nix-bitcoin/pkgs/generate-secrets/default.nix

{ pkgs }: with pkgs;

let
  rpcauthSrc = builtins.fetchurl {
    url = "https://raw.githubusercontent.com/bitcoin/bitcoin/d6cde007db9d3e6ee93bd98a9bbfdce9bfa9b15b/share/rpcauth/rpcauth.py";
    sha256 = "189mpplam6yzizssrgiyv70c9899ggh8cac76j4n7v0xqzfip07n";
  };
  rpcauth = pkgs.writeScriptBin "rpcauth" ''
    exec ${pkgs.python3}/bin/python ${rpcauthSrc} "$@"
  '';
in
writers.writeBash "generate-secrets" ''
  export PATH=${lib.makeBinPath [ coreutils pwgen openssl gnugrep rpcauth ]}
  . ${./generate-secrets.sh} ${./openssl.cnf}
''
add generate-secrets pkg generate-secrets.sh will also be used in generate-secrets.nix, so DRY its dependency definitions. 2019-11-27 13:04:31 +00:00			`{ pkgs }: with pkgs;`

bitcoind: switch from rpcpassword to rpcauth Includes bitcoind's `share/rpcauth` to convert apg generated passwords into salted HMAC-SHA-256 hashed passwords. 2020-06-22 12:10:54 +00:00			`let`
generate-secrets: fetch rpcauth.py from github No need to vendor this. 2020-08-27 10:17:40 +00:00			`rpcauthSrc = builtins.fetchurl {`
			`url = "https://raw.githubusercontent.com/bitcoin/bitcoin/d6cde007db9d3e6ee93bd98a9bbfdce9bfa9b15b/share/rpcauth/rpcauth.py";`
			`sha256 = "189mpplam6yzizssrgiyv70c9899ggh8cac76j4n7v0xqzfip07n";`
			`};`
			`rpcauth = pkgs.writeScriptBin "rpcauth" ''`
generate-secrets: fix python version for rpcauth I accidentally included the minor version number. Version 3.5 has been removed from nixpkgs unstable. 2020-09-24 14:32:38 +00:00			`exec ${pkgs.python3}/bin/python ${rpcauthSrc} "$@"`
generate-secrets: fetch rpcauth.py from github No need to vendor this. 2020-08-27 10:17:40 +00:00			`'';`
bitcoind: switch from rpcpassword to rpcauth Includes bitcoind's `share/rpcauth` to convert apg generated passwords into salted HMAC-SHA-256 hashed passwords. 2020-06-22 12:10:54 +00:00			`in`
generate-secrets: always run with Bash, stop on errors 2020-10-23 08:45:49 +00:00			`writers.writeBash "generate-secrets" ''`
generate-secrets: use pwgen Password length and alphabet is unchanged, but the restriction to include at least one numeric and one capital char has been removed. This restriction is not needed by client applications, adds code complexity, and even (insignificantly) reduces entropy. Reason for switching to pwgen: apg uses /dev/random instead of /dev/urandom which brings no security benefits but can stall the generate-secrets script on low-entropy devices due to blocking. Since `security.rngd` has been disabled in NixOS 20.09, blocking in generate-secrets can also appear on regular NixOS desktop systems. 2020-12-16 00:28:12 +00:00			`export PATH=${lib.makeBinPath [ coreutils pwgen openssl gnugrep rpcauth ]}`
add generate-secrets pkg generate-secrets.sh will also be used in generate-secrets.nix, so DRY its dependency definitions. 2019-11-27 13:04:31 +00:00			`. ${./generate-secrets.sh} ${./openssl.cnf}`
			`''`