counterweight
bf3d21fef7
Nothing in the repo pushes to, authenticates against, or is gated by Uptime
Kuma any more.
── The sixth instance of the banner bug ────────────────────────────────────
memos had `Restart memos` guarded by `uptime_kuma_enabled`, because the
deprecation banner was placed immediately above it and swept it in. It is a
HANDLER, so every memos config change since 2026-09-11 applied to disk and
silently never restarted the service. Ungated.
That is the same failure found in forgejo-runner's self-assert, phoenixd's timer
enable, mempool's three timer enables, fulcrum's restart handler and bitcoind's
restart handler. Every guard was read and asked "monitoring or deployment?"
before being deleted, which is the only reason this was caught.
── What was removed ────────────────────────────────────────────────────────
30 uptime_kuma_enabled guards across 7 unconverted service playbooks, and
the 29 Kuma monitor-creation tasks they gated (embedded Python that drove
the Kuma API, temp credential files, cleanup)
7 dead uptime_kuma_api_url definitions
7 stale DEPRECATED banners
uptime_kuma_enabled and subdomains.uptime_kuma from group_vars/all
healthcheck_push_urls from the vault - 30 push tokens
services/ntfy/setup_ntfy_uptime_kuma_notification.yml -> archive/
The explanatory comments in the six converted roles are KEPT on purpose. They
record why a handler is ungated, and deleting the explanation invites someone
to helpfully re-add the guard.
── The probes moved rather than died ───────────────────────────────────────
Eight per-service health checks were still pushing to Kuma. They are not
superseded by infra/401: that answers "is the unit running", these answer "does
the service actually respond" - an RPC call to bitcoind, a TCP connect to
Fulcrum's Electrum port, an HTTP fetch from Mempool's backend. A process can be
perfectly `active` and useless.
So they were repointed, not deleted. Gatus external endpoints take a POST with
a bearer token and success=true|false where Kuma took a GET with ?status=up, so
report() now maps up/down to true/false internally and no call site changed.
Registered by infra/403 as the `probe` group, one token per host.
Two bugs fixed while in there:
* forgejo-runner's check only ever reported SUCCESS - it exited before pushing
when the runner was down, so a failure was invisible until the heartbeat
window expired. Reporting the failure is the entire point of a check.
* All six healthcheck .service units were mode 0644 and now carry a bearer
token. They are 0600.
Verified: 91 endpoints, 91 UP, 0 DOWN. Every probe triggered by hand and
confirmed arriving. Zero Kuma URLs left in the vault, zero live references in
any playbook or role.
Still standing, deliberately: the Kuma container on watchtower, its Caddy vhost,
and the uptime.contrapeso.xyz DNS record. Turning the service off is a separate
decision from removing the code that talked to it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
81 lines
3.9 KiB
YAML
81 lines
3.9 KiB
YAML
# Fulcrum Configuration Variables
|
|
|
|
# Version - Pinned to specific release
|
|
fulcrum_version: "2.1.0" # Fulcrum version to install
|
|
|
|
# Directories
|
|
fulcrum_db_dir: /mnt/fulcrum_data/fulcrum_db # Database directory (heavy data on special mount)
|
|
fulcrum_config_dir: /etc/fulcrum # Config file location (standard OS path)
|
|
fulcrum_lib_dir: /var/lib/fulcrum # Other data files (banner, etc.) on OS disk
|
|
fulcrum_binary_path: /usr/local/bin/Fulcrum
|
|
|
|
# Network - Bitcoin RPC connection
|
|
# Bitcoin Knots is on a different host (knots_box_local)
|
|
# Using RPC user/password authentication (credentials from group_vars/all/vault.yml)
|
|
# Addressed by Tailscale name, never a LAN IP. This was
|
|
# bitcoin_rpc_host: "192.168.1.140" # IP of knots_box_local
|
|
# but .140 is fulcrum-box ITSELF - knots-box is .135. The DHCP leases had
|
|
# reshuffled (the same drift that transposed the inventory), so running this
|
|
# playbook would have pointed Fulcrum at itself and broken indexing. The live
|
|
# config had already been hand-corrected to knots-box; this makes the repo
|
|
# agree with it.
|
|
bitcoin_rpc_host: "knots-box"
|
|
bitcoin_rpc_port: 8332 # Bitcoin Knots RPC port
|
|
# Note: bitcoin_rpc_user and bitcoin_rpc_password are loaded from group_vars/all/vault.yml
|
|
|
|
# Network - Fulcrum server
|
|
fulcrum_tcp_port: 50001
|
|
# The edge host's socket-proxy/Caddy play needs this too, and a role default is
|
|
# invisible outside this role. The authoritative value for the live deployment is
|
|
# in host_vars/fulcrum_box_local/main.yml, which outranks this; the value here is the
|
|
# protocol standard, so the role still works standalone.
|
|
fulcrum_ssl_port: 50002
|
|
# Binding address for Fulcrum TCP/SSL server:
|
|
# - "127.0.0.1" = localhost only (use when Caddy is on the same box)
|
|
# - "0.0.0.0" = all interfaces (use when Caddy is on a different box)
|
|
# - Specific IP = bind to specific network interface
|
|
fulcrum_tcp_bind: "0.0.0.0" # Default: localhost (change to "0.0.0.0" if Caddy is on different box)
|
|
fulcrum_ssl_bind: "0.0.0.0" # Binding address for SSL port
|
|
# If Caddy is on a different box, set this to the IP address that Caddy will use to connect
|
|
|
|
# SSL/TLS Configuration
|
|
fulcrum_ssl_enabled: true
|
|
fulcrum_ssl_cert_path: "{{ fulcrum_config_dir }}/fulcrum.crt"
|
|
fulcrum_ssl_key_path: "{{ fulcrum_config_dir }}/fulcrum.key"
|
|
fulcrum_ssl_cert_days: 3650 # 10 years validity for self-signed cert
|
|
|
|
|
|
# Performance
|
|
# db_mem will be calculated as 75% of available RAM automatically in playbook
|
|
# db_mem is computed as this share of RAM unless fulcrum_db_mem_mb is set
|
|
# explicitly. On a 5931 MB host 75% is 4448 MB, which leaves ~1.4 GB for the
|
|
# OS and for Fulcrum's non-cache memory; the live config had been hand-tuned
|
|
# down to 2048 and that setting is respected below.
|
|
fulcrum_db_mem_percent: 0.75 # 75% of RAM for database cache
|
|
|
|
# Configuration options
|
|
fulcrum_anon_logs: true # Anonymize client IPs and TxIDs in logs
|
|
fulcrum_peering: false # Disable peering with other Fulcrum servers
|
|
fulcrum_zmq_allow_hashtx: true # Allow ZMQ hashtx notifications
|
|
|
|
# Service user
|
|
fulcrum_user: fulcrum
|
|
fulcrum_group: fulcrum
|
|
|
|
|
|
# --- Health check -----------------------------------------------------------
|
|
# Checks the Electrum TCP port and records the answer in its exit code, which
|
|
# systemd keeps: `systemctl is-failed fulcrum-healthcheck.service`.
|
|
#
|
|
# WHERE TO REPORT HEALTH — the one place to plug in monitoring. Empty means
|
|
# check, exit honestly, report nowhere. Any endpoint accepting an HTTP ping
|
|
# works; nothing here is specific to a monitoring product.
|
|
healthcheck_push_url: ""
|
|
# Bearer token for the Gatus external endpoint. Required whenever a push URL
|
|
# is set: Gatus rejects an unauthenticated push with 401.
|
|
healthcheck_push_token: ""
|
|
|
|
# Explicit db_mem in MB. When set it wins over fulcrum_db_mem_percent; empty
|
|
# means compute from RAM. Set here because the live host had been hand-tuned to
|
|
# 2048 and a silent jump to 4448 is not something a refactor should do.
|
|
fulcrum_db_mem_mb_override: 2048
|