{ config, lib, pkgs, ... }: with lib; let options.services.clightning-rest = { enable = mkEnableOption "lightning-rest"; port = mkOption { type = types.port; default = 3001; description = "REST server port."; }; docPort = mkOption { type = types.port; default = 4001; description = "Swagger API documentation server port."; }; dataDir = mkOption { type = types.path; default = "/var/lib/clightning-rest"; description = "The data directory for clightning-rest."; }; extraConfig = mkOption { type = types.attrs; default = {}; example = { DOMAIN = "mynode.org"; }; description = '' Extra config options. See: https://github.com/Ride-The-Lightning/c-lightning-REST#option-1-via-config-file-cl-rest-configjson ''; }; # Used by ./rtl.nix group = mkOption { readOnly = true; default = clightning.group; description = "The group under which clightning-rest is run."; }; # Rest server address. # Not configurable. The server always listens on all interfaces: # https://github.com/Ride-The-Lightning/c-lightning-REST/issues/84 # Required by netns-isolation. address = mkOption { internal = true; default = "0.0.0.0"; }; tor.enforce = nbLib.tor.enforce; }; cfg = config.services.clightning-rest; nbLib = config.nix-bitcoin.lib; nbPkgs = config.nix-bitcoin.pkgs; inherit (config.services) bitcoind clightning; configFile = builtins.toFile "clightning-rest-config" (builtins.toJSON ({ PORT = cfg.port; DOCPORT = cfg.docPort; LNRPCPATH = "${clightning.dataDir}/${bitcoind.makeNetworkName "bitcoin" "regtest"}/lightning-rpc"; EXECMODE = "production"; PROTOCOL = "https"; RPCCOMMANDS = ["*"]; } // cfg.extraConfig)); in { inherit options; config = mkIf cfg.enable { services.clightning.enable = true; systemd.tmpfiles.rules = [ "d '${cfg.dataDir}' 0770 ${clightning.user} ${cfg.group} - -" ]; systemd.services.clightning-rest = mkIf cfg.enable { wantedBy = [ "multi-user.target" ]; requires = [ "clightning.service" ]; after = [ "clightning.service" ]; path = [ pkgs.openssl ]; environment.CL_REST_STATE_DIR = cfg.dataDir; preStart = '' ln -sfn ${configFile} cl-rest-config.json ''; postStart = '' while [[ ! -e '${cfg.dataDir}/certs/access.macaroon' ]]; do sleep 0.1 done ''; serviceConfig = nbLib.defaultHardening // { # clightning-rest reads the config file from the working directory WorkingDirectory = cfg.dataDir; ExecStart = "${nbPkgs.clightning-rest}/bin/cl-rest"; # Show "clightning-rest" instead of "node" in the journal SyslogIdentifier = "clightning-rest"; User = clightning.user; Restart = "on-failure"; RestartSec = "10s"; ReadWritePaths = cfg.dataDir; } // nbLib.allowedIPAddresses cfg.tor.enforce // nbLib.nodejs; }; }; }