mirror of
https://github.com/fort-nix/nix-bitcoin.git
synced 2024-11-23 06:42:51 +03:00
7369f0a7ec
- Adds lightning-charge to netns-isolation.services - Adds cfg.enforceTor to bring lightning-charge in line with other services - Adds extraArgs option to allow using lightning-charge with network namespaces - Adds host option (defaults to localhost) as target of hidden service
87 lines
2.9 KiB
Nix
87 lines
2.9 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.services.lightning-charge;
|
|
inherit (config) nix-bitcoin-services;
|
|
user = config.users.users.lightning-charge.name;
|
|
group = config.users.users.lightning-charge.group;
|
|
in {
|
|
options.services.lightning-charge = {
|
|
enable = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
If enabled, the lightning-charge service will be installed.
|
|
'';
|
|
};
|
|
dataDir = mkOption {
|
|
type = types.path;
|
|
default = "/var/lib/lightning-charge";
|
|
description = "The data directory for lightning-charge.";
|
|
};
|
|
host = mkOption {
|
|
type = types.str;
|
|
default = "127.0.0.1";
|
|
description = "http server listen address";
|
|
};
|
|
extraArgs = mkOption {
|
|
type = types.separatedString " ";
|
|
default = "";
|
|
description = "Extra command line arguments passed to lightning-charge.";
|
|
};
|
|
enforceTor = nix-bitcoin-services.enforceTor;
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
assertions = [
|
|
{ assertion = config.services.clightning.enable;
|
|
message = "lightning-charge requires clightning.";
|
|
}
|
|
];
|
|
|
|
users.users.lightning-charge = {
|
|
description = "lightning-charge User";
|
|
group = "lightning-charge";
|
|
extraGroups = [ "clightning" ];
|
|
};
|
|
users.groups.lightning-charge = {};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d '${cfg.dataDir}' 0700 ${user} ${group} - -"
|
|
];
|
|
|
|
environment.systemPackages = [ pkgs.nix-bitcoin.lightning-charge ];
|
|
systemd.services.lightning-charge = {
|
|
description = "Run lightning-charge";
|
|
wantedBy = [ "multi-user.target" ];
|
|
requires = [ "clightning.service" ];
|
|
after = [ "clightning.service" ];
|
|
preStart = ''
|
|
# Move existing lightning-charge.db
|
|
# TODO: Remove eventually
|
|
if [[ -e ${config.services.clightning.dataDir}/lightning-charge.db ]]; then
|
|
mv ${config.services.clightning.dataDir}/lightning-charge.db ${cfg.dataDir}/lightning-charge.db
|
|
chown ${user}: ${cfg.dataDir}/lightning-charge.db
|
|
chmod 600 ${cfg.dataDir}/lightning-charge.db
|
|
fi
|
|
'';
|
|
serviceConfig = nix-bitcoin-services.defaultHardening // {
|
|
# Needed to access clightning.dataDir in preStart
|
|
PermissionsStartOnly = "true";
|
|
EnvironmentFile = "${config.nix-bitcoin.secretsDir}/lightning-charge-env";
|
|
ExecStart = "${pkgs.nix-bitcoin.lightning-charge}/bin/charged -l ${config.services.clightning.dataDir}/bitcoin -d ${cfg.dataDir}/lightning-charge.db -i ${cfg.host} ${cfg.extraArgs}";
|
|
User = user;
|
|
Restart = "on-failure";
|
|
RestartSec = "10s";
|
|
ReadWritePaths = "${cfg.dataDir}";
|
|
} // (if cfg.enforceTor
|
|
then nix-bitcoin-services.allowTor
|
|
else nix-bitcoin-services.allowAnyIP)
|
|
// nix-bitcoin-services.nodejs;
|
|
};
|
|
nix-bitcoin.secrets.lightning-charge-env.user = user;
|
|
};
|
|
}
|