Move RPC login to a Secret, put P2Pool on a selectable sidechain

The monerod RPC login was in both Deployments' args, readable by anyone who
can read Deployments. It now lives in the monerod-rpc Secret and reaches the
containers through an env var.

P2Pool now runs on monero_p2pool_chain, defaulting to nano. On main the
miners found a share about every 6 days and missed most PPLNS windows.
The hardcoded main-chain peer only applied to main, so peers are a variable.

monerod's RPC SSL is now autodetect: Shkeeper's Monero module always uses
plain HTTP, so with SSL required it saw the node as Offline and hid XMR.

Also: Deployments use apps/v1, monerod's ZMQ binds 0.0.0.0 to match the
live deployment (P2Pool connects from its own pod), required variables are
checked up front, and the README describes the role.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/main.yml

@@ -1,5 +1,15 @@
 ---
 # tasks file for monero
+- name: Check required variables
+  ansible.builtin.assert:
+    that:
+      - monerod_user | length > 0
+      - monerod_password | length > 0
+      - monero_p2pool_wallet_address | length > 0
+      - monero_p2pool_chain in ['main', 'mini', 'nano']
+    quiet: true
+  no_log: true
+
 - name: Create Monero namespace
   k8s:
     state: present
@@ -105,10 +115,25 @@
           name: ca-issuer
           kind: ClusterIssuer
 
+# Kept out of the Deployments so the login doesn't show in their specs.
+- name: Store the monerod RPC login
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: "{{ monerod_rpc_secret_name }}"
+        namespace: monero
+      type: Opaque
+      stringData:
+        login: "{{ monerod_user }}:{{ monerod_password }}"
+  no_log: true
+
 - name: Edit Deployment for Monerod
   k8s:
     definition:
-      apiVersion: v1
+      apiVersion: apps/v1
       kind: Deployment
       metadata:
         name: monerod
@@ -135,16 +160,24 @@
                   - "--rpc-bind-ip=0.0.0.0"
                   - "--rpc-bind-port=18081"
                   - "--restricted-rpc"
-                  - "--rpc-login={{ monerod_user }}:{{ monerod_password }}"
+                  - "--rpc-login=$(MONEROD_RPC_LOGIN)"
                   - "--data-dir=/data"
-                  - "--zmq-pub=tcp://127.0.0.1:18083"
-                  - "--rpc-ssl=enabled"
+                  - "--zmq-pub=tcp://0.0.0.0:18083"  # P2Pool connects from its own pod
+                  # autodetect: Shkeeper only speaks plain HTTP to monerod (it never sets
+                  # protocol=https), so the port must accept both.
+                  - "--rpc-ssl=autodetect"
                   - "--rpc-ssl-private-key=/etc/letsencrypt/tls.key"
                   - "--rpc-ssl-certificate=/etc/letsencrypt/tls.crt"
                   - "--non-interactive"
                   - "--no-igd"
                   - "--confirm-external-bind"
                   - "--bootstrap-daemon-address=auto"
+                env:
+                  - name: MONEROD_RPC_LOGIN
+                    valueFrom:
+                      secretKeyRef:
+                        name: "{{ monerod_rpc_secret_name }}"
+                        key: login
                 resources:
                   requests:
                     memory: 2Gi
@@ -168,7 +201,7 @@
 - name: deploy p2pool
   k8s:
     definition:
-      apiVersion: v1
+      apiVersion: apps/v1
       kind: Deployment
       metadata:
         name: p2pool
@@ -189,25 +222,26 @@
                 imagePullPolicy: IfNotPresent
                 command:
                   - p2pool
-                args:
-                  - "--host"
-                  - "monerod"
-                  - "--rpc-port"
-                  - "18081"
-                  - "--wallet"
-                  - "{{ monero_p2pool_wallet_address }}"
-                  - "--stratum"
-                  - "0.0.0.0:3333"
-                  - "--p2p"
-                  - "0.0.0.0:37889"
-                  - "--addpeers"
-                  - "65.21.227.114:37889"
-                  - "--tls-cert"
-                  - "/etc/letsencrypt/tls.crt"
-                  - "--tls-cert-key"
-                  - "/etc/letsencrypt/tls.key"
-                  - "--rpc-ssl"
-                  - "--rpc-login={{ monerod_user }}:{{ monerod_password }}"
+                args: >-
+                  {{
+                    ['--host', 'monerod',
+                     '--rpc-port', '18081',
+                     '--wallet', monero_p2pool_wallet_address,
+                     '--stratum', '0.0.0.0:3333',
+                     '--p2p', '0.0.0.0:37889']
+                    + ([] if monero_p2pool_chain == 'main' else ['--' ~ monero_p2pool_chain])
+                    + (['--addpeers', monero_p2pool_addpeers | join(',')] if monero_p2pool_addpeers else [])
+                    + ['--tls-cert', '/etc/letsencrypt/tls.crt',
+                       '--tls-cert-key', '/etc/letsencrypt/tls.key',
+                       '--rpc-ssl',
+                       '--rpc-login=$(MONEROD_RPC_LOGIN)']
+                  }}
+                env:
+                  - name: MONEROD_RPC_LOGIN
+                    valueFrom:
+                      secretKeyRef:
+                        name: "{{ monerod_rpc_secret_name }}"
+                        key: login
                 ports:
                   - containerPort: 3333
                   - containerPort: 37889