signed commit

modules/bitcoind.nix

@@ -44,28 +44,31 @@ in {
         default = null;
         description = "Override the default port on which to listen for connections.";
     };
-
   };
-
   config = mkIf cfg.enable {
-      users.users.bitcoin =
-        {
+    users.users.bitcoin = {
         description = "Bitcoind User";
         createHome  = true;
         inherit home;
     };
-      systemd.services.bitcoind =
-        { description = "Run bitcoind";
+    systemd.services.bitcoind = {
+      description = "Run bitcoind";
       path  = [ pkgs.bitcoin ];
       wantedBy = [ "multi-user.target" ];
       preStart = ''
         mkdir -p ${home}/.bitcoin
         ln -sf ${configFile} ${home}/.bitcoin/bitcoin.conf
         '';
-          serviceConfig =
-            {
+      serviceConfig = {
         ExecStart = "${pkgs.bitcoin}/bin/bitcoind";
         User = "bitcoin";
+        Restart = "on-failure";
+
+        PrivateTmp = "true";
+        ProtectSystem = "full";
+        NoNewPrivileges = "true";
+        PrivateDevices = "true";
+        MemoryDenyWriteExecute = "true";
       };
     };
   };

modules/clightning.nix

@@ -0,0 +1,72 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.clightning;
+  home = "/var/lib/clightning";
+  configFile = pkgs.writeText "config" ''
+    autolisten=false
+    network=bitcoin
+    bitcoin-rpcuser=${cfg.bitcoin-rpcuser}
+    bitcoin-rpcpassword=${cfg.bitcoin-rpcpassword}
+  '';
+in {
+  options.services.clightning = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        If enabled, the clightning service will be installed.
+      '';
+    };
+    autolisten = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        If enabled, the clightning service will listen.
+      '';
+    };
+    bitcoin-rpcuser = mkOption {
+      type = types.string;
+      description = ''
+        Bitcoin RPC user
+      '';
+    };
+    bitcoin-rpcpassword = mkOption {
+      type = types.string;
+      description = ''
+        Bitcoin RPC password
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+      users.users.clightning =
+        {
+          description = "clightning User";
+          createHome  = true;
+          inherit home;
+      };
+      systemd.services.clightning =
+        { description = "Run clightningd";
+          path  = [ pkgs.clightning pkgs.bitcoin ];
+          wantedBy = [ "multi-user.target" ];
+          preStart = ''
+            mkdir -p ${home}/.lightning
+            ln -sf ${configFile} ${home}/.lightning/config
+            '';
+          serviceConfig =
+            {
+              ExecStart = "${pkgs.clightning}/bin/lightningd";
+              User = "clightning";
+              Restart = "on-failure";
+              PrivateTmp = "true";
+              ProtectSystem = "full";
+              NoNewPrivileges = "true";
+              PrivateDevices = "true";
+              MemoryDenyWriteExecute = "true";
+            };
+        };
+    };
+}