Reach monerod inside the cluster

Shkeeper's Monero module talks to monerod over plain HTTP only. Point it at
the in-cluster Service so that traffic never leaves the cluster; monerod's
RPC now accepts plain HTTP alongside HTTPS (ansible-role-monero).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/main.yml

@@ -24,20 +24,26 @@
     release_namespace: kubernetes-secret-generator
     create_namespace: true
 
+- name: namespace  
+  kubernetes.core.k8s:    
+    api_version: v1    
+    kind: Namespace    
+    name: shkeeper    
+    state: present
+
 - name: deploy
   kubernetes.core.helm:
     name: shkeeper
     chart_ref: vsys-host/shkeeper
     release_namespace: shkeeper
-    create_namespace: true
+    create_namespace: false
     values:
-      namespace: shkeeper
       external_ip: 0.0.0.0
       domain: "shkeeper.eom.dev"
       additional_domains: []
       dev:
         imagePullSecrets:
-      storageClassName:
+      storageClassName: r720-nfs-client
       shkeeper:
         image: vsyshost/shkeeper:2.5.28
         port: 5000
@@ -96,23 +102,25 @@
       trx:
         enabled: false
       usdt:
-        enabled: false
+        enabled: true
       usdc:
         enabled: false
       unified_evm_image: vsyshost/evm-shkeeper:1.1.1
       eth_fullnode:
         enabled: false
-        url: http://ethereum:8545
+        url: https://fullnode.ethereum.shkeeper.io:8645
         mainnet: true
         nodeSelector: {}
         tolerations: []
-      ethereum_shkeeper: {}
+      ethereum_shkeeper:
+        extraEnv:
+          LAST_BLOCK_LOCKED: "FALSE"
       eth:
-        enabled: false
+        enabled: true
       eth_usdt:
-        enabled: false
+        enabled: true
       eth_usdc:
-        enabled: false
+        enabled: true
       eth_pyusd:
         enabled: false
       eth_dai:
@@ -122,12 +130,13 @@
         image: vsyshost/monero:v0.18.1.2
         mainnet: true
         fullnode:
-          enabled: true
+          enabled: false
           monerod:
-            host: "monerod.eom.dev"
+            # In-cluster: Shkeeper uses plain HTTP to monerod, so keep it off the network.
-            port: "1111"
+            host: "monerod.monero.svc.cluster.local"
-            user: "monerod"
+            port: "18081"
-            password: "monerod"
+            user: "{{ monerod_user }}"
+            password: "{{ monerod_password }}"
             nodeSelector: {}
             tolerations: []
       bnb_fullnode:
@@ -299,12 +308,14 @@
           - web
           - websecure
         routes:
-          - match: Host(`shkeeper.eom.dev`)
+          - match: "Host(`shkeeper.eom.dev`)"
             kind: Rule
             services:
               - name: shkeeper
                 port: 5000
                 namespace: shkeeper
         tls:
-          secretName: shkeeper-cert
+          - hosts:
+              - shkeeper.eom.dev
+            secretName: shkeeper-cert