Commit Graph

744 Commits

Author SHA1 Message Date
Jonas Nick
1c31208078
Merge #229: Improve bitcoind RPC user config
9b6a3ec835 generate-secrets: extract fn 'makeHMAC' (Erik Arvstedt)
ca18ffb90a generate-secrets: fetch rpcauth.py from github (Erik Arvstedt)
4d6127bb76 bitcoind: clarify RPC whitelist test (Erik Arvstedt)
9d610991be bitcoind: remove custom rpc user names (Erik Arvstedt)
1408403dec bitcoind: clarify how bitcoin-cli RPC access is enabled (Erik Arvstedt)
4790c601a1 bitcoind: move rpc user config to bitcoind (Erik Arvstedt)
876cfadf1a bitcoind: add rpc user option 'passwordHMACFromFile' (Erik Arvstedt)
59434e79f0 bitcoind: simplify default rpc user name config (Erik Arvstedt)
205829b91f bitcoind: remove whitespace (Erik Arvstedt)

Pull request description:

ACKs for top commit:
  nixbitcoin:
    ACK 9b6a3ec835
  jonasnick:
    concept ACK 9b6a3ec835

Tree-SHA512: ccb9a8d2dc1f360cc1f0bd77535fa8edfd9afec0a519719103fd059d5912a1ed4960c22ef14df616a731f6a88861fecb8d1653fb71c2288b851e4a02f9f49cb2
2020-08-29 20:06:53 +00:00
Erik Arvstedt
9b6a3ec835
generate-secrets: extract fn 'makeHMAC' 2020-08-27 12:20:06 +02:00
Erik Arvstedt
ca18ffb90a
generate-secrets: fetch rpcauth.py from github
No need to vendor this.
2020-08-27 12:20:06 +02:00
Erik Arvstedt
4d6127bb76
bitcoind: clarify RPC whitelist test
- Remove redundant comment
- Test with obviously unsafe RPC call 'stop'
- No need to test privileged user who has no whitelist
2020-08-27 12:19:49 +02:00
Erik Arvstedt
9d610991be
bitcoind: remove custom rpc user names
Simpler.
We've just removed option 'bitcoind.rpcuser', so we can also remove the
old name 'bitcoinrpc'.
2020-08-27 11:39:26 +02:00
Erik Arvstedt
1408403dec
bitcoind: clarify how bitcoin-cli RPC access is enabled
It's not immediately clear why rpcuser/rpcpassword are needed in addition to the rpcauth
config entries.
2020-08-26 22:52:47 +02:00
Erik Arvstedt
4790c601a1
bitcoind: move rpc user config to bitcoind
This enables modules-only usage.
The privileged user is needed by bitcoind (cli), the public user is
needed by other services.
2020-08-26 22:52:47 +02:00
Erik Arvstedt
876cfadf1a
bitcoind: add rpc user option 'passwordHMACFromFile'
This allows adding additional rpc users without the need for
user-specific code in preStart.
2020-08-26 22:52:47 +02:00
Erik Arvstedt
59434e79f0
bitcoind: simplify default rpc user name config 2020-08-26 21:16:32 +02:00
Erik Arvstedt
205829b91f
bitcoind: remove whitespace 2020-08-26 21:16:32 +02:00
Jonas Nick
4d19fb7bf7
Merge #228: Update nixpkgs
52978b87fb Update nixpkgs (Jonas Nick)
6a2efccdf3 spark-wallet: 0.2.14 -> 0.2.16 (Jonas Nick)
438dde84fe Replace sks-keyservers.net with keyserver.ubuntu.com (Jonas Nick)

Pull request description:

ACKs for top commit:
  nixbitcoin:
    ACK 52978b87fb

Tree-SHA512: b3f68865e2606760682e8fc1f6e637bfb38b382ea25cc67eff6402585b0f7118f132a5d9d7531c650d29d69c0b4eb8e277ad172038be73c4d34a9de678140844
2020-08-26 09:52:47 +00:00
Jonas Nick
5c99656cce
Merge #226: Improve netns-isolation and tests
e5fb3f6a7f run-tests: document how to pass extra build args (Erik Arvstedt)
df790f6766 run-tests: allow linking test build results for all scenarios (Erik Arvstedt)
91697b1427 test: allow for testing all scenarios (Erik Arvstedt)
28236691aa test: rename scenarios/lib.py -> base.py (Erik Arvstedt)
80da0a41bc test: load complete test environment in debug mode (Erik Arvstedt)
9b4cd7bd1c test: simplify scenario handling (Erik Arvstedt)
0f56ea6ad1 test: include scenario in test name (Erik Arvstedt)
9237e5dc3d test: use pydoc docstring (Erik Arvstedt)
ed73627e02 netns-exec: minor style fixes (Erik Arvstedt)
91ebc2d517 netns-exec: simplify installation (Erik Arvstedt)
809e754851 netns: improve bridge setup (Erik Arvstedt)
b7450877a0 netns: rename bridge peer devices br-nb-veth* -> nb-veth-br* (Erik Arvstedt)
8bfb7bb2f8 netns: rename bridge br0 -> nb-br (Erik Arvstedt)
32e70a7516 netns: move webindex config for modules-only usage (Erik Arvstedt)
121301337b netns: add option 'allowedUser' for modules-only usage (Erik Arvstedt)
9715134f06 netns: don't repeat cli definitions (Erik Arvstedt)
e385c73256 netns: separate implementation and service configs (Erik Arvstedt)
d0b8d77de2 netns: remove conditionals for service settings (Erik Arvstedt)
0f0f6ddbb9 netns: add comment about undesirable algorithmic complexity (Erik Arvstedt)
a3ae8668e6 netns: use map instead of concatMap (Erik Arvstedt)
b7fc819be5 netns: consistent var naming (Erik Arvstedt)
5a81693ef3 netns: add range check for netns ids (Erik Arvstedt)
74f1610668 netns: clarify addressblock description (Erik Arvstedt)
4eb92df08c netns: remove redundant filter (Erik Arvstedt)
50de54aef1 netns: remove empty connections defs (Erik Arvstedt)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK e5fb3f6a7f
  nixbitcoin:
    ACK e5fb3f6a7f

Tree-SHA512: e2accf7b5ab5d4c4c07a8f9307409021809326648139424ff7ebaa7be3e628f21d5be8dafabe19b9659d09537a5b3976e2513bc287e79027376b5271006bc214
2020-08-25 13:29:33 +00:00
Erik Arvstedt
e5fb3f6a7f
run-tests: document how to pass extra build args 2020-08-25 14:58:04 +02:00
Erik Arvstedt
df790f6766
run-tests: allow linking test build results for all scenarios 2020-08-25 14:58:04 +02:00
Erik Arvstedt
91697b1427
test: allow for testing all scenarios
Test all scenarios by default when running 'build' (which happens
when the script is called without arguments).

Default to scenario 'default' in other test commands like 'debug'.
2020-08-25 14:53:13 +02:00
Erik Arvstedt
28236691aa
test: rename scenarios/lib.py -> base.py
This file isn't a scenario, it's also not a lib because it contains
the main share of actual tests.
2020-08-25 14:53:13 +02:00
Erik Arvstedt
80da0a41bc
test: load complete test environment in debug mode
Stop just before executing actual tests.
This makes all test functions accessible in debug mode.
2020-08-25 14:53:12 +02:00
Erik Arvstedt
9b4cd7bd1c
test: simplify scenario handling
We can switch to a more sophisticated scheme later when adding more scenarios
2020-08-25 14:53:12 +02:00
Erik Arvstedt
0f56ea6ad1
test: include scenario in test name 2020-08-25 14:53:12 +02:00
Erik Arvstedt
9237e5dc3d
test: use pydoc docstring 2020-08-25 14:53:12 +02:00
Erik Arvstedt
ed73627e02
netns-exec: minor style fixes
- Use inline variable declarations
- Improve messages
- Fix naming: available -> allowed
- Simplify intro comment
2020-08-25 14:53:12 +02:00
Erik Arvstedt
91ebc2d517
netns-exec: simplify installation 2020-08-25 14:53:12 +02:00
Erik Arvstedt
809e754851
netns: improve bridge setup
- Explain why we don't use option `networking.bridges`
- Make the bridge setup service part of NixOS' network-setup.service.
  This yields no noticable functional changes for now, but it's
  conceptually cleaner to finish the network setup before network.target
  becomes active.
- Add 'nb-' prefix to service name
2020-08-25 14:53:12 +02:00
Erik Arvstedt
b7450877a0
netns: rename bridge peer devices br-nb-veth* -> nb-veth-br*
This ensures a consistent 'nb-' namespace and simplifies the
dhcpcd.denyInterfaces rules.

Also rename vethName -> veth.
2020-08-25 14:53:12 +02:00
Erik Arvstedt
8bfb7bb2f8
netns: rename bridge br0 -> nb-br
br0 has a high risk of name clashes when nix-bitcoin used as part of a
larger config.
Use a more specific name.
2020-08-25 14:53:08 +02:00
Jonas Nick
52978b87fb
Update nixpkgs
Includes clightning 0.9.0
2020-08-25 12:41:29 +00:00
Jonas Nick
6a2efccdf3
spark-wallet: 0.2.14 -> 0.2.16
This will be required for clightning 0.9.0
2020-08-25 12:40:47 +00:00
Jonas Nick
438dde84fe
Replace sks-keyservers.net with keyserver.ubuntu.com
sks-keyservers fail most of the time.
2020-08-25 12:39:54 +00:00
Erik Arvstedt
32e70a7516
netns: move webindex config for modules-only usage
webindex is only available in secure-node.
2020-08-25 11:40:27 +02:00
Erik Arvstedt
121301337b
netns: add option 'allowedUser' for modules-only usage
The dependency on secure-node.nix prevented using nix-bitcoin by just
importing modules.nix.
2020-08-25 11:40:27 +02:00
Erik Arvstedt
9715134f06
netns: don't repeat cli definitions
1. Saves some code.
2. Guarantees that the netns and no-netns cli defs are always in sync.
2020-08-25 11:40:27 +02:00
Erik Arvstedt
e385c73256
netns: separate implementation and service configs
This greatly improves clarity.

Especially the bitcoind-import-banlist.serviceConfig definition was out
of place.
2020-08-25 11:40:27 +02:00
Erik Arvstedt
d0b8d77de2
netns: remove conditionals for service settings
Going without the conditionals (like in secure-node.nix) adds
readability and doesn't reduce evaluation performance (in fact, it
even slightly improves performance due to implementation details
of mkIf).

To avoid errors, remove use of disabled services in secure-node.nix and
nix-bitcoin-webindex.nix.
2020-08-25 11:40:27 +02:00
Erik Arvstedt
0f0f6ddbb9
netns: add comment about undesirable algorithmic complexity
We don't want to be Accidentally Quadratic™
2020-08-25 11:40:26 +02:00
Erik Arvstedt
a3ae8668e6
netns: use map instead of concatMap 2020-08-25 11:40:26 +02:00
Erik Arvstedt
b7fc819be5
netns: consistent var naming
n is used elsewhere in similar contexts.
2020-08-25 11:40:26 +02:00
Erik Arvstedt
5a81693ef3
netns: add range check for netns ids 2020-08-25 11:40:26 +02:00
Erik Arvstedt
74f1610668
netns: clarify addressblock description 2020-08-25 11:40:26 +02:00
Erik Arvstedt
4eb92df08c
netns: remove redundant filter
The 'availableNetns' connection matrix only consists of enabled entries,
so no extra filtering is needed.
Reason: availableNetns starts with the filtered 'base' and is then symmetrised.
2020-08-25 11:40:26 +02:00
Erik Arvstedt
50de54aef1
netns: remove empty connections defs
Like in the netns defintion for bitcoind.
2020-08-25 11:40:26 +02:00
Jonas Nick
0f1f105948
Merge #225: Fix process info restriction
44de5064cd security: don't restrict process info by default for module users (Erik Arvstedt)
a36789b468 test: move security tests to separate function (Erik Arvstedt)
588a0b2405 security: enable full systemd-status for group 'proc' (Erik Arvstedt)
96ea2e671c security: simplify and fix dbus configuration (Erik Arvstedt)
343e026030 rename dbus.nix -> security.nix (Erik Arvstedt)
7367446761 test: rename assert_matches_exactly -> assert_full_match (Erik Arvstedt)

Pull request description:

ACKs for top commit:
  nixbitcoin:
    ACK 44de5064cd

Tree-SHA512: f782cfdc81b5d6b3da968d0221bd54420791a9f5cd89cde9e62d6d04882d921b5efe9046d975133587b5c2d711c47133b3a5a2351940899a90a28bf16218a7ad
2020-08-24 14:56:05 +00:00
Jonas Nick
b00e9b6aa3
Merge #222: Add nix-bitcoin.lib for utility functions and types
322ba5bfff Add nix-bitcoin.lib for utility functions and types (Jonas Nick)

Pull request description:

ACKs for top commit:
  erikarvstedt:
    ACK 322ba5bfff

Tree-SHA512: 61fc91d11c06883ffc15e200dfefd88b4169849c19d3073c76820910c641613e64d01439cc482792a5eaadabeca7711eb838f0f791fcfc70cfa79e2b156f4efc
2020-08-23 20:53:45 +00:00
Jonas Nick
bfc73f2176
Merge #227: Install.md docs updates
9e6b280fdd docs updates (jurraca)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK 9e6b280fdd

Tree-SHA512: ae197a81e74347c7cce77899bb6fbd5397160aa27448e5e8ea43d15a181169705271abaecb4755e9d126e32d9c3eee06620430200e6c2e868d5d85cf0554bd5a
2020-08-22 07:50:45 +00:00
jurraca
9e6b280fdd docs updates 2020-08-21 21:43:46 +00:00
Jonas Nick
322ba5bfff
Add nix-bitcoin.lib for utility functions and types 2020-08-20 21:31:24 +00:00
Erik Arvstedt
44de5064cd
security: don't restrict process info by default for module users 2020-08-20 13:12:07 +02:00
Erik Arvstedt
a36789b468
test: move security tests to separate function 2020-08-20 13:12:06 +02:00
Erik Arvstedt
588a0b2405
security: enable full systemd-status for group 'proc'
Previously, systemd-status was broken for all users except root.

Use a 'default' deny policy, which is overridden for group 'proc'.

Add operator to group 'proc'.

Also, remove redundant XML boilerplate.
2020-08-20 13:12:06 +02:00
Erik Arvstedt
96ea2e671c
security: simplify and fix dbus configuration
Previously, due to the dependency on a helper service, this dbus config
was initially inactive after system boot, allowing for unrestricted use
of the problematic dbus call.
This also broke the accompanying VM test on faster systems.

Remove 'allow' policy for root because it's a no-op:
1. It's overridden by the 'mandatory' deny policy.
2. Root can use all dbus calls anyways, regardless of policy settings.

Also, add some comments.
2020-08-20 13:12:06 +02:00
Erik Arvstedt
343e026030
rename dbus.nix -> security.nix
This file has a broader scope than just configuring dbus.
2020-08-20 13:12:06 +02:00