Expose config options for cleartext stratum port

2026-08-01 06:31:15 +03:00
commit a2ae800a19
36 changed files with 4585 additions and 0 deletions
@@ -0,0 +1,96 @@
+import { readFile } from 'node:fs/promises'
+import { storeJson } from '../fileModels/store.json'
+import { i18n } from '../i18n'
+import { sdk } from '../sdk'
+import { defaultStratumTlsPort } from '../utils'
+
+/**
+ * 0.4.0 replacement for the 0.3.x "properties" that published the stratum
+ * TLS fingerprint and full PEM. Miners whose firmware verifies against a CA
+ * bundle (AxeOS / Bitaxe) need the PEM pasted in as a custom root, or the
+ * SHA-256 fingerprint pinned, depending on what the firmware exposes.
+ */
+export const showTlsCert = sdk.Action.withoutInput(
+  // id
+  'show-tls-cert',
+
+  // metadata
+  async ({ effects }) => ({
+    name: i18n('Stratum TLS Certificate'),
+    description: i18n(
+      'Shows the self-signed stratum TLS certificate: SHA-256 fingerprint for pinning and the full PEM to paste into miner firmware (e.g. the AxeOS "Stratum SSL Cert" field).',
+    ),
+    warning: null,
+    allowedStatuses: 'any',
+    group: null,
+    visibility: (await storeJson.read((s) => s.tlsEnabled).const(effects))
+      ? 'enabled'
+      : { disabled: i18n('Enable Stratum TLS in Configure first') },
+  }),
+
+  // the execution function
+  async ({ effects }) => {
+    const tlsPort =
+      (await storeJson.read((s) => s.stratumTlsPort).once()) ??
+      defaultStratumTlsPort
+    const notYet = i18n('(not yet generated — start the service once)')
+    const fingerprint = await readFile(
+      sdk.volumes.main.subpath('tls/fingerprint.txt'),
+      'utf-8',
+    )
+      .then((s) => s.trim())
+      .catch(() => notYet)
+    const certPem = await readFile(
+      sdk.volumes.main.subpath('tls/stratum.crt'),
+      'utf-8',
+    )
+      .then((s) => s.trim())
+      .catch(() => notYet)
+
+    return {
+      version: '1',
+      title: i18n('Stratum TLS Certificate'),
+      message: i18n(
+        'Connect miners with stratum+ssl:// to the Stratum (TLS) interface. The certificate is self-signed: paste the PEM into firmware that accepts a custom root, pin the fingerprint, or disable verification.',
+      ),
+      result: {
+        type: 'group',
+        value: [
+          {
+            name: i18n('TLS Port (internal)'),
+            description: i18n(
+              'Container-side TLS stratum port. The externally reachable port is shown on the Stratum (TLS) interface.',
+            ),
+            type: 'single',
+            value: String(tlsPort),
+            copyable: true,
+            qr: false,
+            masked: false,
+          },
+          {
+            name: i18n('Fingerprint (SHA-256)'),
+            description: i18n(
+              'Use this for fingerprint pinning on miner firmwares that support it. Changes only when the certificate is regenerated.',
+            ),
+            type: 'single',
+            value: fingerprint,
+            copyable: true,
+            qr: false,
+            masked: false,
+          },
+          {
+            name: i18n('Certificate (PEM)'),
+            description: i18n(
+              'Full self-signed certificate. Copy the whole block including the BEGIN/END CERTIFICATE markers.',
+            ),
+            type: 'single',
+            value: certPem,
+            copyable: true,
+            qr: false,
+            masked: false,
+          },
+        ],
+      },
+    }
+  },
+)