Stratum bridge

tenrai-stratum-bridge takes work from your node and hands it to miners on other machines. Each miner logs in with its own address, and every block it finds pays that address directly. The bridge keeps no balances and pays nothing itself; for shared payouts, run a pool.

1. Run a synced node

The bridge runs on the node's machine and talks to its mining listener at 127.0.0.1:28702. Set up the node as in Run a node.

2. Start the bridge

tenrai-stratum-bridge

Without options the bridge serves miners on this machine: it takes work from the node at 127.0.0.1:28702, listens on 127.0.0.1:28720 and shows its dashboard on http://127.0.0.1:28771/. It waits for the node when that is not running yet. The first start writes tenrai-stratum-bridge.json with the default settings next to the program.

For rigs in your local network:

tenrai-stratum-bridge --listen-tls 0.0.0.0 --tls-name 192.168.1.10 --allow 192.168.1.0/24

The first start creates tenrai-stratum-bridge.crt and its key next to the program. The miner sends unencrypted Stratum only to its own machine, so the rigs need TLS and this certificate.

Every listener outside 127.0.0.1 needs one of --allow, --password-file or --public.

3. Point the miners at it

On each rig:

tenrai-miner -a <address> --stratum 192.168.1.10 --tls-ca tenrai-stratum-bridge.crt -w rig1

No --pool here: the bridge builds work that pays each miner's own address.

4. Check it

The dashboard at http://127.0.0.1:28771/ shows workers, hashrate, shares and found blocks. The log prints a worker report every 30 seconds.

Over the internet

Use TLS and protect the port:

tenrai-stratum-bridge --listen-tls 0.0.0.0:28721 --tls-cert bridge.crt --tls-key bridge.key \
  --password-file bridge.pass --autoban

tenrai-miner -a <address> --stratum stratum+tls://bridge.example.org:28721 -w rig1 -p "<password>"

The certificate and key are PEM files, for example from Let's Encrypt. Miners trust a self-signed certificate with --tls-ca bridge.crt. TLS listeners speak TLS 1.3 with the X25519MLKEM768 key exchange only.

Open to everyone, without a password:

tenrai-stratum-bridge --listen-tls 0.0.0.0:28721 --tls-cert bridge.crt --tls-key bridge.key --public --autoban

Stratum version 2; miners then use stratum2+tls://:

tenrai-stratum-bridge --listen-v2-tls 0.0.0.0:28722 --tls-cert bridge.crt --tls-key bridge.key --public

Browser miners, behind a TLS proxy:

tenrai-stratum-bridge --listen-ws 127.0.0.1:28723 --ws-origin https://miner.example --public

The proxy passes each visitor's address as X-Real-IP; the bridge reads it only from connections that come from 127.0.0.1. Without it, limits and bans would apply to all browser miners together. --ws-origin keeps other web pages from mining through the bridge.

Unencrypted listeners, --listen and --listen-ws, only accept 127.0.0.1; the bridge refuses them on any other address. Miners on other machines connect over TLS, or through a TLS proxy in front of a loopback listener.

Options

The bridge reads tenrai-stratum-bridge.json next to the program and creates it with the default settings on the first start; --config names another file. The file takes the long option names. A value on the command line replaces the file's; lists from both are added together.

Node and listeners

Access

Loopback is never banned.

Shares and blocks

A miner can ask for a fixed share difficulty with the password d=131072, or <password>,d=131072.

Statistics and logs

Statistics

The protocol is described in the stratum reference.