nix-bitcoin/docs/services.md
Erik Arvstedt 8e1ad6e3a8
docs/services: update Zeus usage section, add clightning
The current Zeus version has native tor support, so Orbot is no longer required.
2022-05-06 16:26:40 +02:00

12 KiB

Nodeinfo

Run nodeinfo to see onion addresses and local addresses for enabled services.

Managing services

NixOS uses the systemd service manager.

Usage:

# Show service status
systemctl status bitcoind

# Show the last 100 log messages
journalctl -u bitcoind -n 100
# Show all log messages since the last system boot
journalctl -b -u bitcoind

# These commands require root permissions
systemctl stop bitcoind
systemctl start bitcoind
systemctl restart bitcoind

# Show the service definition
systemctl cat bitcoind
# Show all service parameters
systemctl show bitcoind

Connect to RTL

Normally you would connect to RTL via SSH tunneling with a command like this

ssh -L 3000:localhost:3000 root@bitcoin-node

Or like this, if you are using netns-isolation

ssh -L 3000:169.254.1.29:3000 root@bitcoin-node

Otherwise, you can access it via Tor Browser at http://<onion-address>. You can find the <onion-address> with command nodeinfo. The default password location is $secretsDir/rtl-password. See: Secrets dir

Use LND or clightning with Zeus (smartphone wallet) via Tor

  1. Install Zeus

  2. Edit your configuration.nix

    For lnd

    Add the following config:

    services.lnd.lndconnectOnion.enable = true;
    
    For clightning

    Add the following config:

    services.clightning-rest = {
      enable = true;
      lndconnectOnion.enable = true;
    };
    
  3. Deploy your configuration

  4. Run the following command on your node (as user operator) to create a QR code with address and authentication information:

    For lnd
    lndconnect-onion
    
    For clightning
    lndconnect-onion-clightning
    
  5. Configure Zeus

    • Add a new node
    • Select Scan lndconnect config (at the bottom) and scan the QR code
    • For clightning: Set Node interface to c-lightning-REST
    • Click Save node config
    • Start sending sats privately

Additional lndconnect features

Create plain text URLs or QR code images:

lndconnect-onion --url
lndconnect-onion --image

Create a QR code for a custom hostname:

lndconnect-onion --host=mynode.org

Connect to spark-wallet

Requirements

  1. Enable spark-wallet in configuration.nix

    Change

    # services.spark-wallet.enable = true;
    

    to

    services.spark-wallet.enable = true;
    
  2. Deploy new configuration.nix

  3. Enable Orbot VPN for spark-wallet

    Open Orbot app
    Turn on "VPN Mode"
    Select Gear icon under "Tor-Enabled Apps"
    Toggle checkbox under Spark icon
    
  4. Get the onion address, access key and QR access code for the spark wallet android app

    journalctl -eu spark-wallet
    

    Note: The qr code might have issues scanning if you have a light terminal theme. Try setting it to dark or highlighting the entire output to invert the colors.

  5. Connect to spark-wallet android app

    Server Settings
    Scan QR
    Done
    

Connect to electrs

Requirements Android

Requirements Desktop

  1. Enable electrs in configuration.nix

    Change

    # services.electrs.enable = true;
    

    to

    services.electrs.enable = true;
    
  2. Deploy new configuration.nix

  3. Get electrs onion address with format <onion-address>:<port>

    nodeinfo | jq -r .electrs.onion_address
    
  4. Connect to electrs

    Make sure Tor is running on Desktop or as Orbot on Android.

    On Desktop

    electrum --oneserver -1 -s "<electrs onion address>:t" -p socks5:localhost:9050
    

    On Android

    Three dots in the upper-right-hand corner
    Network > Proxy mode: socks5, Host: 127.0.0.1, Port: 9050
    Network > Auto-connect: OFF
    Network > One-server mode: ON
    Network > Server: <electrs onion address>:t
    

Connect to nix-bitcoin node through the SSH onion service

  1. Get the SSH onion address (excluding the port suffix)

    ssh operator@bitcoin-node
    nodeinfo | jq -r .sshd.onion_address | sed 's/:.*//'
    
  2. Create a SSH key

    ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519
    
  3. Place the ed25519 key's fingerprint in the configuration.nix openssh.authorizedKeys.keys field like so

    # FIXME: Add your SSH pubkey
    services.openssh.enable = true;
    users.users.root = {
      openssh.authorizedKeys.keys = [ "<contents of ~/.ssh/id_ed25519.pub>" ];
    };
    
  4. Connect to your nix-bitcoin node's SSH onion service, forwarding a local port to the nix-bitcoin node's SSH server

    ssh -i ~/.ssh/id_ed25519 -L <random port of your choosing>:localhost:22 root@<SSH onion address>
    
  5. Edit your deployment tool's configuration and change the node's address to localhost and the ssh port to <random port of your choosing>. If you use krops as described in the installation tutorial, set target = "localhost:<random port of your choosing>"; in krops/deploy.nix.

  6. After deploying the new configuration, it will connect through the SSH tunnel you established in step iv. This also allows you to do more complex SSH setups that some deployment tools don't support. An example would be authenticating with Trezor's SSH agent, which provides extra security.

Initialize a Trezor for Bitcoin Core's Hardware Wallet Interface

  1. Enable Trezor in configuration.nix

    Change

    # services.hardware-wallets.trezor = true;
    

    to

    services.hardware-wallets.trezor = true;
    
  2. Deploy new configuration.nix

  3. Check that your nix-bitcoin node recognizes your Trezor

    ssh operator@bitcoin-node
    lsusb
    

    Should show something relating to your Trezor

  4. If your Trezor has outdated firmware or is not yet initialized: Start your Trezor in bootloader mode

    Trezor v1

    Plug in your Trezor with both buttons depressed
    

    Trezor v2

    Start swiping your finger across your Trezor's touchscreen and plug in the USB cable when your finger is halfway through
    
  5. If your Trezor's firmware is outdated: Update your Trezor's firmware

    trezorctl firmware-update
    

    Follow the on-screen instructions

    Caution: This command will wipe your Trezor. If you already store Bitcoin on it, only do this with the recovery seed nearby.

  6. If your Trezor is not yet initialized: Set up your Trezor

    trezorctl reset-device -p
    

    Follow the on-screen instructions

  7. Find your Trezor

    hwi enumerate
    hwi -t trezor -d <path from previous command> promptpin
    hwi -t trezor -d <path> sendpin <number positions for the PIN as displayed on your device's screen>
    hwi enumerate
    
  8. Follow Bitcoin Core's instructions on Using Bitcoin Core with Hardware Wallets to use your Trezor with bitcoin-cli on your nix-bitcoin node

JoinMarket

Diff to regular JoinMarket usage

For clarity reasons, nix-bitcoin renames all scripts to jm-* without .py, for example wallet-tool.py becomes jm-wallet-tool. The rest of this section details nix-bitcoin specific workflows for JoinMarket.

Wallets

By default, a wallet is automatically generated at service startup. It's stored at /var/lib/joinmarket/wallets/wallet.jmdat, and its mnmenoic recovery seed phrase is stored at /var/lib/joinmarket/jm-wallet-seed.

A missing wallet file is automatically recreated if the seed file is still present.

If you want to manually initialize your wallet instead, follow these steps:

  1. Enable JoinMarket in your node configuration

    services.joinmarket.enable = true;
    
  2. Move the automatically generated wallet.jmdat

    mv /var/lib/joinmarket/wallet.jmdat /var/lib/joinmarket/bak.jmdat
    
  3. Generate wallet on your node

    jm-wallet-tool generate
    

    Follow the on-screen instructions and write down your seed.

    In order to use nix-bitcoin's joinmarket.yieldgenerator, use the password from $secretsDir/jm-wallet-password and use the suggested default wallet name wallet.jmdat. If you want to use your own jm-wallet-password, simply replace the password string in your local secrets directory. See: Secrets dir

Run the tumbler

The tumbler needs to be able to run in the background for a long time, use screen to run it accross SSH sessions. You can also use tmux in the same fashion.

  1. Add screen to your environment.systemPackages, for example

    environment.systemPackages = with pkgs; [
      vim
      screen
    ];
    
  2. Start the screen session

    screen -S "tumbler"
    
  3. Start the tumbler

    Example: Tumbling into your wallet after buying from an exchange to improve privacy:

    jm-tumbler wallet.jmdat <addr1> <addr2> <addr3>
    

    After tumbling your bitcoin end up in these three addresses. You can now spend them without the exchange collecting data on your purchases.

    Get more information here

  4. Detach the screen session to leave the tumbler running in the background

    Ctrl-a d or Ctrl-a Ctrl-d
    
  5. Re-attach to the screen session

    screen -r tumbler
    
  6. End screen session

    Type exit when tumbler is done

    exit
    

Run a "maker" or "yield generator"

The maker/yield generator in nix-bitcoin is implemented using a systemd service.

See here for more yield generator information.

  1. Enable yield generator bot in your node configuration

    services.joinmarket.yieldgenerator = {
      enable = true;
      # Optional: Add custom parameters
      txfee = 200;
      cjfee_a = 300;
    };
    '';
    
  2. Check service status

    systemctl status joinmarket-yieldgenerator
    
  3. Profit

clightning

Plugins

There is a number of plugins available for clightning. See Readme: Features → clightning or search.nixos.org for a complete list.

You can activate and configure these plugins like so:

services.clightning = {
    enable = true;
    plugins = {
        prometheus.enable = true;
        prometheus.listen = "0.0.0.0:9900";
    };
};

Please have a look at the module for a plugin (e.g. prometheus.nix) to learn its configuration options.