services: add names for systemd helper scripts

The systemd journal now shows a specific script name instead of
the generic name "script" before script output.

modules/joinmarket.nix

@@ -168,14 +168,15 @@ in {
       after = [ "bitcoind.service" ];
       path = [ pkgs.sudo ];
       serviceConfig = nbLib.defaultHardening // {
-        ExecStartPre = nbLib.privileged ''
+        ExecStartPre = nbLib.privileged "joinmarket-create-config" ''
           install -o '${cfg.user}' -g '${cfg.group}' -m 640 ${configFile} ${cfg.dataDir}/joinmarket.cfg
           sed -i \
              "s|@@RPC_PASSWORD@@|rpc_password = $(cat ${secretsDir}/bitcoin-rpcpassword-privileged)|" \
              '${cfg.dataDir}/joinmarket.cfg'
         '';
         # Generating wallets (jmclient/wallet.py) is only supported for mainnet or testnet
-        ExecStartPost = mkIf (bitcoind.network == "mainnet") (nbLib.privileged ''
+        ExecStartPost = mkIf (bitcoind.network == "mainnet")
+          (nbLib.privileged "joinmarket-create-wallet" ''
             walletname=wallet.jmdat
             wallet=${cfg.dataDir}/wallets/$walletname
             if [[ ! -f $wallet ]]; then

modules/lnd.nix

@@ -190,7 +190,7 @@ in {
           restUrl = "https://${cfg.restAddress}:${toString cfg.restPort}/v1";
         in [
           # Run fully privileged for secrets dir write access
-          "+${nbLib.script ''
+          (nbLib.privileged "lnd-create-mnemonic" ''
             attempts=250
             while ! { exec 3>/dev/tcp/${cfg.restAddress}/${toString cfg.restPort} && exec 3>&-; } &>/dev/null; do
                   ((attempts-- == 0)) && { echo "lnd REST service unreachable"; exit 1; }
@@ -206,8 +206,8 @@ in {
                 -X GET ${restUrl}/genseed | ${pkgs.jq}/bin/jq -c '.cipher_seed_mnemonic' > "$mnemonic"
             fi
             chown lnd: "$mnemonic"
-          ''}"
-          "${nbLib.script ''
+          '')
+          (nbLib.script "lnd-create-wallet" ''
             if [[ ! -f ${networkDir}/wallet.db ]]; then
               echo Create lnd wallet
 
@@ -240,7 +240,7 @@ in {
 
           '')
           # Run fully privileged for chown
-          "+${nbLib.script ''
+          (nbLib.privileged "lnd-create-macaroons" ''
             umask ug=r,o=
             ${lib.concatMapStrings (macaroon: ''
               echo "Create custom macaroon ${macaroon}"
@@ -254,7 +254,7 @@ in {
                 ${pkgs.jq}/bin/jq -c '.macaroon' | ${pkgs.xxd}/bin/xxd -p -r > "$macaroonPath"
               chown ${cfg.macaroons.${macaroon}.user}: "$macaroonPath"
             '') (attrNames cfg.macaroons)}
-          ''}"
+          '')
         ];
       } // (if cfg.enforceTor
           then nbLib.allowTor

pkgs/lib.nix

@@ -52,13 +52,13 @@ let self = {
     '';
   };
 
-  script = src: pkgs.writers.writeBash "script" ''
+  script = name: src: pkgs.writers.writeBash name ''
     set -eo pipefail
     ${src}
   '';
 
   # Used for ExecStart*
-  privileged = src: "+${self.script src}";
+  privileged = name: src: "+${self.script name src}";
 
   cliExec = mkOption {
     # Used by netns-isolation to execute the cli in the service's private netns