From e385c732567a1cdf958f8b6690011e03765cd53b Mon Sep 17 00:00:00 2001
From: Erik Arvstedt <erik.arvstedt@gmail.com>
Date: Fri, 21 Aug 2020 22:35:59 +0200
Subject: [PATCH] netns: separate implementation and service configs

This greatly improves clarity.

Especially the bitcoind-import-banlist.serviceConfig definition was out
of place.
---
 modules/netns-isolation.nix | 115 +++++++++++++++++-------------------
 1 file changed, 55 insertions(+), 60 deletions(-)

diff --git a/modules/netns-isolation.nix b/modules/netns-isolation.nix
index ddff07b..b18782d 100644
--- a/modules/netns-isolation.nix
+++ b/modules/netns-isolation.nix
@@ -75,8 +75,10 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
-    # Prerequisites
+  config = mkIf cfg.enable (mkMerge [
+
+  # Base infrastructure
+  {
     networking.dhcpcd.denyInterfaces = [ "br0" "br-nb*" "nb-veth*" ];
     services.tor.client.socksListenAddress = "${bridgeIp}:9050";
     networking.firewall.interfaces.br0.allowedTCPPorts = [ 9050 ];
@@ -88,51 +90,6 @@ in {
       permissions = "u+rx,g+rx,o-rwx";
     };
 
-    nix-bitcoin.netns-isolation.services = {
-      bitcoind = {
-        id = 12;
-      };
-      clightning = {
-        id = 13;
-        connections = [ "bitcoind" ];
-      };
-      lnd = {
-        id = 14;
-        connections = [ "bitcoind" ];
-      };
-      liquidd = {
-        id = 15;
-        connections = [ "bitcoind" ];
-      };
-      electrs = {
-        id = 16;
-        connections = [ "bitcoind" ];
-      };
-      spark-wallet = {
-        id = 17;
-        # communicates with clightning over lightning-rpc socket
-      };
-      lightning-charge = {
-        id = 18;
-        # communicates with clightning over lightning-rpc socket
-      };
-      nanopos = {
-        id = 19;
-        connections = [ "nginx" "lightning-charge" ];
-      };
-      recurring-donations = {
-        id = 20;
-        # communicates with clightning over lightning-rpc socket
-      };
-      nginx = {
-        id = 21;
-      };
-      lightning-loop = {
-        id = 22;
-        connections = [ "lnd" ];
-      };
-    };
-
     systemd.services = {
       netns-bridge = {
         description = "Create bridge";
@@ -153,8 +110,6 @@ in {
           RemainAfterExit = "yes";
         };
       };
-
-      bitcoind-import-banlist.serviceConfig.NetworkNamespacePath = "/var/run/netns/nb-bitcoind";
     } //
     (let
       makeNetnsServices = n: v: let
@@ -206,8 +161,55 @@ in {
     in foldl (services: n:
       services // (makeNetnsServices n netns.${n})
     ) {} (builtins.attrNames netns));
+  }
+
+  # Service-specific config
+  {
+    nix-bitcoin.netns-isolation.services = {
+      bitcoind = {
+        id = 12;
+      };
+      clightning = {
+        id = 13;
+        connections = [ "bitcoind" ];
+      };
+      lnd = {
+        id = 14;
+        connections = [ "bitcoind" ];
+      };
+      liquidd = {
+        id = 15;
+        connections = [ "bitcoind" ];
+      };
+      electrs = {
+        id = 16;
+        connections = [ "bitcoind" ];
+      };
+      spark-wallet = {
+        id = 17;
+        # communicates with clightning over lightning-rpc socket
+      };
+      lightning-charge = {
+        id = 18;
+        # communicates with clightning over lightning-rpc socket
+      };
+      nanopos = {
+        id = 19;
+        connections = [ "nginx" "lightning-charge" ];
+      };
+      recurring-donations = {
+        id = 20;
+        # communicates with clightning over lightning-rpc socket
+      };
+      nginx = {
+        id = 21;
+      };
+      lightning-loop = {
+        id = 22;
+        connections = [ "lnd" ];
+      };
+    };
 
-    # bitcoin: Custom netns configs
     services.bitcoind = {
       bind = netns.bitcoind.address;
       rpcbind = [
@@ -221,14 +223,13 @@ in {
         netns-exec nb-bitcoind ${config.services.bitcoind.package}/bin/bitcoin-cli -datadir='${config.services.bitcoind.dataDir}' "$@"
       '';
     };
+    systemd.services.bitcoind-import-banlist.serviceConfig.NetworkNamespacePath = "/var/run/netns/nb-bitcoind";
 
-    # clightning: Custom netns configs
     services.clightning = {
       bitcoin-rpcconnect = netns.bitcoind.address;
       bind-addr = netns.clightning.address;
     };
 
-    # lnd: Custom netns configs
     services.lnd = {
       listen = netns.lnd.address;
       rpclisten = [
@@ -248,7 +249,6 @@ in {
       '';
     };
 
-    # liquidd: Custom netns configs
     services.liquidd = {
       bind = netns.liquidd.address;
       rpcbind = [
@@ -267,31 +267,25 @@ in {
       '';
     };
 
-    # electrs: Custom netns configs
     services.electrs = {
       address = netns.electrs.address;
       daemonrpc = "${netns.bitcoind.address}:${toString config.services.bitcoind.rpc.port}";
     };
 
-    # spark-wallet: Custom netns configs
     services.spark-wallet = {
       host = netns.spark-wallet.address;
       extraArgs = "--no-tls";
     };
 
-    # lightning-charge: Custom netns configs
     services.lightning-charge.host = netns.lightning-charge.address;
 
-    # nanopos: Custom netns configs
     services.nanopos = {
       charged-url = "http://${netns.lightning-charge.address}:9112";
       host = netns.nanopos.address;
     };
 
-    # nginx: Custom netns configs
     services.nix-bitcoin-webindex.host = netns.nginx.address;
 
-    # loop: Custom netns configs
     services.lightning-loop = {
       cli = pkgs.writeScriptBin "loop"
       # Switch user because lnd makes datadir contents readable by user only
@@ -299,5 +293,6 @@ in {
         netns-exec nb-lightning-loop sudo -u lnd ${config.services.lightning-loop.package}/bin/loop "$@"
       '';
     };
-  };
+  }
+  ]);
 }