6f032e3c40
lnd: fix mnemonic file access vulnerability
...
Previously, the file was readable by 'other' for a short time after
creation.
2020-09-15 12:09:00 +00:00
b97584f5cb
netns: allow return traffic to outgoing connections
2020-09-15 12:08:58 +00:00
9d610991be
bitcoind: remove custom rpc user names
...
Simpler.
We've just removed option 'bitcoind.rpcuser', so we can also remove the
old name 'bitcoinrpc'.
2020-08-27 11:39:26 +02:00
1408403dec
bitcoind: clarify how bitcoin-cli RPC access is enabled
...
It's not immediately clear why rpcuser/rpcpassword are needed in addition to the rpcauth
config entries.
2020-08-26 22:52:47 +02:00
4790c601a1
bitcoind: move rpc user config to bitcoind
...
This enables modules-only usage.
The privileged user is needed by bitcoind (cli), the public user is
needed by other services.
2020-08-26 22:52:47 +02:00
876cfadf1a
bitcoind: add rpc user option 'passwordHMACFromFile'
...
This allows adding additional rpc users without the need for
user-specific code in preStart.
2020-08-26 22:52:47 +02:00
59434e79f0
bitcoind: simplify default rpc user name config
2020-08-26 21:16:32 +02:00
205829b91f
bitcoind: remove whitespace
2020-08-26 21:16:32 +02:00
91ebc2d517
netns-exec: simplify installation
2020-08-25 14:53:12 +02:00
809e754851
netns: improve bridge setup
...
- Explain why we don't use option `networking.bridges`
- Make the bridge setup service part of NixOS' network-setup.service.
This yields no noticable functional changes for now, but it's
conceptually cleaner to finish the network setup before network.target
becomes active.
- Add 'nb-' prefix to service name
2020-08-25 14:53:12 +02:00
b7450877a0
netns: rename bridge peer devices br-nb-veth* -> nb-veth-br*
...
This ensures a consistent 'nb-' namespace and simplifies the
dhcpcd.denyInterfaces rules.
Also rename vethName -> veth.
2020-08-25 14:53:12 +02:00
8bfb7bb2f8
netns: rename bridge br0 -> nb-br
...
br0 has a high risk of name clashes when nix-bitcoin used as part of a
larger config.
Use a more specific name.
2020-08-25 14:53:08 +02:00
32e70a7516
netns: move webindex config for modules-only usage
...
webindex is only available in secure-node.
2020-08-25 11:40:27 +02:00
121301337b
netns: add option 'allowedUser' for modules-only usage
...
The dependency on secure-node.nix prevented using nix-bitcoin by just
importing modules.nix.
2020-08-25 11:40:27 +02:00
9715134f06
netns: don't repeat cli definitions
...
1. Saves some code.
2. Guarantees that the netns and no-netns cli defs are always in sync.
2020-08-25 11:40:27 +02:00
e385c73256
netns: separate implementation and service configs
...
This greatly improves clarity.
Especially the bitcoind-import-banlist.serviceConfig definition was out
of place.
2020-08-25 11:40:27 +02:00
d0b8d77de2
netns: remove conditionals for service settings
...
Going without the conditionals (like in secure-node.nix) adds
readability and doesn't reduce evaluation performance (in fact, it
even slightly improves performance due to implementation details
of mkIf).
To avoid errors, remove use of disabled services in secure-node.nix and
nix-bitcoin-webindex.nix.
2020-08-25 11:40:27 +02:00
0f0f6ddbb9
netns: add comment about undesirable algorithmic complexity
...
We don't want to be Accidentally Quadratic™
2020-08-25 11:40:26 +02:00
a3ae8668e6
netns: use map instead of concatMap
2020-08-25 11:40:26 +02:00
b7fc819be5
netns: consistent var naming
...
n is used elsewhere in similar contexts.
2020-08-25 11:40:26 +02:00
5a81693ef3
netns: add range check for netns ids
2020-08-25 11:40:26 +02:00
74f1610668
netns: clarify addressblock description
2020-08-25 11:40:26 +02:00
4eb92df08c
netns: remove redundant filter
...
The 'availableNetns' connection matrix only consists of enabled entries,
so no extra filtering is needed.
Reason: availableNetns starts with the filtered 'base' and is then symmetrised.
2020-08-25 11:40:26 +02:00
50de54aef1
netns: remove empty connections defs
...
Like in the netns defintion for bitcoind.
2020-08-25 11:40:26 +02:00
0f1f105948
Merge #225 : Fix process info restriction
...
44de5064cda36789b468588a0b240596ea2e671c343e026030736744676144de5064cd
2020-08-24 14:56:05 +00:00
322ba5bfff
Add nix-bitcoin.lib for utility functions and types
2020-08-20 21:31:24 +00:00
44de5064cd
security: don't restrict process info by default for module users
2020-08-20 13:12:07 +02:00
588a0b2405
security: enable full systemd-status for group 'proc'
...
Previously, systemd-status was broken for all users except root.
Use a 'default' deny policy, which is overridden for group 'proc'.
Add operator to group 'proc'.
Also, remove redundant XML boilerplate.
2020-08-20 13:12:06 +02:00
96ea2e671c
security: simplify and fix dbus configuration
...
Previously, due to the dependency on a helper service, this dbus config
was initially inactive after system boot, allowing for unrestricted use
of the problematic dbus call.
This also broke the accompanying VM test on faster systems.
Remove 'allow' policy for root because it's a no-op:
1. It's overridden by the 'mandatory' deny policy.
2. Root can use all dbus calls anyways, regardless of policy settings.
Also, add some comments.
2020-08-20 13:12:06 +02:00
343e026030
rename dbus.nix -> security.nix
...
This file has a broader scope than just configuring dbus.
2020-08-20 13:12:06 +02:00
e4fb7a52de
backups: add module
2020-08-04 15:25:37 +00:00
62f83a71b8
Merge #218 : Fix typos
...
df89ceed39df89ceed39
2020-08-04 15:13:09 +00:00
e650df30d5
bitcoind: bump rpcthread count
2020-08-04 14:46:57 +00:00
ac96fd59db
assertions: make lnd.enable depend on !clightning.enable or port != 9735
2020-08-04 14:07:10 +00:00
3ed564ea06
lnd: make listen IP address only
2020-08-04 14:07:08 +00:00
716e98789c
lnd: add listenPort option
2020-08-04 14:07:06 +00:00
43da15557d
clightning: refactor bind-addr to be IP address only
...
With typecheck
2020-08-04 14:07:02 +00:00
df89ceed39
Fix typos
2020-08-04 13:32:06 +00:00
d99ccc8445
clightning: add bindport option
2020-08-04 12:42:57 +00:00
0baeb2acce
Merge #209 : Lightning loop
...
e9204946d4491d83a6588f3588b13f1bb801ad7be9204946d4
2020-07-28 20:02:12 +00:00
491d83a658
lightning-loop: add module
2020-07-28 15:55:52 +00:00
8f3588b13f
lnd: higher attempt limit for less-powerful machines
...
Opening main database sometimes takes longer than 50 ExecStartPost
restPort connection attempts.
2020-07-28 15:55:50 +00:00
5086fc3234
bitcoin: drive-by prune fix
2020-07-28 14:32:54 +00:00
1bf45a9547
bitcoind: add rpcwhitelist feature
...
Default behavior for rpc whitelisting is set to 0, which means that
rpcwhitelisting is only enforced for rpc users for whom an `rpcwhitelist`
exists.
2020-07-28 14:32:50 +00:00
5a978a2836
bitcoind: switch from rpcpassword to rpcauth
...
Includes bitcoind's `share/rpcauth` to convert apg generated passwords
into salted HMAC-SHA-256 hashed passwords.
2020-07-28 14:32:47 +00:00
0248e6493f
systemd: lock down systemctl status
...
Mitigates a security issue that allows unprivileged users to read other
unprivileged user's processes' credentials from CGroup using `systemctl
status`.
2020-07-28 11:28:09 +00:00
4dbc348921
electrs: remove TLSProxy
...
https://github.com/spesmilo/electrum/issues/5278 was resolved
2020-07-21 13:41:03 +00:00
02853067a1
bitcoind: postStart wait until bitcoind can receive rpc calls
2020-07-21 13:23:07 +00:00
25adce29e5
secure-node: only mkHiddenServices if services are enabled
2020-07-21 09:38:55 +00:00
c542b92e55
nginx: add netns
...
- Adds nginx to netns-isolation.services
- Adds host option (defaults to localhost) as target of hidden service
2020-07-21 09:38:53 +00:00
Erik Arvstedt
nixbitcoin
Jonas Nick
practicalswift