greg/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

clightning: add announce-tor

Browse Source 
From the clightning manpage:

autolisten=BOOL By default, we bind (and maybe announce) on IPv4 and
IPv6 interfaces if no addr, bind-addr or  announce-addr options  are
specified. Setting this to false disables that.

We already set bind-addr by default, so autolisten had no effect.
Therefore, this commit replaces autolisten with the more granular
announce-addr option.

For now we are Tor-only, so we only need to announce our hidden service
to accept incoming connections. In the future, we can add clearnet
connectivity with `addr` and route connections into our netns with NAT.
This commit is contained in:
nixbitcoin 2020-06-04 08:23:02 +00:00
parent 515aae2825
commit 65b5dab3d4
No known key found for this signature in database
GPG Key ID: DD11F9AD5308B3BA
2 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
examples/configuration.nix
View File

@ -38,9 +38,10 @@
# Enable this module to use clightning, a Lightning Network implementation # Enable this module to use clightning, a Lightning Network implementation
# in C. # in C.
services.clightning.enable = true; services.clightning.enable = true;
# Enable this option to listen for incoming lightning connections. By # Enable this option to announce our Tor Hidden Service. By default clightning
# default nix-bitcoin nodes offer outgoing connectivity. # offers outgoing functionality, but doesn't announce the Tor Hidden Service
# services.clightning.autolisten = true; # under which peers can reach us.
# services.clightning.announce-tor = true;
### LND ### LND
# Disable clightning and uncomment the following line in order to enable lnd, # Disable clightning and uncomment the following line in order to enable lnd,

16
modules/clightning.nix
View File

@ -5,8 +5,8 @@ with lib;
let let
cfg = config.services.clightning; cfg = config.services.clightning;
inherit (config) nix-bitcoin-services; inherit (config) nix-bitcoin-services;
onion-chef-service = (if cfg.announce-tor then [ "onion-chef.service" ] else []);
configFile = pkgs.writeText "config" '' configFile = pkgs.writeText "config" ''
autolisten=${if cfg.autolisten then "true" else "false"}
network=bitcoin network=bitcoin
bitcoin-datadir=${config.services.bitcoind.dataDir} bitcoin-datadir=${config.services.bitcoind.dataDir}
${optionalString (cfg.proxy != null) "proxy=${cfg.proxy}"} ${optionalString (cfg.proxy != null) "proxy=${cfg.proxy}"}
@ -28,7 +28,8 @@ in {
type = types.bool; type = types.bool;
default = false; default = false;
description = '' description = ''
If enabled, the clightning service will listen. Bind (and maybe announce) on IPv4 and IPv6 interfaces if no addr,
bind-addr or announce-addr options are specified.
''; '';
}; };
proxy = mkOption { proxy = mkOption {
@ -48,6 +49,11 @@ in {
default = null; default = null;
description = "Set an IP address or UNIX domain socket to listen to"; description = "Set an IP address or UNIX domain socket to listen to";
}; };
announce-tor = mkOption {
type = types.bool;
default = false;
description = "Announce clightning Tor Hidden Service";
};
bitcoin-rpcuser = mkOption { bitcoin-rpcuser = mkOption {
type = types.str; type = types.str;
description = '' description = ''
@ -93,12 +99,13 @@ in {
"d '${cfg.dataDir}' 0770 ${cfg.user} ${cfg.group} - -" "d '${cfg.dataDir}' 0770 ${cfg.user} ${cfg.group} - -"
]; ];
services.onion-chef.access.clightning = if cfg.announce-tor then [ "clightning" ] else [];
systemd.services.clightning = { systemd.services.clightning = {
description = "Run clightningd"; description = "Run clightningd";
path = [ pkgs.nix-bitcoin.bitcoind ]; path = [ pkgs.nix-bitcoin.bitcoind ];
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
requires = [ "bitcoind.service" ]; requires = [ "bitcoind.service" ] ++ onion-chef-service;
after = [ "bitcoind.service" ]; after = [ "bitcoind.service" ] ++ onion-chef-service;
preStart = '' preStart = ''
cp ${configFile} ${cfg.dataDir}/config cp ${configFile} ${cfg.dataDir}/config
chown -R '${cfg.user}:${cfg.group}' '${cfg.dataDir}' chown -R '${cfg.user}:${cfg.group}' '${cfg.dataDir}'
@ -106,6 +113,7 @@ in {
rm -f ${cfg.dataDir}/bitcoin/lightning-rpc rm -f ${cfg.dataDir}/bitcoin/lightning-rpc
chmod 600 ${cfg.dataDir}/config chmod 600 ${cfg.dataDir}/config
echo "bitcoin-rpcpassword=$(cat ${config.nix-bitcoin.secretsDir}/bitcoin-rpcpassword)" >> '${cfg.dataDir}/config' echo "bitcoin-rpcpassword=$(cat ${config.nix-bitcoin.secretsDir}/bitcoin-rpcpassword)" >> '${cfg.dataDir}/config'
${optionalString cfg.announce-tor "echo announce-addr=$(cat /var/lib/onion-chef/clightning/clightning) >> '${cfg.dataDir}/config'"}
''; '';
serviceConfig = nix-bitcoin-services.defaultHardening // { serviceConfig = nix-bitcoin-services.defaultHardening // {
ExecStart = "${pkgs.nix-bitcoin.clightning}/bin/lightningd --lightning-dir=${cfg.dataDir}"; ExecStart = "${pkgs.nix-bitcoin.clightning}/bin/lightningd --lightning-dir=${cfg.dataDir}";