nix-bitcoin/modules/nix-bitcoin-webindex.nix

{ config, lib, pkgs, ... }:

with lib;

let
  cfg = config.services.nix-bitcoin-webindex;
  inherit (config) nix-bitcoin-services;
  indexFile = pkgs.writeText "index.html" ''
    <html>
      <body>
        <p>
          <h1>
            nix-bitcoin
          </h1>
        </p>
        <p>
        <h2>
          <a href="store/">store</a>
        </h2>
        </p>
        <p>
        <h3>
          lightning node: CLIGHTNING_ID
        </h3>
        </p>
      </body>
    </html>
  '';
  createWebIndex = pkgs.writeText "make-index.sh" ''
    set -e
    mkdir -p /var/www/
    cp ${indexFile} /var/www/index.html
    chown -R nginx /var/www/
    nodeinfo
    . <(nodeinfo)
    sed -i "s/CLIGHTNING_ID/$CLIGHTNING_ID/g" /var/www/index.html
  '';
in {
  options.services.nix-bitcoin-webindex = {
    enable = mkOption {
      type = types.bool;
      default = false;
      description = ''
        If enabled, the webindex service will be installed.
      '';
    };
    enforceTor =  nix-bitcoin-services.enforceTor;
  };

  config = mkIf cfg.enable {
    services.nginx = {
      enable = true;
      virtualHosts."_" = {
        root = "/var/www";
        extraConfig = ''
          location /store/ {
            proxy_pass http://127.0.0.1:${toString config.services.nanopos.port};
            rewrite /store/(.*) /$1 break;
          }
        '';
      };
    };
    services.tor.hiddenServices.nginx = {
      map = [{
        port = 80;
      } {
        port = 443;
      }];
      version = 3;
    };

    # create-web-index
    systemd.services.create-web-index = {
      description = "Get node info";
      wantedBy = [ "multi-user.target" ];
      after = [ "nodeinfo.service" ];
      path  = with pkgs; [
        config.programs.nodeinfo
        config.services.clightning.cli
        config.services.lnd.cli
        jq
        sudo
      ];
      serviceConfig = nix-bitcoin-services.defaultHardening // {
        ExecStart="${pkgs.bash}/bin/bash ${createWebIndex}";
        User = "root";
        Type = "simple";
        RemainAfterExit="yes";
        Restart = "on-failure";
        RestartSec = "10s";
        PrivateNetwork = "true"; # This service needs no network access
      } // (if cfg.enforceTor
          then nix-bitcoin-services.allowTor
          else nix-bitcoin-services.allowAnyIP
        );
    };
  };
}
Add missing nixbitcoin webindex 2018-12-06 14:39:54 +03:00			`{ config, lib, pkgs, ... }:`

			`with lib;`

			`let`
Switch to stable channel but pull the bitcoind and clightning packages and the tor module from unstable 2019-01-01 22:16:24 +03:00			`cfg = config.services.nix-bitcoin-webindex;`
add 'nix-bitcoin-services' option 1. Makes the content easily accessible for module users 2. Avoids needlessly recalculating the attrset in every client module 2019-11-27 16:04:23 +03:00			`inherit (config) nix-bitcoin-services;`
Add missing nixbitcoin webindex 2018-12-06 14:39:54 +03:00			`indexFile = pkgs.writeText "index.html" ''`
			`<html>`
			`<body>`
			`<p>`
			`<h1>`
			`nix-bitcoin`
			`</h1>`
			`</p>`
			`<p>`
			`<h2>`
			`<a href="store/">store</a>`
			`</h2>`
			`</p>`
			`<p>`
			`<h3>`
			`lightning node: CLIGHTNING_ID`
			`</h3>`
			`</p>`
			`</body>`
			`</html>`
			`'';`
			`createWebIndex = pkgs.writeText "make-index.sh" ''`
			`set -e`
			`mkdir -p /var/www/`
			`cp ${indexFile} /var/www/index.html`
			`chown -R nginx /var/www/`
			`nodeinfo`
			`. <(nodeinfo)`
			`sed -i "s/CLIGHTNING_ID/$CLIGHTNING_ID/g" /var/www/index.html`
			`'';`
			`in {`
Switch to stable channel but pull the bitcoind and clightning packages and the tor module from unstable 2019-01-01 22:16:24 +03:00			`options.services.nix-bitcoin-webindex = {`
Add missing nixbitcoin webindex 2018-12-06 14:39:54 +03:00			`enable = mkOption {`
			`type = types.bool;`
			`default = false;`
			`description = ''`
			`If enabled, the webindex service will be installed.`
			`'';`
			`};`
Use IPAddress{Allow,Deny} by default for systemd services 2019-04-28 02:53:26 +03:00			`enforceTor = nix-bitcoin-services.enforceTor;`
Add missing nixbitcoin webindex 2018-12-06 14:39:54 +03:00			`};`

			`config = mkIf cfg.enable {`
			`services.nginx = {`
			`enable = true;`
			`virtualHosts."_" = {`
			`root = "/var/www";`
			`extraConfig = ''`
			`location /store/ {`
			`proxy_pass http://127.0.0.1:${toString config.services.nanopos.port};`
			`rewrite /store/(.*) /$1 break;`
			`}`
			`'';`
			`};`
			`};`
			`services.tor.hiddenServices.nginx = {`
			`map = [{`
			`port = 80;`
			`} {`
			`port = 443;`
			`}];`
			`version = 3;`
			`};`

			`# create-web-index`
			`systemd.services.create-web-index = {`
			`description = "Get node info";`
			`wantedBy = [ "multi-user.target" ];`
			`after = [ "nodeinfo.service" ];`
clightning: add cli option An executable is more robust to use than shell aliases. This is also a preparation for commit 'add module test' because the NixOS testing framework makes interactive aliases hard to use: It unsets 'PS1' which is used by programs/bash/bash.nix to detect interactive shells. 2019-11-27 16:04:33 +03:00			`path = with pkgs; [`
nodeinfo: Convert to module and allow alternative operator username currently, nodeinfo has presets/secure-node.nix as a strict dependency as it requires onion-chef and the 'operatorName' option. and nix-bitcoin-webindex.nix has nodeinfo as a dependecy. so don't add nodeinfo and webindex to modules.nix because they will fail on standalone use. 2020-05-03 17:42:53 +03:00			`config.programs.nodeinfo`
clightning: add cli option An executable is more robust to use than shell aliases. This is also a preparation for commit 'add module test' because the NixOS testing framework makes interactive aliases hard to use: It unsets 'PS1' which is used by programs/bash/bash.nix to detect interactive shells. 2019-11-27 16:04:33 +03:00			`config.services.clightning.cli`
lnd: add cli option 2019-11-27 16:04:34 +03:00			`config.services.lnd.cli`
clightning: add cli option An executable is more robust to use than shell aliases. This is also a preparation for commit 'add module test' because the NixOS testing framework makes interactive aliases hard to use: It unsets 'PS1' which is used by programs/bash/bash.nix to detect interactive shells. 2019-11-27 16:04:33 +03:00			`jq`
			`sudo`
			`];`
All modules: Give service config precedence over defaultHardening With '//' the latter takes precedence over the former in case of equally named attributes. 2020-05-05 16:18:41 +03:00			`serviceConfig = nix-bitcoin-services.defaultHardening // {`
Add missing nixbitcoin webindex 2018-12-06 14:39:54 +03:00			`ExecStart="${pkgs.bash}/bin/bash ${createWebIndex}";`
			`User = "root";`
			`Type = "simple";`
			`RemainAfterExit="yes";`
			`Restart = "on-failure";`
			`RestartSec = "10s";`
webindex & onion-chef: Run non-network-facing services in PrivateNetwork 2020-05-05 16:25:00 +03:00			`PrivateNetwork = "true"; # This service needs no network access`
All modules: Give service config precedence over defaultHardening With '//' the latter takes precedence over the former in case of equally named attributes. 2020-05-05 16:18:41 +03:00			`} // (if cfg.enforceTor`
Use IPAddress{Allow,Deny} by default for systemd services 2019-04-28 02:53:26 +03:00			`then nix-bitcoin-services.allowTor`
			`else nix-bitcoin-services.allowAnyIP`
			`);`
Add missing nixbitcoin webindex 2018-12-06 14:39:54 +03:00			`};`
			`};`
			`}`