pleb/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
750 Commits 1 Branch 0 Tags
ac6cee5c128990e7a5c661bb634b461812a92f70
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Erik Arvstedt ac6cee5c12 pkgs: add extra-container 2020-10-11 19:40:26 +02:00
Erik Arvstedt be2127ae5b test: fix noConnections configs 
- bitcoind: remove mkForce because otherwise the whole extraConfig is replaced
  by the value of mkForce.

- liquidd: don't disable 'listen' because it is entirely benign in offline
  mode, we also allow it for bitcoind.
 2020-10-11 19:40:08 +02:00
Erik Arvstedt 1e18d3ea3b test: improve modularization 
This improves debugging and experimenting by making it easy to compose fine-grained
scenarios that have specific tests and features enabled.

The VM test output now includes the subtest name and duration.

Remove the 'raise Exception()' hack for interactive mode.

Run 'banlist-and-restart' test before 'backups'. This speeds up the test
by avoiding an extra shutdown of all bitcoin-related services.
 2020-10-11 19:40:08 +02:00
Erik Arvstedt 14d2d97ba6 test: rename scenario withnetns -> netns 
This makes the naming consistent with scenarios added in later
commits.
 2020-09-30 11:26:41 +02:00
Erik Arvstedt 9bf77ee3e8 backups test: simplify and speed up 2020-09-30 11:26:41 +02:00
Erik Arvstedt fcda69e8b6 netns test: connect from main netns 
All services are reachable from the main netns, no need to enter
service network namespaces.

This allows us to remove extra_tests.
 2020-09-30 11:26:41 +02:00
Erik Arvstedt 24069aa2c6 electrs: add option 'monitoringPort' 2020-09-30 11:26:41 +02:00
Erik Arvstedt 611cfe5a28 electrs: remove redundant daemonrpc option 2020-09-30 11:26:41 +02:00
Erik Arvstedt a19d3b07c2 electrs: add variable 'bitcoind' 2020-09-30 11:26:41 +02:00
Erik Arvstedt a6dde36b87 electrs: use consistent args formatting 
One line per arg.
 2020-09-30 11:26:40 +02:00
Erik Arvstedt 45bcbf683d test: rename test.nix -> tests.nix 
The plural is consistent with tests.py and run-tests.sh
 2020-09-30 11:26:40 +02:00
Erik Arvstedt c92e85f707 test: rename base.py -> tests.py 2020-09-30 11:26:40 +02:00
Erik Arvstedt 774da9d4e0 generate-secrets: fix python version for rpcauth 
I accidentally included the minor version number.
Version 3.5 has been removed from nixpkgs unstable.
 2020-09-24 16:32:38 +02:00
Erik Arvstedt 6f032e3c40 lnd: fix mnemonic file access vulnerability 
Previously, the file was readable by 'other' for a short time after
creation.
 2020-09-15 12:09:00 +00:00
Erik Arvstedt 9b6a3ec835 generate-secrets: extract fn 'makeHMAC' 2020-08-27 12:20:06 +02:00
Erik Arvstedt ca18ffb90a generate-secrets: fetch rpcauth.py from github 
No need to vendor this.
 2020-08-27 12:20:06 +02:00
Erik Arvstedt 4d6127bb76 bitcoind: clarify RPC whitelist test 
- Remove redundant comment
- Test with obviously unsafe RPC call 'stop'
- No need to test privileged user who has no whitelist
 2020-08-27 12:19:49 +02:00
Erik Arvstedt 9d610991be bitcoind: remove custom rpc user names 
Simpler.
We've just removed option 'bitcoind.rpcuser', so we can also remove the
old name 'bitcoinrpc'.
 2020-08-27 11:39:26 +02:00
Erik Arvstedt 1408403dec bitcoind: clarify how bitcoin-cli RPC access is enabled 
It's not immediately clear why rpcuser/rpcpassword are needed in addition to the rpcauth
config entries.
 2020-08-26 22:52:47 +02:00
Erik Arvstedt 4790c601a1 bitcoind: move rpc user config to bitcoind 
This enables modules-only usage.
The privileged user is needed by bitcoind (cli), the public user is
needed by other services.
 2020-08-26 22:52:47 +02:00
Erik Arvstedt 876cfadf1a bitcoind: add rpc user option 'passwordHMACFromFile' 
This allows adding additional rpc users without the need for
user-specific code in preStart.
 2020-08-26 22:52:47 +02:00
Erik Arvstedt 59434e79f0 bitcoind: simplify default rpc user name config 2020-08-26 21:16:32 +02:00
Erik Arvstedt 205829b91f bitcoind: remove whitespace 2020-08-26 21:16:32 +02:00
Erik Arvstedt e5fb3f6a7f run-tests: document how to pass extra build args 2020-08-25 14:58:04 +02:00
Erik Arvstedt df790f6766 run-tests: allow linking test build results for all scenarios 2020-08-25 14:58:04 +02:00
Erik Arvstedt 91697b1427 test: allow for testing all scenarios 
Test all scenarios by default when running 'build' (which happens
when the script is called without arguments).

Default to scenario 'default' in other test commands like 'debug'.
 2020-08-25 14:53:13 +02:00
Erik Arvstedt 28236691aa test: rename scenarios/lib.py -> base.py 
This file isn't a scenario, it's also not a lib because it contains
the main share of actual tests.
 2020-08-25 14:53:13 +02:00
Erik Arvstedt 80da0a41bc test: load complete test environment in debug mode 
Stop just before executing actual tests.
This makes all test functions accessible in debug mode.
 2020-08-25 14:53:12 +02:00
Erik Arvstedt 9b4cd7bd1c test: simplify scenario handling 
We can switch to a more sophisticated scheme later when adding more scenarios
 2020-08-25 14:53:12 +02:00
Erik Arvstedt 0f56ea6ad1 test: include scenario in test name 2020-08-25 14:53:12 +02:00
Erik Arvstedt 9237e5dc3d test: use pydoc docstring 2020-08-25 14:53:12 +02:00
Erik Arvstedt ed73627e02 netns-exec: minor style fixes 
- Use inline variable declarations
- Improve messages
- Fix naming: available -> allowed
- Simplify intro comment
 2020-08-25 14:53:12 +02:00
Erik Arvstedt 91ebc2d517 netns-exec: simplify installation 2020-08-25 14:53:12 +02:00
Erik Arvstedt 809e754851 netns: improve bridge setup 
- Explain why we don't use option `networking.bridges`
- Make the bridge setup service part of NixOS' network-setup.service.
  This yields no noticable functional changes for now, but it's
  conceptually cleaner to finish the network setup before network.target
  becomes active.
- Add 'nb-' prefix to service name
 2020-08-25 14:53:12 +02:00
Erik Arvstedt b7450877a0 netns: rename bridge peer devices br-nb-veth* -> nb-veth-br* 
This ensures a consistent 'nb-' namespace and simplifies the
dhcpcd.denyInterfaces rules.

Also rename vethName -> veth.
 2020-08-25 14:53:12 +02:00
Erik Arvstedt 8bfb7bb2f8 netns: rename bridge br0 -> nb-br 
br0 has a high risk of name clashes when nix-bitcoin used as part of a
larger config.
Use a more specific name.
 2020-08-25 14:53:08 +02:00
Erik Arvstedt 32e70a7516 netns: move webindex config for modules-only usage 
webindex is only available in secure-node.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt 121301337b netns: add option 'allowedUser' for modules-only usage 
The dependency on secure-node.nix prevented using nix-bitcoin by just
importing modules.nix.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt 9715134f06 netns: don't repeat cli definitions 
1. Saves some code.
2. Guarantees that the netns and no-netns cli defs are always in sync.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt e385c73256 netns: separate implementation and service configs 
This greatly improves clarity.

Especially the bitcoind-import-banlist.serviceConfig definition was out
of place.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt d0b8d77de2 netns: remove conditionals for service settings 
Going without the conditionals (like in secure-node.nix) adds
readability and doesn't reduce evaluation performance (in fact, it
even slightly improves performance due to implementation details
of mkIf).

To avoid errors, remove use of disabled services in secure-node.nix and
nix-bitcoin-webindex.nix.
 2020-08-25 11:40:27 +02:00
Erik Arvstedt 0f0f6ddbb9 netns: add comment about undesirable algorithmic complexity 
We don't want to be Accidentally Quadratic™
 2020-08-25 11:40:26 +02:00
Erik Arvstedt a3ae8668e6 netns: use map instead of concatMap 2020-08-25 11:40:26 +02:00
Erik Arvstedt b7fc819be5 netns: consistent var naming 
n is used elsewhere in similar contexts.
 2020-08-25 11:40:26 +02:00
Erik Arvstedt 5a81693ef3 netns: add range check for netns ids 2020-08-25 11:40:26 +02:00
Erik Arvstedt 74f1610668 netns: clarify addressblock description 2020-08-25 11:40:26 +02:00
Erik Arvstedt 4eb92df08c netns: remove redundant filter 
The 'availableNetns' connection matrix only consists of enabled entries,
so no extra filtering is needed.
Reason: availableNetns starts with the filtered 'base' and is then symmetrised.
 2020-08-25 11:40:26 +02:00
Erik Arvstedt 50de54aef1 netns: remove empty connections defs 
Like in the netns defintion for bitcoind.
 2020-08-25 11:40:26 +02:00
Erik Arvstedt 44de5064cd security: don't restrict process info by default for module users 2020-08-20 13:12:07 +02:00
Erik Arvstedt a36789b468 test: move security tests to separate function 2020-08-20 13:12:06 +02:00
Erik Arvstedt 588a0b2405 security: enable full systemd-status for group 'proc' 
Previously, systemd-status was broken for all users except root.

Use a 'default' deny policy, which is overridden for group 'proc'.

Add operator to group 'proc'.

Also, remove redundant XML boilerplate.
 2020-08-20 13:12:06 +02:00
Erik Arvstedt 96ea2e671c security: simplify and fix dbus configuration 
Previously, due to the dependency on a helper service, this dbus config
was initially inactive after system boot, allowing for unrestricted use
of the problematic dbus call.
This also broke the accompanying VM test on faster systems.

Remove 'allow' policy for root because it's a no-op:
1. It's overridden by the 'mandatory' deny policy.
2. Root can use all dbus calls anyways, regardless of policy settings.

Also, add some comments.
 2020-08-20 13:12:06 +02:00
Erik Arvstedt 343e026030 rename dbus.nix -> security.nix 
This file has a broader scope than just configuring dbus.
 2020-08-20 13:12:06 +02:00
Erik Arvstedt 7367446761 test: rename assert_matches_exactly -> assert_full_match 
More precise, needed in a later commit.
 2020-08-20 13:12:05 +02:00
Erik Arvstedt db48ab9b69 services: use 'port' option type 2020-06-02 17:31:28 +02:00
Erik Arvstedt 5f3f362451 lnd: add strict hardening 
Add ProtectSystem=strict, remove PermissionStartOnly.

Extract the section of postStart that needs secrets dir write
access into a separate script with full privileges.

Simplify preStart and fix dataDir quoting.
 2020-05-22 16:13:58 +00:00
Erik Arvstedt 0f1ee5f533 examples: improve shell session usability 
- Add usage prompt when starting shell sessions

- Give all examples an uniform interface ("c") for running commands
  or starting a shell on the node.
 2020-05-17 23:53:32 +02:00
Erik Arvstedt 719dcd77bb examples: execute bash sessions in script environment 
Previously, the sessions contained only explicitly exported variables
and functions.
This was fragile and in part buggy due to lacking exports.

Interactive features like user-defined aliases and functions are still
working as before.
 2020-05-17 14:30:39 +02:00
Erik Arvstedt 509fca5328 fix syntax error 
Fixes #172
 2020-05-06 12:13:32 +02:00
Erik Arvstedt b9f07bf706 test: use older qemu version for travis compatibility 2020-05-04 11:34:22 +00:00
Erik Arvstedt 026a22fcee use python testing from stable nixpkgs 2020-05-04 11:34:05 +00:00
Erik Arvstedt 2d3a1e839e electrs: fix conditional cargoSha256 2020-05-03 18:32:56 +00:00
Erik Arvstedt 4dc6c3ba5d add option 'dataDirReadableByGroup' 
These settings are now more accessible for users that don't use
nix-bitcoin's default node config.
Additionally, remove 'other' permissions via umask.
 2020-04-16 15:55:34 +02:00
Erik Arvstedt 7ffbe83de3 README: add links to example scripts 2020-04-15 18:57:55 +02:00
Erik Arvstedt ade3f84317 examples: add shell session snippets 2020-04-15 18:55:02 +02:00
Erik Arvstedt 3e188238d0 only update bitcoin.conf when changed 2020-04-12 22:32:37 +02:00
Erik Arvstedt 08322eed9b use [[ test 2020-04-12 22:32:37 +02:00
Erik Arvstedt 201fc33782 move line to relevant code section (blocks dir setup) 2020-04-12 22:32:37 +02:00
Erik Arvstedt 1f8fe310d0 remove option 'configFileOption' 
It doesn't make sense for bitcoind users to completely redefine their
config file. Also, it's poorly named and the description is faulty.

This is a breaking change, but this option has probably no actual users.
 2020-04-12 22:32:37 +02:00
Erik Arvstedt 4e5c1d7551 disable redundant logfile 2020-04-12 22:32:37 +02:00
Erik Arvstedt a05551fd1c improve config file formatting 2020-04-12 22:32:37 +02:00
Erik Arvstedt 5e81d60d63 improve formatting 2020-04-12 22:32:37 +02:00
Erik Arvstedt d60a5aa4db define rpc.users submodule inline 
Improves readability.
 2020-04-12 22:32:37 +02:00
Erik Arvstedt 1a2271fb14 remove unused variable 'hexStr' 2020-04-12 22:32:36 +02:00
Erik Arvstedt 4e92b1c818 remove redundant hardening options 
These are already defined in nix-bitcoin-services.defaultHardening.
 2020-04-12 22:32:36 +02:00
Erik Arvstedt 47fd6cd0f3 simplify ExecStart 2020-04-12 22:32:36 +02:00
Erik Arvstedt 64fc63cc40 remove pidFile 
- service type "simple" is the default
- pidFile is not needed for service type "simple"
 2020-04-12 22:32:36 +02:00
Erik Arvstedt bceaa361ca operator: allow reading systemd journal 2020-04-09 11:02:06 +02:00
Erik Arvstedt 145961c2de fix operator authorized keys setup 
This fixes these flaws in `copy-root-authorized-keys`:
- When `.vbox-nixops-client-key` is missing, operator's authorized_keys
  file is always appended to, growing the file indefinitely.
- Service is always added and not restricted to nixops-vbox deployments.
 2020-04-09 11:02:06 +02:00
Erik Arvstedt 37b2faf63c move systemPackages definitions to services 
These are generally useful and shouldn't be limited to secure-node.nix.

Also, only add the hardware-wallets group when hardware wallets are enabled.
 2020-04-08 17:35:14 +02:00
Erik Arvstedt 6c22e13b7f copy-root-authorized-keys: use inline script definition 2020-04-08 17:35:14 +02:00
Erik Arvstedt 63c6fe3213 fixup! use '' for multi-line string 2020-04-08 17:35:14 +02:00
Erik Arvstedt ab617946a9 extract variable 'cfg' 2020-04-08 17:35:13 +02:00
Erik Arvstedt 36c84d8360 add option clightning.onionport 
Analogous to electrs.onionport
 2020-04-08 17:35:13 +02:00
Erik Arvstedt 681dbaf328 move electrs.onionport option 
Only used in secure-node.nix
 2020-04-08 17:35:13 +02:00
Erik Arvstedt 74fbfa3a5d use lib.optionals 2020-04-08 17:35:13 +02:00
Erik Arvstedt ec6d33fbb6 rearrange code sections 
Move services to the top, operator account setup to the bottom.
 2020-04-08 17:35:13 +02:00
Erik Arvstedt e16ddc9c77 extract 'mkHiddenService' 
toPort equals port by default.
 2020-04-08 17:35:13 +02:00
Erik Arvstedt 89d3d58850 use mkIf 2020-04-08 17:35:13 +02:00
Erik Arvstedt 85e52a06cb improve grouping of suboptions 2020-04-08 17:35:12 +02:00
Erik Arvstedt 1a63f0ca6a remove option 'services.nix-bitcoin.enable' 
Users can enable the node config just by importing secure-node.nix
 2020-04-08 17:35:12 +02:00
Erik Arvstedt 0f8b2e91fd add nix-bitcoin.nix for backwards compatibility 2020-04-08 17:35:12 +02:00
Erik Arvstedt 28792f79dc rename nix-bitcoin.nix -> presets/secure-node.nix 2020-04-08 17:35:12 +02:00
Erik Arvstedt 041ec55794 nixops: build with pinned nixpkgs 2020-04-08 17:29:50 +02:00
Erik Arvstedt 705d187a35 examples/shell.nix: don't run shellHook on subsequent nix-shells 
This avoids an extra delay and the unexpected creation of secrets when
run in another dir.

Needed for the 'fetch-release' script introduced in a later commit.
 2020-03-30 11:00:31 +02:00
Erik Arvstedt 9df22a2764 add deploy-qemu-vm.sh example 2020-03-30 10:56:57 +02:00
Erik Arvstedt abcee651d3 add deploy-container.sh 2020-03-30 10:49:15 +02:00
Erik Arvstedt e398674964 run-tests.sh: fix leaking tmp files outside TMPDIR 
- Move vm image (NIX_DISK_IMAGE) from $TMP to $TMPDIR
- Set $PWD

Also:
- Simplify mktemp command
- USE_TMPDIR=1: Don't create extra dir inside $TMPDIR
 2020-03-29 18:51:35 +02:00
Erik Arvstedt b07c77f4a4 secrets.nix: remove obsolete comment 2020-03-29 18:51:34 +02:00
Erik Arvstedt 3a606608fb remove custom no-upnp bitcoind builds 
Disabling upnp via compilation brings no substantial security benefits.
There's no way to inadvertently enable upnp, it must be set explicitly
via bitcoind.extraConfig.

But it's a huge hassle for new users who have to recompile bitcoind
before being able to use nix-bitcoin.

Also, elementsd is currently built with upnp support by default.
 2020-03-26 10:14:03 +01:00