counterweight
d26dc78b3c
892-line playbook becomes 40 lines plus a role with install/build/configure/
service/healthcheck phases, five templates and one handler. bitcoin_knots_vars.yml
is deleted; its content is the role's defaults.
Verified after a real run: bitcoind still active since 2026-08-19 (NO restart),
chain at 966844 blocks / 875 GB, DATUM config intact, dbcache still 200, health
check timer firing again. changed=3, all health-check. vipy changed=0.
⚠ THE BIG ONE: the playbook would have deleted the mining integration.
bitcoin.conf on the node carries a section that was hand-added and was missing
from the template entirely:
blockmaxsize=3985000
blockmaxweight=3985000
blocknotify=killall -USR1 datum_gateway
maxmempool=1000
blockreconstructionextratxn=1000000
blocknotify is how datum_gateway learns a new block landed. Running the old
playbook would have stripped all of it and solo mining would have carried on
against a stale template - a silent failure that costs money rather than raising
an error. Also dbcache 200 -> 3528 (hand-tuned down; the calculation wants 90% of
RAM) and logging moved off the file. All now reconciled, dbcache behind
bitcoin_dbcache_mb_override.
bitcoin-knots and datum-gateway are ONE SYSTEM. Noted in the README.
AND MY OWN FIX MADE IT MORE DANGEROUS. The `Restart bitcoind` handler was guarded
by uptime_kuma_enabled, so it had been inert: bitcoin.conf and the systemd unit
both notify it and neither could restart anything - a config change applied to
disk, reported success, and never took effect. Ungating that is right, but it
converts "wrong config sitting inertly on disk" into "node restarted onto a
config that breaks mining". The ungating had to land WITH the template
reconciliation, not before it.
It also raises the bar permanently: any residual template/live difference now
restarts a Bitcoin node on every run. Four rounds of --check --diff to reach
changed=0 - the DATUM section, an explanatory comment that was rendering into the
deployed config (now a {# #} Jinja comment), a "# Pruning (optional)" comment the
live file had, and one trailing blank line.
The build path is 32 tasks all guarded by `not bitcoind_binary_exists.stat.exists`,
so a converged host skips the 30-60 minute compile and both `state: absent`
deletions. Those target /opt/bitcoin-knots/{source,bitcoin-<version>}; the chain
is in /mnt/knots_data and is never touched. Signature-verification tasks copied
verbatim.
The health check timer had last fired 2026-08-09 while reporting active/enabled -
same OnBootSec + OnUnitActiveSec dead chain as fulcrum. The role runs the check
once after enabling to supply the reference the timer schedules from.
Ownership parity checked mechanically against `git show HEAD:`, keyed by TASK
NAME rather than path - keying by path gave a false positive, because
bitcoin_knots_source_dir is created with ownership and later removed with
state: absent, so whichever task comes last wins and that differs between one
file and five. 13/13 match.
bitcoin_p2p_port and the tailscale hostname moved to services_config.yml for the
socket-proxy play on the edge host.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
60 lines
1.9 KiB
YAML
60 lines
1.9 KiB
YAML
# Centralized Services Configuration
|
|
# Subdomains and Caddy settings for all services
|
|
|
|
# Edit these subdomains to match your preferences
|
|
subdomains:
|
|
# Monitoring Services (on watchtower)
|
|
ntfy: ntfy
|
|
# DEPRECATED 2026-09-11 — Uptime Kuma is decommissioned and this subdomain no
|
|
# longer resolves to anything. Kept only because the deprecated monitoring
|
|
# blocks still template it into uptime_kuma_api_url. See archive/uptime_kuma/.
|
|
uptime_kuma: uptime
|
|
|
|
# VPN Infrastructure (on spacey)
|
|
headscale: headscale
|
|
|
|
# Core Services (on vipy)
|
|
vaultwarden: vault
|
|
forgejo: forgejo
|
|
lnbits: wallet
|
|
|
|
# Secondary Services (on vipy)
|
|
ntfy_emergency_app: avisame
|
|
personal_blog: pablohere
|
|
|
|
# Memos (on memos-box)
|
|
memos: memos
|
|
|
|
# Mempool Block Explorer (on mempool_box, proxied via vipy)
|
|
mempool: mempool
|
|
|
|
# DATUM Gateway dashboard (on knots_box, proxied via vipy)
|
|
datum_gateway: datum
|
|
|
|
# Caddy configuration
|
|
caddy_sites_dir: /etc/caddy/sites-enabled
|
|
|
|
# Service-specific settings shared across playbooks
|
|
service_settings:
|
|
ntfy:
|
|
topic: alerts
|
|
headscale:
|
|
namespace: counter-net
|
|
mempool:
|
|
# The frontend port is needed in two places on two different hosts: the
|
|
# mempool role deploys it on mempool-box, and the Caddy play proxies to it
|
|
# from the edge host. A role default cannot serve the second play, so it
|
|
# lives here rather than in roles/mempool/defaults.
|
|
frontend_port: 8080
|
|
bitcoin:
|
|
# The P2P port is needed on two hosts: the bitcoin_knots role deploys the
|
|
# node on knots-box, and the socket-proxy play publishes the port from the
|
|
# edge host. A role default cannot reach that second play.
|
|
p2p_port: 8333
|
|
tailscale_hostname: knots-box
|
|
fulcrum:
|
|
# Same shape as mempool: the fulcrum role deploys on fulcrum-box, and the
|
|
# socket-proxy play publishes the SSL port from the edge host. A role default
|
|
# is invisible to that second play.
|
|
ssl_port: 50002
|
|
tailscale_hostname: fulcrum-box
|