greg/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
e1e3d8a92b
nix-bitcoin/pkgs/generate-secrets/generate-secrets.sh

45 lines
1.6 KiB
Bash
Raw Normal View History

simplify secrets file format Each secret file to be deployed is now backed by one local file. This simplifies 'setup-secrets' and the secret definitions. Also, with the old format it was not possible to add new secrets to secrets.nix in a simple way. Old secrets are automatically converted to the new format when running nix-shell. Using the new option 'nix-bitcoin.secrets', secrets are now directly defined by the services that use them.
2020-01-12 11:52:38 -08:00
#!/usr/bin/env bash
Add rpc user and password as secrets
2018-11-22 15:51:16 -08:00
generate-secrets: always run with Bash, stop on errors
2020-10-23 01:45:49 -07:00
set -euo pipefail
generate_secrets.sh: add opensslConf option Needed for the following commit.
2019-11-27 05:04:30 -08:00
opensslConf=${1:-openssl.cnf}
Add rpc user and password as secrets
2018-11-22 15:51:16 -08:00
simplify secrets file format Each secret file to be deployed is now backed by one local file. This simplifies 'setup-secrets' and the secret definitions. Also, with the old format it was not possible to add new secrets to secrets.nix in a simple way. Old secrets are automatically converted to the new format when running nix-shell. Using the new option 'nix-bitcoin.secrets', secrets are now directly defined by the services that use them.
2020-01-12 11:52:38 -08:00
makePasswordSecret() {
generate-secrets: use pwgen Password length and alphabet is unchanged, but the restriction to include at least one numeric and one capital char has been removed. This restriction is not needed by client applications, adds code complexity, and even (insignificantly) reduces entropy. Reason for switching to pwgen: apg uses /dev/random instead of /dev/urandom which brings no security benefits but can stall the generate-secrets script on low-entropy devices due to blocking. Since `security.rngd` has been disabled in NixOS 20.09, blocking in generate-secrets can also appear on regular NixOS desktop systems.
2020-12-15 16:28:12 -08:00
# Passwords have alphabet {a-z, A-Z, 0-9} and ~119 bits of entropy
[[ -e $1 ]] || pwgen -s 20 1 > "$1"
simplify secrets file format Each secret file to be deployed is now backed by one local file. This simplifies 'setup-secrets' and the secret definitions. Also, with the old format it was not possible to add new secrets to secrets.nix in a simple way. Old secrets are automatically converted to the new format when running nix-shell. Using the new option 'nix-bitcoin.secrets', secrets are now directly defined by the services that use them.
2020-01-12 11:52:38 -08:00
}
generate-secrets: extract fn 'makeHMAC'
2020-08-27 03:17:41 -07:00
makeHMAC() {
user=$1
rpcauth $user $(cat bitcoin-rpcpassword-$user) | grep rpcauth | cut -d ':' -f 2 > bitcoin-HMAC-$user
}
simplify secrets file format Each secret file to be deployed is now backed by one local file. This simplifies 'setup-secrets' and the secret definitions. Also, with the old format it was not possible to add new secrets to secrets.nix in a simple way. Old secrets are automatically converted to the new format when running nix-shell. Using the new option 'nix-bitcoin.secrets', secrets are now directly defined by the services that use them.
2020-01-12 11:52:38 -08:00
bitcoind: switch from rpcpassword to rpcauth Includes bitcoind's `share/rpcauth` to convert apg generated passwords into salted HMAC-SHA-256 hashed passwords.
2020-06-22 05:10:54 -07:00
makePasswordSecret bitcoin-rpcpassword-privileged
nbxplorer/btcpayserver: add module
2020-08-12 07:47:56 -07:00
makePasswordSecret bitcoin-rpcpassword-btcpayserver
joinmarket-ob-watcher: extra permissions & functionality for fidelity bonds
2021-08-25 02:57:09 -07:00
makePasswordSecret bitcoin-rpcpassword-joinmarket-ob-watcher
bitcoind: switch from rpcpassword to rpcauth Includes bitcoind's `share/rpcauth` to convert apg generated passwords into salted HMAC-SHA-256 hashed passwords.
2020-06-22 05:10:54 -07:00
makePasswordSecret bitcoin-rpcpassword-public
simplify secrets file format Each secret file to be deployed is now backed by one local file. This simplifies 'setup-secrets' and the secret definitions. Also, with the old format it was not possible to add new secrets to secrets.nix in a simple way. Old secrets are automatically converted to the new format when running nix-shell. Using the new option 'nix-bitcoin.secrets', secrets are now directly defined by the services that use them.
2020-01-12 11:52:38 -08:00
makePasswordSecret lnd-wallet-password
makePasswordSecret liquid-rpcpassword
makePasswordSecret spark-wallet-password
backups: add module
2020-06-11 04:39:17 -07:00
makePasswordSecret backup-encryption-password
joinmarket: automatically generate wallet
2020-09-11 04:53:12 -07:00
makePasswordSecret jm-wallet-password
simplify secrets file format Each secret file to be deployed is now backed by one local file. This simplifies 'setup-secrets' and the secret definitions. Also, with the old format it was not possible to add new secrets to secrets.nix in a simple way. Old secrets are automatically converted to the new format when running nix-shell. Using the new option 'nix-bitcoin.secrets', secrets are now directly defined by the services that use them.
2020-01-12 11:52:38 -08:00
generate-secrets: extract fn 'makeHMAC'
2020-08-27 03:17:41 -07:00
[[ -e bitcoin-HMAC-privileged ]] || makeHMAC privileged
[[ -e bitcoin-HMAC-public ]] || makeHMAC public
nbxplorer/btcpayserver: add module
2020-08-12 07:47:56 -07:00
[[ -e bitcoin-HMAC-btcpayserver ]] || makeHMAC btcpayserver
joinmarket-ob-watcher: extra permissions & functionality for fidelity bonds
2021-08-25 02:57:09 -07:00
[[ -e bitcoin-HMAC-joinmarket-ob-watcher ]] || makeHMAC joinmarket-ob-watcher
simplify secrets file format Each secret file to be deployed is now backed by one local file. This simplifies 'setup-secrets' and the secret definitions. Also, with the old format it was not possible to add new secrets to secrets.nix in a simple way. Old secrets are automatically converted to the new format when running nix-shell. Using the new option 'nix-bitcoin.secrets', secrets are now directly defined by the services that use them.
2020-01-12 11:52:38 -08:00
[[ -e spark-wallet-login ]] || echo "login=spark-wallet:$(cat spark-wallet-password)" > spark-wallet-login
backups: add module
2020-06-11 04:39:17 -07:00
[[ -e backup-encryption-env ]] || echo "PASSPHRASE=$(cat backup-encryption-password)" > backup-encryption-env
Add rpc user and password as secrets
2018-11-22 15:51:16 -08:00
secrets: simplify cert generation - Remove openssl.cnf which includes many unused settings. - Generate the key and cert files with a single call to openssl. - Option `-nodes` ("no DES") disables encryption of the key file. - Option `-addext` is used to specify `subjectAltName` settings that were previously defined by openssl.cnf. The key type is unchanged. Certificate changes: - Certificate duration is now 10 years - Organization (subj 'O') is now 'loop' instead of 'loopd' for lightning-loop to simplify the code. For reference, the org. name in auto-generated loop certs is "loop autogenerated cert". - The certificate now includes all default x509v3 extensions. These were previously restricted to just `subjectAltName` by openssl.cnf. We now use the openssl defaults for simplicity.
2021-09-08 08:01:14 -07:00
makeCert() {
if [[ ! -e $name-key || ! -e $name-cert ]]; then
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
-sha256 -days 3650 -nodes -keyout "$name-key" -out "$name-cert" \
-subj "/CN=localhost/O=$name" \
-addext "subjectAltName=DNS:localhost,IP:127.0.0.1,IP:169.254.1.14,IP:169.254.1.22"
# TODO: Remove hardcoded lnd, loopd netns ips
fi
}
lightning-loop: update module * commandlineArgs -> configFile * introduce tls certs * loop dataDir * fix formatting and descriptions Warning: Manual migration of existing loop data directory necessary
2020-09-15 01:46:15 -07:00
secrets: simplify cert generation - Remove openssl.cnf which includes many unused settings. - Generate the key and cert files with a single call to openssl. - Option `-nodes` ("no DES") disables encryption of the key file. - Option `-addext` is used to specify `subjectAltName` settings that were previously defined by openssl.cnf. The key type is unchanged. Certificate changes: - Certificate duration is now 10 years - Organization (subj 'O') is now 'loop' instead of 'loopd' for lightning-loop to simplify the code. For reference, the org. name in auto-generated loop certs is "loop autogenerated cert". - The certificate now includes all default x509v3 extensions. These were previously restricted to just `subjectAltName` by openssl.cnf. We now use the openssl defaults for simplicity.
2021-09-08 08:01:14 -07:00
makeCert lnd
makeCert loop
Reference in New Issue Copy Permalink