pleb/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
684 Commits 1 Branch 0 Tags
1408403decedd3e5b8772dedc2f35af79c817c7a
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Erik Arvstedt 1408403dec bitcoind: clarify how bitcoin-cli RPC access is enabled 
It's not immediately clear why rpcuser/rpcpassword are needed in addition to the rpcauth
config entries.
 2020-08-26 22:52:47 +02:00
Erik Arvstedt 4790c601a1 bitcoind: move rpc user config to bitcoind 
This enables modules-only usage.
The privileged user is needed by bitcoind (cli), the public user is
needed by other services.
 2020-08-26 22:52:47 +02:00
Erik Arvstedt 876cfadf1a bitcoind: add rpc user option 'passwordHMACFromFile' 
This allows adding additional rpc users without the need for
user-specific code in preStart.
 2020-08-26 22:52:47 +02:00
Erik Arvstedt 59434e79f0 bitcoind: simplify default rpc user name config 2020-08-26 21:16:32 +02:00
Erik Arvstedt 205829b91f bitcoind: remove whitespace 2020-08-26 21:16:32 +02:00
Erik Arvstedt e5fb3f6a7f run-tests: document how to pass extra build args 2020-08-25 14:58:04 +02:00
Erik Arvstedt df790f6766 run-tests: allow linking test build results for all scenarios 2020-08-25 14:58:04 +02:00
Erik Arvstedt 91697b1427 test: allow for testing all scenarios 
Test all scenarios by default when running 'build' (which happens
when the script is called without arguments).

Default to scenario 'default' in other test commands like 'debug'.
 2020-08-25 14:53:13 +02:00
Erik Arvstedt 28236691aa test: rename scenarios/lib.py -> base.py 
This file isn't a scenario, it's also not a lib because it contains
the main share of actual tests.
 2020-08-25 14:53:13 +02:00
Erik Arvstedt 80da0a41bc test: load complete test environment in debug mode 
Stop just before executing actual tests.
This makes all test functions accessible in debug mode.
 2020-08-25 14:53:12 +02:00
Erik Arvstedt 9b4cd7bd1c test: simplify scenario handling 
We can switch to a more sophisticated scheme later when adding more scenarios
 2020-08-25 14:53:12 +02:00
Erik Arvstedt 0f56ea6ad1 test: include scenario in test name 2020-08-25 14:53:12 +02:00
Erik Arvstedt 9237e5dc3d test: use pydoc docstring 2020-08-25 14:53:12 +02:00
Erik Arvstedt ed73627e02 netns-exec: minor style fixes 
- Use inline variable declarations
- Improve messages
- Fix naming: available -> allowed
- Simplify intro comment
 2020-08-25 14:53:12 +02:00
Erik Arvstedt 91ebc2d517 netns-exec: simplify installation 2020-08-25 14:53:12 +02:00
Erik Arvstedt 809e754851 netns: improve bridge setup 
- Explain why we don't use option `networking.bridges`
- Make the bridge setup service part of NixOS' network-setup.service.
  This yields no noticable functional changes for now, but it's
  conceptually cleaner to finish the network setup before network.target
  becomes active.
- Add 'nb-' prefix to service name
 2020-08-25 14:53:12 +02:00
Erik Arvstedt b7450877a0 netns: rename bridge peer devices br-nb-veth* -> nb-veth-br* 
This ensures a consistent 'nb-' namespace and simplifies the
dhcpcd.denyInterfaces rules.

Also rename vethName -> veth.
 2020-08-25 14:53:12 +02:00
Erik Arvstedt 8bfb7bb2f8 netns: rename bridge br0 -> nb-br 
br0 has a high risk of name clashes when nix-bitcoin used as part of a
larger config.
Use a more specific name.
 2020-08-25 14:53:08 +02:00
Erik Arvstedt 32e70a7516 netns: move webindex config for modules-only usage 
webindex is only available in secure-node.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt 121301337b netns: add option 'allowedUser' for modules-only usage 
The dependency on secure-node.nix prevented using nix-bitcoin by just
importing modules.nix.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt 9715134f06 netns: don't repeat cli definitions 
1. Saves some code.
2. Guarantees that the netns and no-netns cli defs are always in sync.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt e385c73256 netns: separate implementation and service configs 
This greatly improves clarity.

Especially the bitcoind-import-banlist.serviceConfig definition was out
of place.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt d0b8d77de2 netns: remove conditionals for service settings 
Going without the conditionals (like in secure-node.nix) adds
readability and doesn't reduce evaluation performance (in fact, it
even slightly improves performance due to implementation details
of mkIf).

To avoid errors, remove use of disabled services in secure-node.nix and
nix-bitcoin-webindex.nix.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt 0f0f6ddbb9 netns: add comment about undesirable algorithmic complexity 
We don't want to be Accidentally Quadratic™
 2020-08-25 11:40:26 +02:00
Erik Arvstedt a3ae8668e6 netns: use map instead of concatMap 2020-08-25 11:40:26 +02:00
Erik Arvstedt b7fc819be5 netns: consistent var naming 
n is used elsewhere in similar contexts.
 2020-08-25 11:40:26 +02:00
Erik Arvstedt 5a81693ef3 netns: add range check for netns ids 2020-08-25 11:40:26 +02:00
Erik Arvstedt 74f1610668 netns: clarify addressblock description 2020-08-25 11:40:26 +02:00
Erik Arvstedt 4eb92df08c netns: remove redundant filter 
The 'availableNetns' connection matrix only consists of enabled entries,
so no extra filtering is needed.
Reason: availableNetns starts with the filtered 'base' and is then symmetrised.
 2020-08-25 11:40:26 +02:00
Erik Arvstedt 50de54aef1 netns: remove empty connections defs 
Like in the netns defintion for bitcoind.
 2020-08-25 11:40:26 +02:00
Erik Arvstedt 44de5064cd security: don't restrict process info by default for module users 2020-08-20 13:12:07 +02:00
Erik Arvstedt a36789b468 test: move security tests to separate function 2020-08-20 13:12:06 +02:00
Erik Arvstedt 588a0b2405 security: enable full systemd-status for group 'proc' 
Previously, systemd-status was broken for all users except root.

Use a 'default' deny policy, which is overridden for group 'proc'.

Add operator to group 'proc'.

Also, remove redundant XML boilerplate.
 2020-08-20 13:12:06 +02:00
Erik Arvstedt 96ea2e671c security: simplify and fix dbus configuration 
Previously, due to the dependency on a helper service, this dbus config
was initially inactive after system boot, allowing for unrestricted use
of the problematic dbus call.
This also broke the accompanying VM test on faster systems.

Remove 'allow' policy for root because it's a no-op:
1. It's overridden by the 'mandatory' deny policy.
2. Root can use all dbus calls anyways, regardless of policy settings.

Also, add some comments.
 2020-08-20 13:12:06 +02:00
Erik Arvstedt 343e026030 rename dbus.nix -> security.nix 
This file has a broader scope than just configuring dbus.
 2020-08-20 13:12:06 +02:00
Erik Arvstedt 7367446761 test: rename assert_matches_exactly -> assert_full_match 
More precise, needed in a later commit.
 2020-08-20 13:12:05 +02:00
Erik Arvstedt db48ab9b69 services: use 'port' option type 2020-06-02 17:31:28 +02:00
Erik Arvstedt 5f3f362451 lnd: add strict hardening 
Add ProtectSystem=strict, remove PermissionStartOnly.

Extract the section of postStart that needs secrets dir write
access into a separate script with full privileges.

Simplify preStart and fix dataDir quoting.
 2020-05-22 16:13:58 +00:00
Erik Arvstedt 0f1ee5f533 examples: improve shell session usability 
- Add usage prompt when starting shell sessions

- Give all examples an uniform interface ("c") for running commands
  or starting a shell on the node.
 2020-05-17 23:53:32 +02:00
Erik Arvstedt 719dcd77bb examples: execute bash sessions in script environment 
Previously, the sessions contained only explicitly exported variables
and functions.
This was fragile and in part buggy due to lacking exports.

Interactive features like user-defined aliases and functions are still
working as before.
 2020-05-17 14:30:39 +02:00
Erik Arvstedt 509fca5328 fix syntax error 
Fixes #172
 2020-05-06 12:13:32 +02:00
Erik Arvstedt b9f07bf706 test: use older qemu version for travis compatibility 2020-05-04 11:34:22 +00:00
Erik Arvstedt 026a22fcee use python testing from stable nixpkgs 2020-05-04 11:34:05 +00:00
Erik Arvstedt 2d3a1e839e electrs: fix conditional cargoSha256 2020-05-03 18:32:56 +00:00
Erik Arvstedt 4dc6c3ba5d add option 'dataDirReadableByGroup' 
These settings are now more accessible for users that don't use
nix-bitcoin's default node config.
Additionally, remove 'other' permissions via umask.
 2020-04-16 15:55:34 +02:00
Erik Arvstedt 7ffbe83de3 README: add links to example scripts 2020-04-15 18:57:55 +02:00
Erik Arvstedt ade3f84317 examples: add shell session snippets 2020-04-15 18:55:02 +02:00
Erik Arvstedt 3e188238d0 only update bitcoin.conf when changed 2020-04-12 22:32:37 +02:00
Erik Arvstedt 08322eed9b use [[ test 2020-04-12 22:32:37 +02:00
Erik Arvstedt 201fc33782 move line to relevant code section (blocks dir setup) 2020-04-12 22:32:37 +02:00
Erik Arvstedt 1f8fe310d0 remove option 'configFileOption' 
It doesn't make sense for bitcoind users to completely redefine their
config file. Also, it's poorly named and the description is faulty.

This is a breaking change, but this option has probably no actual users.
 2020-04-12 22:32:37 +02:00
Erik Arvstedt 4e5c1d7551 disable redundant logfile 2020-04-12 22:32:37 +02:00
Erik Arvstedt a05551fd1c improve config file formatting 2020-04-12 22:32:37 +02:00
Erik Arvstedt 5e81d60d63 improve formatting 2020-04-12 22:32:37 +02:00
Erik Arvstedt d60a5aa4db define rpc.users submodule inline 
Improves readability.
 2020-04-12 22:32:37 +02:00
Erik Arvstedt 1a2271fb14 remove unused variable 'hexStr' 2020-04-12 22:32:36 +02:00
Erik Arvstedt 4e92b1c818 remove redundant hardening options 
These are already defined in nix-bitcoin-services.defaultHardening.
 2020-04-12 22:32:36 +02:00
Erik Arvstedt 47fd6cd0f3 simplify ExecStart 2020-04-12 22:32:36 +02:00
Erik Arvstedt 64fc63cc40 remove pidFile 
- service type "simple" is the default
- pidFile is not needed for service type "simple"
 2020-04-12 22:32:36 +02:00
Erik Arvstedt bceaa361ca operator: allow reading systemd journal 2020-04-09 11:02:06 +02:00
Erik Arvstedt 145961c2de fix operator authorized keys setup 
This fixes these flaws in `copy-root-authorized-keys`:
- When `.vbox-nixops-client-key` is missing, operator's authorized_keys
  file is always appended to, growing the file indefinitely.
- Service is always added and not restricted to nixops-vbox deployments.
 2020-04-09 11:02:06 +02:00
Erik Arvstedt 37b2faf63c move systemPackages definitions to services 
These are generally useful and shouldn't be limited to secure-node.nix.

Also, only add the hardware-wallets group when hardware wallets are enabled.
 2020-04-08 17:35:14 +02:00
Erik Arvstedt 6c22e13b7f copy-root-authorized-keys: use inline script definition 2020-04-08 17:35:14 +02:00
Erik Arvstedt 63c6fe3213 fixup! use '' for multi-line string 2020-04-08 17:35:14 +02:00
Erik Arvstedt ab617946a9 extract variable 'cfg' 2020-04-08 17:35:13 +02:00
Erik Arvstedt 36c84d8360 add option clightning.onionport 
Analogous to electrs.onionport
 2020-04-08 17:35:13 +02:00
Erik Arvstedt 681dbaf328 move electrs.onionport option 
Only used in secure-node.nix
 2020-04-08 17:35:13 +02:00
Erik Arvstedt 74fbfa3a5d use lib.optionals 2020-04-08 17:35:13 +02:00
Erik Arvstedt ec6d33fbb6 rearrange code sections 
Move services to the top, operator account setup to the bottom.
 2020-04-08 17:35:13 +02:00
Erik Arvstedt e16ddc9c77 extract 'mkHiddenService' 
toPort equals port by default.
 2020-04-08 17:35:13 +02:00
Erik Arvstedt 89d3d58850 use mkIf 2020-04-08 17:35:13 +02:00
Erik Arvstedt 85e52a06cb improve grouping of suboptions 2020-04-08 17:35:12 +02:00
Erik Arvstedt 1a63f0ca6a remove option 'services.nix-bitcoin.enable' 
Users can enable the node config just by importing secure-node.nix
 2020-04-08 17:35:12 +02:00
Erik Arvstedt 0f8b2e91fd add nix-bitcoin.nix for backwards compatibility 2020-04-08 17:35:12 +02:00
Erik Arvstedt 28792f79dc rename nix-bitcoin.nix -> presets/secure-node.nix 2020-04-08 17:35:12 +02:00
Erik Arvstedt 041ec55794 nixops: build with pinned nixpkgs 2020-04-08 17:29:50 +02:00
Erik Arvstedt 705d187a35 examples/shell.nix: don't run shellHook on subsequent nix-shells 
This avoids an extra delay and the unexpected creation of secrets when
run in another dir.

Needed for the 'fetch-release' script introduced in a later commit.
 2020-03-30 11:00:31 +02:00
Erik Arvstedt 9df22a2764 add deploy-qemu-vm.sh example 2020-03-30 10:56:57 +02:00
Erik Arvstedt abcee651d3 add deploy-container.sh 2020-03-30 10:49:15 +02:00
Erik Arvstedt e398674964 run-tests.sh: fix leaking tmp files outside TMPDIR 
- Move vm image (NIX_DISK_IMAGE) from $TMP to $TMPDIR
- Set $PWD

Also:
- Simplify mktemp command
- USE_TMPDIR=1: Don't create extra dir inside $TMPDIR
 2020-03-29 18:51:35 +02:00
Erik Arvstedt b07c77f4a4 secrets.nix: remove obsolete comment 2020-03-29 18:51:34 +02:00
Erik Arvstedt 3a606608fb remove custom no-upnp bitcoind builds 
Disabling upnp via compilation brings no substantial security benefits.
There's no way to inadvertently enable upnp, it must be set explicitly
via bitcoind.extraConfig.

But it's a huge hassle for new users who have to recompile bitcoind
before being able to use nix-bitcoin.

Also, elementsd is currently built with upnp support by default.
 2020-03-26 10:14:03 +01:00
Erik Arvstedt 5dadea310c add deploy-nixops.sh 2020-03-24 21:43:22 +00:00
Erik Arvstedt 0c74c365de mention performance loss with hardened kernel profile 2020-03-24 21:43:22 +00:00
Erik Arvstedt f3121892ef move main module import to configuration.nix 2020-03-24 21:43:21 +00:00
Erik Arvstedt 0c0978c007 extract module 'deployment/nixops.nix', add option 'deployment.secretsDir' 2020-03-24 21:43:21 +00:00
Erik Arvstedt 5596bcf4fb bitcoind: set default rpcuser 
We're already setting a default rpcpassword, so we should set an
accompanying rpcuser so that rpc clients like electrs work out of the box.
 2020-03-04 18:09:52 +01:00
Erik Arvstedt c4cf323873 electrs: add option 'extraArgs' 
Electrs allows defining settings multiple times via cmdline args, but
not via config files.
So 'extraArgs' is the only way to implement overridable settings,
'extraOptions' wouldn't work.
 2020-03-04 18:09:52 +01:00
Erik Arvstedt e731d71232 electrs: add option 'address' 2020-03-04 18:09:52 +01:00
Erik Arvstedt 1e62456ed1 electrs: test RPC connection to bitcoind 2020-03-04 18:09:52 +01:00
Erik Arvstedt 0be67c325e electrs: use cfg.user, cfg.group 2020-03-04 18:09:51 +01:00
Erik Arvstedt 48be5a79fa electrs.enable: use mkEnableOption 2020-03-04 18:09:51 +01:00
Erik Arvstedt b75b2a1626 electrs: improve description 2020-03-04 18:09:51 +01:00
Erik Arvstedt fa3455d01f electrs: don't leak bitcoinrpc secret through process ARGV 
Supply secret via private config file instead.
 2020-03-04 18:09:51 +01:00
Erik Arvstedt f30aadbef2 electrs: enable unstable build, pin pkg to unstable 
stable's buildRustPackage is painfully slow when evaluating (adds >1 sec
even on a fast machine).

This is fixed (https://github.com/NixOS/nixpkgs/pull/69274) in unstable.
 2020-03-04 18:09:50 +01:00
Erik Arvstedt 5c6571654e electrs: 0.7.1 -> 0.8.3 
Use buildRustPackage instead of buildRustCrate (via crate2nix).

buildRustPackage builds the whole executable and its libraries in a
single `cargo build` process.

With the create2nix approach each library is built in a separate derivation,
directly using rustc instead of the cargo wrapper.

Benefits of buildRustPackage:
- Much simpler to maintain
- Package derivation evaluates much faster

Benefits of crate2nix:
- Build can be distributed over multiple build hosts
- Better sharing of common dependencies between different builds
- More fine-grained rebuilding on build failures

In nixpkgs buildRustPackage is used for almost all Rust pkgs, it's
also a better fit for our use case.
 2020-03-04 18:09:50 +01:00
Erik Arvstedt 47481b2642 electrs: quote dataDir in shell cmd 2020-03-04 18:09:50 +01:00
Erik Arvstedt 8fb33d1099 electrs: use bitcoind.dataDir option 2020-03-04 18:09:50 +01:00
Erik Arvstedt 45ba1f1fb3 electrs: don't print timestamps to log 
Already provided by journald.
 2020-03-04 18:09:49 +01:00
Erik Arvstedt 88080a58bf electrs: wrap long lines in preStart 2020-03-04 18:09:49 +01:00