# xmrblocks - the Onion Monero Blockchain Explorer.
# https://github.com/moneroexamples/onion-monero-blockchain-explorer
#
# This role INSTALLS a prebuilt binary; it does not compile one. xmrblocks links
# 21 static libraries out of a compiled monero source tree, and building that
# needs ~3.2 GB of RAM for a single compiler (~5.5 GB at -j4). monerod-box has
# 2 GB, so it cannot build this at any -j. See README.md.
#
# The artifact is produced by scripts/build-xmrblocks.sh, which runs the whole
# build in a debian:13 container - so it is reproducible on any machine with
# Docker, not just the one that happened to build it.

# --- The artifact ------------------------------------------------------------
# A directory on the CONTROL NODE holding `xmrblocks`, `templates/` and MANIFEST.
xmrblocks_artifact_dir: "{{ lookup('env', 'HOME') }}/personal_infra_artifacts/xmrblocks"

# Pinned checksum of the binary we intend to ship. Asserted on the control node
# BEFORE anything is copied: shipping an unverified binary to a host is the one
# thing this role must never do. Update it together with the build pins in
# scripts/build-xmrblocks.sh.
xmrblocks_sha256: "a40c495e73a44fbb3b666fcd8a01466a2aef12ed1906558f3d5b7e458c256af6"

# Recorded so the deployed host can be matched back to a build.
xmrblocks_explorer_commit: "29593b709edeb23daba035009ccd134a5862543a"
xmrblocks_monero_version: "0.18.5.1"

# --- Install layout ----------------------------------------------------------
# The binary hardcodes TMPL_DIR as "./templates", relative to the working
# directory - so templates MUST sit beside the binary and the unit MUST set
# WorkingDirectory. Get that wrong and it starts fine, then fails per-request.
xmrblocks_dir: /opt/xmrblocks

# Runs as the monero user: the explorer opens monerod's LMDB directly, and
# /var/lib/monero is 0750 monero:monero. It opens it READ-ONLY (DBF_RDONLY in
# MicroCore::init), so it is safe alongside a running monerod.
xmrblocks_user: monero
xmrblocks_group: monero

# --- Runtime -----------------------------------------------------------------
# The LMDB directory, not the data directory: monerod's data-dir plus /lmdb.
xmrblocks_bc_path: /var/lib/monero/lmdb

# 0.0.0.0 so the edge host can reach it over the tailnet. Nothing on the LAN or
# the internet can: Tailscale's ts-input chain sits ahead of UFW, and the only
# public route is the Caddy vhost on vipy.
xmrblocks_bind: "0.0.0.0"
xmrblocks_port: 8081

# The unrestricted RPC on loopback. Used for the mempool view and tx pushing.
xmrblocks_daemon_url: "127.0.0.1:18081"
# monerod's --rpc-login guards BOTH its RPC servers, so the explorer needs it.
xmrblocks_rpc_user: "{{ monero_rpc_user | default('') }}"
xmrblocks_rpc_password: "{{ monero_rpc_password | default('') }}"

# Upstream's own defaults (the Dockerfile CMD).
# NOTE: enable-pusher lets a visitor submit a raw transaction through YOUR node.
# It is a deliberate choice here, not an oversight.
xmrblocks_enable_json_api: true
xmrblocks_enable_autorefresh: true
xmrblocks_enable_pusher: true

# Crow's thread count. Held low on purpose: this box has 2 GB and monerod
# already uses ~1.3 GB of it.
xmrblocks_concurrency: 2

# The unit file carries the RPC login, so --diff is suppressed by default.
xmrblocks_reveal_config: false

# --- Health check ------------------------------------------------------------
# WHERE TO REPORT HEALTH — the one place to plug in monitoring. Empty means
# check, exit honestly, report nowhere.
healthcheck_push_url: ""
# Bearer token for the Gatus external endpoint. Required whenever a push URL
# is set: Gatus rejects an unauthenticated push with 401.
healthcheck_push_token: ""

# WHEN TO CHECK. Daily, 30 minutes after monerod's own check so the two do not
# contend for the same cold LMDB pages. See roles/monero/defaults for why the
# name is prefixed and why this is paired with the 26h heartbeat in
# infra/403_service_probe_registration.yml.
xmrblocks_healthcheck_on_calendar: "*-*-* 05:30:00"