greg/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1,205 Commits 8 Branches 0 Tags 4.1 MiB
82a2b148d8
Commit Graph

92 Commits

Author SHA1 Message Date
Erik Arvstedt
2c8e29b35b
lnd: extract option certPath 
Improves service encapsulation.
 2021-09-11 15:07:24 +02:00
Erik Arvstedt
9f7d048769
modules: move assertion to lnd.nix 
nix-bitcoin.nix is now no longer dependent on clightning.nix and lnd.nix.
Due to condition '!(config.services ? clightning)' lnd.nix still
doesn't depend on clightning.nix.

Also fix the assertion message by renaming clightning.bindPort to clightning.port.
 2021-08-15 22:40:35 +02:00
Erik Arvstedt
f14af1fc48
treewide: use consistent echo message formatting 
Quote the echo message.
 2021-08-15 11:29:34 +02:00
Erik Arvstedt
b8043d3db5
treewide: use consistent bash script indentation 
Always use two spaces.
 2021-08-15 11:29:34 +02:00
Erik Arvstedt
c758d68ea4
lib: rename privileged -> rootScript 
The naming is now analogous the related function `script`.
 2021-08-15 11:29:34 +02:00
Erik Arvstedt
178a0dcf8f
services: use new 'tor' options 2021-08-14 10:46:41 +02:00
Erik Arvstedt
e44f78ebb8
services: set isSystemUser for service users 
'isSystemUser' has to be explicitly set in NixOS 21.05.
Previously, it was the implicit default.
 2021-08-14 10:46:40 +02:00
Erik Arvstedt
637a58d826
lnd: improve waiting for active RPC server 
- Simplify
- Add comment
- Avoid the unneeded default call to sleep
 2021-07-29 20:27:34 +02:00
Erik Arvstedt
adeccce06e
lnd: simplify use of curl 2021-07-29 20:27:33 +02:00
Jonas Nick
ce10003747
lnd: allow curl to retry in the create-wallet script 2021-07-08 13:10:16 +00:00
Jonas Nick
a23b9d1c2d
lnd: check that state is RPC_ACTIVE after unlocking 
The state service is newly introduced in lnd 0.13.0.
 2021-07-07 13:15:04 +00:00
Jonas Nick
c75347027b
lnd: don't wait until the RPC port is open after unlocking 
According to the release notes of lnd 0.13.0 [0] the RPC service is available at
all times.

[0] https://github.com/lightningnetwork/lnd/releases/tag/v0.13.0-beta
 2021-07-07 13:12:50 +00:00
Erik Arvstedt
08fe9ba84a
services: add finer-grained address family restrictions 
Due to a possible NixOS bug, this commit has no effect on NixOS 20.09
where `RestrictAddressFamilies` is a no-op.
It's only relevant for NixOS unstable with cgroups v2.

bitcoind+zmq: instead of allowing all address families, only add the required
AF_NETLINK family.

lnd: lnd only runs a zmq client, not a server, therefore it requires
no additional address families.

lightning-pool, clightning-plugin-zmq: add AF_NETLINK.
 2021-03-22 14:35:29 +01:00
Erik Arvstedt
020433cec6
services: add helper fn setAllowedIPAddresses 
Also use 'allowLocalIPAddresses' instead of 'allowTor' in bitcoind-import-banlist
which doesn't use Tor.
 2021-03-22 13:20:45 +01:00
Erik Arvstedt
09cd3ce5e4
lnd: show curl error messages 2021-03-16 12:46:19 +01:00
Erik Arvstedt
03db1a61b1
lnd, joinmarket: don't write to secrets dir 
Keeping the secrets dir read-only is more simple and robust.

- lnd seed mnemonic creation and joinmarket wallet creation can be
  run as the regular service user instead of root.

- It is easier to switch to a third-party secrets deployment
  method in the future.

Don't create a seed mnemonic for lnd when a wallet exists.
This avoids creating unused mnemonics and helps simplifying
the migration command in `versioning.nix`.
 2021-03-15 18:50:15 +01:00
nixbitcoin
4e9059dc07
bitcoind: rename group bitcoinrpc -> bitcoinrpc-public 
This makes it clear that services with this group can only use
public RPC calls.
 2021-02-18 10:42:21 +00:00
nixbitcoin
85a1722545
lnd: add user & group options 2021-02-17 11:49:51 +00:00
nixbitcoin
2ca92a34a5
services: use doas if enabled 
- Remove sudo from recurring-donations path because it's not used by
  the service

- Use doas instead of sudo in secure-node.nix
 2021-02-09 12:44:04 +00:00
Erik Arvstedt
6a32812412
services: add names for systemd helper scripts 
The systemd journal now shows a specific script name instead of
the generic name "script" before script output.
 2021-02-07 22:45:36 +01:00
Erik Arvstedt
6982699613
services: use consistent layout 
Use the following order of definitions for all services:
- assertions
- configuration of other services
- environment.systemPackages
- tmpfiles
- own service
- users
- secrets
 2021-02-07 22:42:23 +01:00
Erik Arvstedt
9cf038939c
treewide: use mkEnableOption 2021-02-07 22:41:31 +01:00
Erik Arvstedt
7a97304f13
treewide: remove unit descriptions 
Systemd's `Description` option is a misnomer (as confessed by `man systemd.unit`):
Its value is used by user-facing tools in place of the unit file name, so this option
could have been more aptly named `label` or `name`.
`Description` should only be set if the unit file name is not sufficient for naming a unit.
This is not the case for our services, except for `systemd.services.nb-netns-bridge`
whose description has been kept.

As an example how this affects users, weird journal lines like
```
nb-test systemd[1]: Starting Run clightningd...
```
are now replaced by
```
nb-test systemd[1]: Starting clightning.service...
```
 2021-02-07 22:41:31 +01:00
Erik Arvstedt
a942177ecf
treewide: remove user descriptions 
User descriptions are stored in the `comment` field in /etc/passwd.
In our case, these are completely redundant and don't add any useful information.
 2021-02-07 22:41:30 +01:00
Erik Arvstedt
4f6ff408ef
treewide: remove unneeded string literals 2021-02-07 22:41:29 +01:00
Erik Arvstedt
e6a6c721c1
treewide: streamline 'extraConfig' descriptions 2021-02-07 22:40:11 +01:00
Erik Arvstedt
c246bbb36e
bitcoind, clightning, lnd: improve descriptions 
bitcoind: The previous description of 'prune' didn't match the int-only
values supported by our option.
 2021-02-07 22:39:05 +01:00
Erik Arvstedt
a26ed03d77
rename nix-bitcoin-services.nix -> lib.nix 2021-02-04 12:39:48 +00:00
Erik Arvstedt
e2922eb4ce
move rpc thread count setting to lightning modules 2021-01-14 13:25:12 +01:00
Erik Arvstedt
bed00fe937
lnd: use onionServices for address announcing 2021-01-14 13:25:09 +01:00
Erik Arvstedt
5c6977b006
rename onion-chef -> nix-bitcoin.onionAddresses 
This clarifies its function.
 2021-01-14 13:25:05 +01:00
Erik Arvstedt
b41a720c28
lnd: add consistent address options 
Also fix btcpayserver by connecting to the lnd restAddress instead of the p2p address.
 2021-01-14 13:25:03 +01:00
Erik Arvstedt
5b7e0d09b2
bitcoind: add consistent address options 2021-01-14 13:25:03 +01:00
Martin Milata
5feb9e3eae lnd: fix rpc/rest port configuration 2020-12-07 14:38:36 +01:00
Erik Arvstedt
f1681f5b45
add option nix-bitcoin.pkgs, remove overlay 
This works around a nixpkgs bug where overlays are ignored in containers.
 2020-11-09 22:10:07 +01:00
Erik Arvstedt
e39ad358a4
lnd: remove unused bitcoind from PATH 2020-11-09 22:10:07 +01:00
Erik Arvstedt
de23fdd377
lnd: use type str for rpclisten, restlisten 2020-10-29 21:21:28 +01:00
Erik Arvstedt
8b053326cc
bitcoind: use type str for rpcbind 
Extra RPC bind addresses can still be added via extraConfig.
 2020-10-29 21:21:28 +01:00
Erik Arvstedt
82f4901880
netns-lnd: allow RPC access from main netns 2020-10-29 21:21:27 +01:00
Erik Arvstedt
e0675cb256
move enforceTor logic to service modules 
This enables tor support for services without using secure-node.nix
 2020-10-29 21:21:27 +01:00
Erik Arvstedt
0cc8caa737
lnd: only set tor.active on enforceTor 
This also enables the test scenario 'netnsRegtest' introduced in a
later commit by fixing the following bug:
For unknown reasons, when tor.active=true and tor is not running, lnd
fails with a tor connection error on netns-isolation, but runs fine
without netns-isolation.
 2020-10-29 21:21:26 +01:00
Erik Arvstedt
67e49fe415
services: auto-enable dependencies 2020-10-19 14:55:59 +02:00
Erik Arvstedt
75ec85bea2
lnd: add regtest support 2020-10-16 18:01:51 +02:00
Erik Arvstedt
1935c252ec
lnd: remove redundant option 'bitcoind-host' 
Also set bitcoind rpc port.
 2020-10-16 18:01:51 +02:00
Erik Arvstedt
b1a8629223
lnd: add variable 'bitcoind' 2020-10-16 18:01:51 +02:00
Erik Arvstedt
9aa19c3fdd
extract operator module 2020-10-16 16:46:55 +02:00
nixbitcoin
46d681a17e
lnd: generate custom macaroons 
Create new `macaroon` option that allows any module to place its own
custom macaroon in the lnd RuntimeDirectory `/run/lnd`.
 2020-09-15 12:09:02 +00:00
Erik Arvstedt
6f032e3c40
lnd: fix mnemonic file access vulnerability 
Previously, the file was readable by 'other' for a short time after
creation.
 2020-09-15 12:09:00 +00:00
Erik Arvstedt
9715134f06
netns: don't repeat cli definitions 
1. Saves some code.
2. Guarantees that the netns and no-netns cli defs are always in sync.
 2020-08-25 11:40:27 +02:00
Jonas Nick
322ba5bfff
Add nix-bitcoin.lib for utility functions and types 2020-08-20 21:31:24 +00:00