greg/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

clightning: refactor bind-addr to be IP address only

Browse Source 
With typecheck
This commit is contained in:
nixbitcoin 2020-08-04 13:21:40 +00:00
parent d99ccc8445
commit 43da15557d
No known key found for this signature in database
GPG Key ID: DD11F9AD5308B3BA
3 changed files with 219 additions and 222 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
modules/clightning.nix
View File

@ -11,7 +11,7 @@ let
bitcoin-datadir=${config.services.bitcoind.dataDir} bitcoin-datadir=${config.services.bitcoind.dataDir}
${optionalString (cfg.proxy != null) "proxy=${cfg.proxy}"} ${optionalString (cfg.proxy != null) "proxy=${cfg.proxy}"}
always-use-proxy=${if cfg.always-use-proxy then "true" else "false"} always-use-proxy=${if cfg.always-use-proxy then "true" else "false"}
${optionalString (cfg.bind-addr != null) "bind-addr=${cfg.bind-addr}"} ${optionalString (cfg.bind-addr != null) "bind-addr=${cfg.bind-addr}:${toString cfg.bindport}"}
${optionalString (cfg.bitcoin-rpcconnect != null) "bitcoin-rpcconnect=${cfg.bitcoin-rpcconnect}"} ${optionalString (cfg.bitcoin-rpcconnect != null) "bitcoin-rpcconnect=${cfg.bitcoin-rpcconnect}"}
bitcoin-rpcuser=${config.services.bitcoind.rpc.users.public.name} bitcoin-rpcuser=${config.services.bitcoind.rpc.users.public.name}
rpc-file-mode=0660 rpc-file-mode=0660
@ -46,8 +46,8 @@ in {
''; '';
}; };
bind-addr = mkOption { bind-addr = mkOption {
type = types.nullOr types.str; type = types.addCheck types.str (s: builtins.length (builtins.split ":" s) == 1);
default = null; default = "127.0.0.1";
description = "Set an IP address or UNIX domain socket to listen to"; description = "Set an IP address or UNIX domain socket to listen to";
}; };
bindport = mkOption { bindport = mkOption {

13
modules/netns-isolation.nix
View File

@ -70,8 +70,7 @@ in {
}; };
}; };
config = mkMerge [ config = mkIf cfg.enable {
(mkIf cfg.enable {
# Prerequisites # Prerequisites
networking.dhcpcd.denyInterfaces = [ "br0" "br-nb*" "nb-veth*" ]; networking.dhcpcd.denyInterfaces = [ "br0" "br-nb*" "nb-veth*" ];
services.tor.client.socksListenAddress = "${bridgeIp}:9050"; services.tor.client.socksListenAddress = "${bridgeIp}:9050";
@ -227,7 +226,7 @@ in {
# clightning: Custom netns configs # clightning: Custom netns configs
services.clightning = mkIf config.services.clightning.enable { services.clightning = mkIf config.services.clightning.enable {
bitcoin-rpcconnect = netns.bitcoind.address; bitcoin-rpcconnect = netns.bitcoind.address;
bind-addr = "${netns.clightning.address}:${toString config.services.clightning.bindport}"; bind-addr = netns.clightning.address;
}; };
# lnd: Custom netns configs # lnd: Custom netns configs
@ -303,11 +302,5 @@ in {
netns-exec nb-lightning-loop sudo -u lnd ${config.services.lightning-loop.package}/bin/loop "$@" netns-exec nb-lightning-loop sudo -u lnd ${config.services.lightning-loop.package}/bin/loop "$@"
''; '';
}; };
}) };
# Custom netns config option values if netns-isolation not enabled
(mkIf (!cfg.enable) {
# clightning
services.clightning.bind-addr = "127.0.0.1:${toString config.services.clightning.bindport}";
})
];
} }

6
modules/presets/secure-node.nix
View File

@ -152,7 +152,11 @@ in {
enforceTor = true; enforceTor = true;
always-use-proxy = true; always-use-proxy = true;
}; };
services.tor.hiddenServices.clightning = mkIf cfg.clightning.enable (mkHiddenService { port = cfg.clightning.onionport; toHost = (builtins.head (builtins.split ":" cfg.clightning.bind-addr)); toPort = cfg.clightning.bindport; }); services.tor.hiddenServices.clightning = mkIf cfg.clightning.enable (mkHiddenService {
port = cfg.clightning.onionport;
toHost = cfg.clightning.bind-addr;
toPort = cfg.clightning.bindport;
});
# lnd # lnd
services.lnd = { services.lnd = {