personal_infra/ansible/roles/phoenixd/tasks/healthcheck.yml

---
# Everything here answers "is phoenixd healthy" and records the answer. The
# Uptime Kuma specifics that used to follow it — an embedded Python script
# creating monitors over the API, a /tmp credentials file, a push-URL file read
# back and parsed, and a systemd Environment= rewrite — are gone. What reports
# where is now one variable, healthcheck_push_url. See the role README.
- name: Create phoenixd health check script
  ansible.builtin.template:
    src: healthcheck.sh.j2
    dest: "{{ phoenixd_healthcheck_script_path }}"
    owner: root
    group: root
    mode: "0755"
    validate: "bash -n %s"

- name: Create phoenixd health check systemd service
  ansible.builtin.template:
    src: healthcheck.service.j2
    dest: "/etc/systemd/system/{{ phoenixd_healthcheck_service_name }}.service"
    owner: root
    group: root
    mode: "0600"
  notify: Restart phoenixd health check timer

- name: Create phoenixd health check systemd timer
  ansible.builtin.template:
    src: healthcheck.timer.j2
    dest: "/etc/systemd/system/{{ phoenixd_healthcheck_service_name }}.timer"
    owner: root
    group: root
    mode: "0644"
  notify: Restart phoenixd health check timer

- name: Reload systemd daemon after health check units
  systemd:
    daemon_reload: yes

# Ungated on purpose. This was guarded by `uptime_kuma_enabled`, but enabling a
# timer is deployment, not monitoring — the deprecation banner swept it up with
# the push plumbing. The timer is in fact running on the host, from before the
# decommissioning, so the guard meant Ansible had stopped managing something
# that was still live.
- name: Enable and start phoenixd health check timer
  systemd:
    name: "{{ phoenixd_healthcheck_service_name }}.timer"
    enabled: yes
    state: started

- name: Display post-install information
  debug:
    msg: |
      ✓ phoenixd {{ phoenixd_version }} deployed

      Status:      systemctl status phoenixd
      Logs:        journalctl -u phoenixd -f
      CLI:         sudo PHOENIX_DATADIR={{ phoenixd_data_dir }} phoenix-cli --http-bind-port {{ phoenixd_http_bind_port }} getinfo
      HTTP API:    http://{{ phoenixd_http_bind_ip }}:{{ phoenixd_http_bind_port }} (loopback only)
      Data dir:    {{ phoenixd_data_dir }}
      Health:      systemctl is-failed {{ phoenixd_healthcheck_service_name }}.service

      API password (needed to wire LNBits up to this node):
        sudo grep '^http-password=' {{ phoenixd_data_dir }}/phoenix.conf

      ⚠️  BACK UP THE SEED: {{ phoenixd_data_dir }}/seed.dat
          Losing it means losing the funds. phoenixd is deliberately excluded
          from the automated backups (Plan 5, Model C) because the seed is 12
          fixed words — write them down offline, once:
            sudo cat {{ phoenixd_data_dir }}/seed.dat