satoshi
1fccebef01
Old cert was /CN=kamado-pool-stratum with no SAN extension. Strict TLS clients (Go, Rust, mbedtls, most modern miner firmwares) treat missing SAN as a hard validation failure and send TLS alert 42 (bad_certificate), which is exactly what we saw in the stunnel logs: "SSL_accept: ... error:0A000412: ... sslv3 alert bad certificate". Generate the cert with subjectAltName covering kamado-pool.embassy, localhost, and 127.0.0.1, and an explicit extendedKeyUsage=serverAuth. Swap the combined PEM so the cert comes before the key (convention). Upgrades auto-heal: if an existing cert lacks SAN, the entrypoint regenerates it on next start — the fingerprint changes and the user needs to re-pin on their miner, but the previous cert couldn't complete a handshake anyway so there's nothing to lose. Also make stunnel's intent explicit with verify=0 so anyone reading the config knows we're doing opportunistic TLS, not client-cert auth; miner auth is the stratum layer's job.
Kamado Pool — StartOS Packaging
StartOS 0.3.5.1 wrapper for Kamado Pool, a modern solo Bitcoin mining pool built on a patched fork of CKPool-solo with a Go middleware API and Svelte real-time dashboard.
Build
make
This runs deno to bundle the embassy TypeScript procedures, builds a multi-arch OCI image via docker buildx, and packs everything into kamado-pool.s9pk using start-sdk.
The build pulls KamadoPool source from a local sibling checkout (../KamadoPool by default) via a docker buildx named build context — no GitHub clone, no pinned SHA. If your checkout lives elsewhere, override it:
make KAMADO_SRC=/path/to/KamadoPool
Install
make install
License
GPL-3.0 — matches upstream Kamado and CKPool.