Merge #234: loop: v0.8.1 -> v0.9.0

a89a3e934f test: increase diskSize (nixbitcoin)
24b506ff8a tests: simplify lightning-loop test (nixbitcoin)
e7c5f956ea lightning-loop: update module (nixbitcoin)
4a503f57bd lightning-loop: v0.8.1 -> v0.9.0 (nixbitcoin)

Pull request description:

ACKs for top commit:
  jonasnick:
    reACK a89a3e934f
  erikarvstedt:
    I think it's okay if you would just merge 24b506ff8a, which is the direct parent of the ACK'd a89a3e934f, and removing a89a3e934f itself is totally uncontroversial.

Tree-SHA512: cee2a2714c714a22c35cea0fa829b42a371540983609cda6609f4d063d849f2e725643bd77cfe78eb71665725164d63f83b6c2589be9e72ba30aaecd7c8dee6c
This commit is contained in:
Jonas Nick 2020-09-29 17:52:49 +00:00
commit c051544d46
No known key found for this signature in database
GPG Key ID: 4861DBF262123605
6 changed files with 56 additions and 30 deletions

View File

@ -6,8 +6,21 @@ let
cfg = config.services.lightning-loop; cfg = config.services.lightning-loop;
inherit (config) nix-bitcoin-services; inherit (config) nix-bitcoin-services;
secretsDir = config.nix-bitcoin.secretsDir; secretsDir = config.nix-bitcoin.secretsDir;
in { configFile = builtins.toFile "loop.conf" ''
datadir=${cfg.dataDir}
logdir=${cfg.dataDir}/logs
tlscertpath=${secretsDir}/loop-cert
tlskeypath=${secretsDir}/loop-key
lnd.host=${builtins.elemAt config.services.lnd.rpclisten 0}:${toString config.services.lnd.rpcPort}
lnd.macaroondir=${config.services.lnd.dataDir}/chain/bitcoin/mainnet
lnd.tlspath=${secretsDir}/lnd-cert
${optionalString (cfg.proxy != null) "server.proxy=${cfg.proxy}"}
${cfg.extraConfig}
'';
in {
options.services.lightning-loop = { options.services.lightning-loop = {
enable = mkEnableOption "lightning-loop"; enable = mkEnableOption "lightning-loop";
package = mkOption { package = mkOption {
@ -16,26 +29,32 @@ in {
defaultText = "pkgs.nix-bitcoin.lightning-loop"; defaultText = "pkgs.nix-bitcoin.lightning-loop";
description = "The package providing lightning-loop binaries."; description = "The package providing lightning-loop binaries.";
}; };
dataDir = mkOption {
type = types.path;
default = "/var/lib/lightning-loop";
description = "The data directory for lightning-loop.";
};
proxy = mkOption { proxy = mkOption {
type = types.nullOr types.str; type = types.nullOr types.str;
default = null; default = null;
description = "Connect through SOCKS5 proxy"; description = "host:port of SOCKS5 proxy for connnecting to the loop server.";
}; };
extraArgs = mkOption { extraConfig = mkOption {
type = types.separatedString " "; type = types.lines;
default = ""; default = "";
description = "Extra command line arguments passed to loopd."; example = ''
debuglevel=trace
'';
description = "Extra lines appended to the configuration file.";
}; };
cli = mkOption { cli = mkOption {
default = pkgs.writeScriptBin "loop" default = pkgs.writeScriptBin "loop" ''
# Switch user because lnd makes datadir contents readable by user only ${cfg.cliExec} ${cfg.package}/bin/loop --tlscertpath ${secretsDir}/loop-cert "$@"
''
${cfg.cliExec} sudo -u lnd ${cfg.package}/bin/loop "$@"
''; '';
description = "Binary to connect with the lnd instance."; description = "Binary to connect with the lightning-loop instance.";
}; };
inherit (nix-bitcoin-services) cliExec; inherit (nix-bitcoin-services) cliExec;
enforceTor = nix-bitcoin-services.enforceTor; enforceTor = nix-bitcoin-services.enforceTor;
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
@ -47,27 +66,28 @@ in {
environment.systemPackages = [ cfg.package (hiPrio cfg.cli) ]; environment.systemPackages = [ cfg.package (hiPrio cfg.cli) ];
systemd.tmpfiles.rules = [
"d '${cfg.dataDir}' 0770 lnd lnd - -"
];
systemd.services.lightning-loop = { systemd.services.lightning-loop = {
description = "Run loopd";
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
requires = [ "lnd.service" ]; requires = [ "lnd.service" ];
after = [ "lnd.service" ]; after = [ "lnd.service" ];
serviceConfig = nix-bitcoin-services.defaultHardening // { serviceConfig = nix-bitcoin-services.defaultHardening // {
ExecStart = '' ExecStart = "${cfg.package}/bin/loopd --configfile=${configFile}";
${cfg.package}/bin/loopd \
--lnd.host=${config.services.lnd.listen}:10009 \
--lnd.macaroondir=${config.services.lnd.dataDir}/chain/bitcoin/mainnet \
--lnd.tlspath=${secretsDir}/lnd-cert \
${optionalString (cfg.proxy != null) "--server.proxy=${cfg.proxy}"} \
${cfg.extraArgs}
'';
User = "lnd"; User = "lnd";
Restart = "on-failure"; Restart = "on-failure";
RestartSec = "10s"; RestartSec = "10s";
ReadWritePaths = "${config.services.lnd.dataDir}"; ReadWritePaths = "${cfg.dataDir}";
} // (if cfg.enforceTor } // (if cfg.enforceTor
then nix-bitcoin-services.allowTor then nix-bitcoin-services.allowTor
else nix-bitcoin-services.allowAnyIP); else nix-bitcoin-services.allowAnyIP);
}; };
nix-bitcoin.secrets = {
loop-key.user = "lnd";
loop-cert.user = "lnd";
};
}; };
} }

View File

@ -34,3 +34,10 @@ if [[ ! -e lnd-key || ! -e lnd-cert ]]; then
openssl req -config $opensslConf -x509 -sha256 -days 1825 -key lnd-key -in lnd.csr -out lnd-cert openssl req -config $opensslConf -x509 -sha256 -days 1825 -key lnd-key -in lnd.csr -out lnd-cert
rm lnd.csr rm lnd.csr
fi fi
if [[ ! -e loop-key || ! -e loop-cert ]]; then
openssl ecparam -genkey -name prime256v1 -out loop-key
openssl req -config $opensslConf -new -sha256 -key loop-key -out loop.csr -subj '/CN=localhost/O=loopd'
openssl req -config $opensslConf -x509 -sha256 -days 1825 -key loop-key -in loop.csr -out loop-cert
rm loop.csr
fi

View File

@ -32,3 +32,5 @@ IP.1 = 127.0.0.1
DNS.1 = localhost DNS.1 = localhost
# TODO: Remove hardcoded lnd IP # TODO: Remove hardcoded lnd IP
IP.2 = 169.254.1.14 IP.2 = 169.254.1.14
# TODO: Remove hardcoded loopd IP
IP.3 = 169.254.1.22

View File

@ -2,17 +2,17 @@
buildGoModule rec { buildGoModule rec {
pname = "lightning-loop"; pname = "lightning-loop";
version = "0.8.1-beta"; version = "0.9.0-beta";
src = fetchurl { src = fetchurl {
url = "https://github.com/lightninglabs/loop/archive/v${version}.tar.gz"; url = "https://github.com/lightninglabs/loop/archive/v${version}.tar.gz";
# Use ./get-sha256.sh to fetch latest (verified) sha256 # Use ./get-sha256.sh to fetch latest (verified) sha256
sha256 = "36815049c7807b1f0b2b0694ae64b2ec23819240952cb327c9b9e0d530ac4696"; sha256 = "82f7c1c0c1d2ddec59c7c5e0780ae645f97ecdaca00b397cd533b27db7a6b7ca";
}; };
subPackages = [ "cmd/loop" "cmd/loopd" ]; subPackages = [ "cmd/loop" "cmd/loopd" ];
vendorSha256 = "0y1j4ca4njx9fyyq3qv8hmcvs5ig6kyx6hhp1bdby7wgmlc0s5vp"; vendorSha256 = "1dmiiyp38biyrlmwxbrh3k8w7mxv0lsvf5qnzjrrxy6qbmglmk0l";
meta = with lib; { meta = with lib; {
description = " Lightning Loop: A Non-Custodial Off/On Chain Bridge"; description = " Lightning Loop: A Non-Custodial Off/On Chain Bridge";

View File

@ -73,7 +73,7 @@ def run_tests(extra_tests):
assert_matches("su operator -c 'lncli getinfo' | jq", '"version"') assert_matches("su operator -c 'lncli getinfo' | jq", '"version"')
assert_no_failure("lnd") assert_no_failure("lnd")
succeed("systemctl start lightning-loop") assert_running("lightning-loop")
assert_matches("su operator -c 'loop --version'", "version") assert_matches("su operator -c 'loop --version'", "version")
# Check that lightning-loop fails with the right error, making sure # Check that lightning-loop fails with the right error, making sure
# lightning-loop can connect to lnd # lightning-loop can connect to lnd

View File

@ -34,9 +34,6 @@ import ./make-test.nix rec {
services.lnd.enable = true; services.lnd.enable = true;
services.lnd.listenPort = 9736; services.lnd.listenPort = 9736;
services.lightning-loop.enable = true; services.lightning-loop.enable = true;
# needed because we must control when lightning-loop starts so it doesn't
# fail before we run commands in the nb-lightning-loop netns
systemd.services.lightning-loop.wantedBy = mkForce [];
services.electrs.enable = true; services.electrs.enable = true;