Commit Graph

805 Commits

Author SHA1 Message Date
nixbitcoin
3fbfa98635
service hardening: replace obtuse SystemCallFilter with @system-service
@system-service whitelist and additional
https://docs-stage.docker.com/engine/security/seccomp/#significant-syscalls-blocked-by-the-default-profile
blacklist.
2020-05-24 11:14:37 +00:00
nixbitcoin
e34d1c884e
service hardening: Add PrivateUsers
Exceptions in webindex & onion-chef
2020-05-22 16:16:19 +00:00
nixbitcoin
1c75543f2f
clightning: add user and group options 2020-05-22 16:16:17 +00:00
Erik Arvstedt
5f3f362451
lnd: add strict hardening
Add ProtectSystem=strict, remove PermissionStartOnly.

Extract the section of postStart that needs secrets dir write
access into a separate script with full privileges.

Simplify preStart and fix dataDir quoting.
2020-05-22 16:13:58 +00:00
nixbitcoin
a040e52854
All modules: ProtectSystem = strict
Add ReadWritePaths in all modules, except lnd which has ProtectSystem =
full.
2020-05-22 15:47:01 +00:00
nixbitcoin
adc71b892e
Remove PermissionStartOnly where possible and replace with bitcoinrpc
Remove PermissionsStartOnly for bitcoind and spark-wallet (it was never
needed there)

Give reason for PermissionsStartOnly in lightning-charge

Replace PermissionsStartOnly in clightning, electrs and liquid
2020-05-22 15:04:49 +00:00
nixbitcoin
91b6b2c370
All modules with preStart: Use systemd.tmpfiles.rules
This is NixOS' recommended way to setup service dirs
https://github.com/NixOS/nixpkgs/pull/56265. This commit hands off the
initial data directory creation to systemd.tmpfiles.rules. All other
preStart scripts are left intact to limit this changes' scope.
2020-05-22 14:54:39 +00:00
nixbitcoin
423ebf862b
lnd: only enable bitcoind zmqpub if lnd.enable
In conjuction with secure-node.nix, this sets sane
RestrictAddressFamilies unless lnd is enabled. Before, we were
constantly exposing unnecessary Address Families, not just when lnd is
enabled.

However, zmqpub* must always be enabled for lnd, even when used
outside of secure-node.nix, so we make this change in the lnd module.
2020-05-22 14:53:33 +00:00
nixbitcoin
81a1c3f908
service hardening: Add CapabilityBoundingSets
Whitelist with exceptions in webindex and onion-chef
2020-05-22 11:29:54 +00:00
nixbitcoin
3cd61506e0
webindex & onion-chef: Run non-network-facing services in PrivateNetwork 2020-05-22 11:29:07 +00:00
nixbitcoin
7c70dd43ac
All modules: Give service config precedence over defaultHardening
With '//' the latter takes precedence over the former in case of
equally named attributes.
2020-05-22 08:08:27 +00:00
Jonas Nick
0ac1e496b2
Merge #171: Hardening DAC
b8e10afe18 recurring-donations: Run under recurring-donations user (nixbitcoin)
5d01ea7101 nodeinfo: Convert to module and allow alternative operator username (nixbitcoin)
95d230d1d6 Remove bitcoinrpc group remnants (nixbitcoin)
563b210835 spark-wallet: Run under spark-wallet user (nixbitcoin)
205fca3576 bitcoind: only make blocksdir group-readable when dataDirReadableByGroup (nixbitcoin)
81a04a4ef1 lightning-charge: add dedicated user (nixbitcoin)
e67a818297 lightning-charge: 0.4.14 -> 0.4.19 (nixbitcoin)
0ba55757f8 clightning: allow group access to RPC socket (nixbitcoin)
304dd297ba clightning: remove config group read access (nixbitcoin)
04c6936ce9 clightning: Remove clightning "bitcoinrpc" membership (nixbitcoin)
393ab0fb3c electrs: Remove electrs user from "bitcoinrpc" and "bitcoin" sometimes (nixbitcoin)
7cfae66db4 electrs: Drop insecure TLS ciphers (nixbitcoin)
4c139a6d77 electrs: Make TLSProxy truly optional (nixbitcoin)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK b8e10afe18

Tree-SHA512: d3828961b42b8730818b6f55bd9cb19a9c1a1fcecc426da903ba1304251bb4b3b38ff0e4d7b29945ae1bf3c7a42719431b8c91b74b01aeb8d3671026c3d6df75
2020-05-19 12:25:00 +00:00
nixbitcoin
b8e10afe18
recurring-donations: Run under recurring-donations user 2020-05-19 11:13:26 +00:00
nixbitcoin
5d01ea7101
nodeinfo: Convert to module and allow alternative operator username
currently, nodeinfo has presets/secure-node.nix as a strict
dependency as it requires onion-chef and the 'operatorName' option.
and nix-bitcoin-webindex.nix has nodeinfo as a dependecy.

so don't add nodeinfo and webindex to modules.nix because they will fail on standalone use.
2020-05-19 11:13:24 +00:00
nixbitcoin
95d230d1d6
Remove bitcoinrpc group remnants 2020-05-19 11:13:22 +00:00
nixbitcoin
563b210835
spark-wallet: Run under spark-wallet user 2020-05-19 11:13:20 +00:00
nixbitcoin
205fca3576
bitcoind: only make blocksdir group-readable when dataDirReadableByGroup 2020-05-19 11:13:18 +00:00
nixbitcoin
81a04a4ef1
lightning-charge: add dedicated user 2020-05-19 11:13:16 +00:00
nixbitcoin
e67a818297
lightning-charge: 0.4.14 -> 0.4.19 2020-05-19 11:13:13 +00:00
nixbitcoin
0ba55757f8
clightning: allow group access to RPC socket 2020-05-19 11:13:12 +00:00
nixbitcoin
304dd297ba
clightning: remove config group read access 2020-05-19 11:13:05 +00:00
nixbitcoin
04c6936ce9
clightning: Remove clightning "bitcoinrpc" membership
Secrets are written to clightning config file during preStart with root
permissions because of PermissionsStartOnly.
2020-05-19 11:09:13 +00:00
nixbitcoin
393ab0fb3c
electrs: Remove electrs user from "bitcoinrpc" and "bitcoin" sometimes
Electrs does not need to be a part of "bitcoinrpc" group because preStart
electrs.toml creation is handled by PermissionsStartOnly. "bitcoin"
group membership is only necessary when cfg.high-memory is enabled and
electrs reads blocks directly from the blocks directory.
2020-05-19 11:08:59 +00:00
nixbitcoin
7cfae66db4
electrs: Drop insecure TLS ciphers 2020-05-19 11:08:52 +00:00
nixbitcoin
4c139a6d77
electrs: Make TLSProxy truly optional
If TLSProxy is disabled, bypass nginx by forwarding Tor HS traffic
directly to electrs.
2020-05-19 11:08:48 +00:00
Jonas Nick
ca7f287f6d
Merge #178: examples: execute bash sessions in script environment
0f1ee5f533 examples: improve shell session usability (Erik Arvstedt)
719dcd77bb examples: execute bash sessions in script environment (Erik Arvstedt)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK 0f1ee5f533

Tree-SHA512: efaa79b345628026543d3cd7c5449390707a189849d9b375604e319beaf8cd656e554e6097a5a317713713ebfae85464d05a469f12d9aa23d79c685232f1c5c9
2020-05-18 06:44:06 +00:00
Erik Arvstedt
0f1ee5f533
examples: improve shell session usability
- Add usage prompt when starting shell sessions

- Give all examples an uniform interface ("c") for running commands
  or starting a shell on the node.
2020-05-17 23:53:32 +02:00
Erik Arvstedt
719dcd77bb
examples: execute bash sessions in script environment
Previously, the sessions contained only explicitly exported variables
and functions.
This was fragile and in part buggy due to lacking exports.

Interactive features like user-defined aliases and functions are still
working as before.
2020-05-17 14:30:39 +02:00
Jonas Nick
e3a6ca3bb1
Merge #176: Update nixpkgs (lnd 0.10, clightning 0.8.2)
041af87ec1 Update nixpkgs (lnd 0.10, clightning 0.8.2) (Jonas Nick)

Pull request description:

ACKs for top commit:
  nixbitcoin:
    ACK 041af87ec1

Tree-SHA512: 8f3c98090d10cfe4b496cf92bd27d8aa32542d2b7599b8bedb57dd5fd7fcc6cda35a354aee6c151bebce0ae132df6e68d49d544f3349d9ba4fd778501d992e4e
2020-05-15 16:20:25 +00:00
Jonas Nick
041af87ec1
Update nixpkgs (lnd 0.10, clightning 0.8.2) 2020-05-14 22:16:41 +00:00
Jonas Nick
93ac1ac323
Merge #169: Update spark-wallet 0.2.13 -> 0.2.14
8b2ae9c1b7 spark-wallet: update 0.2.13 -> 0.2.14 (nixbitcoin)

Pull request description:

Top commit has no ACKs.

Tree-SHA512: 3f9189d20f21f9fb569d0819102817899436877a1291d69339604a098f15ef836a5072b0054960ec2cd6dfe35732f5f9fbe490c512dfa6266a65698fc5987f91
2020-05-11 07:55:25 +00:00
nixbitcoin
8b2ae9c1b7
spark-wallet: update 0.2.13 -> 0.2.14
Download shesek's github spark-npm.tgz, verify signature, unpack
spark-npm.tgz, patch package.json to include qrcode-terminal in
dependencies, run node2nix with tmpdir as local source, replace tmpdir
spark-wallet source with shesek's github spark-npm.tgz in
node-packages.nix.

spark-wallet: erikarvstedt fixups
2020-05-10 17:12:45 +02:00
Jonas Nick
7c35b93d53
Merge #173: fix syntax error
509fca5328 fix syntax error (Erik Arvstedt)

Pull request description:

ACKs for top commit:
  nixbitcoin:
    ACK 509fca5328

Tree-SHA512: 924677137216e842b65f4b7c80339ffded03e9a40678856a7372f8711b7e1c9103cde3ebd7ec57e11a2149541974cf83fa3d9458519c5b531acb6a310d9a23f3
2020-05-06 14:01:21 +00:00
Erik Arvstedt
509fca5328
fix syntax error
Fixes #172
2020-05-06 12:13:32 +02:00
Jonas Nick
ca2834a6a2
Merge #166: Update nixpkgs (stable 19.09 -> 20.03)
b9f07bf706 test: use older qemu version for travis compatibility (Erik Arvstedt)
026a22fcee use python testing from stable nixpkgs (Erik Arvstedt)
45de0d427d Travis: test electrs with unstable nixpkgs as well (Jonas Nick)
2d3a1e839e electrs: fix conditional cargoSha256 (Erik Arvstedt)
f5dbac318d nixops: fix format exception from upstream nixops (Jonas Nick)
c03ad1ccfa Update nixpkgs (stable 19.09 -> 20.03) (Jonas Nick)
b7047c7286 HWI: allow building with unstable nixpkgs (Jonas Nick)

Pull request description:

ACKs for top commit:
  nixbitcoin:
    ACK b9f07bf706

Tree-SHA512: 20766cdbe465d01b4d503e76741307a7fba403db575869c1f9cf401941b05d5afa7db735772ac235cf88a35b8e4ce49f888adfa5ee9891d4264b5ed570baaca9
2020-05-04 14:59:32 +00:00
Erik Arvstedt
b9f07bf706
test: use older qemu version for travis compatibility 2020-05-04 11:34:22 +00:00
Erik Arvstedt
026a22fcee
use python testing from stable nixpkgs 2020-05-04 11:34:05 +00:00
Jonas Nick
45de0d427d
Travis: test electrs with unstable nixpkgs as well 2020-05-03 18:32:56 +00:00
Erik Arvstedt
2d3a1e839e
electrs: fix conditional cargoSha256 2020-05-03 18:32:56 +00:00
Jonas Nick
f5dbac318d
nixops: fix format exception from upstream nixops
Without this our nixops doesn't build
2020-05-03 18:32:56 +00:00
Jonas Nick
c03ad1ccfa
Update nixpkgs (stable 19.09 -> 20.03) 2020-05-03 18:32:56 +00:00
Jonas Nick
b7047c7286
HWI: allow building with unstable nixpkgs 2020-05-03 18:32:49 +00:00
Jonas Nick
199b9bf315
Merge #156: Get electrs source tarball with gpg verified sha256 and corresponding helper script
1acb22a872 Get electrs source tarball with gpg verified sha256 and corresponding helper script (nixbitcoin)
707b06aed1 Update pinned nixpkgs (nixbitcoin)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK 1acb22a872

Tree-SHA512: 9664d7e8dbedbc7e6c4ccbf8059a4e6379ebeca46ae60da8ac22d424d53830435642a89bfb2a4ff988589e21c8e08d494d933923667f0634830eec4717f0c52a
2020-04-26 20:04:46 +00:00
Jonas Nick
176e4e7e62
Merge #159: Remove bitcoin, clightning, electrs, liquid user home directory
159f551b93 Remove bitcoin, clightning, electrs, liquid user home directory (nixbitcoin)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK 159f551b93

Tree-SHA512: 3c0f8611a75e92d178792097aa5cecf1c14ec95e29667fa6e3fe9047a77345ebdf1924bf9b92f58ded7d682be21a5b1316870b6e9c7ec19b1118b2e7dfe27ce6
2020-04-26 17:49:17 +00:00
nixbitcoin
1acb22a872
Get electrs source tarball with gpg verified sha256 and corresponding helper script
move script to pkg dir, add hint to script in pkg def

remove unneeded script deps

add extended bash error checking

rename DIR -> TMPDIR

remove TMPDIR on exit

strip whitespace, simplify comments

gpg2 -> gpg

latesttagelectrs -> latest

tmpdir: don't use XDG_RUNTIME_DIR

XDG_RUNTIME_DIR is often in RAM and shouldn't be used for larger
workloads like repo downlaods

verify fingerprint of the imported key

remove trailing '-' in output

simplify output

Hide --fetch-key output

Output is not relevant to user, looks better without it

More accurately describe ./get-sha256 function

User might think that ./get-sha256 automatically updates sha256 in default.nix

Fetch key from sks keyservers instead of keybase.io

Using --recv-key simplifies getting the right key, and only the
right key, greatly. I try to refrain from using sks keyservers,
but the certificate spamming attack shouldn't be an issue in this
case because we create a temporary keychain just for the
verificaiton.

remove unneeded cargoDepsHook

Make clang nativeBuildInput instead of buildInput
2020-04-26 17:02:14 +02:00
nixbitcoin
707b06aed1
Update pinned nixpkgs 2020-04-26 16:59:41 +02:00
nixbitcoin
159f551b93
Remove bitcoin, clightning, electrs, liquid user home directory 2020-04-26 14:08:08 +02:00
Jonas Nick
aee39d6549
Merge #165: Electrs fixes
e95f5981aa Remove KN countrycode (nixbitcoin)
742aef1e0f Only set dataDirReadableByGroup if cfg.high-memory is enabled (nixbitcoin)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK e95f5981aa

Tree-SHA512: e8253b934211e6fc6be11917f8acb05a05e390caafdf86f90670f9299d9c0d98596758ff021c65aae199c9a5a3f86f87854e1b8f50a53bab8ad28d9a7003d98e
2020-04-25 18:58:53 +00:00
Jonas Nick
fa5937624d
Merge #163: Make it easy to use pinned packages
47b2b110cc pinned: make it easy to use pinned packages (William Casarin)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK 47b2b110cc

Tree-SHA512: 4a45eee55ff87d8f00f7ef7af7bd6dfc4674c492d45a4875dc933edb5d21e06cd1bcedc73b07b8a2b804a4b1fe9d52223e623d382a348524621749beda8cc115
2020-04-25 18:55:56 +00:00
William Casarin
47b2b110cc pinned: make it easy to use pinned packages
It appears the pinned attrset is a bit adhoc. This generalizes
pinned.nix so that you can do:

  $ nix build -f . pinned.stable.hwi
  $ nix build -f . pinned.unstable.hwi

etc

Signed-off-by: William Casarin <jb55@jb55.com>
2020-04-24 16:58:00 -07:00