greg/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add operator user

Browse Source
This commit is contained in:
Jonas Nick 2018-11-28 23:54:19 +00:00
parent 94258c505e
commit 95c706b1b0
3 changed files with 38 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
modules/bitcoind.nix
View File

@ -187,6 +187,7 @@ in {
chown '${cfg.user}:${cfg.group}' '${cfg.dataDir}'
fi
cp '${configFile}' '${cfg.dataDir}/bitcoin.conf'
chmod o-rw '${cfg.dataDir}/bitcoin.conf'
echo "rpcpassword=$(cat /secrets/bitcoin-rpcpassword)" >> '${cfg.dataDir}/bitcoin.conf'
'';
serviceConfig = {

30
modules/clightning.nix
View File

@ -4,7 +4,6 @@ with lib;
let
cfg = config.services.clightning;
home = "/var/lib/clightning";
configFile = pkgs.writeText "config" ''
autolisten=false
network=bitcoin
@ -32,16 +31,25 @@ in {
Bitcoin RPC user
'';
};
dataDir = mkOption {
type = types.path;
default = "/var/lib/clightning";
description = "The data directory for bitcoind.";
};
};
config = mkIf cfg.enable {
users.users.clightning =
{
description = "clightning User";
createHome = true;
group = "clightning";
extraGroups = [ "bitcoinrpc" "keys" ];
inherit home;
home = cfg.dataDir;
};
users.groups.clightning = {
name = "clightning";
};
systemd.services.clightning =
{ description = "Run clightningd";
path = [ pkgs.bash pkgs.clightning pkgs.bitcoin ];
@ -49,15 +57,19 @@ in {
requires = [ "bitcoind.service" ];
after = [ "bitcoind.service" ];
preStart = ''
mkdir -p ${home}/.lightning
rm -f ${home}/.lightning/config
cp ${configFile} ${home}/.lightning/config
chmod +w ${home}/.lightning/config
echo "bitcoin-rpcpassword=$(cat /secrets/bitcoin-rpcpassword)" >> '${home}/.lightning/config'
mkdir -m 0770 -p ${cfg.dataDir}
rm -f ${cfg.dataDir}/config
chown 'clightning:clightning' '${cfg.dataDir}'
cp ${configFile} ${cfg.dataDir}/config
chown 'clightning:clightning' '${cfg.dataDir}/config'
chmod +w ${cfg.dataDir}/config
chmod o-rw ${cfg.dataDir}/config
echo "bitcoin-rpcpassword=$(cat /secrets/bitcoin-rpcpassword)" >> '${cfg.dataDir}/config'
'';
serviceConfig =
{
ExecStart = "${pkgs.clightning}/bin/lightningd";
PermissionsStartOnly = "true";
ExecStart = "${pkgs.clightning}/bin/lightningd --lightning-dir=${cfg.dataDir}";
User = "clightning";
Restart = "on-failure";
RestartSec = "10s";

18
modules/nixbitcoin.nix
View File

@ -23,6 +23,7 @@ in {
};
config = mkIf cfg.enable {
# Add bitcoinrpc group
users.groups.bitcoinrpc = {};
# Tor
@ -69,15 +70,28 @@ in {
};
# Define a user account. Don't forget to set a password with ‘passwd’.
users.users.guest = {
users.users.operator = {
isNormalUser = true;
extraGroups = [ "clightning" config.services.bitcoind.group ];
};
environment.interactiveShellInit = ''
alias bitcoin-cli='bitcoin-cli -datadir=${config.services.bitcoind.dataDir}'
alias lightning-cli='sudo -u clightning lightning-cli --lightning-dir=${config.services.clightning.dataDir}'
'';
# Unfortunately c-lightning doesn't allow setting the permissions of the rpc socket
# https://github.com/ElementsProject/lightning/issues/1366
security.sudo.configFile = ''
operator ALL=(clightning) NOPASSWD: ALL
'';
# Give root ssh access to the operator account
systemd.services.copy-root-authorized-keys = {
description = "Copy root authorized keys";
wantedBy = [ "multi-user.target" ];
path = [ ];
serviceConfig = {
ExecStart = "${pkgs.bash}/bin/bash -c \"mkdir -p ${config.users.users.guest.home}/.ssh && cp ${config.users.users.root.home}/.vbox-nixops-client-key ${config.users.users.guest.home}/.ssh/authorized_keys && chown -R guest ${config.users.users.guest.home}/.ssh\"";
ExecStart = "${pkgs.bash}/bin/bash -c \"mkdir -p ${config.users.users.operator.home}/.ssh && cp ${config.users.users.root.home}/.vbox-nixops-client-key ${config.users.users.operator.home}/.ssh/authorized_keys && chown -R operator ${config.users.users.operator.home}/.ssh\"";
user = "root";
type = "oneshot";
};