diff --git a/modules/presets/secure-node.nix b/modules/presets/secure-node.nix index 77b8ad2..29464a1 100644 --- a/modules/presets/secure-node.nix +++ b/modules/presets/secure-node.nix @@ -3,6 +3,8 @@ with lib; let + cfg = config.services; + mkHiddenService = map: { map = [ map ]; version = 3; @@ -46,7 +48,7 @@ in { enable = true; client.enable = true; # LND uses ControlPort to create onion services - controlPort = mkIf config.services.lnd.enable 9051; + controlPort = mkIf cfg.lnd.enable 9051; hiddenServices.sshd = mkHiddenService { port = 22; }; }; @@ -55,9 +57,9 @@ in { services.bitcoind = { enable = true; listen = true; - sysperms = if config.services.electrs.enable then true else null; - disablewallet = if config.services.electrs.enable then true else null; - proxy = config.services.tor.client.socksListenAddress; + sysperms = if cfg.electrs.enable then true else null; + disablewallet = if cfg.electrs.enable then true else null; + proxy = cfg.tor.client.socksListenAddress; enforceTor = true; port = 8333; zmqpubrawblock = "tcp://127.0.0.1:28332"; @@ -69,17 +71,17 @@ in { prune = 0; dbCache = 1000; }; - services.tor.hiddenServices.bitcoind = mkHiddenService { port = config.services.bitcoind.port; }; + services.tor.hiddenServices.bitcoind = mkHiddenService { port = cfg.bitcoind.port; }; # clightning services.clightning = { - bitcoin-rpcuser = config.services.bitcoind.rpcuser; - proxy = config.services.tor.client.socksListenAddress; + bitcoin-rpcuser = cfg.bitcoind.rpcuser; + proxy = cfg.tor.client.socksListenAddress; enforceTor = true; always-use-proxy = true; - bind-addr = "127.0.0.1:${toString config.services.clightning.onionport}"; + bind-addr = "127.0.0.1:${toString cfg.clightning.onionport}"; }; - services.tor.hiddenServices.clightning = mkHiddenService { port = config.services.clightning.onionport; }; + services.tor.hiddenServices.clightning = mkHiddenService { port = cfg.clightning.onionport; }; # lnd services.lnd.enforceTor = true; @@ -89,16 +91,16 @@ in { rpcuser = "liquidrpc"; prune = 1000; extraConfig = " - mainchainrpcuser=${config.services.bitcoind.rpcuser} + mainchainrpcuser=${cfg.bitcoind.rpcuser} mainchainrpcport=8332 "; validatepegin = true; listen = true; - proxy = config.services.tor.client.socksListenAddress; + proxy = cfg.tor.client.socksListenAddress; enforceTor = true; port = 7042; }; - services.tor.hiddenServices.liquidd = mkHiddenService { port = config.services.liquidd.port; }; + services.tor.hiddenServices.liquidd = mkHiddenService { port = cfg.liquidd.port; }; # electrs services.electrs = { @@ -108,8 +110,8 @@ in { TLSProxy.port = 50003; }; services.tor.hiddenServices.electrs = mkHiddenService { - port = config.services.electrs.onionport; - toPort = config.services.electrs.TLSProxy.port; + port = cfg.electrs.onionport; + toPort = cfg.electrs.TLSProxy.port; }; services.spark-wallet.onion-service = true; @@ -117,43 +119,41 @@ in { services.nix-bitcoin-webindex.enforceTor = true; - environment.systemPackages = with pkgs; with nix-bitcoin; let - s = config.services; - in + environment.systemPackages = with pkgs; with nix-bitcoin; [ tor bitcoind - (hiPrio s.bitcoind.cli) + (hiPrio cfg.bitcoind.cli) nodeinfo jq qrencode ] - ++ optionals s.clightning.enable [clightning (hiPrio s.clightning.cli)] - ++ optionals s.lnd.enable [lnd (hiPrio s.lnd.cli)] - ++ optionals s.lightning-charge.enable [lightning-charge] - ++ optionals s.nanopos.enable [nanopos] - ++ optionals s.nix-bitcoin-webindex.enable [nginx] - ++ optionals s.liquidd.enable [elementsd (hiPrio s.liquidd.cli) (hiPrio s.liquidd.swap-cli)] - ++ optionals s.spark-wallet.enable [spark-wallet] - ++ optionals s.electrs.enable [electrs] - ++ optionals (s.hardware-wallets.ledger || s.hardware-wallets.trezor) [ + ++ optionals cfg.clightning.enable [clightning (hiPrio cfg.clightning.cli)] + ++ optionals cfg.lnd.enable [lnd (hiPrio cfg.lnd.cli)] + ++ optionals cfg.lightning-charge.enable [lightning-charge] + ++ optionals cfg.nanopos.enable [nanopos] + ++ optionals cfg.nix-bitcoin-webindex.enable [nginx] + ++ optionals cfg.liquidd.enable [elementsd (hiPrio cfg.liquidd.cli) (hiPrio cfg.liquidd.swap-cli)] + ++ optionals cfg.spark-wallet.enable [spark-wallet] + ++ optionals cfg.electrs.enable [electrs] + ++ optionals (cfg.hardware-wallets.ledger || cfg.hardware-wallets.trezor) [ hwi # To allow debugging issues with lsusb usbutils ] - ++ optionals s.hardware-wallets.trezor [ + ++ optionals cfg.hardware-wallets.trezor [ python3.pkgs.trezor ]; # Create user operator which can use bitcoin-cli and lightning-cli users.users.operator = { isNormalUser = true; - extraGroups = [ config.services.bitcoind.group ] - ++ (optionals config.services.clightning.enable [ "clightning" ]) - ++ (optionals config.services.lnd.enable [ "lnd" ]) - ++ (optionals config.services.liquidd.enable [ config.services.liquidd.group ]) - ++ (optionals (config.services.hardware-wallets.ledger || config.services.hardware-wallets.trezor) - [ config.services.hardware-wallets.group ]); + extraGroups = [ cfg.bitcoind.group ] + ++ (optionals cfg.clightning.enable [ "clightning" ]) + ++ (optionals cfg.lnd.enable [ "lnd" ]) + ++ (optionals cfg.liquidd.enable [ cfg.liquidd.group ]) + ++ (optionals (cfg.hardware-wallets.ledger || cfg.hardware-wallets.trezor) + [ cfg.hardware-wallets.group ]); }; # Give operator access to onion hostnames services.onion-chef.enable = true; @@ -162,10 +162,10 @@ in { # Unfortunately c-lightning doesn't allow setting the permissions of the rpc socket # https://github.com/ElementsProject/lightning/issues/1366 security.sudo.configFile = - (optionalString config.services.clightning.enable '' + (optionalString cfg.clightning.enable '' operator ALL=(clightning) NOPASSWD: ALL '') + - (optionalString config.services.lnd.enable '' + (optionalString cfg.lnd.enable '' operator ALL=(lnd) NOPASSWD: ALL '');