nixbitcoin
91b6b2c370
This is NixOS' recommended way to setup service dirs https://github.com/NixOS/nixpkgs/pull/56265. This commit hands off the initial data directory creation to systemd.tmpfiles.rules. All other preStart scripts are left intact to limit this changes' scope.
120 lines
4.0 KiB
Nix
120 lines
4.0 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.services.clightning;
|
|
inherit (config) nix-bitcoin-services;
|
|
configFile = pkgs.writeText "config" ''
|
|
autolisten=${if cfg.autolisten then "true" else "false"}
|
|
network=bitcoin
|
|
bitcoin-datadir=${config.services.bitcoind.dataDir}
|
|
${optionalString (cfg.proxy != null) "proxy=${cfg.proxy}"}
|
|
always-use-proxy=${if cfg.always-use-proxy then "true" else "false"}
|
|
${optionalString (cfg.bind-addr != null) "bind-addr=${cfg.bind-addr}"}
|
|
bitcoin-rpcuser=${cfg.bitcoin-rpcuser}
|
|
rpc-file-mode=0660
|
|
'';
|
|
in {
|
|
options.services.clightning = {
|
|
enable = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
If enabled, the clightning service will be installed.
|
|
'';
|
|
};
|
|
autolisten = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
If enabled, the clightning service will listen.
|
|
'';
|
|
};
|
|
proxy = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = "Set a socks proxy to use to connect to Tor nodes (or for all connections if *always-use-proxy* is set)";
|
|
};
|
|
always-use-proxy = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Always use the *proxy*, even to connect to normal IP addresses (you can still connect to Unix domain sockets manually). This also disables all DNS lookups, to avoid leaking information.
|
|
'';
|
|
};
|
|
bind-addr = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = "Set an IP address or UNIX domain socket to listen to";
|
|
};
|
|
bitcoin-rpcuser = mkOption {
|
|
type = types.str;
|
|
description = ''
|
|
Bitcoin RPC user
|
|
'';
|
|
};
|
|
dataDir = mkOption {
|
|
type = types.path;
|
|
default = "/var/lib/clightning";
|
|
description = "The data directory for clightning.";
|
|
};
|
|
cli = mkOption {
|
|
readOnly = true;
|
|
default = pkgs.writeScriptBin "lightning-cli"
|
|
''
|
|
${pkgs.nix-bitcoin.clightning}/bin/lightning-cli --lightning-dir='${cfg.dataDir}' "$@"
|
|
'';
|
|
description = "Binary to connect with the clightning instance.";
|
|
};
|
|
enforceTor = nix-bitcoin-services.enforceTor;
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
environment.systemPackages = [ pkgs.nix-bitcoin.clightning (hiPrio cfg.cli) ];
|
|
users.users.clightning = {
|
|
description = "clightning User";
|
|
group = "clightning";
|
|
};
|
|
users.groups.clightning = {};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d '${cfg.dataDir}' 0770 ${config.users.users.clightning.name} ${config.users.users.clightning.group} - -"
|
|
];
|
|
|
|
systemd.services.clightning = {
|
|
description = "Run clightningd";
|
|
path = [ pkgs.nix-bitcoin.bitcoind ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
requires = [ "bitcoind.service" ];
|
|
after = [ "bitcoind.service" ];
|
|
preStart = ''
|
|
cp ${configFile} ${cfg.dataDir}/config
|
|
chown -R 'clightning:clightning' '${cfg.dataDir}'
|
|
# The RPC socket has to be removed otherwise we might have stale sockets
|
|
rm -f ${cfg.dataDir}/bitcoin/lightning-rpc
|
|
chmod 600 ${cfg.dataDir}/config
|
|
echo "bitcoin-rpcpassword=$(cat ${config.nix-bitcoin.secretsDir}/bitcoin-rpcpassword)" >> '${cfg.dataDir}/config'
|
|
'';
|
|
serviceConfig = nix-bitcoin-services.defaultHardening // {
|
|
PermissionsStartOnly = "true";
|
|
ExecStart = "${pkgs.nix-bitcoin.clightning}/bin/lightningd --lightning-dir=${cfg.dataDir}";
|
|
User = "clightning";
|
|
Restart = "on-failure";
|
|
RestartSec = "10s";
|
|
} // (if cfg.enforceTor
|
|
then nix-bitcoin-services.allowTor
|
|
else nix-bitcoin-services.allowAnyIP
|
|
);
|
|
# Wait until the rpc socket appears
|
|
postStart = ''
|
|
while [[ ! -e ${cfg.dataDir}/bitcoin/lightning-rpc ]]; do
|
|
sleep 0.1
|
|
done
|
|
# Needed to enable lightning-cli for users with group 'clightning'
|
|
chmod g+x ${cfg.dataDir}/bitcoin
|
|
'';
|
|
};
|
|
};
|
|
}
|