electrs ssl

docs/usage.md

@@ -89,9 +89,19 @@ Connect to electrs
 
 4. Connect to electrs
 
-	On electrum wallet machine
+	On electrum wallet laptop
 	```
-	electrum --oneserver --server=<ELECTRS_ONION>:50001:t
+	electrum --oneserver --server=<ELECTRS_ONION>:50002:s
+	```
+
+	On electrum android phone
+	```
+	Three dots in the upper-right-hand corner
+	Network
+	Server > Enter <ELECTRS_ONION>
+	Back
+	Auto-connect: OFF
+	One-server mode: ON
 	```
 
 Connect to nix-bitcoin node through ssh Tor Hidden Service

modules/electrs.nix

@@ -32,6 +32,16 @@ in {
         default = 50001;
         description = "Override the default port on which to listen for connections.";
     };
+    onionport = mkOption {
+        type = types.ints.u16;
+        default = 50002;
+        description = "Override the default port on which to listen for connections.";
+    };
+    nginxport = mkOption {
+        type = types.ints.u16;
+        default = 50003;
+        description = "Override the default port on which to listen for connections.";
+    };
   };
 
   config = mkIf cfg.enable {
@@ -48,7 +58,7 @@ in {
     systemd.services.electrs = {
       description = "Run electrs";
       wantedBy = [ "multi-user.target" ];
-      requires = [ "bitcoind.service" ];
+      requires = [ "bitcoind.service" "nginx.service"];
       after = [ "bitcoind.service" ];
       # create shell script to start up electrs safely with password parameter
       preStart = ''
@@ -70,5 +80,28 @@ in {
         PrivateDevices = "true";
       };
     };
+
+    services.nginx = {
+      enable = true;
+      appendConfig = ''
+        stream {
+          upstream electrs {
+            server 127.0.0.1:${toString config.services.electrs.port};
+          }
+
+          server {
+            listen ${toString config.services.electrs.nginxport} ssl;
+            proxy_pass electrs;
+
+            ssl_certificate /secrets/ssl_certificate;
+            ssl_certificate_key /secrets/ssl_certificate_key;
+            ssl_session_cache shared:SSL:1m;
+            ssl_session_timeout 4h;
+            ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
+            ssl_prefer_server_ciphers on;
+          }
+        }
+      '';
+    };
   };
 }

modules/nix-bitcoin.nix

@@ -146,10 +146,12 @@ in {
      
     services.spark-wallet.onion-service = true;
     services.electrs.port = 50001;
+    services.electrs.onionport = 50002;
+    services.electrs.nginxport = 50003;
     services.electrs.high-memory = false;
     services.tor.hiddenServices.electrs = {
       map = [{
-        port = config.services.electrs.port; toPort = config.services.electrs.port;
+        port = config.services.electrs.onionport; toPort = config.services.electrs.nginxport;
       }];
       version = 3;
     };

network/network.nix

@@ -36,6 +36,20 @@ let
     group = "clightning";
     permissions = "0440";
   };
+  ssl_certificate_key = {
+    keyFile = ../secrets/ssl_certificate_key.key;
+    destDir = "/secrets/";
+    user = "nginx";
+    group = "root";
+    permissions = "0440";
+  };
+  ssl_certificate = {
+    keyFile = ../secrets/ssl_certificate.crt;
+    destDir = "/secrets/";
+    user = "nginx";
+    group = "root";
+    permissions = "0440";
+  };
 in {
   network.description = "Bitcoin Core node";
 
@@ -50,6 +64,7 @@ in {
       // (if (config.services.lightning-charge.enable) then { inherit lightning-charge-api-token; } else { })
       // (if (config.services.nanopos.enable) then { inherit lightning-charge-api-token-for-nanopos; } else { })
       // (if (config.services.liquidd.enable) then { inherit liquid-rpcpassword; } else { })
-      // (if (config.services.spark-wallet.enable) then { inherit spark-wallet-login; } else { });
+      // (if (config.services.spark-wallet.enable) then { inherit spark-wallet-login; } else { })
+      // (if (config.services.electrs.enable) then { inherit ssl_certificate_key ssl_certificate; } else { });
     } // (bitcoin-node { inherit config pkgs; });
 }

secrets/generate_secrets.sh

@@ -17,3 +17,9 @@ echo Write secrets to $SECRETSFILE
     echo \}
 } >> $SECRETSFILE
 echo Done
+
+echo Generate Self-Signed Cert
+openssl genrsa -out secrets/ssl_certificate_key.key 2048
+openssl req -new -key secrets/ssl_certificate_key.key -out secrets/ssl_certificate.csr -subj "/C=KN"
+openssl x509 -req -days 1825 -in secrets/ssl_certificate.csr -signkey secrets/ssl_certificate_key.key -out secrets/ssl_certificate.crt
+echo Done

shell.nix

@@ -6,7 +6,7 @@ with import nixpkgs { };
 stdenv.mkDerivation rec {
   name = "nix-bitcoin-environment";
 
-  buildInputs = [ pkgs.nixops pkgs.figlet pkgs.apg ];
+  buildInputs = [ pkgs.nixops pkgs.figlet pkgs.apg pkgs.openssl ];
 
   shellHook = ''
     export NIX_PATH="nixpkgs=${nixpkgs}:."