refactor: move vendor/nix-bitcoin to modules/bitcoin, remove overlays
- Move modules/vendor/nix-bitcoin/* -> modules/bitcoin/* (clean, Sovran-owned)
* modules/bitcoin/default.nix imports the 6 tailored services
* modules/bitcoin/common.nix bundles secrets/onion/lib
* modules/bitcoin/stubs.nix kept minimal (no clightning)
* packages/lndinit/default.nix replaces pkgs/sovran-overlay.nix
(lnd.nix now uses pkgs.callPackage ../../packages/lndinit {})
- Remove pkgs/sovran-overlay.nix, pkgs/nbxplorer.nix, pkgs/README.md
* No global overlay - lndinit is a normal package in packages/
- Remove modules/vendor/ entirely
- Update flake.nix: drop overlay-sovran, import ./modules/bitcoin
instead of ./modules/vendor/nix-bitcoin/modules.nix
- No more random vendor/ or pkgs/ dirs - follows Sovran convention:
modules/ for NixOS modules, packages/ for packages
This commit is contained in:
Sovran Clean
@@ -17,12 +17,11 @@
|
||||
config.allowUnfree = true;
|
||||
};
|
||||
};
|
||||
overlay-sovran = import ./pkgs/sovran-overlay.nix;
|
||||
in
|
||||
{
|
||||
nixosConfigurations.nixos = nixpkgs.lib.nixosSystem {
|
||||
modules = [
|
||||
{ nixpkgs.hostPlatform = "x86_64-linux"; nixpkgs.overlays = [ overlay-stable overlay-sovran ]; }
|
||||
{ nixpkgs.hostPlatform = "x86_64-linux"; nixpkgs.overlays = [ overlay-stable ]; }
|
||||
self.nixosModules.Sovran_SystemsOS
|
||||
./hardware-configuration.nix
|
||||
./role-state.nix
|
||||
@@ -32,9 +31,9 @@
|
||||
|
||||
nixosConfigurations.sovran_systemsos-iso = nixpkgs.lib.nixosSystem {
|
||||
modules = [
|
||||
{ nixpkgs.hostPlatform = "x86_64-linux"; nixpkgs.overlays = [ overlay-stable overlay-sovran ]; }
|
||||
{ nixpkgs.hostPlatform = "x86_64-linux"; nixpkgs.overlays = [ overlay-stable ]; }
|
||||
./iso/common.nix
|
||||
./modules/vendor/nix-bitcoin/modules.nix
|
||||
./modules/bitcoin
|
||||
nixvim.nixosModules.nixvim
|
||||
];
|
||||
};
|
||||
@@ -42,10 +41,10 @@
|
||||
nixosModules.Sovran_SystemsOS = { pkgs, lib, config, ... }: {
|
||||
imports = [
|
||||
({ config, pkgs, ... }: {
|
||||
nixpkgs.overlays = [ overlay-stable overlay-sovran ];
|
||||
nixpkgs.overlays = [ overlay-stable ];
|
||||
})
|
||||
./configuration.nix
|
||||
./modules/vendor/nix-bitcoin/modules.nix
|
||||
./modules/bitcoin
|
||||
nixvim.nixosModules.nixvim
|
||||
];
|
||||
config = {
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
# Common Bitcoin infrastructure: secrets, onion services, nodeinfo, security
|
||||
# Extracted from nix-bitcoin, tailored for Sovran (lnd-only)
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
./nix-bitcoin.nix
|
||||
./secrets/secrets.nix
|
||||
./operator.nix
|
||||
./security.nix
|
||||
./onion-addresses.nix
|
||||
./onion-services.nix
|
||||
./nodeinfo.nix
|
||||
./versioning.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
# Sovran Bitcoin stack - tailored from nix-bitcoin, lnd-only, nixpkgs packages
|
||||
# Original: https://github.com/fort-nix/nix-bitcoin
|
||||
{
|
||||
imports = [
|
||||
./common.nix
|
||||
./bitcoind.nix
|
||||
./electrs.nix
|
||||
./lnd.nix
|
||||
./lndconnect.nix
|
||||
./rtl.nix
|
||||
./btcpayserver.nix
|
||||
./mempool.nix
|
||||
./stubs.nix
|
||||
];
|
||||
|
||||
disabledModules = [ "services/networking/bitcoind.nix" ];
|
||||
}
|
||||
@@ -150,7 +150,7 @@ let
|
||||
nbLib = config.nix-bitcoin.lib;
|
||||
secretsDir = config.nix-bitcoin.secretsDir;
|
||||
runAsUser = config.nix-bitcoin.runAsUserCmd;
|
||||
lndinit = "${pkgs.lndinit}/bin/lndinit";
|
||||
lndinit = "${(pkgs.callPackage ../../packages/lndinit {})}/bin/lndinit";
|
||||
|
||||
bitcoind = config.services.bitcoind;
|
||||
|
||||
@@ -178,10 +178,7 @@ in {
|
||||
services.lnd.enable = mkIf cfg.nodes.lnd.enable true;
|
||||
services.lightning-loop.enable = mkIf lndLoopEnabled true;
|
||||
# vendored fix: clightning may not exist in this nixpkgs
|
||||
services.clightning = mkIf (cfg.nodes.clightning.enable && config.services ? clightning) {
|
||||
enable = true;
|
||||
plugins.clnrest.enable = true;
|
||||
};
|
||||
# clightning removed - Sovran uses lnd only
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d '${cfg.dataDir}' 0770 ${cfg.user} ${cfg.group} - -"
|
||||
@@ -1,11 +1,7 @@
|
||||
{ lib, ... }:
|
||||
with lib;
|
||||
{
|
||||
# Stubs for services referenced by vendored nix-bitcoin modules but not in nixpkgs
|
||||
# clightning and clightning-rest are NOT stubbed - they exist in some nixpkgs (f13ff45) but not others (8b8c811)
|
||||
# and have different option structures (plugins only, no enable). Handled via guards, not stubs.
|
||||
# Other services don't exist in either nixpkgs version, so unconditional is safe.
|
||||
|
||||
# Stubs for services referenced but not in nixpkgs - clightning not stubbed (exists in f13ff45, handled via guards)
|
||||
options.services.liquidd.enable = mkOption { type = types.bool; default = false; };
|
||||
options.services.liquidd.dataDir = mkOption { type = types.path; default = "/var/lib/liquidd"; };
|
||||
options.services.liquidd.address = mkOption { type = types.str; default = "127.0.0.1"; };
|
||||
@@ -17,7 +13,6 @@ with lib;
|
||||
options.services.liquidd.group = mkOption { type = types.str; default = "liquidd"; };
|
||||
|
||||
options.services.fulcrum.enable = mkOption { type = types.bool; default = false; };
|
||||
|
||||
options.services.lightning-loop.enable = mkOption { type = types.bool; default = false; };
|
||||
options.services.lightning-pool.enable = mkOption { type = types.bool; default = false; };
|
||||
options.services.joinmarket.enable = mkOption { type = types.bool; default = false; };
|
||||
-54
@@ -1,54 +0,0 @@
|
||||
{ lib, config, ... }:
|
||||
let
|
||||
defaultTrue = lib.mkDefault true;
|
||||
defaultEnableTorProxy = {
|
||||
tor.proxy = defaultTrue;
|
||||
tor.enforce = defaultTrue;
|
||||
};
|
||||
defaultEnforceTor = {
|
||||
tor.enforce = defaultTrue;
|
||||
};
|
||||
in {
|
||||
services.tor = {
|
||||
enable = true;
|
||||
client.enable = true;
|
||||
};
|
||||
|
||||
services = {
|
||||
# Use Tor as a proxy for outgoing connections
|
||||
# and restrict all connections to Tor
|
||||
#
|
||||
bitcoind = defaultEnableTorProxy;
|
||||
# clightning = defaultEnableTorProxy; # vendored: not needed (Sovran uses lnd)
|
||||
lnd = defaultEnableTorProxy;
|
||||
# lightning-loop = defaultEnableTorProxy; # vendored: not used
|
||||
# liquidd = defaultEnableTorProxy; # vendored: not used
|
||||
# TODO-EXTERNAL:
|
||||
# disable Tor enforcement until btcpayserver can fetch rates over Tor
|
||||
# btcpayserver = defaultEnableTorProxy;
|
||||
# lightning-pool = defaultEnableTorProxy; # vendored: not used
|
||||
mempool = defaultEnableTorProxy;
|
||||
|
||||
# These services don't make outgoing connections
|
||||
# (or use Tor by default in case of joinmarket)
|
||||
# but we restrict them to Tor just to be safe.
|
||||
#
|
||||
electrs = defaultEnforceTor;
|
||||
# fulcrum = defaultEnforceTor; # vendored: not used
|
||||
nbxplorer = defaultEnforceTor;
|
||||
rtl = defaultEnforceTor;
|
||||
# joinmarket = defaultEnforceTor; # vendored: not used
|
||||
# joinmarket-ob-watcher = defaultEnforceTor; # vendored: not used
|
||||
# clightning-rest = defaultEnforceTor; # vendored: not used
|
||||
};
|
||||
|
||||
# Add onion services for incoming connections
|
||||
nix-bitcoin.onionServices = {
|
||||
bitcoind.enable = defaultTrue;
|
||||
# liquidd.enable = defaultTrue; # stub
|
||||
electrs.enable = defaultTrue;
|
||||
# fulcrum.enable = defaultTrue; # stub
|
||||
# joinmarket-ob-watcher.enable = defaultTrue; # stub
|
||||
rtl.enable = defaultTrue;
|
||||
};
|
||||
}
|
||||
-29
@@ -1,29 +0,0 @@
|
||||
# Vendored nix-bitcoin — MINIMAL subset used by Sovran_SystemsOS
|
||||
# Original source: https://github.com/fort-nix/nix-bitcoin
|
||||
# Only services actually used by Sovran are kept (6 services vs 20+ upstream)
|
||||
# - backups.nix removed: Sovran uses rsnapshot to Second_Drive (configuration.nix)
|
||||
# - netns-isolation.nix is now a stub (requires false for nwc-wallets)
|
||||
# - stubs.nix provides options for services referenced but not in nixpkgs unstable 2026-08
|
||||
{
|
||||
imports = [
|
||||
./stubs.nix
|
||||
./nix-bitcoin.nix
|
||||
./secrets/secrets.nix
|
||||
./operator.nix
|
||||
./bitcoind.nix
|
||||
./electrs.nix
|
||||
./lnd.nix
|
||||
./lndconnect.nix
|
||||
./rtl.nix
|
||||
./btcpayserver.nix
|
||||
./mempool.nix
|
||||
./security.nix
|
||||
./onion-addresses.nix
|
||||
./onion-services.nix
|
||||
./netns-isolation.nix
|
||||
./nodeinfo.nix
|
||||
./versioning.nix
|
||||
];
|
||||
|
||||
disabledModules = [ "services/networking/bitcoind.nix" ];
|
||||
}
|
||||
-16
@@ -1,16 +0,0 @@
|
||||
{ config, lib, ... }:
|
||||
with lib;
|
||||
{
|
||||
options.nix-bitcoin.netns-isolation = {
|
||||
enable = mkEnableOption "netns isolation (stub — disabled in Sovran_SystemsOS)";
|
||||
};
|
||||
# No config when enabled — isolation is intentionally not implemented.
|
||||
# Sovran requires enable = false (see modules/nwc-wallets.nix assertion).
|
||||
# The original nix-bitcoin implementation (365 lines, bridge nb-br, iptables,
|
||||
# ip netns, 169.254.x.x) broke Caddy/AlbyHub/RTL and is not needed for
|
||||
# desktop/server roles. Keep stub so `nix-bitcoin.netns-isolation.enable`
|
||||
# remains a valid option.
|
||||
config = mkIf config.nix-bitcoin.netns-isolation.enable {
|
||||
warnings = [ "nix-bitcoin.netns-isolation.enable is a stub in vendored Sovran and does nothing. Set it to false." ];
|
||||
};
|
||||
}
|
||||
-62
@@ -1,62 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.services;
|
||||
nbLib = config.nix-bitcoin.lib;
|
||||
operatorName = config.nix-bitcoin.operator.name;
|
||||
in {
|
||||
imports = [
|
||||
../modules.nix
|
||||
./enable-tor.nix
|
||||
];
|
||||
|
||||
options = {
|
||||
# Used by ../versioning.nix
|
||||
nix-bitcoin.secure-node-preset-enabled = {};
|
||||
};
|
||||
|
||||
config = {
|
||||
networking.firewall.enable = true;
|
||||
|
||||
nix-bitcoin.security.dbusHideProcessInformation = true;
|
||||
|
||||
# Use doas instead of sudo
|
||||
security.doas.enable = true;
|
||||
security.sudo.enable = false;
|
||||
environment.shellAliases.sudo = "doas";
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
jq
|
||||
];
|
||||
|
||||
# Add a SSH onion service
|
||||
services.tor.relay.onionServices.sshd = nbLib.mkOnionService { port = 22; };
|
||||
nix-bitcoin.onionAddresses.access.${operatorName} = [ "sshd" ];
|
||||
|
||||
services.bitcoind = {
|
||||
enable = true;
|
||||
listen = true;
|
||||
dbCache = 1000;
|
||||
};
|
||||
|
||||
services.liquidd = {
|
||||
# Enable `validatepegin` to verify that a transaction sending BTC into
|
||||
# Liquid exists on Bitcoin. Without it, a malicious liquid federation can
|
||||
# make the node accept a sidechain that is not fully backed.
|
||||
validatepegin = true;
|
||||
listen = true;
|
||||
};
|
||||
|
||||
nix-bitcoin.nodeinfo.enable = true;
|
||||
|
||||
# vendored: backups removed — was services.backups.frequency = "daily"
|
||||
|
||||
# operator
|
||||
nix-bitcoin.operator.enable = true;
|
||||
users.users.${operatorName} = {
|
||||
openssh.authorizedKeys.keys = config.users.users.root.openssh.authorizedKeys.keys;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
{ lib, buildGoModule, fetchFromGitHub }:
|
||||
|
||||
buildGoModule rec {
|
||||
pname = "lndinit";
|
||||
version = "0.1.3-beta";
|
||||
src = fetchFromGitHub {
|
||||
owner = "lightninglabs";
|
||||
repo = pname;
|
||||
rev = "v${version}";
|
||||
sha256 = "sha256-sO1DpbppCurxr9g9nUl9Vx82FJK1mTcUw3rY1Fm1wEU=";
|
||||
};
|
||||
vendorHash = "sha256-El44BS5Bu0K/klMxkajciU/R6uqiXBMOiLN536QztbE=";
|
||||
subPackages = [ "." ];
|
||||
meta = with lib; {
|
||||
description = "Wallet initializer for lnd (from nix-bitcoin)";
|
||||
homepage = "https://github.com/lightninglabs/lndinit";
|
||||
license = licenses.mit;
|
||||
};
|
||||
}
|
||||
@@ -1,2 +0,0 @@
|
||||
These packages are provided by nixpkgs directly. No extra pinning needed.
|
||||
Missing helpers (lndinit) are vendored below if needed.
|
||||
@@ -1,18 +0,0 @@
|
||||
# Fallback nbxplorer package if not in nixpkgs
|
||||
# This is rarely needed — nixpkgs-unstable usually has it
|
||||
{ lib, buildDotnetModule, fetchFromGitHub, dotnetCorePackages }:
|
||||
buildDotnetModule rec {
|
||||
pname = "nbxplorer";
|
||||
version = "2.5.22";
|
||||
src = fetchFromGitHub {
|
||||
owner = "dgarage";
|
||||
repo = "NBXplorer";
|
||||
rev = "v${version}";
|
||||
sha256 = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
|
||||
};
|
||||
projectFile = "NBXplorer/NBXplorer.csproj";
|
||||
nugetDeps = ./nbxplorer-deps.nix; # not needed if using nixpkgs version
|
||||
dotnet-sdk = dotnetCorePackages.sdk_8_0;
|
||||
dotnet-runtime = dotnetCorePackages.aspnetcore_8_0;
|
||||
meta = with lib; { description = "NBXplorer fallback"; license = licenses.mit; };
|
||||
}
|
||||
@@ -1,37 +0,0 @@
|
||||
# Sovran overlay — provides packages not in nixpkgs or needing overrides
|
||||
# All Bitcoin packages are now sourced from nixpkgs (unstable) directly.
|
||||
# This overlay only fills gaps where nixpkgs is missing/broken.
|
||||
final: prev: let
|
||||
# lndinit is not in nixpkgs — vendor it from nix-bitcoin source
|
||||
lndinit = prev.buildGoModule rec {
|
||||
pname = "lndinit";
|
||||
version = "0.1.3-beta";
|
||||
src = prev.fetchFromGitHub {
|
||||
owner = "lightninglabs";
|
||||
repo = pname;
|
||||
rev = "v${version}";
|
||||
sha256 = "sha256-sO1DpbppCurxr9g9nUl9Vx82FJK1mTcUw3rY1Fm1wEU=";
|
||||
};
|
||||
vendorHash = "sha256-El44BS5Bu0K/klMxkajciU/R6uqiXBMOiLN536QztbE=";
|
||||
subPackages = [ "." ];
|
||||
meta = with prev.lib; {
|
||||
description = "Wallet initializer utility for lnd (vendored from nix-bitcoin)";
|
||||
homepage = "https://github.com/lightninglabs/lndinit";
|
||||
license = licenses.mit;
|
||||
};
|
||||
};
|
||||
|
||||
# netns-exec stub — netns isolation is stubbed, this is no-op
|
||||
# If not needed, stub it to coreutils
|
||||
netns-exec = prev.writeShellScriptBin "netns-exec" ''
|
||||
exec "$@"
|
||||
'';
|
||||
|
||||
# nbxplorer is needed by btcpayserver but was removed from nixpkgs in some versions
|
||||
# Use nixpkgs version if available, otherwise build from nix-bitcoin pin
|
||||
nbxplorer = prev.nbxplorer or (prev.callPackage ./nbxplorer.nix {} );
|
||||
in {
|
||||
inherit lndinit netns-exec;
|
||||
# Re-expose nbxplorer only if missing
|
||||
nbxplorer = if prev ? nbxplorer then prev.nbxplorer else nbxplorer;
|
||||
}
|
||||
Reference in New Issue
Block a user