Files
miner/deploy
rob thijssen 7ac9608b3d
Some checks failed
ci / fmt (pull_request) Successful in 26s
ci / doc (pull_request) Successful in 2m25s
ci / test (pull_request) Successful in 7m33s
ci / clippy (pull_request) Failing after 12m11s
deploy: beast joins the miner fleet for mainnet
Mainnet call 2026-09-09: beast's two RTX 5090s mine alongside benjy and
quadbrat; neuron (cortex inference) is disabled on all three hosts. The
node's miners list and lair/quantus's SCRAPE_MINERS gain beast in the
lair/quantus counterpart.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CBgs2nSi4H2mdh8kD8vMX5
2026-09-09 09:14:32 +03:00
..

deploy

Everything the CI deploy of the miner ships or needs (.gitea/workflows/deploy.yaml). Moved from lair/quantus on 2026-09-03 so that one repo owns the deployed miner; the fleet's monitoring, GPU power limits and nvidia metrics stay there.

File Lands at
quantus-miner.service /etc/systemd/system/quantus-miner.service
quantus-miner.sysusers.conf /etc/sysusers.d/quantus-miner.conf
quantus-miner-metrics.xml /etc/firewalld/services/quantus-miner-metrics.xml
miner.env.tmpl rendered to /etc/quantus-miner/miner.env
infra-setup.sh operator-run once per host; installs the gitea_ci sudoers

The miner's credentials are generated by the node and copied host-to-host by the deploy on every run. Nothing secret lives here.

Traps, all previously hit

  • Adding a file or privileged command means re-running infra-setup.sh. The deploy preflights the host's sudo -n -l against the script's SUDO block and names the missing paths, instead of failing partway with sudo: a password is required.
  • Deploys must be no-ops when nothing changed. push() uses rsync -ic (checksum). The artifact is rebuilt every run so mtimes always differ. Restart only on an itemised content change.
  • --node-addr takes an IP, not a name. It parses as a Rust SocketAddr with no DNS. The deploy resolves the node on the miner host and renders the literal; the 10.x never enters the repo.
  • Pipes in validate steps. The shell is bash -e -o pipefail; a reader that exits early (awk ... exit, grep -q, head) SIGPIPEs the writer, exit 141. Capture into a variable and parse with a here-string.
  • ssh argument quoting. run() is ssh ... "$@" and the remote shell re-splits; any argument with a space is passed as one pre-quoted string.
  • PrivateDevices=false in the unit is deliberate: the miner needs /dev/nvidia*.
  • systemctl is-active is not evidence of mining. A miner that found no adapter, or never got a job, is active. Validate asserts miner_hashes_total advances and miner_gpu_devices matches the matrix.
  • Binaries must be built on cuda-13.0 (Fedora 43, like the hosts). The rust runner is Fedora 44; its binaries fail with GLIBC_2.43 not found.
  • A benchmark (bench.yaml) stops the miner on its host. A deploy landing on the same host during a measurement would find the unit down and start it mid-window. Both are serialised only by not running them together.