luke/bitcoin-ansible-roles, branch mainAnsible roles for Bitcoin and Lightning Network node
https://src.nth.io/luke/bitcoin-ansible-roles/atom?h=main2026-07-31T19:30:30Zlnurld/build: use unversioned golang-go2026-07-31T19:30:30ZLuke Hoerstenluke@hoersten.org2026-07-31T19:30:30Zurn:sha1:4a881bd72dceb1d595b5f73554f466bc4540c739
The pinned golang-1.21-go was a noble leftover; the hand symlink
shadowed the real go on 26.04.
lnd: verify release tarballs against pinned sha256s2026-07-31T19:30:30ZLuke Hoerstenluke@hoersten.org2026-07-31T19:30:30Zurn:sha1:9082f4e78d3d948b38d6030564ea82056168165d
lnd sums come from the signed release manifest. lndconnect publishes
no checksums, so its pin is the tarball hash cross-checked against the
binary in production since 2020.
bitcoind: verify the release tarball against a pinned sha2562026-07-31T19:30:29ZLuke Hoerstenluke@hoersten.org2026-07-31T19:30:29Zurn:sha1:960d14f9f2af1990dac0ae887c150d8a9ea00dce
Pinned per arch from the official SHA256SUMS; download and unarchive
are split so nothing extracts unless the tarball matches. Update the
pins when bumping bitcoind_version.
bitcoind-prometheus-exporter: grant read access to bitcoin.conf2026-07-30T23:19:43ZLuke Hoerstenluke@hoersten.org2026-07-30T23:19:43Zurn:sha1:81809160f41aed1161070148d8cf60a1ed24a6f3
The exporter reads rpc credentials from bitcoin.conf but the bitcoind
role writes it 0600 bitcoin:bitcoin, so the prometheus user could
never read it (only long-lived processes predating the tightened mode
kept working). Make the conf group-readable and add prometheus to the
bitcoin group.
bitcoind: harden the service unit for boot and shutdown2026-07-30T23:19:43ZLuke Hoerstenluke@hoersten.org2026-07-30T23:19:43Zurn:sha1:4d15c92944280312d47198d6861918b3316784bf
- order after network-online: rpcbind fails with getaddrinfo errors
when bitcoind starts before addresses are configured
- restart on failure so a transient bad start heals itself
- 30min stop timeout: the chainstate flush can far exceed systemd's
90s default, and a SIGKILL there risks a slow replay or a reindex
lnurld/build: create build_work_dir and redirect Go caches2026-07-26T21:46:21ZLuke Hoerstenluke@hoersten.org2026-07-26T21:46:21Zurn:sha1:f0d085279b2b5310c6f175d01f0d20afdad85e0e
Create the work dir and set GOPATH/GOCACHE/GOMODCACHE on the build task, so the
role is self-contained rather than relying on the playbook's environment.
lnurld/build: force a real tarball for the single-file artifact2026-07-26T21:31:56ZLuke Hoerstenluke@hoersten.org2026-07-26T21:31:56Zurn:sha1:45f9acddf48de0e6e1e05aaf4a37e77552c5324c
community.general.archive (>=10) compresses a lone file into a bare .gz instead
of a tarball, which the server can't unarchive. Set force_archive: true.
lnurld/build: stage checkout under build_work_dir instead of /tmp2026-07-26T21:05:40ZLuke Hoerstenluke@hoersten.org2026-07-26T21:05:40Zurn:sha1:a7ea89331b44f506e1d0d617065b3faaff06ebd8bitcoind: bump to 31.02026-07-21T00:01:32ZLuke Hoerstenluke@hoersten.org2026-07-21T00:01:32Zurn:sha1:f7ac758286927494d8238a28702b85386a80478eBind lnd restlisten to LAN interface instead of loopback2026-05-26T12:29:24ZLuke Hoerstenluke@hoersten.org2026-05-26T12:29:24Zurn:sha1:272788e6107e8353b7b21a3a8363be9e8ac62541
Nginx reverse proxy on btc.nth.io runs on a separate host from lnd,
so 127.0.0.1 binding broke cross-host proxying (502 Bad Gateway).
Bind to default_ipv4 to keep REST off other interfaces while still
reachable from the proxy host.