diff --git a/ansible/group_vars/all/vault.yml b/ansible/group_vars/all/vault.yml
index 6c01d31..6ac207c 100644
--- a/ansible/group_vars/all/vault.yml
+++ b/ansible/group_vars/all/vault.yml
@@ -1,162 +1,174 @@
 $ANSIBLE_VAULT;1.1;AES256
-32333164303734353564643266316239636365313631613866306666643538353537323939373066
-3439396330326266396531303737363131313831396365650a343832363564356337396530383438
-36356465623634623361643436383262393339663134373630666363613464653437666164393731
-3462326463346535310a396531393761643062643563613964613234666531643139666535323734
-63653630616138373539343434636434326466353134643864396466373435613738653536356532
-36313432373138316532663464353638386530666231376636643931663338303663346665363039
-39323734343934393037633766626132333835363265653538373266323236336137356630353834
-63306164313434363130306339346435643463376137366534643033366537383861363531353861
-34363966303234333133336466646635623136396138663637613133613861313866646634643132
-34383461366133333430633631353561653037346339626165346564353630373363643065323535
-61386237353135636665363538623538313039343965363535323734653763366238373334323065
-64626135383736316135303731656231313263306266636563343465653666326663333536383435
-32643537616161623830656161633763303566656462356235633866303165383663386435363133
-61353430656337656364646231383332316534316233393333646436353062316461366439613030
-62346366383566356661376463616137373062303363346333636134633465396238343761363139
-38616336633532366165376237626337333933353935613066303865303536303464633834643533
-31376236333133336166373635626130316632396561393930353065616465663336393938323539
-35343531306261343733626539346265386436643135326461353734346164633233383237393731
-32303030623564666539383835333064323630393539393062313435383663303334383134666436
-63336564353464313534323866383533323365393761643565633430346263346666623638303030
-38653461616661346661316537306666313165613163303835363636616561343335623131636633
-36636263356530366663616461316635316365393666313066326265306335363038366561356339
-37366231656330643764613664653735633963666638623961653134316136666336396438333864
-65653738623638373636366666663463373035363862396565396166643332343934626261353938
-34666638383531366532663963323533323965373439623735353661373862393830623934313535
-62363237663764356338383133336463303234393262623061363062373938613262383836323431
-35336133306139386336373965393132393431343535306162383337643961323039373530646330
-35383962303263353234376164633530666264386338376335653465616161383532613830636562
-36613837326564313565633632353964346537303337316233623033383961363737313861393234
-64313130306264636134626638396661353362346439373463663965653165613436363633323238
-39356430613033643334363731346333346639643563633162333636653066386233373063653138
-38623630353265663332366630316362633135633362313735306533333962373433376237366266
-64643266323862383363633033656465303032336134623036646530323264323532653234306363
-64326663343064643865373164306661613463366561383737363535303861646634353139636666
-66626466303037363064303865313830356531313834353165303839326238613962313261353536
-63626133663765373763623930623963653038313661656131666261356236366565626663323831
-32313130366135616662616639386436656265346635613762353832626466323261346333373661
-33656338326631393064313762343161363832643030303737663639356261633131353937396135
-34666361353266373661626534353134663235343662636435383032636261636637636361613631
-30373965373638386664313432386264303761376266363161363633343831633032356639343836
-36306163303363353534313466353863633834393337303161313431343165346162653537346130
-36393439386232613865613837346563643031393530646433353936383463303562326331313738
-30646537616264333332323562363237323530313333386531323066343335323133366566383935
-34613232323965626339653132323162626234356135323436353263306137343130346337326531
-62396164386661303366363566393833353130643636613865616433633166666532653937646262
-63323530616533373962626264633236313064306336633063356536343862316237383166346264
-65666466366435653134303164613632666336626630373764333534393164303132656530343031
-32386137633135376531373662336131313030303436333833663234343938323232343832633234
-35623361393533316232393431646561616535643638383533353266646235313736356366343231
-30383962353833326161663534396565316139393439366631313731663737656332646361326331
-35623038343931666231653731346435653162326237376339663936343933346264343564666132
-62393230363262323366313963373737646138336163313434376462383964396337313030383831
-35643865303738393736323032353239633631306262663536663732623933383431383563646664
-65326230323239353831623232633935636632636438636165376633313364643637373233323231
-30323534333131623138636266396565373964633963626536383930316663656634636638316363
-36326438363463386138633133346666383163323936653131666339333430316363393966316130
-66333732333565646564303633373464666461373437656634306564336432323465386631323034
-32376635666139313465393539353438626534646332323537363163653233353030366231306234
-31663065393062633438343438303762633931653564366666336662323430366466333334303763
-64356138373035323862326137643963323865666539316439333064343961303838636265623735
-36636233373065303239363461373239646662346162326164613332373761326561656234636438
-39636231386531353236303933343661393333383730636366626263393534656363366337316432
-66393162313731616165343362643162376334346262353730653738323138646463666433383963
-31626131373736633662366366376566656438343330383330616235376239353661663663313233
-63373836363638366432376130633930343862613436633263613538336536616163656364656561
-35353163323663663833343834373036366531623536303138613035353064303065623761376462
-32656363613765316635666639383865636538326130386535316132623238393730353631346136
-65353864393863376632356437303565626262343039636436636335383337623465336263623439
-61393030636466303836663166613766326164626639313965373734643466373663343565343631
-35356431303139396131346335346664373830663361616136306535643431353037636431343132
-32613164333232346335663236343238653033643133316564666534323130373861623962393461
-62386336326461326239383534303631346639343765393839656364353762356266653733303238
-37393533366164393863373134633439383765616435346239333065623438353431663035306132
-30363663383765356365333234323061326163653463646566373764363037373932623032366133
-64626633643737323631306539333531343239326639643166393435323731353932336262633963
-62363561616635356230626431626232383439633738306532636361336334616238643665323266
-35666165396566323639303733623364353436613966336337656363633762393664303939656537
-33656431663431396237643536613233376561313261323635613634613439633533393361333435
-33616136633936386135623563616530663833643339623439366430646639646162613863643565
-32343732613134656332653163623437366637656537666334653239366638653537393639396234
-63613362623037663465626438646136396362663033376261376166306138363436666566393838
-63363262386261316432313235323166333334346539343663303265303535636439653130366566
-38383632326433323036356266646138366233656131663633613236303137336437383333653430
-35653738623635656661393232333334643937303631663464383239353635393735353833333265
-38303831623130303634666464316465653639383230623662326534333136616561666166613930
-37643632393265326364376230643634356538626337633638663634326538396536383633303633
-62613532336435326161626263376462363162303762613835663831623539623562336361333031
-37346438343230363433633738643064336235323438346534643463333930626430653131623538
-61363735336332633663383136613633376430303133366634643839636562656431663737336431
-65653164393331626532356566623830623931373431393330633638306663376566346136643863
-61653461633637643663303761326464636339336635383938633039613132336139663762363734
-34313831366232383562363834653232613665616266323033336635653933626630346132643164
-66336663363161616431316666383430326266636134396239656561643763386438306434373166
-65616637356366353336346539396665396364383162383533323837303134313664326338366131
-64336333316531353661616561656430386462666565373535613134336634383136613638323565
-34303130316162376137303137396330343466383263363638306334386161613535303735623537
-30613065383963666166336135663632303038326163346630376466393761663738653532333466
-35346161373237383766393063623939363664356639653862353132353930383261643761363135
-66323364376432363437656239626362313835333537663030386435623764373937636130663331
-31663636616261636663306230653264353566313966333665383938393731336538363665636665
-33383334613565393139613138633636656234386263663932323364653361623433326438326132
-34636633663838636634323236636564333630666362356333333230346333373833653365363135
-37326630386439356139653865643039666237313833306161643263663363393965633163366436
-65373132623265363134343233653366383665633163363766353066653863373937613631373332
-34653835636565353731396331633133393435373739306663343632323234633462356630666238
-36316634303031346138393835363565366131663534323933623166653662323931386135363432
-36626434323536326636653165626661386663393134653061326634633162653666393661353762
-31343766383933633261366437396332356362663539623032663435356231656430366532623535
-35636361343330333263636230383030326139323065373032376238333162343462383566333264
-66386439303163616638353635303736376461326533623234633264353865393065363765366636
-63383034373631656331386439633863613731633930646330613931303430366236643735633434
-33346638356330643534396236633630616134626237613363306334383639336161306235626133
-32616339633033343431633131666131383036373335303739663634653831376563363034363365
-63366532393761323862373434656264323938313334333234323162353663306263636435653636
-65343531663234636362623139653439386132316430346536623864383539313037666439643638
-35323235303164396361383832303362613235386530303538376265373964623363653365383961
-61306365346532336164303763396364363038646563323562653865303461353339366334376534
-61346230343662336633316133666631613136316537393464666635643336393566613730333837
-62643232623831333730313737666536353137613138333566323934353236616464656238303339
-63346665326661653832646466636165366338376638353431346130323230646534303137386634
-66646362663831623234333335376561336664343232323361326430313138633266343065366535
-39396463636330663738333033616334623366643636623735396435643865396630656234333433
-63346437663331653233313430666633366264343565373838656536323231633966663262346434
-35386631333063666233303364346139336461333736366438396239353136373339636638323534
-61663564353733363131363139663761646561313337656232336164653234646563666266656362
-36613666303165383530386530646331346661323633393232376533386661376533663166346337
-63316431393964333731373332313732643765386662656437373136663532663531383436393761
-36323939643464343035313633313436373038646234343366356264386131623462343161313261
-62383839343863386365366432396666303065616137396631373330643339656433363463313131
-30653431393630653331633634363233323632306434626566393662323566613565633639313938
-65626434353530306630636430646261373365386538613232383663336339303838626533306164
-62386166363861613863393331343362303665613239626265316366386165633264636163343366
-30643965633239333162633433366132323162396564383530373839333331643632333930643035
-33313663623165613033353130616666643136303137356462613237653430366663653061653035
-64653961343163646530623863313663303231633764626264363366613162313535653631656365
-39633561643833313334363465626263656132623463633335333465306266373634386238666165
-37373134646438303134653734323665666531626533666663363534316238666232316438393939
-32633531313565636531646361356566663133316164623133653935313335323835616238336431
-61663664393239343837353039303334353035323861323533663161376361353933313032306136
-36623463363235303166616162373665616333346366336333333531623932376664383861616232
-38393263336364343566653735396561363836373064346131336366316231303539386531643835
-34363463636232653137656339643630336333653163383332663763663633393837343963336666
-61316236366436363064396464383138373639373864636261383533333139306237303030373037
-36333563653036393734393439636262303837356133636233663064623136356133613932656365
-62356630323134373063663664316133663761383035633065383838333364663732353866356230
-33333263316666323133323433653330646161386462303163303235343031343761633234306166
-63363138376531353130663431636637646262366436393161376633306332346465316333656432
-34333238306263666537626231376665376435623466643131363736656432353938653236656132
-37313633323863656463633030336566343265666534663737396530316234343433383931336462
-35306236626564373766393438653134353332616532373132336663626130666532373933323863
-39656463386136646131356462653933306532383232313334326334613738356339623566636661
-62373139326138326663666237663436656631343635373733626439643466326439663361313266
-61323966336532653263633530646363366439326663356664313065306166313863396439396564
-30303138326261303661333831306536333363663536323235356263623533346233386161396131
-64356265363964316231333933613463623163316538393830393539306533313035303765656437
-38623262333662613665396537323331393937366533303039386138643639383664663263643734
-65313531343636393232343230613639363466616235633162353430646364363934393530643263
-39633539333237653733363132303163613564623232313464376336306431666534653338323765
-35646564653736383962343664383666333936363864396334333463313637343336396434633766
-35396466306235323338393937643362373764613161333462303665646239636562306635663330
-3630
+38656563383931366464306463373265623631353331376532333134313463303635656162373437
+3735623062343764316262613966353338326535313161360a323831623936373966633535396632
+63303961636566646338373464336637323830663932653039306362653832306163313938396135
+3633663532373362390a333233366636666437626365373732633361653833363264623138386661
+35636665666230326164343339633834616134666531343839623134343163333864333834303862
+37313864303335326133343666333733363333663336356234633332323262616530356661316363
+62306338303966306632303531613161386135346439333137393062343938303134656436656539
+64326134363664353165616436353635633265643161383335393633383563656231336139346138
+38366238653236623664313662626566373631633136613864373032316539646332363035343865
+32666664363737373962396162313438303030613264366232373030316335366534666531646239
+62306630316432346131383738373764313263363039376435653062313136356531383534343831
+37336536313564323336613639386138303562666437376238376630623665373230653232396261
+34333433343361643065643032366433643137396231343331326362626434643365356131613766
+34613039306130653535653330623333333631653538643536616530373538386332346132363739
+65653135306663336163336263376332326230616238666365653663663462306238366466663366
+31633833333465653534613863643465323631336661393366356363386462623434636631623738
+30376265663739333336393664626539353531653637303464316562613436373739353039653430
+36353034643839323131353033643866303333306435653532656239653061656235393536306463
+31626162393462356238323737313933633465623566646161363964393164393762626531326138
+61343336373065313232343064646463346638613661393263326265366539623861623537643164
+32663365313161316464333137383337656662323137356635636637326163343562323965666166
+30396531326364656461613232653361313061623835663663643861306334386539626530386666
+63306331313466623163366332326564353639383961656362633435363065313830613764306237
+37303530643266646464653263306432313766633835343739636261623464366536346665636135
+31333638306237623535623439613636363937333430633831306162333466323137323932663432
+35616135363134306231323933303635336332376163303131656131376131393465353434353330
+38623339313964313730663263373963306337373938393863323062366534613131623764386638
+65616463376633663864653363643135623663316439346336376366346166303962633366636565
+65373335623962613131336364396133623738613364383639356533316138383333353464616639
+62316161656633666431356462313634383239363464613031313232393131643936333237616364
+36646530646239626662386231313239396238323139383037653337376134316535373464613235
+35346439646234623462623262336461326434346632373966626464313633343266616463643764
+37633830653230666631383134313738326265343738386631346261343439356163353262626161
+37343134663764396439633535616537386638633731643164383064333266643830356563383066
+34356161623361623366363435653739383438396363643338353736323139313661373031396132
+61373834303439663939376339633832313639643332383239313337666433623435613161306139
+62633162346338663335663661643938316539316139356165346461326433646366306134356338
+35613934623666386463356536303362626466663062643236346163323337616232323535396265
+36636165656366396136666533626433363562353537343430333361643635313335336435626265
+36663233383265636530313332336562623833373930626136316265393634653466333732666563
+36383037336566373566313661363062346431343534396533656135326534646161346639383336
+35306633303836346365383533316661613630326533393836353036636132636663653530656336
+35656364613130633761666632333633333137656637353362353337626266616238336266306636
+61393932343736306465666338626365613531386362376565383738366230333465663137343363
+64336661343563643136626362303937653632316230356531323231653063306538616633616265
+64306332396639323461653136356662376236363861643466633466666265646538653833373138
+38623130633037333666623862636165666333366335643765613834383533343436626638356536
+32333939326532396339666637386237303730363332643861316236613634353230353565316239
+30356135323237633963343461376233656333633636303662333365333735383930656538356238
+31373862613534386464333865653361363663373664663234346636316262356137613037353135
+37656534383164363131613834633062656437373066646336666533313033643130636361383038
+61336366343230303036336563663537623230643061383732623865383134366535353365346363
+33373331323831396462633031353665363033346536306334366237646363636633353732626166
+66363938663861616461613562646530656366333166303264363030306139343161313938613361
+66376263326131626132646530643439633634303539613863623965373432363863326130616536
+64626336633238613034353166353664363230393732366465346363303537336161623834333265
+61346365393964393365656565323331303265616630613766656239656438316539636632373038
+62313139386233633732643765383039646534326236333134613531313437346161343638376432
+66336432363739633231303138383338313164313930373866366431316638353761323531333930
+31353136326630363038626135383939393639306466383832373630623565383766663736363937
+38656132303738333863623262656131396366313663666461666231626364646433613137333062
+32336661373236666235306534616535323061663634383763386339353732646636306563323632
+34313433653137613930363631373666613330363761333639373630306537343633643561366231
+38363833363139666631333431646262656239316138373339326533623437383336353139646431
+31313833363733653534333133633636616636343635393039666233383661666363373263313631
+34363064353135383261633666316462356231616163373634383730386536613462346535383331
+61336632643363306435323866346665626464366163343735616130613335663235376132396663
+35363635663664626638663331366131646333623533613065323731643366656562353138363335
+34653863323337653331306232306133323666356464323932323562376632333439303537306534
+66346462363535353961383061323762343237393535626638633365396566616636616236396462
+38353433393631393338646338383830663331663538336465366161653333373736623063666437
+34633365383736653230316631636666386664643731323434613761613139666432636236653137
+30393666663261616332323466353161636632643534386131306632313236653063633531356564
+66353964393634336530396162393862653837376436623738663135303632383166613333336165
+62333434613432626264653865353035643563663435316233376465383961303534646339373632
+31343530353636343238623565653566663936633763323861383231366533303164316339653637
+36393364616365666335386539653439653735323162396131643931333866613862633437333438
+34663233356461383537343738343134626532323361653666633733353939333065363131316133
+63616632336130653962636236336264363565303839653531326264386331316264623038326266
+62336233303332333638613461366231343935323036366536383639373837616638616362643331
+35663331653133343661346635613036643065303637613964666237353166386666313439383936
+31663730356636333061326535316638366531656430353633383663336535663830323063356666
+62333762393865333132653161346361313832643163356265616133373663363836303662613935
+63623662313830623434303530303833663063336164363836643531323239653966366233373266
+35373037323132653833646432356435333834346138636133633339613165303362336265303065
+31343931386136323362376431336164343931343934643031336435303738393764613332393561
+31363333623165643363646638336435633539626635656536323030646130323734643134336562
+62353233366533363131313462656239366337343532336332323563343931376237306231656532
+63326439303930326563323238613538386435393735356438316536373064643465306362346135
+63646532343334323538343838653764303332386139313239376332656664316361343536663766
+61363065343862373165366563366363376362303862633037373763663132663631346562313161
+62636635303738393763373232643862386135386537333637636631626638363232323036316366
+38383235366333363264653163313937333566633066356663383466393535333535313939326266
+30626531386333626334366533613366353433396438313838346339396433666436663961643438
+62633336633066616163626232326334633265356532663535323264373166316133386466653131
+66623261333964623235386433346236353338363961323230356633613864303735386530303165
+30646265346566626562643330333233636164386432613436383034623337323531613735656133
+64653232343839653661303662336435653439663732303638323732333064646333313732356339
+31303934613938326365656161383262363633373265616466616562313237363763613265376664
+38636534646237616332653531323036313430643862393362383630653339343931376164373735
+39323136653730316462643964643939396662333462653934623136643839373864613335303463
+61643765656431363734616435343564393663346535636134383637653538646336666164336339
+31353230656364633936643338613563306639316464653864396230626263306338323639323238
+35396334613039343734303232363962653164636561633164303132366234376632653339376538
+37366638376666353733633132636131653462613732656364316530306333313431316164663839
+34646366393835353338373763333666646535363634633864306433316135376663343833613435
+37356636346234623735663361336366363264646535336566363933653832613039663161663762
+65663234666437363834646163643733356136396464633830336533366337303438313665336166
+33376331373032316464353037383433623334643965656434636134333166323238666438653337
+32306234636661656639306464653238326536376661363036626561386630326239616137376565
+32666438356161336437646562373534326632306165666439666130313036373262633164376362
+66646639663663323134626636313130343362343966653564306265623630326664336534333037
+65626562666337653436373130613230656535386264303132373634353861376238386435366636
+38316637613036333836356536306132626631326562363535613835313432353133373138613264
+62396261303239396364613039346135623437336565663034313264643535366336653363336330
+31623539396435643132383363353861323064336430653936623438303933356562613335643861
+39663437333836383331663830626433386431383338373261353266386531373931383632306135
+36316339366539333730656638386635333733363764613364303563323665396336613930346233
+34333433323030643262373636663838343131303637613237376463386662303235623338393063
+66313166343730383961363765663463303266383938653638393830613662643362386361626132
+66306533313461663131613565343534303735366232383164333837363330626534643363626164
+33326134376263333530663631383930623066313035373135616665323564323033323639623235
+35383538356434663035306137366437613537373531316436336366646165346330383538386331
+64666232343961343261393339356531363636303165393532313632613363316665633233316330
+35623939613463333164643736313531666531626232386361663435653938343536363236616431
+61343430363861626339336166316135663234366132313762616230393239663931656536306663
+31343366663063396139336237373361333030353333623064336262313465316538623438313265
+62656232613435643437373233396566623537353038316262643239653432373863626530323334
+35633132353463356634633237386134346532353930343339303337643637373932666665313561
+39346531383663663131623863383832346237356231386263656566653631363836323132333135
+37316135613730386362666564643037653366373464323431303332306364373432646338333031
+31613533633664343038376533306235393030646236346232386236653138636234666561646263
+31386633343265663335323236346435653261363763366234346263626663643964393962343766
+63656237326563653633383461333364396165626138343461353963656131663265313835326465
+65643164316537333531363139623732376364346363613363663066663733616665346233633662
+35343065316437373136656235323466343732613335393761313061353432623664363462383562
+38333139636336366462326565383631633864633165613332343833396237336561346164656664
+63316463323233383434663061633564666264313261353632316164643035306234393732333435
+66623663316334373431633734323232313436366364623037303965366663386237343439613433
+65383763393061633431303736656238396364343765363463333433313836386666613964623634
+30643065626437653966393237326433373936653861306536363834623363613830343036363766
+64386234653331363564373065343139623965646562373933333162386264353832303164336362
+33613036666139396533333862316366396464646465346263623730313336663935356139663762
+65623466323239383732636165333564356534333939316539663366363065623631303933663863
+31393637643761303731646638323133636464623366363032656335643435373064666463366365
+65653831666262616165306537623534653763636633633137653733323234346266363630306434
+64616633326266636134343536363365393033663934663965323537633136356535353436316634
+61643636303237363033313637396533303761303536373836343332636466396339353065386539
+38366530623332316439393633356235386665636364313739643432623032303363613666656264
+31353063633862366638363838663932386131366434646462313130366633643430373230313338
+33383362313230373137393934323561343064623065353063653535366266373237656530303335
+38616263613232353632333361383030626133323261323033396638666231396638353537383338
+33393466663938356363623438366265336330313039313666343462356331626265383565623364
+66323835303365366333623733343664626431343663623465326235363430356661616166346630
+30336266383830336461663130616363663637653964366634663930393066633134626530653766
+34393439363332383831383865393464656165643331333661643138663133643133626236333363
+34643438353037346334316233653034313737616134653762353239636234383233336338633031
+32386332656530313361393532623661393538633463393861636539393666626362653031636566
+34616265353736633539313032346334313339313934323962313463376664373336666236346633
+31306563633966653134343937323839316137356164373338343965643934636631646666386361
+62363165663838626538363966396161363366303162356664313437613034636531356638333237
+35613833366462653834363261653365356336643635363831383930323566623262353865653233
+63333138633466653165666236356430666532353639326261613462636161636634613235353165
+38316566306533373138336334643465616339383739653639303632303661656135313039303632
+66613966633036653461396330663630396663623732346261653265343233393730306537363032
+66653737306431343435316433646164303338353865653336303731636663303863363662333863
+33323334656631326137646563616236393035336539646563643064663564383736343961656435
+36306136353037616634383866303636383531616136633230346538336563656366393466613262
+32663266323333393764616561316636356664346265353433653262313239326264306434383030
+34356263323331313364653966623630326433343863643839313165313063626261646339323837
+64613838353334613661346662346636313432393837386139386136613366353038343962366639
+32626265313764613733313334353432346434323439326637383462313863383165303963353665
+34313635623766313361633030616439343433353735326433383563656435393563
diff --git a/ansible/infra_secrets.yml b/ansible/infra_secrets.yml
index c597ce2..6bec8f7 100644
--- a/ansible/infra_secrets.yml
+++ b/ansible/infra_secrets.yml
@@ -1,162 +1,174 @@
 $ANSIBLE_VAULT;1.1;AES256
-34313539653264336537326165616161313931303664633032373566626264643439393136386230
-6330353962336634623963336535333130626662336561650a303864333966333336376661356139
-35303531343330356331356166666666343739636564353039313637663066356135623630396236
-6434663137386232300a323334313332373630366133393530313438623733666333623437666539
-65376166643436303661343763383166616662653137636539623435653632623433396465616363
-33336431363266653138366564343862626634373838316439313339313961323437656435623635
-37653534376262656130373734353335663764386633646436396335616437633636376462343861
-38343430363733316166353032343164313333663865356335393634656335373636346565653233
-63386535366533303736623463623830363166646530666631643730303265396163353538656662
-34363964356665666464336636373535613639343535633361383064623065643230303066303661
-35333666353331363031353732643233613439666539373539343437336362656132373634663636
-30383039303266663961666662613730646664386266356338366335633663666162343338363263
-63323531613735363333613637666530323830346135653839353733306561396239373734313530
-61616233313264323264396230393163303766666665656330636636306661303838333265383535
-63383330363331663038643735653266333233613666393161636634396365663832653736306437
-39636230336336613863623562376134616234323434653061656534383132353038333966663631
-36666562623234303130373661636136336538386163353230383830303438336435346432623761
-36636263306564323039356165623835363730643463343065366436323235616639376363363037
-38623165623635363239366361616337663932653734383162376363396533373563643439633632
-36306564336165363035386663323366343636383366393366373732393634356236626535356333
-38383633316362396133346631303234363366666664343137633765353231306534653837323035
-65333762383164663433356438333264323631373561353762646265386630616536633833306565
-32336635623036666131613634333332393037643063373561303938313762666262353564303039
-31333731396661373865313862633732313864306131303936333638323965613831323034303130
-39393864663136383430626137323736313132303030326131616463653635383262353731653034
-65643437323434626637313333666538613039633635333231386433363963653432376164383364
-34376437386166363335373964666631393230383038333137636439643936393866356537393535
-35306135313532363462653734633162363236356436386161656164666261393236393162353865
-38613964613434636334663361396362396163623533623166306261366130633962653131386365
-65626464663736326365376166633538303439326561643362633163626330643265393630303163
-62383835623639663838663934663030383363646339663632666364613830373263313437303964
-37343664356135663361323539663562323265373163303035633463326162363462636131363436
-31343764313537666661656631643263353239616563636361633561313966663932616163313932
-66363837656538373337653737653061356237383436643964653230333263313063333033663866
-61613634363463363232663765646438653266386166623431363932383931396339633665633430
-62306437633438393136643930653939623734643162353961313831613337646435656436353436
-30396265643732636337303233623931643361663032383335333431623063393731633764636166
-38663465366537636539376661643237623936333565383666333163363066366532633965346463
-38653265373262663039353433663134373361663535336633383566303462393663623432653836
-64323838343432343061323338353633613930613463383465633465313436343932366163313361
-32356431353434353434306462306134643332326363353462666561663035356530376263653831
-30616533323666363161653231663835663532336236663034316364333438336130383537346633
-65656565643363303036396439373963623338626461366234623233626231323534616130623537
-66323666346439333763646635643635663538633361356637646565353234316264306339373765
-37356236323763383761323637306163613933623661353262643362636330393362646236386563
-38323236666633306336393839396439303536643933393331333363626533373636356339623235
-66643436343736383136656630356139653537356632343838636364306461326539373932383430
-66343736333261316363316230623336313366303963366134666533626363353937373434383965
-65363737626534363030386461333261363736373230323437303636353030373335366266643566
-34313863363864306331306130626135623265643935376130303566636432646532356438613635
-36353766373434323638626330313030333737346262653833643735306432623836323834663638
-34646130623363613763346163363435643561336332663865623563343666616338616134336361
-31313731646434666263303136613338613637613530303932646561616138393032343838623766
-35633163366463346663656331386539376263646264343466366466663664643661383238326138
-38646231616133373038343636383733643661366131646335623564623663326537373039353535
-36643062623063663131363765666265303231333332333535316634336262306437633236323961
-66653263613836373235363166326337393762346534636330633931356265613765363336386162
-61393630636136313630613363383138333939313231396332353132313139323362386162613364
-63633261313965323966396635623334333633353963663263666433616632613463353231386238
-61333439613839353431613637633465616338363334333962666464396563356266323538373761
-64343436636138663934306130336663633665356465303064363637316332656432666639633330
-39383664616536383265303265663437303438393833663066343735616261653736346230663663
-34663563653862316335326661663264333138613430643934303334343838623934356431313264
-61393166616239613131636131643762313563623137633966326362326664346438366564306130
-30663161306462383836646436316138373431636339633438343439633633663735336433356232
-36373437323031303637636231646262343133646632633561393339303835326336656533613562
-36616530623530386238623262393537626632376637663232336138353232396333383837303362
-36623538333432396439306261356663383163653665393530313434616137626230356463333434
-30383861363164343866326264366135346166633936313834636162303764613735383565663264
-30616264643535353730396435633863646634616332303337363230366666373563656534383661
-34613835346565393730353165663264656661623930623361383465366336383933626162393530
-39353535613237313064613537383564323164323337313039393637396534383563373637373730
-66653539303963623034333862613539613663323238333765646138656464386535336334626437
-35626465623864376539333964316533326235626265346438333737633738393532323162306430
-66353633386337626462643466343333353130356663363766353161333662323830643261376139
-32616465326135373037636265306436653630646164323365636166356362353634343036623035
-35303136373235313431613932666230353034396334336561333732353762656434633037666664
-31306438386635613038623662336137336430653434383730653161383239376466326232323163
-66653738363030626231383930303335333663623837366464633764333461636461303131393966
-32303035376661623738323032346638613261313963626130386464383032303334383735396564
-63326633376139316436393236643066656631396134393962366363346233666232393434626134
-31653933383631613064303563656665383834623662306137303861623063663437636335326430
-62306630393938323832613830353230313136383834333832343366646632366634393632383539
-61373531653862623261633766613531346263343030373733383465353233316162656566386264
-35313834333739393064303730306262663032376335663032613233343131336662623065346231
-37653164633632396635363434623936346135616531353536323961336662646334666335306137
-38343037303337363966663934663733303364323134613633313566346161376661383032393832
-35363531316431303937323761323234666436313661623833323235373539393134346261666533
-32396665383961316166633836656562623665656134353762303238373633376333356664666539
-33356430613663366162316663623735646434656261613835363835343935323765626335326139
-34636439313466363438343862313636303163376635383361633338363664623830613837616464
-34306636346438313437613430306466383166373431353435656166643638626236373533393939
-62366538353262383239396236653664613664626236326531386536643433313361393065316562
-37303435333231313434653939313264613031343266616537383464356334333137646132396536
-30623238346662323163656365323933373366323530306530613032363861643037393332626531
-30353838393263306137633564376430323038313162626633623238353136653032653936303863
-33373135656434316466663363616138623734313063666632393265343532333433303731373239
-30393635333465313735363030386634323635393335383532326138346538633264386163623463
-34396336366638306633633732363162633336353962303261346439396231366337653633653161
-34383732333530366136366334396630303533336165653333326465306439313233373335326237
-30663331643839663534666338616466323633636364363663353462613632353764353931663164
-39306462623434653035396534663232326533643032343139663237366235653265393164373735
-30626435626235343730366265633935663463663435633137646138393765323738633162623239
-65666666353339656636633765313164306339383135623633643763396530643061383764373364
-38616233613562353831343838343830323130646662363061316534346564336631343639623161
-38666338346330643537366631313165366632643932323131613836303362383733633165653762
-64383539303139386337323931623531373461343737303236396534346566363338306138393334
-62363961386234326539663433646530663233306365613662633737376237393838306361343365
-31623538353362663830646436376236333161656238303332303339353531613461313839643239
-65613230373035336434363632633735643063646363656133326630336461313035633662613763
-65333665323764306535656137343034656165366530386166353964636338653532613332633437
-64323665333335386661376437303539336534393865353262623366323762326435313262626234
-37323433333138363837613034616662383362636462616134393431303737306166646233346362
-33633536636537633230353039623562636635396138366131366337613131323334356139346433
-62393564656635663836383164343562303637303533376665383638343238653939663962303535
-61383232316264323434366530623635623637623062333235646436646531643261633264393461
-36333766356434633532363536353734383866656461613338633234363966313661333537613439
-37343236396535666661656634326439633539303339616563643465613732343933393131623038
-63353231633633356563373438396335636439326136363463366663646565313532303230313836
-33613734323538316534386531616233646431623435326338366339386431376363656439326535
-39373065386463353435396466323433343436306639303266323431653037336463316532376533
-39656365303166306430646664346539376366343332633837303030376561623966393732393466
-65353563346234633965623036636264386239336537656237313433633932323063636239616561
-34323261373938333462623862393063333963306333616530656232646461363132323932663231
-65656361326139323030326332613166303461326236383432323761663061353134633736353665
-39643932363538376163613063316533346530646139626536356663633464636235353035653362
-61313838363065623365666538643562356336373539343237366161316130373461306362353133
-37343965666436643633626461613738303738313838326265373164373464643037363861643730
-30326431393865373362363836333631393039313938343834366237653961353163326665306262
-34643836653434313838303035623961613036656630666266366330313031386338326563663833
-64323535663438313865306539343936393864376263393532336538316530663839643161346233
-65383831316566373734636462396161323630376434666430653235373238303932616662666437
-31373532353339366534316463623237313835366164663630343561623861383263626365663566
-66383034613939363736356262336336356363313332363466653534653336353964313831363139
-34626436623231306434393464376639303462356132636630373762366135613935363033623137
-39643036366263353139623539666130333163616562353239353731623534346635653239396636
-39363636346234356465383365356462333430366265306464666666393033656638393930626661
-36616365393637316231656239336135333664346139373163303231363266393562626364346561
-36333738373738643136653465353331316561646162383230666133636135646330636363653061
-35623234303233326531356537616131356533386334623938303462613337323930623566343664
-34323831616636393264643765653262316434623635373733623139396131636366353033653263
-66393361653766623161343935626234336163363765313339653266343837313731653839643066
-36633861663130346635343863646166393238333165316365333230376433333439613731333461
-37353035323931306462646465323066333463333236353665303664393461353030343963346132
-32396237626335313831616662383165333439393739353865623631333630363432633366646263
-32633435366461656535323230613739323634386536666132633935313532663763353963343065
-61616134333630633333616639333062663636326237366265326264613863353537323232373165
-32663964313736313031376662663631663635393731333264613566336661623030616235333163
-31343865333735633933373933303030393632656435333032373730663866343736626663623136
-62643566356665356234306134653037383638303064316138313638653336616364393934623862
-38613864313962633335653165363437383631366531613731633339313562366364306164386430
-34326133643436616537336132306634613461353963306664313531633564653134383330336537
-64393331346566313966626238663733646565343761353563623461663662336331656634323964
-34323965326638363038316233623431656233346165373136343532316635326561356265336232
-63396563383765333736356638363261396634303730383136663566383135303331373534313766
-66363335356265396164326438393862613333663936666230316133396563376535663365633061
-35323665373233656631633038343631356233633934666161633766306331373537646231306437
-32623965656139373835333238343565643635306437656262623334316633646361623262386435
-32663031323338313339386663656363316164353666346237316137313562623838326436383862
-35616663633433613064613264363637396632333734326231343830633537336364346336316461
-3833
+30383238343938316437303961393961633538303835356661366465306161353738616335343563
+6135613063376562303539613535633463616433383239380a323163346131633838393836383539
+38623766303739623131613935363037323462353664386563356661393665306136323863656363
+3433313638363731630a336165343563653930663435333037653330386364336530373830346336
+34396361653637626137343033343432303438383761393765313164393631666230616537366636
+33313234636535306535336132373830383438636235636466623861363734636238393234316137
+36643439643130363462643765353061623436376463386139616435323136376366653932323766
+34393161353062386666626633393639623434653864383439343339363665636134636139326538
+36323966373230363938623434336161396235316532663739353837623238343862633032613264
+32626565313637306131393466653739383935646134346330333835393932396634323565313861
+38613864656139646261343835316562323863363836376266653139336638366161323035373265
+39366566333136646134353065653065333337303832363237653361353234386335643165376331
+35316339396130366163313130633561643062316164376262353131323237303861666263643536
+32333062316330313532343832336434653664656565616634643436656466373533376535396533
+35626636393135626539633365326364353462633462656364316361303732643632356230643333
+30396233616633326438393836383237623636383464333830343464343837383231653139386336
+65313337366665343936366430623162643032626430336466643230313530343832383730303263
+65386235633832643931656562303561666131646362303533323430336235643436653866366161
+64636365633731613365663833663264343233313037326537616164656231656332663461653635
+31323237656361666630323930336630626437393836313431353839636435363466376535633962
+63323462626662616139653665346132343736636361643930333366666237303438356364656464
+36663363386131646361316535653463366234663062323539646562633962653537383465366439
+36343635313934353063373734386137653239343538663037646362376434383234363361623165
+66663734313133343062363137323931643338326365346234313835303431613632623461366339
+64656138303166356136313962646133306536333465316239383532353362333932326639393363
+63393430373133316532633562386432663332623934376636306438623061353238333562313737
+63393338333534646265643462666163356365653937643634316266303730346333346465313662
+33326638643639326361386461663931613766373937656266313964336461633939333535646231
+35316331333537303830653336373530353364616161346232323130336137373737616534373435
+35383466666262333834323332393737613763303562643232616432316636386635383934373633
+34316462393064656633373562333039646135373332373063653539313230646466326233313536
+38346238623162353338656437336536663534643062376138643030363935336461333638363134
+30653738383233636531333165386131383061363466313736336632303136616261623137313065
+30323766393862663965623337303638366239663130643638383765383930353533323635316232
+34646339366162653663323964363863623962643166646130633236353563313061353434376334
+66313862313265653238633034616530343164303432666539363733666662653733666462303662
+65663638653534643132353361313130323763636338303836346430623664303732356636636232
+62396135343236646537386334373166303663353661323236336365336533613139373430333364
+65363863323335353663396366616530633836363837653963656636333264323434323365396135
+62613862386361616633333636663263376465613465633362333733326665326639663961313631
+32653735353563366236363936343438623665363834633436393232653737623436303237376530
+34353032633433363865303866643761343130303431326236353332356464396433323430613830
+38373035306137363562376539633863343737616339346463636236393537346163323731333733
+63656161306437343862643836633539326661653062383361613739366237623162653939366335
+30613466643665313830353332393365623933376638326534336664616561363461643237386533
+64376532306663373934356361663832323337393266356138343236663964666637343431663237
+62303531353266633164336363356336616332663730663933353730356365393866313662363730
+63346434663162313333663738393461386638343864616634323938323437363232356466303637
+32663630633466623839306537366465653164616631373564366132636165346231303065653036
+66333134336132376232393639616163393366343365336661633330316436656163396434343963
+30356331393432613561636562343138643062613738613764666232656639393532623433343138
+37623963303237663337626661656638636364323931643730343535303737656461663831336336
+65653031656633386562663837386130613635306438313764653830663966663232646663356132
+61613338663331666265393566613661653462323530623930373034363363363238663465303162
+39303465613435343934636365336262376431616136383538353862323235643835373638663832
+38303336306665616666353963653532313162336536336137613337653363323138626338333861
+36663364656463623337663362643936393664363937306135353464363061393837346161333435
+63343030333830626438653565623065383264616264303035613432313266643739333063653066
+39623863373632363337663065653865343433393333386633626237393162383338343038646165
+30396331643033386331333039663066356432613733336235353266356336326138323864396132
+38313164393833343339663363366438313931393232613935343063306233323061363066616366
+62303564643930643262666364346130363530363630306331393032623736643630376563636533
+62656338343734343739383565396339323138666265626235376235613963666566333862656533
+63626566343737636532363535656238316332363831303862313265383936613339616430376231
+32663363613135626463373166623063336135303437313031353337323939633732396139623731
+36653061313233363837396636643234666439663261316361346263343934393237626134656230
+66326135396661383432323939666662376163376233323339303939336363336531653163633464
+33346266346533346631393666316239343463366636613336313833663730323734613135343930
+62613130613933656237366262363433353434303763326564333965383662336661313037616430
+32643061313638373931646464383465626234323866386336313861336531383638363736633438
+38643662376364333564383963613339623964396666313263653336393666623932393738656665
+63653234316265316535303531646230326530616639653036653731373934316238313563313338
+62373162346333666634346362333232373234613430386237656337353661643839663465663265
+36303738636137633636646537613336386230316334613739383362656661643163373936663130
+37393361323837323032376464323961306335623835616134633735626164306539383936613064
+36653133666230336262616438343539346561363863653364343662356233633239623765383165
+30336635393763646432396437613838383733626565353737336165626333643339376432393366
+31386334326130346164633534366532363037316334373133326362303965346633633939333539
+35613435626232653733303266666431666133366430633538623931623231353235383364303765
+64376133653562336631326630363036623033303039363561643236653531663861336262393865
+37346633626334313736303831633236313562393363313133613836326137303435356435613337
+31613335336562376435393237326439613863383264316537353165373437333866666364316366
+36326332336335396430663332326562613235623338633930633437663162643433663065323234
+36613663356534366433383431386666643736323936383030396139326464623961666666323462
+35613335633666313330636161613836343861313861666530323935343961316631666566653565
+61363033306338323966376631343232343038393564616262323532626131643265303865396539
+62363433353666626666393331636537363535306534383634333262326438366463363138666230
+32386366303462323930343863333463383638653532386362323338306266393337326535363663
+36346366393631396163343930626537643161353038383934313331363834323431653364303939
+37326532643864343338626430363065353833353862353262336235336637663865653263663339
+62363366663838366236653364363064356137346463383933626533343461356162363062653932
+37663966373031363133326534623763643030356335386139363565613135353835343233636330
+66393532396530643532626336303737306134323537373135663435376632343331323663333737
+66316638396563626663313636386566363036383663656230336530376234376138303462323030
+61613931336364383265366234393933653432313562666238666639326430376238623365373838
+38363339616365623065376438323738306633666561326432303935393938373638613736303332
+35353833663431313462333362313732353534383630343030393564626139353139623530633332
+34653639386263313738613430323664383264646632633062643031303437636262623966313630
+30663533623334633164353964643536623566623132666166373039303361346534346337396430
+66633632633162316462636662363938656263663135326237303361386234623661333938616262
+62343731623838646133333135306438623538626639663863313337313862626535303937346138
+64623338336333323239643565336533323234353436616230373063663539613839646238643735
+32613163343637656337653139346463383734363636633635316261646133343731653133613238
+35613265633538323039663665353664333434373834393264653830343766343136653632363532
+65356331633262643635343861393535353532383137346534633661613963333531626463346562
+63323638376536626534353062646561373566396235386634646663616230633635386661333334
+34643833653065633033333839633736656161396236363364393838613038326532353130353063
+62373635356665643133353561633861643436613035636239373630373164386531343736643564
+32656536633631353931666137663234343861633865303436323434303636376634366665313234
+33336163396330383263346333323065616437383564303839636235313964343633626166623833
+62316436326532386338356563643038663737616338363636383032623665373862643631643331
+62336364366537366531663762393964633531333166303662356334383562383466303334663261
+63663638633736353934663530343934613837623963366232323637626466343138613165626634
+38663338386465353463633438356434353839303334343165386430623733393934343466333134
+35373137653635653966383865333637623930666562323236323434653063613464353362396164
+31353632353637326330316239393665653833393438663436376562326638336239396337633134
+39343031323931303061663837353931396263333637633264643966343633363966626135356333
+30643564666336636535663264396632636532616234316130313761333731626639333665393430
+37653765336533346564306139333436623466626664393735363865663733306161393634323161
+38653262303363313562363233643634623364396237316636623431656366393538633131366139
+64383833313537653137363961306538353230656164626663613462323962363631643336356561
+61343539393239623861373633386338663534616438333538613632356265376132356539653964
+61643234373639643933653963323631336433633863326263303938643166356330396339626637
+30353337626231333730386465326533346233626561373564376234343763616431313031656531
+65396363396436383337373133333231393139303734643533623233613136363031616430653530
+31383231333763646437646430346564623739376365656661363539386164346365633730623738
+65373334613138336263623262653833363566633638646139656433326165353637363131316230
+31653436353336636333656430656564356233626535333263616136626136363430353237366230
+37346533316562653764396262646661623232346335633966303833356332346133653535356638
+61386338363139343561636564396232643361333936656637363130323165666536613066663137
+64356233376662666432366364626639373534663865343865323363333239636461326665306537
+35666533643834373839326139623564316533303562306235386238313764666438656139393362
+61353337303761666538636533613839336237646331663231353831303663323739623362326363
+66646136383765356431306639383336623237346534623535613435346238353866316164333763
+62646665396233646632633535633332313934653964396562656464376635306434613932623664
+66303131616137616439353939663731306438383662393039333036663862336537356335306266
+66646538316432346132633764626361353561663937323039383138636331326232643932633932
+34353061396461646664633364303536353833646130303032656238313637363736643663356237
+34356161313463626361393031643332656464326166636333616162383431396662383261383033
+31303537326532323238363539613439626365613538643364646366326236353934376539383865
+32373731323133383335343639626133353232613033306331373237646364643830613532306237
+37663034613363363164363935633332633732653761623439366636646137326163306632316264
+35356164343462633938333331323836313539303961316532613032396632666138646265636337
+38313539633430646166313435376532323630343232393735346335363731363666663363663138
+38373465396461306665303331383266663836666434626137636632653266393239656631353833
+32626531363763303439356565666434333334383737316431353032333638366338383430313436
+62326331353834303261663730303066623062336638323433353565656638336235663734323530
+66396666306534393139656138666430373537653862343232386233313730313831643734353539
+35636361643230316665306563633836656261353338663538336666383462343132666361356233
+32623732646564316461373537373331363138653332393638656437643635376663303430373933
+31383837643033323334326562663135613537373661396166656130613963383265303961323230
+63376662656232393833373731653234316462333834356534303738323430336633646437323332
+34376263396662373931333938623330626438663336323066326239636535323562623936636335
+39373335363663643238316230356534643033393363383436613865336361653566626336666630
+37313739646337653436663665386666393063316263653833633239396632313734616262616166
+38303363646661373139343039353532363736336261356462366238343135313637636166643431
+38633236386535346166386434616234326164346661386534663834646464303038313561613034
+33656265653739383932323632613766333335363633393666396663306337333231316639633731
+35383062613633363065616535666638326138306431366130336238343263356362333535346435
+35643866386430333730663461353136313630323961633764616134333835643234656633303232
+35363333656436653563353336393066306139633937623037643566633166646264313864646364
+36636663613465656339613534613634633733616662346530356361383934633466616138383865
+66313930613030386163346363333836633139376637323337396434613761636434666164393534
+37346437356431313930333932303465326138393262643665643139646134386161613465666363
+32376464653737363130303761303838663061626636643534326235333062643735653837633938
+35336161306435323665653035313930646666366631353464626235313761386135303665636137
+62646466313662613630616234373933376138383037363933626437306466633832343238633964
+30346265653865623537323833393763343632323839353237363466336663396131333266396533
+65626561646233626366353862396564373463623563343961646662633133613333646435303030
+31323332626534383732643839353739653835333934373835653331663762376337393930363833
+36313033633239383830363861623538396463396163333138613437303535396265336664313639
+31653837623938393137643137306566386666653564373838373265306462303062623436653261
+31333138396664613962303965613536373239643166353831623565643662323564
diff --git a/ansible/roles/mempool/README.md b/ansible/roles/mempool/README.md
new file mode 100644
index 0000000..d8282cc
--- /dev/null
+++ b/ansible/roles/mempool/README.md
@@ -0,0 +1,69 @@
+# `mempool`
+
+Deploys the [Mempool](https://mempool.space) block explorer as a three-container
+Docker Compose stack — MariaDB, backend, frontend — on `mempool-box`, and keeps a
+health check on each.
+
+Converted from `deploy_mempool_playbook.yml` (745 lines) under Plan 6. The
+playbook is now 37 lines: this role, plus a second play that publishes the
+frontend through Caddy on the edge host.
+
+## Phases
+
+| | |
+|---|---|
+| `docker.yml` | Docker engine: repo, key, packages, service |
+| `deploy.yml` | directories, `docker-compose.yml`, pull, up, wait-for-healthy |
+| `healthcheck.yml` | three check scripts, three services, three timers |
+
+## Three health checks, not one
+
+Mempool is three moving parts and knowing *which* one is down is the point, so
+each gets its own check, unit and timer, driven by the `mempool_healthchecks`
+list:
+
+| | checks |
+|---|---|
+| `mariadb` | `docker inspect` health status of `mempool-db` |
+| `backend` | `GET /api/v1/backend-info` |
+| `frontend` | `GET /` |
+
+Each records its answer in its exit code, which systemd keeps:
+`systemctl is-failed mempool-backend-healthcheck.service`. Reporting elsewhere
+is one field per check, `push_url`, and is the plug-in point for whatever
+monitoring exists. Empty means check, exit honestly, report nowhere. The URLs
+are credentials, so callers pass them from the vault.
+
+Nothing here is specific to a monitoring product. The embedded Python that
+created monitors over the Uptime Kuma API, the `/tmp` credentials file, the
+push-URL file read back and parsed, and three systemd `Environment=` rewrites
+are gone.
+
+## MariaDB owns its own data directory
+
+`{{ mempool_mysql_dir }}` is bind-mounted into the container, which runs as uid
+**999** and must create files there. The playbook this replaced declared
+`owner: "{{ ansible_user }}"` (1000) on it, which had drifted from reality ever
+since the containers were created — unnoticed, because the playbook had not been
+run since.
+
+That was not academic. The first real run of this role pulled a newer
+`mariadb:10.11` and recreated `mempool-db`; had the chown still been in place,
+MariaDB would have come back to a directory it could not write. The role now
+ensures the directory exists and leaves ownership to the container.
+
+## `mempool_frontend_port` lives in `services_config.yml`
+
+Two hosts need it: this role deploys the frontend on `mempool-box`, and the Caddy
+play proxies to it from the edge host. A role default is invisible to the second
+play, so the value lives in `service_settings.mempool.frontend_port` and the role
+default derives from it.
+
+## Expect `changed=2` on a converged host
+
+`Pull Mempool images` and `Deploy Mempool containers with docker compose` are
+bare `command:` tasks with no `changed_when`, so they always report changed.
+That is the idempotent floor, not drift. Everything else reports `ok`.
+
+**`mariadb:10.11` is a moving tag**, so a run can pull a newer patch release and
+recreate the database container. Pin it if that is not what you want.
diff --git a/ansible/roles/mempool/defaults/main.yml b/ansible/roles/mempool/defaults/main.yml
new file mode 100644
index 0000000..d0e36b2
--- /dev/null
+++ b/ansible/roles/mempool/defaults/main.yml
@@ -0,0 +1,55 @@
+# Mempool Configuration Variables
+
+# Version - Pinned to specific release
+mempool_version: "v3.2.1"
+
+# Directories
+mempool_dir: /opt/mempool
+mempool_data_dir: "{{ mempool_dir }}/data"
+mempool_mysql_dir: "{{ mempool_dir }}/mysql"
+
+# Network - Bitcoin Core/Knots connection (via Tailnet Magic DNS)
+bitcoin_host: "knots-box"
+bitcoin_rpc_port: 8332
+# Note: bitcoin_rpc_user and bitcoin_rpc_password are loaded from infra_secrets.yml
+
+# Network - Fulcrum Electrum server (via Tailnet Magic DNS)
+fulcrum_host: "fulcrum-box"
+fulcrum_port: 50001
+fulcrum_tls: "false"
+
+# Mempool network mode
+mempool_network: "mainnet"
+
+# Container ports (internal)
+# Sourced from services_config.yml: the Caddy play on the edge host needs this
+# too, and a role default is not visible outside this role.
+mempool_frontend_port: "{{ service_settings.mempool.frontend_port }}"
+mempool_backend_port: 8999
+
+# MariaDB settings
+mariadb_database: "mempool"
+mariadb_user: "mempool"
+# Note: mariadb_mempool_password is loaded from infra_secrets.yml
+
+
+
+# --- Health checks ----------------------------------------------------------
+# Three independent checks, because Mempool is three moving parts and knowing
+# WHICH one is down is the whole point. Each records its answer in its exit
+# code, which systemd keeps:
+#     systemctl is-failed mempool-backend-healthcheck.service
+#
+# push_url is where to report, and is the single plug-in point for whatever
+# monitoring exists. Empty means check, exit honestly, report nowhere.
+# The URLs are credentials, so callers pass them from the vault.
+mempool_healthchecks:
+  - name: mariadb
+    label: MariaDB
+    push_url: ""
+  - name: backend
+    label: Backend
+    push_url: ""
+  - name: frontend
+    label: Frontend
+    push_url: ""
diff --git a/ansible/roles/mempool/tasks/deploy.yml b/ansible/roles/mempool/tasks/deploy.yml
new file mode 100644
index 0000000..d98df7e
--- /dev/null
+++ b/ansible/roles/mempool/tasks/deploy.yml
@@ -0,0 +1,75 @@
+---
+- name: Create mempool directories
+  file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: '0755'
+  loop:
+    - "{{ mempool_dir }}"
+    - "{{ mempool_data_dir }}"
+
+# MariaDB owns its own data directory. The container runs as uid 999 and has to
+# create files in there; this playbook declared owner: {{ ansible_user }} (1000),
+# which had been drifting from reality ever since the containers were created and
+# would have broken MariaDB the first time it needed a new file. It went
+# unnoticed only because the playbook had not been run since.
+#
+# So: ensure the directory exists, and let the container own it. On a fresh
+# install the mariadb image's entrypoint sets ownership itself.
+- name: Ensure the MariaDB data directory exists
+  file:
+    path: "{{ mempool_mysql_dir }}"
+    state: directory
+
+- name: Create docker-compose.yml for Mempool
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ mempool_dir }}/docker-compose.yml"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: '0644'
+- name: Pull Mempool images
+  command: docker compose pull
+  args:
+    chdir: "{{ mempool_dir }}"
+
+- name: Deploy Mempool containers with docker compose
+  command: docker compose up -d
+  args:
+    chdir: "{{ mempool_dir }}"
+
+- name: Wait for MariaDB to be healthy
+  command: docker inspect --format='{{ '{{' }}.State.Health.Status{{ '}}' }}' mempool-db
+  register: mariadb_health
+  until: mariadb_health.stdout == 'healthy'
+  retries: 30
+  delay: 10
+  changed_when: false
+
+- name: Wait for Mempool backend to start
+  uri:
+    url: "http://localhost:{{ mempool_backend_port }}/api/v1/backend-info"
+    method: GET
+    status_code: 200
+    timeout: 10
+  register: backend_check
+  until: backend_check.status == 200
+  retries: 30
+  delay: 10
+  ignore_errors: yes
+
+- name: Wait for Mempool frontend to be available
+  uri:
+    url: "http://localhost:{{ mempool_frontend_port }}"
+    method: GET
+    status_code: 200
+    timeout: 10
+  register: frontend_check
+  until: frontend_check.status == 200
+  retries: 20
+  delay: 5
+  ignore_errors: yes
+
+# ═════════════════════════════════════════════════════════════════════════
diff --git a/ansible/roles/mempool/tasks/docker.yml b/ansible/roles/mempool/tasks/docker.yml
new file mode 100644
index 0000000..b97e63e
--- /dev/null
+++ b/ansible/roles/mempool/tasks/docker.yml
@@ -0,0 +1,72 @@
+---
+- name: Remove old Docker-related packages
+  apt:
+    name:
+      - docker.io
+      - docker-doc
+      - docker-compose
+      - podman-docker
+      - containerd
+      - runc
+    state: absent
+    purge: yes
+    autoremove: yes
+
+- name: Update apt cache
+  apt:
+    update_cache: yes
+
+- name: Install prerequisites
+  apt:
+    name:
+      - ca-certificates
+      - curl
+    state: present
+
+- name: Create directory for Docker GPG key
+  file:
+    path: /etc/apt/keyrings
+    state: directory
+    mode: '0755'
+
+- name: Download Docker GPG key
+  get_url:
+    url: https://download.docker.com/linux/debian/gpg
+    dest: /etc/apt/keyrings/docker.asc
+    mode: '0644'
+
+- name: Get Debian architecture
+  command: dpkg --print-architecture
+  register: deb_arch
+  changed_when: false
+
+- name: Add Docker repository
+  apt_repository:
+    repo: "deb [arch={{ deb_arch.stdout }} signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
+    filename: docker
+    state: present
+    update_cache: yes
+
+- name: Install Docker packages
+  apt:
+    name:
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io
+      - docker-buildx-plugin
+      - docker-compose-plugin
+    state: present
+    update_cache: yes
+
+- name: Ensure Docker is started and enabled
+  systemd:
+    name: docker
+    enabled: yes
+    state: started
+
+- name: Add user to docker group
+  user:
+    name: "{{ ansible_user }}"
+    groups: docker
+    append: yes
+
diff --git a/ansible/roles/mempool/tasks/healthcheck.yml b/ansible/roles/mempool/tasks/healthcheck.yml
new file mode 100644
index 0000000..fa53a9c
--- /dev/null
+++ b/ansible/roles/mempool/tasks/healthcheck.yml
@@ -0,0 +1,58 @@
+---
+# Three checks, one per moving part. The Uptime Kuma specifics that used to
+# follow — an embedded Python script creating monitors over the API, a /tmp
+# credentials file, a push-URL file read back and parsed, and three systemd
+# Environment= rewrites — are gone. Where each reports is now hc.push_url.
+- name: Create Mempool health check scripts
+  ansible.builtin.template:
+    src: "healthcheck-{{ hc.name }}.sh.j2"
+    dest: "/usr/local/bin/mempool-{{ hc.name }}-healthcheck-push.sh"
+    owner: root
+    group: root
+    mode: '0755'
+    validate: "bash -n %s"
+  loop: "{{ mempool_healthchecks }}"
+  loop_control:
+    loop_var: hc
+    label: "{{ hc.name }}"
+
+- name: Create systemd services for health checks
+  ansible.builtin.template:
+    src: healthcheck.service.j2
+    dest: "/etc/systemd/system/mempool-{{ hc.name }}-healthcheck.service"
+    owner: root
+    group: root
+    mode: '0644'
+  loop: "{{ mempool_healthchecks }}"
+  loop_control:
+    loop_var: hc
+    label: "{{ hc.name }}"
+
+- name: Create systemd timers for health checks
+  ansible.builtin.template:
+    src: healthcheck.timer.j2
+    dest: "/etc/systemd/system/mempool-{{ hc.name }}-healthcheck.timer"
+    owner: root
+    group: root
+    mode: '0644'
+  loop: "{{ mempool_healthchecks }}"
+  loop_control:
+    loop_var: hc
+    label: "{{ hc.name }}"
+
+- name: Reload systemd daemon
+  systemd:
+    daemon_reload: yes
+
+# Ungated on purpose: enabling a timer is deployment, not monitoring. The
+# deprecation banner swept this up with the push plumbing, so Ansible stopped
+# managing three timers that are in fact running on the host.
+- name: Enable and start health check timers
+  systemd:
+    name: "mempool-{{ hc.name }}-healthcheck.timer"
+    enabled: yes
+    state: started
+  loop: "{{ mempool_healthchecks }}"
+  loop_control:
+    loop_var: hc
+    label: "{{ hc.name }}"
diff --git a/ansible/roles/mempool/tasks/main.yml b/ansible/roles/mempool/tasks/main.yml
new file mode 100644
index 0000000..9feb652
--- /dev/null
+++ b/ansible/roles/mempool/tasks/main.yml
@@ -0,0 +1,6 @@
+---
+# import_tasks, not include_tasks: static imports stay visible to --list-tasks,
+# which is how this conversion was verified against the playbook it replaced.
+- ansible.builtin.import_tasks: docker.yml
+- ansible.builtin.import_tasks: deploy.yml
+- ansible.builtin.import_tasks: healthcheck.yml
diff --git a/ansible/roles/mempool/templates/docker-compose.yml.j2 b/ansible/roles/mempool/templates/docker-compose.yml.j2
new file mode 100644
index 0000000..fda2ad1
--- /dev/null
+++ b/ansible/roles/mempool/templates/docker-compose.yml.j2
@@ -0,0 +1,75 @@
+# All containers use host network for Tailscale MagicDNS resolution
+services:
+  mariadb:
+    image: mariadb:10.11
+    container_name: mempool-db
+    restart: unless-stopped
+    network_mode: host
+    environment:
+      MYSQL_DATABASE: "{{ mariadb_database }}"
+      MYSQL_USER: "{{ mariadb_user }}"
+      MYSQL_PASSWORD: "{{ mariadb_mempool_password }}"
+      MYSQL_ROOT_PASSWORD: "{{ mariadb_mempool_password }}"
+    volumes:
+      - {{ mempool_mysql_dir }}:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+
+  mempool-backend:
+    image: mempool/backend:{{ mempool_version }}
+    container_name: mempool-backend
+    restart: unless-stopped
+    network_mode: host
+    environment:
+      # Database (localhost since all containers share host network)
+      DATABASE_ENABLED: "true"
+      DATABASE_HOST: "127.0.0.1"
+      DATABASE_DATABASE: "{{ mariadb_database }}"
+      DATABASE_USERNAME: "{{ mariadb_user }}"
+      DATABASE_PASSWORD: "{{ mariadb_mempool_password }}"
+      # Bitcoin Core/Knots (via Tailnet MagicDNS)
+      CORE_RPC_HOST: "{{ bitcoin_host }}"
+      CORE_RPC_PORT: "{{ bitcoin_rpc_port }}"
+      CORE_RPC_USERNAME: "{{ bitcoin_rpc_user }}"
+      CORE_RPC_PASSWORD: "{{ bitcoin_rpc_password }}"
+      # Electrum (Fulcrum via Tailnet MagicDNS)
+      ELECTRUM_HOST: "{{ fulcrum_host }}"
+      ELECTRUM_PORT: "{{ fulcrum_port }}"
+      ELECTRUM_TLS_ENABLED: "{{ fulcrum_tls }}"
+      # Mempool settings
+      MEMPOOL_NETWORK: "{{ mempool_network }}"
+      MEMPOOL_BACKEND: "electrum"
+      MEMPOOL_CLEAR_PROTECTION_MINUTES: "20"
+      MEMPOOL_INDEXING_BLOCKS_AMOUNT: "52560"
+    volumes:
+      - {{ mempool_data_dir }}:/backend/cache
+    depends_on:
+      mariadb:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8999/api/v1/backend-info"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+
+  mempool-frontend:
+    image: mempool/frontend:{{ mempool_version }}
+    container_name: mempool-frontend
+    restart: unless-stopped
+    network_mode: host
+    environment:
+      FRONTEND_HTTP_PORT: "{{ mempool_frontend_port }}"
+      BACKEND_MAINNET_HTTP_HOST: "127.0.0.1"
+    depends_on:
+      - mempool-backend
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:{{ mempool_frontend_port }}"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
diff --git a/ansible/roles/mempool/templates/healthcheck-backend.sh.j2 b/ansible/roles/mempool/templates/healthcheck-backend.sh.j2
new file mode 100644
index 0000000..3a6630a
--- /dev/null
+++ b/ansible/roles/mempool/templates/healthcheck-backend.sh.j2
@@ -0,0 +1,18 @@
+#!/bin/bash
+# Mempool backend health check — managed by Ansible (roles/mempool)
+# The exit code is the answer; systemd keeps it. Reporting is optional.
+PUSH_URL="${HEALTHCHECK_PUSH_URL:-}"
+BACKEND_PORT="{{ mempool_backend_port }}"
+
+check() {
+    curl -sf --max-time 5 "http://localhost:${BACKEND_PORT}/api/v1/backend-info" > /dev/null 2>&1
+}
+
+report() {
+    [ -n "$PUSH_URL" ] || return 0
+    curl -s --max-time 10 --retry 2 -o /dev/null \
+        "${PUSH_URL}?status=$1&msg=${2// /%20}&ping=" || true
+}
+
+if check; then report up "OK"; exit 0
+else echo "Mempool backend not responding"; report down "Mempool backend not responding"; exit 1; fi
diff --git a/ansible/roles/mempool/templates/healthcheck-frontend.sh.j2 b/ansible/roles/mempool/templates/healthcheck-frontend.sh.j2
new file mode 100644
index 0000000..b2541d3
--- /dev/null
+++ b/ansible/roles/mempool/templates/healthcheck-frontend.sh.j2
@@ -0,0 +1,18 @@
+#!/bin/bash
+# Mempool frontend health check — managed by Ansible (roles/mempool)
+# The exit code is the answer; systemd keeps it. Reporting is optional.
+PUSH_URL="${HEALTHCHECK_PUSH_URL:-}"
+FRONTEND_PORT="{{ mempool_frontend_port }}"
+
+check() {
+    curl -sf --max-time 5 "http://localhost:${FRONTEND_PORT}" > /dev/null 2>&1
+}
+
+report() {
+    [ -n "$PUSH_URL" ] || return 0
+    curl -s --max-time 10 --retry 2 -o /dev/null \
+        "${PUSH_URL}?status=$1&msg=${2// /%20}&ping=" || true
+}
+
+if check; then report up "OK"; exit 0
+else echo "Mempool frontend not responding"; report down "Mempool frontend not responding"; exit 1; fi
diff --git a/ansible/roles/mempool/templates/healthcheck-mariadb.sh.j2 b/ansible/roles/mempool/templates/healthcheck-mariadb.sh.j2
new file mode 100644
index 0000000..cbc36f5
--- /dev/null
+++ b/ansible/roles/mempool/templates/healthcheck-mariadb.sh.j2
@@ -0,0 +1,21 @@
+#!/bin/bash
+# Mempool MariaDB health check — managed by Ansible (roles/mempool)
+# The exit code is the answer; systemd keeps it. Reporting is optional.
+PUSH_URL="${HEALTHCHECK_PUSH_URL:-}"
+
+check() {
+{% raw %}
+    [ "$(docker inspect --format='{{.State.Health.Status}}' mempool-db 2>/dev/null)" = "healthy" ]
+{% endraw %}
+}
+
+report() {
+    # No push URL is normal, not an error. The previous version logged
+    # "ERROR: UPTIME_KUMA_PUSH_URL not set" on every fire, once a minute.
+    [ -n "$PUSH_URL" ] || return 0
+    curl -s --max-time 10 --retry 2 -o /dev/null \
+        "${PUSH_URL}?status=$1&msg=${2// /%20}&ping=" || true
+}
+
+if check; then report up "OK"; exit 0
+else echo "MariaDB container unhealthy"; report down "MariaDB container unhealthy"; exit 1; fi
diff --git a/ansible/roles/mempool/templates/healthcheck.service.j2 b/ansible/roles/mempool/templates/healthcheck.service.j2
new file mode 100644
index 0000000..44548bd
--- /dev/null
+++ b/ansible/roles/mempool/templates/healthcheck.service.j2
@@ -0,0 +1,14 @@
+[Unit]
+Description=Mempool {{ hc.label }} Health Check
+After=network.target docker.service
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/bin/mempool-{{ hc.name }}-healthcheck-push.sh
+Environment=HEALTHCHECK_PUSH_URL={{ hc.push_url }}
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target
diff --git a/ansible/roles/mempool/templates/healthcheck.timer.j2 b/ansible/roles/mempool/templates/healthcheck.timer.j2
new file mode 100644
index 0000000..868cb7c
--- /dev/null
+++ b/ansible/roles/mempool/templates/healthcheck.timer.j2
@@ -0,0 +1,10 @@
+[Unit]
+Description=Mempool {{ hc.name }} Health Check Timer
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=1min
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/ansible/services/mempool/deploy_mempool_playbook.yml b/ansible/services/mempool/deploy_mempool_playbook.yml
index e9cab0e..0766da0 100644
--- a/ansible/services/mempool/deploy_mempool_playbook.yml
+++ b/ansible/services/mempool/deploy_mempool_playbook.yml
@@ -1,3 +1,4 @@
+---
 - name: Deploy Mempool Block Explorer with Docker
   hosts: mempool
   become: yes
@@ -5,603 +6,17 @@
     - ../../infra_vars.yml
     - ../../services_config.yml
     - ../../infra_secrets.yml
-    - ./mempool_vars.yml
   vars:
-    mempool_subdomain: "{{ subdomains.mempool }}"
-    mempool_domain: "{{ mempool_subdomain }}.{{ root_domain }}"
-    uptime_kuma_api_url: "https://{{ subdomains.uptime_kuma }}.{{ root_domain }}"
-
-  tasks:
-    # ===========================================
-    # Docker Installation (from 910_docker_playbook.yml)
-    # ===========================================
-    - name: Remove old Docker-related packages
-      apt:
-        name:
-          - docker.io
-          - docker-doc
-          - docker-compose
-          - podman-docker
-          - containerd
-          - runc
-        state: absent
-        purge: yes
-        autoremove: yes
-
-    - name: Update apt cache
-      apt:
-        update_cache: yes
-
-    - name: Install prerequisites
-      apt:
-        name:
-          - ca-certificates
-          - curl
-        state: present
-
-    - name: Create directory for Docker GPG key
-      file:
-        path: /etc/apt/keyrings
-        state: directory
-        mode: '0755'
-
-    - name: Download Docker GPG key
-      get_url:
-        url: https://download.docker.com/linux/debian/gpg
-        dest: /etc/apt/keyrings/docker.asc
-        mode: '0644'
-
-    - name: Get Debian architecture
-      command: dpkg --print-architecture
-      register: deb_arch
-      changed_when: false
-
-    - name: Add Docker repository
-      apt_repository:
-        repo: "deb [arch={{ deb_arch.stdout }} signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
-        filename: docker
-        state: present
-        update_cache: yes
-
-    - name: Install Docker packages
-      apt:
-        name:
-          - docker-ce
-          - docker-ce-cli
-          - containerd.io
-          - docker-buildx-plugin
-          - docker-compose-plugin
-        state: present
-        update_cache: yes
-
-    - name: Ensure Docker is started and enabled
-      systemd:
-        name: docker
-        enabled: yes
-        state: started
-
-    - name: Add user to docker group
-      user:
-        name: "{{ ansible_user }}"
-        groups: docker
-        append: yes
-
-    # ===========================================
-    # Mempool Deployment
-    # ===========================================
-    - name: Create mempool directories
-      file:
-        path: "{{ item }}"
-        state: directory
-        owner: "{{ ansible_user }}"
-        group: "{{ ansible_user }}"
-        mode: '0755'
-      loop:
-        - "{{ mempool_dir }}"
-        - "{{ mempool_data_dir }}"
-        - "{{ mempool_mysql_dir }}"
-
-    - name: Create docker-compose.yml for Mempool
-      copy:
-        dest: "{{ mempool_dir }}/docker-compose.yml"
-        content: |
-          # All containers use host network for Tailscale MagicDNS resolution
-          services:
-            mariadb:
-              image: mariadb:10.11
-              container_name: mempool-db
-              restart: unless-stopped
-              network_mode: host
-              environment:
-                MYSQL_DATABASE: "{{ mariadb_database }}"
-                MYSQL_USER: "{{ mariadb_user }}"
-                MYSQL_PASSWORD: "{{ mariadb_mempool_password }}"
-                MYSQL_ROOT_PASSWORD: "{{ mariadb_mempool_password }}"
-              volumes:
-                - {{ mempool_mysql_dir }}:/var/lib/mysql
-              healthcheck:
-                test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
-                interval: 10s
-                timeout: 5s
-                retries: 5
-                start_period: 30s
-
-            mempool-backend:
-              image: mempool/backend:{{ mempool_version }}
-              container_name: mempool-backend
-              restart: unless-stopped
-              network_mode: host
-              environment:
-                # Database (localhost since all containers share host network)
-                DATABASE_ENABLED: "true"
-                DATABASE_HOST: "127.0.0.1"
-                DATABASE_DATABASE: "{{ mariadb_database }}"
-                DATABASE_USERNAME: "{{ mariadb_user }}"
-                DATABASE_PASSWORD: "{{ mariadb_mempool_password }}"
-                # Bitcoin Core/Knots (via Tailnet MagicDNS)
-                CORE_RPC_HOST: "{{ bitcoin_host }}"
-                CORE_RPC_PORT: "{{ bitcoin_rpc_port }}"
-                CORE_RPC_USERNAME: "{{ bitcoin_rpc_user }}"
-                CORE_RPC_PASSWORD: "{{ bitcoin_rpc_password }}"
-                # Electrum (Fulcrum via Tailnet MagicDNS)
-                ELECTRUM_HOST: "{{ fulcrum_host }}"
-                ELECTRUM_PORT: "{{ fulcrum_port }}"
-                ELECTRUM_TLS_ENABLED: "{{ fulcrum_tls }}"
-                # Mempool settings
-                MEMPOOL_NETWORK: "{{ mempool_network }}"
-                MEMPOOL_BACKEND: "electrum"
-                MEMPOOL_CLEAR_PROTECTION_MINUTES: "20"
-                MEMPOOL_INDEXING_BLOCKS_AMOUNT: "52560"
-              volumes:
-                - {{ mempool_data_dir }}:/backend/cache
-              depends_on:
-                mariadb:
-                  condition: service_healthy
-              healthcheck:
-                test: ["CMD", "curl", "-f", "http://localhost:8999/api/v1/backend-info"]
-                interval: 30s
-                timeout: 10s
-                retries: 3
-                start_period: 60s
-
-            mempool-frontend:
-              image: mempool/frontend:{{ mempool_version }}
-              container_name: mempool-frontend
-              restart: unless-stopped
-              network_mode: host
-              environment:
-                FRONTEND_HTTP_PORT: "{{ mempool_frontend_port }}"
-                BACKEND_MAINNET_HTTP_HOST: "127.0.0.1"
-              depends_on:
-                - mempool-backend
-              healthcheck:
-                test: ["CMD", "curl", "-f", "http://localhost:{{ mempool_frontend_port }}"]
-                interval: 30s
-                timeout: 10s
-                retries: 3
-                start_period: 30s
-        owner: "{{ ansible_user }}"
-        group: "{{ ansible_user }}"
-        mode: '0644'
-
-    - name: Pull Mempool images
-      command: docker compose pull
-      args:
-        chdir: "{{ mempool_dir }}"
-
-    - name: Deploy Mempool containers with docker compose
-      command: docker compose up -d
-      args:
-        chdir: "{{ mempool_dir }}"
-
-    - name: Wait for MariaDB to be healthy
-      command: docker inspect --format='{{ '{{' }}.State.Health.Status{{ '}}' }}' mempool-db
-      register: mariadb_health
-      until: mariadb_health.stdout == 'healthy'
-      retries: 30
-      delay: 10
-      changed_when: false
-
-    - name: Wait for Mempool backend to start
-      uri:
-        url: "http://localhost:{{ mempool_backend_port }}/api/v1/backend-info"
-        method: GET
-        status_code: 200
-        timeout: 10
-      register: backend_check
-      until: backend_check.status == 200
-      retries: 30
-      delay: 10
-      ignore_errors: yes
-
-    - name: Wait for Mempool frontend to be available
-      uri:
-        url: "http://localhost:{{ mempool_frontend_port }}"
-        method: GET
-        status_code: 200
-        timeout: 10
-      register: frontend_check
-      until: frontend_check.status == 200
-      retries: 20
-      delay: 5
-      ignore_errors: yes
-
-    # ═════════════════════════════════════════════════════════════════════════
-    # DEPRECATED — Uptime Kuma was decommissioned on 2026-09-11.
-    #
-    # Every task below is inert: uptime_kuma_enabled is false in
-    # group_vars/all/main.yml, so they all skip and the deployment above still
-    # runs normally. Kept because the health-check logic is the durable part —
-    # when a replacement exists, rewire the push transport and flip the flag.
-    #
-    # What was being monitored: archive/uptime_kuma/MONITORS.md
-    # ═════════════════════════════════════════════════════════════════════════
-    - name: Display deployment status
-      when: uptime_kuma_enabled | default(false)
-      debug:
-        msg:
-          - "Mempool deployment complete!"
-          - "Frontend: http://localhost:{{ mempool_frontend_port }}"
-          - "Backend API: http://localhost:{{ mempool_backend_port }}/api/v1/backend-info"
-          - "Backend check: {{ 'OK' if backend_check.status == 200 else 'Still initializing...' }}"
-          - "Frontend check: {{ 'OK' if frontend_check.status == 200 else 'Still initializing...' }}"
-
-    # ===========================================
-    # Health Check Scripts for Uptime Kuma Push Monitors
-    # ===========================================
-    - name: Create Mempool MariaDB health check script
-      when: uptime_kuma_enabled | default(false)
-      copy:
-        dest: /usr/local/bin/mempool-mariadb-healthcheck-push.sh
-        content: |
-          #!/bin/bash
-          UPTIME_KUMA_PUSH_URL="${UPTIME_KUMA_PUSH_URL}"
-
-          check_container() {
-              local status=$(docker inspect --format='{{ '{{' }}.State.Health.Status{{ '}}' }}' mempool-db 2>/dev/null)
-              [ "$status" = "healthy" ]
-          }
-
-          push_to_uptime_kuma() {
-              local status=$1
-              local msg=$2
-              if [ -z "$UPTIME_KUMA_PUSH_URL" ]; then
-                  echo "ERROR: UPTIME_KUMA_PUSH_URL not set"
-                  return 1
-              fi
-              curl -s --max-time 10 --retry 2 -o /dev/null \
-                  "${UPTIME_KUMA_PUSH_URL}?status=${status}&msg=${msg// /%20}&ping=" || true
-          }
-
-          if check_container; then
-              push_to_uptime_kuma "up" "OK"
-              exit 0
-          else
-              push_to_uptime_kuma "down" "MariaDB container unhealthy"
-              exit 1
-          fi
-        owner: root
-        group: root
-        mode: '0755'
-
-    - name: Create Mempool backend health check script
-      when: uptime_kuma_enabled | default(false)
-      copy:
-        dest: /usr/local/bin/mempool-backend-healthcheck-push.sh
-        content: |
-          #!/bin/bash
-          UPTIME_KUMA_PUSH_URL="${UPTIME_KUMA_PUSH_URL}"
-          BACKEND_PORT={{ mempool_backend_port }}
-
-          check_backend() {
-              curl -sf --max-time 5 "http://localhost:${BACKEND_PORT}/api/v1/backend-info" > /dev/null 2>&1
-          }
-
-          push_to_uptime_kuma() {
-              local status=$1
-              local msg=$2
-              if [ -z "$UPTIME_KUMA_PUSH_URL" ]; then
-                  echo "ERROR: UPTIME_KUMA_PUSH_URL not set"
-                  return 1
-              fi
-              curl -s --max-time 10 --retry 2 -o /dev/null \
-                  "${UPTIME_KUMA_PUSH_URL}?status=${status}&msg=${msg// /%20}&ping=" || true
-          }
-
-          if check_backend; then
-              push_to_uptime_kuma "up" "OK"
-              exit 0
-          else
-              push_to_uptime_kuma "down" "Backend API not responding"
-              exit 1
-          fi
-        owner: root
-        group: root
-        mode: '0755'
-
-    - name: Create Mempool frontend health check script
-      when: uptime_kuma_enabled | default(false)
-      copy:
-        dest: /usr/local/bin/mempool-frontend-healthcheck-push.sh
-        content: |
-          #!/bin/bash
-          UPTIME_KUMA_PUSH_URL="${UPTIME_KUMA_PUSH_URL}"
-          FRONTEND_PORT={{ mempool_frontend_port }}
-
-          check_frontend() {
-              curl -sf --max-time 5 "http://localhost:${FRONTEND_PORT}" > /dev/null 2>&1
-          }
-
-          push_to_uptime_kuma() {
-              local status=$1
-              local msg=$2
-              if [ -z "$UPTIME_KUMA_PUSH_URL" ]; then
-                  echo "ERROR: UPTIME_KUMA_PUSH_URL not set"
-                  return 1
-              fi
-              curl -s --max-time 10 --retry 2 -o /dev/null \
-                  "${UPTIME_KUMA_PUSH_URL}?status=${status}&msg=${msg// /%20}&ping=" || true
-          }
-
-          if check_frontend; then
-              push_to_uptime_kuma "up" "OK"
-              exit 0
-          else
-              push_to_uptime_kuma "down" "Frontend not responding"
-              exit 1
-          fi
-        owner: root
-        group: root
-        mode: '0755'
-
-    # ===========================================
-    # Systemd Timers for Health Checks
-    # ===========================================
-    - name: Create systemd services for health checks
-      copy:
-        dest: "/etc/systemd/system/mempool-{{ item.name }}-healthcheck.service"
-        content: |
-          [Unit]
-          Description=Mempool {{ item.label }} Health Check
-          After=network.target docker.service
-
-          [Service]
-          Type=oneshot
-          User=root
-          ExecStart=/usr/local/bin/mempool-{{ item.name }}-healthcheck-push.sh
-          Environment=UPTIME_KUMA_PUSH_URL=
-          StandardOutput=journal
-          StandardError=journal
-
-          [Install]
-          WantedBy=multi-user.target
-        owner: root
-        group: root
-        mode: '0644'
-      loop:
-        - { name: "mariadb", label: "MariaDB" }
-        - { name: "backend", label: "Backend" }
-        - { name: "frontend", label: "Frontend" }
-
-    - name: Create systemd timers for health checks
-      copy:
-        dest: "/etc/systemd/system/mempool-{{ item }}-healthcheck.timer"
-        content: |
-          [Unit]
-          Description=Mempool {{ item }} Health Check Timer
-
-          [Timer]
-          OnBootSec=2min
-          OnUnitActiveSec=1min
-          Persistent=true
-
-          [Install]
-          WantedBy=timers.target
-        owner: root
-        group: root
-        mode: '0644'
-      loop:
-        - mariadb
-        - backend
-        - frontend
-
-    - name: Reload systemd daemon
-      systemd:
-        daemon_reload: yes
-
-    - name: Enable and start health check timers
-      when: uptime_kuma_enabled | default(false)
-      systemd:
-        name: "mempool-{{ item }}-healthcheck.timer"
-        enabled: yes
-        state: started
-      loop:
-        - mariadb
-        - backend
-        - frontend
-
-    # ===========================================
-    # Uptime Kuma Push Monitor Setup
-    # ===========================================
-    - name: Create Uptime Kuma push monitor setup script for Mempool
-      when: uptime_kuma_enabled | default(false)
-      delegate_to: localhost
-      become: no
-      copy:
-        dest: /tmp/setup_mempool_monitors.py
-        content: |
-          #!/usr/bin/env python3
-          import sys
-          import traceback
-          import yaml
-          from uptime_kuma_api import UptimeKumaApi, MonitorType
-
-          try:
-              with open('/tmp/ansible_mempool_config.yml', 'r') as f:
-                  config = yaml.safe_load(f)
-
-              url = config['uptime_kuma_url']
-              username = config['username']
-              password = config['password']
-              monitors_to_create = config['monitors']
-
-              api = UptimeKumaApi(url, timeout=30)
-              api.login(username, password)
-
-              monitors = api.get_monitors()
-
-              # Find or create "services" group
-              group = next((m for m in monitors if m.get('name') == 'services' and m.get('type') == 'group'), None)
-              if not group:
-                  api.add_monitor(type='group', name='services')
-                  monitors = api.get_monitors()
-                  group = next((m for m in monitors if m.get('name') == 'services' and m.get('type') == 'group'), None)
-
-              # Get ntfy notification ID
-              notifications = api.get_notifications()
-              ntfy_notification_id = None
-              for notif in notifications:
-                  if notif.get('type') == 'ntfy':
-                      ntfy_notification_id = notif.get('id')
-                      break
-
-              results = {}
-              for monitor_name in monitors_to_create:
-                  existing = next((m for m in monitors if m.get('name') == monitor_name), None)
-
-                  if existing:
-                      print(f"Monitor '{monitor_name}' already exists (ID: {existing['id']})")
-                      push_token = existing.get('pushToken') or existing.get('push_token')
-                      if push_token:
-                          results[monitor_name] = f"{url}/api/push/{push_token}"
-                          print(f"Push URL ({monitor_name}): {results[monitor_name]}")
-                  else:
-                      print(f"Creating push monitor '{monitor_name}'...")
-                      api.add_monitor(
-                          type=MonitorType.PUSH,
-                          name=monitor_name,
-                          parent=group['id'],
-                          interval=90,
-                          maxretries=3,
-                          retryInterval=60,
-                          notificationIDList={ntfy_notification_id: True} if ntfy_notification_id else {}
-                      )
-                      monitors = api.get_monitors()
-                      new_monitor = next((m for m in monitors if m.get('name') == monitor_name), None)
-                      if new_monitor:
-                          push_token = new_monitor.get('pushToken') or new_monitor.get('push_token')
-                          if push_token:
-                              results[monitor_name] = f"{url}/api/push/{push_token}"
-                              print(f"Push URL ({monitor_name}): {results[monitor_name]}")
-
-              api.disconnect()
-              print("SUCCESS")
-
-              # Write results to file for Ansible to read
-              with open('/tmp/mempool_push_urls.yml', 'w') as f:
-                  yaml.dump(results, f)
-
-          except Exception as e:
-              print(f"ERROR: {str(e)}", file=sys.stderr)
-              traceback.print_exc(file=sys.stderr)
-              sys.exit(1)
-        mode: '0755'
-
-    - name: Create temporary config for monitor setup
-      when: uptime_kuma_enabled | default(false)
-      delegate_to: localhost
-      become: no
-      copy:
-        dest: /tmp/ansible_mempool_config.yml
-        content: |
-          uptime_kuma_url: "{{ uptime_kuma_api_url }}"
-          username: "{{ uptime_kuma_username }}"
-          password: "{{ uptime_kuma_password }}"
-          monitors:
-            - "Mempool MariaDB"
-            - "Mempool Backend"
-            - "Mempool Frontend"
-        mode: '0644'
-
-    - name: Run Uptime Kuma push monitor setup
-      when: uptime_kuma_enabled | default(false)
-      command: python3 /tmp/setup_mempool_monitors.py
-      delegate_to: localhost
-      become: no
-      register: monitor_setup
-      changed_when: "'SUCCESS' in monitor_setup.stdout"
-      ignore_errors: yes
-
-    - name: Display monitor setup output
-      debug:
-        msg: "{{ monitor_setup.stdout_lines }}"
-      when: monitor_setup.stdout is defined
-
-    - name: Read push URLs from file
-      when: uptime_kuma_enabled | default(false)
-      slurp:
-        src: /tmp/mempool_push_urls.yml
-      delegate_to: localhost
-      become: no
-      register: push_urls_file
-      ignore_errors: yes
-
-    - name: Parse push URLs
-      set_fact:
-        push_urls: "{{ push_urls_file.content | b64decode | from_yaml }}"
-      when: push_urls_file.content is defined
-      ignore_errors: yes
-
-    - name: Update MariaDB health check service with push URL
-      lineinfile:
-        path: /etc/systemd/system/mempool-mariadb-healthcheck.service
-        regexp: '^Environment=UPTIME_KUMA_PUSH_URL='
-        line: "Environment=UPTIME_KUMA_PUSH_URL={{ push_urls['Mempool MariaDB'] }}"
-        insertafter: '^\[Service\]'
-      when: push_urls is defined and push_urls['Mempool MariaDB'] is defined
-
-    - name: Update Backend health check service with push URL
-      lineinfile:
-        path: /etc/systemd/system/mempool-backend-healthcheck.service
-        regexp: '^Environment=UPTIME_KUMA_PUSH_URL='
-        line: "Environment=UPTIME_KUMA_PUSH_URL={{ push_urls['Mempool Backend'] }}"
-        insertafter: '^\[Service\]'
-      when: push_urls is defined and push_urls['Mempool Backend'] is defined
-
-    - name: Update Frontend health check service with push URL
-      lineinfile:
-        path: /etc/systemd/system/mempool-frontend-healthcheck.service
-        regexp: '^Environment=UPTIME_KUMA_PUSH_URL='
-        line: "Environment=UPTIME_KUMA_PUSH_URL={{ push_urls['Mempool Frontend'] }}"
-        insertafter: '^\[Service\]'
-      when: push_urls is defined and push_urls['Mempool Frontend'] is defined
-
-    - name: Reload systemd after push URL updates
-      systemd:
-        daemon_reload: yes
-      when: push_urls is defined
-
-    - name: Restart health check timers
-      systemd:
-        name: "mempool-{{ item }}-healthcheck.timer"
-        state: restarted
-      loop:
-        - mariadb
-        - backend
-        - frontend
-      when: push_urls is defined
-
-    - name: Clean up temporary files
-      when: uptime_kuma_enabled | default(false)
-      delegate_to: localhost
-      become: no
-      file:
-        path: "{{ item }}"
-        state: absent
-      loop:
-        - /tmp/setup_mempool_monitors.py
-        - /tmp/ansible_mempool_config.yml
-        - /tmp/mempool_push_urls.yml
+    # Preserves the three push URLs these checks have been reporting to all
+    # along, so the move to a role changes no behaviour. The role knows nothing
+    # about Uptime Kuma — these are just "URLs that accept a ping", and whatever
+    # replaces it sets the same values.
+    mempool_healthchecks:
+      - {name: mariadb,  label: MariaDB,  push_url: "{{ healthcheck_push_urls.mempool.mariadb  | default('') }}"}
+      - {name: backend,  label: Backend,  push_url: "{{ healthcheck_push_urls.mempool.backend  | default('') }}"}
+      - {name: frontend, label: Frontend, push_url: "{{ healthcheck_push_urls.mempool.frontend | default('') }}"}
+  roles:
+    - mempool
 
 - name: Configure Caddy reverse proxy for Mempool on the edge host
   hosts: edge
@@ -609,12 +24,8 @@
   vars_files:
     - ../../infra_vars.yml
     - ../../services_config.yml
-    - ../../infra_secrets.yml
-    - ./mempool_vars.yml
   vars:
-    mempool_subdomain: "{{ subdomains.mempool }}"
-    mempool_domain: "{{ mempool_subdomain }}.{{ root_domain }}"
-
+    mempool_domain: "{{ subdomains.mempool }}.{{ root_domain }}"
   tasks:
     - name: Publish Mempool through Caddy (via Tailscale)
       ansible.builtin.include_role:
@@ -622,124 +33,5 @@
       vars:
         caddy_site_name: mempool
         caddy_site_domain: "{{ mempool_domain }}"
-        caddy_site_upstream: "mempool-box:{{ mempool_frontend_port }}"
+        caddy_site_upstream: "mempool-box:{{ service_settings.mempool.frontend_port }}"
         caddy_site_resolvers: "100.100.100.100"
-
-    - name: Display Mempool URL
-      when: uptime_kuma_enabled | default(false)
-      debug:
-        msg: "Mempool is now available at https://{{ mempool_domain }}"
-
-    # ===========================================
-    # Uptime Kuma HTTP Monitor for Public Endpoint
-    # ===========================================
-    - name: Create Uptime Kuma HTTP monitor setup script for Mempool
-      when: uptime_kuma_enabled | default(false)
-      delegate_to: localhost
-      become: no
-      copy:
-        dest: /tmp/setup_mempool_http_monitor.py
-        content: |
-          #!/usr/bin/env python3
-          import sys
-          import traceback
-          import yaml
-          from uptime_kuma_api import UptimeKumaApi, MonitorType
-
-          try:
-              with open('/tmp/ansible_mempool_http_config.yml', 'r') as f:
-                  config = yaml.safe_load(f)
-
-              url = config['uptime_kuma_url']
-              username = config['username']
-              password = config['password']
-              monitor_url = config['monitor_url']
-              monitor_name = config['monitor_name']
-
-              api = UptimeKumaApi(url, timeout=30)
-              api.login(username, password)
-
-              monitors = api.get_monitors()
-
-              # Find or create "services" group
-              group = next((m for m in monitors if m.get('name') == 'services' and m.get('type') == 'group'), None)
-              if not group:
-                  api.add_monitor(type='group', name='services')
-                  monitors = api.get_monitors()
-                  group = next((m for m in monitors if m.get('name') == 'services' and m.get('type') == 'group'), None)
-
-              # Check if monitor already exists
-              existing = next((m for m in monitors if m.get('name') == monitor_name), None)
-
-              # Get ntfy notification ID
-              notifications = api.get_notifications()
-              ntfy_notification_id = None
-              for notif in notifications:
-                  if notif.get('type') == 'ntfy':
-                      ntfy_notification_id = notif.get('id')
-                      break
-
-              if existing:
-                  print(f"Monitor '{monitor_name}' already exists (ID: {existing['id']})")
-                  print("Skipping - monitor already configured")
-              else:
-                  print(f"Creating HTTP monitor '{monitor_name}'...")
-                  api.add_monitor(
-                      type=MonitorType.HTTP,
-                      name=monitor_name,
-                      url=monitor_url,
-                      parent=group['id'],
-                      interval=60,
-                      maxretries=3,
-                      retryInterval=60,
-                      notificationIDList={ntfy_notification_id: True} if ntfy_notification_id else {}
-                  )
-
-              api.disconnect()
-              print("SUCCESS")
-
-          except Exception as e:
-              print(f"ERROR: {str(e)}", file=sys.stderr)
-              traceback.print_exc(file=sys.stderr)
-              sys.exit(1)
-        mode: '0755'
-
-    - name: Create temporary config for HTTP monitor setup
-      when: uptime_kuma_enabled | default(false)
-      delegate_to: localhost
-      become: no
-      copy:
-        dest: /tmp/ansible_mempool_http_config.yml
-        content: |
-          uptime_kuma_url: "https://{{ subdomains.uptime_kuma }}.{{ root_domain }}"
-          username: "{{ uptime_kuma_username }}"
-          password: "{{ uptime_kuma_password }}"
-          monitor_url: "https://{{ mempool_domain }}"
-          monitor_name: "Mempool Public Access"
-        mode: '0644'
-
-    - name: Run Uptime Kuma HTTP monitor setup
-      when: uptime_kuma_enabled | default(false)
-      command: python3 /tmp/setup_mempool_http_monitor.py
-      delegate_to: localhost
-      become: no
-      register: http_monitor_setup
-      changed_when: "'SUCCESS' in http_monitor_setup.stdout"
-      ignore_errors: yes
-
-    - name: Display HTTP monitor setup output
-      debug:
-        msg: "{{ http_monitor_setup.stdout_lines }}"
-      when: http_monitor_setup.stdout is defined
-
-    - name: Clean up HTTP monitor temporary files
-      when: uptime_kuma_enabled | default(false)
-      delegate_to: localhost
-      become: no
-      file:
-        path: "{{ item }}"
-        state: absent
-      loop:
-        - /tmp/setup_mempool_http_monitor.py
-        - /tmp/ansible_mempool_http_config.yml
-
diff --git a/ansible/services/mempool/mempool_vars.yml b/ansible/services/mempool/mempool_vars.yml
deleted file mode 100644
index d3051c3..0000000
--- a/ansible/services/mempool/mempool_vars.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-# Mempool Configuration Variables
-
-# Version - Pinned to specific release
-mempool_version: "v3.2.1"
-
-# Directories
-mempool_dir: /opt/mempool
-mempool_data_dir: "{{ mempool_dir }}/data"
-mempool_mysql_dir: "{{ mempool_dir }}/mysql"
-
-# Network - Bitcoin Core/Knots connection (via Tailnet Magic DNS)
-bitcoin_host: "knots-box"
-bitcoin_rpc_port: 8332
-# Note: bitcoin_rpc_user and bitcoin_rpc_password are loaded from infra_secrets.yml
-
-# Network - Fulcrum Electrum server (via Tailnet Magic DNS)
-fulcrum_host: "fulcrum-box"
-fulcrum_port: 50001
-fulcrum_tls: "false"
-
-# Mempool network mode
-mempool_network: "mainnet"
-
-# Container ports (internal)
-mempool_frontend_port: 8080
-mempool_backend_port: 8999
-
-# MariaDB settings
-mariadb_database: "mempool"
-mariadb_user: "mempool"
-# Note: mariadb_mempool_password is loaded from infra_secrets.yml
-
-
diff --git a/ansible/services_config.yml b/ansible/services_config.yml
index a20c853..5014297 100644
--- a/ansible/services_config.yml
+++ b/ansible/services_config.yml
@@ -40,3 +40,9 @@ service_settings:
     topic: alerts
   headscale:
     namespace: counter-net
+  mempool:
+    # The frontend port is needed in two places on two different hosts: the
+    # mempool role deploys it on mempool-box, and the Caddy play proxies to it
+    # from the edge host. A role default cannot serve the second play, so it
+    # lives here rather than in roles/mempool/defaults.
+    frontend_port: 8080