counterweight/personal_infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

bitcoin-knots, fulcrum, datum-gateway: add and use the socket_proxy role

Browse source 
Three near-identical hosts: edge plays become one role plus three short
calls. 183 lines removed, 34 added, plus a 111-line role.

Verified before touching any playbook: all six live units on vipy reproduced
byte-identically. Then --limit edge --check per playbook - bitcoin-knots and
fulcrum changed=0; datum-gateway changed=2, both attributable to the already
known caddy_site comment line and the Reload caddy handler it triggers.
The 6 units and 14 Caddy files on the hosts are byte-identical afterwards.

PLAN_4 claimed these three plays had "no behavioural drift at all". That was
wrong - it came from a diff truncated by head -60. The live bitcoin-p2p-proxy
units carry four settings this playbook never wrote:

  .socket   Documentation=, FreeBind=true
  .service  Documentation=, TimeoutStopSec=5,
            StandardOutput=journal, StandardError=journal

FreeBind is the one that matters: it lets the socket bind to an address that
is not up yet, so without it the socket can fail to start on boot. Running
the bitcoin-knots playbook would have stripped it. Same class of hazard as
headscale. The role expresses all four; bitcoin-p2p is the only caller that
passes any.

Also: UFW treats the rule comment as part of the rule. datum-stratum's live
comment is "DATUM Gateway Stratum public access" but the role's derived
default produced "DATUM Stratum public access", which rewrote the rule.
Caught in the dry-run; datum now passes the comment explicitly.

Two deliberate differences from the original, both documented in the README:
ignore_errors: yes on the upstream check became failed_when: false, and the
handler restarts the .socket, which drops connections open through it - it
fires only when a unit file actually changes.

The inert Uptime Kuma TCP monitor blocks stay in the playbooks rather than
being pulled into a new role (12/12/18 guarded tasks).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
counterweight 2026-09-11 23:50:15 +02:00
parent 16cbd189b8
commit c4094b692f
Signed by: counterweight
GPG key ID: 883EDBAA726BD96C
9 changed files with 207 additions and 183 deletions
Download patch file Download diff file Expand all files Collapse all files

17
ansible/roles/socket_proxy/defaults/main.yml Normal file
View file

@ -0,0 +1,17 @@
---
# Required
socket_proxy_name: "" # "bitcoin-p2p" -> bitcoin-p2p-proxy.{socket,service}
socket_proxy_description: "" # "Bitcoin P2P" -> "Bitcoin P2P Proxy Socket"
socket_proxy_listen_port: 0 # public port on the edge host
socket_proxy_upstream_host: "" # Tailscale hostname, e.g. "knots-box"
# Optional
socket_proxy_upstream_port: "" # defaults to socket_proxy_listen_port
socket_proxy_documentation: "" # Documentation= in both units
socket_proxy_free_bind: false # FreeBind=true: bind before the address is up
socket_proxy_timeout_stop_sec: "" # TimeoutStopSec=
socket_proxy_log_to_journal: false # StandardOutput/StandardError=journal
# Firewall
socket_proxy_ufw_proto: tcp
socket_proxy_ufw_comment: "" # defaults to "<description> public access"