lightning-loop: add module

This commit is contained in:
nixbitcoin 2020-07-07 14:22:17 +00:00
parent 8f3588b13f
commit 491d83a658
No known key found for this signature in database
GPG Key ID: DD11F9AD5308B3BA
5 changed files with 97 additions and 0 deletions

View File

@ -129,6 +129,12 @@
# a network-level as much as possible. # a network-level as much as possible.
# nix-bitcoin.netns-isolation.enable = true; # nix-bitcoin.netns-isolation.enable = true;
### lightning-loop
# Enable this module to use lightninglab's non-custodial off/on chain bridge.
# loopd (lightning-loop daemon) will be started automatically. Users can
# interact with off/on chain bridge using `loop in` and `loop out`.
# services.lightning-loop.enable = true;
# FIXME: Define your hostname. # FIXME: Define your hostname.
networking.hostName = "nix-bitcoin"; networking.hostName = "nix-bitcoin";
time.timeZone = "UTC"; time.timeZone = "UTC";

View File

@ -0,0 +1,72 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.lightning-loop;
inherit (config) nix-bitcoin-services;
secretsDir = config.nix-bitcoin.secretsDir;
in {
options.services.lightning-loop = {
enable = mkEnableOption "lightning-loop";
package = mkOption {
type = types.package;
default = pkgs.nix-bitcoin.lightning-loop;
defaultText = "pkgs.nix-bitcoin.lightning-loop";
description = "The package providing lightning-loop binaries.";
};
proxy = mkOption {
type = types.nullOr types.str;
default = null;
description = "Connect through SOCKS5 proxy";
};
extraArgs = mkOption {
type = types.separatedString " ";
default = "";
description = "Extra command line arguments passed to loopd.";
};
cli = mkOption {
default = pkgs.writeScriptBin "loop"
# Switch user because lnd makes datadir contents readable by user only
''
exec sudo -u lnd ${cfg.package}/bin/loop "$@"
'';
description = "Binary to connect with the lnd instance.";
};
enforceTor = nix-bitcoin-services.enforceTor;
};
config = mkIf cfg.enable {
assertions = [
{ assertion = config.services.lnd.enable;
message = "lightning-loop requires lnd.";
}
];
environment.systemPackages = [ cfg.package (hiPrio cfg.cli) ];
systemd.services.lightning-loop = {
description = "Run loopd";
wantedBy = [ "multi-user.target" ];
requires = [ "lnd.service" ];
after = [ "lnd.service" ];
serviceConfig = nix-bitcoin-services.defaultHardening // {
ExecStart = ''
${cfg.package}/bin/loopd \
--lnd.host=${config.services.lnd.listen}:10009 \
--lnd.macaroondir=${config.services.lnd.dataDir}/chain/bitcoin/mainnet \
--lnd.tlspath=${secretsDir}/lnd-cert \
${optionalString (cfg.proxy != null) "--server.proxy=${cfg.proxy}"} \
${cfg.extraArgs}
'';
User = "lnd";
Restart = "on-failure";
RestartSec = "10s";
ReadWritePaths = "${config.services.lnd.dataDir}";
} // (if cfg.enforceTor
then nix-bitcoin-services.allowTor
else nix-bitcoin-services.allowAnyIP);
};
};
}

View File

@ -13,6 +13,7 @@
./recurring-donations.nix ./recurring-donations.nix
./hardware-wallets.nix ./hardware-wallets.nix
./lnd.nix ./lnd.nix
./lightning-loop.nix
./secrets/secrets.nix ./secrets/secrets.nix
./netns-isolation.nix ./netns-isolation.nix
./dbus.nix ./dbus.nix

View File

@ -127,6 +127,10 @@ in {
id = 21; id = 21;
connections = []; connections = [];
}; };
lightning-loop = {
id = 22;
connections = [ "lnd" ];
};
}; };
systemd.services = { systemd.services = {
@ -291,6 +295,14 @@ in {
# nginx: Custom netns configs # nginx: Custom netns configs
services.nix-bitcoin-webindex.host = mkIf config.services.nix-bitcoin-webindex.enable netns.nginx.address; services.nix-bitcoin-webindex.host = mkIf config.services.nix-bitcoin-webindex.enable netns.nginx.address;
# loop: Custom netns configs
services.lightning-loop = mkIf config.services.lightning-loop.enable {
cli = pkgs.writeScriptBin "loop"
# Switch user because lnd makes datadir contents readable by user only
''
netns-exec nb-lightning-loop sudo -u lnd ${config.services.lightning-loop.package}/bin/loop "$@"
'';
};
}) })
# Custom netns config option values if netns-isolation not enabled # Custom netns config option values if netns-isolation not enabled
(mkIf (!cfg.enable) { (mkIf (!cfg.enable) {

View File

@ -91,6 +91,12 @@ in {
}; };
services.tor.hiddenServices.lnd = mkIf cfg.lnd.enable (mkHiddenService { port = cfg.lnd.onionport; toHost = cfg.lnd.listen; }); services.tor.hiddenServices.lnd = mkIf cfg.lnd.enable (mkHiddenService { port = cfg.lnd.onionport; toHost = cfg.lnd.listen; });
# lightning-loop
services.lightning-loop = {
proxy = cfg.tor.client.socksListenAddress;
enforceTor = true;
};
# liquidd # liquidd
services.liquidd = { services.liquidd = {
rpcuser = "liquidrpc"; rpcuser = "liquidrpc";