Monerometrics

monerometrics

A reorg-aware observatory for the health of the Monero network: public dashboard + API.

monerometrics is community-funded. A Kuno campaign funds the next two years: hosting, FCMP++ readiness, free reorg alerts, open data export and a second node.

monerometrics measures and historizes the health of the Monero network: network hashrate, block time, mempool state, mining-pool distribution and, above all, chain reorganizations (reorgs) and orphan blocks, which most block explorers surface poorly.

The project was born from the August 2025 Qubic episode, during which a mining pool paying miners in its own token approached a majority of the network hashrate, then withheld blocks and released a longer private chain. On 14 September 2025 that produced an 18-block reorganization at height 3,499,659 that erased about 36 minutes of history, well past the 10 confirmations everyone treated as final: transactions thought settled were suddenly unconfirmed again. The public debate lacked reliable, accessible data to settle it. monerometrics fills that gap with a neutral, verifiable, reorg-aware observatory.

It is open-source and self-funded, with no ads and no tracking. The dashboard and the API are free and open, permanently: there is no paid tier, and there will not be one.

From a diploma project to a community tool. monerometrics V1 was built and defended as a

French professional IT-infrastructure project, and it earned the diploma. With that chapter

closed, the goal of V2 is to hand the project over to the Monero community.

• Dashboard: monerometrics.net
• Public API: api.monerometrics.net (OpenAPI documented)
• MCP server: https://api.monerometrics.net/mcp (Streamable HTTP; in the MCP Registry)
• Tor hidden service: 6wbhchvavey26lbtscl6w6qg76balycixtsklcggrsslyk4xah6sbbad.onion (dashboard + API, no Cloudflare, no IP exposure, see Access over Tor)

---

What it does

Dashboard, a React SPA in four sections, available in English, French and Spanish, light and dark themes, readable on a phone:

• *Consensus and reorganizations*: a chain-fork visualizer that draws competing branches as a tree, reorg statistics by window up to everything recorded, and orphan history. Each block names its pool and how the attribution was established, and merge-mined blocks are flagged.
• *Mining concentration*: pool distribution, the combined share of the two largest pools, and the evidence behind each attribution.
• *Network state*: hashrate, block-time variance, mempool, emission, and a transaction fee estimator reading the node's four priority tiers live.
• *Peer-to-peer market*: Haveno premium over spot on both sides of the book, live order-book depth, resting liquidity, and premium by payment method.
• Transaction search: paste a transaction hash and get what Monero actually makes public about it, plus which pool mined its block and whether that height was ever contested by a reorg. The hash travels in a POST body, so it never lands in a URL.
• Every time series is navigable: a range strip under each chart, drag to move through time, zoom, and statistics that follow the visible window rather than the whole series.

Public API: FastAPI, read-only JSON endpoints grouped by theme, documented via OpenAPI.

Reorg detection: a Python worker reads each block from a synced node, computes the indicators and detects reorganizations by re-checking a rolling window of recent blocks against the node, recording their real depth and the transactions they displaced.

Architecture

A visitor reaches the dashboard or API through Cloudflare, which terminates TLS and applies its edge protections, then forwards to a hardened edge server (nginx + ModSecurity WAF). The edge serves the static dashboard and reverse-proxies the API to the k3s node, where the application core runs: a Monero node, the indexer, PostgreSQL and the API.

A second, independent path exists: a Tor hidden service running on the edge, which bypasses Cloudflare entirely and serves both the dashboard and the API on a single origin, behind the same WAF.

flowchart LR

User(["Visitor"]) -->|HTTPS| CF["Cloudflare DNS · WAF · proxy"] CF -->|"HTTP/2 origin pull"| Edge Tor(["Tor visitor"]) -.->|"Tor network"| Onion subgraph HZ["Hetzner Cloud · private network 10.0.0.0/24"] Onion["tor daemon hidden service v3"] Edge["edge 10.0.0.20 nginx + ModSecurity WAF static dashboard"] Onion -.->|"127.0.0.1:8080"| Edge subgraph K3S["k3s 10.0.0.30 · no public ingress"] API["FastAPI"] Worker["Python worker (indexer)"] DB[("PostgreSQL 17")] Node["monerod 0.18 pruned"] end Edge -->|"api. proxy_pass"| API API --> DB Worker --> DB Worker -->|JSON-RPC| Node end Node <-->|"P2P sync"| Monero(["Monero network"]) API -.->|"XMR price (cached)"| Price(["CoinGecko · Kraken Haveno (RetoSwap)"])

Access over Tor

The dashboard is also published as a Tor v3 hidden service, giving a path to the data that does not depend on Cloudflare and does not expose the visitor's IP address:

6wbhchvavey26lbtscl6w6qg76balycixtsklcggrsslyk4xah6sbbad.onion

• One origin, no leaks. The hidden service serves the dashboard on / and reverse-proxies the API under /api. The SPA detects an .onion host at runtime and switches to that relative path, so no browser request ever leaves the hidden service for the clearnet. One build serves both.
• No TLS, on purpose. Tor already encrypts and authenticates end to end, and the .onion address *is* the service's public key.
• Same WAF. The hidden-service vhost runs the same ModSecurity rules as the clearnet site, so Tor is not a way around the filtering.
• Not reachable from the internet. The .onion vhost listens on 127.0.0.1:8080 only, so the Tor daemon is the sole thing that can reach it. Tor makes outbound connections only.
• No logs. Every request arrives from 127.0.0.1, so access logging on this vhost would record nothing useful and is disabled.
• Discoverable. The clearnet site advertises it with an Onion-Location header.
• Rate limiting. Per-IP limiting is meaningless over Tor, so hidden-service traffic is tagged by nginx and isolated in its own bucket with a higher ceiling. The tagging header is stripped on the clearnet vhosts, so it cannot be forged from the internet.

Deployed by the tor Ansible role (config/ansible/roles/tor/).

Infrastructure

The platform runs on Hetzner Cloud (Nuremberg) as two Ubuntu 24.04 servers on a private network, each behind its own firewall. Neither exposes SSH to the internet: administration goes only over a Tailscale (WireGuard) mesh joined by both servers, and Grafana is reachable over Tailscale only. Backups are paused: the tooling (Restic, encrypted, see k8s/monerometrics/BACKUP-PRA.md) stays in the repository, but no scheduled backup runs today.

flowchart TB

Admin(["Administrator"]) -->|"SSH over Tailscale"| Mesh Internet(["Internet"]) -->|"80 / 443 via Cloudflare"| Edge subgraph HZ["Hetzner Cloud (nbg1) · 10.0.0.0/24"] Edge["edge 10.0.0.20 firewall: 80/443 from Cloudflare only"] K3s["k3s 10.0.0.30 + data volume firewall: no inbound (P2P 18080 only)"] Edge -->|"private network"| K3s end Mesh["Tailscale mesh (admin SSH · kubectl · Grafana)"] Mesh --- Edge Mesh --- K3s

Key choices: per-server firewalls, no public SSH anywhere, a WAF on the only public web surface, a zero-trust admin mesh, and a k3s node exposing nothing but the Monero P2P port. A dedicated SSH bastion was dropped in October 2026: Tailscale already gave a zero-trust entry point, so the extra server only added cost. Tailscale's own SSH is disabled; plain OpenSSH with keys runs over the mesh, so access never depends on a browser re-validation. Both hops run HTTP/2 with the WAF active. Everything is Infrastructure-as-Code: Hetzner and Cloudflare resources via Terraform, server configuration and CIS-aligned hardening via Ansible, images published to GHCR. Supervision with Prometheus + Grafana, with alert rules on indexing, node sync, disk and failing workloads. The backup tooling (Restic) is kept but paused.

Secrets. The cluster is provisioned with OpenBao (a free fork of Vault) and the manifests carry no plaintext credential. OpenBao unseals itself on start (static seal, key held in a Kubernetes Secret created outside the repository); the workloads can also fall back to a Kubernetes Secret (postgres-credentials-fallback), so a sealed vault never takes the service down.

Running cost

Hetzner list prices, monthly cap, including 20 % VAT:

Cloudflare, Let's Encrypt, Tailscale and GitHub Actions are on free tiers.

The volume is the item that moves, and the chain drives it, not indexing. The pruned Monero blockchain takes 106 GB; the entire indexed database, 3.77 M blocks and every time series, takes 3.1 GB, about 540 bytes per block, and grows by roughly 150 MB a year.

Growth is measured from the indexed data rather than estimated. Summing the recorded size of every canonical block gives 186.8 GB for the full chain, so this pruned node keeps a bit over half of Monero. The chain grew 22.18 GB over the last twelve full months, which is 12.35 GB a year on disk, steady across years (17.5 GB in 2022, 18.3 in 2023, 29.1 in 2024, 22.2 in 2025). The volume reached 94 % of 128 GB, so it was taken to 250 GB in October 2026, funded by the community (Kuno milestone 1). That leaves room well beyond the two years promised, which also absorbs the heavier transactions FCMP++ will bring. Removing the SSH bastion the same month paid for most of the difference.

How the indexer works

The worker (apps/worker/indexer.py) is the heart of the project. Every POLL_INTERVAL seconds it asks monerod for its state and, when the node is synced, runs three passes:

1. Confirmation-window rescan (reorg detection). It re-fetches the headers of the last CONFIRMATION_WINDOW blocks (default 60) in one call and compares each hash to the canonical hash already stored. Any mismatch is a reorganization: the stored block is flagged orphan (is_canonical = false), the node's block becomes canonical, and a row is written to reorgs_detected with the real depth and the affected transaction count. This pass is what makes reorg detection work at all: forward-only indexing never revisits the past, so it would silently miss every reorg that rewrites already-indexed heights.

**The window is