counterweight
a0c23ae766
802-line playbook becomes 68 lines (three plays: the role, the Caddy dashboard, the Stratum socket proxy) plus a 345-line role. datum_gateway_vars.yml is deleted; its content is the role's defaults. Verified after a real run with zero miners connected: datum-gateway restarted cleanly onto the reformatted config, deployed config.json semantically identical to what was there (pool_address bc1qvrj3g84..., pool_pass_* false, ports unchanged), health check timer firing, and the Knots side untouched - bitcoind still up since 2026-08-19 with blocknotify intact. TWO PIECES OF DRIFT WHERE THE NODE WAS RIGHT, both confirmed with the operator: - datum_mining_address: the vault held bc1qdse9dsg... while the node had been mining to bc1qvrj3g... since 2026-08-08. This is WHERE BLOCK REWARDS ARE PAID. And unlike fulcrum and bitcoin-knots, the `Restart datum-gateway` handler here was never gated, so the stale value would have applied immediately rather than sitting inert on disk. - pool_pass_workers / pool_pass_full_users: false on the node, true in the vars file. Both corrected in the vault and role defaults with notes recording why. Comparing this config needs semantics, not text: the live file is single-line JSON and the template renders pretty-printed, so a textual diff is pure noise. Rendering it and comparing parsed JSON is what surfaced both differences. config.json carries bitcoind.rpcpassword and api.admin_password, and --diff prints rendered content - so `--check --diff` put them on the terminal. The task now sets diff: false by default (-e datum_reveal_config=true to opt in). Those two should be rotated. I also mis-reported pool_pass_workers/pool_pass_full_users as exposed credentials because my masking matched "pass" in the key name. They are BOOLEANS, and mining.pool_address is a Bitcoin address, public by nature. Only the two real passwords above were exposed. `Configure cmake build` and `Compile datum_gateway` are bare command: tasks with no changed_when, so they recompile on every run. The build is reproducible - Install datum_gateway binary sees identical content and leaves the installed binary's timestamp alone - but it is wasted work each time. Documented as the idempotent floor. Ownership parity checked mechanically against `git show HEAD:` keyed by task name: 7/7 match, 9 Kuma tasks dropped. This completes Plan 6 Stage 2: all six services in the list are roles. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
67 lines
2.3 KiB
YAML
67 lines
2.3 KiB
YAML
# Centralized Services Configuration
|
|
# Subdomains and Caddy settings for all services
|
|
|
|
# Edit these subdomains to match your preferences
|
|
subdomains:
|
|
# Monitoring Services (on watchtower)
|
|
ntfy: ntfy
|
|
# DEPRECATED 2026-09-11 — Uptime Kuma is decommissioned and this subdomain no
|
|
# longer resolves to anything. Kept only because the deprecated monitoring
|
|
# blocks still template it into uptime_kuma_api_url. See archive/uptime_kuma/.
|
|
uptime_kuma: uptime
|
|
|
|
# VPN Infrastructure (on spacey)
|
|
headscale: headscale
|
|
|
|
# Core Services (on vipy)
|
|
vaultwarden: vault
|
|
forgejo: forgejo
|
|
lnbits: wallet
|
|
|
|
# Secondary Services (on vipy)
|
|
ntfy_emergency_app: avisame
|
|
personal_blog: pablohere
|
|
|
|
# Memos (on memos-box)
|
|
memos: memos
|
|
|
|
# Mempool Block Explorer (on mempool_box, proxied via vipy)
|
|
mempool: mempool
|
|
|
|
# DATUM Gateway dashboard (on knots_box, proxied via vipy)
|
|
datum_gateway: datum
|
|
|
|
# Caddy configuration
|
|
caddy_sites_dir: /etc/caddy/sites-enabled
|
|
|
|
# Service-specific settings shared across playbooks
|
|
service_settings:
|
|
ntfy:
|
|
topic: alerts
|
|
headscale:
|
|
namespace: counter-net
|
|
mempool:
|
|
# The frontend port is needed in two places on two different hosts: the
|
|
# mempool role deploys it on mempool-box, and the Caddy play proxies to it
|
|
# from the edge host. A role default cannot serve the second play, so it
|
|
# lives here rather than in roles/mempool/defaults.
|
|
frontend_port: 8080
|
|
bitcoin:
|
|
# The P2P port is needed on two hosts: the bitcoin_knots role deploys the
|
|
# node on knots-box, and the socket-proxy play publishes the port from the
|
|
# edge host. A role default cannot reach that second play.
|
|
p2p_port: 8333
|
|
tailscale_hostname: knots-box
|
|
datum_gateway:
|
|
# Needed on two hosts: the datum_gateway role deploys on knots-box, while the
|
|
# Caddy play (dashboard) and the socket-proxy play (Stratum) both run on the
|
|
# edge host. A role default cannot reach either of those plays.
|
|
api_port: 7152
|
|
stratum_port: 23334
|
|
tailscale_hostname: knots-box
|
|
fulcrum:
|
|
# Same shape as mempool: the fulcrum role deploys on fulcrum-box, and the
|
|
# socket-proxy play publishes the SSL port from the edge host. A role default
|
|
# is invisible to that second play.
|
|
ssl_port: 50002
|
|
tailscale_hostname: fulcrum-box
|