greg
/
nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

lightning-loop: add certificate options `extraIPs` and `extraDomains` 

This is useful for non-local access to the lightning-loop REST server.
This commit is contained in:
Erik Arvstedt 2022-07-07 16:08:28 +02:00
parent edfbe700e7
commit c853f380d4
No known key found for this signature in database
GPG Key ID: 33312B944DD97846
2 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
modules/lightning-loop.nix
View File

@ -40,6 +40,26 @@ let
default = if cfg.tor.proxy then config.nix-bitcoin.torClientAddressWithPort else null;
description = "host:port of SOCKS5 proxy for connnecting to the loop server.";
};
certificate = {
extraIPs = mkOption {
type = with types; listOf str;
default = [];
example = [ "60.100.0.1" ];
description = ''
Extra `subjectAltName` IPs added to the certificate.
This works the same as loop option `tlsextraip`.
'';
};
extraDomains = mkOption {
type = with types; listOf str;
default = [];
example = [ "example.com" ];
description = ''
Extra `subjectAltName` domain names added to the certificate.
This works the same as loop option `tlsextradomain`.
'';
};
};
extraConfig = mkOption {
type = types.lines;
default = "";
@ -101,6 +121,8 @@ in {
"d '${cfg.dataDir}' 0770 ${lnd.user} ${lnd.group} - -"
];
services.lightning-loop.certificate.extraIPs = mkIf (cfg.rpcAddress != "localhost") [ "${cfg.rpcAddress}" ];
systemd.services.lightning-loop = {
wantedBy = [ "multi-user.target" ];
requires = [ "lnd.service" ];
@ -119,7 +141,7 @@ in {
loop-cert.user = lnd.user;
};
nix-bitcoin.generateSecretsCmds.lightning-loop = ''
makeCert loop '${optionalString (cfg.rpcAddress != "localhost") "IP:${cfg.rpcAddress}"}'
makeCert loop '${nbLib.mkCertExtraAltNames cfg.certificate}'
'';
};
}

1
test/tests.nix
View File

@ -100,6 +100,7 @@ let
tests.lndconnect-onion-clightning = cfg.clightning-rest.lndconnectOnion.enable;
tests.lightning-loop = cfg.lightning-loop.enable;
services.lightning-loop.certificate.extraIPs = [ "20.0.0.1" ];
tests.lightning-pool = cfg.lightning-pool.enable;
nix-bitcoin.onionServices.lnd.public = true;