Jonas Nick
5c99656cce
Merge #226 : Improve netns-isolation and tests
...
e5fb3f6a7fdf790f676691697b142728236691aa80da0a41bc9b4cd7bd1c0f56ea6ad19237e5dc3ded73627e0291ebc2d517809e754851b7450877a08bfb7bb2f832e70a7516121301337b9715134f06e385c73256d0b8d77de20f0f6ddbb9a3ae8668e6b7fc819be55a81693ef374f16106684eb92df08c50de54aef1e5fb3f6a7fe5fb3f6a7f
2020-08-25 13:29:33 +00:00
Erik Arvstedt
e5fb3f6a7f
run-tests: document how to pass extra build args
2020-08-25 14:58:04 +02:00
Erik Arvstedt
df790f6766
run-tests: allow linking test build results for all scenarios
2020-08-25 14:58:04 +02:00
Erik Arvstedt
91697b1427
test: allow for testing all scenarios
...
Test all scenarios by default when running 'build' (which happens
when the script is called without arguments).
Default to scenario 'default' in other test commands like 'debug'.
2020-08-25 14:53:13 +02:00
Erik Arvstedt
28236691aa
test: rename scenarios/lib.py -> base.py
...
This file isn't a scenario, it's also not a lib because it contains
the main share of actual tests.
2020-08-25 14:53:13 +02:00
Erik Arvstedt
80da0a41bc
test: load complete test environment in debug mode
...
Stop just before executing actual tests.
This makes all test functions accessible in debug mode.
2020-08-25 14:53:12 +02:00
Erik Arvstedt
9b4cd7bd1c
test: simplify scenario handling
...
We can switch to a more sophisticated scheme later when adding more scenarios
2020-08-25 14:53:12 +02:00
Erik Arvstedt
0f56ea6ad1
test: include scenario in test name
2020-08-25 14:53:12 +02:00
Erik Arvstedt
9237e5dc3d
test: use pydoc docstring
2020-08-25 14:53:12 +02:00
Erik Arvstedt
ed73627e02
netns-exec: minor style fixes
...
- Use inline variable declarations
- Improve messages
- Fix naming: available -> allowed
- Simplify intro comment
2020-08-25 14:53:12 +02:00
Erik Arvstedt
91ebc2d517
netns-exec: simplify installation
2020-08-25 14:53:12 +02:00
Erik Arvstedt
809e754851
netns: improve bridge setup
...
- Explain why we don't use option `networking.bridges`
- Make the bridge setup service part of NixOS' network-setup.service.
This yields no noticable functional changes for now, but it's
conceptually cleaner to finish the network setup before network.target
becomes active.
- Add 'nb-' prefix to service name
2020-08-25 14:53:12 +02:00
Erik Arvstedt
b7450877a0
netns: rename bridge peer devices br-nb-veth* -> nb-veth-br*
...
This ensures a consistent 'nb-' namespace and simplifies the
dhcpcd.denyInterfaces rules.
Also rename vethName -> veth.
2020-08-25 14:53:12 +02:00
Erik Arvstedt
8bfb7bb2f8
netns: rename bridge br0 -> nb-br
...
br0 has a high risk of name clashes when nix-bitcoin used as part of a
larger config.
Use a more specific name.
2020-08-25 14:53:08 +02:00
Erik Arvstedt
32e70a7516
netns: move webindex config for modules-only usage
...
webindex is only available in secure-node.
2020-08-25 11:40:27 +02:00
Erik Arvstedt
121301337b
netns: add option 'allowedUser' for modules-only usage
...
The dependency on secure-node.nix prevented using nix-bitcoin by just
importing modules.nix.
2020-08-25 11:40:27 +02:00
Erik Arvstedt
9715134f06
netns: don't repeat cli definitions
...
1. Saves some code.
2. Guarantees that the netns and no-netns cli defs are always in sync.
2020-08-25 11:40:27 +02:00
Erik Arvstedt
e385c73256
netns: separate implementation and service configs
...
This greatly improves clarity.
Especially the bitcoind-import-banlist.serviceConfig definition was out
of place.
2020-08-25 11:40:27 +02:00
Erik Arvstedt
d0b8d77de2
netns: remove conditionals for service settings
...
Going without the conditionals (like in secure-node.nix) adds
readability and doesn't reduce evaluation performance (in fact, it
even slightly improves performance due to implementation details
of mkIf).
To avoid errors, remove use of disabled services in secure-node.nix and
nix-bitcoin-webindex.nix.
2020-08-25 11:40:27 +02:00
Erik Arvstedt
0f0f6ddbb9
netns: add comment about undesirable algorithmic complexity
...
We don't want to be Accidentally Quadratic™
2020-08-25 11:40:26 +02:00
Erik Arvstedt
a3ae8668e6
netns: use map instead of concatMap
2020-08-25 11:40:26 +02:00
Erik Arvstedt
b7fc819be5
netns: consistent var naming
...
n is used elsewhere in similar contexts.
2020-08-25 11:40:26 +02:00
Erik Arvstedt
5a81693ef3
netns: add range check for netns ids
2020-08-25 11:40:26 +02:00
Erik Arvstedt
74f1610668
netns: clarify addressblock description
2020-08-25 11:40:26 +02:00
Erik Arvstedt
4eb92df08c
netns: remove redundant filter
...
The 'availableNetns' connection matrix only consists of enabled entries,
so no extra filtering is needed.
Reason: availableNetns starts with the filtered 'base' and is then symmetrised.
2020-08-25 11:40:26 +02:00
Erik Arvstedt
50de54aef1
netns: remove empty connections defs
...
Like in the netns defintion for bitcoind.
2020-08-25 11:40:26 +02:00
Jonas Nick
0f1f105948
Merge #225 : Fix process info restriction
...
44de5064cda36789b468588a0b240596ea2e671c343e026030736744676144de5064cd
2020-08-24 14:56:05 +00:00
Jonas Nick
b00e9b6aa3
Merge #222 : Add nix-bitcoin.lib for utility functions and types
...
322ba5bfff322ba5bfff
2020-08-23 20:53:45 +00:00
Jonas Nick
bfc73f2176
Merge #227 : Install.md docs updates
...
9e6b280fdd9e6b280fdd
2020-08-22 07:50:45 +00:00
jurraca
9e6b280fdd
docs updates
2020-08-21 21:43:46 +00:00
Jonas Nick
322ba5bfff
Add nix-bitcoin.lib for utility functions and types
2020-08-20 21:31:24 +00:00
Erik Arvstedt
44de5064cd
security: don't restrict process info by default for module users
2020-08-20 13:12:07 +02:00
Erik Arvstedt
a36789b468
test: move security tests to separate function
2020-08-20 13:12:06 +02:00
Erik Arvstedt
588a0b2405
security: enable full systemd-status for group 'proc'
...
Previously, systemd-status was broken for all users except root.
Use a 'default' deny policy, which is overridden for group 'proc'.
Add operator to group 'proc'.
Also, remove redundant XML boilerplate.
2020-08-20 13:12:06 +02:00
Erik Arvstedt
96ea2e671c
security: simplify and fix dbus configuration
...
Previously, due to the dependency on a helper service, this dbus config
was initially inactive after system boot, allowing for unrestricted use
of the problematic dbus call.
This also broke the accompanying VM test on faster systems.
Remove 'allow' policy for root because it's a no-op:
1. It's overridden by the 'mandatory' deny policy.
2. Root can use all dbus calls anyways, regardless of policy settings.
Also, add some comments.
2020-08-20 13:12:06 +02:00
Erik Arvstedt
343e026030
rename dbus.nix -> security.nix
...
This file has a broader scope than just configuring dbus.
2020-08-20 13:12:06 +02:00
Erik Arvstedt
7367446761
test: rename assert_matches_exactly -> assert_full_match
...
More precise, needed in a later commit.
2020-08-20 13:12:05 +02:00
Jonas Nick
72000b4a99
Merge #200 : backups: add module
...
22c3fd52e1e4fb7a52de22c3fd52e1
2020-08-04 15:38:44 +00:00
nixbitcoin
22c3fd52e1
backups: add feature test
2020-08-04 15:25:39 +00:00
nixbitcoin
e4fb7a52de
backups: add module
2020-08-04 15:25:37 +00:00
Jonas Nick
62f83a71b8
Merge #218 : Fix typos
...
df89ceed39df89ceed39
2020-08-04 15:13:09 +00:00
Jonas Nick
3f53d7da40
Merge #217 : Concurrent LN
...
e650df30d546e15ee9ccac96fd59db3ed564ea06716e98789c43da15557dd99ccc8445e650df30d5
2020-08-04 15:10:07 +00:00
nixbitcoin
e650df30d5
bitcoind: bump rpcthread count
2020-08-04 14:46:57 +00:00
nixbitcoin
46e15ee9cc
tests: make lnd & clightning tests run concurrently
2020-08-04 14:07:12 +00:00
nixbitcoin
ac96fd59db
assertions: make lnd.enable depend on !clightning.enable or port != 9735
2020-08-04 14:07:10 +00:00
nixbitcoin
3ed564ea06
lnd: make listen IP address only
2020-08-04 14:07:08 +00:00
nixbitcoin
716e98789c
lnd: add listenPort option
2020-08-04 14:07:06 +00:00
nixbitcoin
43da15557d
clightning: refactor bind-addr to be IP address only
...
With typecheck
2020-08-04 14:07:02 +00:00
practicalswift
df89ceed39
Fix typos
2020-08-04 13:32:06 +00:00
nixbitcoin
d99ccc8445
clightning: add bindport option
2020-08-04 12:42:57 +00:00
