ansible-role-monero/tasks/main.yml

---
# tasks file for monero
- name: Check required variables
  ansible.builtin.assert:
    that:
      - monerod_user | length > 0
      - monerod_password | length > 0
      - monero_p2pool_wallet_address | length > 0
      - monero_p2pool_chain in ['main', 'mini', 'nano']
    quiet: true
  no_log: true

- name: Create Monero namespace
  k8s:
    state: present
    definition:
      apiVersion: v1
      kind: Namespace
      metadata:
        name: monero

- name: Create PVC for Monero
  k8s:
    state: present
    definition:
      apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: data
        namespace: monero
      spec:
        storageClassName: r720-nfs-client
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 512Gi

- name: Create PVC for P2Pool
  k8s:
    state: present
    definition:
      apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: p2pool
        namespace: monero
      spec:
        storageClassName: r720-nfs-client
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 64Gi

- name: Request a certificate for Monero
  k8s:
    state: present
    definition:
      apiVersion: cert-manager.io/v1
      kind: Certificate
      metadata:
        name: monerotls
        namespace: monero
      spec:
        secretName: monerotls
        privateKey:
          algorithm: RSA
          encoding: PKCS1
          size: 2048
        duration: 2160h # 90d
        renewBefore: 360h # 15d
        isCA: false
        usages:
          - server auth
          - client auth
        subject:
          organizations:
            - EOM
        commonName: monerod.eom.dev
        dnsNames:
          - monerod.eom.dev
        issuerRef:
          name: ca-issuer
          kind: ClusterIssuer

- name: Request a certificate for p2pool
  k8s:
    state: present
    definition:
      apiVersion: cert-manager.io/v1
      kind: Certificate
      metadata:
        name: tls
        namespace: monero
      spec:
        secretName: tls
        privateKey:
          algorithm: RSA
          encoding: PKCS1
          size: 2048
        duration: 2160h # 90d
        renewBefore: 360h # 15d
        isCA: false
        usages:
          - server auth
          - client auth
        subject:
          organizations:
            - EOM
        commonName: p2pool.eom.dev
        dnsNames:
          - p2pool.eom.dev
        issuerRef:
          name: ca-issuer
          kind: ClusterIssuer

# Kept out of the Deployments so the login doesn't show in their specs.
- name: Store the monerod RPC login
  k8s:
    state: present
    definition:
      apiVersion: v1
      kind: Secret
      metadata:
        name: "{{ monerod_rpc_secret_name }}"
        namespace: monero
      type: Opaque
      stringData:
        login: "{{ monerod_user }}:{{ monerod_password }}"
  no_log: true

- name: Edit Deployment for Monerod
  k8s:
    definition:
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: monerod
        namespace: monero
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: monerod
        template:
          metadata:
            labels:
              app: monerod
          spec:
            containers:
              - name: monerod
                image: ericomeehan/monerod:latest
                imagePullPolicy: Always
                command:
                  - monerod
                args:
                  - "--p2p-bind-ip=0.0.0.0"
                  - "--p2p-bind-port=18080"
                  - "--rpc-bind-ip=0.0.0.0"
                  - "--rpc-bind-port=18081"
                  - "--restricted-rpc"
                  - "--rpc-login=$(MONEROD_RPC_LOGIN)"
                  - "--data-dir=/data"
                  - "--zmq-pub=tcp://0.0.0.0:18083"  # P2Pool connects from its own pod
                  # autodetect: Shkeeper only speaks plain HTTP to monerod (it never sets
                  # protocol=https), so the port must accept both.
                  - "--rpc-ssl=autodetect"
                  - "--rpc-ssl-private-key=/etc/letsencrypt/tls.key"
                  - "--rpc-ssl-certificate=/etc/letsencrypt/tls.crt"
                  - "--non-interactive"
                  - "--no-igd"
                  - "--confirm-external-bind"
                  - "--bootstrap-daemon-address=auto"
                env:
                  - name: MONEROD_RPC_LOGIN
                    valueFrom:
                      secretKeyRef:
                        name: "{{ monerod_rpc_secret_name }}"
                        key: login
                resources:
                  requests:
                    memory: 2Gi
                ports:
                  - containerPort: 18080
                  - containerPort: 18081
                  - containerPort: 18083
                volumeMounts:
                  - name: monerod
                    mountPath: /data
                  - name: monerotls
                    mountPath: /etc/letsencrypt
            volumes:
              - name: monerod
                persistentVolumeClaim:
                  claimName: data
              - name: monerotls
                secret:
                  secretName: monerotls

- name: deploy p2pool
  k8s:
    definition:
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: p2pool
        namespace: monero
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: p2pool
        template:
          metadata:
            labels:
              app: p2pool
          spec:
            containers:
              - name: p2pool
                image: ericomeehan/p2pool:latest
                imagePullPolicy: IfNotPresent
                command:
                  - p2pool
                # P2Pool takes "--opt value" only; "--opt=value" makes it exit.
                args: >-
                  {{
                    ['--host', 'monerod',
                     '--rpc-port', '18081',
                     '--wallet', monero_p2pool_wallet_address,
                     '--stratum', '0.0.0.0:3333',
                     '--p2p', '0.0.0.0:37889']
                    + ([] if monero_p2pool_chain == 'main' else ['--' ~ monero_p2pool_chain])
                    + (['--addpeers', monero_p2pool_addpeers | join(',')] if monero_p2pool_addpeers else [])
                    + ['--tls-cert', '/etc/letsencrypt/tls.crt',
                       '--tls-cert-key', '/etc/letsencrypt/tls.key',
                       '--rpc-ssl',
                       '--rpc-login', '$(MONEROD_RPC_LOGIN)']
                  }}
                env:
                  - name: MONEROD_RPC_LOGIN
                    valueFrom:
                      secretKeyRef:
                        name: "{{ monerod_rpc_secret_name }}"
                        key: login
                ports:
                  - containerPort: 3333
                  - containerPort: 37889
                volumeMounts:
                  - name: p2pool
                    mountPath: /home/p2pool
                  - name: tls
                    mountPath: /etc/letsencrypt
            volumes:
              - name: p2pool
                persistentVolumeClaim:
                  claimName: p2pool
              - name: tls
                secret:
                  secretName: tls

- name: monero service
  k8s:
    definition:
      apiVersion: v1
      kind: Service
      metadata:
        name: monerod
        namespace: monero
      spec:
        selector:
          app: monerod
        ports:
          - port: 18080
            name: p2p
          - port: 18081
            name: rpc
          - port: 18083
            name: zmq
        type: LoadBalancer

- name: p2pool service
  k8s:
    definition:
      apiVersion: v1
      kind: Service
      metadata:
        name: p2pool
        namespace: monero
      spec:
        selector:
          app: p2pool
        ports:
          - port: 3333
            name: mine
          - port: 37889
            name: p2poolp2p
        type: LoadBalancer