lnd: add certificate options extraIPs and extraDomains

This is useful for non-local access to the lnd REST server.

test/tests.nix

@@ -35,6 +35,13 @@ let
       # Share the same pkgs instance among tests
       nixpkgs.pkgs = mkDefault globalPkgs;
 
+      environment.systemPackages = mkMerge (with pkgs; [
+        # Needed to test macaroon creation
+        (mkIfTest "btcpayserver" [ openssl xxd ])
+        # Needed to test certificate creation
+        (mkIfTest "lnd" [ openssl ])
+      ]);
+
       tests.bitcoind = cfg.bitcoind.enable;
       services.bitcoind = {
         enable = true;
@@ -81,7 +88,13 @@ let
       tests.spark-wallet = cfg.spark-wallet.enable;
 
       tests.lnd = cfg.lnd.enable;
-      services.lnd.port = 9736;
+      services.lnd = {
+        port = 9736;
+        certificate = {
+          extraIPs = [ "10.0.0.1" "20.0.0.1" ];
+          extraDomains = [ "example.com" ];
+        };
+      };
 
       tests.lndconnect-onion-lnd = cfg.lnd.lndconnectOnion.enable;
       tests.lndconnect-onion-clightning = cfg.clightning-rest.lndconnectOnion.enable;
@@ -103,8 +116,6 @@ let
         lightningBackend = mkDefault "lnd";
         lbtc = mkDefault true;
       };
-      # Needed to test macaroon creation
-      environment.systemPackages = mkIfTest "btcpayserver" (with pkgs; [ openssl xxd ]);
       test.data.btcpayserver-lbtc = config.services.btcpayserver.lbtc;
 
       tests.joinmarket = cfg.joinmarket.enable;

test/tests.py

@@ -7,9 +7,11 @@ def succeed(*cmds):
     return machine.succeed(*cmds)
 
 def assert_matches(cmd, regexp):
-    out = succeed(cmd)
-    if not re.search(regexp, out):
-        raise Exception(f"Pattern '{regexp}' not found in '{out}'")
+    assert_str_matches(succeed(cmd), regexp)
+
+def assert_str_matches(str, regexp):
+    if not re.search(regexp, str):
+        raise Exception(f"Pattern '{regexp}' not found in '{str}'")
 
 def assert_full_match(cmd, regexp):
     out = succeed(cmd)
@@ -152,6 +154,12 @@ def _():
     assert_matches("runuser -u operator -- lncli getinfo | jq", '"version"')
     assert_no_failure("lnd")
 
+    # Test certificate generation
+    cert_alt_names = succeed("</secrets/lnd-cert openssl x509 -noout -ext subjectAltName")
+    assert_str_matches(cert_alt_names, '10.0.0.1')
+    assert_str_matches(cert_alt_names, '20.0.0.1')
+    assert_str_matches(cert_alt_names, 'example.com')
+
 @test("lndconnect-onion-lnd")
 def _():
     assert_running("lnd")