pleb/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
538 Commits 1 Branch 0 Tags
95d230d1d6a64b27fa834748b6fc695b7e8f4cec
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Erik Arvstedt 509fca5328 fix syntax error 
Fixes #172
 2020-05-06 12:13:32 +02:00
Erik Arvstedt b9f07bf706 test: use older qemu version for travis compatibility 2020-05-04 11:34:22 +00:00
Erik Arvstedt 026a22fcee use python testing from stable nixpkgs 2020-05-04 11:34:05 +00:00
Erik Arvstedt 2d3a1e839e electrs: fix conditional cargoSha256 2020-05-03 18:32:56 +00:00
Erik Arvstedt 4dc6c3ba5d add option 'dataDirReadableByGroup' 
These settings are now more accessible for users that don't use
nix-bitcoin's default node config.
Additionally, remove 'other' permissions via umask.
 2020-04-16 15:55:34 +02:00
Erik Arvstedt 7ffbe83de3 README: add links to example scripts 2020-04-15 18:57:55 +02:00
Erik Arvstedt ade3f84317 examples: add shell session snippets 2020-04-15 18:55:02 +02:00
Erik Arvstedt 3e188238d0 only update bitcoin.conf when changed 2020-04-12 22:32:37 +02:00
Erik Arvstedt 08322eed9b use [[ test 2020-04-12 22:32:37 +02:00
Erik Arvstedt 201fc33782 move line to relevant code section (blocks dir setup) 2020-04-12 22:32:37 +02:00
Erik Arvstedt 1f8fe310d0 remove option 'configFileOption' 
It doesn't make sense for bitcoind users to completely redefine their
config file. Also, it's poorly named and the description is faulty.

This is a breaking change, but this option has probably no actual users.
 2020-04-12 22:32:37 +02:00
Erik Arvstedt 4e5c1d7551 disable redundant logfile 2020-04-12 22:32:37 +02:00
Erik Arvstedt a05551fd1c improve config file formatting 2020-04-12 22:32:37 +02:00
Erik Arvstedt 5e81d60d63 improve formatting 2020-04-12 22:32:37 +02:00
Erik Arvstedt d60a5aa4db define rpc.users submodule inline 
Improves readability.
 2020-04-12 22:32:37 +02:00
Erik Arvstedt 1a2271fb14 remove unused variable 'hexStr' 2020-04-12 22:32:36 +02:00
Erik Arvstedt 4e92b1c818 remove redundant hardening options 
These are already defined in nix-bitcoin-services.defaultHardening.
 2020-04-12 22:32:36 +02:00
Erik Arvstedt 47fd6cd0f3 simplify ExecStart 2020-04-12 22:32:36 +02:00
Erik Arvstedt 64fc63cc40 remove pidFile 
- service type "simple" is the default
- pidFile is not needed for service type "simple"
 2020-04-12 22:32:36 +02:00
Erik Arvstedt bceaa361ca operator: allow reading systemd journal 2020-04-09 11:02:06 +02:00
Erik Arvstedt 145961c2de fix operator authorized keys setup 
This fixes these flaws in `copy-root-authorized-keys`:
- When `.vbox-nixops-client-key` is missing, operator's authorized_keys
  file is always appended to, growing the file indefinitely.
- Service is always added and not restricted to nixops-vbox deployments.
 2020-04-09 11:02:06 +02:00
Erik Arvstedt 37b2faf63c move systemPackages definitions to services 
These are generally useful and shouldn't be limited to secure-node.nix.

Also, only add the hardware-wallets group when hardware wallets are enabled.
 2020-04-08 17:35:14 +02:00
Erik Arvstedt 6c22e13b7f copy-root-authorized-keys: use inline script definition 2020-04-08 17:35:14 +02:00
Erik Arvstedt 63c6fe3213 fixup! use '' for multi-line string 2020-04-08 17:35:14 +02:00
Erik Arvstedt ab617946a9 extract variable 'cfg' 2020-04-08 17:35:13 +02:00
Erik Arvstedt 36c84d8360 add option clightning.onionport 
Analogous to electrs.onionport
 2020-04-08 17:35:13 +02:00
Erik Arvstedt 681dbaf328 move electrs.onionport option 
Only used in secure-node.nix
 2020-04-08 17:35:13 +02:00
Erik Arvstedt 74fbfa3a5d use lib.optionals 2020-04-08 17:35:13 +02:00
Erik Arvstedt ec6d33fbb6 rearrange code sections 
Move services to the top, operator account setup to the bottom.
 2020-04-08 17:35:13 +02:00
Erik Arvstedt e16ddc9c77 extract 'mkHiddenService' 
toPort equals port by default.
 2020-04-08 17:35:13 +02:00
Erik Arvstedt 89d3d58850 use mkIf 2020-04-08 17:35:13 +02:00
Erik Arvstedt 85e52a06cb improve grouping of suboptions 2020-04-08 17:35:12 +02:00
Erik Arvstedt 1a63f0ca6a remove option 'services.nix-bitcoin.enable' 
Users can enable the node config just by importing secure-node.nix
 2020-04-08 17:35:12 +02:00
Erik Arvstedt 0f8b2e91fd add nix-bitcoin.nix for backwards compatibility 2020-04-08 17:35:12 +02:00
Erik Arvstedt 28792f79dc rename nix-bitcoin.nix -> presets/secure-node.nix 2020-04-08 17:35:12 +02:00
Erik Arvstedt 041ec55794 nixops: build with pinned nixpkgs 2020-04-08 17:29:50 +02:00
Erik Arvstedt 705d187a35 examples/shell.nix: don't run shellHook on subsequent nix-shells 
This avoids an extra delay and the unexpected creation of secrets when
run in another dir.

Needed for the 'fetch-release' script introduced in a later commit.
 2020-03-30 11:00:31 +02:00
Erik Arvstedt 9df22a2764 add deploy-qemu-vm.sh example 2020-03-30 10:56:57 +02:00
Erik Arvstedt abcee651d3 add deploy-container.sh 2020-03-30 10:49:15 +02:00
Erik Arvstedt e398674964 run-tests.sh: fix leaking tmp files outside TMPDIR 
- Move vm image (NIX_DISK_IMAGE) from $TMP to $TMPDIR
- Set $PWD

Also:
- Simplify mktemp command
- USE_TMPDIR=1: Don't create extra dir inside $TMPDIR
 2020-03-29 18:51:35 +02:00
Erik Arvstedt b07c77f4a4 secrets.nix: remove obsolete comment 2020-03-29 18:51:34 +02:00
Erik Arvstedt 3a606608fb remove custom no-upnp bitcoind builds 
Disabling upnp via compilation brings no substantial security benefits.
There's no way to inadvertently enable upnp, it must be set explicitly
via bitcoind.extraConfig.

But it's a huge hassle for new users who have to recompile bitcoind
before being able to use nix-bitcoin.

Also, elementsd is currently built with upnp support by default.
 2020-03-26 10:14:03 +01:00
Erik Arvstedt 5dadea310c add deploy-nixops.sh 2020-03-24 21:43:22 +00:00
Erik Arvstedt 0c74c365de mention performance loss with hardened kernel profile 2020-03-24 21:43:22 +00:00
Erik Arvstedt f3121892ef move main module import to configuration.nix 2020-03-24 21:43:21 +00:00
Erik Arvstedt 0c0978c007 extract module 'deployment/nixops.nix', add option 'deployment.secretsDir' 2020-03-24 21:43:21 +00:00
Erik Arvstedt 5596bcf4fb bitcoind: set default rpcuser 
We're already setting a default rpcpassword, so we should set an
accompanying rpcuser so that rpc clients like electrs work out of the box.
 2020-03-04 18:09:52 +01:00
Erik Arvstedt c4cf323873 electrs: add option 'extraArgs' 
Electrs allows defining settings multiple times via cmdline args, but
not via config files.
So 'extraArgs' is the only way to implement overridable settings,
'extraOptions' wouldn't work.
 2020-03-04 18:09:52 +01:00
Erik Arvstedt e731d71232 electrs: add option 'address' 2020-03-04 18:09:52 +01:00
Erik Arvstedt 1e62456ed1 electrs: test RPC connection to bitcoind 2020-03-04 18:09:52 +01:00
Erik Arvstedt 0be67c325e electrs: use cfg.user, cfg.group 2020-03-04 18:09:51 +01:00
Erik Arvstedt 48be5a79fa electrs.enable: use mkEnableOption 2020-03-04 18:09:51 +01:00
Erik Arvstedt b75b2a1626 electrs: improve description 2020-03-04 18:09:51 +01:00
Erik Arvstedt fa3455d01f electrs: don't leak bitcoinrpc secret through process ARGV 
Supply secret via private config file instead.
 2020-03-04 18:09:51 +01:00
Erik Arvstedt f30aadbef2 electrs: enable unstable build, pin pkg to unstable 
stable's buildRustPackage is painfully slow when evaluating (adds >1 sec
even on a fast machine).

This is fixed (https://github.com/NixOS/nixpkgs/pull/69274) in unstable.
 2020-03-04 18:09:50 +01:00
Erik Arvstedt 5c6571654e electrs: 0.7.1 -> 0.8.3 
Use buildRustPackage instead of buildRustCrate (via crate2nix).

buildRustPackage builds the whole executable and its libraries in a
single `cargo build` process.

With the create2nix approach each library is built in a separate derivation,
directly using rustc instead of the cargo wrapper.

Benefits of buildRustPackage:
- Much simpler to maintain
- Package derivation evaluates much faster

Benefits of crate2nix:
- Build can be distributed over multiple build hosts
- Better sharing of common dependencies between different builds
- More fine-grained rebuilding on build failures

In nixpkgs buildRustPackage is used for almost all Rust pkgs, it's
also a better fit for our use case.
 2020-03-04 18:09:50 +01:00
Erik Arvstedt 47481b2642 electrs: quote dataDir in shell cmd 2020-03-04 18:09:50 +01:00
Erik Arvstedt 8fb33d1099 electrs: use bitcoind.dataDir option 2020-03-04 18:09:50 +01:00
Erik Arvstedt 45ba1f1fb3 electrs: don't print timestamps to log 
Already provided by journald.
 2020-03-04 18:09:49 +01:00
Erik Arvstedt 88080a58bf electrs: wrap long lines in preStart 2020-03-04 18:09:49 +01:00
Erik Arvstedt 301bb91ae5 simplify setting high-memory options 2020-03-04 18:09:49 +01:00
Erik Arvstedt 93fd2329b8 electrs: make nginx TLS proxy optional 
Electrs users shouldn't be forced to run a TLS proxy.
 2020-03-04 18:09:48 +01:00
Erik Arvstedt acde24ce43 electrs: move user/group definitions to bottom 
Consistent with other service defs.
 2020-03-04 18:09:48 +01:00
Erik Arvstedt 148327326b electrs: formatting 2020-03-04 18:09:48 +01:00
Erik Arvstedt cce9932b62 make pinned pkgs accessible through pkgs/default.nix 
Useful for developing and for importing pinned pkgs via config.nix.
 2020-03-04 18:09:48 +01:00
Erik Arvstedt 4d8590f8ed fix qemu error on travis 2020-02-27 01:28:20 +01:00
Erik Arvstedt ad23b508e3 {generate,setup}-secrets: remove process hardening 
ProtectSystem=full disables writing to /etc which is the default
secrets location.

Besides that, hardening is pointless for {generate,setup}-secrets which
don't read external input and are fully under our control.
 2020-02-26 20:38:46 +01:00
Erik Arvstedt 89f9bedb9d generate-secrets.nix: fix indentation 2020-02-26 20:38:46 +01:00
Erik Arvstedt 31ad56950f CI build: print number of VM CPUs 2020-02-25 22:51:57 +01:00
Erik Arvstedt 83863c03e5 use pinned nixpkgs-unstable for the test driver 2020-01-15 23:14:04 +00:00
Erik Arvstedt 6fe647ecc4 spark-wallet, lightning-charge: specify mainchain network in clightning data dir 
This fixes warnings in each service.
 2020-01-15 23:13:48 +00:00
Erik Arvstedt eaaa6b8701 clightning: update to v0.8.0 
To continue using inotify would be too complicated because we would also need to
monitor the creation of the 'bitcoin' subdirectory.
 2020-01-15 23:13:19 +00:00
Erik Arvstedt 7dd5f01527 lightning-charge: 0.4.7 -> 0.4.14 2020-01-15 23:09:08 +00:00
Erik Arvstedt 187ff884db add modules test 
The build of package 'nodeinfo' is implicitly tested by the modules test.
 2020-01-13 00:25:12 +01:00
Erik Arvstedt 826245484e make secrets dir location configurable 
Users of the nix-bitcoin modules shouldn't be forced to add an extra
dir under root.
The secrets location is unchanged for the default node config.
 2020-01-13 00:25:12 +01:00
Erik Arvstedt b1e13e9415 simplify secrets file format 
Each secret file to be deployed is now backed by one local file.
This simplifies 'setup-secrets' and the secret definitions.
Also, with the old format it was not possible to add new secrets
to secrets.nix in a simple way.

Old secrets are automatically converted to the new format when running
nix-shell.

Using the new option 'nix-bitcoin.secrets', secrets are now directly
defined by the services that use them.
 2020-01-13 00:25:11 +01:00
Erik Arvstedt 314272a228 lnd, nanopos: move user and group definitions to the bottom 
This is the default service formatting style in nixpkgs.
 2020-01-13 00:25:11 +01:00
Erik Arvstedt 766fa4f300 travis: cache all build outputs with cachix 
This further speeds up builds, in particular the modules test in the
next commit. By checking if the expected final build output has already
been cached, we can even skip the download of cached builds.
 2020-01-13 00:25:11 +01:00
Erik Arvstedt b0e759160d travis: set NIX_PATH as early as possible 
This avoids some unneded downloads when installing cachix.
 2020-01-12 20:53:35 +01:00
Erik Arvstedt c51bbcf104 travis: move comment 2020-01-12 20:53:35 +01:00
Erik Arvstedt 7092dce0c7 travis: remove use of deprecated statements 2020-01-12 20:53:34 +01:00
Erik Arvstedt 190a92507c travis: split up scripts into statements 
Advantages:
- The build fails if a statement fails.
  Previously, errors in all but the last statement were silently
  ignored.
- The Travis log gives a fine-grained view of the output of each
  statement.

Add if statements because the '[…] &&' prefix results in YAML syntax
errors.
 2020-01-12 20:02:04 +01:00
Erik Arvstedt 10d6b04ac8 support enabling clightning and lnd simultaneously 
Needed for testing.
 2020-01-12 20:02:04 +01:00
Erik Arvstedt ad7a519284 bitcoind: wait until RPC port is open 
This fixes rare failures in clightning which requires an open bitcoind
RPC port
 2020-01-12 20:02:04 +01:00
Erik Arvstedt 5536b64fb3 lnd: wait until wallet is created 2020-01-12 20:02:04 +01:00
Erik Arvstedt 6f2a55d63c lnd: wait until RPC port is open 2020-01-12 20:02:03 +01:00
Erik Arvstedt 1868bef462 lnd: add option 'rpcPort' 
10009 is lnd's default port.
Needed for the following commit.
 2020-01-12 20:02:03 +01:00
Erik Arvstedt 120e3e8cfe lnd postStart: suppress curl response output 
Errors are still shown
 2020-01-12 20:02:03 +01:00
Erik Arvstedt 3e86637327 lnd postStart: poll for REST service availability 
Improves service startup time compared to just sleeping
 2020-01-12 20:02:03 +01:00
Erik Arvstedt 795c51dc01 lnd postStart: make more idiomatic 
- [[]]-style tests
- indent all multi-line statements the same way
 2020-01-12 20:02:03 +01:00
Erik Arvstedt 6e58beae8a lnd: use postStart option for script 
- set -e is implicit
- coreutils are in PATH and don't have to be explicitly referenced (echo is a shell builtin anyways)
- exit 0 is unneeded ('if' statements never fail)
 2020-01-12 20:02:03 +01:00
Erik Arvstedt 86167c6e6d clightning: wait until the RPC socket appears 
This fixes failures with spark-wallet which requires clightning RPC
 2020-01-12 20:02:02 +01:00
Erik Arvstedt 60c732a6a1 onion-chef: set RemainAfterExit, fix tor dependency 
This better fits the semantics of this unit and allows for easier
automated testing whether the service is active.

wantedBy = bindsTo = after = tor.service is the simplest way to ensure
that this unit is always running/restarted in lockstep with tor.
Previously, onion-chef would have stayed inactive in the case
that tor was stopped and then later restarted.
 2020-01-12 20:02:02 +01:00
Erik Arvstedt 2b9b3ba1c5 systemPackages: improve readability with shorter service references 2020-01-12 20:02:02 +01:00
Erik Arvstedt 14ecb5511a liquid: add cli option 2020-01-12 20:02:02 +01:00
Erik Arvstedt cd5ed39b9c lnd: add cli option 2020-01-12 20:02:02 +01:00
Erik Arvstedt 1833b15888 clightning: add cli option 
An executable is more robust to use than shell aliases.

This is also a preparation for commit 'add module test' because the
NixOS testing framework makes interactive aliases hard to use: It
unsets 'PS1' which is used by programs/bash/bash.nix to detect
interactive shells.
 2020-01-12 20:02:02 +01:00
Erik Arvstedt b90bf6691b add generate-secrets.service 2020-01-12 20:02:01 +01:00
Erik Arvstedt 6447694214 add generate-secrets pkg 
generate-secrets.sh will also be used in generate-secrets.nix, so DRY
its dependency definitions.
 2020-01-12 20:02:01 +01:00
Erik Arvstedt e34093a8ac generate_secrets.sh: add opensslConf option 
Needed for the following commit.
 2020-01-12 20:02:01 +01:00