Commit Graph

627 Commits

Author SHA1 Message Date
Erik Arvstedt
f0096371bf
btcpayserver: expand nbPkgs in option defaults
Required by commit `nix-bitcoin.nix: add `defaultText` (automatic)`.
2021-12-11 13:27:51 +01:00
Erik Arvstedt
349f904e79
secrets: use assertion instead of error in default value
This enables generating module option documentation.
2021-12-11 13:27:48 +01:00
Erik Arvstedt
2f0f1ec15a
hardened-extended: define kernelParams as separate strings
This is now checked by the modules.
2021-12-10 12:16:31 +00:00
Erik Arvstedt
71e9864060
netns-isolation: add compatibility with 21.11
`security.wrappers` now requires `group` be defined.
2021-12-10 12:16:09 +00:00
nixbitcoin
b5984a603c
joinmarket: 0.9.3 -> 0.9.4
Ilita IRC server & use upstream twisted again
2021-12-08 12:38:28 +00:00
nixbitcoin
1a8e7d6348
clightning: re-enable seccomp filtering 2021-12-08 12:38:10 +00:00
Erik Arvstedt
6b539627ee
add presets/bitcoind-remote.nix
This simplifies integrating a remote bitcoind instance and
makes `bitcoin-cli` work with the remote node.

Add note regarding `whitelistedPort` to docs.
2021-12-07 15:35:33 +01:00
Erik Arvstedt
1596b3a5d2
minor fixes
- README: fix uppercase

- bitcoind: add whitespace

- hardware-wallets: remove unused variables
2021-12-07 15:35:33 +01:00
Jonas Nick
747019a9e9
Merge fort-nix/nix-bitcoin#425: Misc. improvements
def64a73b8 treewide: use TODO-EXTERNAL (Erik Arvstedt)
6f37bef2a3 netns-isolation: simplify firewall setup (Erik Arvstedt)
f52059ce3c docs: add doc 'Configuration and maintenance' (Erik Arvstedt)
94aee8174d usage.md: add section `Managing services` (Erik Arvstedt)
8cc7b83da1 usage.md: convert to '#' heading syntax (Erik Arvstedt)
91fbcfcc77 faq.md: reformat (Erik Arvstedt)
9e4f4d6b0f bitcoind: add option `txindex` (Erik Arvstedt)
10a744a598 rtl: add option `extraCurrency` (Erik Arvstedt)
62a2602e78 electrs: use dataDir for storing extra config (Erik Arvstedt)
9bda7305fd services: add `tor.*` options (Erik Arvstedt)
ff24e73ad7 onion-addresses: fix files not being copied (Erik Arvstedt)
c6fe017aeb netns-isolation: avoid creating service files for disabled services (Erik Arvstedt)
017e08ca10 btcpayserver: move nbxplorer options to bottom (Erik Arvstedt)
e1d869d76c modules.nix: move rtl to fix topological sorting (Erik Arvstedt)
e44cd7ecdc rtl: improve descriptions (Erik Arvstedt)
bd275d3a9a minor improvements (Erik Arvstedt)
8aa28da110 remove `recurring-donations` module (Erik Arvstedt)

Pull request description:

ACKs for top commit:
  nixbitcoin:
    ACK def64a73b8
  jonasnick:
    ACK def64a73b8

Tree-SHA512: 13acd2a3dd73c07f9c31874c8e961f12f39accb48847cbad08479b9a8154b79a6f186819272072dfb5c4768264b81f6e058e9afa57a729db2096784e48352dfd
2021-11-29 18:05:19 +00:00
Erik Arvstedt
def64a73b8
treewide: use TODO-EXTERNAL
Use TODO-EXTERNAL for TODOs that depend on external factors like
upstream fixes.
2021-11-29 13:47:48 +01:00
Erik Arvstedt
6f37bef2a3
netns-isolation: simplify firewall setup
Set all allowed INPUT/OUTPUT addresses in a single `iptables` command.
2021-11-29 13:47:48 +01:00
Erik Arvstedt
9e4f4d6b0f
bitcoind: add option txindex 2021-11-29 13:22:44 +01:00
Erik Arvstedt
10a744a598
rtl: add option extraCurrency 2021-11-29 13:22:44 +01:00
Erik Arvstedt
62a2602e78
electrs: use dataDir for storing extra config
This is simpler and more memory-efficient.
We've also changed other services to use this appraoch.

Also remove unneded `wait_for_unit` in the electrs regtest test.
2021-11-29 13:22:44 +01:00
Erik Arvstedt
9bda7305fd
services: add tor.* options
Split `enforceTor` into `tor.proxy` and `tor.enforce`.
By enabling `tor.proxy` without `tor.enforce`, a service can accept
incoming clearnet connections.
E.g., this allows setting up a Tor-proxied bitcoind node that accepts
RPC connections from LAN.
2021-11-29 13:22:43 +01:00
Erik Arvstedt
ff24e73ad7
onion-addresses: fix files not being copied
When NixOS is already running and Tor is restarted due to config
changes, `/var/lib/tor/state` may be present even when Tor has not
yet finished setting up onion services.
This caused the previous version of `onion-addresses` to not wait for
Tor and to skip not yet present onion service files.

`onion-addresses` now waits until each required onion service file
has appeared.
2021-11-29 13:22:43 +01:00
Erik Arvstedt
c6fe017aeb
netns-isolation: avoid creating service files for disabled services
Only set the `serviceConfig` option when the service is enabled.
Otherwise a service file is created.
2021-11-29 13:22:43 +01:00
Erik Arvstedt
017e08ca10
btcpayserver: move nbxplorer options to bottom
These are largely irrelevant to end users.
2021-11-28 21:18:49 +01:00
Erik Arvstedt
e1d869d76c
modules.nix: move rtl to fix topological sorting
rtl depends on lnd and lightning-loop.
2021-11-28 21:18:47 +01:00
Erik Arvstedt
e44cd7ecdc
rtl: improve descriptions
Also move cl-rest to the bottom.
2021-11-28 21:18:44 +01:00
Erik Arvstedt
bd275d3a9a
minor improvements
- README:
  - Add RTL

- examples/configuration.nix:
  - Fix comment

- btcpayserver.nix:
  - Use nbLib.addressWithPort
  - Embed optionalString like the other optionalStrings

- clboss.nix:
  - Improve description

- clightning.nix:
  - Option `extraConfig`: Add example, improve description.
  - Disable `log-timestamps`. Timestamps are already logged via journald.
  - Simplify `preStart` script

- electrs.nix:
  - Use `port` description wording like in other services.
2021-11-28 21:18:40 +01:00
Erik Arvstedt
8aa28da110
remove recurring-donations module
This module has failed to evaluate for quite some time.
We might bring it back someday with bolt12 and LNURL support.
2021-11-28 21:18:39 +01:00
Jonas Nick
76737ead9f
update nixpkgs
btcpayserver: 1.3.3 -> 1.3.6
electrs: 0.9.2 -> 0.9.3
lnd: 0.13.3-beta -> 0.14.1-beta
nbxplorer: 2.2.16 -> 2.2.18

electrs does not accept command line argument -vv anymore, so we have to use
--log-filter instead.
2021-11-28 17:34:10 +00:00
Jonas Nick
6673c8245c
Merge fort-nix/nix-bitcoin#423: Misc. improvements
4a74b7de08 clightning: work around unsupported seccomp syscall (Erik Arvstedt)
38a843d005 clightning: update python pkgs to new version (Erik Arvstedt)
6ad7107ddb update nixpkgs (Erik Arvstedt)
f58d67677e netns-isolation: separate host and netns setup (Erik Arvstedt)
cb6e5ef702 netns-isolation: fix routing issues due to netns restarting (Erik Arvstedt)
7f77147b60 makeShell: minor improvements (Erik Arvstedt)
a5730eb736 makeShell: make the help msg a shell derivation variable (Erik Arvstedt)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK 4a74b7de08

Tree-SHA512: 75454b51db6d7ab41590d8579e0a5136e5ac1be78d5c2f547c6ef1982c0de679968879bb9bac57dd66413f59a4659236601ab75414486b0137c7c43d73d22759
2021-11-10 21:57:16 +00:00
Erik Arvstedt
4a74b7de08
clightning: work around unsupported seccomp syscall 2021-11-10 21:26:56 +01:00
nixbitcoin
f569227410
rtl: add module 2021-11-09 14:13:42 +00:00
Erik Arvstedt
f58d67677e
netns-isolation: separate host and netns setup
- Improves readability

- `netns exec ...` (called via `netnsIptables`) incurs a large
  overhead: In addition to netns switching, a mount namespace
  is setup and populated with the contents of /etc/netns/<ns>/.
  Instead, simply run `nsenter`.
2021-11-08 12:46:28 +01:00
Erik Arvstedt
cb6e5ef702
netns-isolation: fix routing issues due to netns restarting
Previously, restarting a service implied restarting its netns.
For unknown reasons, this sometimes caused the netns-local address
to not be routable from the root netns for up to 20 s.
I.e., the service was sometimes unreachable after restarting.

Now the netns is no longer stopped when the service is stopped.
2021-11-08 12:46:27 +01:00
Jonas Nick
3f844c06f0
Merge fort-nix/nix-bitcoin#418: update nixpkgs
b3e868d0af tests/regtest: disable incompatible `validatepegin` for liquidd (Erik Arvstedt)
c30fe1919b netns-isolation: don't auto-assign IPv6 addrs to peer links (Erik Arvstedt)
6584540828 makeShell: make help message extensible (Erik Arvstedt)
0478354477 versioning: move variable (Erik Arvstedt)
8616254d63 bitcoind-rpc-public-whitelist: remove waitfornewblock (Erik Arvstedt)
083e141e3e tests/btcpayserver: test bitcoind P2P connection in regtest (Erik Arvstedt)
82c92df162 tests/regtest: fix restarting bitcoind (Erik Arvstedt)
49086abcc5 liquidd: use systemd startup notification (Erik Arvstedt)
b83fd845c2 update nixpkgs (nixbitcoin)
852c112603 Use HTTPS URL for spark-wallet GitHub node packages (nixbitcoin)

Pull request description:

ACKs for top commit:
  erikarvstedt:
    ACK b3e868d0af
  jonasnick:
    utACK b3e868d0af

Tree-SHA512: 300410157a54f90f40abda064ed9b8f2310e3002bd2eac0527404d5402cd7d87c2d2d1d79d68cf1569841645c333b281d706607deae9461e1ef07f6c20427297
2021-11-03 10:25:38 +00:00
cadwgan0
ae1c90997d missing sys import for error path set_onion_address 2021-11-02 23:25:55 -04:00
Erik Arvstedt
b3e868d0af
tests/regtest: disable incompatible validatepegin for liquidd
Otherwise liquidd startup fails. This bug was not covered by our tests,
because we're not combining `regtest` with `secure-node`.
But nixbitcoin.org does, which should suffice for now.
2021-11-02 17:40:43 +01:00
Erik Arvstedt
c30fe1919b
netns-isolation: don't auto-assign IPv6 addrs to peer links
This simplifies the host's address configuration.

This also removes unused addresses that are returned when resolving
container hostnames via nss-mymachines:
`getent ahosts nb-test`
2021-11-02 17:40:43 +01:00
Erik Arvstedt
0478354477
versioning: move variable
The variable is an internal implementation detail. Move it close to
where it's used.
2021-11-02 17:40:43 +01:00
Erik Arvstedt
8616254d63
bitcoind-rpc-public-whitelist: remove waitfornewblock
This is an internal testing function and it's no longer used by electrs.
2021-11-02 17:40:43 +01:00
Erik Arvstedt
49086abcc5
liquidd: use systemd startup notification 2021-11-02 17:40:43 +01:00
nixbitcoin
c2eb81b57e
btcpayserver: fix liquidd whitelistedPort 2021-11-01 11:59:05 +00:00
Jonas Nick
bac8518e7c
secure-node: stop pruning liquidd
There is no security reason why pruning should be enabled and therefore it
surprises users. Turning on pruning in the first place was simply a mistake.
2021-10-31 14:37:56 +00:00
Jonas Nick
347a0f3aee
secure-node: add dummy option to determine if the preset is enabled
This is useful for versioning.nix.
2021-10-31 14:00:46 +00:00
Erik Arvstedt
aada35fc7b
minor improvements
- README: add matrix room

- examples/configuration.nix: explain why bitcoind is enabled by default

- btcpayserver: group lnd service settings

- clightning:
  Use public onion port only when the onion service is public

  This allows users to enable the onion service while announcing a
  non-onion public address.

- netns-isolation: move `readOnly` attr to the top

- tests: use mkDefault to allow for easier overriding

- tests/btcpayserver: test web server response
2021-10-30 15:34:48 +02:00
Erik Arvstedt
1da23cd933
bitcoind, liquidd: add whitelisted socket
This allows whitelisting local services without implicitly
whitelisting all inbound onion connections, which would happen when
setting bitcoind/liquidd option `whitelist=localhost`.

Used by electrs and nbxplorer, which requires the unsafe `mempool`
permission.
2021-10-29 18:28:31 +02:00
Erik Arvstedt
8c3a88b2e8
update nixpkgs-unstable
Switch back from nixpkgs master to unstable.

Pkg updates:
btcpayserver: 1.2.3 -> 1.2.4
electrs: 0.9.0 -> 0.9.1
elementsd: 0.18.1.12 -> 0.21.0
lightning-pool: 0.5.0-alpha -> 0.5.1-alpha
nbxplorer: 2.2.5 -> 2.2.11

- liquidd:
  add `onionPort` like in bitcoind

- tests/electrs:
  remove KillSignal workaround
2021-10-29 17:59:25 +02:00
Erik Arvstedt
cc3d43f4e9
bitcoind: set onionPort in bitcoind module
This removes the module-level dependency from onion-services to
bitcoind.
Due to the `or false` fallback, there's no dependency added in
the reverse direction.

In particular, this allows us to not add a dependency on liquidd in
the following commit.
2021-10-28 22:24:24 +02:00
Jonas Nick
20d4240919
Merge fort-nix/nix-bitcoin#410: joinmarket: 0.9.2 -> 0.9.3
d5ce1c43a8 test: make joinmarket work with regtest (nixbitcoin)
a10aa21c69 joinmarket: 0.9.2 -> 0.9.3 (nixbitcoin)
721ba1aeba python-packages: separate `specific-versions` pkgs (Erik Arvstedt)

Pull request description:

ACKs for top commit:
  erikarvstedt:
    ACK d5ce1c43a8
  jonasnick:
    light utACK d5ce1c43a8

Tree-SHA512: 5ddccbf9a88640086d14051283b59e704364d4d5f3f6aa6c698d88d8a6634ac9a7b525b11cf1670c9aaa6a797635bc23e135972d9bc8c909ec51b58fe57e8f5c
2021-10-28 09:50:22 +00:00
nixbitcoin
d5ce1c43a8
test: make joinmarket work with regtest 2021-10-27 16:08:28 +02:00
nixbitcoin
a10aa21c69
joinmarket: 0.9.2 -> 0.9.3 2021-10-27 16:02:59 +02:00
kon
b6d1928e90 clightning: add public port
Co-authored-by: Erik Arvstedt <erik.arvstedt@gmail.com>
2021-10-26 21:34:33 +02:00
Jonas Nick
bfe8ac972c
Merge fort-nix/nix-bitcoin#405: bitcoind: add separate p2p socket for tor connections
ec4a4dbe41 btcpayserver: fix whitelist security issue (Erik Arvstedt)
df2070b44a bitcoind: add separate p2p socket for tor connections (Erik Arvstedt)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK ec4a4dbe41

Tree-SHA512: 457bfb5806dca65507261c1868ca89c86a39f63bd10833b7531fd74dd779816083270c8ccc95ad08a5306e9b31c440904e3cba35464d47c0d87418d0be3e732d
2021-10-21 12:17:17 +00:00
Erik Arvstedt
ec4a4dbe41
btcpayserver: fix whitelist security issue
Whitelisting localhost implicitly whitelists all inbound onion
connections. This prevents banning misbehaving inbound onion peers
and enables message `mempool` which can cause privacy leaks.

Instead, grant `download` as the single bitcoind whitelist permission, which
should be safe for onion peers.
Remove liquidd whitelisting because it doesn't support fine-grained permissions.

After a cursory glance at the nbxplorer code I think that nbxplorer
requires none of the other default whitelist permissions (noban, mempool,
relay).
Details: https://github.com/dgarage/NBXplorer/issues/344
2021-10-21 11:40:40 +02:00
Erik Arvstedt
df2070b44a
bitcoind: add separate p2p socket for tor connections
This re-enables onion tagging while still supporting untagged connections.

Onion sockets are not yet supported in the latest liquidd/elements
version 0.18.1.12 available on nixpkgs.
2021-10-21 11:40:40 +02:00
Jonas Nick
8b1b06311d
Merge fort-nix/nix-bitcoin#406: bitcoind: one-option i2p support
63836127c9 bitcoind: one-option i2p support (nixbitcoin)

Pull request description:

ACKs for top commit:
  erikarvstedt:
    ACK 63836127c9
  jonasnick:
    utACK 63836127c9

Tree-SHA512: be7806657885ba455e7137dfc8c20ea4d58898b04db030a964aafbde1c505041a1f9e700654ad9c75ab2bb9267174bdbe84c9d7e4de63a09508b72fbd5c8f1a1
2021-10-15 11:02:09 +00:00