Merge fort-nix/nix-bitcoin#510: lnd, lightning-loop: add certificate options extraIPs and extraDomains

c853f380d4 lightning-loop: add certificate options `extraIPs` and `extraDomains` (Erik Arvstedt)
edfbe700e7 lnd: add certificate options `extraIPs` and `extraDomains` (Erik Arvstedt)
60a27d58a6 lnd, lightning-loop: improve `extraConfig` option description (Erik Arvstedt)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK c853f380d4

Tree-SHA512: f83ddd99826fdcae964de2ff7f45ca941f0ffb6130f5e4f8481d7e2c9946ebea8415460c0cfe68a9626a2fb0d6912e5285b580db00d78bfcfdac665426bf3649

modules/lightning-loop.nix

@@ -40,13 +40,37 @@ let
       default = if cfg.tor.proxy then config.nix-bitcoin.torClientAddressWithPort else null;
       description = "host:port of SOCKS5 proxy for connnecting to the loop server.";
     };
+    certificate = {
+      extraIPs = mkOption {
+        type = with types; listOf str;
+        default = [];
+        example = [ "60.100.0.1" ];
+        description = ''
+          Extra `subjectAltName` IPs added to the certificate.
+          This works the same as loop option `tlsextraip`.
+        '';
+      };
+      extraDomains = mkOption {
+        type = with types; listOf str;
+        default = [];
+        example = [ "example.com" ];
+        description = ''
+          Extra `subjectAltName` domain names added to the certificate.
+          This works the same as loop option `tlsextradomain`.
+        '';
+      };
+    };
     extraConfig = mkOption {
       type = types.lines;
       default = "";
       example = ''
         debuglevel=trace
       '';
-      description = "Extra lines appended to the configuration file.";
+      description = ''
+        Extra lines appended to the configuration file.
+        See here for all available options:
+        https://github.com/lightninglabs/loop/blob/11ab596080e9d36f1df43edbeba0702b25aa7457/loopd/config.go#L119
+      '';
     };
     cli = mkOption {
       default = pkgs.writeScriptBin "loop" ''
@@ -97,6 +121,8 @@ in {
       "d '${cfg.dataDir}' 0770 ${lnd.user} ${lnd.group} - -"
     ];
 
+    services.lightning-loop.certificate.extraIPs = mkIf (cfg.rpcAddress != "localhost") [ "${cfg.rpcAddress}" ];
+
     systemd.services.lightning-loop = {
       wantedBy = [ "multi-user.target" ];
       requires = [ "lnd.service" ];
@@ -115,7 +141,7 @@ in {
        loop-cert.user = lnd.user;
      };
      nix-bitcoin.generateSecretsCmds.lightning-loop = ''
-       makeCert loop '${optionalString (cfg.rpcAddress != "localhost") "IP:${cfg.rpcAddress}"}'
+       makeCert loop '${nbLib.mkCertExtraAltNames cfg.certificate}'
     '';
   };
 }

modules/lnd.nix

@@ -70,13 +70,37 @@ let
         Extra macaroon definitions.
       '';
     };
+    certificate = {
+      extraIPs = mkOption {
+        type = with types; listOf str;
+        default = [];
+        example = [ "60.100.0.1" ];
+        description = ''
+          Extra `subjectAltName` IPs added to the certificate.
+          This works the same as lnd option `tlsextraip`.
+        '';
+      };
+      extraDomains = mkOption {
+        type = with types; listOf str;
+        default = [];
+        example = [ "example.com" ];
+        description = ''
+          Extra `subjectAltName` domain names added to the certificate.
+          This works the same as lnd option `tlsextradomain`.
+        '';
+      };
+    };
     extraConfig = mkOption {
       type = types.lines;
       default = "";
       example = ''
         autopilot.active=1
       '';
-      description = "Extra lines appended to <filename>lnd.conf</filename>.";
+      description = ''
+        Extra lines appended to `lnd.conf`.
+        See here for all available options:
+        https://github.com/lightningnetwork/lnd/blob/master/sample-lnd.conf
+      '';
     };
     package = mkOption {
       type = types.package;
@@ -191,6 +215,8 @@ in {
       "d '${cfg.dataDir}' 0770 ${cfg.user} ${cfg.group} - -"
     ];
 
+    services.lnd.certificate.extraIPs = mkIf (cfg.rpcAddress != "localhost") [ "${cfg.rpcAddress}" ];
+
     systemd.services.lnd = {
       wantedBy = [ "multi-user.target" ];
       requires = [ "bitcoind.service" ];
@@ -278,7 +304,7 @@ in {
     # - Enables deployment of a mesh of server plus client nodes with predefined certs
     nix-bitcoin.generateSecretsCmds.lnd = ''
       makePasswordSecret lnd-wallet-password
-      makeCert lnd '${optionalString (cfg.rpcAddress != "localhost") "IP:${cfg.rpcAddress}"}'
+      makeCert lnd '${nbLib.mkCertExtraAltNames cfg.certificate}'
     '';
   };
 }

pkgs/lib.nix

@@ -109,4 +109,10 @@ let self = {
 
   optionalAttr = cond: name: if cond then name else null;
 
+  mkCertExtraAltNames = cert:
+    builtins.concatStringsSep "," (
+      (map (domain: "DNS:${domain}") cert.extraDomains) ++
+      (map (ip: "IP:${ip}") cert.extraIPs)
+    );
+
 }; in self

test/tests.nix

@@ -35,6 +35,13 @@ let
       # Share the same pkgs instance among tests
       nixpkgs.pkgs = mkDefault globalPkgs;
 
+      environment.systemPackages = mkMerge (with pkgs; [
+        # Needed to test macaroon creation
+        (mkIfTest "btcpayserver" [ openssl xxd ])
+        # Needed to test certificate creation
+        (mkIfTest "lnd" [ openssl ])
+      ]);
+
       tests.bitcoind = cfg.bitcoind.enable;
       services.bitcoind = {
         enable = true;
@@ -81,12 +88,19 @@ let
       tests.spark-wallet = cfg.spark-wallet.enable;
 
       tests.lnd = cfg.lnd.enable;
-      services.lnd.port = 9736;
+      services.lnd = {
+        port = 9736;
+        certificate = {
+          extraIPs = [ "10.0.0.1" "20.0.0.1" ];
+          extraDomains = [ "example.com" ];
+        };
+      };
 
       tests.lndconnect-onion-lnd = cfg.lnd.lndconnectOnion.enable;
       tests.lndconnect-onion-clightning = cfg.clightning-rest.lndconnectOnion.enable;
 
       tests.lightning-loop = cfg.lightning-loop.enable;
+      services.lightning-loop.certificate.extraIPs = [ "20.0.0.1" ];
 
       tests.lightning-pool = cfg.lightning-pool.enable;
       nix-bitcoin.onionServices.lnd.public = true;
@@ -103,8 +117,6 @@ let
         lightningBackend = mkDefault "lnd";
         lbtc = mkDefault true;
       };
-      # Needed to test macaroon creation
-      environment.systemPackages = mkIfTest "btcpayserver" (with pkgs; [ openssl xxd ]);
       test.data.btcpayserver-lbtc = config.services.btcpayserver.lbtc;
 
       tests.joinmarket = cfg.joinmarket.enable;

test/tests.py

@@ -7,9 +7,11 @@ def succeed(*cmds):
     return machine.succeed(*cmds)
 
 def assert_matches(cmd, regexp):
-    out = succeed(cmd)
-    if not re.search(regexp, out):
-        raise Exception(f"Pattern '{regexp}' not found in '{out}'")
+    assert_str_matches(succeed(cmd), regexp)
+
+def assert_str_matches(str, regexp):
+    if not re.search(regexp, str):
+        raise Exception(f"Pattern '{regexp}' not found in '{str}'")
 
 def assert_full_match(cmd, regexp):
     out = succeed(cmd)
@@ -152,6 +154,12 @@ def _():
     assert_matches("runuser -u operator -- lncli getinfo | jq", '"version"')
     assert_no_failure("lnd")
 
+    # Test certificate generation
+    cert_alt_names = succeed("</secrets/lnd-cert openssl x509 -noout -ext subjectAltName")
+    assert_str_matches(cert_alt_names, '10.0.0.1')
+    assert_str_matches(cert_alt_names, '20.0.0.1')
+    assert_str_matches(cert_alt_names, 'example.com')
+
 @test("lndconnect-onion-lnd")
 def _():
     assert_running("lnd")