From 81a04a4ef14f27f196d519ff482f0d6a225f02b0 Mon Sep 17 00:00:00 2001
From: nixbitcoin <nixbitcoin@i2pmail.org>
Date: Mon, 18 May 2020 14:32:17 +0000
Subject: [PATCH] lightning-charge: add dedicated user

---
 modules/lightning-charge.nix | 42 +++++++++++++++++++++++++-----------
 1 file changed, 30 insertions(+), 12 deletions(-)

diff --git a/modules/lightning-charge.nix b/modules/lightning-charge.nix
index 9566402..0da37c3 100644
--- a/modules/lightning-charge.nix
+++ b/modules/lightning-charge.nix
@@ -5,6 +5,8 @@ with lib;
 let
   cfg = config.services.lightning-charge;
   inherit (config) nix-bitcoin-services;
+  user = config.users.users.lightning-charge.name;
+  group = config.users.users.lightning-charge.group;
 in {
   options.services.lightning-charge = {
     enable = mkOption {
@@ -14,35 +16,51 @@ in {
         If enabled, the lightning-charge service will be installed.
       '';
     };
-    clightning-datadir = mkOption {
-      type = types.str;
-      default = "/var/lib/clighting/";
-      description = ''
-        Data directory of the clightning service
-      '';
+    dataDir = mkOption {
+      type = types.path;
+      default = "/var/lib/lightning-charge";
+      description = "The data directory for lightning-charge.";
     };
   };
 
   config = mkIf cfg.enable {
+    users.users.lightning-charge = {
+      description = "lightning-charge User";
+      group = "lightning-charge";
+      extraGroups = [ "clightning" ];
+    };
+    users.groups.lightning-charge = {};
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.dataDir}' 0700 ${user} ${group} - -"
+    ];
+
     environment.systemPackages = [ pkgs.nix-bitcoin.lightning-charge ];
     systemd.services.lightning-charge = {
       description = "Run lightning-charge";
       wantedBy = [ "multi-user.target" ];
       requires = [ "clightning.service" ];
       after = [ "clightning.service" ];
+      preStart = ''
+        # Move existing lightning-charge.db
+        # TODO: Remove eventually
+        if [[ -e ${config.services.clightning.dataDir}/lightning-charge.db ]]; then
+          mv ${config.services.clightning.dataDir}/lightning-charge.db ${cfg.dataDir}/lightning-charge.db
+          chown ${user}: ${cfg.dataDir}/lightning-charge.db
+          chmod 600 ${cfg.dataDir}/lightning-charge.db
+        fi
+        '';
       serviceConfig = {
+          PermissionsStartOnly = "true";
           EnvironmentFile = "${config.nix-bitcoin.secretsDir}/lightning-charge-env";
-          ExecStart = "${pkgs.nix-bitcoin.lightning-charge}/bin/charged -l ${config.services.clightning.dataDir}/bitcoin -d ${config.services.clightning.dataDir}/lightning-charge.db";
-          # Unfortunately c-lightning doesn't allow setting the permissions of the rpc socket,
-          # so this must run as the clightning user
-          # https://github.com/ElementsProject/lightning/issues/1366
-          User = "clightning";
+          ExecStart = "${pkgs.nix-bitcoin.lightning-charge}/bin/charged -l ${config.services.clightning.dataDir}/bitcoin -d ${cfg.dataDir}/lightning-charge.db";
+          User = user;
           Restart = "on-failure";
           RestartSec = "10s";
       } // nix-bitcoin-services.defaultHardening
         // nix-bitcoin-services.nodejs
         // nix-bitcoin-services.allowTor;
     };
-    nix-bitcoin.secrets.lightning-charge-env.user = "clightning";
+    nix-bitcoin.secrets.lightning-charge-env.user = user;
   };
 }