Even when an identity file (i.e. a private key) is specified, SSH
tries all keys loaded by the SSH agent first for authentication
(if an agent is running).
When the agent returns many keys this can lead to a "Too Many Failures"
auth error, because none of the agent keys are accepted by the VM SSH
server.
Fix this by only using the provided key.
Since version 257 (NixOS 25.05), systemd-nspawn automatically creates a
/dev/fuse node in the container when the host's FUSE node is accessible
to the nspawn process:
https://github.com/systemd/systemd/pull/34067
bitcoind 29.x is required for joinmarket.
nixos-25.05 is at 29.0, which is a regression from 29.1.
nixos-unstable is at 30.0, which is incompatible.
Adapted from nixpkgs `96ff46705a694219cefa5155ba52203d9d32e65e`, with
minor modifications to make it compatible with nixos 25.05.
In `buildTests`, `nixInstantiate` is called in a subshell.
When `tmpDir` is unset before the call, the tmpdir is created in the
subshell and gets deleted before subshell exit (via `trap`).
But subsequent code accesses the tmpdir, which has now been deleted,
leading to an error.
This bug has been undetected for a long time because bash 5.2 has a
bug [1] where `trap` is not always executed, causing the tmpdir to never be deleted.
Bash 5.3 (introduced in NixOS 25.05) now works correctly and exposes the bug.
Fix it by creating the tmpdir before the subshell call.
[1] https://mail.gnu.org/archive/html/help-bash/2024-07/msg00007.html
Use `nix build --print-build-logs` to prefix the build output with the
name of its derivation.
This helps to distinguish build outputs when output is interleaved in
parallel builds.
- Use `sourceRoot`
- Allow `generate.sh` to directly trigger the build of `nodeModules`.
Needed by mempool 3.2.1, where `mempool-backend` has multiple fixed output
derivation dependencies, which can only be updated if they can be
built directly.
This option is unneeded because `bitcoin-cli` auth and connection
settings are already provided by other options like `bitcoin-rpcpassword`.
In bitcoind versions prior to 29.0, option `datadir` (passed by clightning to `bitcoin-cli`)
was therefore ignored.
Since 29.0, option `datadir` is always checked for validity. This causes a
file permission error because service clighting has no access to the
bitcoin datadir. This is now fixed.
Let A be a service that depends on another service B.
When A can gracefully handle failures and restarts of B, use
```
wants = [ "B.service" ];
after = [ "B.service" ];
```
instead of
```
requires = [ "B.service" ];
after = [ "B.service" ];
```
in the definition of A.
This way, A keeps running when B is stopped or restarted after a failure.
With `requires`, A is instead stopped when B is stopped or restarted due to a failure.
This brings two benefits:
1. Improved uptime
Examples:
- RTL keeps running when one lightning node has failed
- btcpayserver keeps running and accepting on-chain payments when the lightning node has crashed
2. Avoids a systemd bug where depending units (`A.service` in the
above example) are not restarted when their dependency fails
(issue github/systemd#18856, no full link to avoid spamming the issue).
In real world nix-bitcoin deployments, this issue was only likely to
appear when clightning failed during activation, causing depending
units (like `RTL`) to stop and not be restarted.
All services depending on `clightning` have now been changed to use
`wants`, thereby avoiding the bug.
Services `electrs` and `lightning-loop` fail when their respective
dependencies stop, so these services have not been changed.
I also haven't changed services `joinmarket` and
`joinmarket-yieldgenerator`. Further manual testing is needed to
determine if they can be switched to `wants`.
Use the `update-flake.sh` script to auto-update the NixOS version at
various places.
Also update `examples/container/flake.nix` which has been
missing in the update instructions.
This test requires `electrs` to be enabled.
Also, by using `electrs` instead of `clightning` we avoid the bug
where clightning hangs at startup when internet access is unavailable.
Due to technical limititations, internet access is available in NixOS
containers only after the container has started.
Nix 2.24 is the default in NixOS 24.11.
This is required by the following commit that uses a `flake update`
command syntax only supported by Nix >= 2.19.
By wrapping the value in a list, users can add other `ExecStartPost` scripts.
The previous scalar value could only be replaced, but not merged with
other definitions.
These options are set by default in `jmclient/configure.py` and don't
need to be repeated.
Some options, like those in section `POLICY`, might be assigned more
suitable default values in future joinmarket releases, so don't override
them in nix-bitcoin.
Ensure that the file relative to the example scripts is called.
Previously, the unqualified call would give precedence to source files in
PATH. This could lead to the wrong file being called when dir
`helper` (containing another file named `start-bash-session.sh`) was in PATH.
Erik Arvstedt