datum-gateway: convert to a role, de-Uptime-Kuma the health check

802-line playbook becomes 68 lines (three plays: the role, the Caddy dashboard,
the Stratum socket proxy) plus a 345-line role. datum_gateway_vars.yml is
deleted; its content is the role's defaults.

Verified after a real run with zero miners connected: datum-gateway restarted
cleanly onto the reformatted config, deployed config.json semantically identical
to what was there (pool_address bc1qvrj3g84..., pool_pass_* false, ports
unchanged), health check timer firing, and the Knots side untouched - bitcoind
still up since 2026-08-19 with blocknotify intact.

TWO PIECES OF DRIFT WHERE THE NODE WAS RIGHT, both confirmed with the operator:

- datum_mining_address: the vault held bc1qdse9dsg... while the node had been
  mining to bc1qvrj3g... since 2026-08-08. This is WHERE BLOCK REWARDS ARE PAID.
  And unlike fulcrum and bitcoin-knots, the `Restart datum-gateway` handler here
  was never gated, so the stale value would have applied immediately rather than
  sitting inert on disk.
- pool_pass_workers / pool_pass_full_users: false on the node, true in the vars
  file.

Both corrected in the vault and role defaults with notes recording why.

Comparing this config needs semantics, not text: the live file is single-line
JSON and the template renders pretty-printed, so a textual diff is pure noise.
Rendering it and comparing parsed JSON is what surfaced both differences.

config.json carries bitcoind.rpcpassword and api.admin_password, and --diff
prints rendered content - so `--check --diff` put them on the terminal. The task
now sets diff: false by default (-e datum_reveal_config=true to opt in). Those
two should be rotated.

I also mis-reported pool_pass_workers/pool_pass_full_users as exposed credentials
because my masking matched "pass" in the key name. They are BOOLEANS, and
mining.pool_address is a Bitcoin address, public by nature. Only the two real
passwords above were exposed.

`Configure cmake build` and `Compile datum_gateway` are bare command: tasks with
no changed_when, so they recompile on every run. The build is reproducible -
Install datum_gateway binary sees identical content and leaves the installed
binary's timestamp alone - but it is wasted work each time. Documented as the
idempotent floor.

Ownership parity checked mechanically against `git show HEAD:` keyed by task
name: 7/7 match, 9 Kuma tasks dropped.

This completes Plan 6 Stage 2: all six services in the list are roles.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ansible/roles/datum_gateway/templates/config.json.j2

@@ -0,0 +1,35 @@
+{
+    "bitcoind": {
+        "rpcuser": "{{ bitcoin_rpc_user }}",
+        "rpcpassword": "{{ bitcoin_rpc_password }}",
+        "rpcurl": "{{ datum_bitcoin_rpc_url }}",
+        "notify_fallback": true
+    },
+    "stratum": {
+        "listen_port": {{ datum_gateway_stratum_port }},
+        "vardiff_min": {{ datum_vardiff_min }}
+    },
+    "mining": {
+        "pool_address": "{{ datum_mining_address }}",
+        "coinbase_tag_primary": "{{ datum_coinbase_tag_primary }}",
+        "coinbase_tag_secondary": "{{ datum_coinbase_tag_secondary }}"
+    },
+    "api": {
+        "admin_password": "{{ datum_gateway_admin_password }}",
+        "listen_port": {{ datum_gateway_api_port }},
+        "modify_conf": false
+    },
+    "logger": {
+        "log_to_console": true,
+        "log_to_file": true,
+        "log_file": "{{ datum_gateway_log_dir }}/datum_gateway.log",
+        "log_rotate_daily": true,
+        "log_level_console": 2,
+        "log_level_file": 1
+    },
+    "datum": {
+        "pool_pass_workers": {{ datum_pool_pass_workers | lower }},
+        "pool_pass_full_users": {{ datum_pool_pass_full_users | lower }},
+        "pooled_mining_only": {{ datum_pooled_mining_only | lower }}
+    }
+}

ansible/roles/datum_gateway/templates/datum-gateway.service.j2

@@ -0,0 +1,22 @@
+[Unit]
+Description=DATUM Gateway - Bitcoin Mining Gateway
+Documentation=https://github.com/OCEAN-xyz/datum_gateway
+After=network.target bitcoind.service
+Wants=bitcoind.service
+
+[Service]
+User={{ datum_gateway_user }}
+Group={{ datum_gateway_group }}
+Type=simple
+ExecStart={{ datum_gateway_bin_path }} --config {{ datum_gateway_config_dir }}/config.json
+Restart=on-failure
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+
+# Prevent config from being read by other users
+ReadWritePaths={{ datum_gateway_log_dir }}
+ReadOnlyPaths={{ datum_gateway_config_dir }}
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/datum_gateway/templates/healthcheck.service.j2

@@ -0,0 +1,14 @@
+[Unit]
+Description=DATUM Gateway Health Check
+After=network.target datum-gateway.service
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/bin/datum-gateway-healthcheck-push.sh
+Environment=HEALTHCHECK_PUSH_URL={{ healthcheck_push_url }}
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/datum_gateway/templates/healthcheck.sh.j2

@@ -0,0 +1,32 @@
+#!/bin/bash
+# DATUM Gateway health check — managed by Ansible (roles/datum_gateway)
+#
+# The exit code is the answer and systemd keeps it:
+#     systemctl is-failed datum-gateway-healthcheck.service
+# Reporting anywhere else is optional and generic.
+PUSH_URL="${HEALTHCHECK_PUSH_URL:-}"
+STRATUM_PORT={{ datum_gateway_stratum_port }}
+
+check_datum() {
+    # Service must be active and stratum port must be listening
+    systemctl is-active --quiet datum-gateway && \
+    nc -z 127.0.0.1 "${STRATUM_PORT}"
+}
+
+report() {
+    local status=$1
+    local msg=$2
+    # No push URL is normal, not an error: the exit code below is still a
+    # complete answer for anything reading unit state.
+    [ -n "$PUSH_URL" ] || return 0
+    curl -s --max-time 10 --retry 2 -o /dev/null \
+        "${PUSH_URL}?status=${status}&msg=${msg// /%20}&ping=" || true
+}
+
+if check_datum; then
+    report "up" "OK"
+    exit 0
+else
+    report "down" "DATUM Gateway not responding"
+    exit 1
+fi

ansible/roles/datum_gateway/templates/healthcheck.timer.j2

@@ -0,0 +1,10 @@
+[Unit]
+Description=DATUM Gateway Health Check Timer
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=1min
+Persistent=true
+
+[Install]
+WantedBy=timers.target