diff --git a/README.md b/README.md index 225dd44..2be36b0 100644 --- a/README.md +++ b/README.md @@ -1,38 +1,39 @@ -Role Name -========= +ansible-role-monero +=================== -A brief description of the role goes here. - -Requirements ------------- - -Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. +Deploys a Monero node (monerod) and a P2Pool node to Kubernetes, in the +`monero` namespace. Miners point xmrig at the P2Pool service on port 3333. Role Variables -------------- -A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. +Required, from Vault: -Dependencies ------------- +- `monerod_user`, `monerod_password`: monerod's RPC login. Stored in the + `monerod-rpc` Secret and passed to both containers through an environment + variable, so it doesn't show in the Deployment specs. +- `monero_p2pool_wallet_address`: the address P2Pool pays out to. -A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. +Optional: + +- `monero_p2pool_chain` (default `nano`): `main`, `mini` or `nano`. Match it + to your total hashrate; see the note in `defaults/main.yml`. Switching + chains starts from zero shares on the new chain, and shares on the old one + stop earning once they leave its PPLNS window. +- `monero_p2pool_addpeers` (default `[]`): extra P2Pool peers as `host:port`. + They must be on the same chain. Example Playbook ---------------- -Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: - - - hosts: servers + - hosts: alpha-control-plane + become: true + vars_files: + - ../secrets.yaml roles: - - { role: username.rolename, x: 42 } + - role: ericomeehan.monero License ------- -BSD - -Author Information ------------------- - -An optional section for the role authors to include contact information, or a website (HTML is not allowed). +MIT-0 diff --git a/defaults/main.yml b/defaults/main.yml index a3b6d8d..8e4897e 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,3 +1,20 @@ #SPDX-License-Identifier: MIT-0 --- # defaults file for ansible-role-monero + +# P2Pool sidechain: main, mini or nano. Pick the one your total hashrate can +# find shares on at least every few hours, or payouts become rare lumps: +# share difficulty (Nov 2026) is ~4.2G on main, ~320M on mini, ~160M on nano. +# A home setup of a few kH/s belongs on nano. P2P stays on port 37889 on +# every chain, so the LoadBalancer and any router forwarding are unchanged. +monero_p2pool_chain: nano + +# Extra P2Pool peers, as host:port. Peers only help on their own chain. +monero_p2pool_addpeers: [] + +monerod_rpc_secret_name: monerod-rpc + +# Required (Vault). +monerod_user: "" +monerod_password: "" +monero_p2pool_wallet_address: "" diff --git a/tasks/main.yml b/tasks/main.yml index 5525edf..aa55d8d 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,5 +1,15 @@ --- # tasks file for monero +- name: Check required variables + ansible.builtin.assert: + that: + - monerod_user | length > 0 + - monerod_password | length > 0 + - monero_p2pool_wallet_address | length > 0 + - monero_p2pool_chain in ['main', 'mini', 'nano'] + quiet: true + no_log: true + - name: Create Monero namespace k8s: state: present @@ -105,10 +115,25 @@ name: ca-issuer kind: ClusterIssuer +# Kept out of the Deployments so the login doesn't show in their specs. +- name: Store the monerod RPC login + k8s: + state: present + definition: + apiVersion: v1 + kind: Secret + metadata: + name: "{{ monerod_rpc_secret_name }}" + namespace: monero + type: Opaque + stringData: + login: "{{ monerod_user }}:{{ monerod_password }}" + no_log: true + - name: Edit Deployment for Monerod k8s: definition: - apiVersion: v1 + apiVersion: apps/v1 kind: Deployment metadata: name: monerod @@ -135,16 +160,24 @@ - "--rpc-bind-ip=0.0.0.0" - "--rpc-bind-port=18081" - "--restricted-rpc" - - "--rpc-login={{ monerod_user }}:{{ monerod_password }}" + - "--rpc-login=$(MONEROD_RPC_LOGIN)" - "--data-dir=/data" - - "--zmq-pub=tcp://127.0.0.1:18083" - - "--rpc-ssl=enabled" + - "--zmq-pub=tcp://0.0.0.0:18083" # P2Pool connects from its own pod + # autodetect: Shkeeper only speaks plain HTTP to monerod (it never sets + # protocol=https), so the port must accept both. + - "--rpc-ssl=autodetect" - "--rpc-ssl-private-key=/etc/letsencrypt/tls.key" - "--rpc-ssl-certificate=/etc/letsencrypt/tls.crt" - "--non-interactive" - "--no-igd" - "--confirm-external-bind" - "--bootstrap-daemon-address=auto" + env: + - name: MONEROD_RPC_LOGIN + valueFrom: + secretKeyRef: + name: "{{ monerod_rpc_secret_name }}" + key: login resources: requests: memory: 2Gi @@ -168,7 +201,7 @@ - name: deploy p2pool k8s: definition: - apiVersion: v1 + apiVersion: apps/v1 kind: Deployment metadata: name: p2pool @@ -189,25 +222,26 @@ imagePullPolicy: IfNotPresent command: - p2pool - args: - - "--host" - - "monerod" - - "--rpc-port" - - "18081" - - "--wallet" - - "{{ monero_p2pool_wallet_address }}" - - "--stratum" - - "0.0.0.0:3333" - - "--p2p" - - "0.0.0.0:37889" - - "--addpeers" - - "65.21.227.114:37889" - - "--tls-cert" - - "/etc/letsencrypt/tls.crt" - - "--tls-cert-key" - - "/etc/letsencrypt/tls.key" - - "--rpc-ssl" - - "--rpc-login={{ monerod_user }}:{{ monerod_password }}" + args: >- + {{ + ['--host', 'monerod', + '--rpc-port', '18081', + '--wallet', monero_p2pool_wallet_address, + '--stratum', '0.0.0.0:3333', + '--p2p', '0.0.0.0:37889'] + + ([] if monero_p2pool_chain == 'main' else ['--' ~ monero_p2pool_chain]) + + (['--addpeers', monero_p2pool_addpeers | join(',')] if monero_p2pool_addpeers else []) + + ['--tls-cert', '/etc/letsencrypt/tls.crt', + '--tls-cert-key', '/etc/letsencrypt/tls.key', + '--rpc-ssl', + '--rpc-login=$(MONEROD_RPC_LOGIN)'] + }} + env: + - name: MONEROD_RPC_LOGIN + valueFrom: + secretKeyRef: + name: "{{ monerod_rpc_secret_name }}" + key: login ports: - containerPort: 3333 - containerPort: 37889