greg/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

joinmarket: run with group 'bitcoin'

Browse Source 
Don't copy bitcoin-rpcpassword-privileged as root, instead run service
with group "bitcoin".
Same effect, less complexity. Note, PoLP still obeyed for joinmarket-ob-watcher.
This commit is contained in:
nixbitcoin 2021-08-08 10:58:48 +02:00
parent ed480a35af
commit 6258d64cb6
No known key found for this signature in database
GPG Key ID: B6044ECBA2DAE5D0
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
modules/joinmarket.nix
View File

@ -232,7 +232,7 @@ in {
requires = [ "bitcoind.service" ]; requires = [ "bitcoind.service" ];
after = [ "bitcoind.service" ]; after = [ "bitcoind.service" ];
serviceConfig = nbLib.defaultHardening // { serviceConfig = nbLib.defaultHardening // {
ExecStartPre = nbLib.privileged "joinmarket-create-config" '' ExecStartPre = nbLib.script "joinmarket-create-config" ''
install -o '${cfg.user}' -g '${cfg.group}' -m 640 ${configFile} ${cfg.dataDir}/joinmarket.cfg install -o '${cfg.user}' -g '${cfg.group}' -m 640 ${configFile} ${cfg.dataDir}/joinmarket.cfg
sed -i \ sed -i \
"s|@@RPC_PASSWORD@@|rpc_password = $(cat ${secretsDir}/bitcoin-rpcpassword-privileged)|" \ "s|@@RPC_PASSWORD@@|rpc_password = $(cat ${secretsDir}/bitcoin-rpcpassword-privileged)|" \
@ -270,7 +270,7 @@ in {
group = cfg.group; group = cfg.group;
home = cfg.dataDir; home = cfg.dataDir;
# Allow access to the tor control socket, needed for payjoin onion service creation # Allow access to the tor control socket, needed for payjoin onion service creation
extraGroups = [ "tor" ]; extraGroups = [ "tor" "bitcoin" ];
}; };
users.groups.${cfg.group} = {}; users.groups.${cfg.group} = {};
nix-bitcoin.operator = { nix-bitcoin.operator = {