mempool: convert to a role, de-Uptime-Kuma the health checks

745-line playbook becomes 37 lines (the role, plus the Caddy play for the edge
host) and a 408-line role with docker/deploy/healthcheck phases and six
templates. mempool_vars.yml is deleted; its content is the role's defaults.

Three health checks are kept, not collapsed: Mempool is three moving parts and
knowing which one is down is the point. Each has its own script, unit, timer and
push_url, driven by a mempool_healthchecks list. The Uptime Kuma specifics are
gone - the embedded Python creating monitors over the API, the /tmp credentials
file, the push-URL file read back and parsed, three Environment= rewrites - and
the three live push URLs are preserved from the vault, so reporting is unchanged.

`Enable and start health check timers` and `Display deployment status` were both
guarded by uptime_kuma_enabled despite being deployment tasks. Third service in
a row with that pattern: the deprecation banner was applied to contiguous blocks,
so anything sitting near the push plumbing was disabled with it. Ungated.

TWO OWNERSHIP PROBLEMS, different in kind:

- MINE: I wrote `owner: root` on docker-compose.yml where the original says
  `owner: "{{ ansible_user }}"`. A straight violation of extract-mechanically-
  change-nothing, caught only by reading the check-mode diff line by line.
  Reverted to match the original.

- PRE-EXISTING, and dangerous: the playbook declared
  `owner: "{{ ansible_user }}"` (1000) on the MariaDB data directory, which the
  container owns as uid 999. Confirmed against `git show HEAD:` before
  concluding it was not mine. It had drifted since the containers were created
  and went unnoticed because the playbook had not been run since.

  This was not academic. The first real run pulled a newer mariadb:10.11 and
  recreated mempool-db; with the chown still in place MariaDB would have come
  back to a data directory it could not write. The role now ensures the
  directory exists and leaves ownership to the container. Verified after the
  run: /opt/mempool/mysql is still 999:999 and all three containers are healthy.

  This is a deliberate behaviour change, not part of the extraction. It is in
  this commit rather than a follow-up because the faithful version was never
  safe to run, so there was no intermediate state worth recording as verified.

mempool_frontend_port moved to services_config.yml: two hosts need it (this role
deploys the frontend, the Caddy play proxies to it from the edge host) and a role
default is invisible to the second play. caddy_site's parameter assert caught
this loudly - "'mempool_frontend_port' is undefined" - rather than silently.

Verified: check-mode diff clean apart from unavoidable check-mode artifacts;
first run ok=24 changed=5, zero failures; second run changed=2 - the two bare
`command:` tasks (pull, compose up) that have no changed_when and always report
changed. That is the idempotent floor. All three health checks report
ExecMainStatus 0 with their push URLs intact.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ansible/roles/mempool/defaults/main.yml

@@ -0,0 +1,55 @@
+# Mempool Configuration Variables
+
+# Version - Pinned to specific release
+mempool_version: "v3.2.1"
+
+# Directories
+mempool_dir: /opt/mempool
+mempool_data_dir: "{{ mempool_dir }}/data"
+mempool_mysql_dir: "{{ mempool_dir }}/mysql"
+
+# Network - Bitcoin Core/Knots connection (via Tailnet Magic DNS)
+bitcoin_host: "knots-box"
+bitcoin_rpc_port: 8332
+# Note: bitcoin_rpc_user and bitcoin_rpc_password are loaded from infra_secrets.yml
+
+# Network - Fulcrum Electrum server (via Tailnet Magic DNS)
+fulcrum_host: "fulcrum-box"
+fulcrum_port: 50001
+fulcrum_tls: "false"
+
+# Mempool network mode
+mempool_network: "mainnet"
+
+# Container ports (internal)
+# Sourced from services_config.yml: the Caddy play on the edge host needs this
+# too, and a role default is not visible outside this role.
+mempool_frontend_port: "{{ service_settings.mempool.frontend_port }}"
+mempool_backend_port: 8999
+
+# MariaDB settings
+mariadb_database: "mempool"
+mariadb_user: "mempool"
+# Note: mariadb_mempool_password is loaded from infra_secrets.yml
+
+
+
+# --- Health checks ----------------------------------------------------------
+# Three independent checks, because Mempool is three moving parts and knowing
+# WHICH one is down is the whole point. Each records its answer in its exit
+# code, which systemd keeps:
+#     systemctl is-failed mempool-backend-healthcheck.service
+#
+# push_url is where to report, and is the single plug-in point for whatever
+# monitoring exists. Empty means check, exit honestly, report nowhere.
+# The URLs are credentials, so callers pass them from the vault.
+mempool_healthchecks:
+  - name: mariadb
+    label: MariaDB
+    push_url: ""
+  - name: backend
+    label: Backend
+    push_url: ""
+  - name: frontend
+    label: Frontend
+    push_url: ""