c8774375d3
modules: use consistent service variables
...
Benefits of adding top-level variables for used services:
- Makes it obvious which other services are referenced by a service
- Less code
We already do this in many other places.
2021-09-13 13:41:47 +02:00
ad97c268c6
modules: move user/group options to bottom
...
These are insignificant, generic options; place them above readonly options.
We already do this in other services.
Also move user/group config to bottom in spark-wallet.
2021-09-13 13:41:47 +02:00
27c45b82cc
modules: move options to the top
...
This greatly improves readability and makes it easier to discover options.
This commit was genereated by running the following script inside the
repo root dir:
#!/usr/bin/env ruby
def transform(src)
return false if src.include?('inherit options;')
success = false
options = nil
src.sub!(/^ options.*?^ }.*?;/m) do |match|
options = match
" inherit options;"
end
return false if !options
src.sub!(/^with lib;\s*let\n+/m) do |match|
success = true
<<~EOF
with lib;
let
#{options}
EOF
end
success
end
Dir['modules/**/*.nix'].each do |f|
src = File.read(f)
if transform(src)
puts "Changed file #{f}"
File.write(f, src)
end
end
2021-09-13 13:41:47 +02:00
731cf647ff
modules: remove unneeded use of `options` module arg
...
Needed by the following commit.
2021-09-13 13:41:47 +02:00
a2466b1127
secrets: allow extending generate-secrets
...
`generate-secrets` is no longer a monolithic script. Instead, it's
composed of the values of option `nix-bitcoin.generateSecretsCmds`.
This has the following advantages:
- generate-secrets is now extensible by users
- Only secrets of enabled services are generated
- RPC IPs in the `lnd` and `loop` certs are no longer hardcoded.
Secrets are no longer automatically generated when entering nix-shell.
Instead, they are generated before deployment (via `krops-deploy`)
because secrets generation is now dependant on the node configuration.
2021-09-12 11:29:54 +02:00
82a2b148d8
secrets: minor fixes
...
- Improve comment.
- `secretsSetupMethod` is not internal because it can be set to "manual"
by the user.
2021-09-11 15:07:24 +02:00
2c8e29b35b
lnd: extract option `certPath`
...
Improves service encapsulation.
2021-09-11 15:07:24 +02:00
be12a49933
lightning-pool/loop: extract lnd variable
2021-09-11 15:07:24 +02:00
5087ce245f
minor cleanups
...
- btcpayserver: remove unneeded trailing semicolons
- krops/get-sha256:
`tail` is unneeded because `nix-prefetch-url` just outputs a single
line containing the hash.
2021-09-11 15:07:23 +02:00
0d2db4e79f
backups: add option `postgresqlDatabases`
...
This simplifies defining postgresql backups.
This change is covered by tests.py.
2021-09-11 15:07:23 +02:00
9730be9282
joinmarket-yieldgenerator: simplify start script
2021-08-30 13:37:05 +02:00
179b86d19c
joinmarket: allow recreating wallet from seed
...
This allows users to easily upgrade their wallets to use Fidelity Bonds.
2021-08-30 13:37:05 +02:00
7c5ef32b50
versioning: move list of changes to the top
...
Improves readability.
2021-08-30 13:37:05 +02:00
b15d71605e
joinmarket: fix leaking passwords
...
Previously, `bitcoin-rpcpassword-privileged` and `jm-wallet-password` were
passed as world readable arguments to sed and jm-genwallet subprocesses.
2021-08-30 13:37:04 +02:00
00a0759884
joinmarket-ob-watcher: extra permissions & functionality for fidelity bonds
2021-08-30 13:37:04 +02:00
d7f9e33e1c
joinmarket-ob-watcher: move resource files to extra dir
...
Don't clutter joinmarket/bin with ob-watcher resource files.
2021-08-30 13:37:04 +02:00
e95abf6c7e
joinmarket: 0.8.3 -> 0.9.1
2021-08-30 09:02:26 +00:00
a8a8b9ce4d
backups: backup NixOS uid, gid mappings
...
Now that service uid, gid mappings are included in the backups, along
with the service data dirs, we can remove 'chown -R' for
clightning and liquidd data dirs.
Note that we used 'chown -R' only for these two services, while this
approach would have been relevant for all services with data dirs.
2021-08-15 22:40:35 +02:00
ee8b83681b
modules: document module dependencies
2021-08-15 22:40:35 +02:00
9f7d048769
modules: move assertion to lnd.nix
...
nix-bitcoin.nix is now no longer dependent on clightning.nix and lnd.nix.
Due to condition '!(config.services ? clightning)' lnd.nix still
doesn't depend on clightning.nix.
Also fix the assertion message by renaming clightning.bindPort to clightning.port.
2021-08-15 22:40:35 +02:00
cce9a3f6b2
modules: move nix-bitcoin options to file 'nix-bitcoin.nix'
...
This allows modules.nix to consist only of a list of modules.
2021-08-15 22:40:35 +02:00
13b4650e84
versioning: add usage comment
2021-08-15 11:29:36 +02:00
ca3c7a281b
secrets: mark option 'secretsSetupMethod' as internal
2021-08-15 11:29:36 +02:00
f9a0fd7a17
nodeinfo: fix indentation
2021-08-15 11:29:36 +02:00
1ef8cbb384
joinmarket: fix allowRunAsUsers setting
...
This option requires user names instead of groups.
2021-08-15 11:29:35 +02:00
fb36f2abe5
joinmarket-ob-watcher: use consistent mode formatting
...
Remove redundant leading zero.
2021-08-15 11:29:34 +02:00
f14af1fc48
treewide: use consistent echo message formatting
...
Quote the echo message.
2021-08-15 11:29:34 +02:00
b8043d3db5
treewide: use consistent bash script indentation
...
Always use two spaces.
2021-08-15 11:29:34 +02:00
c758d68ea4
lib: rename privileged -> rootScript
...
The naming is now analogous the related function `script`.
2021-08-15 11:29:34 +02:00
a2454975a5
doas: fix recursive calls to doas
...
Doas was broken for recursive calls like `doas -u operator lncli`
where `lncli` internally calls doas.
2021-08-14 10:46:42 +02:00
161baa7e68
joinmarket-ob-watcher: allow required 'mbind' system call
2021-08-14 10:46:41 +02:00
a0e5894f1f
backups: remove illegal option definition
2021-08-14 10:46:41 +02:00
35fe939cf8
security: update /proc restriction mechanism
...
NixOS option `security.hideProcessInformation` for globally restricting
access to /proc has been removed.
Use per-service restrictions via 'ProtectProc' instead.
Rename
`nix-bitcoin.security.hideProcessInformation` to
`nix-bitcoin.security.dbusHideProcessInformation`
because this option now only implements the dbus restriction.
2021-08-14 10:46:41 +02:00
178a0dcf8f
services: use new 'tor' options
2021-08-14 10:46:41 +02:00
e44f78ebb8
services: set isSystemUser for service users
...
'isSystemUser' has to be explicitly set in NixOS 21.05.
Previously, it was the implicit default.
2021-08-14 10:46:40 +02:00
a25ceecca5
update to NixOS 21.05
2021-08-12 11:18:26 +02:00
1ecd9756f6
Merge fort-nix/nix-bitcoin#369 : BTCPayServer L-BTC Support
...
54810ce1bfb24c14ec61b7225f5d1154810ce1bf
2021-08-10 12:23:46 +00:00
881a3aa004
joinmarket: use preStart, postStart
2021-08-10 10:12:42 +00:00
e2c6eb6681
joinmarket: create bitcoind wallet
...
Starting with 0.21.0, bitcoin no longer automatically creates and loads
a default wallet.
This was being ignored because of a JoinMarket issue [1] in CI builds prior
to this version. Now a watch-only Bitcoin Core wallet is created in ExecStartPost.
[1] https://github.com/JoinMarket-Org/joinmarket-clientserver/issues/812
2021-08-10 10:12:37 +00:00
6258d64cb6
joinmarket: run with group 'bitcoin'
...
Don't copy bitcoin-rpcpassword-privileged as root, instead run service
with group "bitcoin".
Same effect, less complexity. Note, PoLP still obeyed for joinmarket-ob-watcher.
2021-08-10 10:12:33 +00:00
ed480a35af
joinmarket: 0.8.2 -> 0.8.3
...
Includes
- coincurve: 13.0.0 -> 15.0.0
- Update Darkscience Tor onion address
2021-08-10 10:12:29 +00:00
54810ce1bf
btcpayserver: add L-BTC support
2021-08-10 10:04:54 +00:00
b24c14ec61
liquidd: make regtest capable
2021-08-10 10:04:22 +00:00
637a58d826
lnd: improve waiting for active RPC server
...
- Simplify
- Add comment
- Avoid the unneeded default call to sleep
2021-07-29 20:27:34 +02:00
adeccce06e
lnd: simplify use of curl
2021-07-29 20:27:33 +02:00
b666bb2903
charge-lnd: add module
2021-07-12 17:36:31 +02:00
ce10003747
lnd: allow curl to retry in the create-wallet script
2021-07-08 13:10:16 +00:00
a23b9d1c2d
lnd: check that state is RPC_ACTIVE after unlocking
...
The state service is newly introduced in lnd 0.13.0.
2021-07-07 13:15:04 +00:00
c75347027b
lnd: don't wait until the RPC port is open after unlocking
...
According to the release notes of lnd 0.13.0 [0] the RPC service is available at
all times.
[0] https://github.com/lightningnetwork/lnd/releases/tag/v0.13.0-beta
2021-07-07 13:12:50 +00:00
7914405ced
clboss: add option for using custom package
2021-04-13 14:12:39 +00:00
3b938a909f
add hardened-extended preset
2021-04-02 10:59:09 +00:00
08fe9ba84a
services: add finer-grained address family restrictions
...
Due to a possible NixOS bug, this commit has no effect on NixOS 20.09
where `RestrictAddressFamilies` is a no-op.
It's only relevant for NixOS unstable with cgroups v2.
bitcoind+zmq: instead of allowing all address families, only add the required
AF_NETLINK family.
lnd: lnd only runs a zmq client, not a server, therefore it requires
no additional address families.
lightning-pool, clightning-plugin-zmq: add AF_NETLINK.
2021-03-22 14:35:29 +01:00
020433cec6
services: add helper fn setAllowedIPAddresses
...
Also use 'allowLocalIPAddresses' instead of 'allowTor' in bitcoind-import-banlist
which doesn't use Tor.
2021-03-22 13:20:45 +01:00
cdf27d9d0c
bitcoind: improve service timeouts
...
- Improve readability by using minutes
- set `TimeoutStopSec` like in bitcoin/contrib/init/bitcoind.service.
Stopping bitcoind can exceed the default timeout during IBD.
2021-03-16 12:46:19 +01:00
09cd3ce5e4
lnd: show curl error messages
2021-03-16 12:46:19 +01:00
fe118b28ff
examples: add krops deployment method
2021-03-15 18:53:07 +01:00
03db1a61b1
lnd, joinmarket: don't write to secrets dir
...
Keeping the secrets dir read-only is more simple and robust.
- lnd seed mnemonic creation and joinmarket wallet creation can be
run as the regular service user instead of root.
- It is easier to switch to a third-party secrets deployment
method in the future.
Don't create a seed mnemonic for lnd when a wallet exists.
This avoids creating unused mnemonics and helps simplifying
the migration command in `versioning.nix`.
2021-03-15 18:50:15 +01:00
55d87490ec
secrets: make configuration more robust
...
- Fail at evaluation when secrets setup is not configured.
Previously, bitcoind failed at runtime due to the missing secrets target.
- Fail at evaluation when conflicting secrets setup methods are used.
This happens when `secretsSetupMethod` has more than one definition.
2021-03-15 12:42:52 +00:00
b0c223e716
secrets: don't stop services when the secrets target stops
...
With krops or nixops the secrets target is always restarted during
the deployment process.
This previously caused unnecessary restarts of all nix-bitcoin services.
2021-03-15 12:42:52 +00:00
b701cb5603
secrets: add option 'generateSecrets'
...
Move this feature from a module preset to a regular option, so that it's
easily discoverable and accessible.
Simplify the implementation of `generateSecrets` by adding it to the
existing `setup-secrets` service script.
Also rename option setup-secrets -> setupSecrets.
2021-03-15 12:42:52 +00:00
a4dabc7390
Remove nixops examples and documentation
2021-03-15 12:42:47 +00:00
1377cf5147
Merge #337 : joinmarket: 0.8.1 -> 0.8.2
...
5ead2a70755ead2a7075
2021-03-10 21:24:12 +00:00
5ead2a7075
joinmarket: 0.8.1 -> 0.8.2
...
- add SNICKER to default config
- update package
- ob-watcher: copy vendorized js and css dependencies
- add missing dependency to jmbase
- use cryptography from pinned.nixpkgs-unstable
2021-03-10 13:33:49 +00:00
6c9c820862
lightning-loop: 0.11.3-beta -> 0.12.0-beta
2021-03-07 18:28:08 +00:00
eb21012745
pool: add pkg, module & tests
2021-03-01 10:59:35 +01:00
f66b2d569b
Merge #333 : electrs: v0.8.7 -> v0.8.8
...
eaa58505a7eaa58505a7
2021-02-24 09:01:04 +00:00
b1c9e13033
bitcoind: secure-node remove assumevalid
2021-02-23 11:04:31 +00:00
eaa58505a7
electrs: v0.8.7 -> v0.8.8
2021-02-23 10:51:43 +00:00
4e9059dc07
bitcoind: rename group bitcoinrpc -> bitcoinrpc-public
...
This makes it clear that services with this group can only use
public RPC calls.
2021-02-18 10:42:21 +00:00
19e401b028
bitcoind: enable cookie-based authentication
2021-02-18 10:40:09 +00:00
ecc601a6d6
onion-addresses: mirror nix-bitcoin.onionAddresses.access behavior
...
This commit fixes an issue with LND, in which if both
nix-bitcoin.onionServices.lnd.public &
services.lnd.restOnionService.enable were enabled, one would try to
create a file named `lnd` and the other would try to create a directory
named `lnd` with a file named `lnd-rest` inside it. This would obiously
cause an error and fail the LND service.
2021-02-17 11:50:47 +00:00
e873326bfe
modules: use user & group options
...
I've tried my best to locate all uses of hardcoded usernames, but its
not guaranteed that all have been found/fixed.
2021-02-17 11:50:25 +00:00
ccef870b74
spark-wallet: add user & group options
2021-02-17 11:50:07 +00:00
85a1722545
lnd: add user & group options
2021-02-17 11:49:51 +00:00
42f7e9f874
joinmarket: 0.8.0-a5e8879 -> 0.8.1
...
- Update joinmarket package
- Revert unofficial release settings
- Move Yield Generator config to configFile
- Add new config option max_sweep_fee_change
2021-02-14 16:23:53 +00:00
2ca92a34a5
services: use doas if enabled
...
- Remove sudo from recurring-donations path because it's not used by
the service
- Use doas instead of sudo in secure-node.nix
2021-02-09 12:44:04 +00:00
ce2b445777
treewide: use runuser for dropping privileges
...
When running as root, use runuser instead of sudo.
As opposed to sudo or doas, runuser is a standalone
binary that needs no external configuration.
Also, it's a bit faster.
2021-02-09 12:44:01 +00:00
803584a288
backups: don't use hardcoded secrets dir
2021-02-07 22:45:38 +01:00
6a32812412
services: add names for systemd helper scripts
...
The systemd journal now shows a specific script name instead of
the generic name "script" before script output.
2021-02-07 22:45:36 +01:00
6982699613
services: use consistent layout
...
Use the following order of definitions for all services:
- assertions
- configuration of other services
- environment.systemPackages
- tmpfiles
- own service
- users
- secrets
2021-02-07 22:42:23 +01:00
a43534dda0
services: improve config file setup
...
- btcpayserver, nbxplorer: Add quotes to the
dataDir arg. (dataDir can contain spaces.)
- clightning, liquidd: use 'install'
2021-02-07 22:42:22 +01:00
18f2002cf0
joinmarket-yieldgenerator: improve systemd journal output
...
Journal entries now look like
`joinmarket-yieldgenerator[9795]: User data location: /var/lib/joinmarket`
instead of
`bash[9795]: User data location: /var/lib/joinmarket`
2021-02-07 22:41:46 +01:00
9d0b8c8f6f
joinmarket-ob-watcher: use DynamicUser
...
DynamicUser simplifies services that don't need a persistent uid/gid,
like joinmarket-ob-watcher.
For existing installations the data dir migration to dynamic users
is automatically handled by systemd.
2021-02-07 22:41:44 +01:00
e9c98f415c
joinmarket: explain need for tor control socket
2021-02-07 22:41:31 +01:00
d9c87b6a8f
joinmarket: fix wallet creation
...
- Fix jm-wallet-seed being globally readable.
- Handle seed extraction failures.
If seed extraction fails, remove the newly created wallet.
This guarantees that wallets always have an accompanying seed.
2021-02-07 22:41:31 +01:00
7458350108
treewide: remove deprecated types.loaOf
2021-02-07 22:41:31 +01:00
9cf038939c
treewide: use mkEnableOption
2021-02-07 22:41:31 +01:00
7a97304f13
treewide: remove unit descriptions
...
Systemd's `Description` option is a misnomer (as confessed by `man systemd.unit`):
Its value is used by user-facing tools in place of the unit file name, so this option
could have been more aptly named `label` or `name`.
`Description` should only be set if the unit file name is not sufficient for naming a unit.
This is not the case for our services, except for `systemd.services.nb-netns-bridge`
whose description has been kept.
As an example how this affects users, weird journal lines like
```
nb-test systemd[1]: Starting Run clightningd...
```
are now replaced by
```
nb-test systemd[1]: Starting clightning.service...
```
2021-02-07 22:41:31 +01:00
a942177ecf
treewide: remove user descriptions
...
User descriptions are stored in the `comment` field in /etc/passwd.
In our case, these are completely redundant and don't add any useful information.
2021-02-07 22:41:30 +01:00
4f6ff408ef
treewide: remove unneeded string literals
2021-02-07 22:41:29 +01:00
e6a6c721c1
treewide: streamline 'extraConfig' descriptions
2021-02-07 22:40:11 +01:00
e774c045de
treewide: fix formatting
2021-02-07 22:40:10 +01:00
0b5b29a2a3
netns-isolation: simplify permission definition for netns-exec
...
The new definition is equivalent to the old one.
2021-02-07 22:39:06 +01:00
af2040f4c4
netns-isolation: use 'true' for systemd option
2021-02-07 22:39:05 +01:00
c246bbb36e
bitcoind, clightning, lnd: improve descriptions
...
bitcoind: The previous description of 'prune' didn't match the int-only
values supported by our option.
2021-02-07 22:39:05 +01:00
7533f12ef1
bitcoind, clightning, run-tests: minor refactoring
...
bitcoind: use builtins.toFile
clightning: use boolToString
run-tests: remove leftover var
2021-02-07 22:39:05 +01:00
f0850d3f23
btcpayserver: reorder config settings
...
Move 'bind' and 'port' next to each other and to the top.
2021-02-07 22:39:05 +01:00
d1c0ea9f85
btcpayserver: add missing systemd postgresql dependency
...
btcpayserver fails if it starts before postgresql.
2021-02-07 22:39:05 +01:00
ebd478fd0d
lnd: add option 'restOnionService'
2021-02-05 09:17:14 +01:00
a344ae95c9
move mkHiddenService to lib
2021-02-04 12:39:54 +00:00
a26ed03d77
rename nix-bitcoin-services.nix -> lib.nix
2021-02-04 12:39:48 +00:00
86d7db9940
bitcoind: add uptime to the public api whitelist
...
It is needed by lnd to check bitcoind health status since lnd-0.12.0.
2021-02-02 22:32:20 +01:00
b114d0c3b1
bitcoind: use systemd startup notification
2021-01-31 22:26:49 +01:00
332d0e70c8
bitcoind: support onion address announcing
2021-01-31 22:26:49 +01:00
9662c19ab1
onionServices: use actual user name of services
...
Previously, onionAddresses definitions in onionServices were of the form
onionAddresses.access.<service> = [<service>];
This caused failures for configurations where a service user name was
overridden or for bitcoind whose default user is 'bitcoin' instead of 'bitcoind'.
Now set the equivalent of:
onionAddresses.access.<actualServiceUser> = [<service>];
Implement this via a new option `onionAddresses.services` to make things more
readable and to work around an infinite recursion error in onionServices.
2021-01-31 22:26:49 +01:00
5c09845e6f
bitcoind: tag incoming connections as onion on enforceTor
2021-01-31 22:26:49 +01:00
035438d427
Merge #290 : JoinMarket Orderbook Watcher
...
8c125ec48c915df059f4254246cf398c125ec48c
2021-01-17 20:00:13 +00:00
8c125ec48c
joinmarket-obwatcher: add pkg & module
2021-01-17 17:40:12 +00:00
9480ada135
nodeinfo fix lnd
2021-01-17 17:13:09 +01:00
c6c14889eb
Merge #293 : Module refactorings, onionServices
...
e2922eb4ce352fc4e8fe757a66b9bd0e00c39d475f7a7962f704d8560f86323a431abaf6b883a9ac2a240d6f4a18c7842e1a45c40c4eb9bed00fe9373980cd5a41bd2a46cb7387fb9f246b05b5402bb1fffe9882485f34b094d3b266f232516d13b26d0a93562f76dd43c247e3fe5c6977b00655073eee7009e0042aa839f16c0b4ab5d76ba1b38fa32b7f91e78a609687b41a720c28dd4a0238f95b7e0d09b2e2922eb4cee2922eb4ce
2021-01-14 20:42:23 +00:00
e2922eb4ce
move rpc thread count setting to lightning modules
2021-01-14 13:25:12 +01:00
352fc4e8fe
liquid: remove insecure and redundant option 'rpcpassword'
2021-01-14 13:25:11 +01:00
757a66b9bd
liquid: move rpcuser definition to module
2021-01-14 13:25:11 +01:00
0e00c39d47
secure-node: improve layout
2021-01-14 13:25:11 +01:00
5f7a7962f7
backups: remove redundant option 'program'
...
Not needed until we support other backup backends.
2021-01-14 13:25:11 +01:00
04d8560f86
secure-node: remove qrencode, tor from systemPackages
...
Keep jq which is useful for analyzing service cli output.
2021-01-14 13:25:10 +01:00
323a431aba
improve nodeinfo
...
- enable usage outside of secure-node.nix
- use json as the output format
- show ports
- also show local addresses, which is particularly useful when
netns-isolation is enabled
- only show enabled services
2021-01-14 13:25:10 +01:00
f6b883a9ac
remove webindex
...
This module is outdated and incomplete. We can readd an improved version in
the future.
Move nanopos nginx proxy tests to the nanopos test.
2021-01-14 13:25:10 +01:00
2a240d6f4a
enable-tor: disable default onion services for clightning, lnd, btcpayserver
...
In case of btcpayserver the default onion service is a security risk
because any visitor can register an admin account on a freshly setup node.
2021-01-14 13:25:09 +01:00
18c7842e1a
modules: show warnings for obsolete options
2021-01-14 13:25:09 +01:00
45c40c4eb9
versioning: simplify assertion evaluation
2021-01-14 13:25:09 +01:00
bed00fe937
lnd: use onionServices for address announcing
2021-01-14 13:25:09 +01:00
3980cd5a41
clightning: use onionServices for address announcing
2021-01-14 13:25:08 +01:00
bd2a46cb73
spark-wallet: use onionServices
...
Also remove the unneeded definition of ReadWritePaths because the
service doesn't need write access to onion files.
2021-01-14 13:25:08 +01:00
87fb9f246b
add 'enable-tor' preset
...
Move 'enforceTor' and onion-service definitions from secure-node.nix.
Use the onionServices module to define onion services.
Onion services now automatically work for services that bind to an INADDR_ANY (`0.0.0.0`) address.
2021-01-14 13:25:08 +01:00
05b5402bb1
add nix-bitcoin.onionServices
2021-01-14 13:25:07 +01:00
fffe988248
onionAddresses: add readonly option 'dataDir'
...
Used by 'onionServices' in a later commit for services that announce
their onion address.
2021-01-14 13:25:07 +01:00
5f34b094d3
onionAddresses: improve script
...
- use -e to check for existence of /var/lib/tor/state, use shorter
polling interval
- clear existing dataDir contents to avoid accumulating obsolete data
- use concatMapStrings instead of foldl'
2021-01-14 13:25:07 +01:00
b266f23251
onionAddresses: use service 'script' option
...
This also makes the script stop on errors.
2021-01-14 13:25:07 +01:00
6d13b26d0a
onionAddresses: add more precise type for option 'access'
2021-01-14 13:25:06 +01:00
93562f76dd
onionAddresses: remove redundant option 'enable'
...
The service can be disabled via `onion-addresses.access = mkForce {};`
Also remove redundant description.
2021-01-14 13:25:06 +01:00
43c247e3fe
onionAddresses: use StateDirectory instead of tmpfiles
...
Simplifies the dataDir setup.
2021-01-14 13:25:06 +01:00
5c6977b006
rename onion-chef -> nix-bitcoin.onionAddresses
...
This clarifies its function.
2021-01-14 13:25:05 +01:00
09e0042aa8
spark-wallet: add consistent address options
2021-01-14 13:25:05 +01:00
39f16c0b4a
liquidd: add consistent address options
2021-01-14 13:25:05 +01:00
b5d76ba1b3
electrs: add consistent address options
2021-01-14 13:25:04 +01:00
8fa32b7f91
btcpayserver: add consistent address options
2021-01-14 13:25:04 +01:00
e78a609687
clightning: add consistent address options
...
Also remove option 'autolisten'. This option has no effect because
option 'bind-addr' is always set.
2021-01-14 13:25:04 +01:00
b41a720c28
lnd: add consistent address options
...
Also fix btcpayserver by connecting to the lnd restAddress instead of the p2p address.
2021-01-14 13:25:03 +01:00
dd4a0238f9
bitcoind: group rpc options under parent option 'rpc'
2021-01-14 13:25:03 +01:00
5b7e0d09b2
bitcoind: add consistent address options
2021-01-14 13:25:03 +01:00
41a6be6552
Merge #297 : joinmarket: add enforceTor to firewall scripts on netns-level
...
71ee16d76771ee16d767
2021-01-10 23:11:08 +00:00
e3a45fcc0c
joinmarket: add rpcWalletFile option
...
The joinmarket docs recommend using a separate wallet to avoid mixing up jm and
default wallet.
2021-01-10 21:52:27 +00:00
71ee16d767
joinmarket: add enforceTor to firewall scripts on netns-level
2021-01-04 16:09:20 +00:00
79f4723cda
lightning-charge: remove package and module
2021-01-01 19:16:46 +00:00
58de79d401
nanopos: remove package and module
2021-01-01 17:37:30 +00:00
da674d1ccf
Merge #292 : joinmarket: always synchronize secrets.jm-wallet-password
...
ed636dd070ed636dd070
2020-12-30 19:18:56 +00:00
ed636dd070
joinmarket: always synchronize secrets.jm-wallet-password
...
secrets.jm-wallet-password is always needed by joinmarket, not just when
joinmarket.yieldgenerator.enable
2020-12-30 16:49:50 +00:00
edc657d138
btcpayserver: add rootpath option
2020-12-30 16:47:50 +00:00
f89498d4fc
clboss: add module
2020-12-22 09:40:00 +00:00
7b32a78de2
Merge #284 : Fix containers
...
2bfb4efbd83403795c86ff94985b8bc8e73c959e44b06aea5aa359cdfb66a5a2fc72742bfb4efbd82bfb4efbd8
2020-12-21 12:24:14 +00:00
c8e73c959e
fix 'hardened' profile for NixOS 20.09
...
The 'scudo' memory allocator set by the 'hardened' profile breaks some
services on 20.09.
The fix for NixOS unstable (https://github.com/NixOS/nixpkgs/pull/104052 )
is ineffective on 20.09.
As a workaround, add a custom 'hardened' preset that uses the default allocator.
2020-12-18 19:56:56 +01:00
fdfafb2f40
joinmarket: 0.7.4 -> 0.8.0-bcfa7eb
...
Update to 0.8.0 with hotfix for genwallet script
Includes module versioning error with migration instructions
2020-12-17 11:12:58 +00:00
5feb9e3eae
lnd: fix rpc/rest port configuration
2020-12-07 14:38:36 +01:00
1d44b99340
add curated clightning plugins
2020-11-18 20:21:34 -06:00
f1681f5b45
add option nix-bitcoin.pkgs, remove overlay
...
This works around a nixpkgs bug where overlays are ignored in containers.
2020-11-09 22:10:07 +01:00
b1a5f5e7b9
don't add service-only pkgs to systemPackages
...
These packages are not useful in shell environemnts.
2020-11-09 22:10:07 +01:00
e39ad358a4
lnd: remove unused bitcoind from PATH
2020-11-09 22:10:07 +01:00
59e128a994
joinmarket: add payjoin configuration
2020-11-06 08:51:25 +00:00
f29f04c0c4
secure-node: LND no longer requires ControlPort
...
Onion service is now generated through mkHiddenService function.
2020-11-06 08:51:23 +00:00
0972af55f1
netns: fix setup service restarts
2020-11-03 21:55:13 +01:00
63a464431b
netns: fail when netns already exists
...
Under normal circumstances, service-specific netns should never exist
before the netns setup service starts.
An existing netns is a genuine error that should not be silently ignored.
2020-11-03 21:55:13 +01:00
b4b607dfa5
netns: simplify firewall setup
2020-10-29 22:36:20 +01:00
25639cec42
netns: fix error msg when starting netns
...
Previously, the failing initial `netns delete` resulted in a
"Cannot remove namespace file ..." error visible in the journal
and status output.
2020-10-29 21:21:30 +01:00
67068afd6b
netns: fix error when stopping netns
...
A short time after `netns delete` finishes, the peer link in the main
netns is automatically removed.
When `link del` is run before that, it fails with
`Cannot find device "nb-veth-br-*"` and the netns service enters a failed state.
2020-10-29 21:21:30 +01:00
8da01fe8a6
lightning-loop: allow RPC access from main netns
...
Note that this also exposes the REST server, which is secured by
macaroon auth like the RPC server.
2020-10-29 21:21:29 +01:00
d76b080b74
lightning-loop: add RPC and REST server options
2020-10-29 21:21:29 +01:00
e66636ef0e
liquidd: use type str for rpcbind
2020-10-29 21:21:29 +01:00
de23fdd377
lnd: use type str for rpclisten, restlisten
2020-10-29 21:21:28 +01:00
8b053326cc
bitcoind: use type str for rpcbind
...
Extra RPC bind addresses can still be added via extraConfig.
2020-10-29 21:21:28 +01:00
6903e8afcc
netns-liquidd: allow RPC access from main netns
2020-10-29 21:21:28 +01:00
82f4901880
netns-lnd: allow RPC access from main netns
2020-10-29 21:21:27 +01:00
58d24e735d
netns-bitcoind: allow RPC access from main netns
2020-10-29 21:21:27 +01:00
e0675cb256
move enforceTor logic to service modules
...
This enables tor support for services without using secure-node.nix
2020-10-29 21:21:27 +01:00
0cc8caa737
lnd: only set tor.active on enforceTor
...
This also enables the test scenario 'netnsRegtest' introduced in a
later commit by fixing the following bug:
For unknown reasons, when tor.active=true and tor is not running, lnd
fails with a tor connection error on netns-isolation, but runs fine
without netns-isolation.
2020-10-29 21:21:26 +01:00
5e0e16529c
netns: fix default addressblock value type
...
Also remove redundant definition in secure-node.nix
2020-10-20 18:21:37 +02:00
6933b0ef47
Merge #251 : Services: Auto-enable dependencies
...
67e49fe41567e49fe415
2020-10-20 11:17:10 +00:00
67e49fe415
services: auto-enable dependencies
2020-10-19 14:55:59 +02:00
486f385fdd
lightning-loop: 0.9.0 -> 0.10.0
...
Includes macaroon authentication
2020-10-19 08:59:14 +00:00
06cba7b519
Merge #249 : Add regtest support
...
9951f10e741f96ca67c5eb42fc8e0606b2ec5b02975b30c90e031df4231f848c4c6eda96b08f5d60bd2145dc77001f8fe8d36f4715ac2a46efd141a175ec85bea21935c252ecb1a8629223937aee006247d611b5ef127b186c3c0f32f3c99ec24ac5d363abd32cde30ddadaed3da9e928e20979951f10e74
2020-10-17 13:04:27 +00:00
d3ece59919
add module 'versioning'
2020-10-16 23:23:00 +02:00
06b2ec5b02
joinmarket: add regtest support
2020-10-16 18:01:52 +02:00
975b30c90e
joinmarket: don't hardcode bitcoind rpc port
2020-10-16 18:01:52 +02:00
031df4231f
joinmarket: move comment out of config file
2020-10-16 18:01:52 +02:00
848c4c6eda
joinmarket: add variable 'bitcoind'
2020-10-16 18:01:52 +02:00
96b08f5d60
btcpayserver: add regtest support
2020-10-16 18:01:52 +02:00
bd2145dc77
btcpayserver: add 'port' option
2020-10-16 18:01:51 +02:00
001f8fe8d3
btcpayserver: use option bitcoind.rpc.port
2020-10-16 18:01:51 +02:00
6f4715ac2a
electrs: add regtest support
2020-10-16 18:01:51 +02:00
46efd141a1
lightning-loop: add regtest support
2020-10-16 18:01:51 +02:00
75ec85bea2
lnd: add regtest support
2020-10-16 18:01:51 +02:00
1935c252ec
lnd: remove redundant option 'bitcoind-host'
...
Also set bitcoind rpc port.
2020-10-16 18:01:51 +02:00
b1a8629223
lnd: add variable 'bitcoind'
2020-10-16 18:01:51 +02:00
937aee0062
spark-wallet: add regtest support
2020-10-16 18:01:50 +02:00
47d611b5ef
spark-wallet: use tor rate provider only when enforceTor
2020-10-16 18:01:50 +02:00
127b186c3c
spark-wallet: simplify start script
...
Also:
- quote paths
- use long form args
2020-10-16 18:01:50 +02:00
0f32f3c99e
clightning: add regtest support
2020-10-16 18:01:50 +02:00
c24ac5d363
clightning: remove redundant option 'bitcoin-rpcconnect'
2020-10-16 18:01:50 +02:00
abd32cde30
clightning: enable config file read access for group
...
Enables lightning-cli group access when nonstandard config options are set.
2020-10-16 18:01:50 +02:00
ddadaed3da
clightning: always use bind-addr in config
...
bind-addr can't be null.
2020-10-16 18:01:50 +02:00
Erik Arvstedt
nixbitcoin
Jonas Nick
Martin Milata
kon
Ian Shipman