From c853f380d43279813a8c4ae2a955f9cbf0bb7231 Mon Sep 17 00:00:00 2001
From: Erik Arvstedt <erik.arvstedt@gmail.com>
Date: Thu, 7 Jul 2022 16:08:28 +0200
Subject: [PATCH] lightning-loop: add certificate options `extraIPs` and
 `extraDomains`

This is useful for non-local access to the lightning-loop REST server.
---
 modules/lightning-loop.nix | 24 +++++++++++++++++++++++-
 test/tests.nix             |  1 +
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/modules/lightning-loop.nix b/modules/lightning-loop.nix
index 1a6bdc6..1bd526c 100644
--- a/modules/lightning-loop.nix
+++ b/modules/lightning-loop.nix
@@ -40,6 +40,26 @@ let
       default = if cfg.tor.proxy then config.nix-bitcoin.torClientAddressWithPort else null;
       description = "host:port of SOCKS5 proxy for connnecting to the loop server.";
     };
+    certificate = {
+      extraIPs = mkOption {
+        type = with types; listOf str;
+        default = [];
+        example = [ "60.100.0.1" ];
+        description = ''
+          Extra `subjectAltName` IPs added to the certificate.
+          This works the same as loop option `tlsextraip`.
+        '';
+      };
+      extraDomains = mkOption {
+        type = with types; listOf str;
+        default = [];
+        example = [ "example.com" ];
+        description = ''
+          Extra `subjectAltName` domain names added to the certificate.
+          This works the same as loop option `tlsextradomain`.
+        '';
+      };
+    };
     extraConfig = mkOption {
       type = types.lines;
       default = "";
@@ -101,6 +121,8 @@ in {
       "d '${cfg.dataDir}' 0770 ${lnd.user} ${lnd.group} - -"
     ];
 
+    services.lightning-loop.certificate.extraIPs = mkIf (cfg.rpcAddress != "localhost") [ "${cfg.rpcAddress}" ];
+
     systemd.services.lightning-loop = {
       wantedBy = [ "multi-user.target" ];
       requires = [ "lnd.service" ];
@@ -119,7 +141,7 @@ in {
        loop-cert.user = lnd.user;
      };
      nix-bitcoin.generateSecretsCmds.lightning-loop = ''
-       makeCert loop '${optionalString (cfg.rpcAddress != "localhost") "IP:${cfg.rpcAddress}"}'
+       makeCert loop '${nbLib.mkCertExtraAltNames cfg.certificate}'
     '';
   };
 }
diff --git a/test/tests.nix b/test/tests.nix
index b10d016..7eccd08 100644
--- a/test/tests.nix
+++ b/test/tests.nix
@@ -100,6 +100,7 @@ let
       tests.lndconnect-onion-clightning = cfg.clightning-rest.lndconnectOnion.enable;
 
       tests.lightning-loop = cfg.lightning-loop.enable;
+      services.lightning-loop.certificate.extraIPs = [ "20.0.0.1" ];
 
       tests.lightning-pool = cfg.lightning-pool.enable;
       nix-bitcoin.onionServices.lnd.public = true;