQUIRED] L1 CONFIGURATION 
+# [REQUIRED] L1 CONFIGURATION
 # --------------------------
 # Replace these values with your L1 (Ethereum) node endpoints
 OP_NODE_L1_ETH_RPC=<your-preferred-l1-rpc>
@@ -30,6 +31,10 @@ OP_NODE_L1_BEACON_FETCH_ALL_SIDECARS="true"
 OP_NODE_L1_RPC_KIND="debug_geth"
 OP_NODE_L1_TRUST_RPC="false"
 
+BASE_NODE_L1_ETH_RPC=<your-preferred-l1-rpc>
+BASE_NODE_L1_BEACON=<your-preferred-l1-beacon>
+BASE_NODE_L1_TRUST_RPC="false"
+
 # ENGINE CONFIGURATION
 # -------------------
 OP_NODE_L2_ENGINE_KIND=reth
@@ -37,6 +42,10 @@ OP_NODE_L2_ENGINE_RPC=ws://execution:8551
 OP_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
 OP_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
 
+BASE_NODE_L2_ENGINE_RPC=ws://execution:8551
+BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
+BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
+
 # P2P CONFIGURATION
 # ---------------
 OP_NODE_P2P_AGENT=base
@@ -46,13 +55,18 @@ OP_NODE_P2P_LISTEN_UDP_PORT=9222
 OP_NODE_INTERNAL_IP="true"
 OP_NODE_P2P_BOOTNODES=enr:-J24QNz9lbrKbN4iSmmjtnr7SjUMk4zB7f1krHZcTZx-JRKZd0kA2gjufUROD6T3sOWDVDnFJRvqBBo62zuF-hYCohOGAYiOoEyEgmlkgnY0gmlwhAPniryHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQKNVFlCxh_B-716tTs-h1vMzZkSs1FTu_OYTNjgufplG4N0Y3CCJAaDdWRwgiQG,enr:-J24QH-f1wt99sfpHy4c0QJM-NfmsIfmlLAMMcgZCUEgKG_BBYFc6FwYgaMJMQN5dsRBJApIok0jFn-9CS842lGpLmqGAYiOoDRAgmlkgnY0gmlwhLhIgb2Hb3BzdGFja4OFQgCJc2VjcDI1NmsxoQJ9FTIv8B9myn1MWaC_2lJ-sMoeCDkusCsk4BYHjjCq04N0Y3CCJAaDdWRwgiQG,enr:-J24QDXyyxvQYsd0yfsN0cRr1lZ1N11zGTplMNlW4xNEc7LkPXh0NAJ9iSOVdRO95GPYAIc6xmyoCCG6_0JxdL3a0zaGAYiOoAjFgmlkgnY0gmlwhAPckbGHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQJwoS7tzwxqXSyFL7g0JM-KWVbgvjfB8JA__T7yY_cYboN0Y3CCJAaDdWRwgiQG,enr:-J24QHmGyBwUZXIcsGYMaUqGGSl4CFdx9Tozu-vQCn5bHIQbR7On7dZbU61vYvfrJr30t0iahSqhc64J46MnUO2JvQaGAYiOoCKKgmlkgnY0gmlwhAPnCzSHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQINc4fSijfbNIiGhcgvwjsjxVFJHUstK9L1T8OTKUjgloN0Y3CCJAaDdWRwgiQG,enr:-J24QG3ypT4xSu0gjb5PABCmVxZqBjVw9ca7pvsI8jl4KATYAnxBmfkaIuEqy9sKvDHKuNCsy57WwK9wTt2aQgcaDDyGAYiOoGAXgmlkgnY0gmlwhDbGmZaHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQIeAK_--tcLEiu7HvoUlbV52MspE0uCocsx1f_rYvRenIN0Y3CCJAaDdWRwgiQG
 
+BASE_NODE_P2P_LISTEN_IP=0.0.0.0
+BASE_NODE_P2P_ADVERTISE_TCP_PORT=9222
+BASE_NODE_P2P_ADVERTISE_UDP_PORT=9222
+BASE_NODE_P2P_BOOTNODES=enr:-J24QNz9lbrKbN4iSmmjtnr7SjUMk4zB7f1krHZcTZx-JRKZd0kA2gjufUROD6T3sOWDVDnFJRvqBBo62zuF-hYCohOGAYiOoEyEgmlkgnY0gmlwhAPniryHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQKNVFlCxh_B-716tTs-h1vMzZkSs1FTu_OYTNjgufplG4N0Y3CCJAaDdWRwgiQG,enr:-J24QH-f1wt99sfpHy4c0QJM-NfmsIfmlLAMMcgZCUEgKG_BBYFc6FwYgaMJMQN5dsRBJApIok0jFn-9CS842lGpLmqGAYiOoDRAgmlkgnY0gmlwhLhIgb2Hb3BzdGFja4OFQgCJc2VjcDI1NmsxoQJ9FTIv8B9myn1MWaC_2lJ-sMoeCDkusCsk4BYHjjCq04N0Y3CCJAaDdWRwgiQG,enr:-J24QDXyyxvQYsd0yfsN0cRr1lZ1N11zGTplMNlW4xNEc7LkPXh0NAJ9iSOVdRO95GPYAIc6xmyoCCG6_0JxdL3a0zaGAYiOoAjFgmlkgnY0gmlwhAPckbGHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQJwoS7tzwxqXSyFL7g0JM-KWVbgvjfB8JA__T7yY_cYboN0Y3CCJAaDdWRwgiQG,enr:-J24QHmGyBwUZXIcsGYMaUqGGSl4CFdx9Tozu-vQCn5bHIQbR7On7dZbU61vYvfrJr30t0iahSqhc64J46MnUO2JvQaGAYiOoCKKgmlkgnY0gmlwhAPnCzSHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQINc4fSijfbNIiGhcgvwjsjxVFJHUstK9L1T8OTKUjgloN0Y3CCJAaDdWRwgiQG,enr:-J24QG3ypT4xSu0gjb5PABCmVxZqBjVw9ca7pvsI8jl4KATYAnxBmfkaIuEqy9sKvDHKuNCsy57WwK9wTt2aQgcaDDyGAYiOoGAXgmlkgnY0gmlwhDbGmZaHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQIeAK_--tcLEiu7HvoUlbV52MspE0uCocsx1f_rYvRenIN0Y3CCJAaDdWRwgiQG
+
 # RETH CONFIGURATION
 # ----------------
 OP_RETH_DISABLE_DISCOVERY="false"
 OP_RETH_DISABLE_TX_POOL_GOSSIP="true"
 OP_RETH_OP_NETWORK="base-sepolia"
 
-# RPC CONFIGURATION
+# RPC CONFIGURATION (deprecated)
 # ---------------
 OP_NODE_RPC_ADDR=0.0.0.0
 OP_NODE_RPC_PORT=8545
@@ -74,6 +88,12 @@ OP_NODE_SNAPSHOT_LOG=/tmp/op-node-snapshot-log
 OP_NODE_METRICS_ENABLED="true"
 OP_NODE_METRICS_ADDR=0.0.0.0
 OP_NODE_METRICS_PORT="7300"
+
+BASE_NODE_LOG_VERBOSITY=3
+BASE_NODE_LOG_FORMAT="json"
+BASE_NODE_METRICS_ENABLED="true"
+BASE_NODE_METRICS_ADDR=0.0.0.0
+BASE_NODE_METRICS_PORT="7300"
 STATSD_ADDRESS="172.17.0.1"
 
 # OPTIONAL SETTINGS
@@ -85,7 +105,7 @@ STATSD_ADDRESS="172.17.0.1"
 # OP_NETHERMIND_ETHSTATS_NODE_NAME=NethermindNode
 # OP_NETHERMIND_ETHSTATS_ENDPOINT=ethstats_endpoint
 
-# TRUSTED RPC MODE (OPTIONAL - UNCOMMENT TO ENABLE)
+# TRUSTED RPC MODE (OPTIONAL - UNCOMMENT TO ENABLE) (deprecated)
 # OP_NODE_L1_TRUST_RPC=true
 
 # SNAP SYNC (OPTIONAL EXPERIMENTAL FEATURE - UNCOMMENT TO ENABLE)
diff --git a/.gitignore b/.gitignore
index daa8017b0..7bb8e3f91 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,4 +3,4 @@
 /reth-data/
 /nethermind-data/
 /dependency_updater/dependency_updater
-.DS_Store
\ No newline at end of file
+.DS_Store
diff --git a/base-consensus-entrypoint b/base-consensus-entrypoint
new file mode 100755
index 000000000..1d0682a51
--- /dev/null
+++ b/base-consensus-entrypoint
@@ -0,0 +1,51 @@
+#!/bin/bash
+set -eu
+
+get_public_ip() {
+  # Define a list of HTTP-based providers
+  local PROVIDERS=(
+    "http://ifconfig.me"
+    "http://api.ipify.org"
+    "http://ipecho.net/plain"
+    "http://v4.ident.me"
+  )
+  # Iterate through the providers until an IP is found or the list is exhausted
+  for provider in "${PROVIDERS[@]}"; do
+    local IP
+    IP=$(curl -s --max-time 10 --connect-timeout 5 "$provider")
+    # Check if IP contains a valid format (simple regex for an IPv4 address)
+    if [[ $IP =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+      echo "$IP"
+      return 0
+    fi
+  done
+  return 1
+}
+
+if [[ -z "${BASE_NODE_NETWORK:-}" ]]; then
+  echo "expected BASE_NODE_NETWORK to be set" 1>&2
+  exit 1
+fi
+
+# wait until local execution client comes up (authed so will return 401 without token)
+until [ "$(curl -s --max-time 10 --connect-timeout 5 -w '%{http_code}' -o /dev/null "${BASE_NODE_L2_ENGINE_RPC/ws/http}")" -eq 401 ]; do
+  echo "waiting for execution client to be ready"
+  sleep 5
+done
+
+# public-facing P2P node, advertise public IP address
+if PUBLIC_IP=$(get_public_ip); then
+  echo "fetched public IP is: $PUBLIC_IP"
+else
+  echo "Could not retrieve public IP."
+  exit 8
+fi
+export BASE_NODE_P2P_ADVERTISE_IP=$PUBLIC_IP
+
+echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
+
+if [[ -n "${BASE_NODE_SOURCE_L2_RPC:-}" ]]; then
+  exec ./base-consensus follow
+fi
+
+exec ./base-consensus node
diff --git a/consensus-entrypoint b/consensus-entrypoint
new file mode 100755
index 000000000..fcdc26eb5
--- /dev/null
+++ b/consensus-entrypoint
@@ -0,0 +1,10 @@
+#!/bin/bash
+set -eu
+
+if [ "${USE_BASE_CONSENSUS:-false}" = "true" ]; then
+    echo "Using Base Client"
+    exec base-consensus-entrypoint
+else
+    echo "Using OP Node"
+    exec op-node-entrypoint
+end
diff --git a/docker-compose.yml b/docker-compose.yml
index fc7cebe1d..bf1acda4f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -28,6 +28,6 @@ services:
       - "9222:9222/udp" # P2P UDP
       - "7300:7300" # metrics
       - "6060:6060" # pprof
-    command: ["bash", "./op-node-entrypoint"]
+    command: ["bash", "./consensus-entrypoint"]
     env_file:
       - ${NETWORK_ENV:-.env.mainnet} # Use .env.mainnet by default, override with .env.sepolia for testnet
diff --git a/geth/Dockerfile b/geth/Dockerfile
index e9312e2f1..46b903469 100644
--- a/geth/Dockerfile
+++ b/geth/Dockerfile
@@ -13,6 +13,22 @@ RUN . /tmp/versions.env && git clone $OP_NODE_REPO --branch $OP_NODE_TAG --singl
 RUN . /tmp/versions.env && cd op-node && \
     make VERSION=$OP_NODE_TAG op-node
 
+FROM rust:1.88 AS base-consensus
+
+WORKDIR /app
+
+COPY versions.env /tmp/versions.env
+
+RUN apt-get update && apt-get -y upgrade && \
+    apt-get install -y git libclang-dev pkg-config curl build-essential && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN . /tmp/versions.env && git clone $BASE_NODE_REPO . && \
+    git checkout tags/$BASE_NODE_TAG && \
+    bash -c '[ "$(git rev-parse HEAD)" = "$BASE_NODE_COMMIT" ]' || (echo "Commit hash verification failed" && exit 1)
+
+RUN cargo build --bin base-consensus --profile maxperf
+
 FROM golang:1.24 AS geth
 
 WORKDIR /app
@@ -35,9 +51,12 @@ RUN mkdir -p /var/log/supervisor
 WORKDIR /app
 
 COPY --from=op /app/op-node/bin/op-node ./
+COPY --from=base-consensus /app/target/maxperf/base-consensus ./
 COPY --from=geth /app/build/bin/geth ./
 COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
 COPY geth/geth-entrypoint ./execution-entrypoint
 COPY op-node-entrypoint .
+COPY base-consensus-entrypoint .
+COPY consensus-entrypoint .
 
 CMD ["/usr/bin/supervisord"]
diff --git a/geth/geth-entrypoint b/geth/geth-entrypoint
index 7180e8337..b598cb3f4 100755
--- a/geth/geth-entrypoint
+++ b/geth/geth-entrypoint
@@ -28,7 +28,7 @@ fi
 
 mkdir -p $GETH_DATA_DIR
 
-echo "$OP_NODE_L2_ENGINE_AUTH_RAW" > "$OP_NODE_L2_ENGINE_AUTH"
+echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
 
 if [ "${OP_GETH_ETH_STATS+x}" = x ]; then
     ADDITIONAL_ARGS="$ADDITIONAL_ARGS --ethstats=$OP_GETH_ETH_STATS"
@@ -48,7 +48,7 @@ fi
 
 if [ "${HOST_IP:+x}" = x ]; then
     ADDITIONAL_ARGS="$ADDITIONAL_ARGS --nat=extip:$HOST_IP"
-fi 
+fi
 
 exec ./geth \
     --datadir="$GETH_DATA_DIR" \
@@ -62,7 +62,7 @@ exec ./geth \
     --authrpc.addr=0.0.0.0 \
     --authrpc.port="$AUTHRPC_PORT" \
     --authrpc.vhosts="*" \
-    --authrpc.jwtsecret="$OP_NODE_L2_ENGINE_AUTH" \
+    --authrpc.jwtsecret="$BASE_NODE_L2_ENGINE_AUTH" \
     --ws \
     --ws.addr=0.0.0.0 \
     --ws.port="$WS_PORT" \
diff --git a/nethermind/Dockerfile b/nethermind/Dockerfile
index f03032f76..43486a24e 100644
--- a/nethermind/Dockerfile
+++ b/nethermind/Dockerfile
@@ -13,6 +13,22 @@ RUN . /tmp/versions.env && git clone $OP_NODE_REPO --branch $OP_NODE_TAG --singl
 RUN . /tmp/versions.env && cd op-node && \
     just VERSION=$OP_NODE_TAG op-node
 
+FROM rust:1.88 AS base-consensus
+
+WORKDIR /app
+
+COPY versions.env /tmp/versions.env
+
+RUN apt-get update && apt-get -y upgrade && \
+    apt-get install -y git libclang-dev pkg-config curl build-essential && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN . /tmp/versions.env && git clone $BASE_NODE_REPO . && \
+    git checkout tags/$BASE_NODE_TAG && \
+    bash -c '[ "$(git rev-parse HEAD)" = "$BASE_NODE_COMMIT" ]' || (echo "Commit hash verification failed" && exit 1)
+
+RUN cargo build --bin base-consensus --profile maxperf
+
 FROM mcr.microsoft.com/dotnet/sdk:10.0-noble AS build
 
 ARG BUILD_CONFIG=release
@@ -25,7 +41,7 @@ COPY versions.env /tmp/versions.env
 RUN . /tmp/versions.env && git clone $NETHERMIND_REPO --branch $NETHERMIND_TAG --single-branch . && \
     git switch -c $NETHERMIND_TAG && \
     bash -c '[ "$(git rev-parse HEAD)" = "$NETHERMIND_COMMIT" ]'
-    
+
 RUN TARGETARCH=${TARGETARCH#linux/} && \
     arch=$([ "$TARGETARCH" = "amd64" ] && echo "x64" || echo "$TARGETARCH") && \
     echo "Using architecture: $arch" && \
@@ -43,8 +59,11 @@ WORKDIR /app
 
 COPY --from=build /publish ./
 COPY --from=op /app/op-node/bin/op-node ./
+COPY --from=base-consensus /app/target/maxperf/base-consensus ./
 COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
 COPY nethermind/nethermind-entrypoint ./execution-entrypoint
 COPY op-node-entrypoint .
+COPY base-consensus-entrypoint .
+COPY consensus-entrypoint .
 
 CMD ["/usr/bin/supervisord"]
diff --git a/nethermind/nethermind-entrypoint b/nethermind/nethermind-entrypoint
index d818d92fc..66367b22c 100755
--- a/nethermind/nethermind-entrypoint
+++ b/nethermind/nethermind-entrypoint
@@ -23,11 +23,11 @@ fi
 mkdir -p "$NETHERMIND_DATA_DIR"
 
 # Write the JWT secret
-if [[ -z "$OP_NODE_L2_ENGINE_AUTH_RAW" ]]; then
-    echo "Expected OP_NODE_L2_ENGINE_AUTH_RAW to be set" 1>&2
+if [[ -z "$BASE_NODE_L2_ENGINE_AUTH_RAW" ]]; then
+    echo "Expected BASE_NODE_L2_ENGINE_AUTH_RAW to be set" 1>&2
     exit 1
 fi
-echo "$OP_NODE_L2_ENGINE_AUTH_RAW" > "$OP_NODE_L2_ENGINE_AUTH"
+echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
 
 # Additional arguments based on environment variables
 if [[ -n "${OP_NETHERMIND_BOOTNODES:-}" ]]; then
@@ -52,7 +52,7 @@ exec ./nethermind \
     --JsonRpc.Host=0.0.0.0 \
     --JsonRpc.WebSocketsPort="$WS_PORT" \
     --JsonRpc.Port="$RPC_PORT" \
-    --JsonRpc.JwtSecretFile="$OP_NODE_L2_ENGINE_AUTH" \
+    --JsonRpc.JwtSecretFile="$BASE_NODE_L2_ENGINE_AUTH" \
     --JsonRpc.EngineHost=0.0.0.0 \
     --JsonRpc.EnginePort="$AUTHRPC_PORT" \
     --HealthChecks.Enabled=true \
diff --git a/reth/Dockerfile b/reth/Dockerfile
index 40777e2e3..2c9eec55f 100644
--- a/reth/Dockerfile
+++ b/reth/Dockerfile
@@ -52,7 +52,7 @@ RUN . /tmp/versions.env && git clone $BASE_RETH_NODE_REPO . && \
     git checkout tags/$BASE_RETH_NODE_TAG && \
     bash -c '[ "$(git rev-parse HEAD)" = "$BASE_RETH_NODE_COMMIT" ]' || (echo "Commit hash verification failed" && exit 1)
 
-RUN cargo build --bin base-reth-node --profile maxperf
+RUN cargo build --bin base-reth-node --bin base-consensus --profile maxperf
 
 FROM ubuntu:24.04
 
@@ -64,9 +64,12 @@ RUN mkdir -p /var/log/supervisor
 WORKDIR /app
 
 COPY --from=op /app/op-node/bin/op-node ./
+COPY --from=reth-base /app/target/maxperf/base-consensus ./
 COPY --from=reth-base /app/target/maxperf/base-reth-node ./
 COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
 COPY ./reth/reth-entrypoint ./execution-entrypoint
 COPY op-node-entrypoint .
+COPY base-consensus-entrypoint .
+COPY consensus-entrypoint .
 
 CMD ["/usr/bin/supervisord"]
diff --git a/reth/reth-entrypoint b/reth/reth-entrypoint
index 12d9b9cf8..0ffebc83f 100755
--- a/reth/reth-entrypoint
+++ b/reth/reth-entrypoint
@@ -35,7 +35,7 @@ case "$LOG_LEVEL" in
     "warn")
         LOG_LEVEL="vv"
         ;;
-    "info"|*)
+    "info")
         LOG_LEVEL="vvv"
         ;;
     "debug")
@@ -44,8 +44,28 @@ case "$LOG_LEVEL" in
     "trace")
         LOG_LEVEL="vvvvv"
         ;;
+    *)
+        echo "Unknown log level: $LOG_LEVEL"
+        LOG_LEVEL="vvv"
+        ;;
 esac
 
+wait_for_pid() {
+    local pid="$1"
+
+    # Check if the process exists at all before waiting
+    if [[ ! -e "/proc/$pid" ]]; then
+        echo "Process $pid does not exist." >&2
+        return 1
+    fi
+
+    echo "Waiting for process $pid to exit..."
+    while [[ -e "/proc/$pid" ]]; do
+        sleep 1
+    done
+    echo "Process $pid has exited."
+}
+
 # Add pruning for base
 if [[ "${RETH_PRUNING_ARGS+x}" = x ]]; then
     echo "Adding pruning arguments: $RETH_PRUNING_ARGS"
@@ -71,7 +91,7 @@ if [[ "$RETH_HISTORICAL_PROOFS" == "true" && -n "$RETH_HISTORICAL_PROOFS_STORAGE
     # wait for json-rpc to return a block number greater than 0 (synced beyond genesis)
     while true; do
         RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","method":"eth_getBlockByNumber","params":["latest", false],"id":1}' http://127.0.0.1:"$RPC_PORT" 2>/dev/null || true)
-        
+
         if echo "$RESPONSE" | grep -q '"number":"0x0"'; then
             echo "waiting for reth node to sync beyond genesis block"
         elif echo "$RESPONSE" | grep -q '"result"'; then
@@ -80,7 +100,7 @@ if [[ "$RETH_HISTORICAL_PROOFS" == "true" && -n "$RETH_HISTORICAL_PROOFS_STORAGE
         else
             echo "waiting for reth node to start up"
         fi
-        
+
         sleep 1
         MAX_WAIT=$((MAX_WAIT - 1))
         if [ "$MAX_WAIT" -eq 0 ]; then
@@ -93,7 +113,7 @@ if [[ "$RETH_HISTORICAL_PROOFS" == "true" && -n "$RETH_HISTORICAL_PROOFS_STORAGE
     # shut down gracefully
     kill "$PID"
 
-    (wait "$PID" && echo "reth node initialized") || echo "warning: reth node exited with code $?"
+    (wait_for_pid "$PID" && echo "reth node initialized") || echo "warning: reth node exited with code $?"
 
     ADDITIONAL_ARGS="$ADDITIONAL_ARGS --proofs-history --proofs-history.storage-path=$RETH_HISTORICAL_PROOFS_STORAGE_PATH"
 
@@ -108,7 +128,7 @@ fi
 
 mkdir -p "$RETH_DATA_DIR"
 echo "Starting reth with additional args: $ADDITIONAL_ARGS"
-echo "$OP_NODE_L2_ENGINE_AUTH_RAW" > "$OP_NODE_L2_ENGINE_AUTH"
+echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
 
 exec "$BINARY" node \
   -$LOG_LEVEL \
@@ -127,7 +147,7 @@ exec "$BINARY" node \
   --ipcpath="$IPC_PATH" \
   --authrpc.addr=0.0.0.0 \
   --authrpc.port="$AUTHRPC_PORT" \
-  --authrpc.jwtsecret="$OP_NODE_L2_ENGINE_AUTH" \
+  --authrpc.jwtsecret="$BASE_NODE_L2_ENGINE_AUTH" \
   --metrics=0.0.0.0:"$METRICS_PORT" \
   --max-outbound-peers=100 \
   --chain "$RETH_CHAIN" \
diff --git a/supervisord.conf b/supervisord.conf
index 8021dce12..aa634ed35 100644
--- a/supervisord.conf
+++ b/supervisord.conf
@@ -3,8 +3,8 @@ nodaemon=true
 logfile=/dev/null
 logfile_maxbytes=0
 
-[program:op-node]
-command=/app/op-node-entrypoint
+[program:base-consensus]
+command=/app/consensus-entrypoint
 stdout_logfile=/dev/fd/1
 stdout_logfile_maxbytes=0
 redirect_stderr=true

From 9fb9eeaaad6f7615a0e37cb5439fe8743f481484 Mon Sep 17 00:00:00 2001
From: Julian Meyer <julian.meyer@coinbase.com>
Date: Mon, 6 Apr 2026 10:21:21 -0700
Subject: [PATCH 2/9] Fix node repo ref

---
 geth/Dockerfile       | 6 +++---
 nethermind/Dockerfile | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/geth/Dockerfile b/geth/Dockerfile
index 46b903469..9870b28de 100644
--- a/geth/Dockerfile
+++ b/geth/Dockerfile
@@ -23,9 +23,9 @@ RUN apt-get update && apt-get -y upgrade && \
     apt-get install -y git libclang-dev pkg-config curl build-essential && \
     rm -rf /var/lib/apt/lists/*
 
-RUN . /tmp/versions.env && git clone $BASE_NODE_REPO . && \
-    git checkout tags/$BASE_NODE_TAG && \
-    bash -c '[ "$(git rev-parse HEAD)" = "$BASE_NODE_COMMIT" ]' || (echo "Commit hash verification failed" && exit 1)
+RUN . /tmp/versions.env && git clone $BASE_RETH_NODE_REPO . && \
+    git checkout tags/$BASE_RETH_NODE_TAG && \
+    bash -c '[ "$(git rev-parse HEAD)" = "$BASE_RETH_NODE_COMMIT" ]' || (echo "Commit hash verification failed" && exit 1)
 
 RUN cargo build --bin base-consensus --profile maxperf
 
diff --git a/nethermind/Dockerfile b/nethermind/Dockerfile
index 43486a24e..23ea2bfe8 100644
--- a/nethermind/Dockerfile
+++ b/nethermind/Dockerfile
@@ -23,9 +23,9 @@ RUN apt-get update && apt-get -y upgrade && \
     apt-get install -y git libclang-dev pkg-config curl build-essential && \
     rm -rf /var/lib/apt/lists/*
 
-RUN . /tmp/versions.env && git clone $BASE_NODE_REPO . && \
-    git checkout tags/$BASE_NODE_TAG && \
-    bash -c '[ "$(git rev-parse HEAD)" = "$BASE_NODE_COMMIT" ]' || (echo "Commit hash verification failed" && exit 1)
+RUN . /tmp/versions.env && git clone $BASE_RETH_NODE_REPO . && \
+    git checkout tags/$BASE_RETH_NODE_TAG && \
+    bash -c '[ "$(git rev-parse HEAD)" = "$BASE_RETH_NODE_COMMIT" ]' || (echo "Commit hash verification failed" && exit 1)
 
 RUN cargo build --bin base-consensus --profile maxperf
 

From 6064907b3b76c94a1588c8ff4724c65048fe2819 Mon Sep 17 00:00:00 2001
From: Julian Meyer <julian.meyer@coinbase.com>
Date: Mon, 6 Apr 2026 10:35:31 -0700
Subject: [PATCH 3/9] fix mold install

---
 geth/Dockerfile       | 2 +-
 nethermind/Dockerfile | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/geth/Dockerfile b/geth/Dockerfile
index 9870b28de..3c2e61ca6 100644
--- a/geth/Dockerfile
+++ b/geth/Dockerfile
@@ -20,7 +20,7 @@ WORKDIR /app
 COPY versions.env /tmp/versions.env
 
 RUN apt-get update && apt-get -y upgrade && \
-    apt-get install -y git libclang-dev pkg-config curl build-essential && \
+    apt-get install -y git libclang-dev pkg-config curl build-essential mold && \
     rm -rf /var/lib/apt/lists/*
 
 RUN . /tmp/versions.env && git clone $BASE_RETH_NODE_REPO . && \
diff --git a/nethermind/Dockerfile b/nethermind/Dockerfile
index 23ea2bfe8..abf28e220 100644
--- a/nethermind/Dockerfile
+++ b/nethermind/Dockerfile
@@ -20,7 +20,7 @@ WORKDIR /app
 COPY versions.env /tmp/versions.env
 
 RUN apt-get update && apt-get -y upgrade && \
-    apt-get install -y git libclang-dev pkg-config curl build-essential && \
+    apt-get install -y git libclang-dev pkg-config curl build-essential mold && \
     rm -rf /var/lib/apt/lists/*
 
 RUN . /tmp/versions.env && git clone $BASE_RETH_NODE_REPO . && \

From 5ff22cf87e4d1114117d1a3492754d98c46ffa13 Mon Sep 17 00:00:00 2001
From: Julian Meyer <julian.meyer@coinbase.com>
Date: Mon, 6 Apr 2026 10:59:19 -0700
Subject: [PATCH 4/9] use mold built from source

---
 geth/Dockerfile       | 25 ++++++++++++++++++++++---
 nethermind/Dockerfile | 25 ++++++++++++++++++++++---
 2 files changed, 44 insertions(+), 6 deletions(-)

diff --git a/geth/Dockerfile b/geth/Dockerfile
index 3c2e61ca6..5c1db3d53 100644
--- a/geth/Dockerfile
+++ b/geth/Dockerfile
@@ -13,16 +13,35 @@ RUN . /tmp/versions.env && git clone $OP_NODE_REPO --branch $OP_NODE_TAG --singl
 RUN . /tmp/versions.env && cd op-node && \
     make VERSION=$OP_NODE_TAG op-node
 
-FROM rust:1.88 AS base-consensus
+FROM rust:1.88-trixie AS base-consensus
 
 WORKDIR /app
 
 COPY versions.env /tmp/versions.env
 
-RUN apt-get update && apt-get -y upgrade && \
-    apt-get install -y git libclang-dev pkg-config curl build-essential mold && \
+ARG MOLD_VERSION=2.40.4
+ARG MOLD_SHA256_AARCH64=c799b9ccae8728793da2186718fbe53b76400a9da396184fac0c64aa3298ec37
+ARG MOLD_SHA256_ARM=d82792748a81202423ddd2496fc8719404fe694493abdef691cc080392ee44bf
+ARG MOLD_SHA256_X86_64=4c999e19ffa31afa5aa429c679b665d5e2ca5a6b6832ad4b79668e8dcf3d8ec1
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+      git libclang-dev pkg-config curl build-essential cmake && \
     rm -rf /var/lib/apt/lists/*
 
+RUN set -eux; \
+    case "$(uname -m)" in \
+      x86_64) MOLD_ARCH=x86_64; MOLD_SHA256="${MOLD_SHA256_X86_64}" ;; \
+      aarch64|arm64) MOLD_ARCH=aarch64; MOLD_SHA256="${MOLD_SHA256_AARCH64}" ;; \
+      armv7l|armv6l) MOLD_ARCH=arm; MOLD_SHA256="${MOLD_SHA256_ARM}" ;; \
+      *) echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://github.com/rui314/mold/releases/download/v${MOLD_VERSION}/mold-${MOLD_VERSION}-${MOLD_ARCH}-linux.tar.gz" -o /tmp/mold.tar.gz; \
+    echo "${MOLD_SHA256}  /tmp/mold.tar.gz" | sha256sum -c -; \
+    tar -xzf /tmp/mold.tar.gz -C /tmp; \
+    cp /tmp/mold-${MOLD_VERSION}-${MOLD_ARCH}-linux/bin/* /usr/local/bin/; \
+    rm -rf /tmp/mold*
+
 RUN . /tmp/versions.env && git clone $BASE_RETH_NODE_REPO . && \
     git checkout tags/$BASE_RETH_NODE_TAG && \
     bash -c '[ "$(git rev-parse HEAD)" = "$BASE_RETH_NODE_COMMIT" ]' || (echo "Commit hash verification failed" && exit 1)
diff --git a/nethermind/Dockerfile b/nethermind/Dockerfile
index abf28e220..1f4ae519b 100644
--- a/nethermind/Dockerfile
+++ b/nethermind/Dockerfile
@@ -13,16 +13,35 @@ RUN . /tmp/versions.env && git clone $OP_NODE_REPO --branch $OP_NODE_TAG --singl
 RUN . /tmp/versions.env && cd op-node && \
     just VERSION=$OP_NODE_TAG op-node
 
-FROM rust:1.88 AS base-consensus
+FROM rust:1.88-trixie AS base-consensus
 
 WORKDIR /app
 
 COPY versions.env /tmp/versions.env
 
-RUN apt-get update && apt-get -y upgrade && \
-    apt-get install -y git libclang-dev pkg-config curl build-essential mold && \
+ARG MOLD_VERSION=2.40.4
+ARG MOLD_SHA256_AARCH64=c799b9ccae8728793da2186718fbe53b76400a9da396184fac0c64aa3298ec37
+ARG MOLD_SHA256_ARM=d82792748a81202423ddd2496fc8719404fe694493abdef691cc080392ee44bf
+ARG MOLD_SHA256_X86_64=4c999e19ffa31afa5aa429c679b665d5e2ca5a6b6832ad4b79668e8dcf3d8ec1
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+      git libclang-dev pkg-config curl build-essential cmake && \
     rm -rf /var/lib/apt/lists/*
 
+RUN set -eux; \
+    case "$(uname -m)" in \
+      x86_64) MOLD_ARCH=x86_64; MOLD_SHA256="${MOLD_SHA256_X86_64}" ;; \
+      aarch64|arm64) MOLD_ARCH=aarch64; MOLD_SHA256="${MOLD_SHA256_AARCH64}" ;; \
+      armv7l|armv6l) MOLD_ARCH=arm; MOLD_SHA256="${MOLD_SHA256_ARM}" ;; \
+      *) echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://github.com/rui314/mold/releases/download/v${MOLD_VERSION}/mold-${MOLD_VERSION}-${MOLD_ARCH}-linux.tar.gz" -o /tmp/mold.tar.gz; \
+    echo "${MOLD_SHA256}  /tmp/mold.tar.gz" | sha256sum -c -; \
+    tar -xzf /tmp/mold.tar.gz -C /tmp; \
+    cp /tmp/mold-${MOLD_VERSION}-${MOLD_ARCH}-linux/bin/* /usr/local/bin/; \
+    rm -rf /tmp/mold*
+
 RUN . /tmp/versions.env && git clone $BASE_RETH_NODE_REPO . && \
     git checkout tags/$BASE_RETH_NODE_TAG && \
     bash -c '[ "$(git rev-parse HEAD)" = "$BASE_RETH_NODE_COMMIT" ]' || (echo "Commit hash verification failed" && exit 1)

From 097f0c277e2d5d98ef4ddb5e772fea8ed4748b75 Mon Sep 17 00:00:00 2001
From: Julian Meyer <julian.meyer@coinbase.com>
Date: Mon, 6 Apr 2026 12:34:52 -0700
Subject: [PATCH 5/9] Base consensus default true

---
 .env | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.env b/.env
index 90f423c39..f250d81ac 100644
--- a/.env
+++ b/.env
@@ -1,2 +1,3 @@
 CLIENT=${CLIENT:-geth}
-HOST_DATA_DIR=./${CLIENT}-data
\ No newline at end of file
+HOST_DATA_DIR=./${CLIENT}-data
+USE_BASE_CONSENSUS=true

From 6ef324bf67b959920abfb334033e62ace0d208d7 Mon Sep 17 00:00:00 2001
From: Julian Meyer <julian.meyer@coinbase.com>
Date: Mon, 6 Apr 2026 13:29:23 -0700
Subject: [PATCH 6/9] fix issues

---
 .env.mainnet              | 2 +-
 .env.sepolia              | 2 +-
 base-consensus-entrypoint | 6 +-----
 consensus-entrypoint      | 6 +++---
 docker-compose.yml        | 4 ++++
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.env.mainnet b/.env.mainnet
index 2b689d6ed..2afe64c80 100644
--- a/.env.mainnet
+++ b/.env.mainnet
@@ -38,7 +38,7 @@ BASE_NODE_L1_TRUST_RPC="false"
 # ENGINE CONFIGURATION
 # -------------------
 OP_NODE_L2_ENGINE_KIND=reth
-OP_NODE_L2_ENGINE_RPC=ws://execution:8551
+OP_NODE_L2_ENGINE_RPC=http://execution:8551
 OP_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
 OP_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
 
diff --git a/.env.sepolia b/.env.sepolia
index 7d037c176..0f717e55b 100644
--- a/.env.sepolia
+++ b/.env.sepolia
@@ -42,7 +42,7 @@ OP_NODE_L2_ENGINE_RPC=ws://execution:8551
 OP_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
 OP_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
 
-BASE_NODE_L2_ENGINE_RPC=ws://execution:8551
+BASE_NODE_L2_ENGINE_RPC=http://execution:8551
 BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
 BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
 
diff --git a/base-consensus-entrypoint b/base-consensus-entrypoint
index 1d0682a51..c3d0dbd55 100755
--- a/base-consensus-entrypoint
+++ b/base-consensus-entrypoint
@@ -44,8 +44,4 @@ export BASE_NODE_P2P_ADVERTISE_IP=$PUBLIC_IP
 
 echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
 
-if [[ -n "${BASE_NODE_SOURCE_L2_RPC:-}" ]]; then
-  exec ./base-consensus follow
-fi
-
-exec ./base-consensus node
+exec ./base-consensus
diff --git a/consensus-entrypoint b/consensus-entrypoint
index fcdc26eb5..9d4a93b5f 100755
--- a/consensus-entrypoint
+++ b/consensus-entrypoint
@@ -3,8 +3,8 @@ set -eu
 
 if [ "${USE_BASE_CONSENSUS:-false}" = "true" ]; then
     echo "Using Base Client"
-    exec base-consensus-entrypoint
+    exec ./base-consensus-entrypoint
 else
     echo "Using OP Node"
-    exec op-node-entrypoint
-end
+    exec ./op-node-entrypoint
+fi
diff --git a/docker-compose.yml b/docker-compose.yml
index bf1acda4f..83d2c4c1f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -13,6 +13,8 @@ services:
     command: ["bash", "./execution-entrypoint"]
     volumes:
       - ${HOST_DATA_DIR}:/data
+    environment:
+      - USE_BASE_CONSENSUS=${USE_BASE_CONSENSUS:-false}
     env_file:
       - ${NETWORK_ENV:-.env.mainnet} # Use .env.mainnet by default, override with .env.sepolia for testnet
   node:
@@ -29,5 +31,7 @@ services:
       - "7300:7300" # metrics
       - "6060:6060" # pprof
     command: ["bash", "./consensus-entrypoint"]
+    environment:
+      - USE_BASE_CONSENSUS=${USE_BASE_CONSENSUS:-false}
     env_file:
       - ${NETWORK_ENV:-.env.mainnet} # Use .env.mainnet by default, override with .env.sepolia for testnet

From c843c9cc832245b7b607e0d1463a1039847a1326 Mon Sep 17 00:00:00 2001
From: Julian Meyer <julian.meyer@coinbase.com>
Date: Mon, 6 Apr 2026 13:43:34 -0700
Subject: [PATCH 7/9] Remove base-consensus from geth/nethermind and add
 warning

---
 consensus-entrypoint  |  9 +++++++--
 geth/Dockerfile       | 37 -------------------------------------
 nethermind/Dockerfile | 37 -------------------------------------
 3 files changed, 7 insertions(+), 76 deletions(-)

diff --git a/consensus-entrypoint b/consensus-entrypoint
index 9d4a93b5f..be95aa3c5 100755
--- a/consensus-entrypoint
+++ b/consensus-entrypoint
@@ -2,8 +2,13 @@
 set -eu
 
 if [ "${USE_BASE_CONSENSUS:-false}" = "true" ]; then
-    echo "Using Base Client"
-    exec ./base-consensus-entrypoint
+    if [ -f ./base-consensus-entrypoint ]; then
+        echo "Using Base Client"
+        exec ./base-consensus-entrypoint
+    else
+        echo "Base client is not supported for this node type"
+        exit 1
+    fi
 else
     echo "Using OP Node"
     exec ./op-node-entrypoint
diff --git a/geth/Dockerfile b/geth/Dockerfile
index 5c1db3d53..c32881405 100644
--- a/geth/Dockerfile
+++ b/geth/Dockerfile
@@ -13,41 +13,6 @@ RUN . /tmp/versions.env && git clone $OP_NODE_REPO --branch $OP_NODE_TAG --singl
 RUN . /tmp/versions.env && cd op-node && \
     make VERSION=$OP_NODE_TAG op-node
 
-FROM rust:1.88-trixie AS base-consensus
-
-WORKDIR /app
-
-COPY versions.env /tmp/versions.env
-
-ARG MOLD_VERSION=2.40.4
-ARG MOLD_SHA256_AARCH64=c799b9ccae8728793da2186718fbe53b76400a9da396184fac0c64aa3298ec37
-ARG MOLD_SHA256_ARM=d82792748a81202423ddd2496fc8719404fe694493abdef691cc080392ee44bf
-ARG MOLD_SHA256_X86_64=4c999e19ffa31afa5aa429c679b665d5e2ca5a6b6832ad4b79668e8dcf3d8ec1
-
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-      git libclang-dev pkg-config curl build-essential cmake && \
-    rm -rf /var/lib/apt/lists/*
-
-RUN set -eux; \
-    case "$(uname -m)" in \
-      x86_64) MOLD_ARCH=x86_64; MOLD_SHA256="${MOLD_SHA256_X86_64}" ;; \
-      aarch64|arm64) MOLD_ARCH=aarch64; MOLD_SHA256="${MOLD_SHA256_AARCH64}" ;; \
-      armv7l|armv6l) MOLD_ARCH=arm; MOLD_SHA256="${MOLD_SHA256_ARM}" ;; \
-      *) echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;; \
-    esac; \
-    curl -fsSL "https://github.com/rui314/mold/releases/download/v${MOLD_VERSION}/mold-${MOLD_VERSION}-${MOLD_ARCH}-linux.tar.gz" -o /tmp/mold.tar.gz; \
-    echo "${MOLD_SHA256}  /tmp/mold.tar.gz" | sha256sum -c -; \
-    tar -xzf /tmp/mold.tar.gz -C /tmp; \
-    cp /tmp/mold-${MOLD_VERSION}-${MOLD_ARCH}-linux/bin/* /usr/local/bin/; \
-    rm -rf /tmp/mold*
-
-RUN . /tmp/versions.env && git clone $BASE_RETH_NODE_REPO . && \
-    git checkout tags/$BASE_RETH_NODE_TAG && \
-    bash -c '[ "$(git rev-parse HEAD)" = "$BASE_RETH_NODE_COMMIT" ]' || (echo "Commit hash verification failed" && exit 1)
-
-RUN cargo build --bin base-consensus --profile maxperf
-
 FROM golang:1.24 AS geth
 
 WORKDIR /app
@@ -70,12 +35,10 @@ RUN mkdir -p /var/log/supervisor
 WORKDIR /app
 
 COPY --from=op /app/op-node/bin/op-node ./
-COPY --from=base-consensus /app/target/maxperf/base-consensus ./
 COPY --from=geth /app/build/bin/geth ./
 COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
 COPY geth/geth-entrypoint ./execution-entrypoint
 COPY op-node-entrypoint .
-COPY base-consensus-entrypoint .
 COPY consensus-entrypoint .
 
 CMD ["/usr/bin/supervisord"]
diff --git a/nethermind/Dockerfile b/nethermind/Dockerfile
index 1f4ae519b..0ecb7360a 100644
--- a/nethermind/Dockerfile
+++ b/nethermind/Dockerfile
@@ -13,41 +13,6 @@ RUN . /tmp/versions.env && git clone $OP_NODE_REPO --branch $OP_NODE_TAG --singl
 RUN . /tmp/versions.env && cd op-node && \
     just VERSION=$OP_NODE_TAG op-node
 
-FROM rust:1.88-trixie AS base-consensus
-
-WORKDIR /app
-
-COPY versions.env /tmp/versions.env
-
-ARG MOLD_VERSION=2.40.4
-ARG MOLD_SHA256_AARCH64=c799b9ccae8728793da2186718fbe53b76400a9da396184fac0c64aa3298ec37
-ARG MOLD_SHA256_ARM=d82792748a81202423ddd2496fc8719404fe694493abdef691cc080392ee44bf
-ARG MOLD_SHA256_X86_64=4c999e19ffa31afa5aa429c679b665d5e2ca5a6b6832ad4b79668e8dcf3d8ec1
-
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-      git libclang-dev pkg-config curl build-essential cmake && \
-    rm -rf /var/lib/apt/lists/*
-
-RUN set -eux; \
-    case "$(uname -m)" in \
-      x86_64) MOLD_ARCH=x86_64; MOLD_SHA256="${MOLD_SHA256_X86_64}" ;; \
-      aarch64|arm64) MOLD_ARCH=aarch64; MOLD_SHA256="${MOLD_SHA256_AARCH64}" ;; \
-      armv7l|armv6l) MOLD_ARCH=arm; MOLD_SHA256="${MOLD_SHA256_ARM}" ;; \
-      *) echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;; \
-    esac; \
-    curl -fsSL "https://github.com/rui314/mold/releases/download/v${MOLD_VERSION}/mold-${MOLD_VERSION}-${MOLD_ARCH}-linux.tar.gz" -o /tmp/mold.tar.gz; \
-    echo "${MOLD_SHA256}  /tmp/mold.tar.gz" | sha256sum -c -; \
-    tar -xzf /tmp/mold.tar.gz -C /tmp; \
-    cp /tmp/mold-${MOLD_VERSION}-${MOLD_ARCH}-linux/bin/* /usr/local/bin/; \
-    rm -rf /tmp/mold*
-
-RUN . /tmp/versions.env && git clone $BASE_RETH_NODE_REPO . && \
-    git checkout tags/$BASE_RETH_NODE_TAG && \
-    bash -c '[ "$(git rev-parse HEAD)" = "$BASE_RETH_NODE_COMMIT" ]' || (echo "Commit hash verification failed" && exit 1)
-
-RUN cargo build --bin base-consensus --profile maxperf
-
 FROM mcr.microsoft.com/dotnet/sdk:10.0-noble AS build
 
 ARG BUILD_CONFIG=release
@@ -78,11 +43,9 @@ WORKDIR /app
 
 COPY --from=build /publish ./
 COPY --from=op /app/op-node/bin/op-node ./
-COPY --from=base-consensus /app/target/maxperf/base-consensus ./
 COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
 COPY nethermind/nethermind-entrypoint ./execution-entrypoint
 COPY op-node-entrypoint .
-COPY base-consensus-entrypoint .
 COPY consensus-entrypoint .
 
 CMD ["/usr/bin/supervisord"]

From c514a26ce438d1443c4da3d252df1774b07e0e8a Mon Sep 17 00:00:00 2001
From: Julian Meyer <julian.meyer@coinbase.com>
Date: Mon, 6 Apr 2026 13:45:26 -0700
Subject: [PATCH 8/9] switch back to old envs for geth/nethermind

---
 geth/geth-entrypoint             | 4 ++--
 nethermind/nethermind-entrypoint | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/geth/geth-entrypoint b/geth/geth-entrypoint
index b598cb3f4..5b355d124 100755
--- a/geth/geth-entrypoint
+++ b/geth/geth-entrypoint
@@ -28,7 +28,7 @@ fi
 
 mkdir -p $GETH_DATA_DIR
 
-echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
+echo "$OP_NODE_L2_ENGINE_AUTH_RAW" > "$OP_NODE_L2_ENGINE_AUTH"
 
 if [ "${OP_GETH_ETH_STATS+x}" = x ]; then
     ADDITIONAL_ARGS="$ADDITIONAL_ARGS --ethstats=$OP_GETH_ETH_STATS"
@@ -62,7 +62,7 @@ exec ./geth \
     --authrpc.addr=0.0.0.0 \
     --authrpc.port="$AUTHRPC_PORT" \
     --authrpc.vhosts="*" \
-    --authrpc.jwtsecret="$BASE_NODE_L2_ENGINE_AUTH" \
+    --authrpc.jwtsecret="$OP_NODE_L2_ENGINE_AUTH" \
     --ws \
     --ws.addr=0.0.0.0 \
     --ws.port="$WS_PORT" \
diff --git a/nethermind/nethermind-entrypoint b/nethermind/nethermind-entrypoint
index 66367b22c..d818d92fc 100755
--- a/nethermind/nethermind-entrypoint
+++ b/nethermind/nethermind-entrypoint
@@ -23,11 +23,11 @@ fi
 mkdir -p "$NETHERMIND_DATA_DIR"
 
 # Write the JWT secret
-if [[ -z "$BASE_NODE_L2_ENGINE_AUTH_RAW" ]]; then
-    echo "Expected BASE_NODE_L2_ENGINE_AUTH_RAW to be set" 1>&2
+if [[ -z "$OP_NODE_L2_ENGINE_AUTH_RAW" ]]; then
+    echo "Expected OP_NODE_L2_ENGINE_AUTH_RAW to be set" 1>&2
     exit 1
 fi
-echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
+echo "$OP_NODE_L2_ENGINE_AUTH_RAW" > "$OP_NODE_L2_ENGINE_AUTH"
 
 # Additional arguments based on environment variables
 if [[ -n "${OP_NETHERMIND_BOOTNODES:-}" ]]; then
@@ -52,7 +52,7 @@ exec ./nethermind \
     --JsonRpc.Host=0.0.0.0 \
     --JsonRpc.WebSocketsPort="$WS_PORT" \
     --JsonRpc.Port="$RPC_PORT" \
-    --JsonRpc.JwtSecretFile="$BASE_NODE_L2_ENGINE_AUTH" \
+    --JsonRpc.JwtSecretFile="$OP_NODE_L2_ENGINE_AUTH" \
     --JsonRpc.EngineHost=0.0.0.0 \
     --JsonRpc.EnginePort="$AUTHRPC_PORT" \
     --HealthChecks.Enabled=true \

From 50efd3a182fb3b3ef1b88a6c2cf1f9420c411063 Mon Sep 17 00:00:00 2001
From: Julian Meyer <julian.meyer@coinbase.com>
Date: Mon, 6 Apr 2026 14:56:58 -0700
Subject: [PATCH 9/9] Update network configs

---
 .env.mainnet | 2 +-
 .env.sepolia | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.env.mainnet b/.env.mainnet
index 2afe64c80..04f9999af 100644
--- a/.env.mainnet
+++ b/.env.mainnet
@@ -4,8 +4,8 @@
 # NETWORK CONFIGURATION
 # --------------------
 RETH_CHAIN=base
+BASE_NODE_NETWORK=base
 OP_NODE_NETWORK=base-mainnet
-BASE_NODE_NETWORK=8453
 OP_GETH_OP_NETWORK=base-mainnet
 
 # BASE SEQUENCER ENDPOINTS
diff --git a/.env.sepolia b/.env.sepolia
index 0f717e55b..4c99fb7a4 100644
--- a/.env.sepolia
+++ b/.env.sepolia
@@ -5,7 +5,7 @@
 # --------------------
 RETH_CHAIN=base-sepolia
 OP_NODE_NETWORK=base-sepolia
-BASE_NODE_NETWORK=84532
+BASE_NODE_NETWORK=base-sepolia
 OP_GETH_OP_NETWORK=base-sepolia
 
 # BASE SEQUENCER ENDPOINTS