DevOps/ansible-role-monero
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Move RPC login to a Secret, put P2Pool on a selectable sidechain

Browse Source 
The monerod RPC login was in both Deployments' args, readable by anyone who
can read Deployments. It now lives in the monerod-rpc Secret and reaches the
containers through an env var.

P2Pool now runs on monero_p2pool_chain, defaulting to nano. On main the
miners found a share about every 6 days and missed most PPLNS windows.
The hardcoded main-chain peer only applied to main, so peers are a variable.

monerod's RPC SSL is now autodetect: Shkeeper's Monero module always uses
plain HTTP, so with SSL required it saw the node as Offline and hid XMR.

Also: Deployments use apps/v1, monerod's ZMQ binds 0.0.0.0 to match the
live deployment (P2Pool connects from its own pod), required variables are
checked up front, and the README describes the role.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
claude
2026-11-07 11:46:16 -05:00
co-authored by Claude Opus 5.5
parent dfef5bea63
commit 46aec42185
3 changed files with 98 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+23 -22
View File
@@ -1,38 +1,39 @@
Role Name
=========
ansible-role-monero
===================
A brief description of the role goes here.
Requirements
------------
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
Deploys a Monero node (monerod) and a P2Pool node to Kubernetes, in the
`monero` namespace. Miners point xmrig at the P2Pool service on port 3333.
Role Variables
--------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
Required, from Vault:
Dependencies
------------
- `monerod_user`, `monerod_password`: monerod's RPC login. Stored in the
`monerod-rpc` Secret and passed to both containers through an environment
variable, so it doesn't show in the Deployment specs.
- `monero_p2pool_wallet_address`: the address P2Pool pays out to.
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Optional:
- `monero_p2pool_chain` (default `nano`): `main`, `mini` or `nano`. Match it
to your total hashrate; see the note in `defaults/main.yml`. Switching
chains starts from zero shares on the new chain, and shares on the old one
stop earning once they leave its PPLNS window.
- `monero_p2pool_addpeers` (default `[]`): extra P2Pool peers as `host:port`.
They must be on the same chain.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
- hosts: alpha-control-plane
become: true
vars_files:
- ../secrets.yaml
roles:
- { role: username.rolename, x: 42 }
- role: ericomeehan.monero
License
-------
BSD
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).
MIT-0
defaults/main.yml
+17
View File
@@ -1,3 +1,20 @@
#SPDX-License-Identifier: MIT-0
---
# defaults file for ansible-role-monero
# P2Pool sidechain: main, mini or nano. Pick the one your total hashrate can
# find shares on at least every few hours, or payouts become rare lumps:
# share difficulty (Nov 2026) is ~4.2G on main, ~320M on mini, ~160M on nano.
# A home setup of a few kH/s belongs on nano. P2P stays on port 37889 on
# every chain, so the LoadBalancer and any router forwarding are unchanged.
monero_p2pool_chain: nano
# Extra P2Pool peers, as host:port. Peers only help on their own chain.
monero_p2pool_addpeers: []
monerod_rpc_secret_name: monerod-rpc
# Required (Vault).
monerod_user: ""
monerod_password: ""
monero_p2pool_wallet_address: ""
tasks/main.yml
+58 -24
View File
@@ -1,5 +1,15 @@
---
# tasks file for monero
- name: Check required variables
ansible.builtin.assert:
that:
- monerod_user | length > 0
- monerod_password | length > 0
- monero_p2pool_wallet_address | length > 0
- monero_p2pool_chain in ['main', 'mini', 'nano']
quiet: true
no_log: true
- name: Create Monero namespace
k8s:
state: present
@@ -105,10 +115,25 @@
name: ca-issuer
kind: ClusterIssuer
# Kept out of the Deployments so the login doesn't show in their specs.
- name: Store the monerod RPC login
k8s:
state: present
definition:
apiVersion: v1
kind: Secret
metadata:
name: "{{ monerod_rpc_secret_name }}"
namespace: monero
type: Opaque
stringData:
login: "{{ monerod_user }}:{{ monerod_password }}"
no_log: true
- name: Edit Deployment for Monerod
k8s:
definition:
apiVersion: v1
apiVersion: apps/v1
kind: Deployment
metadata:
name: monerod
@@ -135,16 +160,24 @@
- "--rpc-bind-ip=0.0.0.0"
- "--rpc-bind-port=18081"
- "--restricted-rpc"
- "--rpc-login={{ monerod_user }}:{{ monerod_password }}"
- "--rpc-login=$(MONEROD_RPC_LOGIN)"
- "--data-dir=/data"
- "--zmq-pub=tcp://127.0.0.1:18083"
- "--rpc-ssl=enabled"
- "--zmq-pub=tcp://0.0.0.0:18083" # P2Pool connects from its own pod
# autodetect: Shkeeper only speaks plain HTTP to monerod (it never sets
# protocol=https), so the port must accept both.
- "--rpc-ssl=autodetect"
- "--rpc-ssl-private-key=/etc/letsencrypt/tls.key"
- "--rpc-ssl-certificate=/etc/letsencrypt/tls.crt"
- "--non-interactive"
- "--no-igd"
- "--confirm-external-bind"
- "--bootstrap-daemon-address=auto"
env:
- name: MONEROD_RPC_LOGIN
valueFrom:
secretKeyRef:
name: "{{ monerod_rpc_secret_name }}"
key: login
resources:
requests:
memory: 2Gi
@@ -168,7 +201,7 @@
- name: deploy p2pool
k8s:
definition:
apiVersion: v1
apiVersion: apps/v1
kind: Deployment
metadata:
name: p2pool
@@ -189,25 +222,26 @@
imagePullPolicy: IfNotPresent
command:
- p2pool
args:
- "--host"
- "monerod"
- "--rpc-port"
- "18081"
- "--wallet"
- "{{ monero_p2pool_wallet_address }}"
- "--stratum"
- "0.0.0.0:3333"
- "--p2p"
- "0.0.0.0:37889"
- "--addpeers"
- "65.21.227.114:37889"
- "--tls-cert"
- "/etc/letsencrypt/tls.crt"
- "--tls-cert-key"
- "/etc/letsencrypt/tls.key"
- "--rpc-ssl"
- "--rpc-login={{ monerod_user }}:{{ monerod_password }}"
args: >-
{{
['--host', 'monerod',
'--rpc-port', '18081',
'--wallet', monero_p2pool_wallet_address,
'--stratum', '0.0.0.0:3333',
'--p2p', '0.0.0.0:37889']
+ ([] if monero_p2pool_chain == 'main' else ['--' ~ monero_p2pool_chain])
+ (['--addpeers', monero_p2pool_addpeers | join(',')] if monero_p2pool_addpeers else [])
+ ['--tls-cert', '/etc/letsencrypt/tls.crt',
'--tls-cert-key', '/etc/letsencrypt/tls.key',
'--rpc-ssl',
'--rpc-login=$(MONEROD_RPC_LOGIN)']
}}
env:
- name: MONEROD_RPC_LOGIN
valueFrom:
secretKeyRef:
name: "{{ monerod_rpc_secret_name }}"
key: login
ports:
- containerPort: 3333
- containerPort: 37889