uptime kuma: remove every live reference, repoint the probes to Gatus

Nothing in the repo pushes to, authenticates against, or is gated by Uptime
Kuma any more.

── The sixth instance of the banner bug ────────────────────────────────────
memos had `Restart memos` guarded by `uptime_kuma_enabled`, because the
deprecation banner was placed immediately above it and swept it in. It is a
HANDLER, so every memos config change since 2026-09-11 applied to disk and
silently never restarted the service. Ungated.

That is the same failure found in forgejo-runner's self-assert, phoenixd's timer
enable, mempool's three timer enables, fulcrum's restart handler and bitcoind's
restart handler. Every guard was read and asked "monitoring or deployment?"
before being deleted, which is the only reason this was caught.

── What was removed ────────────────────────────────────────────────────────
  30 uptime_kuma_enabled guards across 7 unconverted service playbooks, and
     the 29 Kuma monitor-creation tasks they gated (embedded Python that drove
     the Kuma API, temp credential files, cleanup)
  7  dead uptime_kuma_api_url definitions
  7  stale DEPRECATED banners
     uptime_kuma_enabled and subdomains.uptime_kuma from group_vars/all
     healthcheck_push_urls from the vault - 30 push tokens
     services/ntfy/setup_ntfy_uptime_kuma_notification.yml -> archive/

The explanatory comments in the six converted roles are KEPT on purpose. They
record why a handler is ungated, and deleting the explanation invites someone
to helpfully re-add the guard.

── The probes moved rather than died ───────────────────────────────────────
Eight per-service health checks were still pushing to Kuma. They are not
superseded by infra/401: that answers "is the unit running", these answer "does
the service actually respond" - an RPC call to bitcoind, a TCP connect to
Fulcrum's Electrum port, an HTTP fetch from Mempool's backend. A process can be
perfectly `active` and useless.

So they were repointed, not deleted. Gatus external endpoints take a POST with
a bearer token and success=true|false where Kuma took a GET with ?status=up, so
report() now maps up/down to true/false internally and no call site changed.
Registered by infra/403 as the `probe` group, one token per host.

Two bugs fixed while in there:
  * forgejo-runner's check only ever reported SUCCESS - it exited before pushing
    when the runner was down, so a failure was invisible until the heartbeat
    window expired. Reporting the failure is the entire point of a check.
  * All six healthcheck .service units were mode 0644 and now carry a bearer
    token. They are 0600.

Verified: 91 endpoints, 91 UP, 0 DOWN. Every probe triggered by hand and
confirmed arriving. Zero Kuma URLs left in the vault, zero live references in
any playbook or role.

Still standing, deliberately: the Kuma container on watchtower, its Caddy vhost,
and the uptime.contrapeso.xyz DNS record. Turning the service off is a separate
decision from removing the code that talked to it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ansible/roles/bitcoin_knots/defaults/main.yml

@@ -51,6 +51,9 @@ bitcoin_group: bitcoin
 # check, exit honestly, report nowhere. Any endpoint accepting an HTTP ping
 # works; nothing here is specific to a monitoring product.
 healthcheck_push_url: ""
+# Bearer token for the Gatus external endpoint. Required whenever a push URL
+# is set: Gatus rejects an unauthenticated push with 401.
+healthcheck_push_token: ""
 
 # --- Logging ----------------------------------------------------------------
 # The live node logs to a file. Set to "" to use printtoconsole=1 (journald).

ansible/roles/bitcoin_knots/tasks/healthcheck.yml

@@ -24,7 +24,7 @@
     dest: /etc/systemd/system/bitcoin-knots-healthcheck.service
     owner: root
     group: root
-    mode: '0644'
+    mode: "0600"
 
 - name: Create systemd timer for Bitcoin Knots health check
   ansible.builtin.template:

ansible/roles/bitcoin_knots/templates/healthcheck.service.j2

@@ -7,6 +7,7 @@ Type=oneshot
 User=root
 ExecStart=/usr/local/bin/bitcoin-knots-healthcheck-push.sh
 Environment=HEALTHCHECK_PUSH_URL={{ healthcheck_push_url }}
+Environment=HEALTHCHECK_PUSH_TOKEN={{ healthcheck_push_token }}
 StandardOutput=journal
 StandardError=journal
 

ansible/roles/bitcoin_knots/templates/healthcheck.sh.j2

@@ -12,6 +12,7 @@ RPC_PORT={{ bitcoin_rpc_port }}
 RPC_USER="{{ bitcoin_rpc_user }}"
 RPC_PASSWORD="{{ bitcoin_rpc_password }}"
 PUSH_URL="${HEALTHCHECK_PUSH_URL:-}"
+PUSH_TOKEN="${HEALTHCHECK_PUSH_TOKEN:-}"
 
 # Check if bitcoind RPC is responding
 check_bitcoind() {
@@ -46,8 +47,14 @@ report() {
     # URL encode spaces in message
     local encoded_msg="${msg// /%20}"
     
-    if ! curl -s --max-time 10 --retry 2 -o /dev/null \
-        "${PUSH_URL}?status=${status}&msg=${encoded_msg}&ping="; then
+    # Gatus external endpoint: a POST with a bearer token, NOT Uptime Kuma's
+    # GET with ?status=up. The callers still pass up/down, so the mapping is
+    # done here rather than at every call site.
+    local _ok=false
+    [ "${status}" = "up" ] && _ok=true
+    if ! curl -s --max-time 15 --retry 2 -o /dev/null -X POST \
+        -H "Authorization: Bearer ${PUSH_TOKEN}" \
+        "${PUSH_URL}?success=${_ok}&error=${encoded_msg}"; then
         return 1
     fi
 }

ansible/roles/datum_gateway/defaults/main.yml

@@ -56,3 +56,6 @@ datum_pooled_mining_only: true
 # WHERE TO REPORT HEALTH — the one place to plug in monitoring. Empty means
 # check, exit honestly, report nowhere.
 healthcheck_push_url: ""
+# Bearer token for the Gatus external endpoint. Required whenever a push URL
+# is set: Gatus rejects an unauthenticated push with 401.
+healthcheck_push_token: ""

ansible/roles/datum_gateway/tasks/healthcheck.yml

@@ -19,7 +19,7 @@
     dest: /etc/systemd/system/datum-gateway-healthcheck.service
     owner: root
     group: root
-    mode: '0644'
+    mode: "0600"
   notify: Restart datum-gateway health check timer
 
 - name: Create datum-gateway health check systemd timer

ansible/roles/datum_gateway/templates/healthcheck.service.j2

@@ -7,6 +7,7 @@ Type=oneshot
 User=root
 ExecStart=/usr/local/bin/datum-gateway-healthcheck-push.sh
 Environment=HEALTHCHECK_PUSH_URL={{ healthcheck_push_url }}
+Environment=HEALTHCHECK_PUSH_TOKEN={{ healthcheck_push_token }}
 StandardOutput=journal
 StandardError=journal
 

ansible/roles/datum_gateway/templates/healthcheck.sh.j2

@@ -5,6 +5,7 @@
 #     systemctl is-failed datum-gateway-healthcheck.service
 # Reporting anywhere else is optional and generic.
 PUSH_URL="${HEALTHCHECK_PUSH_URL:-}"
+PUSH_TOKEN="${HEALTHCHECK_PUSH_TOKEN:-}"
 STRATUM_PORT={{ datum_gateway_stratum_port }}
 
 check_datum() {
@@ -19,8 +20,14 @@ report() {
     # No push URL is normal, not an error: the exit code below is still a
     # complete answer for anything reading unit state.
     [ -n "$PUSH_URL" ] || return 0
-    curl -s --max-time 10 --retry 2 -o /dev/null \
-        "${PUSH_URL}?status=${status}&msg=${msg// /%20}&ping=" || true
+    # Gatus external endpoint: a POST with a bearer token, NOT Uptime Kuma's
+    # GET with ?status=up. The callers still pass up/down, so the mapping is
+    # done here rather than at every call site.
+    local _ok=false
+    [ "${status}" = "up" ] && _ok=true
+    curl -s --max-time 15 --retry 2 -o /dev/null -X POST \
+        -H "Authorization: Bearer ${PUSH_TOKEN}" \
+        "${PUSH_URL}?success=${_ok}&error=${msg// /%20}" || true
 }
 
 if check_datum; then

ansible/roles/forgejo_runner/defaults/main.yml

@@ -36,3 +36,6 @@ healthcheck_service_name: forgejo-runner-healthcheck
 # A pull-based monitor (Prometheus node_exporter textfile, say) needs this left
 # empty — it reads the systemd unit state instead.
 healthcheck_push_url: ""
+# Bearer token for the Gatus external endpoint. Required whenever a push URL
+# is set: Gatus rejects an unauthenticated push with 401.
+healthcheck_push_token: ""

ansible/roles/forgejo_runner/tasks/healthcheck.yml

@@ -27,7 +27,7 @@
     dest: "/etc/systemd/system/{{ healthcheck_service_name }}.service"
     owner: root
     group: root
-    mode: '0644'
+    mode: "0600"
 
 - name: Create healthcheck systemd timer
   ansible.builtin.template:

ansible/roles/forgejo_runner/templates/healthcheck.service.j2

@@ -5,6 +5,8 @@ After=network.target
 [Service]
 Type=oneshot
 ExecStart={{ healthcheck_script_path }}
+Environment=HEALTHCHECK_PUSH_URL={{ healthcheck_push_url }}
+Environment=HEALTHCHECK_PUSH_TOKEN={{ healthcheck_push_token }}
 User=root
 StandardOutput=journal
 StandardError=journal

ansible/roles/forgejo_runner/templates/healthcheck.sh.j2

@@ -10,34 +10,38 @@
 # it. Nothing here knows or cares which monitoring product is on the other end.
 
 LOG_FILE="{{ healthcheck_log_file }}"
-PUSH_URL="{{ healthcheck_push_url }}"
+# Read from the environment rather than templated in, so the unit file is the
+# only place the token lives and the script is not secret.
+PUSH_URL="${HEALTHCHECK_PUSH_URL:-}"
+PUSH_TOKEN="${HEALTHCHECK_PUSH_TOKEN:-}"
 
 log_message() {
     echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> "$LOG_FILE"
 }
 
+# Gatus external endpoint: a POST with a bearer token and success=true|false.
+#
+# This used to report ONLY success - it exited before pushing when the runner
+# was down - so a failure was invisible until the heartbeat window expired.
+# Reporting the failure is the whole point of having a check.
+report() {
+    local ok="$1" msg="$2"
+    [ -n "$PUSH_URL" ] || return 0
+    curl -s --max-time 15 --retry 2 -o /dev/null -X POST \
+        -H "Authorization: Bearer ${PUSH_TOKEN}" \
+        "${PUSH_URL}?success=${ok}&error=${msg// /%20}" || true
+}
+
 main() {
     if ! systemctl is-active --quiet forgejo-runner; then
         log_message "ERROR: forgejo-runner is not active"
+        report false "forgejo-runner is not active"
         exit 1
     fi
 
-    if [ -z "$PUSH_URL" ]; then
-        # Healthy, and nothing to report to. Not an error: the exit code below
-        # is still a complete answer for anything reading unit state.
-        log_message "forgejo-runner is active (no push URL configured)"
-        exit 0
-    fi
-
-    log_message "forgejo-runner is active, sending ping"
-    response=$(curl -s -w "\n%{http_code}" "$PUSH_URL?status=up&msg=forgejo-runner%20is%20active" 2>&1)
-    http_code=$(echo "$response" | tail -n1)
-    if [ "$http_code" = "200" ] || [ "$http_code" = "201" ]; then
-        log_message "Ping sent successfully (HTTP $http_code)"
-    else
-        log_message "ERROR: Failed to send ping (HTTP $http_code)"
-        exit 1
-    fi
+    log_message "forgejo-runner is active"
+    report true "active"
+    exit 0
 }
 
 main

ansible/roles/fulcrum/defaults/main.yml

@@ -71,6 +71,9 @@ fulcrum_group: fulcrum
 # check, exit honestly, report nowhere. Any endpoint accepting an HTTP ping
 # works; nothing here is specific to a monitoring product.
 healthcheck_push_url: ""
+# Bearer token for the Gatus external endpoint. Required whenever a push URL
+# is set: Gatus rejects an unauthenticated push with 401.
+healthcheck_push_token: ""
 
 # Explicit db_mem in MB. When set it wins over fulcrum_db_mem_percent; empty
 # means compute from RAM. Set here because the live host had been hand-tuned to

ansible/roles/fulcrum/tasks/healthcheck.yml

@@ -19,7 +19,7 @@
     dest: /etc/systemd/system/fulcrum-healthcheck.service
     owner: root
     group: root
-    mode: '0644'
+    mode: "0600"
 
 - name: Create systemd timer for Fulcrum health check
   ansible.builtin.template:

ansible/roles/fulcrum/templates/healthcheck.service.j2

@@ -7,6 +7,7 @@ Type=oneshot
 User=root
 ExecStart=/usr/local/bin/fulcrum-healthcheck-push.sh
 Environment=HEALTHCHECK_PUSH_URL={{ healthcheck_push_url }}
+Environment=HEALTHCHECK_PUSH_TOKEN={{ healthcheck_push_token }}
 StandardOutput=journal
 StandardError=journal
 

ansible/roles/fulcrum/templates/healthcheck.sh.j2

@@ -10,6 +10,7 @@
 FULCRUM_HOST="{{ fulcrum_tcp_bind }}"
 FULCRUM_PORT={{ fulcrum_tcp_port }}
 PUSH_URL="${HEALTHCHECK_PUSH_URL:-}"
+PUSH_TOKEN="${HEALTHCHECK_PUSH_TOKEN:-}"
 
 check_fulcrum() {
     timeout 5 bash -c "echo > /dev/tcp/${FULCRUM_HOST}/${FULCRUM_PORT}" 2>/dev/null
@@ -20,8 +21,14 @@ report() {
     # No push URL is normal, not an error: the exit code below is still a
     # complete answer for anything reading unit state.
     [ -n "$PUSH_URL" ] || return 0
-    curl -s --max-time 10 --retry 2 -o /dev/null \
-        "${PUSH_URL}?status=${status}&msg=${msg// /%20}&ping=" || true
+    # Gatus external endpoint: a POST with a bearer token, NOT Uptime Kuma's
+    # GET with ?status=up. The callers still pass up/down, so the mapping is
+    # done here rather than at every call site.
+    local _ok=false
+    [ "${status}" = "up" ] && _ok=true
+    curl -s --max-time 15 --retry 2 -o /dev/null -X POST \
+        -H "Authorization: Bearer ${PUSH_TOKEN}" \
+        "${PUSH_URL}?success=${_ok}&error=${msg// /%20}" || true
 }
 
 if check_fulcrum; then

ansible/roles/mempool/defaults/main.yml

@@ -45,6 +45,8 @@ mariadb_user: "mempool"
 # push_url is where to report, and is the single plug-in point for whatever
 # monitoring exists. Empty means check, exit honestly, report nowhere.
 # The URLs are credentials, so callers pass them from the vault.
+healthcheck_push_token: ""
+
 mempool_healthchecks:
   - name: mariadb
     label: MariaDB

ansible/roles/mempool/tasks/healthcheck.yml

@@ -22,7 +22,7 @@
     dest: "/etc/systemd/system/mempool-{{ hc.name }}-healthcheck.service"
     owner: root
     group: root
-    mode: '0644'
+    mode: "0600"
   loop: "{{ mempool_healthchecks }}"
   loop_control:
     loop_var: hc

ansible/roles/mempool/templates/healthcheck-backend.sh.j2

@@ -2,6 +2,7 @@
 # Mempool backend health check — managed by Ansible (roles/mempool)
 # The exit code is the answer; systemd keeps it. Reporting is optional.
 PUSH_URL="${HEALTHCHECK_PUSH_URL:-}"
+PUSH_TOKEN="${HEALTHCHECK_PUSH_TOKEN:-}"
 BACKEND_PORT="{{ mempool_backend_port }}"
 
 check() {
@@ -10,8 +11,14 @@ check() {
 
 report() {
     [ -n "$PUSH_URL" ] || return 0
-    curl -s --max-time 10 --retry 2 -o /dev/null \
-        "${PUSH_URL}?status=$1&msg=${2// /%20}&ping=" || true
+    # Gatus external endpoint: a POST with a bearer token, NOT Uptime Kuma's
+    # GET with ?status=up. The callers still pass up/down, so the mapping is
+    # done here rather than at every call site.
+    local _ok=false
+    [ "$1" = "up" ] && _ok=true
+    curl -s --max-time 15 --retry 2 -o /dev/null -X POST \
+        -H "Authorization: Bearer ${PUSH_TOKEN}" \
+        "${PUSH_URL}?success=${_ok}&error=${2// /%20}" || true
 }
 
 if check; then report up "OK"; exit 0

ansible/roles/mempool/templates/healthcheck-frontend.sh.j2

@@ -2,6 +2,7 @@
 # Mempool frontend health check — managed by Ansible (roles/mempool)
 # The exit code is the answer; systemd keeps it. Reporting is optional.
 PUSH_URL="${HEALTHCHECK_PUSH_URL:-}"
+PUSH_TOKEN="${HEALTHCHECK_PUSH_TOKEN:-}"
 FRONTEND_PORT="{{ mempool_frontend_port }}"
 
 check() {
@@ -10,8 +11,14 @@ check() {
 
 report() {
     [ -n "$PUSH_URL" ] || return 0
-    curl -s --max-time 10 --retry 2 -o /dev/null \
-        "${PUSH_URL}?status=$1&msg=${2// /%20}&ping=" || true
+    # Gatus external endpoint: a POST with a bearer token, NOT Uptime Kuma's
+    # GET with ?status=up. The callers still pass up/down, so the mapping is
+    # done here rather than at every call site.
+    local _ok=false
+    [ "$1" = "up" ] && _ok=true
+    curl -s --max-time 15 --retry 2 -o /dev/null -X POST \
+        -H "Authorization: Bearer ${PUSH_TOKEN}" \
+        "${PUSH_URL}?success=${_ok}&error=${2// /%20}" || true
 }
 
 if check; then report up "OK"; exit 0

ansible/roles/mempool/templates/healthcheck-mariadb.sh.j2

@@ -2,6 +2,7 @@
 # Mempool MariaDB health check — managed by Ansible (roles/mempool)
 # The exit code is the answer; systemd keeps it. Reporting is optional.
 PUSH_URL="${HEALTHCHECK_PUSH_URL:-}"
+PUSH_TOKEN="${HEALTHCHECK_PUSH_TOKEN:-}"
 
 check() {
 {% raw %}
@@ -13,8 +14,14 @@ report() {
     # No push URL is normal, not an error. The previous version logged
     # "ERROR: UPTIME_KUMA_PUSH_URL not set" on every fire, once a minute.
     [ -n "$PUSH_URL" ] || return 0
-    curl -s --max-time 10 --retry 2 -o /dev/null \
-        "${PUSH_URL}?status=$1&msg=${2// /%20}&ping=" || true
+    # Gatus external endpoint: a POST with a bearer token, NOT Uptime Kuma's
+    # GET with ?status=up. The callers still pass up/down, so the mapping is
+    # done here rather than at every call site.
+    local _ok=false
+    [ "$1" = "up" ] && _ok=true
+    curl -s --max-time 15 --retry 2 -o /dev/null -X POST \
+        -H "Authorization: Bearer ${PUSH_TOKEN}" \
+        "${PUSH_URL}?success=${_ok}&error=${2// /%20}" || true
 }
 
 if check; then report up "OK"; exit 0

ansible/roles/mempool/templates/healthcheck.service.j2

@@ -7,6 +7,7 @@ Type=oneshot
 User=root
 ExecStart=/usr/local/bin/mempool-{{ hc.name }}-healthcheck-push.sh
 Environment=HEALTHCHECK_PUSH_URL={{ hc.push_url }}
+Environment=HEALTHCHECK_PUSH_TOKEN={{ healthcheck_push_token }}
 StandardOutput=journal
 StandardError=journal
 

ansible/roles/phoenixd/defaults/main.yml

@@ -51,3 +51,6 @@ phoenixd_healthcheck_service_name: phoenixd-healthcheck
 # Empty means check, log, exit honestly, report nowhere. Any endpoint that
 # accepts an HTTP ping works; nothing here is specific to a monitoring product.
 healthcheck_push_url: ""
+# Bearer token for the Gatus external endpoint. Required whenever a push URL
+# is set: Gatus rejects an unauthenticated push with 401.
+healthcheck_push_token: ""

ansible/roles/phoenixd/tasks/healthcheck.yml

@@ -19,7 +19,7 @@
     dest: "/etc/systemd/system/{{ phoenixd_healthcheck_service_name }}.service"
     owner: root
     group: root
-    mode: "0644"
+    mode: "0600"
   notify: Restart phoenixd health check timer
 
 - name: Create phoenixd health check systemd timer

ansible/roles/phoenixd/templates/healthcheck.service.j2

@@ -7,6 +7,7 @@ Type=oneshot
 User=root
 ExecStart={{ phoenixd_healthcheck_script_path }}
 Environment=HEALTHCHECK_PUSH_URL={{ healthcheck_push_url }}
+Environment=HEALTHCHECK_PUSH_TOKEN={{ healthcheck_push_token }}
 StandardOutput=journal
 StandardError=journal
 

ansible/roles/phoenixd/templates/healthcheck.sh.j2

@@ -6,6 +6,7 @@
 #     systemctl is-failed {{ phoenixd_healthcheck_service_name }}.service
 # That is a complete answer on its own. Reporting anywhere else is optional.
 PUSH_URL="${HEALTHCHECK_PUSH_URL:-}"
+PUSH_TOKEN="${HEALTHCHECK_PUSH_TOKEN:-}"
 export PHOENIX_DATADIR="{{ phoenixd_data_dir }}"
 
 check_phoenixd() {
@@ -25,8 +26,14 @@ report() {
     # answers the question. The previous version logged ERROR here on every
     # single fire, once a minute, which is noise that trains you to ignore it.
     [ -n "$PUSH_URL" ] || return 0
-    curl -s --max-time 10 --retry 2 -o /dev/null \
-        "${PUSH_URL}?status=${status}&msg=${msg// /%20}&ping=" || true
+    # Gatus external endpoint: a POST with a bearer token, NOT Uptime Kuma's
+    # GET with ?status=up. The callers still pass up/down, so the mapping is
+    # done here rather than at every call site.
+    local _ok=false
+    [ "${status}" = "up" ] && _ok=true
+    curl -s --max-time 15 --retry 2 -o /dev/null -X POST \
+        -H "Authorization: Bearer ${PUSH_TOKEN}" \
+        "${PUSH_URL}?success=${_ok}&error=${msg// /%20}" || true
 }
 
 if check_phoenixd; then