counterweight
a0c23ae766
802-line playbook becomes 68 lines (three plays: the role, the Caddy dashboard, the Stratum socket proxy) plus a 345-line role. datum_gateway_vars.yml is deleted; its content is the role's defaults. Verified after a real run with zero miners connected: datum-gateway restarted cleanly onto the reformatted config, deployed config.json semantically identical to what was there (pool_address bc1qvrj3g84..., pool_pass_* false, ports unchanged), health check timer firing, and the Knots side untouched - bitcoind still up since 2026-08-19 with blocknotify intact. TWO PIECES OF DRIFT WHERE THE NODE WAS RIGHT, both confirmed with the operator: - datum_mining_address: the vault held bc1qdse9dsg... while the node had been mining to bc1qvrj3g... since 2026-08-08. This is WHERE BLOCK REWARDS ARE PAID. And unlike fulcrum and bitcoin-knots, the `Restart datum-gateway` handler here was never gated, so the stale value would have applied immediately rather than sitting inert on disk. - pool_pass_workers / pool_pass_full_users: false on the node, true in the vars file. Both corrected in the vault and role defaults with notes recording why. Comparing this config needs semantics, not text: the live file is single-line JSON and the template renders pretty-printed, so a textual diff is pure noise. Rendering it and comparing parsed JSON is what surfaced both differences. config.json carries bitcoind.rpcpassword and api.admin_password, and --diff prints rendered content - so `--check --diff` put them on the terminal. The task now sets diff: false by default (-e datum_reveal_config=true to opt in). Those two should be rotated. I also mis-reported pool_pass_workers/pool_pass_full_users as exposed credentials because my masking matched "pass" in the key name. They are BOOLEANS, and mining.pool_address is a Bitcoin address, public by nature. Only the two real passwords above were exposed. `Configure cmake build` and `Compile datum_gateway` are bare command: tasks with no changed_when, so they recompile on every run. The build is reproducible - Install datum_gateway binary sees identical content and leaves the installed binary's timestamp alone - but it is wasted work each time. Documented as the idempotent floor. Ownership parity checked mechanically against `git show HEAD:` keyed by task name: 7/7 match, 9 Kuma tasks dropped. This completes Plan 6 Stage 2: all six services in the list are roles. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
74 lines
2.1 KiB
YAML
74 lines
2.1 KiB
YAML
---
|
|
- name: Install DATUM Gateway build dependencies
|
|
apt:
|
|
name:
|
|
- cmake
|
|
- build-essential
|
|
- git
|
|
- libjansson-dev
|
|
- libmicrohttpd-dev
|
|
- libsodium-dev
|
|
- libcurl4-openssl-dev
|
|
# Runtime-only (netcat for health check)
|
|
- netcat-openbsd
|
|
state: present
|
|
update_cache: yes
|
|
|
|
# ===========================================
|
|
# System User and Directories
|
|
# ===========================================
|
|
- name: Create datum system user
|
|
user:
|
|
name: "{{ datum_gateway_user }}"
|
|
system: yes
|
|
shell: /usr/sbin/nologin
|
|
home: "{{ datum_gateway_dir }}"
|
|
create_home: no
|
|
comment: "DATUM Gateway"
|
|
|
|
- name: Create DATUM Gateway directories
|
|
file:
|
|
path: "{{ item.path }}"
|
|
state: directory
|
|
owner: "{{ item.owner }}"
|
|
group: "{{ datum_gateway_group }}"
|
|
mode: "{{ item.mode }}"
|
|
loop:
|
|
- { path: "{{ datum_gateway_dir }}", owner: root, mode: "0755" }
|
|
- { path: "{{ datum_gateway_source_dir }}", owner: root, mode: "0755" }
|
|
- { path: "{{ datum_gateway_config_dir }}", owner: "{{ datum_gateway_user }}", mode: "0750" }
|
|
- { path: "{{ datum_gateway_log_dir }}", owner: "{{ datum_gateway_user }}", mode: "0750" }
|
|
|
|
# ===========================================
|
|
# Build from Source
|
|
# ===========================================
|
|
- name: Clone DATUM Gateway repository at {{ datum_gateway_version }}
|
|
git:
|
|
repo: https://github.com/OCEAN-xyz/datum_gateway.git
|
|
dest: "{{ datum_gateway_source_dir }}"
|
|
version: "{{ datum_gateway_version }}"
|
|
force: yes
|
|
register: git_clone
|
|
|
|
- name: Configure cmake build
|
|
command: cmake . -DCMAKE_BUILD_TYPE=Release
|
|
args:
|
|
chdir: "{{ datum_gateway_source_dir }}"
|
|
|
|
- name: Compile datum_gateway
|
|
command: make -j{{ datum_gateway_build_jobs }}
|
|
args:
|
|
chdir: "{{ datum_gateway_source_dir }}"
|
|
|
|
- name: Install datum_gateway binary
|
|
copy:
|
|
src: "{{ datum_gateway_source_dir }}/datum_gateway"
|
|
dest: "{{ datum_gateway_bin_path }}"
|
|
remote_src: yes
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
notify: Restart datum-gateway
|
|
|
|
# ===========================================
|
|
# Configuration
|