pleb/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
579 Commits 1 Branch 0 Tags
fe6e118bb33ef94eee5c831504a69bd28b6ee8c5
Commit Graph
80 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
nixbitcoin fe6e118bb3 elementsd: 0.18.1.3 -> 0.18.1.8 
Also includes `get-sha256.sh` to easily determine verified sha256's
 2020-07-19 12:15:39 +00:00
nixbitcoin 5ca58a2a26 nixpkgs: update stable and unstable 
Includes bitcoin 0.20.0 and lnd 0.10.3
 2020-07-19 12:15:33 +00:00
nixbitcoin a20807b8a3 travis: fix 
Simplify installing nix package manager. Issue 2733 is fixed in nix
2.3.3 and travis installs 2.3.6.
 2020-07-08 09:26:33 +00:00
nixbitcoin e81ccb6596 electrs: 0.8.3 -> 0.8.5 2020-07-07 10:54:40 +00:00
nixbitcoin f280d54bb8 add module assertions 2020-06-17 09:23:17 +00:00
nixbitcoin 23cd323ad1 assertions: add lnd, clightning exclusivity 2020-06-15 13:02:58 +00:00
nixbitcoin 0ad524ca2d example config: clarify nix-bitcoin will auto-detect invalid settings 2020-06-15 10:56:01 +00:00
nixbitcoin c16924b850 example config: change hwi excluding dependency to high-memory 
HWI can be enabled if electrs is enabled as long as electrs.high-memory
is disabled.
 2020-06-15 10:55:59 +00:00
nixbitcoin 0fd99c4cc0 bitcoind: simplify pruning 
Remove the possible null value for bitcoind.prune and set prune = 0 in
bitcoind as a default. Remove prune = 0 in secure-node.nix and the
mkForce in configuration.nix (bitcoind.prune = lib.mkForce ).
 2020-06-15 10:55:57 +00:00
nixbitcoin b9a7a71873 example config: document enabling pruning 2020-06-15 10:55:55 +00:00
nixbitcoin 12adabe407 banlist: update to newest version 
Received by E-Mail from gmaxwell
 2020-06-11 09:23:26 +00:00
nixbitcoin ccc3a70344 service hardening: add more restrictions 
Add RestrictSUIDSGID
Add RemoveIPC
Add RestrictRealtime
Add ProtectHostname
 2020-05-24 11:14:45 +00:00
nixbitcoin 3fbfa98635 service hardening: replace obtuse SystemCallFilter with @system-service 
@system-service whitelist and additional
https://docs-stage.docker.com/engine/security/seccomp/#significant-syscalls-blocked-by-the-default-profile
blacklist.
 2020-05-24 11:14:37 +00:00
nixbitcoin e34d1c884e service hardening: Add PrivateUsers 
Exceptions in webindex & onion-chef
 2020-05-22 16:16:19 +00:00
nixbitcoin 1c75543f2f clightning: add user and group options 2020-05-22 16:16:17 +00:00
nixbitcoin a040e52854 All modules: ProtectSystem = strict 
Add ReadWritePaths in all modules, except lnd which has ProtectSystem =
full.
 2020-05-22 15:47:01 +00:00
nixbitcoin adc71b892e Remove PermissionStartOnly where possible and replace with bitcoinrpc 
Remove PermissionsStartOnly for bitcoind and spark-wallet (it was never
needed there)

Give reason for PermissionsStartOnly in lightning-charge

Replace PermissionsStartOnly in clightning, electrs and liquid
 2020-05-22 15:04:49 +00:00
nixbitcoin 91b6b2c370 All modules with preStart: Use systemd.tmpfiles.rules 
This is NixOS' recommended way to setup service dirs
https://github.com/NixOS/nixpkgs/pull/56265. This commit hands off the
initial data directory creation to systemd.tmpfiles.rules. All other
preStart scripts are left intact to limit this changes' scope.
 2020-05-22 14:54:39 +00:00
nixbitcoin 423ebf862b lnd: only enable bitcoind zmqpub if lnd.enable 
In conjuction with secure-node.nix, this sets sane
RestrictAddressFamilies unless lnd is enabled. Before, we were
constantly exposing unnecessary Address Families, not just when lnd is
enabled.

However, zmqpub* must always be enabled for lnd, even when used
outside of secure-node.nix, so we make this change in the lnd module.
 2020-05-22 14:53:33 +00:00
nixbitcoin 81a1c3f908 service hardening: Add CapabilityBoundingSets 
Whitelist with exceptions in webindex and onion-chef
 2020-05-22 11:29:54 +00:00
nixbitcoin 3cd61506e0 webindex & onion-chef: Run non-network-facing services in PrivateNetwork 2020-05-22 11:29:07 +00:00
nixbitcoin 7c70dd43ac All modules: Give service config precedence over defaultHardening 
With '//' the latter takes precedence over the former in case of
equally named attributes.
 2020-05-22 08:08:27 +00:00
nixbitcoin b8e10afe18 recurring-donations: Run under recurring-donations user 2020-05-19 11:13:26 +00:00
nixbitcoin 5d01ea7101 nodeinfo: Convert to module and allow alternative operator username 
currently, nodeinfo has presets/secure-node.nix as a strict
dependency as it requires onion-chef and the 'operatorName' option.
and nix-bitcoin-webindex.nix has nodeinfo as a dependecy.

so don't add nodeinfo and webindex to modules.nix because they will fail on standalone use.
 2020-05-19 11:13:24 +00:00
nixbitcoin 95d230d1d6 Remove bitcoinrpc group remnants 2020-05-19 11:13:22 +00:00
nixbitcoin 563b210835 spark-wallet: Run under spark-wallet user 2020-05-19 11:13:20 +00:00
nixbitcoin 205fca3576 bitcoind: only make blocksdir group-readable when dataDirReadableByGroup 2020-05-19 11:13:18 +00:00
nixbitcoin 81a04a4ef1 lightning-charge: add dedicated user 2020-05-19 11:13:16 +00:00
nixbitcoin e67a818297 lightning-charge: 0.4.14 -> 0.4.19 2020-05-19 11:13:13 +00:00
nixbitcoin 0ba55757f8 clightning: allow group access to RPC socket 2020-05-19 11:13:12 +00:00
nixbitcoin 304dd297ba clightning: remove config group read access 2020-05-19 11:13:05 +00:00
nixbitcoin 04c6936ce9 clightning: Remove clightning "bitcoinrpc" membership 
Secrets are written to clightning config file during preStart with root
permissions because of PermissionsStartOnly.
 2020-05-19 11:09:13 +00:00
nixbitcoin 393ab0fb3c electrs: Remove electrs user from "bitcoinrpc" and "bitcoin" sometimes 
Electrs does not need to be a part of "bitcoinrpc" group because preStart
electrs.toml creation is handled by PermissionsStartOnly. "bitcoin"
group membership is only necessary when cfg.high-memory is enabled and
electrs reads blocks directly from the blocks directory.
 2020-05-19 11:08:59 +00:00
nixbitcoin 7cfae66db4 electrs: Drop insecure TLS ciphers 2020-05-19 11:08:52 +00:00
nixbitcoin 4c139a6d77 electrs: Make TLSProxy truly optional 
If TLSProxy is disabled, bypass nginx by forwarding Tor HS traffic
directly to electrs.
 2020-05-19 11:08:48 +00:00
nixbitcoin 8b2ae9c1b7 spark-wallet: update 0.2.13 -> 0.2.14 
Download shesek's github spark-npm.tgz, verify signature, unpack
spark-npm.tgz, patch package.json to include qrcode-terminal in
dependencies, run node2nix with tmpdir as local source, replace tmpdir
spark-wallet source with shesek's github spark-npm.tgz in
node-packages.nix.

spark-wallet: erikarvstedt fixups
 2020-05-10 17:12:45 +02:00
nixbitcoin 1acb22a872 Get electrs source tarball with gpg verified sha256 and corresponding helper script 
move script to pkg dir, add hint to script in pkg def

remove unneeded script deps

add extended bash error checking

rename DIR -> TMPDIR

remove TMPDIR on exit

strip whitespace, simplify comments

gpg2 -> gpg

latesttagelectrs -> latest

tmpdir: don't use XDG_RUNTIME_DIR

XDG_RUNTIME_DIR is often in RAM and shouldn't be used for larger
workloads like repo downlaods

verify fingerprint of the imported key

remove trailing '-' in output

simplify output

Hide --fetch-key output

Output is not relevant to user, looks better without it

More accurately describe ./get-sha256 function

User might think that ./get-sha256 automatically updates sha256 in default.nix

Fetch key from sks keyservers instead of keybase.io

Using --recv-key simplifies getting the right key, and only the
right key, greatly. I try to refrain from using sks keyservers,
but the certificate spamming attack shouldn't be an issue in this
case because we create a temporary keychain just for the
verificaiton.

remove unneeded cargoDepsHook

Make clang nativeBuildInput instead of buildInput
 2020-04-26 17:02:14 +02:00
nixbitcoin 707b06aed1 Update pinned nixpkgs 2020-04-26 16:59:41 +02:00
nixbitcoin 159f551b93 Remove bitcoin, clightning, electrs, liquid user home directory 2020-04-26 14:08:08 +02:00
nixbitcoin e95f5981aa Remove KN countrycode 2020-04-24 16:27:48 +02:00
nixbitcoin 742aef1e0f Only set dataDirReadableByGroup if cfg.high-memory is enabled 2020-04-24 16:21:12 +02:00
nixbitcoin 0382d3a6b8 Document low-entropy problem 2020-04-19 15:16:00 +02:00
nixbitcoin 89dc836f94 Update spark-wallet 0.2.12 -> 0.2.13 2020-04-17 14:13:04 +02:00
nixbitcoin 8f9082f893 Enable validatepegin for Liquid 2019-08-01 10:38:05 +02:00
nixbitcoin 8cf54d4b13 Update electrs to v0.7.1 2019-07-28 18:48:15 +02:00
nixbitcoin d9fbb9aff2 Move electrs startscript to tempdir and fix nits 2019-07-28 17:29:52 +02:00
nixbitcoin 54dc68810a Update tested hardware 2019-07-26 13:54:33 +02:00
nixbitcoin 52f48d1f87 More detailed instructions on connecting to spark-wallet and electrs through Tor 2019-06-02 20:26:15 +02:00
nixbitcoin 5523d33d8a Decline security features from overarching security axioms 2019-05-31 17:26:28 +02:00
nixbitcoin 3227a0151f Add script to generate electrs expressions with crate2nix 2019-05-30 14:34:56 +02:00
nixbitcoin 8c93d6a9a8 Update electrs to version 0.6.2 with pinned dependencies 2019-05-24 19:25:11 +02:00
nixbitcoin 38ef76d04e Fix nit, fix numbering, use consistent nomenclature 2019-05-15 16:14:01 +02:00
nixbitcoin 64ce7cb261 Bitcoin HWI README entry and various formatting corrections 2019-05-15 16:06:28 +02:00
nixbitcoin ab2da64075 Add documentation on exclusivity of electrs and hwi 2019-05-15 16:06:28 +02:00
nixbitcoin 28b1c133c9 Add reference to docs/usage.md in configuration.nix hw section 2019-05-15 16:06:28 +02:00
nixbitcoin 8eef59ce72 Update documentation 2019-05-15 16:06:27 +02:00
nixbitcoin 48f6bc5f81 Fix clightning port typo (9375 instead of 9735) 2019-05-12 18:29:22 +02:00
nixbitcoin 7416ec4a29 Limit syscalls with Docker whitelist 2019-05-10 12:42:06 +02:00
nixbitcoin f237ee2bbe Improve install documentation 2019-04-28 19:49:57 +02:00
nixbitcoin 37b71d87b8 electrs ssl 2019-04-26 23:41:55 +02:00
nixbitcoin 4364e7c779 Add additional documentation to usage.md 2019-04-22 19:39:15 +02:00
nixbitcoin 19cbe10f04 Split up and enhance documentation 2019-04-12 11:51:52 +02:00
nixbitcoin dfd437f428 Fix textwidth 2019-04-12 10:47:49 +02:00
nixbitcoin 0db7a251fd Update gmaxwell banlist 2019-04-11 23:38:47 +02:00
nixbitcoin 51526089a6 Improve documentation 2019-04-10 11:23:10 +02:00
nixbitcoin 6d723e896f Remove profiles and replace with options to enable/disable each module separately in configuration.nix 2019-04-10 11:13:39 +02:00
nixbitcoin 8b9972f078 Fix typo "ngninx" in nix-bitcoin.nix services.onion-chef.access.operator 2019-04-06 18:56:58 +02:00
nixbitcoin be3d4ed925 Document connecting to ssh Tor Hidden Service 2019-04-06 16:18:37 +02:00
nixbitcoin a7eb091776 Update Nix to 2.2.1 and add sandbox fix 2019-04-05 12:09:26 +02:00
nixbitcoin 4000829002 Use rust stable 1.31 instead of rust nightly for electrs, update electrs, specify electrum-rpc 2019-04-01 17:43:07 +02:00
nixbitcoin eb4968d292 Add high-memory description 2019-03-24 11:38:37 +01:00
nixbitcoin fca4af59ac Remove mentions of electrs in the bitcoind module, set sysperms & disablewallet only when electrs is enabled, electrs enabled in "all" setting, remove 
unnecessary newline, make sysperms & disablewallet optional
 2019-03-21 11:27:28 +01:00
nixbitcoin fbc78ce6ed Add Greg Maxwell's banlist to bitcoind postStart 2019-03-21 10:11:18 +01:00
nixbitcoin d6facee486 Add config.services.liquidd.port 2019-03-18 14:17:38 +01:00
nixbitcoin eacd057963 Fix electrs and add electrs hidden service 2019-03-16 16:11:54 +01:00
nixbitcoin de889d584f Add proxy and hidden service to liquidd 2019-03-14 11:19:28 +01:00
nixbitcoin 132703637c Tor proxy, always-use-proxy, bind to localhost clightning 2019-03-07 13:37:00 +01:00
nixbitcoin 8fedbe66c3 Add own hardware tutorial to README.md 2019-02-24 22:19:56 +01:00
nixbitcoin 197155fb0b Fixed typo and replaced tab with spaces 2019-01-04 10:47:06 +01:00
nixbitcoin 9ada1d32f3 Incorproate PR comments, correct erroneous description in clightning module, add electrs module, add electrs package, add electrs to nix-bitcoin.nix, add electrs to modules/nix-bitcoin.nix 2019-01-04 10:44:03 +01:00