blockchain//Besu//node roles

Every Besu node is a full node, and its roles describe the additional responsibilities it carries. Assigning a role is a matter of port exposure and genesis configuration; every role runs the same binary. A bootnode is the discovery entry point whose enode the others list in `--bootnodes`, a validator signs blocks with an address listed in the genesis extraData, and an RPC node is the external API gateway, its port mapped for dApps and wallets.

Every Besu node is a full node, and its roles describe the additional responsibilities it carries. Assigning a role is a matter of port exposure and genesis configuration; every role runs the same binary. A bootnode is the discovery entry point whose enode the others list in --bootnodes, a validator signs blocks with an address listed in the genesis extraData, and an RPC node is the external API gateway, its port mapped for dApps and wallets.

One node can wear several hats (bootnode, validator and RPC at once), but separation is more secure, because it shrinks the attack surface (minimum privilege): a validator should never expose RPC. The ideal topology has a dedicated bootnode (no RPC), a dedicated validator (no RPC) and a dedicated RPC node (no validator).