nix-bitcoin/modules/joinmarket-ob-watcher.nix
2021-10-13 14:44:36 +02:00

122 lines
3.5 KiB
Nix

{ config, lib, pkgs, ... }:
with lib;
let
options.services.joinmarket-ob-watcher = {
enable = mkEnableOption "JoinMarket orderbook watcher";
address = mkOption {
type = types.str;
default = "127.0.0.1";
description = "HTTP server address.";
};
port = mkOption {
type = types.port;
default = 62601;
description = "HTTP server port.";
};
dataDir = mkOption {
readOnly = true;
default = "/var/lib/joinmarket-ob-watcher";
description = "The data directory for JoinMarket orderbook watcher.";
};
user = mkOption {
type = types.str;
default = "joinmarket-ob-watcher";
description = "The user as which to run JoinMarket.";
};
group = mkOption {
type = types.str;
default = cfg.user;
description = "The group as which to run JoinMarket.";
};
# This option is only used by netns-isolation
enforceTor = mkOption {
readOnly = true;
default = true;
};
};
cfg = config.services.joinmarket-ob-watcher;
nbLib = config.nix-bitcoin.lib;
nbPkgs = config.nix-bitcoin.pkgs;
secretsDir = config.nix-bitcoin.secretsDir;
inherit (config.services) bitcoind joinmarket;
configFile = builtins.toFile "config" ''
[BLOCKCHAIN]
blockchain_source = bitcoin-rpc
network = ${bitcoind.network}
rpc_host = ${bitcoind.rpc.address}
rpc_port = ${toString bitcoind.rpc.port}
rpc_user = ${bitcoind.rpc.users.joinmarket-ob-watcher.name}
${joinmarket.ircServers}
'';
in {
inherit options;
config = mkIf cfg.enable {
services.bitcoind.rpc.users.joinmarket-ob-watcher = {
passwordHMACFromFile = true;
rpcwhitelist = bitcoind.rpc.users.public.rpcwhitelist ++ [
"listwallets"
];
};
# Joinmarket is Tor-only
services.tor = {
enable = true;
client.enable = true;
};
systemd.tmpfiles.rules = [
"d '${cfg.dataDir}' 0770 ${cfg.user} ${cfg.group} - -"
];
systemd.services.joinmarket-ob-watcher = rec {
wantedBy = [ "multi-user.target" ];
requires = [ "tor.service" "bitcoind.service" ];
after = requires;
# The service writes to HOME/.config/matplotlib
environment.HOME = cfg.dataDir;
preStart = ''
{
cat ${configFile}
echo
echo '[BLOCKCHAIN]'
echo "rpc_password = $(cat ${secretsDir}/bitcoin-rpcpassword-joinmarket-ob-watcher)"
} > '${cfg.dataDir}/joinmarket.cfg'
'';
serviceConfig = nbLib.defaultHardening // rec {
StateDirectory = "joinmarket-ob-watcher";
StateDirectoryMode = "770";
WorkingDirectory = cfg.dataDir; # The service creates dir 'logs' in the working dir
User = cfg.user;
ExecStart = ''
${nbPkgs.joinmarket}/bin/jm-ob-watcher --datadir=${cfg.dataDir} \
--host=${cfg.address} --port=${toString cfg.port}
'';
SystemCallFilter = nbLib.defaultHardening.SystemCallFilter ++ [ "mbind" ] ;
Restart = "on-failure";
RestartSec = "10s";
} // nbLib.allowTor;
};
users.users.${cfg.user} = {
isSystemUser = true;
group = cfg.group;
home = cfg.dataDir;
};
users.groups.${cfg.group} = {};
nix-bitcoin.secrets = {
bitcoin-rpcpassword-joinmarket-ob-watcher.user = cfg.user;
bitcoin-HMAC-joinmarket-ob-watcher.user = bitcoind.user;
};
nix-bitcoin.generateSecretsCmds.joinmarket-ob-watcher = ''
makeBitcoinRPCPassword joinmarket-ob-watcher
'';
};
}