Obol Stack Aztec guide advertises L1 endpoints that return HTTP 401

[bussyjd]

Context

obol-stack/installing-networks.md (lines ~185-199, current on main) documents these as the default L1 RPC endpoints for obol network install aztec:

obol network install aztec \
  --attester-private-key=<YOUR_PRIVATE_KEY> \
  --l1-execution-url=https://geth-prysm-mainnet-1.gcp.obol.tech/ \
  --l1-consensus-url=https://prysm-geth-mainnet-1.gcp.obol.tech/

and states:

Default L1 RPC endpoints:

• Execution Layer: https://geth-prysm-mainnet-1.gcp.obol.tech/ (Geth)
• Consensus Layer: https://prysm-geth-mainnet-1.gcp.obol.tech/ (Prysm)

These are production-grade, publicly accessible Ethereum nodes provided by Obol.

Both endpoints return HTTP 401. Verified 2026-07-28:

$ curl -s -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' \
    -d '{"jsonrpc":"2.0","id":1,"method":"eth_chainId","params":[]}' \
    https://geth-prysm-mainnet-1.gcp.obol.tech
401
$ curl -s -o /dev/null -w '%{http_code}' https://prysm-geth-mainnet-1.gcp.obol.tech/eth/v1/node/syncing
401

Both HTTPRoutes are behind a basic-auth-bn-prysm-geth-mainnet-1 middleware (argocd/deploy/tools/traefik/gateway/gke-a21f/bn-prysm-geth-mainnet-1.yaml in obol-infrastructure) — they are not public. Traefik shows no request series for either hostname over a 7-day window, consistent with nobody being able to use them.

Anyone following this guide verbatim hits an auth error with no explanation.

Changes

Pick one:

1. Recommended — replace the example with a placeholder plus guidance to bring your own L1 endpoints (or a genuinely public provider), and drop the "publicly accessible Ethereum nodes provided by Obol" claim.
2. If Obol intends to offer public L1 endpoints for Obol Stack users, provision an unauthenticated (rate-limited) route and document that hostname instead — the current ones are internal, auth-gated, and slated for decommission (ObolNetwork/obol-infrastructure#3007).

Note for sequencing: the backing nodes are being repurposed/decommissioned in ObolNetwork/obol-infrastructure#3007, so option 1 is also the safe pre-req for that work.

[bussyjd]

Update — the decision went the other way, so this issue inverts.

Platform has decided to keep offering the free L1 endpoints to Obol Stack users ("for now, yes"). So the fix is no longer "correct the docs to match reality" — it's make reality match the docs, and this page's claim becomes accurate rather than removed.

What that means in practice:

• The backing nodes (bn-prysm-geth-mainnet-1 on GKE) are no longer decommission candidates — they stay, and get pruned in place instead.
• The blocking work moves to infrastructure: provisioning an unauthenticated, rate-limited route for both hostnames, which today reject every request with 401. Tracked in ObolNetwork/obol-infrastructure#3007.
• Once that route is live, this page's example works as written and the "production-grade, publicly accessible Ethereum nodes provided by Obol" line becomes true.

This issue is therefore no longer a docs-first blocker, but it is still open and still worth acting on, because the guide is broken today and will stay broken until the route lands. Two options depending on timing:

1. If the route lands soon — leave the page as-is and close this once it's verified working end to end (eth_chainId against the execution URL, /eth/v1/node/syncing against the consensus URL, both without credentials).
2. If it'll be a while — add a short interim note that these endpoints require access, so users aren't debugging an unexplained 401 in the meantime.

Worth keeping one thing in view for whoever implements the route: a Stack user's Aztec sequencer backfills its rollup contract from deployment, so the endpoint needs deep logs and receipts even though it doesn't need deep state. That constraint is captured in the infrastructure issue.