pleb/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
784 Commits 1 Branch 0 Tags
937aee00629393847a60871bb758995ee2825cce
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Erik Arvstedt 937aee0062 spark-wallet: add regtest support 2020-10-16 18:01:50 +02:00
Erik Arvstedt 47d611b5ef spark-wallet: use tor rate provider only when enforceTor 2020-10-16 18:01:50 +02:00
Erik Arvstedt 127b186c3c spark-wallet: simplify start script 
Also:
- quote paths
- use long form args
 2020-10-16 18:01:50 +02:00
Erik Arvstedt 0f32f3c99e clightning: add regtest support 2020-10-16 18:01:50 +02:00
Erik Arvstedt c24ac5d363 clightning: remove redundant option 'bitcoin-rpcconnect' 2020-10-16 18:01:50 +02:00
Erik Arvstedt abd32cde30 clightning: enable config file read access for group 
Enables lightning-cli group access when nonstandard config options are set.
 2020-10-16 18:01:50 +02:00
Erik Arvstedt ddadaed3da clightning: always use bind-addr in config 
bind-addr can't be null.
 2020-10-16 18:01:50 +02:00
Erik Arvstedt 9e928e2097 bitcoind: add regtest support 
Remove unsupported option 'testnet'.
 2020-10-16 18:01:49 +02:00
Erik Arvstedt bfed10b2fa run-tests: add command 'all' 
'all' includes test 'full', which now succeeds.
 2020-10-16 16:46:56 +02:00
Erik Arvstedt 0a6b9beda5 run-tests: simplify setting default scenario 2020-10-16 16:46:56 +02:00
Erik Arvstedt 1a32292e07 test: speed up clightning startup when offline 2020-10-16 16:46:56 +02:00
Erik Arvstedt 7d1797cec7 clightning: add option 'extraConfig' 2020-10-16 16:46:56 +02:00
Erik Arvstedt e0117d56d1 spark-wallet: fix always-on onion-chef setting 
Previously, the service failed when onion-service was disabled.
 2020-10-16 16:46:55 +02:00
Erik Arvstedt 480d0d3959 liquid: fix bitcoin rpc settings 
- Remove redundant option mainchainrpchost.
  This option is already provided by bitcoind.
- Set a working default for rpcport and rpcuser.
  Enables use without secure-node.
 2020-10-16 16:46:55 +02:00
Erik Arvstedt c07e767889 test: add python test requirements 
This allows running the Python tests without importing secure-node.
 2020-10-16 16:46:55 +02:00
Erik Arvstedt 9aa19c3fdd extract operator module 2020-10-16 16:46:55 +02:00
Erik Arvstedt 2dd1a741f7 modules: group imports 2020-10-16 16:46:55 +02:00
Erik Arvstedt 1cc432a136 examples/deploy-container: use new extra-container features 2020-10-16 15:53:34 +02:00
Erik Arvstedt 16b2783ae7 examples: enable running outside of working dir 2020-10-16 15:53:34 +02:00
Erik Arvstedt 04075b108c test: use QEMU from stable nixpkgs 2020-10-16 15:53:34 +02:00
Erik Arvstedt 03f8dbba47 test: add non-secure-node eval test 
This tests that the modules work without the secure-node template.

The test currently fails at runtime, but evaluating already helps
catching module-related errors.
 2020-10-16 15:53:34 +02:00
Erik Arvstedt bb763d6a26 run-tests: add 'eval' command 2020-10-16 15:53:34 +02:00
Erik Arvstedt 36358066e4 spark-wallet: don't disable tor when onion-service is disabled 
This fixes modules-only usage.

We can leave enabling tor and tor.client to secure-node.nix, on which
spark-wallet has a strict dependency.
 2020-10-16 15:53:33 +02:00
Erik Arvstedt c9251e72a1 README: add run-tests.sh to examples 2020-10-16 15:53:33 +02:00
Erik Arvstedt 5a565dff66 netns test: use netns ips from config 2020-10-16 15:53:33 +02:00
Erik Arvstedt ac95fe7c82 netns test: don't test recurring-donations 
This service is not enabled and its netns doesn't exist.
 2020-10-16 15:53:33 +02:00
Erik Arvstedt 84744f38d7 netns test: disable backup test 2020-10-16 15:53:33 +02:00
Erik Arvstedt fcc67da9f4 test: add container support 2020-10-16 15:53:33 +02:00
Erik Arvstedt e99b7edb8e run-tests: pass script args verbatim to command without word splitting 
Needed for the upcoming 'container' command
 2020-10-16 15:53:33 +02:00
Erik Arvstedt e7c397a485 run-tests: rename scriptDir -> testDir 
Needed for container support.
 2020-10-16 15:53:32 +02:00
Erik Arvstedt b552d17d55 run-tests: fix arg error messages 
$1 was not substituted due to single quotes.
 2020-10-16 15:53:32 +02:00
Erik Arvstedt 572967d3ad extra-container: pre-release -> 0.5-pre 2020-10-16 15:53:32 +02:00
Erik Arvstedt ac6cee5c12 pkgs: add extra-container 2020-10-11 19:40:26 +02:00
Erik Arvstedt be2127ae5b test: fix noConnections configs 
- bitcoind: remove mkForce because otherwise the whole extraConfig is replaced
  by the value of mkForce.

- liquidd: don't disable 'listen' because it is entirely benign in offline
  mode, we also allow it for bitcoind.
 2020-10-11 19:40:08 +02:00
Erik Arvstedt 1e18d3ea3b test: improve modularization 
This improves debugging and experimenting by making it easy to compose fine-grained
scenarios that have specific tests and features enabled.

The VM test output now includes the subtest name and duration.

Remove the 'raise Exception()' hack for interactive mode.

Run 'banlist-and-restart' test before 'backups'. This speeds up the test
by avoiding an extra shutdown of all bitcoin-related services.
 2020-10-11 19:40:08 +02:00
Erik Arvstedt 14d2d97ba6 test: rename scenario withnetns -> netns 
This makes the naming consistent with scenarios added in later
commits.
 2020-09-30 11:26:41 +02:00
Erik Arvstedt 9bf77ee3e8 backups test: simplify and speed up 2020-09-30 11:26:41 +02:00
Erik Arvstedt fcda69e8b6 netns test: connect from main netns 
All services are reachable from the main netns, no need to enter
service network namespaces.

This allows us to remove extra_tests.
 2020-09-30 11:26:41 +02:00
Erik Arvstedt 24069aa2c6 electrs: add option 'monitoringPort' 2020-09-30 11:26:41 +02:00
Erik Arvstedt 611cfe5a28 electrs: remove redundant daemonrpc option 2020-09-30 11:26:41 +02:00
Erik Arvstedt a19d3b07c2 electrs: add variable 'bitcoind' 2020-09-30 11:26:41 +02:00
Erik Arvstedt a6dde36b87 electrs: use consistent args formatting 
One line per arg.
 2020-09-30 11:26:40 +02:00
Erik Arvstedt 45bcbf683d test: rename test.nix -> tests.nix 
The plural is consistent with tests.py and run-tests.sh
 2020-09-30 11:26:40 +02:00
Erik Arvstedt c92e85f707 test: rename base.py -> tests.py 2020-09-30 11:26:40 +02:00
Erik Arvstedt 774da9d4e0 generate-secrets: fix python version for rpcauth 
I accidentally included the minor version number.
Version 3.5 has been removed from nixpkgs unstable.
 2020-09-24 16:32:38 +02:00
Erik Arvstedt 6f032e3c40 lnd: fix mnemonic file access vulnerability 
Previously, the file was readable by 'other' for a short time after
creation.
 2020-09-15 12:09:00 +00:00
Erik Arvstedt 9b6a3ec835 generate-secrets: extract fn 'makeHMAC' 2020-08-27 12:20:06 +02:00
Erik Arvstedt ca18ffb90a generate-secrets: fetch rpcauth.py from github 
No need to vendor this.
 2020-08-27 12:20:06 +02:00
Erik Arvstedt 4d6127bb76 bitcoind: clarify RPC whitelist test 
- Remove redundant comment
- Test with obviously unsafe RPC call 'stop'
- No need to test privileged user who has no whitelist
 2020-08-27 12:19:49 +02:00
Erik Arvstedt 9d610991be bitcoind: remove custom rpc user names 
Simpler.
We've just removed option 'bitcoind.rpcuser', so we can also remove the
old name 'bitcoinrpc'.
 2020-08-27 11:39:26 +02:00
Erik Arvstedt 1408403dec bitcoind: clarify how bitcoin-cli RPC access is enabled 
It's not immediately clear why rpcuser/rpcpassword are needed in addition to the rpcauth
config entries.
 2020-08-26 22:52:47 +02:00
Erik Arvstedt 4790c601a1 bitcoind: move rpc user config to bitcoind 
This enables modules-only usage.
The privileged user is needed by bitcoind (cli), the public user is
needed by other services.
 2020-08-26 22:52:47 +02:00
Erik Arvstedt 876cfadf1a bitcoind: add rpc user option 'passwordHMACFromFile' 
This allows adding additional rpc users without the need for
user-specific code in preStart.
 2020-08-26 22:52:47 +02:00
Erik Arvstedt 59434e79f0 bitcoind: simplify default rpc user name config 2020-08-26 21:16:32 +02:00
Erik Arvstedt 205829b91f bitcoind: remove whitespace 2020-08-26 21:16:32 +02:00
Erik Arvstedt e5fb3f6a7f run-tests: document how to pass extra build args 2020-08-25 14:58:04 +02:00
Erik Arvstedt df790f6766 run-tests: allow linking test build results for all scenarios 2020-08-25 14:58:04 +02:00
Erik Arvstedt 91697b1427 test: allow for testing all scenarios 
Test all scenarios by default when running 'build' (which happens
when the script is called without arguments).

Default to scenario 'default' in other test commands like 'debug'.
 2020-08-25 14:53:13 +02:00
Erik Arvstedt 28236691aa test: rename scenarios/lib.py -> base.py 
This file isn't a scenario, it's also not a lib because it contains
the main share of actual tests.
 2020-08-25 14:53:13 +02:00
Erik Arvstedt 80da0a41bc test: load complete test environment in debug mode 
Stop just before executing actual tests.
This makes all test functions accessible in debug mode.
 2020-08-25 14:53:12 +02:00
Erik Arvstedt 9b4cd7bd1c test: simplify scenario handling 
We can switch to a more sophisticated scheme later when adding more scenarios
 2020-08-25 14:53:12 +02:00
Erik Arvstedt 0f56ea6ad1 test: include scenario in test name 2020-08-25 14:53:12 +02:00
Erik Arvstedt 9237e5dc3d test: use pydoc docstring 2020-08-25 14:53:12 +02:00
Erik Arvstedt ed73627e02 netns-exec: minor style fixes 
- Use inline variable declarations
- Improve messages
- Fix naming: available -> allowed
- Simplify intro comment
 2020-08-25 14:53:12 +02:00
Erik Arvstedt 91ebc2d517 netns-exec: simplify installation 2020-08-25 14:53:12 +02:00
Erik Arvstedt 809e754851 netns: improve bridge setup 
- Explain why we don't use option `networking.bridges`
- Make the bridge setup service part of NixOS' network-setup.service.
  This yields no noticable functional changes for now, but it's
  conceptually cleaner to finish the network setup before network.target
  becomes active.
- Add 'nb-' prefix to service name
 2020-08-25 14:53:12 +02:00
Erik Arvstedt b7450877a0 netns: rename bridge peer devices br-nb-veth* -> nb-veth-br* 
This ensures a consistent 'nb-' namespace and simplifies the
dhcpcd.denyInterfaces rules.

Also rename vethName -> veth.
 2020-08-25 14:53:12 +02:00
Erik Arvstedt 8bfb7bb2f8 netns: rename bridge br0 -> nb-br 
br0 has a high risk of name clashes when nix-bitcoin used as part of a
larger config.
Use a more specific name.
 2020-08-25 14:53:08 +02:00
Erik Arvstedt 32e70a7516 netns: move webindex config for modules-only usage 
webindex is only available in secure-node.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt 121301337b netns: add option 'allowedUser' for modules-only usage 
The dependency on secure-node.nix prevented using nix-bitcoin by just
importing modules.nix.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt 9715134f06 netns: don't repeat cli definitions 
1. Saves some code.
2. Guarantees that the netns and no-netns cli defs are always in sync.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt e385c73256 netns: separate implementation and service configs 
This greatly improves clarity.

Especially the bitcoind-import-banlist.serviceConfig definition was out
of place.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt d0b8d77de2 netns: remove conditionals for service settings 
Going without the conditionals (like in secure-node.nix) adds
readability and doesn't reduce evaluation performance (in fact, it
even slightly improves performance due to implementation details
of mkIf).

To avoid errors, remove use of disabled services in secure-node.nix and
nix-bitcoin-webindex.nix.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt 0f0f6ddbb9 netns: add comment about undesirable algorithmic complexity 
We don't want to be Accidentally Quadratic™
 2020-08-25 11:40:26 +02:00
Erik Arvstedt a3ae8668e6 netns: use map instead of concatMap 2020-08-25 11:40:26 +02:00
Erik Arvstedt b7fc819be5 netns: consistent var naming 
n is used elsewhere in similar contexts.
 2020-08-25 11:40:26 +02:00
Erik Arvstedt 5a81693ef3 netns: add range check for netns ids 2020-08-25 11:40:26 +02:00
Erik Arvstedt 74f1610668 netns: clarify addressblock description 2020-08-25 11:40:26 +02:00
Erik Arvstedt 4eb92df08c netns: remove redundant filter 
The 'availableNetns' connection matrix only consists of enabled entries,
so no extra filtering is needed.
Reason: availableNetns starts with the filtered 'base' and is then symmetrised.
 2020-08-25 11:40:26 +02:00
Erik Arvstedt 50de54aef1 netns: remove empty connections defs 
Like in the netns defintion for bitcoind.
 2020-08-25 11:40:26 +02:00
Erik Arvstedt 44de5064cd security: don't restrict process info by default for module users 2020-08-20 13:12:07 +02:00
Erik Arvstedt a36789b468 test: move security tests to separate function 2020-08-20 13:12:06 +02:00
Erik Arvstedt 588a0b2405 security: enable full systemd-status for group 'proc' 
Previously, systemd-status was broken for all users except root.

Use a 'default' deny policy, which is overridden for group 'proc'.

Add operator to group 'proc'.

Also, remove redundant XML boilerplate.
 2020-08-20 13:12:06 +02:00
Erik Arvstedt 96ea2e671c security: simplify and fix dbus configuration 
Previously, due to the dependency on a helper service, this dbus config
was initially inactive after system boot, allowing for unrestricted use
of the problematic dbus call.
This also broke the accompanying VM test on faster systems.

Remove 'allow' policy for root because it's a no-op:
1. It's overridden by the 'mandatory' deny policy.
2. Root can use all dbus calls anyways, regardless of policy settings.

Also, add some comments.
 2020-08-20 13:12:06 +02:00
Erik Arvstedt 343e026030 rename dbus.nix -> security.nix 
This file has a broader scope than just configuring dbus.
 2020-08-20 13:12:06 +02:00
Erik Arvstedt 7367446761 test: rename assert_matches_exactly -> assert_full_match 
More precise, needed in a later commit.
 2020-08-20 13:12:05 +02:00
Erik Arvstedt db48ab9b69 services: use 'port' option type 2020-06-02 17:31:28 +02:00
Erik Arvstedt 5f3f362451 lnd: add strict hardening 
Add ProtectSystem=strict, remove PermissionStartOnly.

Extract the section of postStart that needs secrets dir write
access into a separate script with full privileges.

Simplify preStart and fix dataDir quoting.
 2020-05-22 16:13:58 +00:00
Erik Arvstedt 0f1ee5f533 examples: improve shell session usability 
- Add usage prompt when starting shell sessions

- Give all examples an uniform interface ("c") for running commands
  or starting a shell on the node.
 2020-05-17 23:53:32 +02:00
Erik Arvstedt 719dcd77bb examples: execute bash sessions in script environment 
Previously, the sessions contained only explicitly exported variables
and functions.
This was fragile and in part buggy due to lacking exports.

Interactive features like user-defined aliases and functions are still
working as before.
 2020-05-17 14:30:39 +02:00
Erik Arvstedt 509fca5328 fix syntax error 
Fixes #172
 2020-05-06 12:13:32 +02:00
Erik Arvstedt b9f07bf706 test: use older qemu version for travis compatibility 2020-05-04 11:34:22 +00:00
Erik Arvstedt 026a22fcee use python testing from stable nixpkgs 2020-05-04 11:34:05 +00:00
Erik Arvstedt 2d3a1e839e electrs: fix conditional cargoSha256 2020-05-03 18:32:56 +00:00
Erik Arvstedt 4dc6c3ba5d add option 'dataDirReadableByGroup' 
These settings are now more accessible for users that don't use
nix-bitcoin's default node config.
Additionally, remove 'other' permissions via umask.
 2020-04-16 15:55:34 +02:00
Erik Arvstedt 7ffbe83de3 README: add links to example scripts 2020-04-15 18:57:55 +02:00
Erik Arvstedt ade3f84317 examples: add shell session snippets 2020-04-15 18:55:02 +02:00
Erik Arvstedt 3e188238d0 only update bitcoin.conf when changed 2020-04-12 22:32:37 +02:00
Erik Arvstedt 08322eed9b use [[ test 2020-04-12 22:32:37 +02:00
Erik Arvstedt 201fc33782 move line to relevant code section (blocks dir setup) 2020-04-12 22:32:37 +02:00