47 lines
2 KiB
Text
47 lines
2 KiB
Text
|
# monerod configuration - managed by Ansible (roles/monero)
|
||
|
|
#
|
||
|
|
# Config-file syntax is the command-line options with the leading -- removed;
|
||
|
|
# valueless flags take =1. https://docs.getmonero.org/interacting/monero-config-file/
|
||
|
|
|
||
|
|
data-dir={{ monero_data_dir }}
|
||
|
|
log-file={{ monero_log_dir }}/monerod.log
|
||
|
|
log-level=0
|
||
|
|
max-log-file-size=104850000
|
||
|
|
|
||
|
|
# --- P2P: outbound only -----------------------------------------------------
|
||
|
|
# Nothing forwards {{ monero_p2p_port }} to this box, so the node dials out to
|
||
|
|
# peers and never receives. It syncs and serves us completely; it simply does
|
||
|
|
# not relay for strangers. no-igd follows: with nothing forwarded there is
|
||
|
|
# nothing for UPnP to do except announce us to the router.
|
||
|
|
p2p-bind-ip=0.0.0.0
|
||
|
|
p2p-bind-port={{ monero_p2p_port }}
|
||
|
|
no-igd=1
|
||
|
|
out-peers={{ monero_out_peers }}
|
||
|
|
in-peers={{ monero_in_peers }}
|
||
|
|
|
||
|
|
# --- Unrestricted RPC: loopback only ----------------------------------------
|
||
|
|
# Administration and the health check. Never leaves the box.
|
||
|
|
rpc-bind-ip={{ monero_rpc_bind_ip }}
|
||
|
|
rpc-bind-port={{ monero_rpc_port }}
|
||
|
|
|
||
|
|
# --- Restricted RPC: the only surface anything off-box touches --------------
|
||
|
|
# A SECOND server, view-only, reached over the tailnet by Caddy on the edge
|
||
|
|
# host. This is rpc-restricted-bind-port and deliberately NOT `restricted-rpc=1`:
|
||
|
|
# that flag restricts the loopback server too, and then we could not ask our own
|
||
|
|
# node anything useful.
|
||
|
|
#
|
||
|
|
# Bound to 0.0.0.0 and reachable only over the tailnet - Tailscale's ts-input
|
||
|
|
# chain sits ahead of UFW, so nothing on the LAN or the internet reaches this
|
||
|
|
# port without going through Caddy. confirm-external-bind is monerod's
|
||
|
|
# "yes, I meant to do that" for a non-loopback bind.
|
||
|
|
rpc-restricted-bind-ip=0.0.0.0
|
||
|
|
rpc-restricted-bind-port={{ monero_restricted_rpc_port }}
|
||
|
|
confirm-external-bind=1
|
||
|
|
|
||
|
|
# HTTP Digest, and it guards BOTH servers above - core_rpc_server::init passes
|
||
|
|
# the same login to each. This is what Feather sends as the node credentials.
|
||
|
|
rpc-login={{ monero_rpc_user }}:{{ monero_rpc_password }}
|
||
|
|
|
||
|
|
# Nothing subscribes to ZMQ here, so it is one less listener.
|
||
|
|
no-zmq=1
|