Jonas Nick 79067156da
Merge #243: Modularize Tests
1cc432a1363eaafcb200b4ad3a4e7cad989fde26 examples/deploy-container: use new extra-container features (Erik Arvstedt)
16b2783ae79ab0c8f15978e32bddfa3b46a41ff5 examples: enable running outside of working dir (Erik Arvstedt)
04075b108ca3c219bbb6c625b9938b1d1fbc8232 test: use QEMU from stable nixpkgs (Erik Arvstedt)
03f8dbba472747f77ce3a14b4ee60f79f9531537 test: add non-secure-node eval test (Erik Arvstedt)
bb763d6a2613f2295077ee5e1619ba04deba0382 run-tests: add 'eval' command (Erik Arvstedt)
36358066e440d48378130adaf6507174bf60e1a3 spark-wallet: don't disable tor when onion-service is disabled (Erik Arvstedt)
c9251e72a1ccd8c9d325427417c55e0698672428 README: add run-tests.sh to examples (Erik Arvstedt)
5a565dff6607a26698c93e18e8218a02eb618565 netns test: use netns ips from config (Erik Arvstedt)
ac95fe7c82550b6bf9b35f44cf7b9e57db2da023 netns test: don't test recurring-donations (Erik Arvstedt)
84744f38d7ac67c1db98700be2de9e8b8a3fc8ab netns test: disable backup test (Erik Arvstedt)
fcc67da9f42928a8cd8e18b76a6f1cf702ca555a test: add container support (Erik Arvstedt)
e99b7edb8ee5b3400d26da456dc7f620ef0dde37 run-tests: pass script args verbatim to command without word splitting (Erik Arvstedt)
e7c397a48518d89825a52293812bef6360b53e7b run-tests: rename scriptDir -> testDir (Erik Arvstedt)
b552d17d553f99307d290b8c783adb52407db263 run-tests: fix arg error messages (Erik Arvstedt)
572967d3adc5f7be9d9fff1bddcf8f048021ccb8 extra-container: pre-release -> 0.5-pre (Erik Arvstedt)
ac6cee5c128990e7a5c661bb634b461812a92f70 pkgs: add extra-container (Erik Arvstedt)
be2127ae5be17b89868ff98f3df4c25bfbf4a8d6 test: fix noConnections configs (Erik Arvstedt)
1e18d3ea3b38528b784faa581bfcdc9484517f63 test: improve modularization (Erik Arvstedt)
14d2d97ba6e460ff0f322890dd9a829681b45fb7 test: rename scenario withnetns -> netns (Erik Arvstedt)
9bf77ee3e80bd7d23f29640f268aabb75a267667 backups test: simplify and speed up (Erik Arvstedt)
fcda69e8b616728cb74fd47ec1672c1b27eb6605 netns test: connect from main netns (Erik Arvstedt)
24069aa2c6982fb3e6c492379a486c1ce3aebcbd electrs: add option 'monitoringPort' (Erik Arvstedt)
611cfe5a28b63a074aca6e8df0190001e519a14f electrs: remove redundant daemonrpc option (Erik Arvstedt)
a19d3b07c2db9cb314dac9d3cc484f59210ec574 electrs: add variable 'bitcoind' (Erik Arvstedt)
a6dde36b8748e454823a59489d4eef2e241bc0d1 electrs: use consistent args formatting (Erik Arvstedt)
45bcbf683d600e75b00aab4f4e8f015224ab1a9a test: rename test.nix -> tests.nix (Erik Arvstedt)
c92e85f70734aabf2442f20a239cdc02af2121be test: rename base.py -> tests.py (Erik Arvstedt)

Pull request description:

ACKs for top commit:
  nixbitcoin:
    ACK 1cc432a1363eaafcb200b4ad3a4e7cad989fde26
  jonasnick:
    ACK 1cc432a1363eaafcb200b4ad3a4e7cad989fde26

Tree-SHA512: 388f195c85e740937f9e2cecbd672a1f1e64e6ce06a75ba8167aba4fc77b70e07d14282e9ca117b31e9085e37ed4cf286f90f1204cdaa4c0360141039b1cae95
2020-10-16 14:33:21 +00:00
2020-10-16 15:53:34 +02:00
2020-01-09 10:43:29 +01:00
2019-01-02 14:03:52 +00:00
2020-01-09 10:43:29 +01:00
2020-03-30 10:49:15 +02:00

nix-bitcoin

Build Status

Nix packages and nixos modules for easily installing Bitcoin nodes and higher layer protocols with an emphasis on security. This is a work in progress - don't expect it to be bug-free, secure or stable.

The default configuration sets up a Bitcoin Core node and c-lightning. The user can enable spark-wallet in configuration.nix to make c-lightning accessible with a smartphone using spark-wallet. A simple webpage shows the lightning nodeid and links to nanopos letting the user receive donations. It also includes elements-daemon. Outbound peer-to-peer traffic is forced through Tor, and listening services are bound to onion addresses.

A demo installation is running at http://6tr4dg3f2oa7slotdjp4syvnzzcry2lqqlcvqkfxdavxo6jsuxwqpxad.onion. The following screen cast shows a fresh deployment of a nix-bitcoin node.

The goal is to make it easy to deploy a reasonably secure Bitcoin node with a usable wallet. It should allow managing bitcoin (the currency) effectively and providing public infrastructure. It should be a reproducible and extensible platform for applications building on Bitcoin.

Examples

The easiest way to try out nix-bitcoin is to use one of the provided examples.

git clone https://github.com/fort-nix/nix-bitcoin
cd nix-bitcoin/examples/
nix-shell

The following example scripts set up a nix-bitcoin node according to examples/configuration.nix and then shut down immediately. They leave no traces (outside of /nix/store) on the host system.

Tests

The internal test suite is also useful for exploring features.
The following run-tests.sh commands leave no traces (outside of /nix/store) on the host system.

git clone https://github.com/fort-nix/nix-bitcoin
cd nix-bitcoin/test

# Run a Python test shell inside a VM node
./run-tests.sh debug
print(succeed("systemctl status bitcoind"))

# Run a node in a container. Requires systemd and root privileges.
./run-tests.sh container
c systemctl status bitcoind

# Explore a single feature
./run-tests.sh --scenario electrs container

See run-tests.sh for a complete documentation.

Available modules

By default the configuration.nix provides:

  • bitcoind with outbound connections through Tor and inbound connections through a hidden service. By default loaded with banlist of spy nodes.
  • clightning with outbound connections through Tor, not listening
  • includes "nodeinfo" script which prints basic info about the node
  • adds non-root user "operator" which has access to bitcoin-cli and lightning-cli

In configuration.nix the user can enable:

  • a clightning hidden service
  • liquid
  • lightning charge
  • nanopos
  • an index page using nginx to display node information and link to nanopos
  • spark-wallet
  • electrs
  • recurring-donations, a module to repeatedly send lightning payments to recipients specified in the configuration.
  • bitcoin-core-hwi.
    • You no longer need extra software to connect your hardware wallet to Bitcoin Core. Use Bitcoin Core's own Hardware Wallet Interface with one configuration.nix setting.

The data directories of the services can be found in /var/lib on the deployed machines.

Installation

See install.md for a detailed tutorial.

Security

  • Simplicity: Only services you select in configuration.nix and their dependencies are installed, packages and dependencies are pinned, most packages are built from the nixos stable channel, with a few exceptions that are built from the nixpkgs unstable channel, builds happen in a sandboxed environment, code is continuously reviewed and refined.
  • Integrity: Nix package manager, NixOS and packages can be built from source to reduce reliance on binary caches, nix-bitcoin merge commits are signed, all commits are approved by multiple nix-bitcoin developers, upstream packages are cryptographically verified where possible, we use this software ourselves.
  • Principle of Least Privilege: Services operate with least privileges; they each have their own user and are restricted further with systemd options, there's a non-root user operator to interact with the various services.
  • Defense-in-depth: nix-bitcoin is built with a hardened kernel by default, services are confined through discretionary access control, Linux namespaces, and seccomp-bpf with continuous improvements.

Note that nix-bitcoin is still experimental. Also, by design if the machine you're deploying from is insecure, there is nothing nix-bitcoin can do to protect itself.

Hardware requirements

  • Disk space: 300 GB (235GB for Bitcoin blockchain + some room)
    • Bitcoin Core pruning is not supported at the moment because it's not supported by c-lightning. It's possible to use pruning but you need to know what you're doing.
  • RAM: 2GB of memory. ECC memory is better. Additionally, it's recommended to use DDR4 memory with targeted row refresh (TRR) enabled (https://rambleed.com/).

Tested hardware includes pcengine's apu2c4, GB-BACE-3150, GB-BACE-3160. Some hardware (including Intel NUCs) may not be compatible with the hardened kernel turned on by default (see https://github.com/fort-nix/nix-bitcoin/issues/39#issuecomment-517366093 for a workaround).

Usage

For usage instructions, such as how to connect to spark-wallet, electrs and the ssh Tor Hidden Service, see usage.md.

Troubleshooting

If you are having problems with nix-bitcoin check the FAQ or submit an issue. There's also a #nix-bitcoin IRC channel on freenode. We are always happy to help.

Docs

Languages
Nix 84.4%
Shell 11.7%
Python 3.5%
C 0.4%