spark-wallet: use onionServices

Also remove the unneeded definition of ReadWritePaths because the
service doesn't need write access to onion files.

modules/onion-services.nix

@@ -103,6 +103,15 @@ in {
     # Set sensible defaults for some services
     {
       nix-bitcoin.onionServices = {
+        spark-wallet = {
+          externalPort = 80;
+          # Enable 'public' by default, but don't auto-enable the onion service.
+          # When the onion service is enabled, 'public' lets spark-wallet generate
+          # a QR code for accessing the web interface.
+          public = true;
+          # Low priority so we can override this with mkDefault in ./presets/enable-tor.nix
+          enable = mkOverride 1400 false;
+        };
         btcpayserver = {
           externalPort = 80;
         };

modules/presets/enable-tor.nix

@@ -31,5 +31,6 @@ in {
     liquidd.enable = defaultTrue;
     electrs.enable = defaultTrue;
     btcpayserver.enable = defaultTrue;
+    spark-wallet.enable = defaultTrue;
   };
 }

modules/presets/secure-node.nix

@@ -53,10 +53,6 @@ in {
       listen = true;
     };
 
-    services.spark-wallet = {
-      onion-service = true;
-    };
-
     # Backups
     services.backups = {
       program = "duplicity";

modules/spark-wallet.nix

@@ -5,14 +5,13 @@ with lib;
 let
   cfg = config.services.spark-wallet;
   inherit (config) nix-bitcoin-services;
-  onionAddressesService = (if cfg.onion-service then [ "onion-addresses.service" ] else []);
 
   # Use wasabi rate provider because the default (bitstamp) doesn't accept
   # connections through Tor
   torRateProvider = "--rate-provider wasabi --proxy socks5h://${config.services.tor.client.socksListenAddress}";
   startScript = ''
-    ${optionalString cfg.onion-service ''
+    ${optionalString (cfg.getPublicAddressCmd != "") ''
-      publicURL="--public-url http://$(cat /var/lib/onion-addresses/spark-wallet/spark-wallet)"
+      publicURL="--public-url http://$(${cfg.getPublicAddressCmd})"
     ''}
     exec ${config.nix-bitcoin.pkgs.spark-wallet}/bin/spark-wallet \
       --ln-path '${config.services.clightning.networkDir}'  \
@@ -41,19 +40,21 @@ in {
       default = 9737;
       description = "http(s) server port.";
     };
-    onion-service = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        "If enabled, configures spark-wallet to be reachable through an onion service.";
-      '';
-    };
     extraArgs = mkOption {
       type = types.separatedString " ";
       default = "";
       description = "Extra command line arguments passed to spark-wallet.";
     };
-    enforceTor =  nix-bitcoin-services.enforceTor;
+    getPublicAddressCmd = mkOption {
+      type = types.str;
+      default = "";
+      description = ''
+        Bash expression which outputs the public service address.
+        If set, spark-wallet prints a QR code to the systemd journal which
+        encodes an URL for accessing the web interface.
+      '';
+    };
+    inherit (nix-bitcoin-services) enforceTor;
   };
 
   config = mkIf cfg.enable {
@@ -66,24 +67,16 @@ in {
     };
     users.groups.spark-wallet = {};
 
-    services.tor.hiddenServices.spark-wallet = mkIf cfg.onion-service {
-      map = [{
-        port = 80; toPort = cfg.port; toHost = cfg.address;
-      }];
-      version = 3;
-    };
-    nix-bitcoin.onionAddresses.access.spark-wallet = if cfg.onion-service then [ "spark-wallet" ] else [];
     systemd.services.spark-wallet = {
       description = "Run spark-wallet";
       wantedBy = [ "multi-user.target" ];
-      requires = [ "clightning.service" ] ++ onionAddressesService;
+      requires = [ "clightning.service" ];
-      after = [ "clightning.service" ]  ++ onionAddressesService;
+      after = [ "clightning.service" ];
       script = startScript;
       serviceConfig = nix-bitcoin-services.defaultHardening // {
         User = "spark-wallet";
         Restart = "on-failure";
         RestartSec = "10s";
-        ReadWritePaths = mkIf cfg.onion-service "/var/lib/onion-addresses";
       } // (if cfg.enforceTor
             then nix-bitcoin-services.allowTor
             else nix-bitcoin-services.allowAnyIP)