No description
counterweight
a0c23ae766
802-line playbook becomes 68 lines (three plays: the role, the Caddy dashboard, the Stratum socket proxy) plus a 345-line role. datum_gateway_vars.yml is deleted; its content is the role's defaults. Verified after a real run with zero miners connected: datum-gateway restarted cleanly onto the reformatted config, deployed config.json semantically identical to what was there (pool_address bc1qvrj3g84..., pool_pass_* false, ports unchanged), health check timer firing, and the Knots side untouched - bitcoind still up since 2026-08-19 with blocknotify intact. TWO PIECES OF DRIFT WHERE THE NODE WAS RIGHT, both confirmed with the operator: - datum_mining_address: the vault held bc1qdse9dsg... while the node had been mining to bc1qvrj3g... since 2026-08-08. This is WHERE BLOCK REWARDS ARE PAID. And unlike fulcrum and bitcoin-knots, the `Restart datum-gateway` handler here was never gated, so the stale value would have applied immediately rather than sitting inert on disk. - pool_pass_workers / pool_pass_full_users: false on the node, true in the vars file. Both corrected in the vault and role defaults with notes recording why. Comparing this config needs semantics, not text: the live file is single-line JSON and the template renders pretty-printed, so a textual diff is pure noise. Rendering it and comparing parsed JSON is what surfaced both differences. config.json carries bitcoind.rpcpassword and api.admin_password, and --diff prints rendered content - so `--check --diff` put them on the terminal. The task now sets diff: false by default (-e datum_reveal_config=true to opt in). Those two should be rotated. I also mis-reported pool_pass_workers/pool_pass_full_users as exposed credentials because my masking matched "pass" in the key name. They are BOOLEANS, and mining.pool_address is a Bitcoin address, public by nature. Only the two real passwords above were exposed. `Configure cmake build` and `Compile datum_gateway` are bare command: tasks with no changed_when, so they recompile on every run. The build is reproducible - Install datum_gateway binary sees identical content and leaves the installed binary's timestamp alone - but it is wasted work each time. Documented as the idempotent floor. Ownership parity checked mechanically against `git show HEAD:` keyed by task name: 7/7 match, 9 Kuma tasks dropped. This completes Plan 6 Stage 2: all six services in the list are roles. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| ansible | ||
| archive/uptime_kuma | ||
| tofu/nodito | ||
| .gitignore | ||
| 01_infra_setup.md | ||
| 02_vps_core_services_setup.md | ||
| 03_vm_disk_enlargement.md | ||
| README.md | ||
| requirements.txt | ||
Personal infra
My repo documenting my personal infra, along with artifacts, scripts, etc.
How to use
Go through the different numbered markdowns in the repo root to do the different parts.
How to edit secrets
ansible-vault edit ansible/your_file_with_secrets.yml
Assumes that you've set ansible/.vault_pass with chmod 600.
Overview
Services
- Reverse Proxy
- Deployed on Vipy
- Caddy
- Plan install
- File based config
- Crossbackup to Desky via rsync
Uptime Kuma— decommissioned 2026-09-11, seearchive/uptime_kuma/- Deployed on Vipy
- Crossbackup to Desky via rsync
- Vaultwarden
- Deployed on Desky
- Crossbackup to Vipy via rsync
- Gitea
- Deployed on Desky
- Crossbackup to Vipy via rsync
- Immich
- Deployed on Desky
- VPN
- All set up on Vipy
- Bitcoin Knots
- Deployed on Desky
- electrs
- Synapse Server
- Phoenix D + LNBits
- Backups
Infra
- Laptop (Lapy)
- One beefy desktop (Desky)
- One VPS (Vipy)