263 Commits

Author	SHA1	Message	Date
Jonas Nick	a03597ae8e	Merge #189: Update configuration.nix ... f280d54bb88e2d0e9603f9cc4214ff536c9944b8 add module assertions (nixbitcoin) 23cd323ad12cabe4c3921234de480a2f94e50661 assertions: add lnd, clightning exclusivity (nixbitcoin) 0ad524ca2d4125909b40b0661a20f126ab85c056 example config: clarify nix-bitcoin will auto-detect invalid settings (nixbitcoin) c16924b8506889c118b6a380d4a7024e5d5422f8 example config: change hwi excluding dependency to high-memory (nixbitcoin) 0fd99c4cc0f3da94ba6d65671c23f7b32b27b740 bitcoind: simplify pruning (nixbitcoin) b9a7a71873475deca779029f5377b117ad8cc57d example config: document enabling pruning (nixbitcoin) Pull request description: ACKs for top commit: jonasnick: ACK f280d54bb88e2d0e9603f9cc4214ff536c9944b8 Tree-SHA512: a900dc2b95cdc01b457c65853930cb1c31b5288fab06d665207ffb2bcd1d54d75add73113ccaacd98e882d4e6674eb8393fec1ae0a01688de1b56250d5d3d3d6	2020-06-17 09:27:46 +00:00
nixbitcoin	f280d54bb8	add module assertions	2020-06-17 09:23:17 +00:00
nixbitcoin	23cd323ad1	assertions: add lnd, clightning exclusivity	2020-06-15 13:02:58 +00:00
nixbitcoin	0fd99c4cc0	bitcoind: simplify pruning ... Remove the possible null value for bitcoind.prune and set prune = 0 in bitcoind as a default. Remove prune = 0 in secure-node.nix and the mkForce in configuration.nix (bitcoind.prune = lib.mkForce ).	2020-06-15 10:55:57 +00:00
nixbitcoin	12adabe407	banlist: update to newest version ... Received by E-Mail from gmaxwell	2020-06-11 09:23:26 +00:00
Jonas Nick	94672e8f34	Merge #188: lnd: add option for configuring REST port ... 03a627a06f62446a388ce76dc8ea1305fcb22317 lnd: add option for configuring REST port (Martin Milata) Pull request description: ACKs for top commit: nixbitcoin: ACK 03a627a06f62446a388ce76dc8ea1305fcb22317 Tree-SHA512: b184d5ee825382d1f104e17a091ff49fa170230e4e690323cdfd570a0c7f0bf11e57da84f39fda9169fcbead75f0c0597268f728665135e743fa7fee73a1b66c	2020-06-07 14:40:54 +00:00
Jonas Nick	16e602e2b5	Merge #190: services: use 'port' option type ... db48ab9b6946c0222810e7e516c2271803a0c5ab services: use 'port' option type (Erik Arvstedt) Pull request description: ACKs for top commit: jonasnick: ACK db48ab9b6946c0222810e7e516c2271803a0c5ab Tree-SHA512: 24cf0c307b40652d1275575fdf4216696890b0f7786832e7bbee9e21cf6d23d3fc35480926c475fc98c17eba668f5ee2c8c0875689e725c8ad05f2fb6b9ecd20	2020-06-05 20:40:57 +00:00
Martin Milata	03a627a06f	lnd: add option for configuring REST port	2020-06-03 12:07:04 +02:00
Erik Arvstedt	db48ab9b69	services: use 'port' option type	2020-06-02 17:31:28 +02:00
nixbitcoin	ccc3a70344	service hardening: add more restrictions ... Add RestrictSUIDSGID Add RemoveIPC Add RestrictRealtime Add ProtectHostname	2020-05-24 11:14:45 +00:00
nixbitcoin	3fbfa98635	service hardening: replace obtuse SystemCallFilter with @system-service ... @system-service whitelist and additional https://docs-stage.docker.com/engine/security/seccomp/#significant-syscalls-blocked-by-the-default-profile blacklist.	2020-05-24 11:14:37 +00:00
nixbitcoin	e34d1c884e	service hardening: Add PrivateUsers ... Exceptions in webindex & onion-chef	2020-05-22 16:16:19 +00:00
nixbitcoin	1c75543f2f	clightning: add user and group options	2020-05-22 16:16:17 +00:00
Erik Arvstedt	5f3f362451	lnd: add strict hardening ... Add ProtectSystem=strict, remove PermissionStartOnly. Extract the section of postStart that needs secrets dir write access into a separate script with full privileges. Simplify preStart and fix dataDir quoting.	2020-05-22 16:13:58 +00:00
nixbitcoin	a040e52854	All modules: ProtectSystem = strict ... Add ReadWritePaths in all modules, except lnd which has ProtectSystem = full.	2020-05-22 15:47:01 +00:00
nixbitcoin	adc71b892e	Remove PermissionStartOnly where possible and replace with bitcoinrpc ... Remove PermissionsStartOnly for bitcoind and spark-wallet (it was never needed there) Give reason for PermissionsStartOnly in lightning-charge Replace PermissionsStartOnly in clightning, electrs and liquid	2020-05-22 15:04:49 +00:00
nixbitcoin	91b6b2c370	All modules with preStart: Use systemd.tmpfiles.rules ... This is NixOS' recommended way to setup service dirs https://github.com/NixOS/nixpkgs/pull/56265. This commit hands off the initial data directory creation to systemd.tmpfiles.rules. All other preStart scripts are left intact to limit this changes' scope.	2020-05-22 14:54:39 +00:00
nixbitcoin	423ebf862b	lnd: only enable bitcoind zmqpub if lnd.enable ... In conjuction with secure-node.nix, this sets sane RestrictAddressFamilies unless lnd is enabled. Before, we were constantly exposing unnecessary Address Families, not just when lnd is enabled. However, zmqpub* must always be enabled for lnd, even when used outside of secure-node.nix, so we make this change in the lnd module.	2020-05-22 14:53:33 +00:00
nixbitcoin	81a1c3f908	service hardening: Add CapabilityBoundingSets ... Whitelist with exceptions in webindex and onion-chef	2020-05-22 11:29:54 +00:00
nixbitcoin	3cd61506e0	webindex & onion-chef: Run non-network-facing services in PrivateNetwork	2020-05-22 11:29:07 +00:00
nixbitcoin	7c70dd43ac	All modules: Give service config precedence over defaultHardening ... With '//' the latter takes precedence over the former in case of equally named attributes.	2020-05-22 08:08:27 +00:00
nixbitcoin	b8e10afe18	recurring-donations: Run under recurring-donations user	2020-05-19 11:13:26 +00:00
nixbitcoin	5d01ea7101	nodeinfo: Convert to module and allow alternative operator username ... currently, nodeinfo has presets/secure-node.nix as a strict dependency as it requires onion-chef and the 'operatorName' option. and nix-bitcoin-webindex.nix has nodeinfo as a dependecy. so don't add nodeinfo and webindex to modules.nix because they will fail on standalone use.	2020-05-19 11:13:24 +00:00
nixbitcoin	95d230d1d6	Remove bitcoinrpc group remnants	2020-05-19 11:13:22 +00:00
nixbitcoin	563b210835	spark-wallet: Run under spark-wallet user	2020-05-19 11:13:20 +00:00
nixbitcoin	205fca3576	bitcoind: only make blocksdir group-readable when dataDirReadableByGroup	2020-05-19 11:13:18 +00:00
nixbitcoin	81a04a4ef1	lightning-charge: add dedicated user	2020-05-19 11:13:16 +00:00
nixbitcoin	0ba55757f8	clightning: allow group access to RPC socket	2020-05-19 11:13:12 +00:00
nixbitcoin	304dd297ba	clightning: remove config group read access	2020-05-19 11:13:05 +00:00
nixbitcoin	04c6936ce9	clightning: Remove clightning "bitcoinrpc" membership ... Secrets are written to clightning config file during preStart with root permissions because of PermissionsStartOnly.	2020-05-19 11:09:13 +00:00
nixbitcoin	393ab0fb3c	electrs: Remove electrs user from "bitcoinrpc" and "bitcoin" sometimes ... Electrs does not need to be a part of "bitcoinrpc" group because preStart electrs.toml creation is handled by PermissionsStartOnly. "bitcoin" group membership is only necessary when cfg.high-memory is enabled and electrs reads blocks directly from the blocks directory.	2020-05-19 11:08:59 +00:00
nixbitcoin	7cfae66db4	electrs: Drop insecure TLS ciphers	2020-05-19 11:08:52 +00:00
nixbitcoin	4c139a6d77	electrs: Make TLSProxy truly optional ... If TLSProxy is disabled, bypass nginx by forwarding Tor HS traffic directly to electrs.	2020-05-19 11:08:48 +00:00
Erik Arvstedt	509fca5328	fix syntax error ... Fixes #172	2020-05-06 12:13:32 +02:00
nixbitcoin	159f551b93	Remove bitcoin, clightning, electrs, liquid user home directory	2020-04-26 14:08:08 +02:00
nixbitcoin	742aef1e0f	Only set dataDirReadableByGroup if cfg.high-memory is enabled	2020-04-24 16:21:12 +02:00
Erik Arvstedt	4dc6c3ba5d	add option 'dataDirReadableByGroup' ... These settings are now more accessible for users that don't use nix-bitcoin's default node config. Additionally, remove 'other' permissions via umask.	2020-04-16 15:55:34 +02:00
Erik Arvstedt	3e188238d0	only update bitcoin.conf when changed	2020-04-12 22:32:37 +02:00
Erik Arvstedt	08322eed9b	use [[ test	2020-04-12 22:32:37 +02:00
Erik Arvstedt	201fc33782	move line to relevant code section (blocks dir setup)	2020-04-12 22:32:37 +02:00
Erik Arvstedt	1f8fe310d0	remove option 'configFileOption' ... It doesn't make sense for bitcoind users to completely redefine their config file. Also, it's poorly named and the description is faulty. This is a breaking change, but this option has probably no actual users.	2020-04-12 22:32:37 +02:00
Erik Arvstedt	4e5c1d7551	disable redundant logfile	2020-04-12 22:32:37 +02:00
Erik Arvstedt	a05551fd1c	improve config file formatting	2020-04-12 22:32:37 +02:00
Erik Arvstedt	5e81d60d63	improve formatting	2020-04-12 22:32:37 +02:00
Erik Arvstedt	d60a5aa4db	define rpc.users submodule inline ... Improves readability.	2020-04-12 22:32:37 +02:00
Erik Arvstedt	1a2271fb14	remove unused variable 'hexStr'	2020-04-12 22:32:36 +02:00
Erik Arvstedt	4e92b1c818	remove redundant hardening options ... These are already defined in nix-bitcoin-services.defaultHardening.	2020-04-12 22:32:36 +02:00
Erik Arvstedt	47fd6cd0f3	simplify ExecStart	2020-04-12 22:32:36 +02:00
Erik Arvstedt	64fc63cc40	remove pidFile ... - service type "simple" is the default - pidFile is not needed for service type "simple"	2020-04-12 22:32:36 +02:00
Erik Arvstedt	bceaa361ca	operator: allow reading systemd journal	2020-04-09 11:02:06 +02:00