greg
/
nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

spark-wallet: Run under spark-wallet user

This commit is contained in:
nixbitcoin 2020-05-03 14:18:21 +02:00
parent 205fca3576
commit 563b210835
No known key found for this signature in database
GPG Key ID: DD11F9AD5308B3BA
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
modules/spark-wallet.nix
View File

@ -12,7 +12,7 @@ let
${optionalString cfg.onion-service
''
echo Getting onion hostname
CMD="$CMD --public-url http://$(cat /var/lib/onion-chef/clightning/spark-wallet)"
CMD="$CMD --public-url http://$(cat /var/lib/onion-chef/spark-wallet/spark-wallet)"
''
}
# Use rate provide wasabi because default (bitstamp) doesn't accept
@ -48,6 +48,13 @@ in {
config = mkIf cfg.enable {
environment.systemPackages = [ pkgs.nix-bitcoin.spark-wallet ];
users.users.spark-wallet = {
description = "spark-wallet User";
group = "spark-wallet";
extraGroups = [ "clightning" ];
};
users.groups.spark-wallet = {};
services.tor.enable = cfg.onion-service;
# requires client functionality for Bitcoin rate lookup
services.tor.client.enable = true;
@ -58,7 +65,7 @@ in {
version = 3;
};
services.onion-chef.enable = cfg.onion-service;
services.onion-chef.access.clightning = if cfg.onion-service then [ "spark-wallet" ] else [];
services.onion-chef.access.spark-wallet = if cfg.onion-service then [ "spark-wallet" ] else [];
systemd.services.spark-wallet = {
description = "Run spark-wallet";
wantedBy = [ "multi-user.target" ];
@ -67,13 +74,13 @@ in {
serviceConfig = {
PermissionsStartOnly = "true";
ExecStart = "${pkgs.bash}/bin/bash ${run-spark-wallet}";
User = "clightning";
User = "spark-wallet";
Restart = "on-failure";
RestartSec = "10s";
} // nix-bitcoin-services.defaultHardening
// nix-bitcoin-services.nodejs
// nix-bitcoin-services.allowTor;
};
nix-bitcoin.secrets.spark-wallet-login.user = "clightning";
nix-bitcoin.secrets.spark-wallet-login.user = "spark-wallet";
};
}