mirror of
https://github.com/fort-nix/nix-bitcoin.git
synced 2024-09-11 23:17:20 +03:00
Now all services that access secrets only run after the secrets setup has finished. Previously, we assumed that the systemd `after` dependency is transitive, i.e. that adding an `after = [ "bitcoind.service" ]` to a service implicitly pulled in the `after` dependency to `nix-bitcoin-secrets.target` (which is defined for `bitcoind`). This is not the case. Services could start before secrets setup had finished, leading to service failure.
148 lines
4.7 KiB
Nix
148 lines
4.7 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
let
|
|
options.services.lightning-loop = {
|
|
enable = mkEnableOption "Lightning Loop, a non-custodial off/on chain bridge";
|
|
rpcAddress = mkOption {
|
|
type = types.str;
|
|
default = "127.0.0.1";
|
|
description = mdDoc "Address to listen for gRPC connections.";
|
|
};
|
|
rpcPort = mkOption {
|
|
type = types.port;
|
|
default = 11010;
|
|
description = mdDoc "Port to listen for gRPC connections.";
|
|
};
|
|
restAddress = mkOption {
|
|
type = types.str;
|
|
default = cfg.rpcAddress;
|
|
description = mdDoc "Address to listen for REST connections.";
|
|
};
|
|
restPort = mkOption {
|
|
type = types.port;
|
|
default = 8081;
|
|
description = mdDoc "Port to listen for REST connections.";
|
|
};
|
|
package = mkOption {
|
|
type = types.package;
|
|
default = config.nix-bitcoin.pkgs.lightning-loop;
|
|
defaultText = "config.nix-bitcoin.pkgs.lightning-loop";
|
|
description = mdDoc "The package providing lightning-loop binaries.";
|
|
};
|
|
dataDir = mkOption {
|
|
type = types.path;
|
|
default = "/var/lib/lightning-loop";
|
|
description = mdDoc "The data directory for lightning-loop.";
|
|
};
|
|
proxy = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = if cfg.tor.proxy then config.nix-bitcoin.torClientAddressWithPort else null;
|
|
description = mdDoc "`host:port` of SOCKS5 proxy for connnecting to the loop server.";
|
|
};
|
|
certificate = {
|
|
extraIPs = mkOption {
|
|
type = with types; listOf str;
|
|
default = [];
|
|
example = [ "60.100.0.1" ];
|
|
description = mdDoc ''
|
|
Extra `subjectAltName` IPs added to the certificate.
|
|
This works the same as loop option {option}`tlsextraip`.
|
|
'';
|
|
};
|
|
extraDomains = mkOption {
|
|
type = with types; listOf str;
|
|
default = [];
|
|
example = [ "example.com" ];
|
|
description = mdDoc ''
|
|
Extra `subjectAltName` domain names added to the certificate.
|
|
This works the same as loop option {option}`tlsextradomain`.
|
|
'';
|
|
};
|
|
};
|
|
extraConfig = mkOption {
|
|
type = types.lines;
|
|
default = "";
|
|
example = ''
|
|
debuglevel=trace
|
|
'';
|
|
description = mdDoc ''
|
|
Extra lines appended to the configuration file.
|
|
See here for all available options:
|
|
https://github.com/lightninglabs/loop/blob/11ab596080e9d36f1df43edbeba0702b25aa7457/loopd/config.go#L119
|
|
'';
|
|
};
|
|
cli = mkOption {
|
|
default = pkgs.writers.writeBashBin "loop" ''
|
|
${cfg.package}/bin/loop \
|
|
--rpcserver ${nbLib.addressWithPort cfg.rpcAddress cfg.rpcPort} \
|
|
--macaroonpath '${cfg.dataDir}/${network}/loop.macaroon' \
|
|
--tlscertpath '${secretsDir}/loop-cert' "$@"
|
|
'';
|
|
defaultText = "(See source)";
|
|
description = mdDoc "Binary to connect with the lightning-loop instance.";
|
|
};
|
|
tor = nbLib.tor;
|
|
};
|
|
|
|
cfg = config.services.lightning-loop;
|
|
nbLib = config.nix-bitcoin.lib;
|
|
secretsDir = config.nix-bitcoin.secretsDir;
|
|
|
|
lnd = config.services.lnd;
|
|
|
|
network = config.services.bitcoind.network;
|
|
configFile = builtins.toFile "loop.conf" ''
|
|
datadir=${cfg.dataDir}
|
|
network=${network}
|
|
rpclisten=${cfg.rpcAddress}:${toString cfg.rpcPort}
|
|
restlisten=${cfg.restAddress}:${toString cfg.restPort}
|
|
logdir=${cfg.dataDir}/logs
|
|
tlscertpath=${secretsDir}/loop-cert
|
|
tlskeypath=${secretsDir}/loop-key
|
|
|
|
lnd.host=${nbLib.addressWithPort lnd.rpcAddress lnd.rpcPort}
|
|
lnd.macaroonpath=${lnd.networkDir}/admin.macaroon
|
|
lnd.tlspath=${lnd.certPath}
|
|
|
|
${optionalString (cfg.proxy != null) "server.proxy=${cfg.proxy}"}
|
|
|
|
${cfg.extraConfig}
|
|
'';
|
|
in {
|
|
inherit options;
|
|
|
|
config = mkIf cfg.enable {
|
|
services.lnd.enable = true;
|
|
|
|
environment.systemPackages = [ cfg.package (hiPrio cfg.cli) ];
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d '${cfg.dataDir}' 0770 ${lnd.user} ${lnd.group} - -"
|
|
];
|
|
|
|
services.lightning-loop.certificate.extraIPs = mkIf (cfg.rpcAddress != "127.0.0.1") [ "${cfg.rpcAddress}" ];
|
|
|
|
systemd.services.lightning-loop = {
|
|
wantedBy = [ "multi-user.target" ];
|
|
requires = [ "lnd.service" ];
|
|
after = [ "lnd.service" "nix-bitcoin-secrets.target" ];
|
|
serviceConfig = nbLib.defaultHardening // {
|
|
ExecStart = "${cfg.package}/bin/loopd --configfile=${configFile}";
|
|
User = lnd.user;
|
|
Restart = "on-failure";
|
|
RestartSec = "10s";
|
|
ReadWritePaths = [ cfg.dataDir ];
|
|
} // nbLib.allowedIPAddresses cfg.tor.enforce;
|
|
};
|
|
|
|
nix-bitcoin.secrets = {
|
|
loop-key.user = lnd.user;
|
|
loop-cert.user = lnd.user;
|
|
};
|
|
nix-bitcoin.generateSecretsCmds.lightning-loop = ''
|
|
makeCert loop '${nbLib.mkCertExtraAltNames cfg.certificate}'
|
|
'';
|
|
};
|
|
}
|