ansible-role-monero/tasks/main.yml

#SPDX-License-Identifier: MIT-0
---
# tasks file for ansible-role-monero
- name: Create Monero namespace
  k8s:
    state: present
    definition:
      apiVersion: v1
      kind: Namespace
      metadata:
        name: monero

- name: Create PVC for Monero
  k8s:
    state: present
    definition:
      apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: data
        namespace: monero
      spec:
        storageClassName: r720-nfs-client
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 512Gi

- name: Create PVC for P2Pool
  k8s:
    state: present
    definition:
      apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: p2pool
        namespace: monero
      spec:
        storageClassName: r720-nfs-client
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 64Gi

- name: Request a certificate for Monero
  k8s:
    state: present
    definition:
      apiVersion: cert-manager.io/v1
      kind: Certificate
      metadata:
        name: monerotls
        namespace: monero
      spec:
        secretName: monerotls
        privateKey:
          algorithm: RSA
          encoding: PKCS1
          size: 2048
        duration: 2160h # 90d
        renewBefore: 360h # 15d
        isCA: false
        usages:
          - server auth
          - client auth
        subject:
          organizations:
            - EOM
        commonName: monerod.eom.dev
        dnsNames:
          - monerod.eom.dev
        issuerRef:
          name: ca-issuer
          kind: ClusterIssuer

- name: Request a certificate for p2pool
  k8s:
    state: present
    definition:
      apiVersion: cert-manager.io/v1
      kind: Certificate
      metadata:
        name: tls
        namespace: monero
      spec:
        secretName: tls
        privateKey:
          algorithm: RSA
          encoding: PKCS1
          size: 2048
        duration: 2160h # 90d
        renewBefore: 360h # 15d
        isCA: false
        usages:
          - server auth
          - client auth
        subject:
          organizations:
            - EOM
        commonName: p2pool.eom.dev
        dnsNames:
          - p2pool.eom.dev
        issuerRef:
          name: ca-issuer
          kind: ClusterIssuer

- name: Edit Deployment for Monerod
  k8s:
    definition:
      apiVersion: v1
      kind: Deployment
      metadata:
        name: monerod
        namespace: monero
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: monerod
        template:
          metadata:
            labels:
              app: monerod
          spec:
            containers:
              - name: monerod
                image: ericomeehan/monerod:latest
                imagePullPolicy: Always
                command:
                  - monerod
                args:
                  - "--p2p-bind-ip=0.0.0.0"
                  - "--p2p-bind-port=18080"
                  - "--rpc-bind-ip=0.0.0.0"
                  - "--rpc-bind-port=18081"
                  - "--restricted-rpc"
                  - "--rpc-login={{ monerod_user }}:{{ monerod_password }}"
                  - "--data-dir=/data"
                  - "--zmq-pub=tcp://127.0.0.1:18083"
                  - "--rpc-ssl=enabled"
                  - "--rpc-ssl-private-key=/etc/letsencrypt/tls.key"
                  - "--rpc-ssl-certificate=/etc/letsencrypt/tls.crt"
                  - "--non-interactive"
                  - "--no-igd"
                  - "--confirm-external-bind"
                  - "--bootstrap-daemon-address=auto"
                resources:
                  requests:
                    memory: 2Gi
                ports:
                  - containerPort: 18080
                  - containerPort: 18081
                  - containerPort: 18083
                volumeMounts:
                  - name: monerod
                    mountPath: /data
                  - name: monerotls
                    mountPath: /etc/letsencrypt
              - name: p2pool
                image: ericomeehan/p2pool:latest
                imagePullPolicy: IfNotPresent
                command:
                  - p2pool
                args:
                  - "--host"
                  - "127.0.0.1"
                  - "--rpc-port"
                  - "18081"
                  - "--wallet"
                  - "{{ monero_p2pool_wallet_address }}"
                  - "--stratum"
                  - "0.0.0.0:3333"
                  - "--p2p"
                  - "0.0.0.0:37889"
                  - "--addpeers"
                  - "65.21.227.114:37889"
                  - "--tls-cert"
                  - "/etc/letsencrypt/tls.crt"
                  - "--tls-cert-key"
                  - "/etc/letsencrypt/tls.key"
                  - "--rpc-ssl"
                ports:
                  - containerPort: 3333
                  - containerPort: 37889
                volumeMounts:
                  - name: p2pool
                    mountPath: /home/p2pool
                  - name: tls
                    mountPath: /etc/letsencrypt
            volumes:
              - name: monerod
                persistentVolumeClaim:
                  claimName: data
              - name: p2pool
                persistentVolumeClaim:
                  claimName: p2pool
              - name: monerotls
                secret:
                  secretName: monerotls
              - name: tls
                secret:
                  secretName: tls

- name: Create Service for Monero
  k8s:
    definition:
      apiVersion: v1
      kind: Service
      metadata:
        name: monerod
        namespace: monero
      spec:
        selector:
          app: monerod
        ports:
          - port: 18080
            name: p2p
          - port: 18081
            name: rpc
          - port: 18083
            name: zmq
          - port: 3333
            name: mine
          - port: 37889
            name: p2poolp2p
        type: LoadBalancer