b1e13e9415
Each secret file to be deployed is now backed by one local file. This simplifies 'setup-secrets' and the secret definitions. Also, with the old format it was not possible to add new secrets to secrets.nix in a simple way. Old secrets are automatically converted to the new format when running nix-shell. Using the new option 'nix-bitcoin.secrets', secrets are now directly defined by the services that use them.
48 lines
1.5 KiB
Nix
48 lines
1.5 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.services.lightning-charge;
|
|
inherit (config) nix-bitcoin-services;
|
|
in {
|
|
options.services.lightning-charge = {
|
|
enable = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
If enabled, the lightning-charge service will be installed.
|
|
'';
|
|
};
|
|
clightning-datadir = mkOption {
|
|
type = types.str;
|
|
default = "/var/lib/clighting/";
|
|
description = ''
|
|
Data directory of the clightning service
|
|
'';
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
systemd.services.lightning-charge = {
|
|
description = "Run lightning-charge";
|
|
wantedBy = [ "multi-user.target" ];
|
|
requires = [ "clightning.service" ];
|
|
after = [ "clightning.service" ];
|
|
serviceConfig = {
|
|
EnvironmentFile = "/secrets/lightning-charge-env";
|
|
ExecStart = "${pkgs.nix-bitcoin.lightning-charge}/bin/charged -l ${config.services.clightning.dataDir} -d ${config.services.clightning.dataDir}/lightning-charge.db";
|
|
# Unfortunately c-lightning doesn't allow setting the permissions of the rpc socket,
|
|
# so this must run as the clightning user
|
|
# https://github.com/ElementsProject/lightning/issues/1366
|
|
User = "clightning";
|
|
Restart = "on-failure";
|
|
RestartSec = "10s";
|
|
} // nix-bitcoin-services.defaultHardening
|
|
// nix-bitcoin-services.nodejs
|
|
// nix-bitcoin-services.allowTor;
|
|
};
|
|
nix-bitcoin.secrets.lightning-charge-env.user = "clightning";
|
|
};
|
|
}
|