* docs: update systemd example for the serve CLI with required node auth
The unit and readme still described the old HTTP-API miner (MINER_PORT,
MINER_ENGINE, no subcommand). Update ExecStart to 'serve' and document the
now-required MINER_AUTH_TOKEN_FILE / MINER_TLS_CERT_SHA256_FILE, including
how to copy the node's miner-auth-token and miner-tls-cert-sha256 files
past ProtectHome=true, and refresh the env var reference to the current
CLI.
* docs: fix env-file example and CPU-worker claims per review
- Move inline comments off the env assignments: systemd EnvironmentFile=
keeps inline '# ...' text as part of the value, so the copied example fed
Clap unparseable values and the unit crash-looped under Restart=always.
- Describe the real worker behavior: CPUs are counted via the process
affinity mask (num_cpus); unset MINER_CPU_WORKERS auto-detects ~50%, and
an explicit value is used as-is — there is no clamp or warning.
- Drop the 'logs the detected cpuset mask' claim from the unit and override
comments; no such logging exists in the miner.
* docs: metrics exporter is always on; purge-chain does not rotate credentials
- The Prometheus exporter starts unconditionally and binds plaintext HTTP on
0.0.0.0:9900 by default; MINER_METRICS_PORT only changes the port. Say so
everywhere instead of 'when metrics are enabled', and add a hardening note
to firewall the port.
- Rephrase the credential-rotation pitfall: purge-chain removes only the
database, so the node reloads the same miner-auth-token and TLS cert;
rotation only happens when the base path changes or the files themselves
are deleted.
8d0c9f8023