satoshi/KamadoPool-StartOS-040
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Serve Let's Encrypt certificates for stratum TLS on public domains

Browse Source
This commit is contained in:
satoshi
2026-08-01 06:31:15 +03:00
parent 703ca1b559
commit f118c153a0
11 changed files with 369 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+4 -2
View File
@@ -20,7 +20,9 @@ This is the 0.4.0 port of the [0.3.5.1 wrapper](../KamadoPool-StartOS-0351), reb
| compat migrations | `VersionGraph` with an `up` migration that converts a 0.3.5.1 `config.yaml` into `store.json` and preserves the SQLite DB, TLS cert, and ckpool state |
| — | i18n (en, es, de, pl, fr) for all user-facing strings |
Retained behavior: the ckpool restart loop gated on bitcoind reachability (now a daemon wrapper script), dual block-detection (ZMQ + 100 ms blockpoll), the loopback second stratum bind for TLS tagging (`server == 1` → lock icon), the v4 self-signed certificate with broad SANs, and ckpool loglevel 6 with `--log-shares`.
Retained behavior: the ckpool restart loop gated on bitcoind reachability (now a daemon wrapper script), dual block-detection (ZMQ + 100 ms blockpoll), loopback stratum binds for TLS tagging (now one per certificate, declared to kamado-api via `STRATUM_SERVERS` so the dashboard names the certificate on hover), the v4 self-signed certificate with broad SANs, and ckpool loglevel 6 with `--log-shares`.
Stratum TLS serves **two** certificates on one port, selected per connection by SNI: a Let's Encrypt certificate for any clearnet domain attached to the Stratum (TLS) interface (fetched with `getSslCertificate`, no config field — the attached domains *are* the setting), and the self-signed certificate as the default for LAN miners, which send no SNI and fall through to it. The TLS interface binds unconditionally so a domain can be attached without first enabling local TLS.
## Prerequisites
@@ -75,7 +77,7 @@ make KAMADO_SRC=/path/to/KamadoPool
startos/
manifest/ id, images (local Dockerfile build), volumes, bitcoind dependency
main.ts subcontainer, ckpool.conf + stunnel.conf rendering, daemons + health checks (fixed internal ports)
interfaces.ts Web UI (http 8080), Stratum (raw TCP, configurable), Stratum TLS (raw TCP, configurable + conditional)
interfaces.ts Web UI (http 8080), Stratum (raw TCP, configurable), Stratum TLS (raw TCP, configurable; always bound so domains can attach)
fileModels/ store.json (service settings, incl. stratum ports)
actions/ Configure, Pool Status, Stratum TLS Certificate, Regenerate TLS Certificate, Reset Block Latency
dependencies.ts bitcoind (running, synced) + ZMQ autoconfig task