heierbtc/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
b4bc621b8c
nix-bitcoin/modules/lightning-loop.nix

148 lines
4.7 KiB
Nix
Raw Normal View History

lightning-loop: add module
2020-07-07 14:22:17 +00:00
{ config, lib, pkgs, ... }:
with lib;
let
options.services.lightning-loop = {
pkgs: add `meta` attr Also add more detailed `enable` option descriptions.
2021-12-14 18:51:23 +00:00
enable = mkEnableOption "Lightning Loop, a non-custodial off/on chain bridge";
lightning-loop: add RPC and REST server options
2020-10-29 20:20:36 +00:00
rpcAddress = mkOption {
type = types.str;
default = "localhost";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "Address to listen for gRPC connections.";
lightning-loop: add RPC and REST server options
2020-10-29 20:20:36 +00:00
};
rpcPort = mkOption {
type = types.port;
default = 11010;
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "Port to listen for gRPC connections.";
lightning-loop: add RPC and REST server options
2020-10-29 20:20:36 +00:00
};
restAddress = mkOption {
type = types.str;
default = cfg.rpcAddress;
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "Address to listen for REST connections.";
lightning-loop: add RPC and REST server options
2020-10-29 20:20:36 +00:00
};
restPort = mkOption {
type = types.port;
default = 8081;
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "Port to listen for REST connections.";
lightning-loop: add RPC and REST server options
2020-10-29 20:20:36 +00:00
};
lightning-loop: add module
2020-07-07 14:22:17 +00:00
package = mkOption {
type = types.package;
add option nix-bitcoin.pkgs, remove overlay This works around a nixpkgs bug where overlays are ignored in containers.
2020-11-09 21:09:09 +00:00
default = config.nix-bitcoin.pkgs.lightning-loop;
nix-bitcoin.nix: add `defaultText` (automatic) This enables generating module option documentation. This commit was genereated by running the following script inside the repo root dir: def add_default_text(file) src = File.read(file) src2 = src.gsub(/( = mkOption\s+\{[^{]*?)(\n\s+default = )(.*?);$(.*?\})/m) do |str| pre, defaultVar, default, post = Regexp.last_match.captures replacement = if !post.include?('defaultText =') if default =~ /\bpkgs\b/ defaultText = default.lines.length == 1 ? default : "(See source)" "#{pre}#{defaultVar}#{default};#{defaultVar.sub('default', 'defaultText')}#{defaultText.inspect};#{post}" end end replacement or str end File.write(file, src2) if src2 != src end Dir["modules/**/*.nix"].each do |f| next if File.basename(f) == "nix-bitcoin.nix" add_default_text f end
2021-12-08 03:07:28 +00:00
defaultText = "config.nix-bitcoin.pkgs.lightning-loop";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The package providing lightning-loop binaries.";
lightning-loop: add module
2020-07-07 14:22:17 +00:00
};
lightning-loop: update module * commandlineArgs -> configFile * introduce tls certs * loop dataDir * fix formatting and descriptions Warning: Manual migration of existing loop data directory necessary
2020-09-15 08:46:15 +00:00
dataDir = mkOption {
type = types.path;
default = "/var/lib/lightning-loop";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "The data directory for lightning-loop.";
lightning-loop: update module * commandlineArgs -> configFile * introduce tls certs * loop dataDir * fix formatting and descriptions Warning: Manual migration of existing loop data directory necessary
2020-09-15 08:46:15 +00:00
};
lightning-loop: add module
2020-07-07 14:22:17 +00:00
proxy = mkOption {
type = types.nullOr types.str;
services: add `tor.*` options Split `enforceTor` into `tor.proxy` and `tor.enforce`. By enabling `tor.proxy` without `tor.enforce`, a service can accept incoming clearnet connections. E.g., this allows setting up a Tor-proxied bitcoind node that accepts RPC connections from LAN.
2021-11-28 20:24:49 +00:00
default = if cfg.tor.proxy then config.nix-bitcoin.torClientAddressWithPort else null;
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "`host:port` of SOCKS5 proxy for connnecting to the loop server.";
lightning-loop: add module
2020-07-07 14:22:17 +00:00
};
lightning-loop: add certificate options `extraIPs` and `extraDomains` This is useful for non-local access to the lightning-loop REST server.
2022-07-07 14:08:28 +00:00
certificate = {
extraIPs = mkOption {
type = with types; listOf str;
default = [];
example = [ "60.100.0.1" ];
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc ''
lightning-loop: add certificate options `extraIPs` and `extraDomains` This is useful for non-local access to the lightning-loop REST server.
2022-07-07 14:08:28 +00:00
Extra `subjectAltName` IPs added to the certificate.
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
This works the same as loop option {option}`tlsextraip`.
lightning-loop: add certificate options `extraIPs` and `extraDomains` This is useful for non-local access to the lightning-loop REST server.
2022-07-07 14:08:28 +00:00
'';
};
extraDomains = mkOption {
type = with types; listOf str;
default = [];
example = [ "example.com" ];
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc ''
lightning-loop: add certificate options `extraIPs` and `extraDomains` This is useful for non-local access to the lightning-loop REST server.
2022-07-07 14:08:28 +00:00
Extra `subjectAltName` domain names added to the certificate.
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
This works the same as loop option {option}`tlsextradomain`.
lightning-loop: add certificate options `extraIPs` and `extraDomains` This is useful for non-local access to the lightning-loop REST server.
2022-07-07 14:08:28 +00:00
'';
};
};
lightning-loop: update module * commandlineArgs -> configFile * introduce tls certs * loop dataDir * fix formatting and descriptions Warning: Manual migration of existing loop data directory necessary
2020-09-15 08:46:15 +00:00
extraConfig = mkOption {
type = types.lines;
lightning-loop: add module
2020-07-07 14:22:17 +00:00
default = "";
lightning-loop: update module * commandlineArgs -> configFile * introduce tls certs * loop dataDir * fix formatting and descriptions Warning: Manual migration of existing loop data directory necessary
2020-09-15 08:46:15 +00:00
example = ''
debuglevel=trace
'';
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc ''
lnd, lightning-loop: improve `extraConfig` option description
2022-07-07 14:08:26 +00:00
Extra lines appended to the configuration file.
See here for all available options:
https://github.com/lightninglabs/loop/blob/11ab596080e9d36f1df43edbeba0702b25aa7457/loopd/config.go#L119
'';
lightning-loop: add module
2020-07-07 14:22:17 +00:00
};
cli = mkOption {
treewide: set shebang for bash scripts These scripts previously failed when called with syscalls like `execve` (used by, e.g., Python's `subprocess.run`) that use no default interpreter for scripts without a shebang.
2022-11-08 21:45:19 +00:00
default = pkgs.writers.writeBashBin "loop" ''
lightning-loop: allow RPC access from main netns Note that this also exposes the REST server, which is secured by macaroon auth like the RPC server.
2020-10-29 20:20:37 +00:00
${cfg.package}/bin/loop \
services: support 0.0.0.0/:: in `address` options Previously, client services didn't decode these special INADDR_ANY addresses and failed to connect.
2021-10-01 09:51:57 +00:00
--rpcserver ${nbLib.addressWithPort cfg.rpcAddress cfg.rpcPort} \
lightning-loop: 0.9.0 -> 0.10.0 Includes macaroon authentication
2020-10-16 13:46:01 +00:00
--macaroonpath '${cfg.dataDir}/${network}/loop.macaroon' \
--tlscertpath '${secretsDir}/loop-cert' "$@"
lightning-loop: add module
2020-07-07 14:22:17 +00:00
'';
nix-bitcoin.nix: add `defaultText` (automatic) This enables generating module option documentation. This commit was genereated by running the following script inside the repo root dir: def add_default_text(file) src = File.read(file) src2 = src.gsub(/( = mkOption\s+\{[^{]*?)(\n\s+default = )(.*?);$(.*?\})/m) do |str| pre, defaultVar, default, post = Regexp.last_match.captures replacement = if !post.include?('defaultText =') if default =~ /\bpkgs\b/ defaultText = default.lines.length == 1 ? default : "(See source)" "#{pre}#{defaultVar}#{default};#{defaultVar.sub('default', 'defaultText')}#{defaultText.inspect};#{post}" end end replacement or str end File.write(file, src2) if src2 != src end Dir["modules/**/*.nix"].each do |f| next if File.basename(f) == "nix-bitcoin.nix" add_default_text f end
2021-12-08 03:07:28 +00:00
defaultText = "(See source)";
treewide: use `mdDoc` for descriptions Enable markdown syntax (instead of docbook) for descriptions. This only affects external doc tooling that renders the descriptions.
2022-12-18 12:13:47 +00:00
description = mdDoc "Binary to connect with the lightning-loop instance.";
lightning-loop: add module
2020-07-07 14:22:17 +00:00
};
services: add `tor.*` options Split `enforceTor` into `tor.proxy` and `tor.enforce`. By enabling `tor.proxy` without `tor.enforce`, a service can accept incoming clearnet connections. E.g., this allows setting up a Tor-proxied bitcoind node that accepts RPC connections from LAN.
2021-11-28 20:24:49 +00:00
tor = nbLib.tor;
lightning-loop: add module
2020-07-07 14:22:17 +00:00
};
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
cfg = config.services.lightning-loop;
nbLib = config.nix-bitcoin.lib;
secretsDir = config.nix-bitcoin.secretsDir;
lnd = config.services.lnd;
network = config.services.bitcoind.network;
configFile = builtins.toFile "loop.conf" ''
datadir=${cfg.dataDir}
network=${network}
services: support 0.0.0.0/:: in `address` options Previously, client services didn't decode these special INADDR_ANY addresses and failed to connect.
2021-10-01 09:51:57 +00:00
rpclisten=${cfg.rpcAddress}:${toString cfg.rpcPort}
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
restlisten=${cfg.restAddress}:${toString cfg.restPort}
logdir=${cfg.dataDir}/logs
tlscertpath=${secretsDir}/loop-cert
tlskeypath=${secretsDir}/loop-key
services: support 0.0.0.0/:: in `address` options Previously, client services didn't decode these special INADDR_ANY addresses and failed to connect.
2021-10-01 09:51:57 +00:00
lnd.host=${nbLib.addressWithPort lnd.rpcAddress lnd.rpcPort}
modules: move options to the top This greatly improves readability and makes it easier to discover options. This commit was genereated by running the following script inside the repo root dir: #!/usr/bin/env ruby def transform(src) return false if src.include?('inherit options;') success = false options = nil src.sub!(/^ options.*?^ }.*?;/m) do |match| options = match " inherit options;" end return false if !options src.sub!(/^with lib;\s*let\n+/m) do |match| success = true <<~EOF with lib; let #{options} EOF end success end Dir['modules/**/*.nix'].each do |f| src = File.read(f) if transform(src) puts "Changed file #{f}" File.write(f, src) end end
2021-09-13 11:40:47 +00:00
lnd.macaroonpath=${lnd.networkDir}/admin.macaroon
lnd.tlspath=${lnd.certPath}
${optionalString (cfg.proxy != null) "server.proxy=${cfg.proxy}"}
${cfg.extraConfig}
'';
in {
inherit options;
lightning-loop: add module
2020-07-07 14:22:17 +00:00
config = mkIf cfg.enable {
services: auto-enable dependencies
2020-10-18 12:49:20 +00:00
services.lnd.enable = true;
lightning-loop: add module
2020-07-07 14:22:17 +00:00
environment.systemPackages = [ cfg.package (hiPrio cfg.cli) ];
lightning-loop: update module * commandlineArgs -> configFile * introduce tls certs * loop dataDir * fix formatting and descriptions Warning: Manual migration of existing loop data directory necessary
2020-09-15 08:46:15 +00:00
systemd.tmpfiles.rules = [
lightning-pool/loop: extract lnd variable
2021-09-08 15:01:12 +00:00
"d '${cfg.dataDir}' 0770 ${lnd.user} ${lnd.group} - -"
lightning-loop: update module * commandlineArgs -> configFile * introduce tls certs * loop dataDir * fix formatting and descriptions Warning: Manual migration of existing loop data directory necessary
2020-09-15 08:46:15 +00:00
];
lightning-loop: add certificate options `extraIPs` and `extraDomains` This is useful for non-local access to the lightning-loop REST server.
2022-07-07 14:08:28 +00:00
services.lightning-loop.certificate.extraIPs = mkIf (cfg.rpcAddress != "localhost") [ "${cfg.rpcAddress}" ];
lightning-loop: add module
2020-07-07 14:22:17 +00:00
systemd.services.lightning-loop = {
wantedBy = [ "multi-user.target" ];
requires = [ "lnd.service" ];
after = [ "lnd.service" ];
rename nix-bitcoin-services.nix -> lib.nix
2021-02-03 21:44:41 +00:00
serviceConfig = nbLib.defaultHardening // {
lightning-loop: update module * commandlineArgs -> configFile * introduce tls certs * loop dataDir * fix formatting and descriptions Warning: Manual migration of existing loop data directory necessary
2020-09-15 08:46:15 +00:00
ExecStart = "${cfg.package}/bin/loopd --configfile=${configFile}";
lightning-pool/loop: extract lnd variable
2021-09-08 15:01:12 +00:00
User = lnd.user;
lightning-loop: add module
2020-07-07 14:22:17 +00:00
Restart = "on-failure";
RestartSec = "10s";
services: set systemd list options as list values This makes our list definitions mergeable with custom list values set by users. Previously, a module error ("value is a string while a list was expected") was thrown instead. This commit was partly auto-generated with this script: #!/usr/bin/env ruby Dir["**/*.nix"].each do |file| src = File.read(file) fixed = src.gsub(/ReadWritePaths *= *(.*?);/) do "ReadWritePaths = [ #{$1} ];" end File.write(file, fixed) if fixed != src end
2022-05-07 18:34:21 +00:00
ReadWritePaths = [ cfg.dataDir ];
services: add `tor.*` options Split `enforceTor` into `tor.proxy` and `tor.enforce`. By enabling `tor.proxy` without `tor.enforce`, a service can accept incoming clearnet connections. E.g., this allows setting up a Tor-proxied bitcoind node that accepts RPC connections from LAN.
2021-11-28 20:24:49 +00:00
} // nbLib.allowedIPAddresses cfg.tor.enforce;
lightning-loop: add module
2020-07-07 14:22:17 +00:00
};
lightning-loop: update module * commandlineArgs -> configFile * introduce tls certs * loop dataDir * fix formatting and descriptions Warning: Manual migration of existing loop data directory necessary
2020-09-15 08:46:15 +00:00
nix-bitcoin.secrets = {
lightning-pool/loop: extract lnd variable
2021-09-08 15:01:12 +00:00
loop-key.user = lnd.user;
loop-cert.user = lnd.user;
lightning-loop: update module * commandlineArgs -> configFile * introduce tls certs * loop dataDir * fix formatting and descriptions Warning: Manual migration of existing loop data directory necessary
2020-09-15 08:46:15 +00:00
};
secrets: allow extending generate-secrets `generate-secrets` is no longer a monolithic script. Instead, it's composed of the values of option `nix-bitcoin.generateSecretsCmds`. This has the following advantages: - generate-secrets is now extensible by users - Only secrets of enabled services are generated - RPC IPs in the `lnd` and `loop` certs are no longer hardcoded. Secrets are no longer automatically generated when entering nix-shell. Instead, they are generated before deployment (via `krops-deploy`) because secrets generation is now dependant on the node configuration.
2021-09-08 15:01:18 +00:00
nix-bitcoin.generateSecretsCmds.lightning-loop = ''
lightning-loop: add certificate options `extraIPs` and `extraDomains` This is useful for non-local access to the lightning-loop REST server.
2022-07-07 14:08:28 +00:00
makeCert loop '${nbLib.mkCertExtraAltNames cfg.certificate}'
secrets: allow extending generate-secrets `generate-secrets` is no longer a monolithic script. Instead, it's composed of the values of option `nix-bitcoin.generateSecretsCmds`. This has the following advantages: - generate-secrets is now extensible by users - Only secrets of enabled services are generated - RPC IPs in the `lnd` and `loop` certs are no longer hardcoded. Secrets are no longer automatically generated when entering nix-shell. Instead, they are generated before deployment (via `krops-deploy`) because secrets generation is now dependant on the node configuration.
2021-09-08 15:01:18 +00:00
'';
lightning-loop: add module
2020-07-07 14:22:17 +00:00
};
}
Reference in New Issue Copy Permalink