satoshi/KamadoPool-StartOS-0351
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add optional stratum TLS via stunnel sidecar

Browse Source 
New 'tls' union config (disabled by default) spins up an
stunnel4 process inside the container that terminates TLS on
a configurable port (3334 by default) and forwards decrypted
stratum traffic to 127.0.0.1:${STRATUM_PORT}.

Cert is self-signed, generated once on first start with a
10-year validity and persisted at /root/.kamado/tls/ so the
fingerprint stays stable across restarts. SHA-256 fingerprint
is printed to container logs on each startup so users can
pin it on their miners. Miners must connect with
verification disabled (no CA trust chain for a private pool).

Runtime image grows by ~3MB for stunnel4 + openssl. The
supervisor loop now waits on three PIDs and tears all of them
down together if any one exits.
This commit is contained in:
satoshi
2026-04-14 11:21:45 +03:00
parent 74387b8c45
commit cb739867cc
4 changed files with 85 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
instructions.md
+5 -1
View File
@@ -11,7 +11,11 @@ Kamado is a solo Bitcoin mining pool built on a patched fork of CKPool-solo, wit
## Connecting miners
Kamado's stratum server listens on TCP port **3333** inside the container. **StartOS 0.3.x does not forward raw TCP ports on the LAN interface**, so you have two options to reach stratum from miners on your local network:
Kamado's plaintext stratum server listens on TCP port **3333** inside the container (configurable). If you enable **Stratum TLS** in the config, an stunnel sidecar also terminates TLS on port **3334** (configurable) and forwards the decrypted traffic to the plaintext stratum locally. The TLS certificate is generated once on first start and persisted at `/root/.kamado/tls/stratum.crt` — the SHA-256 fingerprint is printed to the container logs so you can pin it on your miners.
Because the cert is self-signed, miners must connect with certificate verification disabled (`stratum+ssl://`, plus whatever skip-verify / insecure flag your firmware exposes).
**StartOS 0.3.x does not forward raw TCP ports on the LAN interface**, so you have two options to reach stratum — plaintext or TLS — from miners on your local network:
- **Router port-forward**: Forward an external port on your router directly to your StartOS server's LAN IP on port 3333 and point miners at that.
- **simpleproxy on a second host**: Run `simpleproxy -L 3333 -R <startos-lan-ip>:3333` on any always-on LAN host and point miners at that host.