---
# Monero: a full node, reachable from Feather over the WAN.
#
# The chain lives on a dedicated 500 GB disk mounted at /var/lib/monero; the
# role creates the filesystem and the fstab entry, and monerod's unit carries
# RequiresMountsFor so it cannot start without it. An initial sync takes days
# and nothing here touches the data directory afterwards.
#
# Exposure is one HTTPS vhost and no new open ports. See roles/monero/README.md.
- name: Deploy the Monero node
  hosts: monero
  become: yes
  vars:
    healthcheck_push_url: "https://{{ subdomains.gatus }}.{{ root_domain }}/api/v1/endpoints/probe_monerod/external"
    healthcheck_push_token: "{{ gatus_push_tokens[inventory_hostname] }}"
  roles:
    - monero

- name: Publish the restricted Monero RPC from the edge host
  hosts: edge
  become: yes
  tasks:
    # No basic auth here on purpose. monerod's own --rpc-login is HTTP Digest
    # and guards this endpoint; Caddy's basic_auth would put a second, Basic
    # challenge in front of it that Feather would answer with the wrong scheme.
    # Caddy's job is TLS and routing, nothing else.
    - name: Expose the restricted Monero RPC over HTTPS
      ansible.builtin.include_role:
        name: caddy_site
      vars:
        caddy_site_name: monero
        caddy_site_domain: "{{ subdomains.monero }}.{{ root_domain }}"
        caddy_site_upstream: "{{ hostvars['monerod_box_local'].ansible_host }}:{{ hostvars['monerod_box_local'].monero_restricted_rpc_port }}"
        caddy_site_resolvers: "100.100.100.100"

    # The per-site validate cannot catch a conflict between sites.
    - name: Validate the whole Caddyfile
      ansible.builtin.command: caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
      changed_when: false