fix(caddy): block the unauthenticated beacon validator namespace from public (VANA-BC-001) (#27)

## What

The public Caddy vhost forwards all of `/eth/*` to the beacon REST
gateway. That prefix includes Prysm's validator namespace, which is
unauthenticated by design (it is meant to be reached only by the
validator client on a trusted network). As shipped it is reachable by
anyone on the internet.

An unauthenticated remote `POST
/eth/v1/validator/prepare_beacon_proposer` writes into Prysm's
`TrackedValidatorsCache`, which is the source of `SuggestedFeeRecipient`
in the execution payload. The validator client signs the produced block
without comparing the payload's fee recipient against its configured
one. So on a node that is both publicly exposed and actively proposing,
an attacker can set the fee recipient for a validator index and redirect
that block's execution-layer priority fees to an address they control.
The proposer schedule needed for timing is published by the same
namespace (`/eth/v1/validator/duties/proposer/{epoch}`), and block
production (`/eth/v{2,3}/validator/blocks/{slot}`) is exposed too.

Reference: VANA-BC-001. Verified live against `rpc.vana.org` (the write
returns 200 and reaches the real Prysm handler; a dummy recipient was
used, nothing moved) and reproduced locally against this exact config.

## Fix

- Deny `/eth/v1|v2|v3/validator` and everything under it on the public
path with a 403, ahead of the public consensus handler.
- Move the trusted-IP handler ahead of the public handlers. It was dead
code before, because `@public_el` / `@public_cl` matched first, which
also meant `RPC_TRUSTED_IP_RANGES` had no effect. Trusted ranges now
keep full access to the execution and consensus layers, including the
validator namespace the validator client needs.
- Public reads are unchanged.

## Testing

Reproduced the deployment locally (this Caddyfile in front of a stub
beacon) and confirmed:

- public client: every `/eth/v{1,2,3}/validator/*` path, including
`prepare_beacon_proposer`, returns 403
- public client: `/eth/v1/node/syncing`, `/eth/v1/beacon/genesis` and
other reads still reach the beacon (200)
- public client: EL JSON-RPC on `/` still routes to geth
- trusted-IP client: full access preserved, including the validator
namespace

`caddy validate` passes.

## Follow-ups (not in this PR)

- Narrow the public consensus handler to an explicit read-only allowlist
(the paths are sketched in comments) instead of forwarding the whole
read namespace. Kept broad here so the security fix does not risk
breaking existing public reads.
- Set `CORS_ALLOWED_ORIGINS` explicitly and pass it to the caddy service
in `docker-compose.yml` instead of defaulting to `*`.
- `archive.vana.org:3500` reportedly exposes the REST API directly on a
public port; apply the same policy there.

Author: volod-vana

Caddyfile

@@ -31,6 +31,17 @@
         remote_ip {$RPC_TRUSTED_IP_RANGES}
     }
 
+    # WebSocket upgrade detection
+    @websocket {
+        header Connection *Upgrade*
+        header Upgrade websocket
+    }
+
+    # All consensus layer paths (used by the trusted handler below)
+    @eth_all {
+        path /eth/*
+    }
+
     # Execution layer public endpoints
     @public_el {
         method GET POST  # GET is required for WebSocket connections
@@ -39,23 +50,60 @@
         path /
     }
 
-    # Consensus layer public endpoints
+    # The beacon validator namespace is UNAUTHENTICATED in Prysm and must never
+    # be reachable from the public internet (VANA-BC-001). An unauthenticated
+    # POST to /eth/v1/validator/prepare_beacon_proposer overwrites a proposer's
+    # execution-layer fee recipient, and /eth/v{2,3}/validator/blocks plus
+    # /eth/v1/validator/duties/proposer widen the surface. These are meant to be
+    # called only by the validator client over the internal network, never here.
+    @validator_private {
+        path /eth/v1/validator /eth/v1/validator/*
+        path /eth/v2/validator /eth/v2/validator/*
+        path /eth/v3/validator /eth/v3/validator/*
+    }
+
+    # Consensus layer public endpoints.
+    # NOTE: this still forwards the read namespace broadly. The intended
+    # hardening is to narrow this to an explicit read-only allowlist, e.g.:
+    #   path /eth/v1/beacon/genesis*
+    #   path /eth/v1/beacon/headers*
+    #   path /eth/v1/beacon/states/*/validators
+    #   path /eth/v1/beacon/states/*/finality_checkpoints
+    #   path /eth/v1/node/health
+    #   path /eth/v1/node/syncing
+    #   path /eth/v1/node/identity
+    #   path /eth/v1/config/*
+    # Kept broad here so this security fix does not break existing public reads;
+    # the validator namespace is denied above regardless.
     @public_cl {
-        # path /eth/v1/beacon/genesis*
-        # path /eth/v1/beacon/headers*
-        # path /eth/v1/beacon/states/*/validators
-        # path /eth/v1/beacon/states/*/finality_checkpoints
-        # path /eth/v1/node/health
-        # path /eth/v1/node/syncing
-        # path /eth/v1/node/identity
-        # Forward all CL requests until we have a final list of public endpoints
         path /eth/*
     }
 
-    # WebSocket upgrade detection
-    @websocket {
-        header Connection *Upgrade*
-        header Upgrade websocket
+    # Trusted IP access. Must be evaluated BEFORE the public handlers, otherwise
+    # @public_el / @public_cl match first and this block is dead code (which also
+    # means RPC_TRUSTED_IP_RANGES currently has no effect). Trusted ranges keep
+    # full access to the execution and consensus layers, including the validator
+    # namespace the validator client needs.
+    handle @trusted {
+        handle @websocket {
+            reverse_proxy geth:{$GETH_WS_PORT:8546}
+        }
+
+        handle / {
+            reverse_proxy geth:{$HTTP_PORT:8545}
+        }
+
+        handle @eth_all {
+            reverse_proxy beacon:{$GRPC_GATEWAY_PORT:3500}
+        }
+
+        # Trusted but unhandled path
+        respond 404
+    }
+
+    # Deny the validator namespace for everyone who is not a trusted IP.
+    handle @validator_private {
+        respond 403
     }
 
     # Public execution layer endpoints
@@ -74,23 +122,6 @@
         reverse_proxy beacon:{$GRPC_GATEWAY_PORT:3500}
     }
 
-    # Trusted IP access
-    handle @trusted {
-        handle / {
-            # Handle WebSocket connections for trusted IPs
-            handle @websocket {
-                reverse_proxy geth:{$GETH_WS_PORT:8546}
-            }
-
-            # Handle regular HTTP connections for trusted IPs
-            reverse_proxy geth:{$HTTP_PORT:8545}
-        }
-
-        handle /eth* {
-            reverse_proxy beacon:{$GRPC_GATEWAY_PORT:3500}
-        }
-    }
-
     # Default: block unhandled requests
     respond 404
 }