clightning: refactor bind-addr to be IP address only
With typecheck
This commit is contained in:
nixbitcoin
parent
d99ccc8445
commit
43da15557d
|
|
@ -11,7 +11,7 @@ let
|
||||||
bitcoin-datadir=${config.services.bitcoind.dataDir}
|
bitcoin-datadir=${config.services.bitcoind.dataDir}
|
||||||
${optionalString (cfg.proxy != null) "proxy=${cfg.proxy}"}
|
${optionalString (cfg.proxy != null) "proxy=${cfg.proxy}"}
|
||||||
always-use-proxy=${if cfg.always-use-proxy then "true" else "false"}
|
always-use-proxy=${if cfg.always-use-proxy then "true" else "false"}
|
||||||
${optionalString (cfg.bind-addr != null) "bind-addr=${cfg.bind-addr}"}
|
${optionalString (cfg.bind-addr != null) "bind-addr=${cfg.bind-addr}:${toString cfg.bindport}"}
|
||||||
${optionalString (cfg.bitcoin-rpcconnect != null) "bitcoin-rpcconnect=${cfg.bitcoin-rpcconnect}"}
|
${optionalString (cfg.bitcoin-rpcconnect != null) "bitcoin-rpcconnect=${cfg.bitcoin-rpcconnect}"}
|
||||||
bitcoin-rpcuser=${config.services.bitcoind.rpc.users.public.name}
|
bitcoin-rpcuser=${config.services.bitcoind.rpc.users.public.name}
|
||||||
rpc-file-mode=0660
|
rpc-file-mode=0660
|
||||||
|
|
@ -46,8 +46,8 @@ in {
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
bind-addr = mkOption {
|
bind-addr = mkOption {
|
||||||
type = types.nullOr types.str;
|
type = types.addCheck types.str (s: builtins.length (builtins.split ":" s) == 1);
|
||||||
default = null;
|
default = "127.0.0.1";
|
||||||
description = "Set an IP address or UNIX domain socket to listen to";
|
description = "Set an IP address or UNIX domain socket to listen to";
|
||||||
};
|
};
|
||||||
bindport = mkOption {
|
bindport = mkOption {
|
||||||
|
|
|
||||||
|
|
@ -70,244 +70,237 @@ in {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
config = mkMerge [
|
config = mkIf cfg.enable {
|
||||||
(mkIf cfg.enable {
|
# Prerequisites
|
||||||
# Prerequisites
|
networking.dhcpcd.denyInterfaces = [ "br0" "br-nb*" "nb-veth*" ];
|
||||||
networking.dhcpcd.denyInterfaces = [ "br0" "br-nb*" "nb-veth*" ];
|
services.tor.client.socksListenAddress = "${bridgeIp}:9050";
|
||||||
services.tor.client.socksListenAddress = "${bridgeIp}:9050";
|
networking.firewall.interfaces.br0.allowedTCPPorts = [ 9050 ];
|
||||||
networking.firewall.interfaces.br0.allowedTCPPorts = [ 9050 ];
|
boot.kernel.sysctl."net.ipv4.ip_forward" = true;
|
||||||
boot.kernel.sysctl."net.ipv4.ip_forward" = true;
|
security.wrappers.netns-exec = {
|
||||||
security.wrappers.netns-exec = {
|
source = "${pkgs.nix-bitcoin.netns-exec}/netns-exec";
|
||||||
source = "${pkgs.nix-bitcoin.netns-exec}/netns-exec";
|
capabilities = "cap_sys_admin=ep";
|
||||||
capabilities = "cap_sys_admin=ep";
|
owner = "${config.nix-bitcoin.operatorName}";
|
||||||
owner = "${config.nix-bitcoin.operatorName}";
|
permissions = "u+rx,g+rx,o-rwx";
|
||||||
permissions = "u+rx,g+rx,o-rwx";
|
};
|
||||||
};
|
|
||||||
|
|
||||||
nix-bitcoin.netns-isolation.services = {
|
nix-bitcoin.netns-isolation.services = {
|
||||||
bitcoind = {
|
bitcoind = {
|
||||||
id = 12;
|
id = 12;
|
||||||
};
|
};
|
||||||
clightning = {
|
clightning = {
|
||||||
id = 13;
|
id = 13;
|
||||||
connections = [ "bitcoind" ];
|
connections = [ "bitcoind" ];
|
||||||
};
|
};
|
||||||
lnd = {
|
lnd = {
|
||||||
id = 14;
|
id = 14;
|
||||||
connections = [ "bitcoind" ];
|
connections = [ "bitcoind" ];
|
||||||
};
|
};
|
||||||
liquidd = {
|
liquidd = {
|
||||||
id = 15;
|
id = 15;
|
||||||
connections = [ "bitcoind" ];
|
connections = [ "bitcoind" ];
|
||||||
};
|
};
|
||||||
electrs = {
|
electrs = {
|
||||||
id = 16;
|
id = 16;
|
||||||
connections = [ "bitcoind" ];
|
connections = [ "bitcoind" ];
|
||||||
};
|
};
|
||||||
spark-wallet = {
|
spark-wallet = {
|
||||||
id = 17;
|
id = 17;
|
||||||
# communicates with clightning over lightning-rpc socket
|
# communicates with clightning over lightning-rpc socket
|
||||||
connections = [];
|
connections = [];
|
||||||
};
|
};
|
||||||
lightning-charge = {
|
lightning-charge = {
|
||||||
id = 18;
|
id = 18;
|
||||||
# communicates with clightning over lightning-rpc socket
|
# communicates with clightning over lightning-rpc socket
|
||||||
connections = [];
|
connections = [];
|
||||||
};
|
};
|
||||||
nanopos = {
|
nanopos = {
|
||||||
id = 19;
|
id = 19;
|
||||||
connections = [ "nginx" "lightning-charge" ];
|
connections = [ "nginx" "lightning-charge" ];
|
||||||
};
|
};
|
||||||
recurring-donations = {
|
recurring-donations = {
|
||||||
id = 20;
|
id = 20;
|
||||||
# communicates with clightning over lightning-rpc socket
|
# communicates with clightning over lightning-rpc socket
|
||||||
connections = [];
|
connections = [];
|
||||||
};
|
};
|
||||||
nginx = {
|
nginx = {
|
||||||
id = 21;
|
id = 21;
|
||||||
connections = [];
|
connections = [];
|
||||||
};
|
};
|
||||||
lightning-loop = {
|
lightning-loop = {
|
||||||
id = 22;
|
id = 22;
|
||||||
connections = [ "lnd" ];
|
connections = [ "lnd" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services = {
|
||||||
|
netns-bridge = {
|
||||||
|
description = "Create bridge";
|
||||||
|
requiredBy = [ "tor.service" ];
|
||||||
|
before = [ "tor.service" ];
|
||||||
|
script = ''
|
||||||
|
${ip} link add name br0 type bridge
|
||||||
|
${ip} link set br0 up
|
||||||
|
${ip} addr add ${bridgeIp}/24 brd + dev br0
|
||||||
|
${iptables} -w -t nat -A POSTROUTING -s 169.254.${toString cfg.addressblock}.0/24 -j MASQUERADE
|
||||||
|
'';
|
||||||
|
preStop = ''
|
||||||
|
${iptables} -w -t nat -D POSTROUTING -s 169.254.${toString cfg.addressblock}.0/24 -j MASQUERADE
|
||||||
|
${ip} link del br0
|
||||||
|
'';
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = "yes";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services = {
|
bitcoind-import-banlist.serviceConfig.NetworkNamespacePath = "/var/run/netns/nb-bitcoind";
|
||||||
netns-bridge = {
|
} //
|
||||||
description = "Create bridge";
|
(let
|
||||||
requiredBy = [ "tor.service" ];
|
makeNetnsServices = n: v: let
|
||||||
before = [ "tor.service" ];
|
vethName = "nb-veth-${toString v.id}";
|
||||||
|
netnsName = "nb-${n}";
|
||||||
|
ipNetns = "${ip} -n ${netnsName}";
|
||||||
|
netnsIptables = "${ip} netns exec ${netnsName} ${config.networking.firewall.package}/bin/iptables";
|
||||||
|
in {
|
||||||
|
"${n}".serviceConfig.NetworkNamespacePath = "/var/run/netns/${netnsName}";
|
||||||
|
|
||||||
|
"netns-${n}" = rec {
|
||||||
|
requires = [ "netns-bridge.service" ];
|
||||||
|
after = [ "netns-bridge.service" ];
|
||||||
|
bindsTo = [ "${n}.service" ];
|
||||||
|
requiredBy = bindsTo;
|
||||||
|
before = bindsTo;
|
||||||
script = ''
|
script = ''
|
||||||
${ip} link add name br0 type bridge
|
${ip} netns add ${netnsName}
|
||||||
${ip} link set br0 up
|
${ipNetns} link set lo up
|
||||||
${ip} addr add ${bridgeIp}/24 brd + dev br0
|
${ip} link add ${vethName} type veth peer name br-${vethName}
|
||||||
${iptables} -w -t nat -A POSTROUTING -s 169.254.${toString cfg.addressblock}.0/24 -j MASQUERADE
|
${ip} link set ${vethName} netns ${netnsName}
|
||||||
'';
|
${ipNetns} addr add ${v.address}/24 dev ${vethName}
|
||||||
|
${ip} link set br-${vethName} up
|
||||||
|
${ipNetns} link set ${vethName} up
|
||||||
|
${ip} link set br-${vethName} master br0
|
||||||
|
${ipNetns} route add default via ${bridgeIp}
|
||||||
|
${netnsIptables} -w -P INPUT DROP
|
||||||
|
${netnsIptables} -w -A INPUT -s 127.0.0.1,${bridgeIp},${v.address} -j ACCEPT
|
||||||
|
'' + (optionalString (config.services.${n}.enforceTor or false)) ''
|
||||||
|
${netnsIptables} -w -P OUTPUT DROP
|
||||||
|
${netnsIptables} -w -A OUTPUT -d 127.0.0.1,${bridgeIp},${v.address} -j ACCEPT
|
||||||
|
'' + concatMapStrings (otherNetns: let
|
||||||
|
other = netns.${otherNetns};
|
||||||
|
in ''
|
||||||
|
${netnsIptables} -w -A INPUT -s ${other.address} -j ACCEPT
|
||||||
|
${netnsIptables} -w -A OUTPUT -d ${other.address} -j ACCEPT
|
||||||
|
'') v.availableNetns;
|
||||||
preStop = ''
|
preStop = ''
|
||||||
${iptables} -w -t nat -D POSTROUTING -s 169.254.${toString cfg.addressblock}.0/24 -j MASQUERADE
|
${ip} netns delete ${netnsName}
|
||||||
${ip} link del br0
|
${ip} link del br-${vethName}
|
||||||
'';
|
'';
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
Type = "oneshot";
|
Type = "oneshot";
|
||||||
RemainAfterExit = "yes";
|
RemainAfterExit = "yes";
|
||||||
|
ExecStartPre = "-${ip} netns delete ${netnsName}";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
bitcoind-import-banlist.serviceConfig.NetworkNamespacePath = "/var/run/netns/nb-bitcoind";
|
|
||||||
} //
|
|
||||||
(let
|
|
||||||
makeNetnsServices = n: v: let
|
|
||||||
vethName = "nb-veth-${toString v.id}";
|
|
||||||
netnsName = "nb-${n}";
|
|
||||||
ipNetns = "${ip} -n ${netnsName}";
|
|
||||||
netnsIptables = "${ip} netns exec ${netnsName} ${config.networking.firewall.package}/bin/iptables";
|
|
||||||
in {
|
|
||||||
"${n}".serviceConfig.NetworkNamespacePath = "/var/run/netns/${netnsName}";
|
|
||||||
|
|
||||||
"netns-${n}" = rec {
|
|
||||||
requires = [ "netns-bridge.service" ];
|
|
||||||
after = [ "netns-bridge.service" ];
|
|
||||||
bindsTo = [ "${n}.service" ];
|
|
||||||
requiredBy = bindsTo;
|
|
||||||
before = bindsTo;
|
|
||||||
script = ''
|
|
||||||
${ip} netns add ${netnsName}
|
|
||||||
${ipNetns} link set lo up
|
|
||||||
${ip} link add ${vethName} type veth peer name br-${vethName}
|
|
||||||
${ip} link set ${vethName} netns ${netnsName}
|
|
||||||
${ipNetns} addr add ${v.address}/24 dev ${vethName}
|
|
||||||
${ip} link set br-${vethName} up
|
|
||||||
${ipNetns} link set ${vethName} up
|
|
||||||
${ip} link set br-${vethName} master br0
|
|
||||||
${ipNetns} route add default via ${bridgeIp}
|
|
||||||
${netnsIptables} -w -P INPUT DROP
|
|
||||||
${netnsIptables} -w -A INPUT -s 127.0.0.1,${bridgeIp},${v.address} -j ACCEPT
|
|
||||||
'' + (optionalString (config.services.${n}.enforceTor or false)) ''
|
|
||||||
${netnsIptables} -w -P OUTPUT DROP
|
|
||||||
${netnsIptables} -w -A OUTPUT -d 127.0.0.1,${bridgeIp},${v.address} -j ACCEPT
|
|
||||||
'' + concatMapStrings (otherNetns: let
|
|
||||||
other = netns.${otherNetns};
|
|
||||||
in ''
|
|
||||||
${netnsIptables} -w -A INPUT -s ${other.address} -j ACCEPT
|
|
||||||
${netnsIptables} -w -A OUTPUT -d ${other.address} -j ACCEPT
|
|
||||||
'') v.availableNetns;
|
|
||||||
preStop = ''
|
|
||||||
${ip} netns delete ${netnsName}
|
|
||||||
${ip} link del br-${vethName}
|
|
||||||
'';
|
|
||||||
serviceConfig = {
|
|
||||||
Type = "oneshot";
|
|
||||||
RemainAfterExit = "yes";
|
|
||||||
ExecStartPre = "-${ip} netns delete ${netnsName}";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
in foldl (services: n:
|
|
||||||
services // (makeNetnsServices n netns.${n})
|
|
||||||
) {} (builtins.attrNames netns));
|
|
||||||
|
|
||||||
# bitcoin: Custom netns configs
|
|
||||||
services.bitcoind = {
|
|
||||||
bind = netns.bitcoind.address;
|
|
||||||
rpcbind = [
|
|
||||||
"${netns.bitcoind.address}"
|
|
||||||
"127.0.0.1"
|
|
||||||
];
|
|
||||||
rpcallowip = [
|
|
||||||
"127.0.0.1"
|
|
||||||
] ++ lib.lists.concatMap (s: [
|
|
||||||
"${netns.${s}.address}"
|
|
||||||
]) netns.bitcoind.availableNetns;
|
|
||||||
cli = pkgs.writeScriptBin "bitcoin-cli" ''
|
|
||||||
netns-exec nb-bitcoind ${config.services.bitcoind.package}/bin/bitcoin-cli -datadir='${config.services.bitcoind.dataDir}' "$@"
|
|
||||||
'';
|
|
||||||
};
|
};
|
||||||
|
in foldl (services: n:
|
||||||
|
services // (makeNetnsServices n netns.${n})
|
||||||
|
) {} (builtins.attrNames netns));
|
||||||
|
|
||||||
# clightning: Custom netns configs
|
# bitcoin: Custom netns configs
|
||||||
services.clightning = mkIf config.services.clightning.enable {
|
services.bitcoind = {
|
||||||
bitcoin-rpcconnect = netns.bitcoind.address;
|
bind = netns.bitcoind.address;
|
||||||
bind-addr = "${netns.clightning.address}:${toString config.services.clightning.bindport}";
|
rpcbind = [
|
||||||
};
|
"${netns.bitcoind.address}"
|
||||||
|
"127.0.0.1"
|
||||||
|
];
|
||||||
|
rpcallowip = [
|
||||||
|
"127.0.0.1"
|
||||||
|
] ++ lib.lists.concatMap (s: [
|
||||||
|
"${netns.${s}.address}"
|
||||||
|
]) netns.bitcoind.availableNetns;
|
||||||
|
cli = pkgs.writeScriptBin "bitcoin-cli" ''
|
||||||
|
netns-exec nb-bitcoind ${config.services.bitcoind.package}/bin/bitcoin-cli -datadir='${config.services.bitcoind.dataDir}' "$@"
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
# lnd: Custom netns configs
|
# clightning: Custom netns configs
|
||||||
services.lnd = mkIf config.services.lnd.enable {
|
services.clightning = mkIf config.services.clightning.enable {
|
||||||
listen = netns.lnd.address;
|
bitcoin-rpcconnect = netns.bitcoind.address;
|
||||||
rpclisten = [
|
bind-addr = netns.clightning.address;
|
||||||
"${netns.lnd.address}"
|
};
|
||||||
"127.0.0.1"
|
|
||||||
];
|
|
||||||
restlisten = [
|
|
||||||
"${netns.lnd.address}"
|
|
||||||
"127.0.0.1"
|
|
||||||
];
|
|
||||||
bitcoind-host = netns.bitcoind.address;
|
|
||||||
cli = pkgs.writeScriptBin "lncli"
|
|
||||||
# Switch user because lnd makes datadir contents readable by user only
|
|
||||||
''
|
|
||||||
netns-exec nb-lnd sudo -u lnd ${config.services.lnd.package}/bin/lncli --tlscertpath ${config.nix-bitcoin.secretsDir}/lnd-cert \
|
|
||||||
--macaroonpath '${config.services.lnd.dataDir}/chain/bitcoin/mainnet/admin.macaroon' "$@"
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
# liquidd: Custom netns configs
|
# lnd: Custom netns configs
|
||||||
services.liquidd = mkIf config.services.liquidd.enable {
|
services.lnd = mkIf config.services.lnd.enable {
|
||||||
bind = netns.liquidd.address;
|
listen = netns.lnd.address;
|
||||||
rpcbind = [
|
rpclisten = [
|
||||||
"${netns.liquidd.address}"
|
"${netns.lnd.address}"
|
||||||
"127.0.0.1"
|
"127.0.0.1"
|
||||||
];
|
];
|
||||||
rpcallowip = [
|
restlisten = [
|
||||||
"127.0.0.1"
|
"${netns.lnd.address}"
|
||||||
] ++ lib.lists.concatMap (s: [
|
"127.0.0.1"
|
||||||
"${netns.${s}.address}"
|
];
|
||||||
]) netns.liquidd.availableNetns;
|
bitcoind-host = netns.bitcoind.address;
|
||||||
mainchainrpchost = netns.bitcoind.address;
|
cli = pkgs.writeScriptBin "lncli"
|
||||||
cli = pkgs.writeScriptBin "elements-cli" ''
|
# Switch user because lnd makes datadir contents readable by user only
|
||||||
netns-exec nb-liquidd ${pkgs.nix-bitcoin.elementsd}/bin/elements-cli -datadir='${config.services.liquidd.dataDir}' "$@"
|
''
|
||||||
'';
|
netns-exec nb-lnd sudo -u lnd ${config.services.lnd.package}/bin/lncli --tlscertpath ${config.nix-bitcoin.secretsDir}/lnd-cert \
|
||||||
swap-cli = pkgs.writeScriptBin "liquidswap-cli" ''
|
--macaroonpath '${config.services.lnd.dataDir}/chain/bitcoin/mainnet/admin.macaroon' "$@"
|
||||||
netns-exec nb-liquidd ${pkgs.nix-bitcoin.liquid-swap}/bin/liquidswap-cli -c '${config.services.liquidd.dataDir}/elements.conf' "$@"
|
'';
|
||||||
'';
|
};
|
||||||
};
|
|
||||||
|
|
||||||
# electrs: Custom netns configs
|
# liquidd: Custom netns configs
|
||||||
services.electrs = mkIf config.services.electrs.enable {
|
services.liquidd = mkIf config.services.liquidd.enable {
|
||||||
address = netns.electrs.address;
|
bind = netns.liquidd.address;
|
||||||
daemonrpc = "${netns.bitcoind.address}:${toString config.services.bitcoind.rpc.port}";
|
rpcbind = [
|
||||||
};
|
"${netns.liquidd.address}"
|
||||||
|
"127.0.0.1"
|
||||||
|
];
|
||||||
|
rpcallowip = [
|
||||||
|
"127.0.0.1"
|
||||||
|
] ++ lib.lists.concatMap (s: [
|
||||||
|
"${netns.${s}.address}"
|
||||||
|
]) netns.liquidd.availableNetns;
|
||||||
|
mainchainrpchost = netns.bitcoind.address;
|
||||||
|
cli = pkgs.writeScriptBin "elements-cli" ''
|
||||||
|
netns-exec nb-liquidd ${pkgs.nix-bitcoin.elementsd}/bin/elements-cli -datadir='${config.services.liquidd.dataDir}' "$@"
|
||||||
|
'';
|
||||||
|
swap-cli = pkgs.writeScriptBin "liquidswap-cli" ''
|
||||||
|
netns-exec nb-liquidd ${pkgs.nix-bitcoin.liquid-swap}/bin/liquidswap-cli -c '${config.services.liquidd.dataDir}/elements.conf' "$@"
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
# spark-wallet: Custom netns configs
|
# electrs: Custom netns configs
|
||||||
services.spark-wallet = mkIf config.services.spark-wallet.enable {
|
services.electrs = mkIf config.services.electrs.enable {
|
||||||
host = netns.spark-wallet.address;
|
address = netns.electrs.address;
|
||||||
extraArgs = "--no-tls";
|
daemonrpc = "${netns.bitcoind.address}:${toString config.services.bitcoind.rpc.port}";
|
||||||
};
|
};
|
||||||
|
|
||||||
# lightning-charge: Custom netns configs
|
# spark-wallet: Custom netns configs
|
||||||
services.lightning-charge.host = mkIf config.services.lightning-charge.enable netns.lightning-charge.address;
|
services.spark-wallet = mkIf config.services.spark-wallet.enable {
|
||||||
|
host = netns.spark-wallet.address;
|
||||||
|
extraArgs = "--no-tls";
|
||||||
|
};
|
||||||
|
|
||||||
# nanopos: Custom netns configs
|
# lightning-charge: Custom netns configs
|
||||||
services.nanopos = mkIf config.services.nanopos.enable {
|
services.lightning-charge.host = mkIf config.services.lightning-charge.enable netns.lightning-charge.address;
|
||||||
charged-url = "http://${netns.lightning-charge.address}:9112";
|
|
||||||
host = netns.nanopos.address;
|
|
||||||
};
|
|
||||||
|
|
||||||
# nginx: Custom netns configs
|
# nanopos: Custom netns configs
|
||||||
services.nix-bitcoin-webindex.host = mkIf config.services.nix-bitcoin-webindex.enable netns.nginx.address;
|
services.nanopos = mkIf config.services.nanopos.enable {
|
||||||
|
charged-url = "http://${netns.lightning-charge.address}:9112";
|
||||||
|
host = netns.nanopos.address;
|
||||||
|
};
|
||||||
|
|
||||||
# loop: Custom netns configs
|
# nginx: Custom netns configs
|
||||||
services.lightning-loop = mkIf config.services.lightning-loop.enable {
|
services.nix-bitcoin-webindex.host = mkIf config.services.nix-bitcoin-webindex.enable netns.nginx.address;
|
||||||
cli = pkgs.writeScriptBin "loop"
|
|
||||||
# Switch user because lnd makes datadir contents readable by user only
|
# loop: Custom netns configs
|
||||||
''
|
services.lightning-loop = mkIf config.services.lightning-loop.enable {
|
||||||
netns-exec nb-lightning-loop sudo -u lnd ${config.services.lightning-loop.package}/bin/loop "$@"
|
cli = pkgs.writeScriptBin "loop"
|
||||||
'';
|
# Switch user because lnd makes datadir contents readable by user only
|
||||||
};
|
''
|
||||||
})
|
netns-exec nb-lightning-loop sudo -u lnd ${config.services.lightning-loop.package}/bin/loop "$@"
|
||||||
# Custom netns config option values if netns-isolation not enabled
|
'';
|
||||||
(mkIf (!cfg.enable) {
|
};
|
||||||
# clightning
|
};
|
||||||
services.clightning.bind-addr = "127.0.0.1:${toString config.services.clightning.bindport}";
|
|
||||||
})
|
|
||||||
];
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -152,7 +152,11 @@ in {
|
||||||
enforceTor = true;
|
enforceTor = true;
|
||||||
always-use-proxy = true;
|
always-use-proxy = true;
|
||||||
};
|
};
|
||||||
services.tor.hiddenServices.clightning = mkIf cfg.clightning.enable (mkHiddenService { port = cfg.clightning.onionport; toHost = (builtins.head (builtins.split ":" cfg.clightning.bind-addr)); toPort = cfg.clightning.bindport; });
|
services.tor.hiddenServices.clightning = mkIf cfg.clightning.enable (mkHiddenService {
|
||||||
|
port = cfg.clightning.onionport;
|
||||||
|
toHost = cfg.clightning.bind-addr;
|
||||||
|
toPort = cfg.clightning.bindport;
|
||||||
|
});
|
||||||
|
|
||||||
# lnd
|
# lnd
|
||||||
services.lnd = {
|
services.lnd = {
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue