# monerod configuration - managed by Ansible (roles/monero)
#
# Config-file syntax is the command-line options with the leading -- removed;
# valueless flags take =1. https://docs.getmonero.org/interacting/monero-config-file/

data-dir={{ monero_data_dir }}
log-file={{ monero_log_dir }}/monerod.log
log-level=0
max-log-file-size=104850000

# --- P2P: outbound only -----------------------------------------------------
# Nothing forwards {{ monero_p2p_port }} to this box, so the node dials out to
# peers and never receives. It syncs and serves us completely; it simply does
# not relay for strangers. no-igd follows: with nothing forwarded there is
# nothing for UPnP to do except announce us to the router.
p2p-bind-ip=0.0.0.0
p2p-bind-port={{ monero_p2p_port }}
no-igd=1
out-peers={{ monero_out_peers }}
in-peers={{ monero_in_peers }}

# --- Unrestricted RPC: loopback only ----------------------------------------
# Administration and the health check. Never leaves the box.
rpc-bind-ip={{ monero_rpc_bind_ip }}
rpc-bind-port={{ monero_rpc_port }}

# --- Restricted RPC: the only surface anything off-box touches --------------
# A SECOND server, view-only, reached over the tailnet by Caddy on the edge
# host. This is rpc-restricted-bind-port and deliberately NOT `restricted-rpc=1`:
# that flag restricts the loopback server too, and then we could not ask our own
# node anything useful.
#
# Bound to 0.0.0.0 and reachable only over the tailnet - Tailscale's ts-input
# chain sits ahead of UFW, so nothing on the LAN or the internet reaches this
# port without going through Caddy. confirm-external-bind is monerod's
# "yes, I meant to do that" for a non-loopback bind.
rpc-restricted-bind-ip=0.0.0.0
rpc-restricted-bind-port={{ monero_restricted_rpc_port }}
confirm-external-bind=1

# HTTP Digest, and it guards BOTH servers above - core_rpc_server::init passes
# the same login to each. This is what Feather sends as the node credentials.
rpc-login={{ monero_rpc_user }}:{{ monero_rpc_password }}

# Nothing subscribes to ZMQ here, so it is one less listener.
no-zmq=1