grenadeandClaude Fable 5.1
b9e1d21ec9
quantus/miner#8. The miner is now deployed from this repo, not from lair/quantus's release-pinned workflow (lair/quantus#4 retires that half). - .gitea/workflows/deploy.yaml: build on cuda-13.0 (Fedora 43 like the hosts, and the runner with nvcc for #3) with the commit embedded, then per host in the matrix: sudoers preflight against deploy/infra-setup.sh, credentials copied from the node, miner.env rendered with the node's mesh IP resolved on the miner host, checksum-gated push of binary and unit, scoped firewalld rule for the exporter, restart only on change. Validate asserts the unit is active, --version carries this commit, the miner sees the matrix's device count, and miner_hashes_total advances within 120 s. If validate fails after a restart, the previous binary is restored. - deploy/: the unit, sysusers, firewalld service and env template moved verbatim from lair/quantus asset/, plus infra-setup.sh with the miner role (and two new cp grants for the rollback). Applied to benjy and quadbrat. - Matrix: benjy and quadbrat; beast present but commented out per the operating policy in #1. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CBgs2nSi4H2mdh8kD8vMX5
65 lines
2.0 KiB
Desktop File
65 lines
2.0 KiB
Desktop File
# Quantus external miner. Runs on the GPU host and connects OUT to the node's
|
|
# QUIC control channel; it listens on nothing but its loopback metrics port, so
|
|
# it ships no firewalld service of its own.
|
|
#
|
|
# Hardened per ~/git/architecture/generic.md §8, with one deliberate relaxation:
|
|
#
|
|
# PrivateDevices=false
|
|
# The miner needs /dev/nvidia*; PrivateDevices=true hides them and wgpu
|
|
# finds no adapter, silently falling back to nothing.
|
|
#
|
|
# Poseidon2-over-Goldilocks is compute-bound in registers, not memory-bound, so
|
|
# there is no tuning knob here worth more than the GPU power limit — which is a
|
|
# host-level concern (nvidia-smi -pl), not a unit-file one.
|
|
#
|
|
# --cpu-workers 0 is deliberate: a current-gen desktop CPU contributes ~4 MH/s
|
|
# next to a 4090's ~183 MH/s, for a couple hundred watts. Measured, not assumed.
|
|
|
|
[Unit]
|
|
Description=Quantus external miner (GPU)
|
|
Documentation=https://github.com/Quantus-Network/quantus-miner
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=quantus-miner
|
|
Group=quantus-miner
|
|
Environment=RUST_LOG=info
|
|
WorkingDirectory=/var/lib/quantus-miner
|
|
|
|
ExecStart=/usr/local/bin/quantus-miner serve \
|
|
--node-addr ${QUANTUS_NODE_ADDR} \
|
|
--auth-token-file /etc/quantus-miner/miner-auth-token \
|
|
--tls-cert-sha256-file /etc/quantus-miner/miner-tls-cert-sha256 \
|
|
--gpu-devices ${QUANTUS_GPU_DEVICES} \
|
|
--cpu-workers 0 \
|
|
--metrics-port 9900
|
|
EnvironmentFile=/etc/quantus-miner/miner.env
|
|
|
|
# The node may be down, still syncing, or mid-redeploy; reconnecting is normal
|
|
# operation, not an error condition.
|
|
Restart=always
|
|
RestartSec=15s
|
|
LimitNOFILE=65536
|
|
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
PrivateDevices=false
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
LockPersonality=true
|
|
SystemCallArchitectures=native
|
|
MemoryDenyWriteExecute=false
|
|
|
|
ReadWritePaths=/var/lib/quantus-miner
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|