phoenixd: convert to a role, de-Uptime-Kuma the health check

552-line playbook becomes 18 lines plus a 411-line role
(install/service/healthcheck phases, four templates, two handlers).
phoenixd_vars.yml is deleted; its content is the role's defaults.

Task-list diff vs the old playbook shows ONLY the eight Uptime Kuma tasks
removed - everything else identical and in the same order.

phoenixd holds a Lightning node, so the run was checked against a pre-flight:

  before: channel 6c25fa83..., balanceSat 1550723, capacitySat 3114830,
          blockHeight 966692, active since 2026-09-02
  after:  identical, and still active since 2026-09-02 - it did NOT restart

`Create phoenixd systemd service` came back unchanged, which is what proves the
template reproduces the live unit byte-for-byte. changed=3 was the health check
script, its unit (Environment rename), and the timer restart. Second run:
changed=0.

Two things the conversion fixed, both symptoms of the deprecation banner having
been applied to contiguous blocks rather than to individual tasks:

- The health check logged "ERROR: UPTIME_KUMA_PUSH_URL not set" on every fire -
  about 1,400 times a day - because its Environment= was emptied at
  decommissioning. The exit code was still correct so nothing was broken, but it
  is exactly the kind of noise that trains you to ignore a log. An unset push
  URL is now normal and silent.
- `Enable and start phoenixd health check timer` was guarded by
  uptime_kuma_enabled and so had not run since the decommissioning, while the
  timer itself was still live on the host from before. Ansible had quietly
  stopped managing something that was still running. Ungated.

Noted, not changed: seed.dat is mode 0644 on the host. That is phoenixd's own
doing, but it is a Lightning seed and worth tightening.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ansible/roles/phoenixd/tasks/healthcheck.yml

@@ -0,0 +1,68 @@
+---
+# Everything here answers "is phoenixd healthy" and records the answer. The
+# Uptime Kuma specifics that used to follow it — an embedded Python script
+# creating monitors over the API, a /tmp credentials file, a push-URL file read
+# back and parsed, and a systemd Environment= rewrite — are gone. What reports
+# where is now one variable, healthcheck_push_url. See the role README.
+- name: Create phoenixd health check script
+  ansible.builtin.template:
+    src: healthcheck.sh.j2
+    dest: "{{ phoenixd_healthcheck_script_path }}"
+    owner: root
+    group: root
+    mode: "0755"
+    validate: "bash -n %s"
+
+- name: Create phoenixd health check systemd service
+  ansible.builtin.template:
+    src: healthcheck.service.j2
+    dest: "/etc/systemd/system/{{ phoenixd_healthcheck_service_name }}.service"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart phoenixd health check timer
+
+- name: Create phoenixd health check systemd timer
+  ansible.builtin.template:
+    src: healthcheck.timer.j2
+    dest: "/etc/systemd/system/{{ phoenixd_healthcheck_service_name }}.timer"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart phoenixd health check timer
+
+- name: Reload systemd daemon after health check units
+  systemd:
+    daemon_reload: yes
+
+# Ungated on purpose. This was guarded by `uptime_kuma_enabled`, but enabling a
+# timer is deployment, not monitoring — the deprecation banner swept it up with
+# the push plumbing. The timer is in fact running on the host, from before the
+# decommissioning, so the guard meant Ansible had stopped managing something
+# that was still live.
+- name: Enable and start phoenixd health check timer
+  systemd:
+    name: "{{ phoenixd_healthcheck_service_name }}.timer"
+    enabled: yes
+    state: started
+
+- name: Display post-install information
+  debug:
+    msg: |
+      ✓ phoenixd {{ phoenixd_version }} deployed
+
+      Status:      systemctl status phoenixd
+      Logs:        journalctl -u phoenixd -f
+      CLI:         sudo PHOENIX_DATADIR={{ phoenixd_data_dir }} phoenix-cli --http-bind-port {{ phoenixd_http_bind_port }} getinfo
+      HTTP API:    http://{{ phoenixd_http_bind_ip }}:{{ phoenixd_http_bind_port }} (loopback only)
+      Data dir:    {{ phoenixd_data_dir }}
+      Health:      systemctl is-failed {{ phoenixd_healthcheck_service_name }}.service
+
+      API password (needed to wire LNBits up to this node):
+        sudo grep '^http-password=' {{ phoenixd_data_dir }}/phoenix.conf
+
+      ⚠️  BACK UP THE SEED: {{ phoenixd_data_dir }}/seed.dat
+          Losing it means losing the funds. phoenixd is deliberately excluded
+          from the automated backups (Plan 5, Model C) because the seed is 12
+          fixed words — write them down offline, once:
+            sudo cat {{ phoenixd_data_dir }}/seed.dat

ansible/roles/phoenixd/tasks/install.yml

@@ -0,0 +1,125 @@
+---
+- name: Install phoenixd runtime dependencies
+  apt:
+    name:
+      - unzip
+      - curl
+    state: present
+    update_cache: yes
+
+# System User and Directories
+- name: Create phoenixd system group
+  group:
+    name: "{{ phoenixd_group }}"
+    system: yes
+
+- name: Create phoenixd system user
+  user:
+    name: "{{ phoenixd_user }}"
+    group: "{{ phoenixd_group }}"
+    system: yes
+    shell: /usr/sbin/nologin
+    home: "{{ phoenixd_home }}"
+    create_home: yes
+    comment: "phoenixd Lightning node"
+
+- name: Create phoenixd home directory
+  file:
+    path: "{{ phoenixd_home }}"
+    state: directory
+    owner: "{{ phoenixd_user }}"
+    group: "{{ phoenixd_group }}"
+    mode: "0750"
+
+- name: Create phoenixd data directory
+  file:
+    path: "{{ phoenixd_data_dir }}"
+    state: directory
+    owner: "{{ phoenixd_user }}"
+    group: "{{ phoenixd_group }}"
+    mode: "0700"
+
+# Download and Install
+- name: Check if phoenixd is already installed
+  stat:
+    path: "{{ phoenixd_bin_dir }}/phoenixd"
+  register: phoenixd_binary
+
+- name: Check installed phoenixd version
+  command: "{{ phoenixd_bin_dir }}/phoenixd --version"
+  register: phoenixd_installed_version
+  changed_when: false
+  failed_when: false
+  when: phoenixd_binary.stat.exists
+
+- name: Decide whether phoenixd needs installing
+  set_fact:
+    phoenixd_needs_install: >-
+      {{ not phoenixd_binary.stat.exists
+         or phoenixd_version not in (phoenixd_installed_version.stdout | default('')) }}
+
+- name: Download phoenixd {{ phoenixd_version }}
+  get_url:
+    url: "{{ phoenixd_url }}"
+    dest: "/tmp/phoenixd-{{ phoenixd_version }}.zip"
+    mode: "0644"
+  when: phoenixd_needs_install | bool
+
+- name: Create temporary extraction directory
+  file:
+    path: /tmp/phoenixd-extract
+    state: directory
+    mode: "0755"
+  when: phoenixd_needs_install | bool
+
+- name: Extract phoenixd archive
+  unarchive:
+    src: "/tmp/phoenixd-{{ phoenixd_version }}.zip"
+    dest: /tmp/phoenixd-extract
+    remote_src: yes
+  when: phoenixd_needs_install | bool
+
+- name: Locate extracted binaries
+  find:
+    paths: /tmp/phoenixd-extract
+    patterns: "{{ item }}"
+    recurse: yes
+    file_type: file
+  register: phoenixd_extracted
+  loop:
+    - phoenixd
+    - phoenix-cli
+  when: phoenixd_needs_install | bool
+
+- name: Fail if the archive did not contain the expected binaries
+  assert:
+    that:
+      - item.files | length > 0
+    fail_msg: "Could not find '{{ item.item }}' in the phoenixd {{ phoenixd_version }} archive"
+  loop: "{{ phoenixd_extracted.results }}"
+  loop_control:
+    label: "{{ item.item }}"
+  when: phoenixd_needs_install | bool
+
+- name: Install phoenixd and phoenix-cli binaries
+  copy:
+    src: "{{ item.files[0].path }}"
+    dest: "{{ phoenixd_bin_dir }}/{{ item.item }}"
+    remote_src: yes
+    owner: root
+    group: root
+    mode: "0755"
+  loop: "{{ phoenixd_extracted.results }}"
+  loop_control:
+    label: "{{ item.item }}"
+  when: phoenixd_needs_install | bool
+  notify: Restart phoenixd
+
+- name: Clean up phoenixd download artifacts
+  file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - "/tmp/phoenixd-{{ phoenixd_version }}.zip"
+    - /tmp/phoenixd-extract
+

ansible/roles/phoenixd/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+# import_tasks, not include_tasks: static imports stay visible to --list-tasks,
+# which is how this conversion was verified against the playbook it replaced.
+- ansible.builtin.import_tasks: install.yml
+- ansible.builtin.import_tasks: service.yml
+- ansible.builtin.import_tasks: healthcheck.yml

ansible/roles/phoenixd/tasks/service.yml

@@ -0,0 +1,52 @@
+---
+- name: Build phoenixd command line arguments
+  set_fact:
+    phoenixd_args: >-
+      {{ (['--agree-to-terms-of-service'] if phoenixd_agree_tos else [])
+         + ['--chain', phoenixd_chain]
+         + ['--auto-liquidity', phoenixd_auto_liquidity]
+         + ['--http-bind-ip', phoenixd_http_bind_ip]
+         + ['--http-bind-port', phoenixd_http_bind_port | string]
+         + (['--max-mining-fee', phoenixd_max_mining_fee | string] if phoenixd_max_mining_fee else [])
+         + (['--webhook', phoenixd_webhook_url] if phoenixd_webhook_url else [])
+         + ['--silent'] }}
+
+- name: Create phoenixd systemd service
+  ansible.builtin.template:
+    src: phoenixd.service.j2
+    dest: /etc/systemd/system/phoenixd.service
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart phoenixd
+
+- name: Reload systemd daemon
+  systemd:
+    daemon_reload: yes
+
+- name: Enable and start phoenixd
+  systemd:
+    name: phoenixd
+    enabled: yes
+    state: started
+
+- name: Flush handlers so phoenixd is running before we inspect its data dir
+  meta: flush_handlers
+
+# --- First boot checks ---
+- name: Wait for phoenixd to write its config file
+  wait_for:
+    path: "{{ phoenixd_data_dir }}/phoenix.conf"
+    state: present
+    timeout: 120
+
+- name: Check that the seed file exists
+  stat:
+    path: "{{ phoenixd_data_dir }}/seed.dat"
+  register: phoenixd_seed_file
+
+- name: Fail if phoenixd did not create a seed
+  assert:
+    that:
+      - phoenixd_seed_file.stat.exists
+    fail_msg: "phoenixd started but {{ phoenixd_data_dir }}/seed.dat is missing - check 'journalctl -u phoenixd'"