remove webindex
This module is outdated and incomplete. We can readd an improved version in the future. Move nanopos nginx proxy tests to the nanopos test.
This commit is contained in:
Erik Arvstedt
parent
2a240d6f4a
commit
f6b883a9ac
@ -76,7 +76,6 @@ NixOS modules
|
|||||||
* [netns-isolation](modules/netns-isolation.nix): isolates applications on the network-level via network namespaces
|
* [netns-isolation](modules/netns-isolation.nix): isolates applications on the network-level via network namespaces
|
||||||
* [backups](modules/backups.nix): daily duplicity backups of all your node's important files
|
* [backups](modules/backups.nix): daily duplicity backups of all your node's important files
|
||||||
* [operator](modules/operator.nix): adds non-root user `operator` who has access to client tools (e.g. `bitcoin-cli`, `lightning-cli`)
|
* [operator](modules/operator.nix): adds non-root user `operator` who has access to client tools (e.g. `bitcoin-cli`, `lightning-cli`)
|
||||||
* [nix-bitcoin webindex](modules/nix-bitcoin-webindex.nix): a local website to display node information
|
|
||||||
|
|
||||||
Security
|
Security
|
||||||
---
|
---
|
||||||
|
|||||||
@ -8,7 +8,7 @@ fetch-release > nix-bitcoin-release.nix
|
|||||||
|
|
||||||
Nodeinfo
|
Nodeinfo
|
||||||
---
|
---
|
||||||
Run `nodeinfo` to see your onion addresses for the webindex, spark, etc. if they are enabled.
|
Run `nodeinfo` to see the onion addresses for enabled services.
|
||||||
|
|
||||||
Connect to spark-wallet
|
Connect to spark-wallet
|
||||||
---
|
---
|
||||||
|
|||||||
@ -110,11 +110,6 @@
|
|||||||
# tool run as user operator.
|
# tool run as user operator.
|
||||||
# services.liquidd.enable = true;
|
# services.liquidd.enable = true;
|
||||||
|
|
||||||
### WEBINDEX
|
|
||||||
# Enable this module to use the nix-bitcoin-webindex, a simple website
|
|
||||||
# displaying your node information. Only available if clightning is enabled.
|
|
||||||
# services.nix-bitcoin-webindex.enable = true;
|
|
||||||
|
|
||||||
### RECURRING-DONATIONS
|
### RECURRING-DONATIONS
|
||||||
# Enable this module to send recurring donations. This is EXPERIMENTAL; it's
|
# Enable this module to send recurring donations. This is EXPERIMENTAL; it's
|
||||||
# not guaranteed that payments are succeeding or that you will notice payment
|
# not guaranteed that payments are succeeding or that you will notice payment
|
||||||
|
|||||||
@ -6,7 +6,6 @@
|
|||||||
electrs = ./electrs.nix;
|
electrs = ./electrs.nix;
|
||||||
liquid = ./liquid.nix;
|
liquid = ./liquid.nix;
|
||||||
presets.secure-node = ./presets/secure-node.nix;
|
presets.secure-node = ./presets/secure-node.nix;
|
||||||
nix-bitcoin-webindex = ./nix-bitcoin-webindex.nix;
|
|
||||||
spark-wallet = ./spark-wallet.nix;
|
spark-wallet = ./spark-wallet.nix;
|
||||||
recurring-donations = ./recurring-donations.nix;
|
recurring-donations = ./recurring-donations.nix;
|
||||||
lnd = ./lnd.nix;
|
lnd = ./lnd.nix;
|
||||||
|
|||||||
@ -1,105 +0,0 @@
|
|||||||
{ config, lib, pkgs, ... }:
|
|
||||||
|
|
||||||
with lib;
|
|
||||||
|
|
||||||
let
|
|
||||||
cfg = config.services.nix-bitcoin-webindex;
|
|
||||||
inherit (config) nix-bitcoin-services;
|
|
||||||
indexFile = pkgs.writeText "index.html" ''
|
|
||||||
<html>
|
|
||||||
<body>
|
|
||||||
<p>
|
|
||||||
<h1>
|
|
||||||
nix-bitcoin
|
|
||||||
</h1>
|
|
||||||
</p>
|
|
||||||
<p>
|
|
||||||
<h3>
|
|
||||||
lightning node: CLIGHTNING_ID
|
|
||||||
</h3>
|
|
||||||
</p>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
'';
|
|
||||||
createWebIndex = pkgs.writeText "make-index.sh" ''
|
|
||||||
set -e
|
|
||||||
cp ${indexFile} /var/www/index.html
|
|
||||||
chown -R nginx:nginx /var/www/
|
|
||||||
nodeinfo
|
|
||||||
. <(nodeinfo)
|
|
||||||
sed -i "s/CLIGHTNING_ID/$CLIGHTNING_ID/g" /var/www/index.html
|
|
||||||
'';
|
|
||||||
in {
|
|
||||||
options.services.nix-bitcoin-webindex = {
|
|
||||||
enable = mkOption {
|
|
||||||
type = types.bool;
|
|
||||||
default = false;
|
|
||||||
description = ''
|
|
||||||
If enabled, the webindex service will be installed.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
host = mkOption {
|
|
||||||
type = types.str;
|
|
||||||
default = if config.nix-bitcoin.netns-isolation.enable then
|
|
||||||
config.nix-bitcoin.netns-isolation.netns.nginx.address
|
|
||||||
else
|
|
||||||
"localhost";
|
|
||||||
description = "HTTP server listen address.";
|
|
||||||
};
|
|
||||||
enforceTor = nix-bitcoin-services.enforceTor;
|
|
||||||
};
|
|
||||||
|
|
||||||
config = mkIf cfg.enable {
|
|
||||||
assertions = [
|
|
||||||
{ assertion = config.services.clightning.enable;
|
|
||||||
message = "nix-bitcoin-webindex requires clightning.";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
|
|
||||||
systemd.tmpfiles.rules = [
|
|
||||||
"d /var/www 0755 nginx nginx - -"
|
|
||||||
];
|
|
||||||
|
|
||||||
services.nginx = {
|
|
||||||
enable = true;
|
|
||||||
virtualHosts."_" = {
|
|
||||||
root = "/var/www";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
services.tor.hiddenServices.nginx = {
|
|
||||||
map = [{
|
|
||||||
port = 80; toHost = cfg.host;
|
|
||||||
} {
|
|
||||||
port = 443; toHost = cfg.host;
|
|
||||||
}];
|
|
||||||
version = 3;
|
|
||||||
};
|
|
||||||
|
|
||||||
# create-web-index
|
|
||||||
systemd.services.create-web-index = {
|
|
||||||
description = "Get node info";
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
path = with pkgs; [
|
|
||||||
config.programs.nodeinfo
|
|
||||||
jq
|
|
||||||
sudo
|
|
||||||
] ++ optional config.services.lnd.enable config.services.lnd.cli
|
|
||||||
++ optional config.services.clightning.enable config.services.clightning.cli;
|
|
||||||
serviceConfig = nix-bitcoin-services.defaultHardening // {
|
|
||||||
ExecStart="${pkgs.bash}/bin/bash ${createWebIndex}";
|
|
||||||
User = "root";
|
|
||||||
Type = "simple";
|
|
||||||
RemainAfterExit="yes";
|
|
||||||
Restart = "on-failure";
|
|
||||||
RestartSec = "10s";
|
|
||||||
PrivateNetwork = "true"; # This service needs no network access
|
|
||||||
PrivateUsers = "false";
|
|
||||||
ReadWritePaths = "/var/www";
|
|
||||||
CapabilityBoundingSet = "CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_SYS_ADMIN CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER";
|
|
||||||
} // (if cfg.enforceTor
|
|
||||||
then nix-bitcoin-services.allowTor
|
|
||||||
else nix-bitcoin-services.allowAnyIP
|
|
||||||
);
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@ -20,7 +20,6 @@ in {
|
|||||||
nbxplorer.enforceTor = true;
|
nbxplorer.enforceTor = true;
|
||||||
spark-wallet.enforceTor = true;
|
spark-wallet.enforceTor = true;
|
||||||
recurring-donations.enforceTor = true;
|
recurring-donations.enforceTor = true;
|
||||||
nix-bitcoin-webindex.enforceTor = true;
|
|
||||||
};
|
};
|
||||||
|
|
||||||
# Add onion services for incoming connections
|
# Add onion services for incoming connections
|
||||||
|
|||||||
@ -15,7 +15,6 @@ in {
|
|||||||
imports = [
|
imports = [
|
||||||
../modules.nix
|
../modules.nix
|
||||||
../nodeinfo.nix
|
../nodeinfo.nix
|
||||||
../nix-bitcoin-webindex.nix
|
|
||||||
./enable-tor.nix
|
./enable-tor.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|||||||
@ -130,7 +130,6 @@ let testEnv = rec {
|
|||||||
scenarios.full
|
scenarios.full
|
||||||
../modules/presets/secure-node.nix
|
../modules/presets/secure-node.nix
|
||||||
];
|
];
|
||||||
services.nix-bitcoin-webindex.enable = true;
|
|
||||||
tests.secure-node = true;
|
tests.secure-node = true;
|
||||||
tests.banlist-and-restart = true;
|
tests.banlist-and-restart = true;
|
||||||
|
|
||||||
|
|||||||
@ -220,14 +220,6 @@ def _():
|
|||||||
def _():
|
def _():
|
||||||
assert_running("onion-addresses")
|
assert_running("onion-addresses")
|
||||||
|
|
||||||
# FIXME: use 'wait_for_unit' because 'create-web-index' always fails during startup due
|
|
||||||
# to incomplete unit dependencies.
|
|
||||||
# 'create-web-index' implicitly tests 'nodeinfo'.
|
|
||||||
machine.wait_for_unit("create-web-index")
|
|
||||||
assert_running("nginx")
|
|
||||||
wait_for_open_port(ip("nginx"), 80)
|
|
||||||
assert_matches(f"curl {ip('nginx')}", "nix-bitcoin")
|
|
||||||
|
|
||||||
|
|
||||||
# Run this test before the following tests that shut down services
|
# Run this test before the following tests that shut down services
|
||||||
# (and their corresponding network namespaces).
|
# (and their corresponding network namespaces).
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user