heierbtc/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
bd2a46cb73
nix-bitcoin/modules/nix-bitcoin-webindex.nix

106 lines
2.8 KiB
Nix
Raw Normal View History

Add missing nixbitcoin webindex
2018-12-06 11:39:54 +00:00
{ config, lib, pkgs, ... }:
with lib;
let
Switch to stable channel but pull the bitcoind and clightning packages and the tor module from unstable
2019-01-01 19:16:24 +00:00
cfg = config.services.nix-bitcoin-webindex;
add 'nix-bitcoin-services' option 1. Makes the content easily accessible for module users 2. Avoids needlessly recalculating the attrset in every client module
2019-11-27 13:04:23 +00:00
inherit (config) nix-bitcoin-services;
Add missing nixbitcoin webindex
2018-12-06 11:39:54 +00:00
indexFile = pkgs.writeText "index.html" ''
<html>
<body>
<p>
<h1>
nix-bitcoin
</h1>
</p>
<p>
<h3>
lightning node: CLIGHTNING_ID
</h3>
</p>
</body>
</html>
'';
createWebIndex = pkgs.writeText "make-index.sh" ''
set -e
cp ${indexFile} /var/www/index.html
All modules with preStart: Use systemd.tmpfiles.rules This is NixOS' recommended way to setup service dirs https://github.com/NixOS/nixpkgs/pull/56265. This commit hands off the initial data directory creation to systemd.tmpfiles.rules. All other preStart scripts are left intact to limit this changes' scope.
2020-05-06 10:43:57 +00:00
chown -R nginx:nginx /var/www/
Add missing nixbitcoin webindex
2018-12-06 11:39:54 +00:00
nodeinfo
. <(nodeinfo)
sed -i "s/CLIGHTNING_ID/$CLIGHTNING_ID/g" /var/www/index.html
'';
in {
Switch to stable channel but pull the bitcoind and clightning packages and the tor module from unstable
2019-01-01 19:16:24 +00:00
options.services.nix-bitcoin-webindex = {
Add missing nixbitcoin webindex
2018-12-06 11:39:54 +00:00
enable = mkOption {
type = types.bool;
default = false;
description = ''
If enabled, the webindex service will be installed.
'';
};
nginx: add netns - Adds nginx to netns-isolation.services - Adds host option (defaults to localhost) as target of hidden service
2020-06-10 14:48:20 +00:00
host = mkOption {
type = types.str;
netns: move webindex config for modules-only usage webindex is only available in secure-node.
2020-08-21 20:36:02 +00:00
default = if config.nix-bitcoin.netns-isolation.enable then
config.nix-bitcoin.netns-isolation.netns.nginx.address
else
"localhost";
nginx: add netns - Adds nginx to netns-isolation.services - Adds host option (defaults to localhost) as target of hidden service
2020-06-10 14:48:20 +00:00
description = "HTTP server listen address.";
};
Use IPAddress{Allow,Deny} by default for systemd services
2019-04-27 23:53:26 +00:00
enforceTor = nix-bitcoin-services.enforceTor;
Add missing nixbitcoin webindex
2018-12-06 11:39:54 +00:00
};
config = mkIf cfg.enable {
add module assertions
2020-06-15 10:34:11 +00:00
assertions = [
nanopos: remove package and module
2021-01-01 17:37:30 +00:00
{ assertion = config.services.clightning.enable;
message = "nix-bitcoin-webindex requires clightning.";
add module assertions
2020-06-15 10:34:11 +00:00
}
];
All modules with preStart: Use systemd.tmpfiles.rules This is NixOS' recommended way to setup service dirs https://github.com/NixOS/nixpkgs/pull/56265. This commit hands off the initial data directory creation to systemd.tmpfiles.rules. All other preStart scripts are left intact to limit this changes' scope.
2020-05-06 10:43:57 +00:00
systemd.tmpfiles.rules = [
"d /var/www 0755 nginx nginx - -"
];
Add missing nixbitcoin webindex
2018-12-06 11:39:54 +00:00
services.nginx = {
enable = true;
virtualHosts."_" = {
root = "/var/www";
};
};
services.tor.hiddenServices.nginx = {
map = [{
nginx: add netns - Adds nginx to netns-isolation.services - Adds host option (defaults to localhost) as target of hidden service
2020-06-10 14:48:20 +00:00
port = 80; toHost = cfg.host;
Add missing nixbitcoin webindex
2018-12-06 11:39:54 +00:00
} {
nginx: add netns - Adds nginx to netns-isolation.services - Adds host option (defaults to localhost) as target of hidden service
2020-06-10 14:48:20 +00:00
port = 443; toHost = cfg.host;
Add missing nixbitcoin webindex
2018-12-06 11:39:54 +00:00
}];
version = 3;
};
# create-web-index
systemd.services.create-web-index = {
description = "Get node info";
wantedBy = [ "multi-user.target" ];
netns: remove conditionals for service settings Going without the conditionals (like in secure-node.nix) adds readability and doesn't reduce evaluation performance (in fact, it even slightly improves performance due to implementation details of mkIf). To avoid errors, remove use of disabled services in secure-node.nix and nix-bitcoin-webindex.nix.
2020-08-21 20:35:58 +00:00
path = with pkgs; [
nodeinfo: Convert to module and allow alternative operator username currently, nodeinfo has presets/secure-node.nix as a strict dependency as it requires onion-chef and the 'operatorName' option. and nix-bitcoin-webindex.nix has nodeinfo as a dependecy. so don't add nodeinfo and webindex to modules.nix because they will fail on standalone use.
2020-05-03 14:42:53 +00:00
config.programs.nodeinfo
clightning: add cli option An executable is more robust to use than shell aliases. This is also a preparation for commit 'add module test' because the NixOS testing framework makes interactive aliases hard to use: It unsets 'PS1' which is used by programs/bash/bash.nix to detect interactive shells.
2019-11-27 13:04:33 +00:00
jq
sudo
netns: remove conditionals for service settings Going without the conditionals (like in secure-node.nix) adds readability and doesn't reduce evaluation performance (in fact, it even slightly improves performance due to implementation details of mkIf). To avoid errors, remove use of disabled services in secure-node.nix and nix-bitcoin-webindex.nix.
2020-08-21 20:35:58 +00:00
] ++ optional config.services.lnd.enable config.services.lnd.cli
++ optional config.services.clightning.enable config.services.clightning.cli;
All modules: Give service config precedence over defaultHardening With '//' the latter takes precedence over the former in case of equally named attributes.
2020-05-05 13:18:41 +00:00
serviceConfig = nix-bitcoin-services.defaultHardening // {
Add missing nixbitcoin webindex
2018-12-06 11:39:54 +00:00
ExecStart="${pkgs.bash}/bin/bash ${createWebIndex}";
User = "root";
Type = "simple";
RemainAfterExit="yes";
Restart = "on-failure";
RestartSec = "10s";
webindex & onion-chef: Run non-network-facing services in PrivateNetwork
2020-05-05 13:25:00 +00:00
PrivateNetwork = "true"; # This service needs no network access
service hardening: Add PrivateUsers Exceptions in webindex & onion-chef
2020-05-06 08:28:00 +00:00
PrivateUsers = "false";
All modules: ProtectSystem = strict Add ReadWritePaths in all modules, except lnd which has ProtectSystem = full.
2020-05-05 15:15:16 +00:00
ReadWritePaths = "/var/www";
service hardening: Add CapabilityBoundingSets Whitelist with exceptions in webindex and onion-chef
2020-05-05 13:27:07 +00:00
CapabilityBoundingSet = "CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_SYS_ADMIN CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER";
All modules: Give service config precedence over defaultHardening With '//' the latter takes precedence over the former in case of equally named attributes.
2020-05-05 13:18:41 +00:00
} // (if cfg.enforceTor
Use IPAddress{Allow,Deny} by default for systemd services
2019-04-27 23:53:26 +00:00
then nix-bitcoin-services.allowTor
else nix-bitcoin-services.allowAnyIP
);
Add missing nixbitcoin webindex
2018-12-06 11:39:54 +00:00
};
};
}
Reference in New Issue Copy Permalink