8d0c9f8023
* docs: update systemd example for the serve CLI with required node auth The unit and readme still described the old HTTP-API miner (MINER_PORT, MINER_ENGINE, no subcommand). Update ExecStart to 'serve' and document the now-required MINER_AUTH_TOKEN_FILE / MINER_TLS_CERT_SHA256_FILE, including how to copy the node's miner-auth-token and miner-tls-cert-sha256 files past ProtectHome=true, and refresh the env var reference to the current CLI. * docs: fix env-file example and CPU-worker claims per review - Move inline comments off the env assignments: systemd EnvironmentFile= keeps inline '# ...' text as part of the value, so the copied example fed Clap unparseable values and the unit crash-looped under Restart=always. - Describe the real worker behavior: CPUs are counted via the process affinity mask (num_cpus); unset MINER_CPU_WORKERS auto-detects ~50%, and an explicit value is used as-is — there is no clamp or warning. - Drop the 'logs the detected cpuset mask' claim from the unit and override comments; no such logging exists in the miner. * docs: metrics exporter is always on; purge-chain does not rotate credentials - The Prometheus exporter starts unconditionally and binds plaintext HTTP on 0.0.0.0:9900 by default; MINER_METRICS_PORT only changes the port. Say so everywhere instead of 'when metrics are enabled', and add a hardening note to firewall the port. - Rephrase the credential-rotation pitfall: purge-chain removes only the database, so the node reloads the same miner-auth-token and TLS cert; rotation only happens when the base path changes or the files themselves are deleted.
104 lines
3.7 KiB
Desktop File
104 lines
3.7 KiB
Desktop File
# Quantus External Miner - systemd unit
|
|
#
|
|
# Install:
|
|
# - Place this file at: /etc/systemd/system/quantus-miner.service
|
|
# - Optional environment file:
|
|
# * /etc/default/quantus-miner (Debian/Ubuntu)
|
|
# * /etc/sysconfig/quantus-miner (RHEL/CentOS/Fedora)
|
|
# - Optional overrides (recommended for CPU affinity/scheduling):
|
|
# * Create drop-ins in: /etc/systemd/system/quantus-miner.service.d/*.conf
|
|
# See examples in: examples/systemd/overrides/
|
|
#
|
|
# Usage:
|
|
# sudo systemctl daemon-reload
|
|
# sudo systemctl enable --now quantus-miner.service
|
|
#
|
|
# Notes:
|
|
# - The miner CLI supports environment variables for all flags (see README):
|
|
# MINER_NODE_ADDR, MINER_AUTH_TOKEN_FILE (or MINER_AUTH_TOKEN),
|
|
# MINER_TLS_CERT_SHA256_FILE (or MINER_TLS_CERT_SHA256),
|
|
# MINER_CPU_WORKERS, MINER_GPU_DEVICES, MINER_GPU_BATCH_SIZE,
|
|
# MINER_CPU_BATCH_SIZE, MINER_GPU_THROTTLE_MS, MINER_METRICS_PORT,
|
|
# MINER_ALLOW_INTEGRATED, MINER_VERBOSE.
|
|
# This unit relies on those env vars (set in /etc/default|/etc/sysconfig) so
|
|
# ExecStart can remain stable and simple.
|
|
# - The node requires miner auth: MINER_AUTH_TOKEN_FILE and
|
|
# MINER_TLS_CERT_SHA256_FILE (or their inline variants) are mandatory —
|
|
# the miner exits at startup without them. Copy the node's
|
|
# miner-auth-token and miner-tls-cert-sha256 files somewhere this service
|
|
# can read (e.g. /etc/quantus-miner/): ProtectHome=true below blocks
|
|
# paths under /home and /root, where the node's base path usually lives.
|
|
# - The miner counts CPUs via the process affinity mask (so CPUAffinity=
|
|
# is respected) and emits a miner_effective_cpus metric.
|
|
# - The Prometheus exporter is ALWAYS on and binds plaintext HTTP on
|
|
# 0.0.0.0:9900 by default; MINER_METRICS_PORT only changes the port.
|
|
# Firewall the port if the host is reachable from untrusted networks.
|
|
|
|
[Unit]
|
|
Description=Quantus External Miner Service
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
Documentation=https://github.com/Quantus-Network/quantus-miner
|
|
|
|
[Service]
|
|
Type=simple
|
|
|
|
# Run under a dedicated service account (create if it does not exist).
|
|
# sudo useradd --system --no-create-home --shell /usr/sbin/nologin quantus
|
|
User=quantus
|
|
Group=quantus
|
|
|
|
# State directory (auto-created by systemd with correct permissions)
|
|
StateDirectory=quantus-miner
|
|
WorkingDirectory=/var/lib/quantus-miner
|
|
|
|
# Load environment from distro-specific location if present.
|
|
# Debian/Ubuntu:
|
|
EnvironmentFile=-/etc/default/quantus-miner
|
|
# RHEL/CentOS/Fedora:
|
|
EnvironmentFile=-/etc/sysconfig/quantus-miner
|
|
|
|
# Default logging level (can be overridden in env files)
|
|
Environment=RUST_LOG=info
|
|
|
|
# Launch the miner. All configuration should be passed via environment vars
|
|
# (preferred) or via EXTRA_MINER_FLAGS in the env file for additional arguments.
|
|
# MINER_AUTH_TOKEN_FILE and MINER_TLS_CERT_SHA256_FILE must be set in the env
|
|
# file (see readme.md) or the miner exits immediately.
|
|
ExecStart=/usr/local/bin/quantus-miner serve $EXTRA_MINER_FLAGS
|
|
|
|
# Graceful shutdown and restart behavior
|
|
Restart=always
|
|
RestartSec=2s
|
|
TimeoutStopSec=30s
|
|
KillSignal=SIGINT
|
|
StartLimitIntervalSec=0
|
|
|
|
# Journald logging
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
|
|
# Security hardening (relaxed enough to allow network + file access)
|
|
NoNewPrivileges=true
|
|
ProtectSystem=full
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
RestrictNamespaces=true
|
|
LockPersonality=true
|
|
RestrictSUIDSGID=true
|
|
SystemCallFilter=@system-service
|
|
|
|
# Resource controls (tune via drop-in overrides for your environment)
|
|
# These are commented here; see examples/systemd/overrides for presets.
|
|
# Nice=-5
|
|
# IOSchedulingClass=best-effort
|
|
# IOSchedulingPriority=2
|
|
# CPUAffinity=0 2 4 6
|
|
# CPUSchedulingPolicy=other
|
|
# CPUWeight=90
|
|
# MemoryMax=infinity
|
|
# TasksMax=infinity
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|