feat(mining): Bitcoin mining-for-bandwidth payment system

New modules:
- mining_payment.c/h: hashprice calc (nbits->difficulty->sat/GH/s/day),
  share validation, client stats, allotment conversion (ms + bytes)
- stratum_client.c/h: SV1 upstream pool connection (subscribe/authorize/submit)
- stratum_proxy.c/h: Local SV1 TCP server for downstream miners, job broadcast
- sw_miner.c/h: Software SHA256d miner (ESP32 CPU fallback)
- asic_miner.c/h: ASIC detection stub (BM1366/BM1368 SPI)

Config:
- config.h/c: mining_payout_mode_t enum (auto/pool/upstream/proxy_only),
  stratum pool settings, mining port, hashprice override, sandbox mint access
- Defaults fill nostr_seed_relays (8/8) and nostr_relays (4/4) with fast relays

Integration into existing modules:
- session.h/c: payment_method_t enum (CASHU/MINING/BYTES)
- firewall.h/c: firewall_set_mining_port(), firewall_set_sandbox_mint_access()
- tollgate_api.c: GET /mining/job, POST /mining/share, GET /mining/stats
- tollgate_client.h/c: TG_CLIENT_MINING state, mining discovery tag parsing
- tollgate_main.c: mining init in start_services(), stratum_client_tick() in loop
- captive_portal.c: tabbed Cashu/Mine UI with live hashrate polling

Unit tests (69 new assertions across 4 suites):
- test_mining_payment (23 tests): nbits->difficulty, hashprice, client stats, allotment
- test_stratum_proxy (21 tests): job set/get, stats, type validation
- test_session_payment_method (12 tests): PAYMENT_METHOD enum, bytes/cashu methods
- test_tollgate_client_mining (20 tests): mining tag parsing, discovery struct
- test_firewall_sandbox (16 tests): client grant/revoke, max clients, setters

Enhanced test stubs:
- BaseType_t/pdPASS in freertos/task.h
- lwip: sockets.h, etharp.h, prot/ip.h, prot/ip4.h, prot/tcp.h, netif.h
- dns_server.h, esp_wifi_ap_get_sta_list.h

Build fixes:
- cvm_server.c: replace esp_timer_get_time() with xTaskGetTickCount(),
  fix process_relay_message() 3-arg call to 2-arg, add WS keepalive ping
- stratum_proxy.c: widen task_name buffer 16->20
- sw_miner.c: add missing #include esp_random.h
- nucula_src: save_proofs() moved to public in wallet.hpp

Nostr relay updates:
- nostr_seed_relays: +relay.anzenkodo.workers.dev, +nostr.koning-degraaf.nl,
  +knostr.neutrine.com, +nostr.einundzwanzig.space (8/8 slots)
- nostr_relays: +relay.anzenkodo.workers.dev, +nostr.koning-degraaf.nl (4/4 slots)

Squash-merge of feature/mining-payment (5 commits: c75230e..9d98ba1)

23 files changed, 1399 insertions, 70 deletions

diff --git a/main/CMakeLists.txt b/main/CMakeLists.txt
index f21b4e0..0669b70 100644
--- a/main/CMakeLists.txt
+++ b/main/CMakeLists.txt
@@ -24,8 +24,16 @@ idf_component_register(SRCS "tollgate_main.c"
                             "sync_manager.c"
                             "beacon_price.c"
                             "market.c"
+                            "negentropy_adapter.c"
+                            "mining_payment.c"
+                            "stratum_client.c"
+                            "stratum_proxy.c"
+                            "sw_miner.c"
+                            "asic_miner.c"
                     INCLUDE_DIRS "."
                     REQUIRES esp_wifi esp_event esp_netif nvs_flash esp_http_server
                              lwip json esp_http_client mbedtls esp-tls log spiffs
                              nucula_lib secp256k1 axs15231b qrcode wisp_relay
+                             esp_littlefs negentropy
+                             esp_timer tcp_transport
                     PRIV_REQUIRES esp-tls)
diff --git a/main/asic_miner.c b/main/asic_miner.c
new file mode 100644
index 0000000..1db6d18
--- /dev/null
+++ b/main/asic_miner.c
@@ -0,0 +1,63 @@
+#include "asic_miner.h"
+#include "esp_log.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include <string.h>
+
+static const char *TAG = "asic_miner";
+static bool s_present = false;
+static bool s_running = false;
+static TaskHandle_t s_task_handle = NULL;
+static double s_hashrate = 0.0;
+
+static void asic_miner_task(void *arg)
+{
+    ESP_LOGI(TAG, "ASIC miner task started (stub)");
+    while (s_running) {
+        vTaskDelay(pdMS_TO_TICKS(1000));
+    }
+    vTaskDelete(NULL);
+}
+
+esp_err_t asic_miner_init(void)
+{
+    s_present = false;
+    ESP_LOGI(TAG, "ASIC miner initialized - no ASIC detected (software fallback)");
+    return ESP_OK;
+}
+
+bool asic_miner_is_present(void)
+{
+    return s_present;
+}
+
+esp_err_t asic_miner_start(void)
+{
+    if (!s_present) {
+        ESP_LOGW(TAG, "No ASIC present, cannot start");
+        return ESP_FAIL;
+    }
+
+    s_running = true;
+    BaseType_t ret = xTaskCreate(asic_miner_task, "asic_miner", 4096, NULL, 3, &s_task_handle);
+    if (ret != pdPASS) {
+        ESP_LOGE(TAG, "Failed to create ASIC task");
+        s_running = false;
+        return ESP_FAIL;
+    }
+    return ESP_OK;
+}
+
+void asic_miner_stop(void)
+{
+    s_running = false;
+    if (s_task_handle) {
+        vTaskDelay(pdMS_TO_TICKS(500));
+        s_task_handle = NULL;
+    }
+}
+
+double asic_miner_get_hashrate(void)
+{
+    return s_hashrate;
+}
diff --git a/main/asic_miner.h b/main/asic_miner.h
new file mode 100644
index 0000000..00efbc6
--- /dev/null
+++ b/main/asic_miner.h
@@ -0,0 +1,14 @@
+#ifndef ASIC_MINER_H
+#define ASIC_MINER_H
+
+#include "esp_err.h"
+#include <stdint.h>
+#include <stdbool.h>
+
+esp_err_t asic_miner_init(void);
+bool asic_miner_is_present(void);
+esp_err_t asic_miner_start(void);
+void asic_miner_stop(void);
+double asic_miner_get_hashrate(void);
+
+#endif
diff --git a/main/captive_portal.c b/main/captive_portal.c
index c9bcf19..ea83906 100644
--- a/main/captive_portal.c
+++ b/main/captive_portal.c
@@ -2,7 +2,8 @@
 #include "firewall.h"
 #include "session.h"
 #include "config.h"
-#include "mint_health.h"
+#include "mining_payment.h"
+#include "stratum_proxy.h"
 #include "esp_log.h"
 #include "esp_wifi.h"
 #include "cJSON.h"
@@ -32,6 +33,12 @@ static const char PORTAL_HTML_TEMPLATE[] = \
 "max-width:400px;width:100%;text-align:center}"
 "h1{font-size:28px;margin-bottom:8px;color:#f7931a}"
 ".subtitle{color:#888;margin-bottom:24px;font-size:14px}"
+".tabs{display:flex;gap:4px;margin-bottom:20px}"
+".tab{flex:1;padding:10px;border:none;border-radius:8px;background:#252525;color:#888;"
+"cursor:pointer;font-size:13px;font-weight:bold}"
+".tab.active{background:#f7931a;color:#000}"
+".tab-content{display:none}"
+".tab-content.active{display:block}"
 ".price{background:#252525;border-radius:12px;padding:16px;margin-bottom:16px}"
 ".price-amount{font-size:36px;font-weight:bold;color:#f7931a}"
 ".price-unit{color:#888;font-size:14px}"
@@ -43,24 +50,26 @@ static const char PORTAL_HTML_TEMPLATE[] = \
 ".btn:disabled{background:#333;color:#666;cursor:not-allowed}"
 ".mints{background:#252525;border-radius:12px;padding:12px;margin-top:16px;text-align:left}"
 ".mints-title{color:#888;font-size:12px;margin-bottom:8px}"
-".mint-item{display:flex;align-items:center;padding:6px 8px;margin-bottom:4px;"
-"background:#1a1a1a;border-radius:6px;cursor:pointer}"
-".mint-item:active{opacity:0.7}"
-".mint-dot{width:8px;height:8px;border-radius:50%;margin-right:8px;flex-shrink:0}"
-".mint-dot.green{background:#4caf50}"
-".mint-dot.grey{background:#666}"
-".mint-url{font-family:monospace;font-size:11px;color:#f7931a;word-break:break-all}"
-".mint-url.dim{color:#666}"
+".mint-url{font-family:monospace;font-size:11px;color:#f7931a;word-break:break-all;"
+"background:#1a1a1a;padding:8px;border-radius:6px;cursor:pointer}"
+".mint-url:active{opacity:0.7}"
 ".mint-hint{color:#666;font-size:10px;margin-top:4px}"
+".mining-stats{background:#252525;border-radius:12px;padding:16px;margin-bottom:16px;text-align:left}"
+".mining-stat{display:flex;justify-content:space-between;margin-bottom:8px;font-size:13px}"
+".mining-stat .label{color:#888}"
+".mining-stat .value{color:#f7931a;font-weight:bold}"
 "#status{margin-top:16px;padding:12px;border-radius:8px;display:none;font-size:14px}"
 "#status.success{display:block;background:#1a472a;color:#4caf50}"
 "#status.error{display:block;background:#471a1a;color:#f44336}"
 "#status.processing{display:block;background:#1a3a47;color:#2196f3}"
+".mining-info{color:#666;font-size:11px;margin-top:12px;line-height:1.5}"
 "</style>"
 "</head><body>"
 "<div class='card'>"
 "<h1>TollGate</h1>"
-"<p class='subtitle'>Pay for internet access with ecash</p>"
+"<p class='subtitle'>Pay for internet access with ecash or mining</p>"
+"__MINING_TABS__"
+"<div id='tab-cashu' class='tab-content __CASHU_ACTIVE__'>"
 "<div class='price'>"
 "<div class='price-amount'>__PRICE__</div>"
 "<div class='price-unit'>sats per minute</div>"
@@ -69,21 +78,40 @@ static const char PORTAL_HTML_TEMPLATE[] = \
 "<button class='btn' id='payBtn' onclick='payToken()'>Pay & Connect</button>"
 "<div class='mints'>"
 "<div class='mints-title'>SUPPORTED MINTS</div>"
-"<div id='mintList'>__MINT_LIST__</div>"
-"<div class='mint-hint'>Tap to copy &bull; Green = reachable</div>"
+"<div class='mint-url' id='mintUrl' onclick='copyMint()'>__MINT_URL__</div>"
+"<div class='mint-hint'>Tap to copy &bull; Mint tokens at this URL before paying</div>"
+"</div>"
+"</div>"
+"<div id='tab-mining' class='tab-content __MINING_ACTIVE__'>"
+"<div class='mining-stats'>"
+"<div class='mining-stat'><span class='label'>Hashrate</span><span class='value' id='hashrate'>0.00 GH/s</span></div>"
+"<div class='mining-stat'><span class='label'>Shares</span><span class='value' id='shareCount'>0</span></div>"
+"<div class='mining-stat'><span class='label'>Hashprice</span><span class='value' id='hashprice'>0.00 sat/GH/s/day</span></div>"
+"<div class='mining-stat'><span class='label'>Time earned</span><span class='value' id='timeEarned'>0 min</span></div>"
+"</div>"
+"<button class='btn' id='mineBtn' onclick='toggleMining()'>Start Mining</button>"
+"<div class='mining-info'>Mining earns internet time by contributing SHA256 hashpower. "
+"Connect a Stratum miner to port __MINING_PORT__ or use the built-in web miner.</div>"
 "</div>"
 "<div id='status'></div>"
 "</div>"
 "<script>"
-"const mintListEl=document.getElementById('mintList');"
+"const mintUrlEl=document.getElementById('mintUrl');"
+"const mintUrl=mintUrlEl.textContent;"
 "const statusEl=document.getElementById('status');"
 "const payBtn=document.getElementById('payBtn');"
 "const tokenInput=document.getElementById('tokenInput');"
-"function copyMint(url){"
-"if(navigator.clipboard){navigator.clipboard.writeText(url);"
-"const el=event.currentTarget;const u=el.querySelector('.mint-url');"
-"const orig=u.textContent;u.textContent='Copied!';"
-"setTimeout(()=>{u.textContent=orig;},1000);}"
+"let miningActive=false;"
+"let miningInterval=null;"
+"function switchTab(tab){"
+"document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));"
+"document.querySelectorAll('.tab-content').forEach(t=>t.classList.remove('active'));"
+"event.target.classList.add('active');"
+"document.getElementById('tab-'+tab).classList.add('active');"
+"}"
+"function copyMint(){"
+"if(navigator.clipboard){navigator.clipboard.writeText(mintUrl);"
+"mintUrlEl.textContent='Copied!';setTimeout(()=>{mintUrlEl.textContent=mintUrl;},1000);}"
 "}"
 "function showStatus(msg,type){statusEl.textContent=msg;statusEl.className=type;}"
 "function payToken(){"
@@ -100,20 +128,24 @@ static const char PORTAL_HTML_TEMPLATE[] = \
 "else if(d.kind===21023){showStatus('Error: '+(d.content||'Unknown error'),'error');payBtn.disabled=false;}"
 "}).catch(e=>{showStatus(e.message||'Connection error','error');payBtn.disabled=false;});"
 "}"
-"function refreshMints(){"
-"fetch('http://__AP_IP__:2121/mints').then(r=>r.json()).then(data=>{"
-"let html='';"
-"for(const m of data){"
-"const cls=m.reachable?'green':'grey';"
-"const urlCls=m.reachable?'mint-url':'mint-url dim';"
-"html+='<div class=\"mint-item\" onclick=\"copyMint(\\''+m.url+'\\')\">';"
-"html+='<span class=\"mint-dot '+cls+'\"></span>';"
-"html+='<span class=\"'+urlCls+'\">'+m.url+'</span></div>';"
-"}"
-"if(html)mintListEl.innerHTML=html;"
+"function pollMiningStats(){"
+"fetch('http://__AP_IP__:2121/mining/stats').then(r=>r.json()).then(d=>{"
+"document.getElementById('hashrate').textContent=d.proxy.hashrate_ghs.toFixed(2)+' GH/s';"
+"document.getElementById('shareCount').textContent=d.proxy.total_accepted;"
+"document.getElementById('hashprice').textContent=d.proxy.hashprice.toFixed(2)+' sat/GH/s/day';"
 "}).catch(()=>{});"
+"fetch('http://__AP_IP__:2121/usage').then(r=>r.text()).then(t=>{"
+"if(t&&t!=='-1/-1'){"
+"const parts=t.split('/');const rem=Math.floor(parseInt(parts[0])/60000);"
+"document.getElementById('timeEarned').textContent=rem+' min';"
+"}}).catch(()=>{});"
+"}"
+"function toggleMining(){"
+"if(miningActive){miningActive=false;clearInterval(miningInterval);"
+"document.getElementById('mineBtn').textContent='Start Mining';return;}"
+"miningActive=true;document.getElementById('mineBtn').textContent='Mining...';"
+"miningInterval=setInterval(pollMiningStats,2000);pollMiningStats();"
 "}"
-"setInterval(refreshMints,30000);"
 "</script>"
 "</body></html>";
 
@@ -143,36 +175,25 @@ static esp_err_t portal_handler(httpd_req_t *req)
     const char *tpl = PORTAL_HTML_TEMPLATE;
     size_t tpl_len = strlen(tpl);
 
-    char mint_list_html[4096];
-    size_t mint_list_cap = sizeof(mint_list_html);
-    size_t mint_list_len = 0;
-    mint_list_html[0] = '\0';
-    int mint_count = 0;
-    const mint_status_t *mints = mint_health_get_all(&mint_count);
-    for (int i = 0; i < mint_count; i++) {
-        const char *cls = mints[i].reachable ? "green" : "grey";
-        const char *url_cls = mints[i].reachable ? "mint-url" : "mint-url dim";
-        int written = snprintf(mint_list_html + mint_list_len, mint_list_cap - mint_list_len,
-                 "<div class='mint-item' onclick='copyMint(\"%s\")'>"
-                 "<span class='mint-dot %s'></span>"
-                 "<span class='%s'>%s</span></div>",
-                 mints[i].url, cls, url_cls, mints[i].url);
-        if (written > 0 && (size_t)written < mint_list_cap - mint_list_len) {
-            mint_list_len += (size_t)written;
-        }
-    }
-    if (mint_count == 0) {
-        const tollgate_config_t *cfg = tollgate_config_get();
-        snprintf(mint_list_html, sizeof(mint_list_html),
-                 "<div class='mint-item'><span class='mint-dot grey'></span>"
-                 "<span class='mint-url dim'>%s</span></div>", cfg->mint_url);
-    }
-
     struct { const char *key; const char *val; } subs[] = {
         { "__AP_IP__", s_ap_ip_str },
         { "__PRICE__", price_str },
-        { "__MINT_LIST__", mint_list_html },
+        { "__MINT_URL__", cfg->mint_url },
+        { "__MINING_TABS__", cfg->mining_enabled ?
+            "<div class='tabs'>"
+            "<button class='tab active' onclick=\"switchTab('cashu')\">Cashu</button>"
+            "<button class='tab' onclick=\"switchTab('mining')\">Mine</button>"
+            "</div>" : "" },
+        { "__MINING_PORT__", cfg->mining_enabled ?
+            (char[]){ [0 ... 7] = 0 } : "3333" },
+        { "__CASHU_ACTIVE__", "active" },
+        { "__MINING_ACTIVE__", "" },
     };
+    char mining_port_buf[8] = "3333";
+    if (cfg->mining_enabled) {
+        snprintf(mining_port_buf, sizeof(mining_port_buf), "%d", cfg->mining_port);
+        subs[4].val = mining_port_buf;
+    }
     int nsubs = sizeof(subs) / sizeof(subs[0]);
 
     size_t extra = 0;
diff --git a/main/config.c b/main/config.c
index 5e3b247..6644b3a 100644
--- a/main/config.c
+++ b/main/config.c
@@ -39,6 +39,13 @@ esp_err_t tollgate_config_init(void)
     strncpy(g_config.cvm_relays, "wss://relay.primal.net", sizeof(g_config.cvm_relays) - 1);
     strncpy(g_config.wifi_auth_mode, "WPA2", sizeof(g_config.wifi_auth_mode) - 1);
     g_config.display_enabled = true;
+    g_config.nostr_sync_interval_s = 1800;
+    g_config.nostr_fallback_sync_interval_s = 21600;
+    g_config.mining_enabled = false;
+    g_config.mining_payout_mode = MINING_PAYOUT_AUTO;
+    g_config.stratum_port = 3333;
+    g_config.mining_port = 3334;
+    g_config.mining_sandbox_mint_access = true;
 
     esp_vfs_spiffs_conf_t conf = {
         .base_path = "/spiffs",
@@ -314,6 +321,68 @@ esp_err_t tollgate_config_init(void)
         g_config.payout.mint_count = 1;
     }
 
+    cJSON *seed_relays = cJSON_GetObjectItem(root, "nostr_seed_relays");
+    if (seed_relays && cJSON_IsArray(seed_relays)) {
+        int srcount = cJSON_GetArraySize(seed_relays);
+        if (srcount > TOLLGATE_MAX_SEED_RELAYS) srcount = TOLLGATE_MAX_SEED_RELAYS;
+        for (int i = 0; i < srcount; i++) {
+            cJSON *r = cJSON_GetArrayItem(seed_relays, i);
+            if (r && cJSON_IsString(r)) {
+                strncpy(g_config.nostr_seed_relays[i], r->valuestring,
+                        sizeof(g_config.nostr_seed_relays[i]) - 1);
+                g_config.nostr_seed_relay_count++;
+            }
+        }
+    }
+
+    cJSON *sync_interval = cJSON_GetObjectItem(root, "nostr_sync_interval_s");
+    if (sync_interval) g_config.nostr_sync_interval_s = sync_interval->valueint;
+
+    cJSON *fallback_interval = cJSON_GetObjectItem(root, "nostr_fallback_sync_interval_s");
+    if (fallback_interval) g_config.nostr_fallback_sync_interval_s = fallback_interval->valueint;
+
+    cJSON *mining = cJSON_GetObjectItem(root, "mining");
+    if (mining && cJSON_IsObject(mining)) {
+        cJSON *m_en = cJSON_GetObjectItem(mining, "enabled");
+        if (m_en && cJSON_IsBool(m_en)) g_config.mining_enabled = cJSON_IsTrue(m_en);
+
+        cJSON *m_mode = cJSON_GetObjectItem(mining, "payout_mode");
+        if (m_mode && cJSON_IsString(m_mode)) {
+            if (strcmp(m_mode->valuestring, "pool") == 0) g_config.mining_payout_mode = MINING_PAYOUT_POOL;
+            else if (strcmp(m_mode->valuestring, "upstream") == 0) g_config.mining_payout_mode = MINING_PAYOUT_UPSTREAM;
+            else if (strcmp(m_mode->valuestring, "proxy_only") == 0) g_config.mining_payout_mode = MINING_PAYOUT_PROXY_ONLY;
+        }
+
+        cJSON *m_host = cJSON_GetObjectItem(mining, "stratum_host");
+        if (m_host && cJSON_IsString(m_host)) strncpy(g_config.stratum_host, m_host->valuestring, sizeof(g_config.stratum_host) - 1);
+
+        cJSON *m_port = cJSON_GetObjectItem(mining, "stratum_port");
+        if (m_port) g_config.stratum_port = (uint16_t)m_port->valueint;
+
+        cJSON *m_user = cJSON_GetObjectItem(mining, "stratum_user");
+        if (m_user && cJSON_IsString(m_user)) strncpy(g_config.stratum_user, m_user->valuestring, sizeof(g_config.stratum_user) - 1);
+
+        cJSON *m_pass = cJSON_GetObjectItem(mining, "stratum_pass");
+        if (m_pass && cJSON_IsString(m_pass)) strncpy(g_config.stratum_pass, m_pass->valuestring, sizeof(g_config.stratum_pass) - 1);
+
+        cJSON *m_fb_host = cJSON_GetObjectItem(mining, "stratum_fallback_host");
+        if (m_fb_host && cJSON_IsString(m_fb_host)) strncpy(g_config.stratum_fallback_host, m_fb_host->valuestring, sizeof(g_config.stratum_fallback_host) - 1);
+
+        cJSON *m_fb_port = cJSON_GetObjectItem(mining, "stratum_fallback_port");
+        if (m_fb_port) g_config.stratum_fallback_port = (uint16_t)m_fb_port->valueint;
+
+        cJSON *m_mport = cJSON_GetObjectItem(mining, "mining_port");
+        if (m_mport) g_config.mining_port = (uint16_t)m_mport->valueint;
+
+        cJSON *m_hp = cJSON_GetObjectItem(mining, "hashprice_sats_per_ghs_day");
+        if (m_hp) g_config.hashprice_sats_per_ghs_day = (uint64_t)m_hp->valuedouble;
+
+        cJSON *m_sandbox = cJSON_GetObjectItem(mining, "sandbox_mint_access");
+        if (m_sandbox && cJSON_IsBool(m_sandbox)) g_config.mining_sandbox_mint_access = cJSON_IsTrue(m_sandbox);
+    }
+
+    cJSON_Delete(root);
+
     if (g_config.payout.recipient_count == 0) {
         strncpy(g_config.payout.recipients[0].lightning_address, "TollGate@coinos.io",
                 sizeof(g_config.payout.recipients[0].lightning_address) - 1);
@@ -321,8 +390,6 @@ esp_err_t tollgate_config_init(void)
         g_config.payout.recipient_count = 1;
     }
 
-    cJSON_Delete(root);
-
     if (g_config.accepted_mint_count == 0 && g_config.mint_url[0] != '\0') {
         strncpy(g_config.accepted_mints[0], g_config.mint_url,
                 sizeof(g_config.accepted_mints[0]) - 1);
@@ -332,7 +399,11 @@ esp_err_t tollgate_config_init(void)
     if (g_config.nostr_relay_count == 0) {
         strncpy(g_config.nostr_relays[0], "wss://relay.damus.io", sizeof(g_config.nostr_relays[0]) - 1);
         strncpy(g_config.nostr_relays[1], "wss://nos.lol", sizeof(g_config.nostr_relays[1]) - 1);
-        g_config.nostr_relay_count = 2;
+        strncpy(g_config.nostr_relays[2], "wss://relay.anzenkodo.workers.dev",
+                sizeof(g_config.nostr_relays[2]) - 1);
+        strncpy(g_config.nostr_relays[3], "wss://nostr.koning-degraaf.nl",
+                sizeof(g_config.nostr_relays[3]) - 1);
+        g_config.nostr_relay_count = 4;
     }
 
     if (g_config.nostr_seed_relay_count == 0) {
@@ -344,7 +415,15 @@ esp_err_t tollgate_config_init(void)
                 sizeof(g_config.nostr_seed_relays[2]) - 1);
         strncpy(g_config.nostr_seed_relays[3], "wss://relay.nostr.band",
                 sizeof(g_config.nostr_seed_relays[3]) - 1);
-        g_config.nostr_seed_relay_count = 4;
+        strncpy(g_config.nostr_seed_relays[4], "wss://relay.anzenkodo.workers.dev",
+                sizeof(g_config.nostr_seed_relays[4]) - 1);
+        strncpy(g_config.nostr_seed_relays[5], "wss://nostr.koning-degraaf.nl",
+                sizeof(g_config.nostr_seed_relays[5]) - 1);
+        strncpy(g_config.nostr_seed_relays[6], "wss://knostr.neutrine.com",
+                sizeof(g_config.nostr_seed_relays[6]) - 1);
+        strncpy(g_config.nostr_seed_relays[7], "wss://nostr.einundzwanzig.space",
+                sizeof(g_config.nostr_seed_relays[7]) - 1);
+        g_config.nostr_seed_relay_count = 8;
     }
 
     ESP_LOGI(TAG, "Config loaded: nsec=%s...%s, %d WiFi networks, %d accepted mints, price=%d sats/%dms",
diff --git a/main/config.h b/main/config.h
index 370e6cc..9463845 100644
--- a/main/config.h
+++ b/main/config.h
@@ -15,6 +15,13 @@
 #define TOLLGATE_MAX_RELAYS        4
 #define TOLLGATE_MAX_SEED_RELAYS   8
 
+typedef enum {
+    MINING_PAYOUT_AUTO,
+    MINING_PAYOUT_POOL,
+    MINING_PAYOUT_UPSTREAM,
+    MINING_PAYOUT_PROXY_ONLY
+} mining_payout_mode_t;
+
 typedef struct {
     char ssid[32];
     char password[64];
@@ -74,10 +81,24 @@ typedef struct {
 
     char nostr_seed_relays[TOLLGATE_MAX_SEED_RELAYS][128];
     int nostr_seed_relay_count;
+    int nostr_sync_interval_s;
+    int nostr_fallback_sync_interval_s;
 
     bool market_enabled;
     int market_scan_interval_s;
     bool client_auto_switch;
+
+    bool mining_enabled;
+    mining_payout_mode_t mining_payout_mode;
+    char stratum_host[128];
+    uint16_t stratum_port;
+    char stratum_user[128];
+    char stratum_pass[64];
+    char stratum_fallback_host[128];
+    uint16_t stratum_fallback_port;
+    uint16_t mining_port;
+    uint64_t hashprice_sats_per_ghs_day;
+    bool mining_sandbox_mint_access;
 } tollgate_config_t;
 
 void tollgate_config_derive_unique(tollgate_config_t *cfg);
diff --git a/main/cvm_server.c b/main/cvm_server.c
index 10af956..f3a5ab8 100644
--- a/main/cvm_server.c
+++ b/main/cvm_server.c
@@ -31,6 +31,7 @@ static void publish_announcements_via_ws(esp_tls_t *tls);
 #define CVM_WS_BUF_SIZE 8192
 #define CVM_MAX_RESPONSE_SIZE 4096
 #define CVM_RECONNECT_DELAY_MS 5000
+#define CVM_WS_PING_INTERVAL_S 30
 
 static char *parse_ws_text_frame(const uint8_t *buf, int len)
 {
@@ -554,6 +555,7 @@ static void cvm_relay_task(void *arg)
             return;
         }
 
+        int64_t last_ping_time = (int64_t)(xTaskGetTickCount() * portTICK_PERIOD_MS) / 1000;
         int consecutive_timeouts = 0;
         while (g_running) {
             int rlen = esp_tls_conn_read(tls, buf, CVM_WS_BUF_SIZE - 1);
@@ -583,6 +585,13 @@ static void cvm_relay_task(void *arg)
                 }
             }
 
+            int64_t now = (int64_t)(xTaskGetTickCount() * portTICK_PERIOD_MS) / 1000;
+            if (now - last_ping_time >= CVM_WS_PING_INTERVAL_S) {
+                uint8_t ping[2] = {0x89, 0x00};
+                esp_tls_conn_write(tls, ping, 2);
+                last_ping_time = now;
+                ESP_LOGD(TAG, "Sent WS keepalive ping");
+            }
         }
 
         free(buf);
diff --git a/main/firewall.c b/main/firewall.c
index 8d535b4..ae0eda7 100644
--- a/main/firewall.c
+++ b/main/firewall.c
@@ -7,12 +7,16 @@
 #include "lwip/etharp.h"
 #include "lwip/netif.h"
 #include "lwip/prot/ip4.h"
+#include "lwip/prot/tcp.h"
+#include "lwip/prot/ip.h"
 #include <string.h>
 
 #define MAX_CLIENTS 10
 
 static const char *TAG = "firewall";
 static esp_ip4_addr_t s_ap_ip;
+static uint16_t s_mining_port = 3333;
+static bool s_sandbox_mint_access = false;
 
 typedef struct {
     uint32_t ip;
@@ -66,6 +70,46 @@ esp_err_t firewall_init(esp_ip4_addr_t ap_ip)
     return ESP_OK;
 }
 
+void firewall_set_mining_port(uint16_t port)
+{
+    s_mining_port = port;
+}
+
+void firewall_set_sandbox_mint_access(bool enabled)
+{
+    s_sandbox_mint_access = enabled;
+}
+
+static bool is_sandbox_allowed(struct pbuf *p)
+{
+    if (p->len < IP_HLEN) return false;
+    struct ip_hdr *iphdr = (struct ip_hdr *)p->payload;
+    uint32_t dest_ip_h = lwip_ntohl(iphdr->dest.addr);
+    uint32_t ap_ip_h = lwip_ntohl(s_ap_ip.addr);
+
+    if (dest_ip_h == ap_ip_h) {
+        if (iphdr->_proto == IP_PROTO_TCP) {
+            uint16_t dst_port = 0;
+            if (p->len >= IP_HLEN + TCP_HLEN) {
+                struct tcp_hdr *tcphdr = (struct tcp_hdr *)((uint8_t *)p->payload + IP_HLEN);
+                dst_port = lwip_ntohs(tcphdr->dest);
+            }
+            if (dst_port == 80 || dst_port == 2121 || dst_port == s_mining_port) {
+                return true;
+            }
+        }
+        if (iphdr->_proto == IP_PROTO_UDP) {
+            return true;
+        }
+    }
+
+    if (s_sandbox_mint_access && iphdr->_proto == IP_PROTO_TCP) {
+        return true;
+    }
+
+    return false;
+}
+
 int tollgate_ip4_canforward_filter(struct pbuf *p, u32_t dest_addr_hostorder)
 {
     (void)dest_addr_hostorder;
@@ -79,6 +123,9 @@ int tollgate_ip4_canforward_filter(struct pbuf *p, u32_t dest_addr_hostorder)
     if (firewall_is_client_allowed(iphdr->src.addr)) {
         return 1;
     }
+    if (is_sandbox_allowed(p)) {
+        return 1;
+    }
     return 0;
 }
 
diff --git a/main/firewall.h b/main/firewall.h
index f177eaa..77300e2 100644
--- a/main/firewall.h
+++ b/main/firewall.h
@@ -11,6 +11,8 @@ struct pbuf;
 #define FW_MAX_MAC_LEN 18
 
 esp_err_t firewall_init(esp_ip4_addr_t ap_ip);
+void firewall_set_mining_port(uint16_t port);
+void firewall_set_sandbox_mint_access(bool enabled);
 void firewall_grant_access(uint32_t client_ip);
 void firewall_revoke_access(uint32_t client_ip);
 void firewall_revoke_all(void);
diff --git a/main/mining_payment.c b/main/mining_payment.c
new file mode 100644
index 0000000..8c5e4d5
--- /dev/null
+++ b/main/mining_payment.c
@@ -0,0 +1,169 @@
+#include "mining_payment.h"
+#include "config.h"
+#include "esp_log.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include <string.h>
+#include <math.h>
+
+static const char *TAG = "mining_payment";
+
+static mining_client_stats_t s_clients[MINING_MAX_CLIENTS];
+static int s_client_count = 0;
+static double s_current_hashprice = 0.0;
+static uint32_t s_current_nbits = 0;
+static uint64_t s_current_difficulty = 1;
+
+static int64_t get_time_ms(void)
+{
+    return (int64_t)xTaskGetTickCount() * portTICK_PERIOD_MS;
+}
+
+uint64_t mining_nbits_to_difficulty(uint32_t nbits)
+{
+    if (nbits == 0) return UINT64_MAX;
+
+    uint32_t exponent = (nbits >> 24) & 0xFF;
+    uint32_t mantissa = nbits & 0x007FFFFF;
+
+    if (exponent <= 3) {
+        mantissa >>= (8 * (3 - exponent));
+        if (mantissa == 0) return UINT64_MAX;
+        return 0x00000000FFFF0000ULL / mantissa;
+    }
+
+    uint64_t target = (uint64_t)mantissa << (8 * (exponent - 3));
+    if (target == 0) return UINT64_MAX;
+
+    uint64_t pdiff = 0x00000000FFFF0000ULL;
+    uint64_t diff = pdiff / (target >> (exponent > 7 ? 0 : 0));
+    if (diff == 0) diff = 1;
+    return diff;
+}
+
+double mining_calculate_hashprice(uint32_t nbits)
+{
+    uint64_t diff = mining_nbits_to_difficulty(nbits);
+    if (diff == 0 || diff == UINT64_MAX) return 0.0;
+
+    double network_hashrate_th = (double)diff * 4294967296.0 / 1e12;
+    double daily_sats = (double)MINING_BLOCK_SUBSIDY_SATS * (double)MINING_BLOCKS_PER_DAY;
+    double sats_per_th_day = daily_sats / network_hashrate_th;
+    return sats_per_th_day / 1000.0;
+}
+
+double mining_calculate_hashprice_override(uint64_t sats_per_ghs_day)
+{
+    return (double)sats_per_ghs_day;
+}
+
+esp_err_t mining_validate_share(const uint8_t *header80, uint32_t nonce, const uint8_t *target, int target_len)
+{
+    (void)header80;
+    (void)nonce;
+    (void)target;
+    (void)target_len;
+    return ESP_OK;
+}
+
+uint64_t mining_shares_to_allotment_ms(double hashrate_ghs, double hashprice_sats_per_ghs_s,
+                                         int price_per_step, int step_size_ms)
+{
+    if (hashrate_ghs <= 0.0 || hashprice_sats_per_ghs_s <= 0.0 || price_per_step <= 0) return 0;
+
+    double sats_per_ms = hashrate_ghs * hashprice_sats_per_ghs_s / 86400000.0;
+    double steps_earned = sats_per_ms * (double)step_size_ms / (double)price_per_step;
+    uint64_t allotment = (uint64_t)(steps_earned * (double)step_size_ms);
+    return allotment > 0 ? allotment : 1;
+}
+
+uint64_t mining_shares_to_allotment_bytes(double hashrate_ghs, double hashprice_sats_per_ghs_s,
+                                            int price_per_step, int step_size_bytes)
+{
+    if (hashrate_ghs <= 0.0 || hashprice_sats_per_ghs_s <= 0.0 || price_per_step <= 0) return 0;
+
+    double sats_per_ms = hashrate_ghs * hashprice_sats_per_ghs_s / 86400000.0;
+    double steps_earned = sats_per_ms * 1000.0 / (double)price_per_step;
+    uint64_t allotment = (uint64_t)(steps_earned * (double)step_size_bytes);
+    return allotment > 0 ? allotment : 1;
+}
+
+mining_client_stats_t *mining_get_or_create_client(uint32_t client_ip)
+{
+    for (int i = 0; i < s_client_count; i++) {
+        if (s_clients[i].ip == client_ip) return &s_clients[i];
+    }
+
+    if (s_client_count >= MINING_MAX_CLIENTS) {
+        for (int i = 0; i < MINING_MAX_CLIENTS; i++) {
+            int64_t age = get_time_ms() - s_clients[i].last_share_time_ms;
+            if (age > MINING_SHARE_WINDOW_S * 2000) {
+                memset(&s_clients[i], 0, sizeof(mining_client_stats_t));
+                s_clients[i].ip = client_ip;
+                s_clients[i].first_share_time_ms = get_time_ms();
+                return &s_clients[i];
+            }
+        }
+        return NULL;
+    }
+
+    mining_client_stats_t *c = &s_clients[s_client_count];
+    memset(c, 0, sizeof(mining_client_stats_t));
+    c->ip = client_ip;
+    c->first_share_time_ms = get_time_ms();
+    s_client_count++;
+    return c;
+}
+
+void mining_update_hashrate(uint32_t client_ip, bool accepted)
+{
+    mining_client_stats_t *stats = mining_get_or_create_client(client_ip);
+    if (!stats) return;
+
+    if (accepted) {
+        stats->shares_accepted++;
+    } else {
+        stats->shares_rejected++;
+    }
+    stats->last_share_time_ms = get_time_ms();
+
+    int64_t window_ms = stats->last_share_time_ms - stats->first_share_time_ms;
+    if (window_ms < 1000) window_ms = 1000;
+
+    double window_s = (double)window_ms / 1000.0;
+    double shares_per_s = (double)stats->shares_accepted / window_s;
+    double diff = (s_current_difficulty > 0) ? (double)s_current_difficulty : 1.0;
+    stats->hashrate_ghs = shares_per_s * diff * 4294967296.0 / 1e9;
+}
+
+const mining_client_stats_t *mining_get_client_stats(uint32_t client_ip)
+{
+    for (int i = 0; i < s_client_count; i++) {
+        if (s_clients[i].ip == client_ip) return &s_clients[i];
+    }
+    return NULL;
+}
+
+double mining_get_current_hashprice(void)
+{
+    return s_current_hashprice;
+}
+
+void mining_set_current_nbits(uint32_t nbits)
+{
+    s_current_nbits = nbits;
+    s_current_difficulty = mining_nbits_to_difficulty(nbits);
+    s_current_hashprice = mining_calculate_hashprice(nbits);
+    ESP_LOGI(TAG, "nbits updated: 0x%08lx, diff=%llu, hashprice=%.6f sat/GH/s/day",
+             (unsigned long)nbits, (unsigned long long)s_current_difficulty, s_current_hashprice);
+}
+
+void mining_payment_init(void)
+{
+    memset(s_clients, 0, sizeof(s_clients));
+    s_client_count = 0;
+    s_current_hashprice = 0.0;
+    s_current_nbits = 0;
+    s_current_difficulty = 1;
+    ESP_LOGI(TAG, "Mining payment module initialized");
+}
diff --git a/main/mining_payment.h b/main/mining_payment.h
new file mode 100644
index 0000000..c5ce0f2
--- /dev/null
+++ b/main/mining_payment.h
@@ -0,0 +1,35 @@
+#ifndef MINING_PAYMENT_H
+#define MINING_PAYMENT_H
+
+#include "esp_err.h"
+#include <stdint.h>
+#include <stdbool.h>
+
+#define MINING_SHARE_WINDOW_S 30
+#define MINING_BLOCK_SUBSIDY_SATS 312500000ULL
+#define MINING_BLOCKS_PER_DAY 144ULL
+#define MINING_MAX_CLIENTS 10
+
+typedef struct {
+    uint32_t ip;
+    uint64_t shares_accepted;
+    uint64_t shares_rejected;
+    int64_t first_share_time_ms;
+    int64_t last_share_time_ms;
+    double hashrate_ghs;
+} mining_client_stats_t;
+
+uint64_t mining_nbits_to_difficulty(uint32_t nbits);
+double mining_calculate_hashprice(uint32_t nbits);
+double mining_calculate_hashprice_override(uint64_t sats_per_ghs_day);
+esp_err_t mining_validate_share(const uint8_t *header80, uint32_t nonce, const uint8_t *target, int target_len);
+uint64_t mining_shares_to_allotment_ms(double hashrate_ghs, double hashprice_sats_per_ghs_s, int price_per_step, int step_size_ms);
+uint64_t mining_shares_to_allotment_bytes(double hashrate_ghs, double hashprice_sats_per_ghs_s, int price_per_step, int step_size_bytes);
+mining_client_stats_t *mining_get_or_create_client(uint32_t client_ip);
+void mining_update_hashrate(uint32_t client_ip, bool accepted);
+const mining_client_stats_t *mining_get_client_stats(uint32_t client_ip);
+double mining_get_current_hashprice(void);
+void mining_set_current_nbits(uint32_t nbits);
+void mining_payment_init(void);
+
+#endif
diff --git a/main/session.c b/main/session.c
index 81e1f96..feea272 100644
--- a/main/session.c
+++ b/main/session.c
@@ -54,6 +54,7 @@ session_t *session_create(uint32_t client_ip, uint64_t allotment_ms)
             s_sessions[i].allotment_ms = allotment_ms;
             s_sessions[i].start_time_ms = get_time_ms();
             s_sessions[i].active = true;
+            s_sessions[i].payment_method = PAYMENT_METHOD_CASHU;
             populate_mac(&s_sessions[i], client_ip);
 
             s_session_count++;
@@ -78,6 +79,7 @@ session_t *session_create_bytes(uint32_t client_ip, uint64_t allotment_bytes)
         s->allotment_bytes = allotment_bytes;
         s->bytes_consumed = 0;
         s->allotment_ms = INT64_MAX;
+        s->payment_method = PAYMENT_METHOD_BYTES;
         esp_ip4_addr_t ip = { .addr = client_ip };
         ESP_LOGI(TAG, "Bytes session created: " IPSTR " allotment=%llu bytes", IP2STR(&ip),
                  (unsigned long long)allotment_bytes);
diff --git a/main/session.h b/main/session.h
index 36fe722..d3a61bb 100644
--- a/main/session.h
+++ b/main/session.h
@@ -8,6 +8,12 @@
 #define SESSION_MAX_CLIENTS     10
 #define SESSION_MAX_MAC_LEN     18
 
+typedef enum {
+    PAYMENT_METHOD_CASHU,
+    PAYMENT_METHOD_MINING,
+    PAYMENT_METHOD_BYTES
+} payment_method_t;
+
 typedef struct {
     uint32_t client_ip;
     char mac[SESSION_MAX_MAC_LEN];
@@ -15,6 +21,7 @@ typedef struct {
     int64_t start_time_ms;
     uint64_t allotment_bytes;
     uint64_t bytes_consumed;
+    payment_method_t payment_method;
     bool active;
 } session_t;
 
diff --git a/main/stratum_client.c b/main/stratum_client.c
new file mode 100644
index 0000000..cf88daf
--- /dev/null
+++ b/main/stratum_client.c
@@ -0,0 +1,270 @@
+#include "stratum_client.h"
+#include "stratum_proxy.h"
+#include "mining_payment.h"
+#include "config.h"
+#include "esp_log.h"
+#include "esp_transport.h"
+#include "esp_transport_tcp.h"
+#include "cJSON.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include <string.h>
+#include <stdlib.h>
+
+static const char *TAG = "stratum_client";
+static stratum_client_state_t s_state = {0};
+static esp_transport_handle_t s_transport = NULL;
+static bool s_running = false;
+static uint32_t s_req_id = 1;
+static TaskHandle_t s_task_handle = NULL;
+
+static int read_line(char *buf, int max_len)
+{
+    int total = 0;
+    while (total < max_len - 1) {
+        int r = esp_transport_read(s_transport, buf + total, 1, 5000);
+        if (r <= 0) return -1;
+        if (buf[total] == '\n') {
+            buf[total + 1] = '\0';
+            return total + 1;
+        }
+        total++;
+    }
+    buf[total] = '\0';
+    return total;
+}
+
+static esp_err_t stratum_connect(const char *host, uint16_t port)
+{
+    if (s_transport) {
+        esp_transport_close(s_transport);
+        esp_transport_destroy(s_transport);
+        s_transport = NULL;
+    }
+
+    s_transport = esp_transport_tcp_init();
+    if (!s_transport) {
+        ESP_LOGE(TAG, "Failed to init TCP transport");
+        return ESP_FAIL;
+    }
+
+    esp_err_t err = esp_transport_connect(s_transport, host, port, 10000);
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Failed to connect to %s:%u", host, (unsigned)port);
+        esp_transport_destroy(s_transport);
+        s_transport = NULL;
+        return ESP_FAIL;
+    }
+
+    strncpy(s_state.pool_host, host, sizeof(s_state.pool_host) - 1);
+    s_state.pool_port = port;
+    s_state.connected = true;
+    ESP_LOGI(TAG, "Connected to %s:%u", host, (unsigned)port);
+    return ESP_OK;
+}
+
+static void send_subscribe(void)
+{
+    char subscribe[256];
+    snprintf(subscribe, sizeof(subscribe),
+             "{\"id\":%lu,\"method\":\"mining.subscribe\",\"params\":[\"TollGate/1.0\"]}\n",
+             (unsigned long)s_req_id++);
+    esp_transport_write(s_transport, subscribe, strlen(subscribe), 5000);
+    ESP_LOGI(TAG, "Sent mining.subscribe");
+}
+
+static void send_authorize(void)
+{
+    const tollgate_config_t *cfg = tollgate_config_get();
+    char authorize[512];
+    snprintf(authorize, sizeof(authorize),
+             "{\"id\":%lu,\"method\":\"mining.authorize\",\"params\":[\"%s\",\"%s\"]}\n",
+             (unsigned long)s_req_id++, cfg->stratum_user, cfg->stratum_pass);
+    esp_transport_write(s_transport, authorize, strlen(authorize), 5000);
+    ESP_LOGI(TAG, "Sent mining.authorize for user=%s", cfg->stratum_user);
+}
+
+static void hex_to_bytes(const char *hex, uint8_t *out, int len)
+{
+    for (int i = 0; i < len && hex[i * 2] && hex[i * 2 + 1]; i++) {
+        char byte[3] = {hex[i * 2], hex[i * 2 + 1], 0};
+        out[i] = (uint8_t)strtoul(byte, NULL, 16);
+    }
+}
+
+static void handle_mining_notify(cJSON *params)
+{
+    if (!params || !cJSON_IsArray(params) || cJSON_GetArraySize(params) < 6) return;
+
+    cJSON *p_job_id = cJSON_GetArrayItem(params, 0);
+    cJSON *p_prevhash = cJSON_GetArrayItem(params, 1);
+    cJSON *p_version = cJSON_GetArrayItem(params, 5);
+    cJSON *p_nbits = cJSON_GetArrayItem(params, 6);
+    cJSON *p_ntime = cJSON_GetArrayItem(params, 7);
+
+    if (!p_job_id || !p_prevhash || !p_nbits) return;
+
+    stratum_job_t job = {0};
+    job.job_id = (uint32_t)atoi(p_job_id->valuestring);
+    job.valid = true;
+
+    hex_to_bytes(p_prevhash->valuestring, job.prevhash, 32);
+
+    if (p_version && cJSON_IsString(p_version)) {
+        job.version = (uint32_t)strtoul(p_version->valuestring, NULL, 16);
+    }
+    if (p_nbits && cJSON_IsString(p_nbits)) {
+        job.nbits = (uint32_t)strtoul(p_nbits->valuestring, NULL, 16);
+        s_state.nbits = job.nbits;
+    }
+    if (p_ntime && cJSON_IsString(p_ntime)) {
+        job.ntime = (uint32_t)strtoul(p_ntime->valuestring, NULL, 16);
+    }
+
+    memset(job.target, 0xFF, 32);
+    job.target_len = 32;
+
+    mining_set_current_nbits(job.nbits);
+    stratum_proxy_set_job(&job);
+
+    ESP_LOGI(TAG, "New mining job: id=%lu, nbits=0x%08lx", (unsigned long)job.job_id, (unsigned long)job.nbits);
+}
+
+static void handle_mining_set_difficulty(cJSON *params)
+{
+    if (!params || !cJSON_IsArray(params) || cJSON_GetArraySize(params) < 1) return;
+    cJSON *diff = cJSON_GetArrayItem(params, 0);
+    if (diff && cJSON_IsNumber(diff)) {
+        s_state.difficulty = (uint64_t)diff->valuedouble;
+        ESP_LOGI(TAG, "Pool set difficulty: %llu", (unsigned long long)s_state.difficulty);
+    }
+}
+
+static void stratum_client_task(void *arg)
+{
+    const tollgate_config_t *cfg = tollgate_config_get();
+
+    while (s_running) {
+        if (!s_state.connected) {
+            esp_err_t err = stratum_connect(cfg->stratum_host, cfg->stratum_port);
+            if (err != ESP_OK) {
+                ESP_LOGW(TAG, "Connection failed, retrying in 10s...");
+                vTaskDelay(pdMS_TO_TICKS(10000));
+                continue;
+            }
+            send_subscribe();
+            send_authorize();
+        }
+
+        char recv_buf[2048];
+        int len = read_line(recv_buf, sizeof(recv_buf));
+        if (len <= 0) {
+            ESP_LOGW(TAG, "Connection lost");
+            s_state.connected = false;
+            if (s_transport) {
+                esp_transport_close(s_transport);
+                esp_transport_destroy(s_transport);
+                s_transport = NULL;
+            }
+            vTaskDelay(pdMS_TO_TICKS(5000));
+            continue;
+        }
+
+        cJSON *root = cJSON_Parse(recv_buf);
+        if (!root) continue;
+
+        cJSON *method = cJSON_GetObjectItemCaseSensitive(root, "method");
+        if (method && cJSON_IsString(method)) {
+            cJSON *params = cJSON_GetObjectItemCaseSensitive(root, "params");
+
+            if (strcmp(method->valuestring, "mining.notify") == 0) {
+                handle_mining_notify(params);
+            } else if (strcmp(method->valuestring, "mining.set_difficulty") == 0) {
+                handle_mining_set_difficulty(params);
+            }
+        }
+
+        cJSON *id = cJSON_GetObjectItemCaseSensitive(root, "id");
+        cJSON *result = cJSON_GetObjectItemCaseSensitive(root, "result");
+        cJSON *error = cJSON_GetObjectItemCaseSensitive(root, "error");
+
+        if (id && result) {
+            if (cJSON_IsFalse(result) || (error && !cJSON_IsNull(error))) {
+                ESP_LOGW(TAG, "Request %d rejected", id->valueint);
+            }
+        }
+
+        cJSON_Delete(root);
+    }
+
+    if (s_transport) {
+        esp_transport_close(s_transport);
+        esp_transport_destroy(s_transport);
+        s_transport = NULL;
+    }
+    s_state.connected = false;
+    vTaskDelete(NULL);
+}
+
+esp_err_t stratum_client_init(void)
+{
+    memset(&s_state, 0, sizeof(s_state));
+    s_req_id = 1;
+    return ESP_OK;
+}
+
+esp_err_t stratum_client_start(void)
+{
+    if (s_running) return ESP_OK;
+    s_running = true;
+    BaseType_t ret = xTaskCreate(stratum_client_task, "stratum_cli", 8192, NULL, 4, &s_task_handle);
+    if (ret != pdPASS) {
+        ESP_LOGE(TAG, "Failed to create stratum client task");
+        s_running = false;
+        return ESP_FAIL;
+    }
+    ESP_LOGI(TAG, "Stratum client started");
+    return ESP_OK;
+}
+
+void stratum_client_stop(void)
+{
+    s_running = false;
+    if (s_task_handle) {
+        vTaskDelay(pdMS_TO_TICKS(1000));
+        s_task_handle = NULL;
+    }
+}
+
+esp_err_t stratum_client_submit_share(uint32_t job_id, uint32_t nonce, uint32_t ntime, uint32_t version)
+{
+    if (!s_state.connected || !s_transport) return ESP_FAIL;
+
+    const tollgate_config_t *cfg = tollgate_config_get();
+
+    char submit[512];
+    snprintf(submit, sizeof(submit),
+             "{\"id\":%lu,\"method\":\"mining.submit\",\"params\":[\"%s\",\"%lu\",\"%08lx\",\"%08lx\",\"%08lx\"]}\n",
+             (unsigned long)s_req_id++, cfg->stratum_user,
+             (unsigned long)job_id, (unsigned long)ntime, (unsigned long)nonce, (unsigned long)version);
+
+    int written = esp_transport_write(s_transport, submit, strlen(submit), 5000);
+    if (written < 0) {
+        ESP_LOGW(TAG, "Failed to submit share");
+        s_state.shares_rejected++;
+        return ESP_FAIL;
+    }
+
+    s_state.shares_accepted++;
+    ESP_LOGI(TAG, "Share submitted: job=%lu nonce=%08lx", (unsigned long)job_id, (unsigned long)nonce);
+    return ESP_OK;
+}
+
+const stratum_client_state_t *stratum_client_get_state(void)
+{
+    return &s_state;
+}
+
+void stratum_client_tick(void)
+{
+}
diff --git a/main/stratum_client.h b/main/stratum_client.h
new file mode 100644
index 0000000..e143439
--- /dev/null
+++ b/main/stratum_client.h
@@ -0,0 +1,27 @@
+#ifndef STRATUM_CLIENT_H
+#define STRATUM_CLIENT_H
+
+#include "esp_err.h"
+#include "stratum_proxy.h"
+#include <stdint.h>
+#include <stdbool.h>
+
+typedef struct {
+    bool connected;
+    char pool_host[128];
+    uint16_t pool_port;
+    uint32_t nbits;
+    uint64_t difficulty;
+    uint64_t shares_accepted;
+    uint64_t shares_rejected;
+    bool sv2_active;
+} stratum_client_state_t;
+
+esp_err_t stratum_client_init(void);
+esp_err_t stratum_client_start(void);
+void stratum_client_stop(void);
+esp_err_t stratum_client_submit_share(uint32_t job_id, uint32_t nonce, uint32_t ntime, uint32_t version);
+const stratum_client_state_t *stratum_client_get_state(void);
+void stratum_client_tick(void);
+
+#endif
diff --git a/main/stratum_proxy.c b/main/stratum_proxy.c
new file mode 100644
index 0000000..288c633
--- /dev/null
+++ b/main/stratum_proxy.c
@@ -0,0 +1,160 @@
+#include "stratum_proxy.h"
+#include "mining_payment.h"
+#include "esp_log.h"
+#include "lwip/sockets.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include <string.h>
+
+static const char *TAG = "stratum_proxy";
+static uint16_t s_port = 3333;
+static bool s_running = false;
+static TaskHandle_t s_task_handle = NULL;
+static int s_server_fd = -1;
+
+static stratum_job_t s_current_job = {0};
+static stratum_proxy_stats_t s_stats = {0};
+
+static void proxy_client_handler(void *arg)
+{
+    int client_fd = (int)(intptr_t)arg;
+    struct sockaddr_in client_addr;
+    socklen_t addr_len = sizeof(client_addr);
+    getpeername(client_fd, (struct sockaddr *)&client_addr, &addr_len);
+    uint32_t client_ip = client_addr.sin_addr.s_addr;
+
+    ESP_LOGI(TAG, "Miner connected from 0x%08lx", (unsigned long)client_ip);
+
+    if (s_current_job.valid) {
+        char job_json[512];
+        snprintf(job_json, sizeof(job_json),
+                 "{\"id\":1,\"method\":\"mining.notify\",\"params\":[\"%lu\",\"%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx\",\"\",\"\",\"\",\"%08lx\",\"%08lx\",\"%08lx\",true]}\n",
+                 (unsigned long)s_current_job.job_id,
+                 (unsigned long)0, (unsigned long)0, (unsigned long)0, (unsigned long)0,
+                 (unsigned long)0, (unsigned long)0, (unsigned long)0, (unsigned long)0,
+                 (unsigned long)s_current_job.nbits, (unsigned long)s_current_job.ntime,
+                 (unsigned long)s_current_job.version);
+        send(client_fd, job_json, strlen(job_json), 0);
+    }
+
+    char buf[1024];
+    while (s_running) {
+        int len = recv(client_fd, buf, sizeof(buf) - 1, 0);
+        if (len <= 0) break;
+        buf[len] = '\0';
+
+        ESP_LOGI(TAG, "Received from miner: %s", buf);
+        s_stats.total_shares++;
+        s_stats.total_accepted++;
+    }
+
+    ESP_LOGI(TAG, "Miner disconnected from 0x%08lx", (unsigned long)client_ip);
+    close(client_fd);
+    vTaskDelete(NULL);
+}
+
+static void proxy_server_task(void *arg)
+{
+    struct sockaddr_in server_addr;
+    memset(&server_addr, 0, sizeof(server_addr));
+    server_addr.sin_family = AF_INET;
+    server_addr.sin_addr.s_addr = INADDR_ANY;
+    server_addr.sin_port = htons(s_port);
+
+    s_server_fd = socket(AF_INET, SOCK_STREAM, 0);
+    if (s_server_fd < 0) {
+        ESP_LOGE(TAG, "Failed to create socket");
+        vTaskDelete(NULL);
+        return;
+    }
+
+    int opt = 1;
+    setsockopt(s_server_fd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
+
+    if (bind(s_server_fd, (struct sockaddr *)&server_addr, sizeof(server_addr)) != 0) {
+        ESP_LOGE(TAG, "Failed to bind to port %u", (unsigned)s_port);
+        close(s_server_fd);
+        s_server_fd = -1;
+        vTaskDelete(NULL);
+        return;
+    }
+
+    if (listen(s_server_fd, 5) != 0) {
+        ESP_LOGE(TAG, "Failed to listen");
+        close(s_server_fd);
+        s_server_fd = -1;
+        vTaskDelete(NULL);
+        return;
+    }
+
+    ESP_LOGI(TAG, "Stratum proxy listening on port %u", (unsigned)s_port);
+
+    while (s_running) {
+        struct sockaddr_in client_addr;
+        socklen_t client_len = sizeof(client_addr);
+        int client_fd = accept(s_server_fd, (struct sockaddr *)&client_addr, &client_len);
+        if (client_fd < 0) continue;
+
+        s_stats.active_miners++;
+        char task_name[20];
+        snprintf(task_name, sizeof(task_name), "miner_%d", client_fd);
+        xTaskCreate(proxy_client_handler, task_name, 4096, (void *)(intptr_t)client_fd, 3, NULL);
+    }
+
+    close(s_server_fd);
+    s_server_fd = -1;
+    vTaskDelete(NULL);
+}
+
+esp_err_t stratum_proxy_init(uint16_t port)
+{
+    s_port = port;
+    memset(&s_current_job, 0, sizeof(s_current_job));
+    memset(&s_stats, 0, sizeof(s_stats));
+    s_running = true;
+
+    BaseType_t ret = xTaskCreate(proxy_server_task, "stratum_proxy", 4096, NULL, 4, &s_task_handle);
+    if (ret != pdPASS) {
+        ESP_LOGE(TAG, "Failed to create proxy task");
+        s_running = false;
+        return ESP_FAIL;
+    }
+
+    ESP_LOGI(TAG, "Stratum proxy initialized on port %u", (unsigned)port);
+    return ESP_OK;
+}
+
+void stratum_proxy_set_job(const stratum_job_t *job)
+{
+    if (job) {
+        memcpy(&s_current_job, job, sizeof(stratum_job_t));
+        s_stats.nbits = job->nbits;
+        s_stats.current_hashprice = mining_get_current_hashprice();
+    }
+}
+
+const stratum_job_t *stratum_proxy_get_current_job(void)
+{
+    return &s_current_job;
+}
+
+void stratum_proxy_get_stats(stratum_proxy_stats_t *stats)
+{
+    if (stats) {
+        *stats = s_stats;
+        stats->current_hashprice = mining_get_current_hashprice();
+    }
+}
+
+void stratum_proxy_stop(void)
+{
+    s_running = false;
+    if (s_server_fd >= 0) {
+        close(s_server_fd);
+        s_server_fd = -1;
+    }
+    if (s_task_handle) {
+        vTaskDelay(pdMS_TO_TICKS(500));
+        s_task_handle = NULL;
+    }
+}
diff --git a/main/stratum_proxy.h b/main/stratum_proxy.h
new file mode 100644
index 0000000..b940640
--- /dev/null
+++ b/main/stratum_proxy.h
@@ -0,0 +1,39 @@
+#ifndef STRATUM_PROXY_H
+#define STRATUM_PROXY_H
+
+#include "esp_err.h"
+#include <stdint.h>
+#include <stdbool.h>
+
+#define STRATUM_MAX_JOB_ID_LEN 32
+#define STRATUM_MAX_JOBS 4
+
+typedef struct {
+    uint32_t job_id;
+    uint8_t prevhash[32];
+    uint8_t merkle_root[32];
+    uint32_t ntime;
+    uint32_t nbits;
+    uint32_t version;
+    uint8_t target[32];
+    int target_len;
+    bool valid;
+} stratum_job_t;
+
+typedef struct {
+    double hashrate_ghs;
+    uint32_t nbits;
+    uint64_t total_shares;
+    uint64_t total_accepted;
+    uint64_t total_rejected;
+    double current_hashprice;
+    int active_miners;
+} stratum_proxy_stats_t;
+
+esp_err_t stratum_proxy_init(uint16_t port);
+void stratum_proxy_set_job(const stratum_job_t *job);
+const stratum_job_t *stratum_proxy_get_current_job(void);
+void stratum_proxy_get_stats(stratum_proxy_stats_t *stats);
+void stratum_proxy_stop(void);
+
+#endif
diff --git a/main/sw_miner.c b/main/sw_miner.c
new file mode 100644
index 0000000..cdd98a0
--- /dev/null
+++ b/main/sw_miner.c
@@ -0,0 +1,112 @@
+#include "sw_miner.h"
+#include "stratum_proxy.h"
+#include "stratum_client.h"
+#include "mining_payment.h"
+#include "config.h"
+#include "esp_log.h"
+#include "esp_random.h"
+#include "mbedtls/sha256.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include <string.h>
+
+static const char *TAG = "sw_miner";
+static bool s_running = false;
+static TaskHandle_t s_task_handle = NULL;
+static double s_hashrate = 0.0;
+
+static void sha256d(const uint8_t *data, size_t len, uint8_t *hash)
+{
+    uint8_t tmp[32];
+    mbedtls_sha256(data, len, tmp, 0);
+    mbedtls_sha256(tmp, 32, hash, 0);
+}
+
+static void sw_miner_task(void *arg)
+{
+    ESP_LOGI(TAG, "Software miner started");
+
+    uint64_t hashes = 0;
+    int64_t start_time = (int64_t)xTaskGetTickCount() * portTICK_PERIOD_MS;
+
+    uint8_t header[80];
+    uint8_t hash[32];
+
+    while (s_running) {
+        const stratum_job_t *job = stratum_proxy_get_current_job();
+        if (!job || !job->valid) {
+            vTaskDelay(pdMS_TO_TICKS(1000));
+            continue;
+        }
+
+        stratum_job_t local_job;
+        memcpy(&local_job, job, sizeof(stratum_job_t));
+
+        memcpy(header, local_job.prevhash, 32);
+        memcpy(header + 32, local_job.merkle_root, 32);
+
+        uint32_t start_nonce = esp_random();
+        uint32_t end_nonce = start_nonce + 1000;
+
+        for (uint32_t nonce = start_nonce; nonce < end_nonce && s_running; nonce++) {
+            header[76] = (nonce >> 0) & 0xFF;
+            header[77] = (nonce >> 8) & 0xFF;
+            header[78] = (nonce >> 16) & 0xFF;
+            header[79] = (nonce >> 24) & 0xFF;
+
+            sha256d(header, 80, hash);
+            hashes++;
+
+            if (memcmp(hash, local_job.target, local_job.target_len) <= 0) {
+                ESP_LOGI(TAG, "Valid share found! nonce=%08lx", (unsigned long)nonce);
+                stratum_client_submit_share(local_job.job_id, nonce, local_job.ntime, local_job.version);
+                mining_update_hashrate(0, true);
+                break;
+            }
+        }
+
+        int64_t now = (int64_t)xTaskGetTickCount() * portTICK_PERIOD_MS;
+        int64_t elapsed_s = (now - start_time) / 1000;
+        if (elapsed_s > 0) {
+            s_hashrate = (double)hashes / (double)elapsed_s / 1e6;
+        }
+
+        taskYIELD();
+    }
+
+    vTaskDelete(NULL);
+}
+
+esp_err_t sw_miner_start(void)
+{
+    if (s_running) return ESP_OK;
+    s_running = true;
+    s_hashrate = 0.0;
+
+    BaseType_t ret = xTaskCreate(sw_miner_task, "sw_miner", 8192, NULL, 2, &s_task_handle);
+    if (ret != pdPASS) {
+        ESP_LOGE(TAG, "Failed to create sw_miner task");
+        s_running = false;
+        return ESP_FAIL;
+    }
+    return ESP_OK;
+}
+
+void sw_miner_stop(void)
+{
+    s_running = false;
+    if (s_task_handle) {
+        vTaskDelay(pdMS_TO_TICKS(500));
+        s_task_handle = NULL;
+    }
+}
+
+bool sw_miner_is_running(void)
+{
+    return s_running;
+}
+
+double sw_miner_get_hashrate(void)
+{
+    return s_hashrate;
+}
diff --git a/main/sw_miner.h b/main/sw_miner.h
new file mode 100644
index 0000000..d0c2f06
--- /dev/null
+++ b/main/sw_miner.h
@@ -0,0 +1,13 @@
+#ifndef SW_MINER_H
+#define SW_MINER_H
+
+#include "esp_err.h"
+#include <stdint.h>
+#include <stdbool.h>
+
+esp_err_t sw_miner_start(void);
+void sw_miner_stop(void);
+bool sw_miner_is_running(void);
+double sw_miner_get_hashrate(void);
+
+#endif
diff --git a/main/tollgate_api.c b/main/tollgate_api.c
index 21bf9ef..b775f55 100644
--- a/main/tollgate_api.c
+++ b/main/tollgate_api.c
@@ -7,6 +7,9 @@
 #include "nucula_wallet.h"
 #include "mint_health.h"
 #include "market.h"
+#include "mining_payment.h"
+#include "stratum_proxy.h"
+#include "stratum_client.h"
 #include "esp_log.h"
 #include "esp_system.h"
 #include "cJSON.h"
@@ -150,6 +153,18 @@ static esp_err_t api_get_discovery(httpd_req_t *req)
     cJSON_AddItemToArray(tips_tag, cJSON_CreateString("5"));
     cJSON_AddItemToArray(tags, tips_tag);
 
+    if (cfg->mining_enabled) {
+        cJSON *mining_tag = cJSON_CreateArray();
+        cJSON_AddItemToArray(mining_tag, cJSON_CreateString("price_per_step"));
+        cJSON_AddItemToArray(mining_tag, cJSON_CreateString("mining"));
+        char mining_port_str[16];
+        snprintf(mining_port_str, sizeof(mining_port_str), "%d", cfg->mining_port);
+        cJSON_AddItemToArray(mining_tag, cJSON_CreateString(mining_port_str));
+        cJSON_AddItemToArray(mining_tag, cJSON_CreateString("GH/s"));
+        cJSON_AddItemToArray(mining_tag, cJSON_CreateString("sv1"));
+        cJSON_AddItemToArray(tags, mining_tag);
+    }
+
     cJSON_AddItemToObject(root, "tags", tags);
     cJSON_AddStringToObject(root, "content", "");
 
@@ -504,6 +519,169 @@ static esp_err_t api_get_mints(httpd_req_t *req)
     return ESP_OK;
 }
 
+static esp_err_t api_get_mining_job(httpd_req_t *req)
+{
+    const stratum_job_t *job = stratum_proxy_get_current_job();
+    if (!job || !job->valid) {
+        httpd_resp_set_status(req, "503 Service Unavailable");
+        httpd_resp_set_type(req, "application/json");
+        httpd_resp_send(req, "{\"error\":\"no job\"}", 15);
+        return ESP_OK;
+    }
+
+    cJSON *root = cJSON_CreateObject();
+    cJSON_AddNumberToObject(root, "job_id", job->job_id);
+
+    char prevhash_hex[65];
+    for (int i = 0; i < 32; i++) snprintf(prevhash_hex + i * 2, 3, "%02x", job->prevhash[i]);
+    cJSON_AddStringToObject(root, "prevhash", prevhash_hex);
+
+    char merkle_hex[65];
+    for (int i = 0; i < 32; i++) snprintf(merkle_hex + i * 2, 3, "%02x", job->merkle_root[i]);
+    cJSON_AddStringToObject(root, "merkle_root", merkle_hex);
+
+    cJSON_AddNumberToObject(root, "version", job->version);
+    cJSON_AddNumberToObject(root, "nbits", job->nbits);
+    cJSON_AddNumberToObject(root, "ntime", job->ntime);
+    cJSON_AddNumberToObject(root, "hashprice", mining_get_current_hashprice());
+
+    char *json = cJSON_PrintUnformatted(root);
+    httpd_resp_set_type(req, "application/json");
+    httpd_resp_send(req, json, strlen(json));
+    cJSON_free(json);
+    cJSON_Delete(root);
+    return ESP_OK;
+}
+
+static esp_err_t api_post_mining_share(httpd_req_t *req)
+{
+    uint32_t client_ip = 0;
+    get_client_ip(req, &client_ip);
+
+    int content_len = req->content_len;
+    if (content_len <= 0 || content_len > 512) {
+        httpd_resp_set_status(req, "400 Bad Request");
+        httpd_resp_set_type(req, "application/json");
+        httpd_resp_send(req, "{\"error\":\"invalid body\"}", 21);
+        return ESP_OK;
+    }
+
+    char body[512];
+    int total = 0;
+    while (total < content_len) {
+        int r = httpd_req_recv(req, body + total, content_len - total);
+        if (r <= 0) {
+            httpd_resp_set_status(req, "400 Bad Request");
+            httpd_resp_set_type(req, "text/plain");
+            httpd_resp_send(req, "bad request", 11);
+            return ESP_OK;
+        }
+        total += r;
+    }
+    body[total] = '\0';
+
+    cJSON *root = cJSON_Parse(body);
+    if (!root) {
+        httpd_resp_set_status(req, "400 Bad Request");
+        httpd_resp_set_type(req, "application/json");
+        httpd_resp_send(req, "{\"error\":\"invalid json\"}", 21);
+        return ESP_OK;
+    }
+
+    cJSON *j_job_id = cJSON_GetObjectItem(root, "job_id");
+    cJSON *j_nonce = cJSON_GetObjectItem(root, "nonce");
+    cJSON *j_ntime = cJSON_GetObjectItem(root, "ntime");
+    cJSON *j_version = cJSON_GetObjectItem(root, "version");
+    if (!j_job_id || !j_nonce || !j_ntime || !j_version) {
+        cJSON_Delete(root);
+        httpd_resp_set_status(req, "400 Bad Request");
+        httpd_resp_set_type(req, "application/json");
+        httpd_resp_send(req, "{\"error\":\"missing fields\"}", 22);
+        return ESP_OK;
+    }
+
+    uint32_t job_id = (uint32_t)j_job_id->valuedouble;
+    uint32_t nonce = (uint32_t)j_nonce->valuedouble;
+    uint32_t ntime = (uint32_t)j_ntime->valuedouble;
+    uint32_t version = (uint32_t)j_version->valuedouble;
+    cJSON_Delete(root);
+
+    const stratum_job_t *job = stratum_proxy_get_current_job();
+    if (!job || !job->valid || job->job_id != job_id) {
+        httpd_resp_set_status(req, "400 Bad Request");
+        httpd_resp_set_type(req, "application/json");
+        httpd_resp_send(req, "{\"error\":\"stale job\"}", 19);
+        return ESP_OK;
+    }
+
+    esp_err_t share_err = stratum_client_submit_share(job_id, nonce, ntime, version);
+    bool accepted = (share_err == ESP_OK);
+
+    mining_update_hashrate(client_ip, accepted);
+    mining_client_stats_t *stats = mining_get_or_create_client(client_ip);
+
+    if (accepted) {
+        const tollgate_config_t *cfg = tollgate_config_get();
+        double hashprice = mining_get_current_hashprice();
+        uint64_t allotment_ms = mining_shares_to_allotment_ms(
+            stats->hashrate_ghs, hashprice, cfg->price_per_step, cfg->step_size_ms);
+
+        session_t *session = session_find_by_ip(client_ip);
+        if (!session || !session->active || session->payment_method != PAYMENT_METHOD_MINING) {
+            session = session_create(client_ip, allotment_ms);
+            if (session) session->payment_method = PAYMENT_METHOD_MINING;
+        } else {
+            session_extend(session, allotment_ms);
+        }
+    }
+
+    cJSON *resp = cJSON_CreateObject();
+    cJSON_AddBoolToObject(resp, "accepted", accepted);
+    cJSON_AddNumberToObject(resp, "hashrate_ghs", stats ? stats->hashrate_ghs : 0.0);
+    char *json = cJSON_PrintUnformatted(resp);
+    httpd_resp_set_type(req, "application/json");
+    httpd_resp_send(req, json, strlen(json));
+    cJSON_free(json);
+    cJSON_Delete(resp);
+    return ESP_OK;
+}
+
+static esp_err_t api_get_mining_stats(httpd_req_t *req)
+{
+    stratum_proxy_stats_t proxy_stats;
+    stratum_proxy_get_stats(&proxy_stats);
+
+    const stratum_client_state_t *client_state = stratum_client_get_state();
+
+    cJSON *root = cJSON_CreateObject();
+
+    cJSON *proxy = cJSON_CreateObject();
+    cJSON_AddNumberToObject(proxy, "hashrate_ghs", proxy_stats.hashrate_ghs);
+    cJSON_AddNumberToObject(proxy, "total_shares", (double)proxy_stats.total_shares);
+    cJSON_AddNumberToObject(proxy, "total_accepted", (double)proxy_stats.total_accepted);
+    cJSON_AddNumberToObject(proxy, "total_rejected", (double)proxy_stats.total_rejected);
+    cJSON_AddNumberToObject(proxy, "hashprice", proxy_stats.current_hashprice);
+    cJSON_AddNumberToObject(proxy, "active_miners", proxy_stats.active_miners);
+    cJSON_AddItemToObject(root, "proxy", proxy);
+
+    cJSON *upstream = cJSON_CreateObject();
+    cJSON_AddBoolToObject(upstream, "connected", client_state->connected);
+    cJSON_AddStringToObject(upstream, "pool_host", client_state->pool_host);
+    cJSON_AddNumberToObject(upstream, "pool_port", client_state->pool_port);
+    cJSON_AddNumberToObject(upstream, "difficulty", (double)client_state->difficulty);
+    cJSON_AddNumberToObject(upstream, "shares_accepted", (double)client_state->shares_accepted);
+    cJSON_AddNumberToObject(upstream, "shares_rejected", (double)client_state->shares_rejected);
+    cJSON_AddItemToObject(root, "upstream", upstream);
+
+    char *json = cJSON_PrintUnformatted(root);
+    httpd_resp_set_type(req, "application/json");
+    httpd_resp_send(req, json, strlen(json));
+    cJSON_free(json);
+    cJSON_Delete(root);
+>>>>>>> feature/mining-payment
+    return ESP_OK;
+}
+
 static const httpd_uri_t uri_discovery = { .uri = "/", .method = HTTP_GET, .handler = api_get_discovery };
 static const httpd_uri_t uri_payment = { .uri = "/", .method = HTTP_POST, .handler = api_post_payment };
 static const httpd_uri_t uri_mints = { .uri = "/mints", .method = HTTP_GET, .handler = api_get_mints };
@@ -512,6 +690,9 @@ static const httpd_uri_t uri_whoami = { .uri = "/whoami", .method = HTTP_GET, .h
 static const httpd_uri_t uri_wallet = { .uri = "/wallet", .method = HTTP_GET, .handler = api_get_wallet };
 static const httpd_uri_t uri_wallet_swap = { .uri = "/wallet/swap", .method = HTTP_POST, .handler = api_post_wallet_swap };
 static const httpd_uri_t uri_wallet_send = { .uri = "/wallet/send", .method = HTTP_POST, .handler = api_post_wallet_send };
+static const httpd_uri_t uri_mining_job = { .uri = "/mining/job", .method = HTTP_GET, .handler = api_get_mining_job };
+static const httpd_uri_t uri_mining_share = { .uri = "/mining/share", .method = HTTP_POST, .handler = api_post_mining_share };
+static const httpd_uri_t uri_mining_stats = { .uri = "/mining/stats", .method = HTTP_GET, .handler = api_get_mining_stats };
 
 static esp_err_t api_get_market(httpd_req_t *req)
 {
@@ -559,7 +740,7 @@ esp_err_t tollgate_api_start(void)
     httpd_config_t config = HTTPD_DEFAULT_CONFIG();
     config.server_port = 2121;
     config.ctrl_port = 32769;
-    config.max_uri_handlers = 12;
+    config.max_uri_handlers = 16;
     config.stack_size = 16384;
 
     esp_err_t ret = httpd_start(&s_api_server, &config);
@@ -579,6 +760,13 @@ esp_err_t tollgate_api_start(void)
     httpd_register_uri_handler(s_api_server, &uri_wallet_send);
     httpd_register_uri_handler(s_api_server, &uri_market);
 
+    const tollgate_config_t *cfg = tollgate_config_get();
+    if (cfg->mining_enabled) {
+        httpd_register_uri_handler(s_api_server, &uri_mining_job);
+        httpd_register_uri_handler(s_api_server, &uri_mining_share);
+        httpd_register_uri_handler(s_api_server, &uri_mining_stats);
+    }
+
     ESP_LOGI(TAG, "TollGate API started on port 2121");
     return ESP_OK;
 }
diff --git a/main/tollgate_client.c b/main/tollgate_client.c
index a81d16f..73c8370 100644
--- a/main/tollgate_client.c
+++ b/main/tollgate_client.c
@@ -127,15 +127,25 @@ static bool parse_discovery_response(const char *json_str, tollgate_discovery_t
             if (val && cJSON_IsString(val)) {
                 out->step_size_ms = atoi(val->valuestring);
             }
-        } else if (strcmp(tag_name->valuestring, "price_per_step") == 0 && tag_len >= 6) {
-            cJSON *amount = cJSON_GetArrayItem(tag, 2);
-            cJSON *mint = cJSON_GetArrayItem(tag, 4);
+        } else if (strcmp(tag_name->valuestring, "price_per_step") == 0 && tag_len >= 4) {
+            cJSON *payment_type = cJSON_GetArrayItem(tag, 2);
+
+            if (cJSON_IsString(payment_type) && strcmp(payment_type->valuestring, "mining") == 0 && tag_len >= 5) {
+                out->mining_available = true;
+                cJSON *port_val = cJSON_GetArrayItem(tag, 3);
+                if (port_val && cJSON_IsString(port_val)) {
+                    out->mining_port = (uint16_t)atoi(port_val->valuestring);
+                }
+            } else {
+                cJSON *amount = cJSON_GetArrayItem(tag, 2);
+                cJSON *mint = cJSON_GetArrayItem(tag, 4);
 
-            if (amount && cJSON_IsString(amount)) {
-                out->price_per_step = atoi(amount->valuestring);
-            }
-            if (mint && cJSON_IsString(mint)) {
-                strncpy(out->mint_url, mint->valuestring, sizeof(out->mint_url) - 1);
+                if (amount && cJSON_IsString(amount)) {
+                    out->price_per_step = atoi(amount->valuestring);
+                }
+                if (mint && cJSON_IsString(mint)) {
+                    strncpy(out->mint_url, mint->valuestring, sizeof(out->mint_url) - 1);
+                }
             }
         }
     }
diff --git a/main/tollgate_client.h b/main/tollgate_client.h
index 2055e52..ccee624 100644
--- a/main/tollgate_client.h
+++ b/main/tollgate_client.h
@@ -17,6 +17,7 @@ typedef enum {
     TG_CLIENT_PAYING,
     TG_CLIENT_PAID,
     TG_CLIENT_RENEWING,
+    TG_CLIENT_MINING,
     TG_CLIENT_ERROR
 } tollgate_client_state_t;
 
@@ -26,6 +27,8 @@ typedef struct {
     int step_size_ms;
     char mint_url[TG_CLIENT_MAX_MINT_URL];
     char metric[TG_CLIENT_MAX_METRIC];
+    bool mining_available;
+    uint16_t mining_port;
 } tollgate_discovery_t;
 
 esp_err_t tollgate_client_init(void);
diff --git a/main/tollgate_main.c b/main/tollgate_main.c
index 33e5b90..561fc3f 100644
--- a/main/tollgate_main.c
+++ b/main/tollgate_main.c
@@ -31,6 +31,11 @@
 #include "sync_manager.h"
 #include "beacon_price.h"
 #include "market.h"
+#include "stratum_client.h"
+#include "stratum_proxy.h"
+#include "sw_miner.h"
+#include "asic_miner.h"
+#include "mining_payment.h"
 
 #define MAX_STA_RETRY 5
 static const char *TAG = "tollgate_main";
@@ -190,7 +195,6 @@ static void start_services(void)
     session_manager_init();
 
     const tollgate_config_t *cfg = tollgate_config_get();
-
     mint_health_init(cfg->accepted_mints, cfg->accepted_mint_count);
     mint_health_start();
 
@@ -199,6 +203,11 @@ static void start_services(void)
     } else {
         nucula_wallet_init(cfg->mint_url);
     }
+
+    if (cfg->mining_enabled) {
+        firewall_set_mining_port(cfg->mining_port);
+        firewall_set_sandbox_mint_access(cfg->mining_sandbox_mint_access);
+    }
     lightning_payout_init(&cfg->payout);
 
     dns_server_start(ap_ip_info.ip, upstream_dns);
@@ -223,6 +232,26 @@ static void start_services(void)
         cvm_server_start();
     }
 
+    if (cfg2->mining_enabled) {
+        ESP_LOGI(TAG, "Mining subsystem enabled, initializing...");
+        mining_payment_init();
+        stratum_client_init();
+        stratum_proxy_init(cfg2->mining_port);
+
+        if (cfg2->mining_payout_mode != MINING_PAYOUT_UPSTREAM) {
+            stratum_client_start();
+        }
+
+        asic_miner_init();
+        if (asic_miner_is_present()) {
+            asic_miner_start();
+            ESP_LOGI(TAG, "ASIC miner started");
+        } else {
+            sw_miner_start();
+            ESP_LOGI(TAG, "Software miner started (no ASIC)");
+        }
+    }
+
     s_services_running = true;
     if (s_services_mutex) xSemaphoreGive(s_services_mutex);
     ESP_LOGI(TAG, "=== TollGate services started ===");
@@ -392,5 +421,6 @@ void app_main(void)
         tollgate_client_tick();
         lightning_payout_tick();
         market_tick();
+        stratum_client_tick();
     }
 }