Serve Let's Encrypt certificates for stratum TLS on public domains

startos/actions/config.ts

@@ -25,7 +25,7 @@ export const inputSpec = InputSpec.of({
   stratumTlsPort: Value.number({
     name: i18n('Stratum TLS Port'),
     description: i18n(
-      'Network port your miners connect to for TLS stratum. Only used when Stratum TLS is enabled below.',
+      'Network port your miners connect to for TLS stratum — both for the local self-signed certificate and for any public domain attached to the Stratum (TLS) interface.',
     ),
     required: true,
     default: defaultStratumTlsPort,
@@ -49,10 +49,14 @@ export const inputSpec = InputSpec.of({
     ),
     default: true,
   }),
+  // Storage key stays `tlsEnabled` so existing installs keep their setting;
+  // only the scope it describes narrowed. TLS over a public domain is not
+  // covered by this toggle — it follows the domains attached to the Stratum
+  // (TLS) interface and needs no configuration here.
   tlsEnabled: Value.toggle({
-    name: i18n('Stratum TLS'),
+    name: i18n('Stratum TLS (Local Network)'),
     description: i18n(
-      'Accept stratum connections over TLS via an stunnel sidecar on a second port. A self-signed certificate is generated once and persisted — miners must trust the certificate (see the Stratum TLS Certificate action) or connect with verification disabled.',
+      'Serve the self-signed certificate on the TLS stratum port, for miners on your local network. Miners have to trust it (see the Stratum TLS Certificate action) or connect with verification disabled. You do NOT need this for miners connecting over a public domain: attach the domain to the Stratum (TLS) interface and StartOS issues a publicly trusted certificate automatically.',
     ),
     default: false,
   }),
@@ -147,7 +151,6 @@ export const config = sdk.Action.withInput(
     const conflict = validatePorts({
       stratumPort: input.stratumPort,
       stratumTlsPort: input.stratumTlsPort,
-      tlsEnabled: input.tlsEnabled,
     })
     if (conflict) throw new Error(conflict)