Show domains in pool status

startos/interfaces.ts

@@ -2,10 +2,13 @@ import { storeJson } from './fileModels/store.json'
 import { i18n } from './i18n'
 import { sdk } from './sdk'
 import {
+  ckpoolPublicTlsPort,
   defaultStratumPort,
+  defaultStratumPublicTlsPort,
   defaultStratumTlsPort,
   stratumHostId,
   stratumInternalPort,
+  stratumPublicTlsHostId,
   stratumTlsHostId,
   stratumTlsInternalPort,
   uiHostId,
@@ -25,11 +28,13 @@ export const setInterfaces = sdk.setupInterfaces(async ({ effects }) => {
     .read((s) => ({
       stratum: s.stratumPort,
       stratumTls: s.stratumTlsPort,
+      publicTls: s.stratumPublicTlsPort,
     }))
     .const(effects)
 
   const externalStratumPort = ports?.stratum ?? defaultStratumPort
   const externalStratumTlsPort = ports?.stratumTls ?? defaultStratumTlsPort
+  const externalPublicTlsPort = ports?.publicTls ?? defaultStratumPublicTlsPort
 
   // Web dashboard
   const uiMulti = sdk.MultiHost.of(effects, uiHostId)
@@ -97,10 +102,10 @@ export const setInterfaces = sdk.setupInterfaces(async ({ effects }) => {
     secure: { ssl: false },
   })
   const stratumTls = sdk.createInterface(effects, {
-    name: i18n('Stratum (TLS)'),
+    name: i18n('Stratum (TLS, Local Network)'),
     id: 'stratum-tls',
     description: i18n(
-      'TLS-encrypted stratum endpoint. Miners on a public domain attached here get a CA-issued certificate automatically; on the local network the self-signed certificate is used (see the Stratum TLS Certificate action)',
+      'TLS-encrypted stratum endpoint for miners on your local network, using the self-signed certificate (see the Stratum TLS Certificate action). Do not attach a public domain here — StartOS cannot issue a certificate for this endpoint; use Stratum (TLS, Public Domain) instead',
     ),
     type: 'api',
     masked: false,
@@ -111,8 +116,48 @@ export const setInterfaces = sdk.setupInterfaces(async ({ effects }) => {
   })
   receipts.push(await tlsOrigin.export([stratumTls]))
 
-  // Drop bindings we no longer use. With fixed internal ports and an
-  // unconditional TLS binding, all three are now permanent — this only
+  // TLS stratum over a public domain — terminated by StartOS, not by us.
+  //
+  // This is the only way to get a publicly-trusted certificate: StartOS
+  // provisions ACME certificates solely for bindings it terminates TLS for,
+  // so a raw TCP binding (the two above) is offered no certificate authority
+  // at all when you attach a domain to it — no Let's Encrypt, not even the
+  // StartOS root CA. Declaring `addSsl` hands the OS the TLS layer, which is
+  // what makes the LE option appear in the domain dialog.
+  //
+  // `secure: null` keeps this endpoint TLS-only: the OS publishes the SSL
+  // port and does not also expose the decrypted one. It forwards plaintext
+  // over the LXC bridge into ckpool's third bind, whose serverurl index is
+  // what tells the dashboard this miner arrived on a CA-issued certificate.
+  const publicTlsMulti = sdk.MultiHost.of(effects, stratumPublicTlsHostId)
+  const publicTlsOrigin = await publicTlsMulti.bindPort(ckpoolPublicTlsPort, {
+    protocol: null,
+    preferredExternalPort: ckpoolPublicTlsPort,
+    addSsl: {
+      preferredExternalPort: externalPublicTlsPort,
+      alpn: null,
+      addXForwardedHeaders: false,
+      auth: null,
+    },
+    secure: null,
+  })
+  const stratumPublicTls = sdk.createInterface(effects, {
+    name: i18n('Stratum (TLS, Public Domain)'),
+    id: 'stratum-tls-public',
+    description: i18n(
+      'TLS-encrypted stratum endpoint for miners connecting over the internet. Attach a domain here and StartOS issues a Let’s Encrypt certificate for it, which any miner validates with nothing pasted in',
+    ),
+    type: 'api',
+    masked: false,
+    schemeOverride: { ssl: 'stratum+ssl', noSsl: 'stratum+ssl' },
+    username: null,
+    path: '',
+    query: {},
+  })
+  receipts.push(await publicTlsOrigin.export([stratumPublicTls]))
+
+  // Drop bindings we no longer use. With fixed internal ports and
+  // unconditional TLS bindings, all four are now permanent — this only
   // clears orphans left by older versions of this package, which did move the
   // internal port and did drop the TLS binding when the toggle was off.
   await sdk.clearBindings(effects, {
@@ -120,6 +165,7 @@ export const setInterfaces = sdk.setupInterfaces(async ({ effects }) => {
       { id: uiHostId, internalPort: uiPort },
       { id: stratumHostId, internalPort: stratumInternalPort },
       { id: stratumTlsHostId, internalPort: stratumTlsInternalPort },
+      { id: stratumPublicTlsHostId, internalPort: ckpoolPublicTlsPort },
     ],
   })
 
@@ -128,7 +174,7 @@ export const setInterfaces = sdk.setupInterfaces(async ({ effects }) => {
   // leaves an orphaned interface record behind, which the UI still lists — so
   // a port change can produce two identical "Stratum" rows.
   await effects.clearServiceInterfaces({
-    except: ['ui', 'stratum', 'stratum-tls'],
+    except: ['ui', 'stratum', 'stratum-tls', 'stratum-tls-public'],
   })
 
   return receipts