From c853f380d43279813a8c4ae2a955f9cbf0bb7231 Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Thu, 7 Jul 2022 16:08:28 +0200 Subject: [PATCH] lightning-loop: add certificate options `extraIPs` and `extraDomains` This is useful for non-local access to the lightning-loop REST server. --- modules/lightning-loop.nix | 24 +++++++++++++++++++++++- test/tests.nix | 1 + 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/modules/lightning-loop.nix b/modules/lightning-loop.nix index 1a6bdc6..1bd526c 100644 --- a/modules/lightning-loop.nix +++ b/modules/lightning-loop.nix @@ -40,6 +40,26 @@ let default = if cfg.tor.proxy then config.nix-bitcoin.torClientAddressWithPort else null; description = "host:port of SOCKS5 proxy for connnecting to the loop server."; }; + certificate = { + extraIPs = mkOption { + type = with types; listOf str; + default = []; + example = [ "60.100.0.1" ]; + description = '' + Extra `subjectAltName` IPs added to the certificate. + This works the same as loop option `tlsextraip`. + ''; + }; + extraDomains = mkOption { + type = with types; listOf str; + default = []; + example = [ "example.com" ]; + description = '' + Extra `subjectAltName` domain names added to the certificate. + This works the same as loop option `tlsextradomain`. + ''; + }; + }; extraConfig = mkOption { type = types.lines; default = ""; @@ -101,6 +121,8 @@ in { "d '${cfg.dataDir}' 0770 ${lnd.user} ${lnd.group} - -" ]; + services.lightning-loop.certificate.extraIPs = mkIf (cfg.rpcAddress != "localhost") [ "${cfg.rpcAddress}" ]; + systemd.services.lightning-loop = { wantedBy = [ "multi-user.target" ]; requires = [ "lnd.service" ]; @@ -119,7 +141,7 @@ in { loop-cert.user = lnd.user; }; nix-bitcoin.generateSecretsCmds.lightning-loop = '' - makeCert loop '${optionalString (cfg.rpcAddress != "localhost") "IP:${cfg.rpcAddress}"}' + makeCert loop '${nbLib.mkCertExtraAltNames cfg.certificate}' ''; }; } diff --git a/test/tests.nix b/test/tests.nix index b10d016..7eccd08 100644 --- a/test/tests.nix +++ b/test/tests.nix @@ -100,6 +100,7 @@ let tests.lndconnect-onion-clightning = cfg.clightning-rest.lndconnectOnion.enable; tests.lightning-loop = cfg.lightning-loop.enable; + services.lightning-loop.certificate.extraIPs = [ "20.0.0.1" ]; tests.lightning-pool = cfg.lightning-pool.enable; nix-bitcoin.onionServices.lnd.public = true;