heierbtc/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
b110e2aea6
nix-bitcoin/modules/btcpayserver.nix

280 lines
11 KiB
Nix
Raw Normal View History

nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
{ config, lib, pkgs, ... }:
with lib;
let
options.services = {
btcpayserver = {
pkgs: add `meta` attr Also add more detailed `enable` option descriptions.
2021-12-14 18:51:23 +00:00
enable = mkEnableOption "btcpayserver, a self-hosted Bitcoin payment processor";
btcpayserver: add consistent address options
2021-01-14 12:24:05 +00:00
address = mkOption {
type = types.str;
default = "127.0.0.1";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "Address to listen on.";
btcpayserver: add consistent address options
2021-01-14 12:24:05 +00:00
};
port = mkOption {
type = types.port;
default = 23000;
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "Port to listen on.";
btcpayserver: add consistent address options
2021-01-14 12:24:05 +00:00
};
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
package = mkOption {
type = types.package;
btcpayserver: add L-BTC support
2021-07-13 14:03:08 +00:00
default = if cfg.btcpayserver.lbtc then
btcpayserver: expand `nbPkgs` in option defaults Required by commit `nix-bitcoin.nix: add `defaultText` (automatic)`.
2021-12-08 03:07:26 +00:00
config.nix-bitcoin.pkgs.btcpayserver.override { altcoinSupport = true; }
btcpayserver: add L-BTC support
2021-07-13 14:03:08 +00:00
else
btcpayserver: expand `nbPkgs` in option defaults Required by commit `nix-bitcoin.nix: add `defaultText` (automatic)`.
2021-12-08 03:07:26 +00:00
config.nix-bitcoin.pkgs.btcpayserver;
nix-bitcoin.nix: add `defaultText` (automatic) This enables generating module option documentation. This commit was genereated by running the following script inside the repo root dir: def add_default_text(file) src = File.read(file) src2 = src.gsub(/( = mkOption\s+\{[^{]*?)(\n\s+default = )(.*?);$(.*?\})/m) do |str| pre, defaultVar, default, post = Regexp.last_match.captures replacement = if !post.include?('defaultText =') if default =~ /\bpkgs\b/ defaultText = default.lines.length == 1 ? default : "(See source)" "#{pre}#{defaultVar}#{default};#{defaultVar.sub('default', 'defaultText')}#{defaultText.inspect};#{post}" end end replacement or str end File.write(file, src2) if src2 != src end Dir["modules/**/*.nix"].each do |f| next if File.basename(f) == "nix-bitcoin.nix" add_default_text f end
2021-12-08 03:07:28 +00:00
defaultText = "(See source)";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The package providing btcpayserver binaries.";
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
};
dataDir = mkOption {
type = types.path;
default = "/var/lib/btcpayserver";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The data directory for btcpayserver.";
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
};
lightningBackend = mkOption {
type = types.nullOr (types.enum [ "clightning" "lnd" ]);
default = null;
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The lightning node implementation to use.";
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
};
btcpayserver: add L-BTC support
2021-07-13 14:03:08 +00:00
lbtc = mkOption {
type = types.bool;
default = false;
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "Enable liquid support in btcpayserver.";
btcpayserver: add L-BTC support
2021-07-13 14:03:08 +00:00
};
btcpayserver: add rootpath option
2020-12-30 10:56:51 +00:00
rootpath = mkOption {
type = types.nullOr types.str;
default = null;
example = "btcpayserver";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The prefix for root-relative btcpayserver URLs.";
btcpayserver: add rootpath option
2020-12-30 10:56:51 +00:00
};
modules: move user/group options to bottom These are insignificant, generic options; place them above readonly options. We already do this in other services. Also move user/group config to bottom in spark-wallet.
2021-09-13 11:40:48 +00:00
user = mkOption {
type = types.str;
default = "btcpayserver";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The user as which to run btcpayserver.";
modules: move user/group options to bottom These are insignificant, generic options; place them above readonly options. We already do this in other services. Also move user/group config to bottom in spark-wallet.
2021-09-13 11:40:48 +00:00
};
group = mkOption {
type = types.str;
default = cfg.btcpayserver.user;
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The group as which to run btcpayserver.";
modules: move user/group options to bottom These are insignificant, generic options; place them above readonly options. We already do this in other services. Also move user/group config to bottom in spark-wallet.
2021-09-13 11:40:48 +00:00
};
services: add `tor.*` options Split `enforceTor` into `tor.proxy` and `tor.enforce`. By enabling `tor.proxy` without `tor.enforce`, a service can accept incoming clearnet connections. E.g., this allows setting up a Tor-proxied bitcoind node that accepts RPC connections from LAN.
2021-11-28 20:24:49 +00:00
tor.enforce = nbLib.tor.enforce;
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
};
btcpayserver: move nbxplorer options to bottom These are largely irrelevant to end users.
2021-11-26 14:13:32 +00:00
nbxplorer = {
enable = mkOption {
# This option is only used by netns-isolation
internal = true;
default = cfg.btcpayserver.enable;
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc ''
btcpayserver: move nbxplorer options to bottom These are largely irrelevant to end users.
2021-11-26 14:13:32 +00:00
nbxplorer is always enabled when btcpayserver is enabled.
'';
};
package = mkOption {
type = types.package;
btcpayserver: expand `nbPkgs` in option defaults Required by commit `nix-bitcoin.nix: add `defaultText` (automatic)`.
2021-12-08 03:07:26 +00:00
default = config.nix-bitcoin.pkgs.nbxplorer;
nix-bitcoin.nix: add `defaultText` (automatic) This enables generating module option documentation. This commit was genereated by running the following script inside the repo root dir: def add_default_text(file) src = File.read(file) src2 = src.gsub(/( = mkOption\s+\{[^{]*?)(\n\s+default = )(.*?);$(.*?\})/m) do |str| pre, defaultVar, default, post = Regexp.last_match.captures replacement = if !post.include?('defaultText =') if default =~ /\bpkgs\b/ defaultText = default.lines.length == 1 ? default : "(See source)" "#{pre}#{defaultVar}#{default};#{defaultVar.sub('default', 'defaultText')}#{defaultText.inspect};#{post}" end end replacement or str end File.write(file, src2) if src2 != src end Dir["modules/**/*.nix"].each do |f| next if File.basename(f) == "nix-bitcoin.nix" add_default_text f end
2021-12-08 03:07:28 +00:00
defaultText = "config.nix-bitcoin.pkgs.nbxplorer";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The package providing nbxplorer binaries.";
btcpayserver: move nbxplorer options to bottom These are largely irrelevant to end users.
2021-11-26 14:13:32 +00:00
};
address = mkOption {
type = types.str;
default = "127.0.0.1";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "Address to listen on.";
btcpayserver: move nbxplorer options to bottom These are largely irrelevant to end users.
2021-11-26 14:13:32 +00:00
};
port = mkOption {
type = types.port;
default = 24444;
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "Port to listen on.";
btcpayserver: move nbxplorer options to bottom These are largely irrelevant to end users.
2021-11-26 14:13:32 +00:00
};
dataDir = mkOption {
type = types.path;
default = "/var/lib/nbxplorer";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The data directory for nbxplorer.";
btcpayserver: move nbxplorer options to bottom These are largely irrelevant to end users.
2021-11-26 14:13:32 +00:00
};
user = mkOption {
type = types.str;
default = "nbxplorer";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The user as which to run nbxplorer.";
btcpayserver: move nbxplorer options to bottom These are largely irrelevant to end users.
2021-11-26 14:13:32 +00:00
};
group = mkOption {
type = types.str;
default = cfg.nbxplorer.user;
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The group as which to run nbxplorer.";
btcpayserver: move nbxplorer options to bottom These are largely irrelevant to end users.
2021-11-26 14:13:32 +00:00
};
services: add `tor.*` options Split `enforceTor` into `tor.proxy` and `tor.enforce`. By enabling `tor.proxy` without `tor.enforce`, a service can accept incoming clearnet connections. E.g., this allows setting up a Tor-proxied bitcoind node that accepts RPC connections from LAN.
2021-11-28 20:24:49 +00:00
tor.enforce = nbLib.tor.enforce;
btcpayserver: move nbxplorer options to bottom These are largely irrelevant to end users.
2021-11-26 14:13:32 +00:00
};
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
};
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
cfg = config.services;
nbLib = config.nix-bitcoin.lib;
modules: use consistent service variables Benefits of adding top-level variables for used services: - Makes it obvious which other services are referenced by a service - Less code We already do this in many other places.
2021-09-13 11:40:49 +00:00
btcpayserver: minor improvements - Quote datadir - Extract liquidd service variable - Move btcpayserver below liquid in modules list because it depends on liquid
2021-10-01 09:51:56 +00:00
inherit (config.services) bitcoind liquidd;
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
in {
inherit options;
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
config = mkIf cfg.btcpayserver.enable {
nbxplorer: fix bitcoind, liquidd settings - Add nbxplorer to whitelists. This is recommended by the nbxplorer docs and guarantees that nbxplorer can always p2p-connect to bitcoind/liquidd. - Enable bitcoind/liquidd p2p servers via `listen`.
2021-10-01 09:51:58 +00:00
services.bitcoind = {
enable = true;
rpc.users.btcpayserver = {
passwordHMACFromFile = true;
rpcwhitelist = cfg.bitcoind.rpc.users.public.rpcwhitelist ++ [
"setban"
"generatetoaddress"
"getpeerinfo"
];
};
bitcoind, liquidd: add whitelisted socket This allows whitelisting local services without implicitly whitelisting all inbound onion connections, which would happen when setting bitcoind/liquidd option `whitelist=localhost`. Used by electrs and nbxplorer, which requires the unsafe `mempool` permission.
2021-10-29 15:56:57 +00:00
listenWhitelisted = true;
nbxplorer: fix bitcoind, liquidd settings - Add nbxplorer to whitelists. This is recommended by the nbxplorer docs and guarantees that nbxplorer can always p2p-connect to bitcoind/liquidd. - Enable bitcoind/liquidd p2p servers via `listen`.
2021-10-01 09:51:58 +00:00
};
services: auto-enable dependencies
2020-10-18 12:49:20 +00:00
services.clightning.enable = mkIf (cfg.btcpayserver.lightningBackend == "clightning") true;
minor improvements - README: add matrix room - examples/configuration.nix: explain why bitcoind is enabled by default - btcpayserver: group lnd service settings - clightning: Use public onion port only when the onion service is public This allows users to enable the onion service while announcing a non-onion public address. - netns-isolation: move `readOnly` attr to the top - tests: use mkDefault to allow for easier overriding - tests/btcpayserver: test web server response
2021-10-30 12:55:55 +00:00
services.lnd = mkIf (cfg.btcpayserver.lightningBackend == "lnd") {
enable = true;
macaroons.btcpayserver = {
inherit (cfg.btcpayserver) user;
permissions = ''{"entity":"info","action":"read"},{"entity":"onchain","action":"read"},{"entity":"offchain","action":"read"},{"entity":"address","action":"read"},{"entity":"message","action":"read"},{"entity":"peers","action":"read"},{"entity":"signer","action":"read"},{"entity":"invoices","action":"read"},{"entity":"invoices","action":"write"},{"entity":"address","action":"write"}'';
};
};
nbxplorer: fix bitcoind, liquidd settings - Add nbxplorer to whitelists. This is recommended by the nbxplorer docs and guarantees that nbxplorer can always p2p-connect to bitcoind/liquidd. - Enable bitcoind/liquidd p2p servers via `listen`.
2021-10-01 09:51:58 +00:00
services.liquidd = mkIf cfg.btcpayserver.lbtc {
enable = true;
bitcoind, liquidd: add whitelisted socket This allows whitelisting local services without implicitly whitelisting all inbound onion connections, which would happen when setting bitcoind/liquidd option `whitelist=localhost`. Used by electrs and nbxplorer, which requires the unsafe `mempool` permission.
2021-10-29 15:56:57 +00:00
listenWhitelisted = true;
services: use consistent layout Use the following order of definitions for all services: - assertions - configuration of other services - environment.systemPackages - tmpfiles - own service - users - secrets
2021-02-01 21:53:22 +00:00
};
btcpayserver: sqlite -> postgresql
2020-09-17 08:04:23 +00:00
services.postgresql = {
enable = true;
nbxplorer: use postgresql The former DBTrie backend has been deprecated.
2022-04-30 13:35:46 +00:00
ensureDatabases = [ "btcpaydb" "nbxplorer" ];
ensureUsers = [
btcpayserver: fix PostgreSQL 15 user permissions Since PostgreSQL 15, DB users need to be DB owners to be able to create tables. We can't use the new `ensureDBOwnerhip` NixOS option [1] to set this up, because it requires the PostgreSQL user name and the database name to be identical, which is not the case for btcpayserver. Instead, we manually issue a PostgreSQL admin statement similar to the one used by `ensureDBOwnerhip`. This method of setting up the user is also compatible with older PostgreSQL versions that come with older NixOS `system.stateVersion`s. [1] https://github.com/NixOS/nixpkgs/pull/266270
2023-12-02 22:26:51 +00:00
{ name = cfg.btcpayserver.user; }
{ name = cfg.nbxplorer.user; }
nbxplorer: use postgresql The former DBTrie backend has been deprecated.
2022-04-30 13:35:46 +00:00
];
btcpayserver: sqlite -> postgresql
2020-09-17 08:04:23 +00:00
};
btcpayserver: fix PostgreSQL 15 user permissions Since PostgreSQL 15, DB users need to be DB owners to be able to create tables. We can't use the new `ensureDBOwnerhip` NixOS option [1] to set this up, because it requires the PostgreSQL user name and the database name to be identical, which is not the case for btcpayserver. Instead, we manually issue a PostgreSQL admin statement similar to the one used by `ensureDBOwnerhip`. This method of setting up the user is also compatible with older PostgreSQL versions that come with older NixOS `system.stateVersion`s. [1] https://github.com/NixOS/nixpkgs/pull/266270
2023-12-02 22:26:51 +00:00
systemd.services.postgresql.postStart = lib.mkAfter ''
$PSQL -tAc '
ALTER DATABASE "btcpaydb" OWNER TO "${cfg.btcpayserver.user}";
ALTER DATABASE "nbxplorer" OWNER TO "${cfg.nbxplorer.user}";
'
'';
btcpayserver: sqlite -> postgresql
2020-09-17 08:04:23 +00:00
services: use consistent layout Use the following order of definitions for all services: - assertions - configuration of other services - environment.systemPackages - tmpfiles - own service - users - secrets
2021-02-01 21:53:22 +00:00
systemd.tmpfiles.rules = [
"d '${cfg.nbxplorer.dataDir}' 0770 ${cfg.nbxplorer.user} ${cfg.nbxplorer.group} - -"
"d '${cfg.btcpayserver.dataDir}' 0770 ${cfg.btcpayserver.user} ${cfg.btcpayserver.group} - -"
];
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
systemd.services.nbxplorer = let
configFile = builtins.toFile "config" ''
modules: use consistent service variables Benefits of adding top-level variables for used services: - Makes it obvious which other services are referenced by a service - Less code We already do this in many other places.
2021-09-13 11:40:49 +00:00
network=${bitcoind.network}
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
btcrpcuser=${cfg.bitcoind.rpc.users.btcpayserver.name}
services: support 0.0.0.0/:: in `address` options Previously, client services didn't decode these special INADDR_ANY addresses and failed to connect.
2021-10-01 09:51:57 +00:00
btcrpcurl=http://${nbLib.addressWithPort bitcoind.rpc.address cfg.bitcoind.rpc.port}
bitcoind, liquidd: add whitelisted socket This allows whitelisting local services without implicitly whitelisting all inbound onion connections, which would happen when setting bitcoind/liquidd option `whitelist=localhost`. Used by electrs and nbxplorer, which requires the unsafe `mempool` permission.
2021-10-29 15:56:57 +00:00
btcnodeendpoint=${nbLib.addressWithPort bitcoind.address bitcoind.whitelistedPort}
btcpayserver: add consistent address options
2021-01-14 12:24:05 +00:00
bind=${cfg.nbxplorer.address}
btcpayserver: add 'port' option
2020-10-16 15:43:11 +00:00
port=${toString cfg.nbxplorer.port}
btcpayserver: add L-BTC support
2021-07-13 14:03:08 +00:00
${optionalString cfg.btcpayserver.lbtc ''
chains=btc,lbtc
btcpayserver: minor improvements - Quote datadir - Extract liquidd service variable - Move btcpayserver below liquid in modules list because it depends on liquid
2021-10-01 09:51:56 +00:00
lbtcrpcuser=${liquidd.rpcuser}
services: support 0.0.0.0/:: in `address` options Previously, client services didn't decode these special INADDR_ANY addresses and failed to connect.
2021-10-01 09:51:57 +00:00
lbtcrpcurl=http://${nbLib.addressWithPort liquidd.rpc.address liquidd.rpc.port}
btcpayserver: fix liquidd whitelistedPort
2021-11-01 11:59:05 +00:00
lbtcnodeendpoint=${nbLib.addressWithPort liquidd.address liquidd.whitelistedPort}
btcpayserver: add L-BTC support
2021-07-13 14:03:08 +00:00
''}
nbxplorer: use postgresql The former DBTrie backend has been deprecated.
2022-04-30 13:35:46 +00:00
postgres=User ID=${cfg.nbxplorer.user};Host=/run/postgresql;Database=nbxplorer
automigrate=1
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
'';
liquidd: use systemd startup notification
2021-11-02 12:07:38 +00:00
in rec {
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
wantedBy = [ "multi-user.target" ];
nbxplorer: use postgresql The former DBTrie backend has been deprecated.
2022-04-30 13:35:46 +00:00
requires = [ "bitcoind.service" "postgresql.service" ] ++ optional cfg.btcpayserver.lbtc "liquidd.service";
treewide: ensure services are started after secrets setup Now all services that access secrets only run after the secrets setup has finished. Previously, we assumed that the systemd `after` dependency is transitive, i.e. that adding an `after = [ "bitcoind.service" ]` to a service implicitly pulled in the `after` dependency to `nix-bitcoin-secrets.target` (which is defined for `bitcoind`). This is not the case. Services could start before secrets setup had finished, leading to service failure.
2023-10-03 11:00:23 +00:00
after = requires ++ [ "nix-bitcoin-secrets.target" ];
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
preStart = ''
services: improve config file setup - btcpayserver, nbxplorer: Add quotes to the dataDir arg. (dataDir can contain spaces.) - clightning, liquidd: use 'install'
2021-02-01 21:53:21 +00:00
install -m 600 ${configFile} '${cfg.nbxplorer.dataDir}/settings.config'
btcpayserver: add L-BTC support
2021-07-13 14:03:08 +00:00
{
echo "btcrpcpassword=$(cat ${config.nix-bitcoin.secretsDir}/bitcoin-rpcpassword-btcpayserver)"
${optionalString cfg.btcpayserver.lbtc ''
echo "lbtcrpcpassword=$(cat ${config.nix-bitcoin.secretsDir}/liquid-rpcpassword)"
''}
} >> '${cfg.nbxplorer.dataDir}/settings.config'
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
'';
rename nix-bitcoin-services.nix -> lib.nix
2021-02-03 21:44:41 +00:00
serviceConfig = nbLib.defaultHardening // {
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
ExecStart = ''
${cfg.nbxplorer.package}/bin/nbxplorer --conf=${cfg.nbxplorer.dataDir}/settings.config \
--datadir=${cfg.nbxplorer.dataDir}
'';
User = cfg.nbxplorer.user;
Restart = "on-failure";
RestartSec = "10s";
services: set systemd list options as list values This makes our list definitions mergeable with custom list values set by users. Previously, a module error ("value is a string while a list was expected") was thrown instead. This commit was partly auto-generated with this script: #!/usr/bin/env ruby Dir["**/*.nix"].each do |file| src = File.read(file) fixed = src.gsub(/ReadWritePaths *= *(.*?);/) do "ReadWritePaths = [ #{$1} ];" end File.write(file, fixed) if fixed != src end
2022-05-07 18:34:21 +00:00
ReadWritePaths = [ cfg.nbxplorer.dataDir ];
treewide: use bool literals for systemd Run this from the repo root to check that there are no more remaining bool strings: grep -P '"true"|"false"' -r --exclude-dir=.git
2023-01-20 12:45:07 +00:00
MemoryDenyWriteExecute = false;
services: add `tor.*` options Split `enforceTor` into `tor.proxy` and `tor.enforce`. By enabling `tor.proxy` without `tor.enforce`, a service can accept incoming clearnet connections. E.g., this allows setting up a Tor-proxied bitcoind node that accepts RPC connections from LAN.
2021-11-28 20:24:49 +00:00
} // nbLib.allowedIPAddresses cfg.nbxplorer.tor.enforce;
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
};
systemd.services.btcpayserver = let
minor improvements - README: - Add RTL - examples/configuration.nix: - Fix comment - btcpayserver.nix: - Use nbLib.addressWithPort - Embed optionalString like the other optionalStrings - clboss.nix: - Improve description - clightning.nix: - Option `extraConfig`: Add example, improve description. - Disable `log-timestamps`. Timestamps are already logged via journald. - Simplify `preStart` script - electrs.nix: - Use `port` description wording like in other services.
2021-11-26 14:13:29 +00:00
nbExplorerUrl = "http://${nbLib.addressWithPort cfg.nbxplorer.address cfg.nbxplorer.port}/";
modules: use consistent service variables Benefits of adding top-level variables for used services: - Makes it obvious which other services are referenced by a service - Less code We already do this in many other places.
2021-09-13 11:40:49 +00:00
nbExplorerCookie = "${cfg.nbxplorer.dataDir}/${bitcoind.makeNetworkName "Main" "RegTest"}/.cookie";
btcpayserver: use new option `certfilepath` for lnd
2022-10-24 10:06:45 +00:00
configFile = builtins.toFile "btcpayserver-config" (''
modules: use consistent service variables Benefits of adding top-level variables for used services: - Makes it obvious which other services are referenced by a service - Less code We already do this in many other places.
2021-09-13 11:40:49 +00:00
network=${bitcoind.network}
btcpayserver: reorder config settings Move 'bind' and 'port' next to each other and to the top.
2021-02-01 21:53:01 +00:00
bind=${cfg.btcpayserver.address}
port=${toString cfg.btcpayserver.port}
services: use new 'tor' options
2021-08-04 22:49:00 +00:00
socksendpoint=${config.nix-bitcoin.torClientAddressWithPort}
btcpayserver: add L-BTC support
2021-07-13 14:03:08 +00:00
btcexplorerurl=${nbExplorerUrl}
btcexplorercookiefile=${nbExplorerCookie}
btcpayserver: reorder config settings Move 'bind' and 'port' next to each other and to the top.
2021-02-01 21:53:01 +00:00
postgres=User ID=${cfg.btcpayserver.user};Host=/run/postgresql;Database=btcpaydb
minor improvements - README: - Add RTL - examples/configuration.nix: - Fix comment - btcpayserver.nix: - Use nbLib.addressWithPort - Embed optionalString like the other optionalStrings - clboss.nix: - Improve description - clightning.nix: - Option `extraConfig`: Add example, improve description. - Disable `log-timestamps`. Timestamps are already logged via journald. - Simplify `preStart` script - electrs.nix: - Use `port` description wording like in other services.
2021-11-26 14:13:29 +00:00
'' + optionalString (cfg.btcpayserver.rootpath != null) ''
rootpath=${cfg.btcpayserver.rootpath}
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
'' + optionalString (cfg.btcpayserver.lightningBackend == "clightning") ''
Fix cln rpc path for btcpayserver on regtest
2022-06-03 21:39:36 +00:00
btclightning=type=clightning;server=unix:///${cfg.clightning.dataDir}/${bitcoind.makeNetworkName "bitcoin" "regtest"}/lightning-rpc
btcpayserver: use new option `certfilepath` for lnd
2022-10-24 10:06:45 +00:00
'' + optionalString (cfg.btcpayserver.lightningBackend == "lnd")
(
"btclightning=type=lnd-rest;" +
"server=https://${cfg.lnd.restAddress}:${toString cfg.lnd.restPort}/;" +
"macaroonfilepath=/run/lnd/btcpayserver.macaroon;" +
"certfilepath=${config.services.lnd.certPath}" +
"\n"
)
+ optionalString cfg.btcpayserver.lbtc ''
btcpayserver: add L-BTC support
2021-07-13 14:03:08 +00:00
chains=btc,lbtc
lbtcexplorerurl=${nbExplorerUrl}
lbtcexplorercookiefile=${nbExplorerCookie}
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
'');
in let self = {
wantedBy = [ "multi-user.target" ];
btcpayserver: add missing systemd postgresql dependency btcpayserver fails if it starts before postgresql.
2021-02-01 21:53:00 +00:00
requires = [ "nbxplorer.service" "postgresql.service" ]
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
++ optional (cfg.btcpayserver.lightningBackend != null) "${cfg.btcpayserver.lightningBackend}.service";
after = self.requires;
rename nix-bitcoin-services.nix -> lib.nix
2021-02-03 21:44:41 +00:00
serviceConfig = nbLib.defaultHardening // {
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
ExecStart = ''
btcpayserver: use new option `certfilepath` for lnd
2022-10-24 10:06:45 +00:00
${cfg.btcpayserver.package}/bin/btcpayserver --conf=${configFile} \
btcpayserver: minor improvements - Quote datadir - Extract liquidd service variable - Move btcpayserver below liquid in modules list because it depends on liquid
2021-10-01 09:51:56 +00:00
--datadir='${cfg.btcpayserver.dataDir}'
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
'';
User = cfg.btcpayserver.user;
btcpayserver: support restarting from the web interface This is required since version 1.7.4. See: https://github.com/btcpayserver/btcpayserver/releases/tag/v1.7.4
2023-02-27 12:17:09 +00:00
# Also restart after the program has exited successfully.
# This is required to support restarting from the web interface after
# interactive plugin installation.
# Restart rate limiting is implemented via the `startLimit*` options below.
Restart = "always";
services: set systemd list options as list values This makes our list definitions mergeable with custom list values set by users. Previously, a module error ("value is a string while a list was expected") was thrown instead. This commit was partly auto-generated with this script: #!/usr/bin/env ruby Dir["**/*.nix"].each do |file| src = File.read(file) fixed = src.gsub(/ReadWritePaths *= *(.*?);/) do "ReadWritePaths = [ #{$1} ];" end File.write(file, fixed) if fixed != src end
2022-05-07 18:34:21 +00:00
ReadWritePaths = [ cfg.btcpayserver.dataDir ];
treewide: use bool literals for systemd Run this from the repo root to check that there are no more remaining bool strings: grep -P '"true"|"false"' -r --exclude-dir=.git
2023-01-20 12:45:07 +00:00
MemoryDenyWriteExecute = false;
services: add `tor.*` options Split `enforceTor` into `tor.proxy` and `tor.enforce`. By enabling `tor.proxy` without `tor.enforce`, a service can accept incoming clearnet connections. E.g., this allows setting up a Tor-proxied bitcoind node that accepts RPC connections from LAN.
2021-11-28 20:24:49 +00:00
} // nbLib.allowedIPAddresses cfg.btcpayserver.tor.enforce;
btcpayserver: support restarting from the web interface This is required since version 1.7.4. See: https://github.com/btcpayserver/btcpayserver/releases/tag/v1.7.4
2023-02-27 12:17:09 +00:00
startLimitIntervalSec = 30;
startLimitBurst = 10;
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
}; in self;
users.users.${cfg.nbxplorer.user} = {
services: set isSystemUser for service users 'isSystemUser' has to be explicitly set in NixOS 21.05. Previously, it was the implicit default.
2021-08-04 22:48:59 +00:00
isSystemUser = true;
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
group = cfg.nbxplorer.group;
btcpayserver: add L-BTC support
2021-07-13 14:03:08 +00:00
extraGroups = [ "bitcoinrpc-public" ]
btcpayserver: minor improvements - Quote datadir - Extract liquidd service variable - Move btcpayserver below liquid in modules list because it depends on liquid
2021-10-01 09:51:56 +00:00
++ optional cfg.btcpayserver.lbtc liquidd.group;
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
home = cfg.nbxplorer.dataDir;
};
users.groups.${cfg.nbxplorer.group} = {};
users.users.${cfg.btcpayserver.user} = {
services: set isSystemUser for service users 'isSystemUser' has to be explicitly set in NixOS 21.05. Previously, it was the implicit default.
2021-08-04 22:48:59 +00:00
isSystemUser = true;
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
group = cfg.btcpayserver.group;
modules: use user & group options I've tried my best to locate all uses of hardcoded usernames, but its not guaranteed that all have been found/fixed.
2021-02-16 16:52:45 +00:00
extraGroups = [ cfg.nbxplorer.group ]
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
++ optional (cfg.btcpayserver.lightningBackend == "clightning") cfg.clightning.user;
home = cfg.btcpayserver.dataDir;
};
users.groups.${cfg.btcpayserver.group} = {};
services: use consistent layout Use the following order of definitions for all services: - assertions - configuration of other services - environment.systemPackages - tmpfiles - own service - users - secrets
2021-02-01 21:53:22 +00:00
nix-bitcoin.secrets = {
bitcoin-rpcpassword-btcpayserver = {
modules: use user & group options I've tried my best to locate all uses of hardcoded usernames, but its not guaranteed that all have been found/fixed.
2021-02-16 16:52:45 +00:00
user = cfg.bitcoind.user;
group = cfg.nbxplorer.group;
services: use consistent layout Use the following order of definitions for all services: - assertions - configuration of other services - environment.systemPackages - tmpfiles - own service - users - secrets
2021-02-01 21:53:22 +00:00
};
modules: use user & group options I've tried my best to locate all uses of hardcoded usernames, but its not guaranteed that all have been found/fixed.
2021-02-16 16:52:45 +00:00
bitcoin-HMAC-btcpayserver.user = cfg.bitcoind.user;
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
};
secrets: allow extending generate-secrets `generate-secrets` is no longer a monolithic script. Instead, it's composed of the values of option `nix-bitcoin.generateSecretsCmds`. This has the following advantages: - generate-secrets is now extensible by users - Only secrets of enabled services are generated - RPC IPs in the `lnd` and `loop` certs are no longer hardcoded. Secrets are no longer automatically generated when entering nix-shell. Instead, they are generated before deployment (via `krops-deploy`) because secrets generation is now dependant on the node configuration.
2021-09-08 15:01:18 +00:00
nix-bitcoin.generateSecretsCmds.btcpayserver = ''
makeBitcoinRPCPassword btcpayserver
'';
nbxplorer/btcpayserver: add module
2020-08-12 14:47:56 +00:00
};
}
Reference in New Issue Copy Permalink