heierbtc/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
84fe731c94
nix-bitcoin/modules/lnd.nix

285 lines
9.3 KiB
Nix
Raw Normal View History

Add LND support
2019-08-05 08:44:38 +00:00
{ config, lib, pkgs, ... }:
with lib;
let
options.services.lnd = {
pkgs: add `meta` attr Also add more detailed `enable` option descriptions.
2021-12-14 18:51:23 +00:00
enable = mkEnableOption "Lightning Network daemon, a Lightning Network implementation in Go";
lnd: add consistent address options Also fix btcpayserver by connecting to the lnd restAddress instead of the p2p address.
2021-01-14 12:24:03 +00:00
address = mkOption {
type = types.str;
lnd: prepare for netns and bring in line with clightning - Adds bitcoind-host, and tor-socks options to allow using with network namespaces. - Adds listen, rpclisten, and restlisten option to specify host on which to listen on for peer, rpc and rest connections respectively - Adds announce-tor option and generates Tor Hidden Service with nix instead of lnd to bring in line with clightning. WARNING: Breaking changes for Tor Hidden Service. Manual migration necessary.
2020-06-04 09:30:17 +00:00
default = "localhost";
lnd: add consistent address options Also fix btcpayserver by connecting to the lnd restAddress instead of the p2p address.
2021-01-14 12:24:03 +00:00
description = "Address to listen for peer connections";
lnd: prepare for netns and bring in line with clightning - Adds bitcoind-host, and tor-socks options to allow using with network namespaces. - Adds listen, rpclisten, and restlisten option to specify host on which to listen on for peer, rpc and rest connections respectively - Adds announce-tor option and generates Tor Hidden Service with nix instead of lnd to bring in line with clightning. WARNING: Breaking changes for Tor Hidden Service. Manual migration necessary.
2020-06-04 09:30:17 +00:00
};
lnd: add consistent address options Also fix btcpayserver by connecting to the lnd restAddress instead of the p2p address.
2021-01-14 12:24:03 +00:00
port = mkOption {
lnd: add listenPort option
2020-08-04 07:45:02 +00:00
type = types.port;
default = 9735;
lnd: add consistent address options Also fix btcpayserver by connecting to the lnd restAddress instead of the p2p address.
2021-01-14 12:24:03 +00:00
description = "Port to listen for peer connections";
lnd: add listenPort option
2020-08-04 07:45:02 +00:00
};
lnd: add consistent address options Also fix btcpayserver by connecting to the lnd restAddress instead of the p2p address.
2021-01-14 12:24:03 +00:00
rpcAddress = mkOption {
lnd: use type str for rpclisten, restlisten
2020-10-29 20:20:33 +00:00
type = types.str;
default = "localhost";
lnd: add consistent address options Also fix btcpayserver by connecting to the lnd restAddress instead of the p2p address.
2021-01-14 12:24:03 +00:00
description = "Address to listen for RPC connections.";
lnd: prepare for netns and bring in line with clightning - Adds bitcoind-host, and tor-socks options to allow using with network namespaces. - Adds listen, rpclisten, and restlisten option to specify host on which to listen on for peer, rpc and rest connections respectively - Adds announce-tor option and generates Tor Hidden Service with nix instead of lnd to bring in line with clightning. WARNING: Breaking changes for Tor Hidden Service. Manual migration necessary.
2020-06-04 09:30:17 +00:00
};
lnd: add consistent address options Also fix btcpayserver by connecting to the lnd restAddress instead of the p2p address.
2021-01-14 12:24:03 +00:00
rpcPort = mkOption {
type = types.port;
default = 10009;
description = "Port to listen for gRPC connections.";
};
restAddress = mkOption {
lnd: use type str for rpclisten, restlisten
2020-10-29 20:20:33 +00:00
type = types.str;
default = "localhost";
lnd: improve options formatting
2021-09-16 10:48:21 +00:00
description = "Address to listen for REST connections.";
lnd: prepare for netns and bring in line with clightning - Adds bitcoind-host, and tor-socks options to allow using with network namespaces. - Adds listen, rpclisten, and restlisten option to specify host on which to listen on for peer, rpc and rest connections respectively - Adds announce-tor option and generates Tor Hidden Service with nix instead of lnd to bring in line with clightning. WARNING: Breaking changes for Tor Hidden Service. Manual migration necessary.
2020-06-04 09:30:17 +00:00
};
lnd: add option for configuring REST port
2020-06-02 13:20:04 +00:00
restPort = mkOption {
type = types.port;
default = 8080;
lnd: add consistent address options Also fix btcpayserver by connecting to the lnd restAddress instead of the p2p address.
2021-01-14 12:24:03 +00:00
description = "Port to listen for REST connections.";
lnd: add option for configuring REST port
2020-06-02 13:20:04 +00:00
};
lnd: improve options formatting
2021-09-16 10:48:21 +00:00
dataDir = mkOption {
type = types.path;
default = "/var/lib/lnd";
description = "The data directory for LND.";
};
networkDir = mkOption {
readOnly = true;
default = "${cfg.dataDir}/chain/bitcoin/${bitcoind.network}";
description = "The network data directory.";
};
lnd: prepare for netns and bring in line with clightning - Adds bitcoind-host, and tor-socks options to allow using with network namespaces. - Adds listen, rpclisten, and restlisten option to specify host on which to listen on for peer, rpc and rest connections respectively - Adds announce-tor option and generates Tor Hidden Service with nix instead of lnd to bring in line with clightning. WARNING: Breaking changes for Tor Hidden Service. Manual migration necessary.
2020-06-04 09:30:17 +00:00
tor-socks = mkOption {
type = types.nullOr types.str;
services: add `tor.*` options Split `enforceTor` into `tor.proxy` and `tor.enforce`. By enabling `tor.proxy` without `tor.enforce`, a service can accept incoming clearnet connections. E.g., this allows setting up a Tor-proxied bitcoind node that accepts RPC connections from LAN.
2021-11-28 20:24:49 +00:00
default = if cfg.tor.proxy then config.nix-bitcoin.torClientAddressWithPort else null;
bitcoind, clightning, lnd: improve descriptions bitcoind: The previous description of 'prune' didn't match the int-only values supported by our option.
2021-02-01 21:53:04 +00:00
description = "Socks proxy for connecting to Tor nodes";
lnd: prepare for netns and bring in line with clightning - Adds bitcoind-host, and tor-socks options to allow using with network namespaces. - Adds listen, rpclisten, and restlisten option to specify host on which to listen on for peer, rpc and rest connections respectively - Adds announce-tor option and generates Tor Hidden Service with nix instead of lnd to bring in line with clightning. WARNING: Breaking changes for Tor Hidden Service. Manual migration necessary.
2020-06-04 09:30:17 +00:00
};
lnd: generate custom macaroons Create new `macaroon` option that allows any module to place its own custom macaroon in the lnd RuntimeDirectory `/run/lnd`.
2020-08-26 08:22:23 +00:00
macaroons = mkOption {
default = {};
type = with types; attrsOf (submodule {
options = {
user = mkOption {
type = types.str;
description = "User who owns the macaroon.";
};
permissions = mkOption {
type = types.str;
example = ''
{"entity":"info","action":"read"},{"entity":"onchain","action":"read"}
'';
description = "List of granted macaroon permissions.";
};
};
});
description = ''
Extra macaroon definitions.
'';
};
Add LND support
2019-08-05 08:44:38 +00:00
extraConfig = mkOption {
lnd: add package option
2020-03-09 08:22:00 +00:00
type = types.lines;
default = "";
example = ''
autopilot.active=1
'';
treewide: streamline 'extraConfig' descriptions
2021-02-01 21:53:11 +00:00
description = "Extra lines appended to <filename>lnd.conf</filename>.";
lnd: add package option
2020-03-09 08:22:00 +00:00
};
package = mkOption {
type = types.package;
add option nix-bitcoin.pkgs, remove overlay This works around a nixpkgs bug where overlays are ignored in containers.
2020-11-09 21:09:09 +00:00
default = config.nix-bitcoin.pkgs.lnd;
nix-bitcoin.nix: add `defaultText` (automatic) This enables generating module option documentation. This commit was genereated by running the following script inside the repo root dir: def add_default_text(file) src = File.read(file) src2 = src.gsub(/( = mkOption\s+\{[^{]*?)(\n\s+default = )(.*?);$(.*?\})/m) do |str| pre, defaultVar, default, post = Regexp.last_match.captures replacement = if !post.include?('defaultText =') if default =~ /\bpkgs\b/ defaultText = default.lines.length == 1 ? default : "(See source)" "#{pre}#{defaultVar}#{default};#{defaultVar.sub('default', 'defaultText')}#{defaultText.inspect};#{post}" end end replacement or str end File.write(file, src2) if src2 != src end Dir["modules/**/*.nix"].each do |f| next if File.basename(f) == "nix-bitcoin.nix" add_default_text f end
2021-12-08 03:07:28 +00:00
defaultText = "config.nix-bitcoin.pkgs.lnd";
lnd: add package option
2020-03-09 08:22:00 +00:00
description = "The package providing lnd binaries.";
};
lnd: add cli option
2019-11-27 13:04:34 +00:00
cli = mkOption {
default = pkgs.writeScriptBin "lncli"
lnd: improve options formatting
2021-09-16 10:48:21 +00:00
# Switch user because lnd makes datadir contents readable by user only
''
${runAsUser} ${cfg.user} ${cfg.package}/bin/lncli \
--rpcserver ${cfg.rpcAddress}:${toString cfg.rpcPort} \
--tlscertpath '${cfg.certPath}' \
--macaroonpath '${networkDir}/admin.macaroon' "$@"
'';
nix-bitcoin.nix: add `defaultText` (automatic) This enables generating module option documentation. This commit was genereated by running the following script inside the repo root dir: def add_default_text(file) src = File.read(file) src2 = src.gsub(/( = mkOption\s+\{[^{]*?)(\n\s+default = )(.*?);$(.*?\})/m) do |str| pre, defaultVar, default, post = Regexp.last_match.captures replacement = if !post.include?('defaultText =') if default =~ /\bpkgs\b/ defaultText = default.lines.length == 1 ? default : "(See source)" "#{pre}#{defaultVar}#{default};#{defaultVar.sub('default', 'defaultText')}#{defaultText.inspect};#{post}" end end replacement or str end File.write(file, src2) if src2 != src end Dir["modules/**/*.nix"].each do |f| next if File.basename(f) == "nix-bitcoin.nix" add_default_text f end
2021-12-08 03:07:28 +00:00
defaultText = "(See source)";
lnd: add cli option
2019-11-27 13:04:34 +00:00
description = "Binary to connect with the lnd instance.";
};
lnd: use onionServices for address announcing
2021-01-14 12:24:21 +00:00
getPublicAddressCmd = mkOption {
type = types.str;
default = "";
description = ''
Bash expression which outputs the public service address to announce to peers.
If left empty, no address is announced.
'';
};
lnd: add user & group options
2021-02-16 16:50:39 +00:00
user = mkOption {
type = types.str;
default = "lnd";
description = "The user as which to run LND.";
};
group = mkOption {
type = types.str;
default = cfg.user;
description = "The group as which to run LND.";
};
lnd: extract option `certPath` Improves service encapsulation.
2021-09-08 15:01:13 +00:00
certPath = mkOption {
readOnly = true;
default = "${secretsDir}/lnd-cert";
description = "LND TLS certificate path.";
};
services: add `tor.*` options Split `enforceTor` into `tor.proxy` and `tor.enforce`. By enabling `tor.proxy` without `tor.enforce`, a service can accept incoming clearnet connections. E.g., this allows setting up a Tor-proxied bitcoind node that accepts RPC connections from LAN.
2021-11-28 20:24:49 +00:00
tor = nbLib.tor;
Add LND support
2019-08-05 08:44:38 +00:00
};
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
cfg = config.services.lnd;
nbLib = config.nix-bitcoin.lib;
secretsDir = config.nix-bitcoin.secretsDir;
runAsUser = config.nix-bitcoin.runAsUserCmd;
lnd: use `lndinit` for wallet creation
2022-03-29 19:48:57 +00:00
lndinit = "${config.nix-bitcoin.pkgs.lndinit}/bin/lndinit";
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
bitcoind = config.services.bitcoind;
modules: use consistent service variables Benefits of adding top-level variables for used services: - Makes it obvious which other services are referenced by a service - Less code We already do this in many other places.
2021-09-13 11:40:49 +00:00
services: support 0.0.0.0/:: in `address` options Previously, client services didn't decode these special INADDR_ANY addresses and failed to connect.
2021-10-01 09:51:57 +00:00
bitcoindRpcAddress = nbLib.address bitcoind.rpc.address;
lnd: improve options formatting
2021-09-16 10:48:21 +00:00
networkDir = cfg.networkDir;
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
configFile = pkgs.writeText "lnd.conf" ''
datadir=${cfg.dataDir}
logdir=${cfg.dataDir}/logs
tlscertpath=${cfg.certPath}
tlskeypath=${secretsDir}/lnd-key
listen=${toString cfg.address}:${toString cfg.port}
rpclisten=${cfg.rpcAddress}:${toString cfg.rpcPort}
restlisten=${cfg.restAddress}:${toString cfg.restPort}
bitcoin.${bitcoind.network}=1
bitcoin.active=1
bitcoin.node=bitcoind
services: add `tor.*` options Split `enforceTor` into `tor.proxy` and `tor.enforce`. By enabling `tor.proxy` without `tor.enforce`, a service can accept incoming clearnet connections. E.g., this allows setting up a Tor-proxied bitcoind node that accepts RPC connections from LAN.
2021-11-28 20:24:49 +00:00
${optionalString (cfg.tor.proxy) "tor.active=true"}
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
${optionalString (cfg.tor-socks != null) "tor.socks=${cfg.tor-socks}"}
bitcoind.rpchost=${bitcoindRpcAddress}:${toString bitcoind.rpc.port}
bitcoind.rpcuser=${bitcoind.rpc.users.public.name}
bitcoind.zmqpubrawblock=${bitcoind.zmqpubrawblock}
bitcoind.zmqpubrawtx=${bitcoind.zmqpubrawtx}
${cfg.extraConfig}
'';
in {
inherit options;
Add LND support
2019-08-05 08:44:38 +00:00
config = mkIf cfg.enable {
add module assertions
2020-06-15 10:34:11 +00:00
assertions = [
modules: move assertion to lnd.nix nix-bitcoin.nix is now no longer dependent on clightning.nix and lnd.nix. Due to condition '!(config.services ? clightning)' lnd.nix still doesn't depend on clightning.nix. Also fix the assertion message by renaming clightning.bindPort to clightning.port.
2021-08-15 09:28:46 +00:00
{ assertion =
!(config.services ? clightning)
|| !config.services.clightning.enable
|| config.services.clightning.port != cfg.port;
message = ''
LND and clightning can't both bind to lightning port 9735. Either
disable LND/clightning or change services.clightning.port or
services.lnd.port to a port other than 9735.
'';
}
add module assertions
2020-06-15 10:34:11 +00:00
];
move rpc thread count setting to lightning modules
2021-01-14 12:24:32 +00:00
services.bitcoind = {
enable = true;
services: use consistent layout Use the following order of definitions for all services: - assertions - configuration of other services - environment.systemPackages - tmpfiles - own service - users - secrets
2021-02-01 21:53:22 +00:00
move rpc thread count setting to lightning modules
2021-01-14 12:24:32 +00:00
# Increase rpc thread count due to reports that lightning implementations fail
# under high bitcoind rpc load
rpc.threads = 16;
services: use consistent layout Use the following order of definitions for all services: - assertions - configuration of other services - environment.systemPackages - tmpfiles - own service - users - secrets
2021-02-01 21:53:22 +00:00
zmqpubrawblock = "tcp://${bitcoindRpcAddress}:28332";
zmqpubrawtx = "tcp://${bitcoindRpcAddress}:28333";
move rpc thread count setting to lightning modules
2021-01-14 12:24:32 +00:00
};
services: auto-enable dependencies
2020-10-18 12:49:20 +00:00
move systemPackages definitions to services These are generally useful and shouldn't be limited to secure-node.nix. Also, only add the hardware-wallets group when hardware wallets are enabled.
2020-04-07 20:47:45 +00:00
environment.systemPackages = [ cfg.package (hiPrio cfg.cli) ];
lnd: only enable bitcoind zmqpub if lnd.enable In conjuction with secure-node.nix, this sets sane RestrictAddressFamilies unless lnd is enabled. Before, we were constantly exposing unnecessary Address Families, not just when lnd is enabled. However, zmqpub* must always be enabled for lnd, even when used outside of secure-node.nix, so we make this change in the lnd module.
2020-05-05 14:28:30 +00:00
All modules with preStart: Use systemd.tmpfiles.rules This is NixOS' recommended way to setup service dirs https://github.com/NixOS/nixpkgs/pull/56265. This commit hands off the initial data directory creation to systemd.tmpfiles.rules. All other preStart scripts are left intact to limit this changes' scope.
2020-05-06 10:43:57 +00:00
systemd.tmpfiles.rules = [
lnd: add user & group options
2021-02-16 16:50:39 +00:00
"d '${cfg.dataDir}' 0770 ${cfg.user} ${cfg.group} - -"
All modules with preStart: Use systemd.tmpfiles.rules This is NixOS' recommended way to setup service dirs https://github.com/NixOS/nixpkgs/pull/56265. This commit hands off the initial data directory creation to systemd.tmpfiles.rules. All other preStart scripts are left intact to limit this changes' scope.
2020-05-06 10:43:57 +00:00
];
Add LND support
2019-08-05 08:44:38 +00:00
systemd.services.lnd = {
wantedBy = [ "multi-user.target" ];
lnd: use onionServices for address announcing
2021-01-14 12:24:21 +00:00
requires = [ "bitcoind.service" ];
after = [ "bitcoind.service" ];
Add LND support
2019-08-05 08:44:38 +00:00
preStart = ''
lnd: add strict hardening Add ProtectSystem=strict, remove PermissionStartOnly. Extract the section of postStart that needs secrets dir write access into a separate script with full privileges. Simplify preStart and fix dataDir quoting.
2020-05-22 13:59:18 +00:00
install -m600 ${configFile} '${cfg.dataDir}/lnd.conf'
lnd: use onionServices for address announcing
2021-01-14 12:24:21 +00:00
{
echo "bitcoind.rpcpass=$(cat ${secretsDir}/bitcoin-rpcpassword-public)"
${optionalString (cfg.getPublicAddressCmd != "") ''
echo "externalip=$(${cfg.getPublicAddressCmd})"
''}
} >> '${cfg.dataDir}/lnd.conf'
lnd: use `lndinit` for wallet creation
2022-03-29 19:48:57 +00:00
if [[ ! -f ${networkDir}/wallet.db ]]; then
mnemonic='${cfg.dataDir}/lnd-seed-mnemonic'
if [[ ! -f "$mnemonic" ]]; then
echo "Create lnd seed"
(umask u=r,go=; ${lndinit} gen-seed > "$mnemonic")
fi
echo "Create lnd wallet"
${lndinit} -v init-wallet \
--file.seed="$mnemonic" \
--file.wallet-password='${secretsDir}/lnd-wallet-password' \
--init-file.output-wallet-dir='${cfg.networkDir}'
fi
Add LND support
2019-08-05 08:44:38 +00:00
'';
rename nix-bitcoin-services.nix -> lib.nix
2021-02-03 21:44:41 +00:00
serviceConfig = nbLib.defaultHardening // {
lnd: improve service initialization - Use systemd startup notification. - Use new option `--wallet-unlock-password-file` instead of manual unlocking.
2022-01-14 14:32:08 +00:00
Type = "notify";
lnd: generate custom macaroons Create new `macaroon` option that allows any module to place its own custom macaroon in the lnd RuntimeDirectory `/run/lnd`.
2020-08-26 08:22:23 +00:00
RuntimeDirectory = "lnd"; # Only used to store custom macaroons
RuntimeDirectoryMode = "711";
lnd: improve service initialization - Use systemd startup notification. - Use new option `--wallet-unlock-password-file` instead of manual unlocking.
2022-01-14 14:32:08 +00:00
ExecStart = ''
${cfg.package}/bin/lnd \
--configfile="${cfg.dataDir}/lnd.conf" \
lnd: use `lndinit` for wallet creation
2022-03-29 19:48:57 +00:00
--wallet-unlock-password-file="${secretsDir}/lnd-wallet-password"
lnd: improve service initialization - Use systemd startup notification. - Use new option `--wallet-unlock-password-file` instead of manual unlocking.
2022-01-14 14:32:08 +00:00
'';
lnd: add user & group options
2021-02-16 16:50:39 +00:00
User = cfg.user;
add lnd TimoutSec
2021-10-12 19:56:15 +00:00
TimeoutSec = "15min";
Add LND support
2019-08-05 08:44:38 +00:00
Restart = "on-failure";
RestartSec = "10s";
services: set systemd list options as list values This makes our list definitions mergeable with custom list values set by users. Previously, a module error ("value is a string while a list was expected") was thrown instead. This commit was partly auto-generated with this script: #!/usr/bin/env ruby Dir["**/*.nix"].each do |file| src = File.read(file) fixed = src.gsub(/ReadWritePaths *= *(.*?);/) do "ReadWritePaths = [ #{$1} ];" end File.write(file, fixed) if fixed != src end
2022-05-07 18:34:21 +00:00
ReadWritePaths = [ cfg.dataDir ];
lnd: add option for configuring REST port
2020-06-02 13:20:04 +00:00
ExecStartPost = let
treewide: curl: exit with error status on HTTP errors This makes scripts fail early on request errors. Previously, curl exited with status 0 when enountering HTTP error status codes. `-fsS` equals `--fail --silent --show-error`.
2022-05-17 11:18:38 +00:00
curl = "${pkgs.curl}/bin/curl -fsS --cacert ${cfg.certPath}";
services: support 0.0.0.0/:: in `address` options Previously, client services didn't decode these special INADDR_ANY addresses and failed to connect.
2021-10-01 09:51:57 +00:00
restUrl = "https://${nbLib.addressWithPort cfg.restAddress cfg.restPort}/v1";
lnd: use `lndinit` for wallet creation
2022-03-29 19:48:57 +00:00
in
lnd: improve service initialization - Use systemd startup notification. - Use new option `--wallet-unlock-password-file` instead of manual unlocking.
2022-01-14 14:32:08 +00:00
# Setting macaroon permissions for other users needs root permissions
lnd: use `lndinit` for wallet creation
2022-03-29 19:48:57 +00:00
nbLib.rootScript "lnd-create-macaroons" ''
lnd: generate custom macaroons Create new `macaroon` option that allows any module to place its own custom macaroon in the lnd RuntimeDirectory `/run/lnd`.
2020-08-26 08:22:23 +00:00
umask ug=r,o=
${lib.concatMapStrings (macaroon: ''
echo "Create custom macaroon ${macaroon}"
macaroonPath="$RUNTIME_DIRECTORY/${macaroon}.macaroon"
lnd: show curl error messages
2021-03-16 11:45:22 +00:00
${curl} \
lnd: add regtest support
2020-10-16 15:43:07 +00:00
-H "Grpc-Metadata-macaroon: $(${pkgs.xxd}/bin/xxd -ps -u -c 99999 '${networkDir}/admin.macaroon')" \
lnd: generate custom macaroons Create new `macaroon` option that allows any module to place its own custom macaroon in the lnd RuntimeDirectory `/run/lnd`.
2020-08-26 08:22:23 +00:00
-X POST \
-d '{"permissions":[${cfg.macaroons.${macaroon}.permissions}]}' \
netns-lnd: allow RPC access from main netns
2020-10-29 20:20:30 +00:00
${restUrl}/macaroon |\
lnd: generate custom macaroons Create new `macaroon` option that allows any module to place its own custom macaroon in the lnd RuntimeDirectory `/run/lnd`.
2020-08-26 08:22:23 +00:00
${pkgs.jq}/bin/jq -c '.macaroon' | ${pkgs.xxd}/bin/xxd -p -r > "$macaroonPath"
chown ${cfg.macaroons.${macaroon}.user}: "$macaroonPath"
'') (attrNames cfg.macaroons)}
lnd: use `lndinit` for wallet creation
2022-03-29 19:48:57 +00:00
'';
services: add `tor.*` options Split `enforceTor` into `tor.proxy` and `tor.enforce`. By enabling `tor.proxy` without `tor.enforce`, a service can accept incoming clearnet connections. E.g., this allows setting up a Tor-proxied bitcoind node that accepts RPC connections from LAN.
2021-11-28 20:24:49 +00:00
} // nbLib.allowedIPAddresses cfg.tor.enforce;
Add LND support
2019-08-05 08:44:38 +00:00
};
extract operator module
2020-09-28 11:09:03 +00:00
lnd: add user & group options
2021-02-16 16:50:39 +00:00
users.users.${cfg.user} = {
services: set isSystemUser for service users 'isSystemUser' has to be explicitly set in NixOS 21.05. Previously, it was the implicit default.
2021-08-04 22:48:59 +00:00
isSystemUser = true;
lnd: add user & group options
2021-02-16 16:50:39 +00:00
group = cfg.group;
bitcoind: rename group bitcoinrpc -> bitcoinrpc-public This makes it clear that services with this group can only use public RPC calls.
2021-02-18 10:42:21 +00:00
extraGroups = [ "bitcoinrpc-public" ];
Remove bitcoin, clightning, electrs, liquid user home directory
2020-04-19 12:44:03 +00:00
home = cfg.dataDir; # lnd creates .lnd dir in HOME
lnd, nanopos: move user and group definitions to the bottom This is the default service formatting style in nixpkgs.
2020-01-12 19:52:37 +00:00
};
lnd: add user & group options
2021-02-16 16:50:39 +00:00
users.groups.${cfg.group} = {};
extract operator module
2020-09-28 11:09:03 +00:00
nix-bitcoin.operator = {
lnd: add user & group options
2021-02-16 16:50:39 +00:00
groups = [ cfg.group ];
allowRunAsUsers = [ cfg.user ];
extract operator module
2020-09-28 11:09:03 +00:00
};
simplify secrets file format Each secret file to be deployed is now backed by one local file. This simplifies 'setup-secrets' and the secret definitions. Also, with the old format it was not possible to add new secrets to secrets.nix in a simple way. Old secrets are automatically converted to the new format when running nix-shell. Using the new option 'nix-bitcoin.secrets', secrets are now directly defined by the services that use them.
2020-01-12 19:52:38 +00:00
nix-bitcoin.secrets = {
lnd: add user & group options
2021-02-16 16:50:39 +00:00
lnd-wallet-password.user = cfg.user;
lnd-key.user = cfg.user;
lnd-cert.user = cfg.user;
secrets: allow extending generate-secrets `generate-secrets` is no longer a monolithic script. Instead, it's composed of the values of option `nix-bitcoin.generateSecretsCmds`. This has the following advantages: - generate-secrets is now extensible by users - Only secrets of enabled services are generated - RPC IPs in the `lnd` and `loop` certs are no longer hardcoded. Secrets are no longer automatically generated when entering nix-shell. Instead, they are generated before deployment (via `krops-deploy`) because secrets generation is now dependant on the node configuration.
2021-09-08 15:01:18 +00:00
lnd-cert.permissions = "444"; # world readable
simplify secrets file format Each secret file to be deployed is now backed by one local file. This simplifies 'setup-secrets' and the secret definitions. Also, with the old format it was not possible to add new secrets to secrets.nix in a simple way. Old secrets are automatically converted to the new format when running nix-shell. Using the new option 'nix-bitcoin.secrets', secrets are now directly defined by the services that use them.
2020-01-12 19:52:38 +00:00
};
secrets: allow extending generate-secrets `generate-secrets` is no longer a monolithic script. Instead, it's composed of the values of option `nix-bitcoin.generateSecretsCmds`. This has the following advantages: - generate-secrets is now extensible by users - Only secrets of enabled services are generated - RPC IPs in the `lnd` and `loop` certs are no longer hardcoded. Secrets are no longer automatically generated when entering nix-shell. Instead, they are generated before deployment (via `krops-deploy`) because secrets generation is now dependant on the node configuration.
2021-09-08 15:01:18 +00:00
# Advantages of manually pre-generating certs:
# - Reduces dynamic state
# - Enables deployment of a mesh of server plus client nodes with predefined certs
nix-bitcoin.generateSecretsCmds.lnd = ''
makePasswordSecret lnd-wallet-password
makeCert lnd '${optionalString (cfg.rpcAddress != "localhost") "IP:${cfg.rpcAddress}"}'
'';
Add LND support
2019-08-05 08:44:38 +00:00
};
}
Reference in New Issue Copy Permalink