counterweight
a0c23ae766
802-line playbook becomes 68 lines (three plays: the role, the Caddy dashboard, the Stratum socket proxy) plus a 345-line role. datum_gateway_vars.yml is deleted; its content is the role's defaults. Verified after a real run with zero miners connected: datum-gateway restarted cleanly onto the reformatted config, deployed config.json semantically identical to what was there (pool_address bc1qvrj3g84..., pool_pass_* false, ports unchanged), health check timer firing, and the Knots side untouched - bitcoind still up since 2026-08-19 with blocknotify intact. TWO PIECES OF DRIFT WHERE THE NODE WAS RIGHT, both confirmed with the operator: - datum_mining_address: the vault held bc1qdse9dsg... while the node had been mining to bc1qvrj3g... since 2026-08-08. This is WHERE BLOCK REWARDS ARE PAID. And unlike fulcrum and bitcoin-knots, the `Restart datum-gateway` handler here was never gated, so the stale value would have applied immediately rather than sitting inert on disk. - pool_pass_workers / pool_pass_full_users: false on the node, true in the vars file. Both corrected in the vault and role defaults with notes recording why. Comparing this config needs semantics, not text: the live file is single-line JSON and the template renders pretty-printed, so a textual diff is pure noise. Rendering it and comparing parsed JSON is what surfaced both differences. config.json carries bitcoind.rpcpassword and api.admin_password, and --diff prints rendered content - so `--check --diff` put them on the terminal. The task now sets diff: false by default (-e datum_reveal_config=true to opt in). Those two should be rotated. I also mis-reported pool_pass_workers/pool_pass_full_users as exposed credentials because my masking matched "pass" in the key name. They are BOOLEANS, and mining.pool_address is a Bitcoin address, public by nature. Only the two real passwords above were exposed. `Configure cmake build` and `Compile datum_gateway` are bare command: tasks with no changed_when, so they recompile on every run. The build is reproducible - Install datum_gateway binary sees identical content and leaves the installed binary's timestamp alone - but it is wasted work each time. Documented as the idempotent floor. Ownership parity checked mechanically against `git show HEAD:` keyed by task name: 7/7 match, 9 Kuma tasks dropped. This completes Plan 6 Stage 2: all six services in the list are roles. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
68 lines
2.8 KiB
YAML
68 lines
2.8 KiB
YAML
---
|
|
# DATUM Gateway: solo/pooled mining gateway, built from source on knots-box.
|
|
#
|
|
# This is HALF OF A SYSTEM. The Bitcoin Knots node on the same host feeds it via
|
|
# `blocknotify=killall -USR1 datum_gateway` in bitcoin.conf (see
|
|
# roles/bitcoin_knots/README.md). Changing either config means thinking about
|
|
# both. Interrupting Stratum costs mining shares, so check for connected miners
|
|
# before restarting:
|
|
# ss -tn state established '( sport = :23334 )'
|
|
- name: Deploy DATUM Gateway on the bitcoin host
|
|
hosts: bitcoin
|
|
become: yes
|
|
vars_files:
|
|
- ../../infra_vars.yml
|
|
- ../../services_config.yml
|
|
- ../../infra_secrets.yml
|
|
vars:
|
|
# Preserves the push URL this check reports to. The role knows nothing about
|
|
# Uptime Kuma — this is just "a URL that accepts a ping".
|
|
healthcheck_push_url: "{{ healthcheck_push_urls.datum_gateway | default('') }}"
|
|
roles:
|
|
- datum_gateway
|
|
|
|
- name: Configure Caddy reverse proxy for the DATUM Gateway dashboard on the edge host
|
|
hosts: edge
|
|
become: yes
|
|
vars_files:
|
|
- ../../infra_vars.yml
|
|
- ../../services_config.yml
|
|
- ../../infra_secrets.yml
|
|
tasks:
|
|
- name: Publish the DATUM Gateway dashboard through Caddy
|
|
ansible.builtin.include_role:
|
|
name: caddy_site
|
|
vars:
|
|
caddy_site_name: datum-gateway
|
|
caddy_site_domain: "{{ subdomains.datum_gateway }}.{{ root_domain }}"
|
|
caddy_site_upstream: "{{ service_settings.datum_gateway.tailscale_hostname }}:{{ service_settings.datum_gateway.api_port }}"
|
|
caddy_site_resolvers: "100.100.100.100"
|
|
caddy_site_basic_auth:
|
|
- user: "{{ datum_dashboard_username }}"
|
|
hash: "{{ datum_dashboard_password_hash }}"
|
|
|
|
# The role validates its own site fragment; this re-validates the whole
|
|
# assembled Caddyfile, which is the only thing that catches a conflict
|
|
# between two sites.
|
|
- name: Validate the assembled Caddyfile
|
|
ansible.builtin.command: caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
|
|
changed_when: false
|
|
|
|
- name: Setup public Stratum port forwarding on the edge host
|
|
hosts: edge
|
|
become: yes
|
|
vars_files:
|
|
- ../../infra_vars.yml
|
|
- ../../services_config.yml
|
|
tasks:
|
|
- name: Expose the DATUM Stratum port through a socket proxy
|
|
ansible.builtin.include_role:
|
|
name: socket_proxy
|
|
vars:
|
|
socket_proxy_name: datum-stratum
|
|
socket_proxy_description: "DATUM Stratum"
|
|
socket_proxy_listen_port: "{{ service_settings.datum_gateway.stratum_port }}"
|
|
socket_proxy_upstream_host: "{{ service_settings.datum_gateway.tailscale_hostname }}"
|
|
# Matches the UFW comment already on the edge host; the derived default
|
|
# would say "DATUM Stratum" and rewrite the rule.
|
|
socket_proxy_ufw_comment: "DATUM Gateway Stratum public access"
|