services: add helper fn setAllowedIPAddresses

Also use 'allowLocalIPAddresses' instead of 'allowTor' in bitcoind-import-banlist
which doesn't use Tor.

modules/bitcoind.nix

@@ -357,9 +357,7 @@ in {
         Restart = "on-failure";
         UMask = mkIf cfg.dataDirReadableByGroup "0027";
         ReadWritePaths = cfg.dataDir;
-      } // (if cfg.enforceTor
+      } // nbLib.allowedIPAddresses cfg.enforceTor
-            then nbLib.allowTor
-            else nbLib.allowAnyIP)
         // optionalAttrs (cfg.zmqpubrawblock != null || cfg.zmqpubrawtx != null) nbLib.allowAnyProtocol;
     };
 
@@ -385,7 +383,7 @@ in {
         User = cfg.user;
         Group = cfg.group;
         ReadWritePaths = cfg.dataDir;
-      } // nbLib.allowTor;
+      } // nbLib.allowLocalIPAddresses;
     };
 
     users.users.${cfg.user}.group = cfg.group;

modules/btcpayserver.nix

@@ -155,10 +155,7 @@ in {
         RestartSec = "10s";
         ReadWritePaths = cfg.nbxplorer.dataDir;
         MemoryDenyWriteExecute = "false";
-      } // (if cfg.nbxplorer.enforceTor
+      } // nbLib.allowedIPAddresses cfg.nbxplorer.enforceTor;
-        then nbLib.allowTor
-        else nbLib.allowAnyIP
-      );
     };
 
     systemd.services.btcpayserver = let
@@ -204,10 +201,7 @@ in {
         RestartSec = "10s";
         ReadWritePaths = cfg.btcpayserver.dataDir;
         MemoryDenyWriteExecute = "false";
-      } // (if cfg.btcpayserver.enforceTor
+      } // nbLib.allowedIPAddresses cfg.btcpayserver.enforceTor;
-        then nbLib.allowTor
-        else nbLib.allowAnyIP
-      );
     }; in self;
 
     users.users.${cfg.nbxplorer.user} = {

modules/clightning.nix

@@ -128,10 +128,7 @@ in {
         Restart = "on-failure";
         RestartSec = "10s";
         ReadWritePaths = cfg.dataDir;
-      } // (if cfg.enforceTor
+      } // nbLib.allowedIPAddresses cfg.enforceTor;
-          then nbLib.allowTor
-          else nbLib.allowAnyIP
-        );
       # Wait until the rpc socket appears
       postStart = ''
         while [[ ! -e ${cfg.networkDir}/lightning-rpc ]]; do

modules/electrs.nix

@@ -102,10 +102,7 @@ in {
         Restart = "on-failure";
         RestartSec = "10s";
         ReadWritePaths = "${cfg.dataDir} ${if cfg.high-memory then "${bitcoind.dataDir}" else ""}";
-      } // (if cfg.enforceTor
+      } // nbLib.allowedIPAddresses cfg.enforceTor;
-          then nbLib.allowTor
-          else nbLib.allowAnyIP
-        );
     };
 
     users.users.${cfg.user} = {

modules/lightning-loop.nix

@@ -102,9 +102,7 @@ in {
         Restart = "on-failure";
         RestartSec = "10s";
         ReadWritePaths = cfg.dataDir;
-      } // (if cfg.enforceTor
+      } // nbLib.allowedIPAddresses cfg.enforceTor;
-            then nbLib.allowTor
-            else nbLib.allowAnyIP);
     };
 
      nix-bitcoin.secrets = {

modules/lightning-pool.nix

@@ -100,9 +100,7 @@ in {
         Restart = "on-failure";
         RestartSec = "10s";
         ReadWritePaths = cfg.dataDir;
-      } // (if cfg.enforceTor
+      } // (nbLib.allowedIPAddresses cfg.enforceTor);
-            then nbLib.allowTor
-            else nbLib.allowAnyIP);
     };
   };
 }

modules/liquid.nix

@@ -239,10 +239,7 @@ in {
         PIDFile = pidFile;
         Restart = "on-failure";
         ReadWritePaths = cfg.dataDir;
-      } // (if cfg.enforceTor
+      } // nbLib.allowedIPAddresses cfg.enforceTor;
-          then nbLib.allowTor
-          else nbLib.allowAnyIP
-        );
     };
 
     users.users.${cfg.user} = {

modules/lnd.nix

@@ -262,10 +262,8 @@ in {
             '') (attrNames cfg.macaroons)}
           '')
         ];
-      } // (if cfg.enforceTor
+      } // nbLib.allowedIPAddresses cfg.enforceTor
-          then nbLib.allowTor
+        // nbLib.allowAnyProtocol;  # For ZMQ
-          else nbLib.allowAnyIP
-        ) // nbLib.allowAnyProtocol;  # For ZMQ
     };
 
     users.users.${cfg.user} = {

modules/recurring-donations.nix

@@ -83,9 +83,7 @@ in {
         ExecStart = "${pkgs.bash}/bin/bash ${recurring-donations-script}";
         User = "recurring-donations";
         Type = "oneshot";
-      } // (if cfg.enforceTor
+      } // nbLib.allowedIPAddresses cfg.enforceTor;
-            then nbLib.allowTor
-            else nbLib.allowAnyIP);
     };
     systemd.timers.recurring-donations = {
       requires = [ "clightning.service" ];

modules/spark-wallet.nix

@@ -79,9 +79,7 @@ in {
         User = cfg.user;
         Restart = "on-failure";
         RestartSec = "10s";
-      } // (if cfg.enforceTor
+      } // nbLib.allowedIPAddresses cfg.enforceTor
-            then nbLib.allowTor
-            else nbLib.allowAnyIP)
         // nbLib.nodejs;
     };
     nix-bitcoin.secrets.spark-wallet-login.user = cfg.user;

pkgs/lib.nix

@@ -35,13 +35,17 @@ let self = {
 
   # nodejs applications apparently rely on memory write execute
   nodejs = { MemoryDenyWriteExecute = "false"; };
-  # Allow tor traffic. Allow takes precedence over Deny.
+
-  allowTor = {
+  # Allow takes precedence over Deny.
+  allowLocalIPAddresses = {
     IPAddressAllow = "127.0.0.1/32 ::1/128 169.254.0.0/16";
   };
-  # Allow any traffic
+  allowAllIPAddresses = { IPAddressAllow = "any"; };
-  allowAnyIP = { IPAddressAllow = "any"; };
+  allowTor = self.allowLocalIPAddresses;
-  allowAnyProtocol = { RestrictAddressFamilies = "~"; };
+  allowedIPAddresses = onlyLocal:
+    if onlyLocal
+    then self.allowLocalIPAddresses
+    else self.allowAllIPAddresses;
 
   enforceTor = mkOption {
     type = types.bool;