values.yaml

# Mining pool — public-pool or ckpool, as a hardened Deployment.
#
# Miners (Bitaxe, NerdQAxe, an S9…) speak Stratum. bitcoind does not: it only
# offers `getblocktemplate` over JSON-RPC. The pool is the piece that bridges the
# two, and it is the piece that builds the coinbase output — the transaction that
# pays out a block if you find one.
#
#   miner ──stratum:3333──> mining-pool ──RPC:8332 + ZMQ:28332──> bitcoin node
#
# In solo mining there is no operator cut and no shared payout: the coinbase pays
# the Bitcoin address the miner authenticates with, which is set on the miner as
# the stratum username, not here.

pool:
  # public-pool | ckpool
  #
  # public-pool  a NestJS stratum server with a stats API and a SQLite store.
  #              This is the one the org publishes a hardened, signed, SBOM'd
  #              image for, and the default.
  # ckpool       Con Kolivas' C stratum server. Smaller, faster, no database, no
  #              API. See pool.ckpool below before you choose it — there is no
  #              image you should trust yet, so you must supply one.
  implementation: public-pool

  # Shown to miners in the pool's stats. Cosmetic.
  identifier: "solo"

  # mainnet | testnet.
  #
  # This only selects which network's address format the pool decodes miner
  # usernames with — it does not select the chain. The chain comes from whatever
  # node you point it at. On a regtest or signet node use `testnet`, which shares
  # their address parameters. The umbrella chart derives this for you.
  network: mainnet

  # ── public-pool ─────────────────────────────────────────────────────────────
  publicPool:
    api:
      # public-pool EXITS AT STARTUP if API_PORT is unset. This is not optional.
      port: 3334
      secure: false
      # ClusterIP only. This is the JSON stats API the (separate) web UI reads —
      # it is not the miner-facing port, and there is no reason to expose it.
      service:
        type: ClusterIP

    # A dev-fee address diverts a share of a found block to someone else. Empty
    # means every satoshi of a found block goes to the miner. Think hard before
    # putting an address here, and be sure it is yours.
    devFeeAddress: ""

    # SQLite share + client-statistics store. No external database server.
    storage:
      enabled: true
      size: 5Gi
      storageClass: ""
      accessMode: ReadWriteOnce
      keepOnDelete: false

  # ── ckpool ──────────────────────────────────────────────────────────────────
  ckpool:
    # ckpool's upstream (Con Kolivas) publishes SOURCE ONLY — there is no official
    # container image, and every ckpool image on Docker Hub is an unaudited
    # personal build by an anonymous account. Since this process constructs the
    # coinbase output that pays out a found block, that is not a build to guess at.
    #
    # So this defaults to docked-titan-foundation's own hardened ckpool image:
    # built from a pinned upstream commit, non-root, cosign-signed, SBOM-attested,
    # exactly as the public-pool image is. Override it if you build your own.
    #
    # Do not reformat these three lines — Renovate's regex matches them.
    image:
      repository: ghcr.io/docked-titan-foundation/ckpool
      tag: "v1.1.0"
      digest: "sha256:b6632a7559326cc291e3863ed2ef79c82f6135e56c8d1ede361175dc89345cf7"

    # ckpool.conf, as data — rendered to JSON verbatim. Any ckpool option works
    # without touching the chart. `btcd`, `serverurl`, `zmqblock` and solo mode
    # are filled in from the bitcoin.* values; anything you set here merges over
    # them.
    config:
      mindiff: 1
      startdiff: 1000
      maxdiff: 0
      # Appears in the coinbase of any block this pool finds.
      btcsig: "/bitcoin-stack/"
      # Share of a solved block donated to ckpool's author. 0 = none. Upstream
      # suggests 0.5; this chart never sets it for you — a found block is yours
      # unless you choose otherwise here. ckpool is excellent software; if you run
      # it long-term, consider supporting the author.
      donation: 0

    # ckpool writes logs and its own state here.
    storage:
      enabled: true
      size: 1Gi
      storageClass: ""
      accessMode: ReadWriteOnce
      keepOnDelete: false

# ── Stratum (the port miners connect to) ───────────────────────────────────────
# Stratum is raw TCP, not HTTP, so it cannot be served through an HTTP Ingress —
# it needs its own address. LoadBalancer is the usual answer on a homelab (MetalLB
# assigns the IP); NodePort works too.
stratum:
  port: 3333
  maxConnectionsPerListener: 1000
  service:
    type: LoadBalancer
    loadBalancerIP: ""
    # Keeps the miner's source IP visible to the pool rather than showing every
    # miner as coming from a node IP.
    externalTrafficPolicy: Local
    annotations: {}

# ── Hostnames and certificates ─────────────────────────────────────────────────
# Off by default: every endpoint below starts with an empty `scopes` list, and an
# empty list means "not published". Nothing here renders until you opt in.
#
# HOW a name is published lives in `global.networking.scopes` — one map, shared
# by every chart in the release, so the domain and the issuers are written once.
# WHAT is published lives here, as a list of scope names per endpoint. Publishing
# something in two places at once is just a two-element list.
#
# Whether an endpoint gets an Ingress or only a DNS record is not a setting: it
# follows from the protocol. The stats API is HTTP and can terminate TLS behind
# an Ingress. Stratum is a raw TCP stream with no Host header and no SNI, so an
# ingress controller has nothing to route on — it gets a name pointing at its
# LoadBalancer address, and no certificate.
#
# The chart emits annotations. It does not install cert-manager or external-dns,
# and does not check that they are running.
networking:
  # The address miners are pointed at. This is the one that pays for itself: a
  # miner configured with stratum+tcp://stratum.example.com:3333 keeps working
  # when the LoadBalancer IP changes, and one configured with a bare IP does not.
  #
  # Requires stratum.service.type to be LoadBalancer or NodePort.
  stratum:
    scopes: []
    name: stratum
    # Override the derived hostname for one scope:
    #   hosts: {external: pool.example.net}
    hosts: {}

  # The public-pool JSON stats API. Read-only, and the thing you actually want
  # published when you are tempted to publish the node's RPC.
  #
  # public-pool only: ckpool has no HTTP surface, and asking for this under
  # ckpool is refused rather than rendering an Ingress onto a Service that does
  # not exist.
  api:
    scopes: []
    name: pool
    hosts: {}
    # Bring your own certificate instead of issuing one, per scope:
    #   tlsSecrets: {internal: my-existing-tls-secret}
    tlsSecrets: {}
    # Ingress class. Empty uses the cluster's default IngressClass.
    className: ""
    # Extra annotations, merged over the generated ones.
    annotations: {}

# ── Scopes: how a name gets published ──────────────────────────────────────────
# Under the umbrella chart this is set once at the top level and both subcharts
# read it. The defaults here exist so this chart also works installed on its own.
#
# `internal` and `external` are ordinary entries, not special names — rename
# them, drop one, or add a third.
global:
  networking:
    # The domain hostnames are derived from. Required once anything is published.
    baseDomain: ""

    scopes:
      # A name that resolves on the LAN only. Note that this does NOT imply a
      # self-signed certificate: an ACME issuer solving DNS-01 will issue a
      # publicly-trusted cert for a host that resolves nowhere on the internet,
      # because DNS-01 never connects to the endpoint.
      internal:
        subdomain: internal          # -> pool.internal.example.com
        issuer: ""                   # cert-manager issuer; empty = no cert issued
        issuerKind: ClusterIssuer    # ClusterIssuer | Issuer
        publishDns: false            # let external-dns create the record
        ttl: "300"
        annotations: {}              # provider extras, added to Ingresses only

      external:
        subdomain: ""                # -> pool.example.com
        issuer: ""
        issuerKind: ClusterIssuer
        publishDns: false
        ttl: "300"
        # Provider-specific options go here, e.g. for Cloudflare:
        #   external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
        annotations: {}

# ── Image (public-pool) ────────────────────────────────────────────────────────
# Pinned by digest. Do not reformat these three lines — Renovate's regex matches
# them.
image:
  repository: ghcr.io/docked-titan-foundation/public-pool
  tag: "v1.0.1"
  digest: "sha256:ac86fd2f7c9323db0616eee3bf4caaf533aa69c41b5fde8811569498c28edb0b"
  pullPolicy: IfNotPresent

# ── The Bitcoin node to mine on ────────────────────────────────────────────────
# The umbrella chart fills all of this in from the node subchart, so you never
# write it twice. Set it by hand only when running this chart standalone against
# a node that lives somewhere else.
bitcoin:
  rpc:
    # Empty + umbrella = derived. Empty + standalone = the chart refuses to render.
    host: ""
    port: 8332
    username: bitcoin
    timeoutMs: 10000
  zmq:
    host: ""
    rawBlockPort: 28332

  # Where the RPC password comes from. With the umbrella this is the node's own
  # Secret, so there is exactly one copy of the credential in the cluster.
  existingSecret:
    name: ""
    key: rpc-password

  # Hold the pool back until the node has finished initial block download.
  #
  # Until IBD completes, bitcoind's getblocktemplate returns "downloading
  # blocks", so the pool has no valid work to hand miners: ckpool can crash-loop
  # on it, and public-pool sits Running but serves dead work. With this on, the
  # pool pod waits in an Init container ("wait-for-node-sync") — an honest status
  # — and its main container starts only once the node reports synced.
  #
  # The pool recovers on its own without this once the node catches up; this
  # exists for a clean pod status, to stop days of crash-loop/error noise during
  # a legitimate sync, and to keep miners off a pool that cannot pay them. The
  # check uses whatever HTTP client the pool image ships (curl, wget, or node).
  #
  # Regtest is exempt automatically: it has no chain to sync and its lone genesis
  # block is ancient, so bitcoind reports initialblockdownload=true until a block
  # is mined — waiting on that would deadlock. The init container treats a regtest
  # node as ready immediately.
  waitForSync:
    enabled: true
    # Seconds between sync checks while the node catches up.
    intervalSeconds: 15
    # Give up after this many seconds — the Init container then restarts and
    # waits again. 0 = wait forever, the right default: a mainnet IBD legitimately
    # takes days, and waiting it out is exactly the point.
    timeoutSeconds: 0

# ── Resources ──────────────────────────────────────────────────────────────────
resources:
  requests:
    cpu: 100m
    memory: 256Mi
  limits:
    cpu: "2"
    memory: 1Gi

# ── Safety rails ───────────────────────────────────────────────────────────────
safety:
  # Refuse to render an image that is not pinned by digest.
  allowUnpinnedImage: false

# ── Hardening ──────────────────────────────────────────────────────────────────
# The public-pool image runs as uid 1000 (the `node` user).
podSecurityContext:
  runAsUser: 1000
  runAsGroup: 1000
  runAsNonRoot: true
  fsGroup: 1000
  seccompProfile:
    type: RuntimeDefault

containerSecurityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop:
      - ALL

serviceAccount:
  create: true
  name: ""
  automountServiceAccountToken: false

terminationGracePeriodSeconds: 60

nodeSelector: {}
tolerations: []
affinity: {}
podAnnotations: {}
podLabels: {}