heierbtc/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
b110e2aea6
nix-bitcoin/modules/joinmarket-ob-watcher.nix

120 lines
3.6 KiB
Nix
Raw Normal View History

joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
{ config, lib, pkgs, ... }:
with lib;
let
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
options.services.joinmarket-ob-watcher = {
enable = mkEnableOption "JoinMarket orderbook watcher";
address = mkOption {
type = types.str;
default = "127.0.0.1";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "HTTP server address.";
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
};
port = mkOption {
type = types.port;
default = 62601;
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "HTTP server port.";
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
};
dataDir = mkOption {
readOnly = true;
default = "/var/lib/joinmarket-ob-watcher";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The data directory for JoinMarket orderbook watcher.";
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
};
user = mkOption {
type = types.str;
default = "joinmarket-ob-watcher";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The user as which to run JoinMarket.";
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
};
group = mkOption {
type = types.str;
default = cfg.user;
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The group as which to run JoinMarket.";
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
};
services: add `tor.*` options Split `enforceTor` into `tor.proxy` and `tor.enforce`. By enabling `tor.proxy` without `tor.enforce`, a service can accept incoming clearnet connections. E.g., this allows setting up a Tor-proxied bitcoind node that accepts RPC connections from LAN.
2021-11-28 20:24:49 +00:00
# This option is only used by netns-isolation.
# Tor is always enabled.
tor.enforce = nbLib.tor.enforce;
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
};
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
cfg = config.services.joinmarket-ob-watcher;
rename nix-bitcoin-services.nix -> lib.nix
2021-02-03 21:44:41 +00:00
nbLib = config.nix-bitcoin.lib;
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
nbPkgs = config.nix-bitcoin.pkgs;
joinmarket-ob-watcher: extra permissions & functionality for fidelity bonds
2021-08-25 09:57:09 +00:00
secretsDir = config.nix-bitcoin.secretsDir;
services: use new 'tor' options
2021-08-04 22:49:00 +00:00
joinmarket: share IRC server definitions between jm and ob-watcher Also add server name comments.
2021-10-13 12:44:36 +00:00
inherit (config.services) bitcoind joinmarket;
services: use new 'tor' options
2021-08-04 22:49:00 +00:00
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
configFile = builtins.toFile "config" ''
[BLOCKCHAIN]
joinmarket-ob-watcher: extra permissions & functionality for fidelity bonds
2021-08-25 09:57:09 +00:00
blockchain_source = bitcoin-rpc
network = ${bitcoind.network}
rpc_host = ${bitcoind.rpc.address}
rpc_port = ${toString bitcoind.rpc.port}
rpc_user = ${bitcoind.rpc.users.joinmarket-ob-watcher.name}
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
joinmarket: 0.9.5 -> 0.9.6
2022-05-27 09:06:14 +00:00
${joinmarket.messagingConfig}
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
'';
in {
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
inherit options;
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
config = mkIf cfg.enable {
joinmarket-ob-watcher: extra permissions & functionality for fidelity bonds
2021-08-25 09:57:09 +00:00
services.bitcoind.rpc.users.joinmarket-ob-watcher = {
passwordHMACFromFile = true;
rpcwhitelist = bitcoind.rpc.users.public.rpcwhitelist ++ [
"listwallets"
];
};
services: use consistent layout Use the following order of definitions for all services: - assertions - configuration of other services - environment.systemPackages - tmpfiles - own service - users - secrets
2021-02-01 21:53:22 +00:00
# Joinmarket is Tor-only
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
services.tor = {
enable = true;
client.enable = true;
};
joinmarket-ob-watcher: extra permissions & functionality for fidelity bonds
2021-08-25 09:57:09 +00:00
systemd.tmpfiles.rules = [
"d '${cfg.dataDir}' 0770 ${cfg.user} ${cfg.group} - -"
];
joinmarket-ob-watcher: require nix-bitcoin.service This caused failures in the tests which were ignored because ob-watcher was expected to fail for other reasons.
2021-10-06 09:27:47 +00:00
systemd.services.joinmarket-ob-watcher = rec {
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
wantedBy = [ "multi-user.target" ];
joinmarket-ob-watcher: require nix-bitcoin.service This caused failures in the tests which were ignored because ob-watcher was expected to fail for other reasons.
2021-10-06 09:27:47 +00:00
requires = [ "tor.service" "bitcoind.service" ];
treewide: ensure services are started after secrets setup Now all services that access secrets only run after the secrets setup has finished. Previously, we assumed that the systemd `after` dependency is transitive, i.e. that adding an `after = [ "bitcoind.service" ]` to a service implicitly pulled in the `after` dependency to `nix-bitcoin-secrets.target` (which is defined for `bitcoind`). This is not the case. Services could start before secrets setup had finished, leading to service failure.
2023-10-03 11:00:23 +00:00
after = requires ++ [ "nix-bitcoin-secrets.target" ];
joinmarket-ob-watcher: use DynamicUser DynamicUser simplifies services that don't need a persistent uid/gid, like joinmarket-ob-watcher. For existing installations the data dir migration to dynamic users is automatically handled by systemd.
2021-02-01 21:53:19 +00:00
# The service writes to HOME/.config/matplotlib
environment.HOME = cfg.dataDir;
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
preStart = ''
joinmarket-ob-watcher: extra permissions & functionality for fidelity bonds
2021-08-25 09:57:09 +00:00
{
cat ${configFile}
echo
echo '[BLOCKCHAIN]'
echo "rpc_password = $(cat ${secretsDir}/bitcoin-rpcpassword-joinmarket-ob-watcher)"
} > '${cfg.dataDir}/joinmarket.cfg'
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
'';
rename nix-bitcoin-services.nix -> lib.nix
2021-02-03 21:44:41 +00:00
serviceConfig = nbLib.defaultHardening // rec {
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
StateDirectory = "joinmarket-ob-watcher";
joinmarket-ob-watcher: use consistent mode formatting Remove redundant leading zero.
2021-08-15 09:28:37 +00:00
StateDirectoryMode = "770";
treewide: remove unneeded string literals
2021-02-01 21:53:12 +00:00
WorkingDirectory = cfg.dataDir; # The service creates dir 'logs' in the working dir
joinmarket-ob-watcher: extra permissions & functionality for fidelity bonds
2021-08-25 09:57:09 +00:00
User = cfg.user;
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
ExecStart = ''
joinmarket-ob-watcher: move resource files to extra dir Don't clutter joinmarket/bin with ob-watcher resource files.
2021-08-12 13:29:19 +00:00
${nbPkgs.joinmarket}/bin/jm-ob-watcher --datadir=${cfg.dataDir} \
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
--host=${cfg.address} --port=${toString cfg.port}
'';
joinmarket-ob-watcher: allow required 'mbind' system call
2021-08-04 22:49:05 +00:00
SystemCallFilter = nbLib.defaultHardening.SystemCallFilter ++ [ "mbind" ] ;
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
Restart = "on-failure";
RestartSec = "10s";
services: add `tor.*` options Split `enforceTor` into `tor.proxy` and `tor.enforce`. By enabling `tor.proxy` without `tor.enforce`, a service can accept incoming clearnet connections. E.g., this allows setting up a Tor-proxied bitcoind node that accepts RPC connections from LAN.
2021-11-28 20:24:49 +00:00
} // nbLib.allowedIPAddresses cfg.tor.enforce;
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
};
joinmarket-ob-watcher: extra permissions & functionality for fidelity bonds
2021-08-25 09:57:09 +00:00
users.users.${cfg.user} = {
isSystemUser = true;
group = cfg.group;
home = cfg.dataDir;
};
users.groups.${cfg.group} = {};
nix-bitcoin.secrets = {
bitcoin-rpcpassword-joinmarket-ob-watcher.user = cfg.user;
bitcoin-HMAC-joinmarket-ob-watcher.user = bitcoind.user;
};
secrets: allow extending generate-secrets `generate-secrets` is no longer a monolithic script. Instead, it's composed of the values of option `nix-bitcoin.generateSecretsCmds`. This has the following advantages: - generate-secrets is now extensible by users - Only secrets of enabled services are generated - RPC IPs in the `lnd` and `loop` certs are no longer hardcoded. Secrets are no longer automatically generated when entering nix-shell. Instead, they are generated before deployment (via `krops-deploy`) because secrets generation is now dependant on the node configuration.
2021-09-08 15:01:18 +00:00
nix-bitcoin.generateSecretsCmds.joinmarket-ob-watcher = ''
makeBitcoinRPCPassword joinmarket-ob-watcher
'';
joinmarket-obwatcher: add pkg & module
2021-01-17 12:24:57 +00:00
};
}
Reference in New Issue Copy Permalink