From 2dd1a741f750a318861e0c63885ae3e8ce3ce72a Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 28 Sep 2020 09:41:17 +0200 Subject: [PATCH 1/9] modules: group imports --- modules/modules.nix | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/modules/modules.nix b/modules/modules.nix index 967053b..8efe809 100644 --- a/modules/modules.nix +++ b/modules/modules.nix @@ -2,24 +2,29 @@ { imports = [ + # Core modules + ./secrets/secrets.nix + + # Main features ./bitcoind.nix ./clightning.nix ./lightning-charge.nix ./nanopos.nix - ./liquid.nix ./spark-wallet.nix - ./electrs.nix - ./onion-chef.nix - ./recurring-donations.nix - ./hardware-wallets.nix ./lnd.nix ./lightning-loop.nix - ./secrets/secrets.nix - ./netns-isolation.nix - ./security.nix - ./backups.nix ./btcpayserver.nix + ./electrs.nix + ./liquid.nix ./joinmarket.nix + ./hardware-wallets.nix + ./recurring-donations.nix + + # Support features + ./security.nix + ./netns-isolation.nix + ./backups.nix + ./onion-chef.nix ]; disabledModules = [ "services/networking/bitcoind.nix" ]; From 9aa19c3fddef455b2dcf130531b01a12144b4d7e Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 28 Sep 2020 13:09:03 +0200 Subject: [PATCH 2/9] extract operator module --- modules/bitcoind.nix | 1 + modules/clightning.nix | 1 + modules/hardware-wallets.nix | 1 + modules/joinmarket.nix | 4 +++ modules/liquid.nix | 3 +++ modules/lnd.nix | 6 +++++ modules/modules.nix | 1 + modules/netns-isolation.nix | 1 + modules/nodeinfo.nix | 2 +- modules/operator.nix | 47 +++++++++++++++++++++++++++++++++ modules/presets/secure-node.nix | 39 +++++---------------------- 11 files changed, 73 insertions(+), 33 deletions(-) create mode 100644 modules/operator.nix diff --git a/modules/bitcoind.nix b/modules/bitcoind.nix index 5862190..3b1e5d1 100644 --- a/modules/bitcoind.nix +++ b/modules/bitcoind.nix @@ -380,6 +380,7 @@ in { }; users.groups.${cfg.group} = {}; users.groups.bitcoinrpc = {}; + nix-bitcoin.operator.groups = [ cfg.group ]; nix-bitcoin.secrets.bitcoin-rpcpassword-privileged.user = "bitcoin"; nix-bitcoin.secrets.bitcoin-rpcpassword-public = { diff --git a/modules/clightning.nix b/modules/clightning.nix index edc42e9..1e654ee 100644 --- a/modules/clightning.nix +++ b/modules/clightning.nix @@ -99,6 +99,7 @@ in { extraGroups = [ "bitcoinrpc" ]; }; users.groups.${cfg.group} = {}; + nix-bitcoin.operator.groups = [ cfg.group ]; systemd.tmpfiles.rules = [ "d '${cfg.dataDir}' 0770 ${cfg.user} ${cfg.group} - -" diff --git a/modules/hardware-wallets.nix b/modules/hardware-wallets.nix index 4d53884..8ff94e2 100644 --- a/modules/hardware-wallets.nix +++ b/modules/hardware-wallets.nix @@ -48,6 +48,7 @@ in { usbutils ]; users.groups."${cfg.group}" = {}; + nix-bitcoin.operator.groups = [ cfg.group ]; }) (mkIf cfg.ledger { diff --git a/modules/joinmarket.nix b/modules/joinmarket.nix index 7ce8b53..752c0dc 100644 --- a/modules/joinmarket.nix +++ b/modules/joinmarket.nix @@ -125,6 +125,10 @@ in { home = cfg.dataDir; }; users.groups.${cfg.group} = {}; + nix-bitcoin.operator = { + groups = [ cfg.group ]; + sudoUsers = [ cfg.group ]; + }; systemd.tmpfiles.rules = [ "d '${cfg.dataDir}' 0770 ${cfg.user} ${cfg.group} - -" diff --git a/modules/liquid.nix b/modules/liquid.nix index ae2b07e..e3b4de3 100644 --- a/modules/liquid.nix +++ b/modules/liquid.nix @@ -263,12 +263,15 @@ in { else nix-bitcoin-services.allowAnyIP ); }; + users.users.${cfg.user} = { group = cfg.group; extraGroups = [ "bitcoinrpc" ]; description = "Liquid sidechain user"; }; users.groups.${cfg.group} = {}; + nix-bitcoin.operator.groups = [ cfg.group ]; + nix-bitcoin.secrets.liquid-rpcpassword.user = "liquid"; }; } diff --git a/modules/lnd.nix b/modules/lnd.nix index e489d07..c58263e 100644 --- a/modules/lnd.nix +++ b/modules/lnd.nix @@ -259,6 +259,7 @@ in { else nix-bitcoin-services.allowAnyIP ) // nix-bitcoin-services.allowAnyProtocol; # For ZMQ }; + users.users.lnd = { description = "LND User"; group = "lnd"; @@ -266,6 +267,11 @@ in { home = cfg.dataDir; # lnd creates .lnd dir in HOME }; users.groups.lnd = {}; + nix-bitcoin.operator = { + groups = [ "lnd" ]; + sudoUsers = [ "lnd" ]; + }; + nix-bitcoin.secrets = { lnd-wallet-password.user = "lnd"; lnd-key.user = "lnd"; diff --git a/modules/modules.nix b/modules/modules.nix index 8efe809..64619b2 100644 --- a/modules/modules.nix +++ b/modules/modules.nix @@ -4,6 +4,7 @@ imports = [ # Core modules ./secrets/secrets.nix + ./operator.nix # Main features ./bitcoind.nix diff --git a/modules/netns-isolation.nix b/modules/netns-isolation.nix index cfeb253..d81b780 100644 --- a/modules/netns-isolation.nix +++ b/modules/netns-isolation.nix @@ -82,6 +82,7 @@ in { User that is allowed to execute commands in the service network namespaces. The user's group is also authorized. ''; + default = config.nix-bitcoin.operator.name; }; netns = mkOption { diff --git a/modules/nodeinfo.nix b/modules/nodeinfo.nix index 5577d52..86f4174 100644 --- a/modules/nodeinfo.nix +++ b/modules/nodeinfo.nix @@ -3,7 +3,7 @@ with lib; let - operatorName = config.nix-bitcoin.operatorName; + operatorName = config.nix-bitcoin.operator.name; script = pkgs.writeScriptBin "nodeinfo" '' set -eo pipefail diff --git a/modules/operator.nix b/modules/operator.nix new file mode 100644 index 0000000..a7a7361 --- /dev/null +++ b/modules/operator.nix @@ -0,0 +1,47 @@ +# Define an operator user for convenient interactive access to nix-bitcoin +# features and services. +# +# When using nix-bitcoin as part of a larger system config, set +# `nix-bitcoin.operator.name` to your main user name. + +{ config, lib, pkgs, options, ... }: + +with lib; +let + cfg = config.nix-bitcoin.operator; +in { + options.nix-bitcoin.operator = { + enable = mkEnableOption "operator user"; + name = mkOption { + type = types.str; + default = "operator"; + description = "User name."; + }; + groups = mkOption { + type = with types; listOf str; + default = []; + description = "Extra groups."; + }; + sudoUsers = mkOption { + type = with types; listOf str; + default = []; + description = "Users as which the operator is allowed to run commands."; + }; + }; + + config = mkIf cfg.enable { + users.users.${cfg.name} = { + isNormalUser = true; + extraGroups = [ + "systemd-journal" + "proc" # Enable full /proc access and systemd-status + ] ++ cfg.groups; + }; + + security.sudo.extraConfig = mkIf (cfg.sudoUsers != []) (let + users = builtins.concatStringsSep "," cfg.sudoUsers; + in '' + ${cfg.name} ALL=(${users}) NOPASSWD: ALL + ''); + }; +} diff --git a/modules/presets/secure-node.nix b/modules/presets/secure-node.nix index dd1839b..fbbcb05 100644 --- a/modules/presets/secure-node.nix +++ b/modules/presets/secure-node.nix @@ -5,7 +5,7 @@ with lib; let cfg = config.services; - operatorName = config.nix-bitcoin.operatorName; + operatorName = config.nix-bitcoin.operator.name; mkHiddenService = map: { map = [ map ]; @@ -29,11 +29,6 @@ in { default = 9735; description = "Port on which to listen for tor client connections."; }; - nix-bitcoin.operatorName = mkOption { - type = types.str; - default = "operator"; - description = "Less-privileged user's name."; - }; }; config = { @@ -159,35 +154,15 @@ in { qrencode ]; - # Create operator user which can access the node's services + services.onion-chef = { + enable = true; + access.${operatorName} = [ "bitcoind" "clightning" "nginx" "liquidd" "spark-wallet" "electrs" "btcpayserver" "sshd" ]; + }; + + nix-bitcoin.operator.enable = true; users.users.${operatorName} = { - isNormalUser = true; - extraGroups = [ - "systemd-journal" - "proc" # Enable full /proc access and systemd-status - cfg.bitcoind.group - ] - ++ (optionals cfg.clightning.enable [ "clightning" ]) - ++ (optionals cfg.lnd.enable [ "lnd" ]) - ++ (optionals cfg.liquidd.enable [ cfg.liquidd.group ]) - ++ (optionals (cfg.hardware-wallets.ledger || cfg.hardware-wallets.trezor) - [ cfg.hardware-wallets.group ]) - ++ (optionals cfg.joinmarket.enable [ cfg.joinmarket.group ]); openssh.authorizedKeys.keys = config.users.users.root.openssh.authorizedKeys.keys; }; - nix-bitcoin.netns-isolation.allowedUser = operatorName; - # Give operator access to onion hostnames - services.onion-chef.enable = true; - services.onion-chef.access.${operatorName} = [ "bitcoind" "clightning" "nginx" "liquidd" "spark-wallet" "electrs" "btcpayserver" "sshd" ]; - - security.sudo.configFile = - (optionalString cfg.lnd.enable '' - ${operatorName} ALL=(lnd) NOPASSWD: ALL - '') + - (optionalString cfg.joinmarket.enable '' - ${operatorName} ALL=(${cfg.joinmarket.user}) NOPASSWD: ALL - ''); - # Enable nixops ssh for operator (`nixops ssh operator@mynode`) on nixops-vbox deployments systemd.services.get-vbox-nixops-client-key = mkIf (builtins.elem ".vbox-nixops-client-key" config.services.openssh.authorizedKeysFiles) { From c07e767889f56d3c61e434877086ec8f86488b78 Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 28 Sep 2020 13:09:04 +0200 Subject: [PATCH 3/9] test: add python test requirements This allows running the Python tests without importing secure-node. --- test/tests.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/test/tests.nix b/test/tests.nix index 3e90c0d..afac7c0 100644 --- a/test/tests.nix +++ b/test/tests.nix @@ -13,6 +13,12 @@ let testEnv = rec { ./lib/test-lib.nix ../modules/modules.nix ../modules/secrets/generate-secrets.nix + { + # Features required by the Python test suite + nix-bitcoin.secretsDir = "/secrets"; + nix-bitcoin.operator.enable = true; + environment.systemPackages = with pkgs; [ jq ]; + } ]; config = { From 480d0d3959aac60a3d6e3dae61a8cc6ad8bc3597 Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 28 Sep 2020 13:09:05 +0200 Subject: [PATCH 4/9] liquid: fix bitcoin rpc settings - Remove redundant option mainchainrpchost. This option is already provided by bitcoind. - Set a working default for rpcport and rpcuser. Enables use without secure-node. --- modules/liquid.nix | 13 +++---------- modules/netns-isolation.nix | 1 - modules/presets/secure-node.nix | 4 ---- 3 files changed, 3 insertions(+), 15 deletions(-) diff --git a/modules/liquid.nix b/modules/liquid.nix index e3b4de3..e9ddee9 100644 --- a/modules/liquid.nix +++ b/modules/liquid.nix @@ -30,7 +30,9 @@ let ${lib.concatMapStrings (rpcallowip: "rpcallowip=${rpcallowip}\n") cfg.rpcallowip} ${optionalString (cfg.rpcuser != null) "rpcuser=${cfg.rpcuser}"} ${optionalString (cfg.rpcpassword != null) "rpcpassword=${cfg.rpcpassword}"} - ${optionalString (cfg.mainchainrpchost != null) "mainchainrpchost=${cfg.mainchainrpchost}"} + mainchainrpchost=${builtins.elemAt config.services.bitcoind.rpcbind 0} + mainchainrpcport=${toString config.services.bitcoind.rpc.port} + mainchainrpcuser=${config.services.bitcoind.rpc.users.public.name} # Extra config options (from liquidd nixos service) ${cfg.extraConfig} @@ -146,15 +148,6 @@ in { default = null; description = "Password for JSON-RPC connections"; }; - mainchainrpchost = mkOption { - type = types.nullOr types.str; - default = null; - description = '' - The address which the daemon will try to connect to the trusted - mainchain daemon to validate peg-ins. - ''; - }; - testnet = mkOption { type = types.bool; default = false; diff --git a/modules/netns-isolation.nix b/modules/netns-isolation.nix index d81b780..a85d3db 100644 --- a/modules/netns-isolation.nix +++ b/modules/netns-isolation.nix @@ -295,7 +295,6 @@ in { rpcallowip = [ "127.0.0.1" ] ++ map (n: "${netns.${n}.address}") netns.liquidd.availableNetns; - mainchainrpchost = netns.bitcoind.address; cliExec = mkCliExec "liquidd"; }; diff --git a/modules/presets/secure-node.nix b/modules/presets/secure-node.nix index fbbcb05..f7320e6 100644 --- a/modules/presets/secure-node.nix +++ b/modules/presets/secure-node.nix @@ -102,10 +102,6 @@ in { services.liquidd = { rpcuser = "liquidrpc"; prune = 1000; - extraConfig = '' - mainchainrpcuser=${config.services.bitcoind.rpc.users.public.name} - mainchainrpcport=8332 - ''; validatepegin = true; listen = true; proxy = cfg.tor.client.socksListenAddress; From e0117d56d12ae6d36501ff9b6a36a6fe7a1e1cb4 Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 28 Sep 2020 13:09:06 +0200 Subject: [PATCH 5/9] spark-wallet: fix always-on onion-chef setting Previously, the service failed when onion-service was disabled. --- modules/spark-wallet.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/spark-wallet.nix b/modules/spark-wallet.nix index 8a0f6a1..cd2a860 100644 --- a/modules/spark-wallet.nix +++ b/modules/spark-wallet.nix @@ -89,7 +89,7 @@ in { User = "spark-wallet"; Restart = "on-failure"; RestartSec = "10s"; - ReadWritePaths = "/var/lib/onion-chef"; + ReadWritePaths = mkIf cfg.onion-service "/var/lib/onion-chef"; } // (if cfg.enforceTor then nix-bitcoin-services.allowTor else nix-bitcoin-services.allowAnyIP) From 7d1797cec7a314342b6988d3d635955eb8b3cff2 Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 28 Sep 2020 13:09:07 +0200 Subject: [PATCH 6/9] clightning: add option 'extraConfig' --- modules/clightning.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/clightning.nix b/modules/clightning.nix index 1e654ee..50dc7c0 100644 --- a/modules/clightning.nix +++ b/modules/clightning.nix @@ -15,6 +15,7 @@ let ${optionalString (cfg.bitcoin-rpcconnect != null) "bitcoin-rpcconnect=${cfg.bitcoin-rpcconnect}"} bitcoin-rpcuser=${config.services.bitcoind.rpc.users.public.name} rpc-file-mode=0660 + ${cfg.extraConfig} ''; in { options.services.clightning = { @@ -70,6 +71,11 @@ in { default = "/var/lib/clightning"; description = "The data directory for clightning."; }; + extraConfig = mkOption { + type = types.lines; + default = ""; + description = "Additional lines appended to the config file."; + }; user = mkOption { type = types.str; default = "clightning"; From 1a32292e07c8e406ba0b9a66793e8cd1d939a12d Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 28 Sep 2020 13:09:08 +0200 Subject: [PATCH 7/9] test: speed up clightning startup when offline --- test/tests.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/test/tests.nix b/test/tests.nix index afac7c0..7456a90 100644 --- a/test/tests.nix +++ b/test/tests.nix @@ -29,6 +29,8 @@ let testEnv = rec { }; tests.clightning = cfg.clightning.enable; + # When WAN is disabled, DNS bootstrapping slows down service startup by ~15 s. + services.clightning.extraConfig = mkIf config.test.noConnections "disable-dns"; tests.spark-wallet = cfg.spark-wallet.enable; From 0a6b9beda5e02118e8ca6073b02d511cab021227 Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 28 Sep 2020 13:09:09 +0200 Subject: [PATCH 8/9] run-tests: simplify setting default scenario --- test/run-tests.sh | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/test/run-tests.sh b/test/run-tests.sh index dd1bed6..b3e460d 100755 --- a/test/run-tests.sh +++ b/test/run-tests.sh @@ -16,8 +16,8 @@ # Example: # ./run-tests.sh -s electrs # -# Run test and link results to avoid garbage collection -# ./run-tests.sh [--scenario ] --out-link-prefix /tmp/nix-bitcoin-test build +# Run test(s) and link results to avoid garbage collection +# ./run-tests.sh [--scenario ] --out-link-prefix /tmp/nix-bitcoin-test # # Pass extra args to nix-build # ./run-tests.sh build --builders 'ssh://mybuildhost - - 15' @@ -178,13 +178,11 @@ build() { fi } -# Set default scenario for all actions other than 'build' -if [[ $1 && $1 != build ]]; then - : ${scenario:=default} -fi - command="${1:-build}" shift || true +if [[ $command != build ]]; then + : ${scenario:=default} +fi if [[ $command == eval ]]; then command=evalTest fi From bfed10b2faea4ed43d21936b4564e799c669ae0d Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 28 Sep 2020 13:09:10 +0200 Subject: [PATCH 9/9] run-tests: add command 'all' 'all' includes test 'full', which now succeeds. --- test/run-tests.sh | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/test/run-tests.sh b/test/run-tests.sh index b3e460d..0b0197c 100755 --- a/test/run-tests.sh +++ b/test/run-tests.sh @@ -168,13 +168,26 @@ vmTestNixExpr() { EOF } +# A basic subset of tests to keep the total runtime within +# manageable bounds (<3 min on desktop systems). +# These are also run on the CI server. +basic() { + scenario=default buildTest "$@" + scenario=netns buildTest "$@" + scenario=full evalTest "$@" +} + +all() { + scenario=default buildTest "$@" + scenario=netns buildTest "$@" + scenario=full buildTest "$@" +} + build() { if [[ $scenario ]]; then buildTest "$@" else - scenario=default buildTest "$@" - scenario=netns buildTest "$@" - scenario=full evalTest "$@" + basic "$@" fi }