satoshi
d9f17ff181
Miner firmware typically verifies the TLS server cert against the hostname it was pointed at. Bitaxe (AxeOS) uses mbedtls and the logs showed mbedtls_ssl_handshake returning -0x2700 (MBEDTLS_ERR_X509_CERT_VERIFY_FAILED) when connecting to obese-admirer.local:3338 — our cert's SAN only had kamado-pool.embassy / kamado-pool / localhost / 127.0.0.1, none of which match an arbitrary mDNS host. Add leftmost-label wildcards for the TLDs miners typically reach the pool through: *.local (mDNS / Bonjour, e.g. obese-admirer.local) *.embassy (StartOS inter-service hostnames) *.onion (Tor hidden services) *.home.arpa (RFC 8375 home network namespace) *.lan (common consumer router default) *.internal (some corporate / LAN setups) OpenSSL's own X509_check_host refuses these 2-label wildcards as a public-suffix safeguard, but mbedtls accepts them (its wildcard check is RFC 2818 verbatim — just requires *.X where X is any non-empty label), so miners using mbedtls-based stacks (ESP-IDF, most embedded firmwares) will now match. Bump TLS_CERT_VERSION to 4 so existing installs self-regenerate.
Kamado Pool — StartOS Packaging
StartOS 0.3.5.1 wrapper for Kamado Pool, a modern solo Bitcoin mining pool built on a patched fork of CKPool-solo with a Go middleware API and Svelte real-time dashboard.
Build
make
This runs deno to bundle the embassy TypeScript procedures, builds a multi-arch OCI image via docker buildx, and packs everything into kamado-pool.s9pk using start-sdk.
The build pulls KamadoPool source from a local sibling checkout (../KamadoPool by default) via a docker buildx named build context — no GitHub clone, no pinned SHA. If your checkout lives elsewhere, override it:
make KAMADO_SRC=/path/to/KamadoPool
Install
make install
License
GPL-3.0 — matches upstream Kamado and CKPool.