Publish sanitized P2Pool hashrate stats

Enable P2Pool's --data-api/--local-api and add a small stdlib-only sidecar
that copies an allowlist of numeric fields (node/sidechain hashrate,
connected miners, shares, network difficulty) to /p2pool/stats.json. Worker
IPs and wallet fragments in local/stratum are never served.

An Ingress adds that single path to the website host (www.eom.dev by
default), so the homepage can read it same-origin and reuse its TLS cert.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018STDcc5BaYxPMNA9S8Wycs

tasks/main.yml

@@ -198,6 +198,19 @@
                 secret:
                   secretName: monerotls
 
+# Mounted into the stats sidecar; the pod annotation below rolls it on change.
+- name: Store the P2Pool stats sidecar script
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: p2pool-stats
+        namespace: monero
+      data:
+        p2pool_stats.py: "{{ lookup('ansible.builtin.file', 'p2pool_stats.py') }}"
+
 - name: deploy p2pool
   k8s:
     definition:
@@ -215,6 +228,8 @@
           metadata:
             labels:
               app: p2pool
+            annotations:
+              monero/stats-script: "{{ lookup('ansible.builtin.file', 'p2pool_stats.py') | hash('sha256') }}"
           spec:
             containers:
               - name: p2pool
@@ -229,7 +244,10 @@
                      '--rpc-port', '18081',
                      '--wallet', monero_p2pool_wallet_address,
                      '--stratum', '0.0.0.0:3333',
-                     '--p2p', '0.0.0.0:37889']
+                     '--p2p', '0.0.0.0:37889',
+                     # JSON stats for the sidecar below. local/stratum lists
+                     # worker IPs, so /api is never served directly.
+                     '--data-api', '/api', '--local-api']
                     + ([] if monero_p2pool_chain == 'main' else ['--' ~ monero_p2pool_chain])
                     + (['--addpeers', monero_p2pool_addpeers | join(',')] if monero_p2pool_addpeers else [])
                     + ['--tls-cert', '/etc/letsencrypt/tls.crt',
@@ -251,6 +269,47 @@
                     mountPath: /home/p2pool
                   - name: tls
                     mountPath: /etc/letsencrypt
+                  - name: api
+                    mountPath: /api
+              # Serves an allowlisted summary of /api at /p2pool/stats.json.
+              - name: stats
+                image: "{{ monero_p2pool_stats_image }}"
+                command: ["python3", "-I", "/app/p2pool_stats.py"]
+                env:
+                  - name: P2POOL_API_DIR
+                    value: /api
+                  - name: P2POOL_CHAIN
+                    value: "{{ monero_p2pool_chain }}"
+                  - name: PYTHONDONTWRITEBYTECODE
+                    value: "1"
+                ports:
+                  - containerPort: 8080
+                    name: stats
+                readinessProbe:
+                  httpGet:
+                    path: /healthz
+                    port: stats
+                resources:
+                  requests:
+                    cpu: 10m
+                    memory: 32Mi
+                  limits:
+                    memory: 64Mi
+                securityContext:
+                  runAsNonRoot: true
+                  runAsUser: 65534
+                  runAsGroup: 65534
+                  readOnlyRootFilesystem: true
+                  allowPrivilegeEscalation: false
+                  capabilities:
+                    drop: [ALL]
+                volumeMounts:
+                  - name: api
+                    mountPath: /api
+                    readOnly: true
+                  - name: stats-app
+                    mountPath: /app
+                    readOnly: true
             volumes:
               - name: p2pool
                 persistentVolumeClaim:
@@ -258,6 +317,12 @@
               - name: tls
                 secret:
                   secretName: tls
+              - name: api
+                emptyDir:
+                  sizeLimit: 64Mi
+              - name: stats-app
+                configMap:
+                  name: p2pool-stats
 
 - name: monero service
   k8s:
@@ -297,3 +362,48 @@
             name: p2poolp2p
         type: LoadBalancer
 
+- name: p2pool stats service
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: p2pool-stats
+        namespace: monero
+      spec:
+        selector:
+          app: p2pool
+        ports:
+          - port: 8080
+            targetPort: stats
+            name: http
+        type: ClusterIP
+
+# Adds one exact path to the website's host. ingress-nginx merges it into that
+# host's server block, so it reuses the website's TLS certificate and the
+# homepage can fetch it same-origin. Nothing else on the host is affected.
+- name: Publish P2Pool stats on the website host
+  k8s:
+    state: "{{ 'present' if monero_p2pool_stats_host | length > 0 else 'absent' }}"
+    definition:
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        name: p2pool-stats
+        namespace: monero
+        annotations:
+          nginx.ingress.kubernetes.io/enable-access-log: "false"
+      spec:
+        ingressClassName: "{{ monero_p2pool_stats_ingress_class }}"
+        rules:
+          - host: "{{ monero_p2pool_stats_host | default('unset', true) }}"
+            http:
+              paths:
+                - path: /p2pool/stats.json
+                  pathType: Exact
+                  backend:
+                    service:
+                      name: p2pool-stats
+                      port:
+                        number: 8080
+