{ config, lib, pkgs, ... }: with lib; let cfg = config.services.clightning; nbLib = config.nix-bitcoin.lib; nbPkgs = config.nix-bitcoin.pkgs; network = config.services.bitcoind.makeNetworkName "bitcoin" "regtest"; configFile = pkgs.writeText "config" '' network=${network} bitcoin-datadir=${config.services.bitcoind.dataDir} ${optionalString (cfg.proxy != null) "proxy=${cfg.proxy}"} always-use-proxy=${boolToString cfg.always-use-proxy} bind-addr=${cfg.address}:${toString cfg.port} bitcoin-rpcconnect=${config.services.bitcoind.rpc.address} bitcoin-rpcport=${toString config.services.bitcoind.rpc.port} bitcoin-rpcuser=${config.services.bitcoind.rpc.users.public.name} rpc-file-mode=0660 ${cfg.extraConfig} ''; in { options.services.clightning = { enable = mkOption { type = types.bool; default = false; description = '' If enabled, the clightning service will be installed. ''; }; address = mkOption { type = types.str; default = "127.0.0.1"; description = "IP address or UNIX domain socket to listen for peer connections."; }; port = mkOption { type = types.port; default = 9735; description = "Port to listen for peer connections."; }; proxy = mkOption { type = types.nullOr types.str; default = if cfg.enforceTor then config.services.tor.client.socksListenAddress else null; description = "Set a socks proxy to use to connect to Tor nodes (or for all connections if *always-use-proxy* is set)"; }; always-use-proxy = mkOption { type = types.bool; default = cfg.enforceTor; description = '' Always use the *proxy*, even to connect to normal IP addresses (you can still connect to Unix domain sockets manually). This also disables all DNS lookups, to avoid leaking information. ''; }; dataDir = mkOption { type = types.path; default = "/var/lib/clightning"; description = "The data directory for clightning."; }; networkDir = mkOption { readOnly = true; default = "${cfg.dataDir}/${network}"; description = "The network data directory."; }; extraConfig = mkOption { type = types.lines; default = ""; description = "Additional lines appended to the config file."; }; user = mkOption { type = types.str; default = "clightning"; description = "The user as which to run clightning."; }; group = mkOption { type = types.str; default = cfg.user; description = "The group as which to run clightning."; }; cli = mkOption { readOnly = true; default = pkgs.writeScriptBin "lightning-cli" '' ${nbPkgs.clightning}/bin/lightning-cli --lightning-dir='${cfg.dataDir}' "$@" ''; description = "Binary to connect with the clightning instance."; }; getPublicAddressCmd = mkOption { type = types.str; default = ""; description = '' Bash expression which outputs the public service address to announce to peers. If left empty, no address is announced. ''; }; inherit (nbLib) enforceTor; }; config = mkIf cfg.enable { services.bitcoind = { enable = true; # Increase rpc thread count due to reports that lightning implementations fail # under high bitcoind rpc load rpc.threads = 16; }; environment.systemPackages = [ nbPkgs.clightning (hiPrio cfg.cli) ]; users.users.${cfg.user} = { description = "clightning User"; group = cfg.group; extraGroups = [ "bitcoinrpc" ]; }; users.groups.${cfg.group} = {}; nix-bitcoin.operator.groups = [ cfg.group ]; systemd.tmpfiles.rules = [ "d '${cfg.dataDir}' 0770 ${cfg.user} ${cfg.group} - -" ]; systemd.services.clightning = { description = "Run clightningd"; path = [ nbPkgs.bitcoind ]; wantedBy = [ "multi-user.target" ]; requires = [ "bitcoind.service" ]; after = [ "bitcoind.service" ]; preStart = '' cp ${configFile} ${cfg.dataDir}/config chown -R '${cfg.user}:${cfg.group}' '${cfg.dataDir}' # The RPC socket has to be removed otherwise we might have stale sockets rm -f ${cfg.networkDir}/lightning-rpc chmod 640 ${cfg.dataDir}/config { echo "bitcoin-rpcpassword=$(cat ${config.nix-bitcoin.secretsDir}/bitcoin-rpcpassword-public)" ${optionalString (cfg.getPublicAddressCmd != "") '' echo "announce-addr=$(${cfg.getPublicAddressCmd})" ''} } >> '${cfg.dataDir}/config' ''; serviceConfig = nbLib.defaultHardening // { ExecStart = "${nbPkgs.clightning}/bin/lightningd --lightning-dir=${cfg.dataDir}"; User = "${cfg.user}"; Restart = "on-failure"; RestartSec = "10s"; ReadWritePaths = "${cfg.dataDir}"; } // (if cfg.enforceTor then nbLib.allowTor else nbLib.allowAnyIP ); # Wait until the rpc socket appears postStart = '' while [[ ! -e ${cfg.networkDir}/lightning-rpc ]]; do sleep 0.1 done # Needed to enable lightning-cli for users with group 'clightning' chmod g+x ${cfg.networkDir} ''; }; }; }