From a26ed03d7780ffd8e04079cb938a2f17d0680057 Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Wed, 3 Feb 2021 22:44:41 +0100 Subject: [PATCH] rename nix-bitcoin-services.nix -> lib.nix --- README.md | 2 +- modules/bitcoind.nix | 16 ++++++++-------- modules/btcpayserver.nix | 18 +++++++++--------- modules/clightning.nix | 10 +++++----- modules/electrs.nix | 10 +++++----- modules/joinmarket-ob-watcher.nix | 6 +++--- modules/joinmarket.nix | 16 ++++++++-------- modules/lightning-loop.nix | 10 +++++----- modules/liquid.nix | 10 +++++----- modules/lnd.nix | 18 +++++++++--------- modules/modules.nix | 10 +++++----- modules/onion-addresses.nix | 4 ++-- modules/recurring-donations.nix | 10 +++++----- modules/spark-wallet.nix | 12 ++++++------ .../nix-bitcoin-services.nix => pkgs/lib.nix | 10 +++++----- 15 files changed, 81 insertions(+), 81 deletions(-) rename modules/nix-bitcoin-services.nix => pkgs/lib.nix (92%) diff --git a/README.md b/README.md index e98cd28..e8817b5 100644 --- a/README.md +++ b/README.md @@ -82,7 +82,7 @@ Security --- * **Simplicity:** Only services you select in `configuration.nix` and their dependencies are installed, packages and dependencies are [pinned](pkgs/nixpkgs-pinned.nix), most packages are built from the [NixOS stable channel](https://github.com/NixOS/nixpkgs/tree/nixos-20.09), with a few exceptions that are built from the nixpkgs unstable channel, builds happen in a [sandboxed environment](https://nixos.org/manual/nix/stable/#conf-sandbox), code is continuously reviewed and refined. * **Integrity:** Nix package manager, NixOS and packages can be built from source to reduce reliance on binary caches, nix-bitcoin merge commits are signed, all commits are approved by multiple nix-bitcoin developers, upstream packages are cryptographically verified where possible, we use this software ourselves. -* **Principle of Least Privilege:** Services operate with least privileges; they each have their own user and are restricted further with [systemd options](modules/nix-bitcoin-services.nix), [RPC whitelisting](modules/bitcoind-rpc-public-whitelist.nix), and [netns-isolation](modules/netns-isolation.nix). There's a non-root user *operator* to interact with the various services. +* **Principle of Least Privilege:** Services operate with least privileges; they each have their own user and are restricted further with [systemd options](pkgs/lib.nix), [RPC whitelisting](modules/bitcoind-rpc-public-whitelist.nix), and [netns-isolation](modules/netns-isolation.nix). There's a non-root user *operator* to interact with the various services. * **Defense-in-depth:** nix-bitcoin is built with a [hardened kernel](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/hardened.nix) by default, services are confined through discretionary access control, Linux namespaces, [dbus firewall](modules/security.nix) and seccomp-bpf with continuous improvements. Note that if the machine you're deploying *from* is insecure, there is nothing nix-bitcoin can do to protect itself. diff --git a/modules/bitcoind.nix b/modules/bitcoind.nix index 7518606..af84cc8 100644 --- a/modules/bitcoind.nix +++ b/modules/bitcoind.nix @@ -4,7 +4,7 @@ with lib; let cfg = config.services.bitcoind; - inherit (config) nix-bitcoin-services; + nbLib = config.nix-bitcoin.lib; secretsDir = config.nix-bitcoin.secretsDir; configFile = pkgs.writeText "bitcoin.conf" '' @@ -291,7 +291,7 @@ in { ''; description = "Binary to connect with the bitcoind instance."; }; - enforceTor = nix-bitcoin-services.enforceTor; + enforceTor = nbLib.enforceTor; }; }; @@ -348,7 +348,7 @@ in { install -o '${cfg.user}' -g '${cfg.group}' -m 640 <(echo "$cfg") $confFile fi ''; - serviceConfig = nix-bitcoin-services.defaultHardening // { + serviceConfig = nbLib.defaultHardening // { Type = "notify"; NotifyAccess = "all"; User = "${cfg.user}"; @@ -359,9 +359,9 @@ in { UMask = mkIf cfg.dataDirReadableByGroup "0027"; ReadWritePaths = "${cfg.dataDir}"; } // (if cfg.enforceTor - then nix-bitcoin-services.allowTor - else nix-bitcoin-services.allowAnyIP) - // optionalAttrs (cfg.zmqpubrawblock != null || cfg.zmqpubrawtx != null) nix-bitcoin-services.allowAnyProtocol; + then nbLib.allowTor + else nbLib.allowAnyIP) + // optionalAttrs (cfg.zmqpubrawblock != null || cfg.zmqpubrawtx != null) nbLib.allowAnyProtocol; }; # Use this to update the banlist: @@ -382,11 +382,11 @@ in { fi done ''; - serviceConfig = nix-bitcoin-services.defaultHardening // { + serviceConfig = nbLib.defaultHardening // { User = "${cfg.user}"; Group = "${cfg.group}"; ReadWritePaths = "${cfg.dataDir}"; - } // nix-bitcoin-services.allowTor; + } // nbLib.allowTor; }; users.users.${cfg.user} = { diff --git a/modules/btcpayserver.nix b/modules/btcpayserver.nix index 3600930..b663132 100644 --- a/modules/btcpayserver.nix +++ b/modules/btcpayserver.nix @@ -4,7 +4,7 @@ with lib; let cfg = config.services; - inherit (config) nix-bitcoin-services; + nbLib = config.nix-bitcoin.lib; nbPkgs = config.nix-bitcoin.pkgs; in { options.services = { @@ -44,7 +44,7 @@ in { internal = true; default = cfg.btcpayserver.enable; }; - enforceTor = nix-bitcoin-services.enforceTor; + enforceTor = nbLib.enforceTor; }; btcpayserver = { @@ -90,7 +90,7 @@ in { example = "btcpayserver"; description = "The prefix for root-relative btcpayserver URLs."; }; - enforceTor = nix-bitcoin-services.enforceTor; + enforceTor = nbLib.enforceTor; }; }; @@ -132,7 +132,7 @@ in { echo "btcrpcpassword=$(cat ${config.nix-bitcoin.secretsDir}/bitcoin-rpcpassword-btcpayserver)" \ >> '${cfg.nbxplorer.dataDir}/settings.config' ''; - serviceConfig = nix-bitcoin-services.defaultHardening // { + serviceConfig = nbLib.defaultHardening // { ExecStart = '' ${cfg.nbxplorer.package}/bin/nbxplorer --conf=${cfg.nbxplorer.dataDir}/settings.config \ --datadir=${cfg.nbxplorer.dataDir} @@ -143,8 +143,8 @@ in { ReadWritePaths = cfg.nbxplorer.dataDir; MemoryDenyWriteExecute = "false"; } // (if cfg.nbxplorer.enforceTor - then nix-bitcoin-services.allowTor - else nix-bitcoin-services.allowAnyIP + then nbLib.allowTor + else nbLib.allowAnyIP ); }; @@ -181,7 +181,7 @@ in { } >> ${cfg.btcpayserver.dataDir}/settings.config ''} ''; - serviceConfig = nix-bitcoin-services.defaultHardening // { + serviceConfig = nbLib.defaultHardening // { ExecStart = '' ${cfg.btcpayserver.package}/bin/btcpayserver --conf=${cfg.btcpayserver.dataDir}/settings.config \ --datadir=${cfg.btcpayserver.dataDir} @@ -192,8 +192,8 @@ in { ReadWritePaths = cfg.btcpayserver.dataDir; MemoryDenyWriteExecute = "false"; } // (if cfg.btcpayserver.enforceTor - then nix-bitcoin-services.allowTor - else nix-bitcoin-services.allowAnyIP + then nbLib.allowTor + else nbLib.allowAnyIP ); }; in self; diff --git a/modules/clightning.nix b/modules/clightning.nix index 544782b..d8838ec 100644 --- a/modules/clightning.nix +++ b/modules/clightning.nix @@ -4,7 +4,7 @@ with lib; let cfg = config.services.clightning; - inherit (config) nix-bitcoin-services; + nbLib = config.nix-bitcoin.lib; nbPkgs = config.nix-bitcoin.pkgs; network = config.services.bitcoind.makeNetworkName "bitcoin" "regtest"; configFile = pkgs.writeText "config" '' @@ -91,7 +91,7 @@ in { If left empty, no address is announced. ''; }; - inherit (nix-bitcoin-services) enforceTor; + inherit (nbLib) enforceTor; }; config = mkIf cfg.enable { @@ -135,15 +135,15 @@ in { } >> '${cfg.dataDir}/config' ''; - serviceConfig = nix-bitcoin-services.defaultHardening // { + serviceConfig = nbLib.defaultHardening // { ExecStart = "${nbPkgs.clightning}/bin/lightningd --lightning-dir=${cfg.dataDir}"; User = "${cfg.user}"; Restart = "on-failure"; RestartSec = "10s"; ReadWritePaths = "${cfg.dataDir}"; } // (if cfg.enforceTor - then nix-bitcoin-services.allowTor - else nix-bitcoin-services.allowAnyIP + then nbLib.allowTor + else nbLib.allowAnyIP ); # Wait until the rpc socket appears postStart = '' diff --git a/modules/electrs.nix b/modules/electrs.nix index 5d03c10..a2c8102 100644 --- a/modules/electrs.nix +++ b/modules/electrs.nix @@ -3,7 +3,7 @@ with lib; let cfg = config.services.electrs; - inherit (config) nix-bitcoin-services; + nbLib = config.nix-bitcoin.lib; secretsDir = config.nix-bitcoin.secretsDir; bitcoind = config.services.bitcoind; in { @@ -51,7 +51,7 @@ in { default = ""; description = "Extra command line arguments passed to electrs."; }; - enforceTor = nix-bitcoin-services.enforceTor; + enforceTor = nbLib.enforceTor; }; config = mkIf cfg.enable { @@ -76,7 +76,7 @@ in { echo "cookie = \"${bitcoind.rpc.users.public.name}:$(cat ${secretsDir}/bitcoin-rpcpassword-public)\"" \ > electrs.toml ''; - serviceConfig = nix-bitcoin-services.defaultHardening // { + serviceConfig = nbLib.defaultHardening // { RuntimeDirectory = "electrs"; RuntimeDirectoryMode = "700"; WorkingDirectory = "/run/electrs"; @@ -104,8 +104,8 @@ in { RestartSec = "10s"; ReadWritePaths = "${cfg.dataDir} ${if cfg.high-memory then "${bitcoind.dataDir}" else ""}"; } // (if cfg.enforceTor - then nix-bitcoin-services.allowTor - else nix-bitcoin-services.allowAnyIP + then nbLib.allowTor + else nbLib.allowAnyIP ); }; diff --git a/modules/joinmarket-ob-watcher.nix b/modules/joinmarket-ob-watcher.nix index e65bd7d..e8b2a30 100644 --- a/modules/joinmarket-ob-watcher.nix +++ b/modules/joinmarket-ob-watcher.nix @@ -3,7 +3,7 @@ with lib; let cfg = config.services.joinmarket-ob-watcher; - inherit (config) nix-bitcoin-services; + nbLib = config.nix-bitcoin.lib; nbPkgs = config.nix-bitcoin.pkgs; torAddress = builtins.head (builtins.split ":" config.services.tor.client.socksListenAddress); configFile = builtins.toFile "config" '' @@ -76,7 +76,7 @@ in { preStart = '' ln -snf ${configFile} ${cfg.dataDir}/joinmarket.cfg ''; - serviceConfig = nix-bitcoin-services.defaultHardening // rec { + serviceConfig = nbLib.defaultHardening // rec { StateDirectory = "joinmarket-ob-watcher"; StateDirectoryMode = "0770"; WorkingDirectory = "${cfg.dataDir}"; # The service creates dir 'logs' in the working dir @@ -87,7 +87,7 @@ in { User = cfg.user; Restart = "on-failure"; RestartSec = "10s"; - } // nix-bitcoin-services.allowTor; + } // nbLib.allowTor; }; users.users.${cfg.user} = { diff --git a/modules/joinmarket.nix b/modules/joinmarket.nix index d1c2367..ccdc8cb 100644 --- a/modules/joinmarket.nix +++ b/modules/joinmarket.nix @@ -4,7 +4,7 @@ with lib; let cfg = config.services.joinmarket; - inherit (config) nix-bitcoin-services; + nbLib = config.nix-bitcoin.lib; nbPkgs = config.nix-bitcoin.pkgs; secretsDir = config.nix-bitcoin.secretsDir; @@ -137,7 +137,7 @@ in { readOnly = true; default = true; }; - inherit (nix-bitcoin-services) cliExec; + inherit (nbLib) cliExec; }; config = mkIf cfg.enable (mkMerge [{ @@ -177,15 +177,15 @@ in { requires = [ "bitcoind.service" ]; after = [ "bitcoind.service" ]; path = [ pkgs.sudo ]; - serviceConfig = nix-bitcoin-services.defaultHardening // { - ExecStartPre = nix-bitcoin-services.privileged '' + serviceConfig = nbLib.defaultHardening // { + ExecStartPre = nbLib.privileged '' install -o '${cfg.user}' -g '${cfg.group}' -m 640 ${configFile} ${cfg.dataDir}/joinmarket.cfg sed -i \ "s|@@RPC_PASSWORD@@|rpc_password = $(cat ${secretsDir}/bitcoin-rpcpassword-privileged)|" \ '${cfg.dataDir}/joinmarket.cfg' ''; # Generating wallets (jmclient/wallet.py) is only supported for mainnet or testnet - ExecStartPost = mkIf (bitcoind.network == "mainnet") (nix-bitcoin-services.privileged '' + ExecStartPost = mkIf (bitcoind.network == "mainnet") (nbLib.privileged '' walletname=wallet.jmdat pw=$(cat "${secretsDir}"/jm-wallet-password) mnemonic=${secretsDir}/jm-wallet-seed @@ -207,7 +207,7 @@ in { Restart = "on-failure"; RestartSec = "10s"; ReadWritePaths = "${cfg.dataDir}"; - } // nix-bitcoin-services.allowTor; + } // nbLib.allowTor; }; nix-bitcoin.secrets.jm-wallet-password.user = cfg.user; @@ -239,14 +239,14 @@ in { pw=$(cat "${secretsDir}"/jm-wallet-password) echo "echo -n $pw | ${start}" > $RUNTIME_DIRECTORY/start ''; - serviceConfig = nix-bitcoin-services.defaultHardening // rec { + serviceConfig = nbLib.defaultHardening // rec { RuntimeDirectory = "joinmarket-yieldgenerator"; # Only used to create start script RuntimeDirectoryMode = "700"; WorkingDirectory = "${cfg.dataDir}"; # The service creates dir 'logs' in the working dir ExecStart = "${pkgs.bash}/bin/bash /run/${RuntimeDirectory}/start"; User = "${cfg.user}"; ReadWritePaths = "${cfg.dataDir}"; - } // nix-bitcoin-services.allowTor; + } // nbLib.allowTor; }; }) ]); diff --git a/modules/lightning-loop.nix b/modules/lightning-loop.nix index 37d9448..fd87b19 100644 --- a/modules/lightning-loop.nix +++ b/modules/lightning-loop.nix @@ -4,7 +4,7 @@ with lib; let cfg = config.services.lightning-loop; - inherit (config) nix-bitcoin-services; + nbLib = config.nix-bitcoin.lib; secretsDir = config.nix-bitcoin.secretsDir; network = config.services.bitcoind.network; rpclisten = "${cfg.rpcAddress}:${toString cfg.rpcPort}"; @@ -80,7 +80,7 @@ in { ''; description = "Binary to connect with the lightning-loop instance."; }; - enforceTor = nix-bitcoin-services.enforceTor; + enforceTor = nbLib.enforceTor; }; config = mkIf cfg.enable { @@ -96,15 +96,15 @@ in { wantedBy = [ "multi-user.target" ]; requires = [ "lnd.service" ]; after = [ "lnd.service" ]; - serviceConfig = nix-bitcoin-services.defaultHardening // { + serviceConfig = nbLib.defaultHardening // { ExecStart = "${cfg.package}/bin/loopd --configfile=${configFile}"; User = "lnd"; Restart = "on-failure"; RestartSec = "10s"; ReadWritePaths = "${cfg.dataDir}"; } // (if cfg.enforceTor - then nix-bitcoin-services.allowTor - else nix-bitcoin-services.allowAnyIP); + then nbLib.allowTor + else nbLib.allowAnyIP); }; nix-bitcoin.secrets = { diff --git a/modules/liquid.nix b/modules/liquid.nix index 6e83321..26b9e5a 100644 --- a/modules/liquid.nix +++ b/modules/liquid.nix @@ -4,7 +4,7 @@ with lib; let cfg = config.services.liquidd; - inherit (config) nix-bitcoin-services; + nbLib = config.nix-bitcoin.lib; nbPkgs = config.nix-bitcoin.pkgs; secretsDir = config.nix-bitcoin.secretsDir; pidFile = "${cfg.dataDir}/liquidd.pid"; @@ -203,7 +203,7 @@ in { ''; description = "Binary for managing liquid swaps."; }; - enforceTor = nix-bitcoin-services.enforceTor; + enforceTor = nbLib.enforceTor; }; }; @@ -232,7 +232,7 @@ in { echo "rpcpassword=$(cat ${secretsDir}/liquid-rpcpassword)" >> '${cfg.dataDir}/elements.conf' echo "mainchainrpcpassword=$(cat ${secretsDir}/bitcoin-rpcpassword-public)" >> '${cfg.dataDir}/elements.conf' ''; - serviceConfig = nix-bitcoin-services.defaultHardening // { + serviceConfig = nbLib.defaultHardening // { Type = "simple"; User = "${cfg.user}"; Group = "${cfg.group}"; @@ -241,8 +241,8 @@ in { Restart = "on-failure"; ReadWritePaths = "${cfg.dataDir}"; } // (if cfg.enforceTor - then nix-bitcoin-services.allowTor - else nix-bitcoin-services.allowAnyIP + then nbLib.allowTor + else nbLib.allowAnyIP ); }; diff --git a/modules/lnd.nix b/modules/lnd.nix index e8fb9c7..4899dac 100644 --- a/modules/lnd.nix +++ b/modules/lnd.nix @@ -4,7 +4,7 @@ with lib; let cfg = config.services.lnd; - inherit (config) nix-bitcoin-services; + nbLib = config.nix-bitcoin.lib; secretsDir = config.nix-bitcoin.secretsDir; bitcoind = config.services.bitcoind; @@ -144,7 +144,7 @@ in { If left empty, no address is announced. ''; }; - inherit (nix-bitcoin-services) enforceTor; + inherit (nbLib) enforceTor; }; config = mkIf cfg.enable { @@ -186,7 +186,7 @@ in { ''} } >> '${cfg.dataDir}/lnd.conf' ''; - serviceConfig = nix-bitcoin-services.defaultHardening // { + serviceConfig = nbLib.defaultHardening // { RuntimeDirectory = "lnd"; # Only used to store custom macaroons RuntimeDirectoryMode = "711"; ExecStart = "${cfg.package}/bin/lnd --configfile=${cfg.dataDir}/lnd.conf"; @@ -198,7 +198,7 @@ in { restUrl = "https://${cfg.restAddress}:${toString cfg.restPort}/v1"; in [ # Run fully privileged for secrets dir write access - "+${nix-bitcoin-services.script '' + "+${nbLib.script '' attempts=250 while ! { exec 3>/dev/tcp/${cfg.restAddress}/${toString cfg.restPort} && exec 3>&-; } &>/dev/null; do ((attempts-- == 0)) && { echo "lnd REST service unreachable"; exit 1; } @@ -215,7 +215,7 @@ in { fi chown lnd: "$mnemonic" ''}" - "${nix-bitcoin-services.script '' + "${nbLib.script '' if [[ ! -f ${networkDir}/wallet.db ]]; then echo Create lnd wallet @@ -248,7 +248,7 @@ in { ''}" # Run fully privileged for chown - "+${nix-bitcoin-services.script '' + "+${nbLib.script '' umask ug=r,o= ${lib.concatMapStrings (macaroon: '' echo "Create custom macaroon ${macaroon}" @@ -265,9 +265,9 @@ in { ''}" ]; } // (if cfg.enforceTor - then nix-bitcoin-services.allowTor - else nix-bitcoin-services.allowAnyIP - ) // nix-bitcoin-services.allowAnyProtocol; # For ZMQ + then nbLib.allowTor + else nbLib.allowAnyIP + ) // nbLib.allowAnyProtocol; # For ZMQ }; users.users.lnd = { diff --git a/modules/modules.nix b/modules/modules.nix index 6ca7e18..3372e30 100644 --- a/modules/modules.nix +++ b/modules/modules.nix @@ -35,17 +35,17 @@ with lib; disabledModules = [ "services/networking/bitcoind.nix" ]; options = { - nix-bitcoin-services = mkOption { - readOnly = true; - default = import ./nix-bitcoin-services.nix lib pkgs; - }; - nix-bitcoin = { pkgs = mkOption { type = types.attrs; default = (import ../pkgs { inherit pkgs; }).modulesPkgs; }; + lib = mkOption { + readOnly = true; + default = import ../pkgs/lib.nix lib pkgs; + }; + # Torify binary that works with custom Tor SOCKS addresses # Related issue: https://github.com/NixOS/nixpkgs/issues/94236 torify = mkOption { diff --git a/modules/onion-addresses.nix b/modules/onion-addresses.nix index df9c9dc..64cda59 100644 --- a/modules/onion-addresses.nix +++ b/modules/onion-addresses.nix @@ -10,7 +10,7 @@ with lib; let cfg = config.nix-bitcoin.onionAddresses; - inherit (config) nix-bitcoin-services; + nbLib = config.nix-bitcoin.lib; in { options.nix-bitcoin.onionAddresses = { access = mkOption { @@ -47,7 +47,7 @@ in { wantedBy = [ "tor.service" ]; bindsTo = [ "tor.service" ]; after = [ "tor.service" ]; - serviceConfig = nix-bitcoin-services.defaultHardening // { + serviceConfig = nbLib.defaultHardening // { Type = "oneshot"; RemainAfterExit = true; StateDirectory = "onion-addresses"; diff --git a/modules/recurring-donations.nix b/modules/recurring-donations.nix index 93ae7b5..84ebea9 100644 --- a/modules/recurring-donations.nix +++ b/modules/recurring-donations.nix @@ -4,7 +4,7 @@ with lib; let cfg = config.services.recurring-donations; - inherit (config) nix-bitcoin-services; + nbLib = config.nix-bitcoin.lib; recurring-donations-script = pkgs.writeScript "recurring-donations.sh" '' LNCLI="${config.nix-bitcoin.pkgs.clightning}/bin/lightning-cli --lightning-dir=${config.services.clightning.dataDir}" pay_tallycoin() { @@ -75,7 +75,7 @@ in { Random delay to add to scheduled time for donation. Default is one day. ''; }; - enforceTor = nix-bitcoin-services.enforceTor; + enforceTor = nbLib.enforceTor; }; config = mkIf cfg.enable { @@ -93,13 +93,13 @@ in { requires = [ "clightning.service" ]; after = [ "clightning.service" ]; path = with pkgs; [ nix-bitcoin.clightning curl sudo jq ]; - serviceConfig = nix-bitcoin-services.defaultHardening // { + serviceConfig = nbLib.defaultHardening // { ExecStart = "${pkgs.bash}/bin/bash ${recurring-donations-script}"; User = "recurring-donations"; Type = "oneshot"; } // (if cfg.enforceTor - then nix-bitcoin-services.allowTor - else nix-bitcoin-services.allowAnyIP); + then nbLib.allowTor + else nbLib.allowAnyIP); }; systemd.timers.recurring-donations = { requires = [ "clightning.service" ]; diff --git a/modules/spark-wallet.nix b/modules/spark-wallet.nix index a130dd2..3a46f89 100644 --- a/modules/spark-wallet.nix +++ b/modules/spark-wallet.nix @@ -4,7 +4,7 @@ with lib; let cfg = config.services.spark-wallet; - inherit (config) nix-bitcoin-services; + nbLib = config.nix-bitcoin.lib; # Use wasabi rate provider because the default (bitstamp) doesn't accept # connections through Tor @@ -54,7 +54,7 @@ in { encodes an URL for accessing the web interface. ''; }; - inherit (nix-bitcoin-services) enforceTor; + inherit (nbLib) enforceTor; }; config = mkIf cfg.enable { @@ -73,14 +73,14 @@ in { requires = [ "clightning.service" ]; after = [ "clightning.service" ]; script = startScript; - serviceConfig = nix-bitcoin-services.defaultHardening // { + serviceConfig = nbLib.defaultHardening // { User = "spark-wallet"; Restart = "on-failure"; RestartSec = "10s"; } // (if cfg.enforceTor - then nix-bitcoin-services.allowTor - else nix-bitcoin-services.allowAnyIP) - // nix-bitcoin-services.nodejs; + then nbLib.allowTor + else nbLib.allowAnyIP) + // nbLib.nodejs; }; nix-bitcoin.secrets.spark-wallet-login.user = "spark-wallet"; }; diff --git a/modules/nix-bitcoin-services.nix b/pkgs/lib.nix similarity index 92% rename from modules/nix-bitcoin-services.nix rename to pkgs/lib.nix index 24d0099..75409bf 100644 --- a/modules/nix-bitcoin-services.nix +++ b/pkgs/lib.nix @@ -1,9 +1,9 @@ -# See `man systemd.exec` and `man systemd.resource-control` for an explanation -# of the various systemd options available through this module. - lib: pkgs: with lib; + +# See `man systemd.exec` and `man systemd.resource-control` for an explanation +# of the systemd-related options available through this module. let self = { # These settings roughly follow systemd's "strict" security profile defaultHardening = { @@ -46,8 +46,8 @@ let self = { type = types.bool; default = false; description = '' - "Whether to force Tor on a service by only allowing connections from and - to 127.0.0.1;"; + Whether to force Tor on a service by only allowing connections from and + to 127.0.0.1; ''; };