Sanitize OPERATOR_GUIDE + make stratum URL env-driven

Removes a live admin password + hardcoded host address that were
committed to the earlier OPERATOR_GUIDE commit. The leaked password
has already been rotated on the deployment box.

Changes:

- OPERATOR_GUIDE.md: password replaced with a pointer to the box's
  /root/simplepool-admin-cred.txt; the specific pool host / SSH key
  replaced with <pool-host> / <ssh-key> placeholders. A note at the
  top warns to keep real values in a gitignored file only.
- dashboard/views/index.ejs: 'Connect a miner' now renders whatever
  PUBLIC_STRATUM_URL says instead of a hardcoded address. Unset
  falls back to a 'stratum+tcp://<pool-host>:3334' placeholder.
- dashboard/server.js: reads PUBLIC_STRATUM_URL from env and passes
  it to the index view.
- deploy/systemd/simplepool-dashboard.service: documents the new
  env var alongside the existing ones.

Author: rsantacroce

OPERATOR_GUIDE.md

@@ -8,18 +8,26 @@ background on why the design looks like this).
 
 ## Quick reference
 
+Substitute your own pool's public IP/hostname for `<pool-host>` and your
+SSH key file for `<ssh-key>` below. On the deployment I built alongside
+this doc, the real values are stashed in a gitignored `FORKNET_CHEATSHEET.md`
+at the repo root — do NOT paste real hosts / passwords into anything
+tracked by git.
+
 | what | where | credentials |
 | --- | --- | --- |
-| Public dashboard | http://45.33.100.24:8081/ | none |
-| **Admin dashboard** | **http://45.33.100.24:8081/admin** | **`admin` / `4DqSK1d6jkefposLEw5DEP5luPT`** |
-| Admin JSON API | http://45.33.100.24:8081/api/admin/summary | same basic auth |
-| Stratum (miner endpoint) | `stratum+tcp://45.33.100.24:3334` | username = Thunder base58 address |
-| SSH | `root@45.33.100.24` | `~/.ssh/id_epitetus` |
-
-The admin password is also stashed at `/root/simplepool-admin-cred.txt`
-on the box (root-only). To rotate, edit
+| Public dashboard | `http://<pool-host>:8081/` | none |
+| **Admin dashboard** | `http://<pool-host>:8081/admin` | **`admin` / `<see /root/simplepool-admin-cred.txt on the box>`** |
+| Admin JSON API | `http://<pool-host>:8081/api/admin/summary` | same basic auth |
+| Stratum (miner endpoint) | `stratum+tcp://<pool-host>:3334` | username = Thunder base58 address |
+| SSH | `root@<pool-host>` | `<ssh-key>` |
+
+The admin password is stashed at `/root/simplepool-admin-cred.txt` on the
+box (root-only). To rotate, edit
 `/etc/systemd/system/simplepool-dashboard.service.d/pps-thunder.conf`
-and `systemctl daemon-reload && systemctl restart simplepool-dashboard`.
+and `systemctl daemon-reload && systemctl restart simplepool-dashboard`
+— there's a scripted version in [Rotating the admin
+password](#rotating-the-admin-password) below.
 
 ---
 
@@ -114,7 +122,7 @@ reconciliation.
 **Currently manual — no admin button yet.** The runbook:
 
 ```sh
-ssh -i ~/.ssh/id_epitetus root@45.33.100.24
+ssh -i <ssh-key> root@<pool-host>
 
 # 1. Get a Thunder-owned deposit address (formatted for the mainchain wallet)
 TCLI=/home/forknet/forknet-software/thunder-rust/target/debug/thunder_app_cli
@@ -214,7 +222,7 @@ finalize crashed" without Thunder-side mempool/chain lookup.
 Nothing on the pool side. The miner points their ASIC firmware at:
 
 ```
-stratum+tcp://45.33.100.24:3334
+stratum+tcp://<pool-host>:3334
 username: <their-Thunder-address>[.<rig_label>]
 password: (anything)
 ```
@@ -239,7 +247,7 @@ view.
 ## Rotating the admin password
 
 ```sh
-ssh -i ~/.ssh/id_epitetus root@45.33.100.24
+ssh -i <ssh-key> root@<pool-host>
 NEW_PASS=$(openssl rand -base64 21 | tr -d '=+/')
 sed -i "s/^Environment=ADMIN_PASSWORD=.*/Environment=ADMIN_PASSWORD=$NEW_PASS/" \
   /etc/systemd/system/simplepool-dashboard.service.d/pps-thunder.conf

dashboard/server.js

@@ -23,6 +23,10 @@ app.use('/static', express.static(path.join(__dirname, 'public'), { maxAge: '1h'
 
 const db = openDb(path.resolve(__dirname, DB_PATH));
 
+/* Shown on the public "Connect a miner" card. Env-driven so the shipped
+ * template doesn't hardcode any particular deployment's host. */
+const PUBLIC_STRATUM_URL = process.env.PUBLIC_STRATUM_URL || 'stratum+tcp://<pool-host>:3334';
+
 app.get('/', (req, res) => {
     const ov = stats.overview(db);
     const lb = stats.leaderboard(db);
@@ -31,6 +35,7 @@ app.get('/', (req, res) => {
     const node = stats.nodeStatus(db);
     res.render('index', {
         ov, lb, lbAddr, blocks, node,
+        stratumUrl: PUBLIC_STRATUM_URL,
         fmtHashrate: stats.fmtHashrate,
         fmtBtc: stats.fmtBtc,
     });

dashboard/views/index.ejs

@@ -63,7 +63,7 @@ const ago = (t) => {
             </p>
 
             <h3 style="margin-top:1em;margin-bottom:0.25em">Connect a miner</h3>
-            <pre class="mono small" style="margin:0;padding:0.5em;background:#0002;border-radius:4px;overflow-x:auto">stratum+tcp://45.33.100.24:3334
+            <pre class="mono small" style="margin:0;padding:0.5em;background:#0002;border-radius:4px;overflow-x:auto"><%= stratumUrl %>
 username:  &lt;your-Thunder-address&gt;[.&lt;rig_label&gt;]
 password:  (ignored — any value)</pre>
             <p class="muted small" style="margin-top:0.5em">

deploy/systemd/simplepool-dashboard.service

@@ -11,6 +11,10 @@ Group=@USER@
 WorkingDirectory=@ROOT@/dashboard
 Environment=PORT=8081
 Environment=PROXY_DB_PATH=@ROOT@/data/shares.db
+# Rendered on the public "Connect a miner" card. Set to the actual
+# host miners should point their ASIC at. Leave unset to show
+# 'stratum+tcp://<pool-host>:3334' as a placeholder.
+# Environment=PUBLIC_STRATUM_URL=stratum+tcp://pool.example.com:3334
 # --- PPS admin panel — /admin route ---
 # When ADMIN_USER + ADMIN_PASSWORD are both set, /admin serves the pool
 # operator view (reserve balance, ledger totals, per-worker owed,