refactor: move vendor/nix-bitcoin to modules/bitcoin, remove overlays
- Move modules/vendor/nix-bitcoin/* -> modules/bitcoin/* (clean, Sovran-owned)
* modules/bitcoin/default.nix imports the 6 tailored services
* modules/bitcoin/common.nix bundles secrets/onion/lib
* modules/bitcoin/stubs.nix kept minimal (no clightning)
* packages/lndinit/default.nix replaces pkgs/sovran-overlay.nix
(lnd.nix now uses pkgs.callPackage ../../packages/lndinit {})
- Remove pkgs/sovran-overlay.nix, pkgs/nbxplorer.nix, pkgs/README.md
* No global overlay - lndinit is a normal package in packages/
- Remove modules/vendor/ entirely
- Update flake.nix: drop overlay-sovran, import ./modules/bitcoin
instead of ./modules/vendor/nix-bitcoin/modules.nix
- No more random vendor/ or pkgs/ dirs - follows Sovran convention:
modules/ for NixOS modules, packages/ for packages
This commit is contained in:
Sovran Clean
@@ -0,0 +1,15 @@
|
||||
# Common Bitcoin infrastructure: secrets, onion services, nodeinfo, security
|
||||
# Extracted from nix-bitcoin, tailored for Sovran (lnd-only)
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
./nix-bitcoin.nix
|
||||
./secrets/secrets.nix
|
||||
./operator.nix
|
||||
./security.nix
|
||||
./onion-addresses.nix
|
||||
./onion-services.nix
|
||||
./nodeinfo.nix
|
||||
./versioning.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
# Sovran Bitcoin stack - tailored from nix-bitcoin, lnd-only, nixpkgs packages
|
||||
# Original: https://github.com/fort-nix/nix-bitcoin
|
||||
{
|
||||
imports = [
|
||||
./common.nix
|
||||
./bitcoind.nix
|
||||
./electrs.nix
|
||||
./lnd.nix
|
||||
./lndconnect.nix
|
||||
./rtl.nix
|
||||
./btcpayserver.nix
|
||||
./mempool.nix
|
||||
./stubs.nix
|
||||
];
|
||||
|
||||
disabledModules = [ "services/networking/bitcoind.nix" ];
|
||||
}
|
||||
@@ -150,7 +150,7 @@ let
|
||||
nbLib = config.nix-bitcoin.lib;
|
||||
secretsDir = config.nix-bitcoin.secretsDir;
|
||||
runAsUser = config.nix-bitcoin.runAsUserCmd;
|
||||
lndinit = "${pkgs.lndinit}/bin/lndinit";
|
||||
lndinit = "${(pkgs.callPackage ../../packages/lndinit {})}/bin/lndinit";
|
||||
|
||||
bitcoind = config.services.bitcoind;
|
||||
|
||||
@@ -178,10 +178,7 @@ in {
|
||||
services.lnd.enable = mkIf cfg.nodes.lnd.enable true;
|
||||
services.lightning-loop.enable = mkIf lndLoopEnabled true;
|
||||
# vendored fix: clightning may not exist in this nixpkgs
|
||||
services.clightning = mkIf (cfg.nodes.clightning.enable && config.services ? clightning) {
|
||||
enable = true;
|
||||
plugins.clnrest.enable = true;
|
||||
};
|
||||
# clightning removed - Sovran uses lnd only
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d '${cfg.dataDir}' 0770 ${cfg.user} ${cfg.group} - -"
|
||||
@@ -1,11 +1,7 @@
|
||||
{ lib, ... }:
|
||||
with lib;
|
||||
{
|
||||
# Stubs for services referenced by vendored nix-bitcoin modules but not in nixpkgs
|
||||
# clightning and clightning-rest are NOT stubbed - they exist in some nixpkgs (f13ff45) but not others (8b8c811)
|
||||
# and have different option structures (plugins only, no enable). Handled via guards, not stubs.
|
||||
# Other services don't exist in either nixpkgs version, so unconditional is safe.
|
||||
|
||||
# Stubs for services referenced but not in nixpkgs - clightning not stubbed (exists in f13ff45, handled via guards)
|
||||
options.services.liquidd.enable = mkOption { type = types.bool; default = false; };
|
||||
options.services.liquidd.dataDir = mkOption { type = types.path; default = "/var/lib/liquidd"; };
|
||||
options.services.liquidd.address = mkOption { type = types.str; default = "127.0.0.1"; };
|
||||
@@ -17,7 +13,6 @@ with lib;
|
||||
options.services.liquidd.group = mkOption { type = types.str; default = "liquidd"; };
|
||||
|
||||
options.services.fulcrum.enable = mkOption { type = types.bool; default = false; };
|
||||
|
||||
options.services.lightning-loop.enable = mkOption { type = types.bool; default = false; };
|
||||
options.services.lightning-pool.enable = mkOption { type = types.bool; default = false; };
|
||||
options.services.joinmarket.enable = mkOption { type = types.bool; default = false; };
|
||||
-54
@@ -1,54 +0,0 @@
|
||||
{ lib, config, ... }:
|
||||
let
|
||||
defaultTrue = lib.mkDefault true;
|
||||
defaultEnableTorProxy = {
|
||||
tor.proxy = defaultTrue;
|
||||
tor.enforce = defaultTrue;
|
||||
};
|
||||
defaultEnforceTor = {
|
||||
tor.enforce = defaultTrue;
|
||||
};
|
||||
in {
|
||||
services.tor = {
|
||||
enable = true;
|
||||
client.enable = true;
|
||||
};
|
||||
|
||||
services = {
|
||||
# Use Tor as a proxy for outgoing connections
|
||||
# and restrict all connections to Tor
|
||||
#
|
||||
bitcoind = defaultEnableTorProxy;
|
||||
# clightning = defaultEnableTorProxy; # vendored: not needed (Sovran uses lnd)
|
||||
lnd = defaultEnableTorProxy;
|
||||
# lightning-loop = defaultEnableTorProxy; # vendored: not used
|
||||
# liquidd = defaultEnableTorProxy; # vendored: not used
|
||||
# TODO-EXTERNAL:
|
||||
# disable Tor enforcement until btcpayserver can fetch rates over Tor
|
||||
# btcpayserver = defaultEnableTorProxy;
|
||||
# lightning-pool = defaultEnableTorProxy; # vendored: not used
|
||||
mempool = defaultEnableTorProxy;
|
||||
|
||||
# These services don't make outgoing connections
|
||||
# (or use Tor by default in case of joinmarket)
|
||||
# but we restrict them to Tor just to be safe.
|
||||
#
|
||||
electrs = defaultEnforceTor;
|
||||
# fulcrum = defaultEnforceTor; # vendored: not used
|
||||
nbxplorer = defaultEnforceTor;
|
||||
rtl = defaultEnforceTor;
|
||||
# joinmarket = defaultEnforceTor; # vendored: not used
|
||||
# joinmarket-ob-watcher = defaultEnforceTor; # vendored: not used
|
||||
# clightning-rest = defaultEnforceTor; # vendored: not used
|
||||
};
|
||||
|
||||
# Add onion services for incoming connections
|
||||
nix-bitcoin.onionServices = {
|
||||
bitcoind.enable = defaultTrue;
|
||||
# liquidd.enable = defaultTrue; # stub
|
||||
electrs.enable = defaultTrue;
|
||||
# fulcrum.enable = defaultTrue; # stub
|
||||
# joinmarket-ob-watcher.enable = defaultTrue; # stub
|
||||
rtl.enable = defaultTrue;
|
||||
};
|
||||
}
|
||||
-29
@@ -1,29 +0,0 @@
|
||||
# Vendored nix-bitcoin — MINIMAL subset used by Sovran_SystemsOS
|
||||
# Original source: https://github.com/fort-nix/nix-bitcoin
|
||||
# Only services actually used by Sovran are kept (6 services vs 20+ upstream)
|
||||
# - backups.nix removed: Sovran uses rsnapshot to Second_Drive (configuration.nix)
|
||||
# - netns-isolation.nix is now a stub (requires false for nwc-wallets)
|
||||
# - stubs.nix provides options for services referenced but not in nixpkgs unstable 2026-08
|
||||
{
|
||||
imports = [
|
||||
./stubs.nix
|
||||
./nix-bitcoin.nix
|
||||
./secrets/secrets.nix
|
||||
./operator.nix
|
||||
./bitcoind.nix
|
||||
./electrs.nix
|
||||
./lnd.nix
|
||||
./lndconnect.nix
|
||||
./rtl.nix
|
||||
./btcpayserver.nix
|
||||
./mempool.nix
|
||||
./security.nix
|
||||
./onion-addresses.nix
|
||||
./onion-services.nix
|
||||
./netns-isolation.nix
|
||||
./nodeinfo.nix
|
||||
./versioning.nix
|
||||
];
|
||||
|
||||
disabledModules = [ "services/networking/bitcoind.nix" ];
|
||||
}
|
||||
-16
@@ -1,16 +0,0 @@
|
||||
{ config, lib, ... }:
|
||||
with lib;
|
||||
{
|
||||
options.nix-bitcoin.netns-isolation = {
|
||||
enable = mkEnableOption "netns isolation (stub — disabled in Sovran_SystemsOS)";
|
||||
};
|
||||
# No config when enabled — isolation is intentionally not implemented.
|
||||
# Sovran requires enable = false (see modules/nwc-wallets.nix assertion).
|
||||
# The original nix-bitcoin implementation (365 lines, bridge nb-br, iptables,
|
||||
# ip netns, 169.254.x.x) broke Caddy/AlbyHub/RTL and is not needed for
|
||||
# desktop/server roles. Keep stub so `nix-bitcoin.netns-isolation.enable`
|
||||
# remains a valid option.
|
||||
config = mkIf config.nix-bitcoin.netns-isolation.enable {
|
||||
warnings = [ "nix-bitcoin.netns-isolation.enable is a stub in vendored Sovran and does nothing. Set it to false." ];
|
||||
};
|
||||
}
|
||||
-62
@@ -1,62 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.services;
|
||||
nbLib = config.nix-bitcoin.lib;
|
||||
operatorName = config.nix-bitcoin.operator.name;
|
||||
in {
|
||||
imports = [
|
||||
../modules.nix
|
||||
./enable-tor.nix
|
||||
];
|
||||
|
||||
options = {
|
||||
# Used by ../versioning.nix
|
||||
nix-bitcoin.secure-node-preset-enabled = {};
|
||||
};
|
||||
|
||||
config = {
|
||||
networking.firewall.enable = true;
|
||||
|
||||
nix-bitcoin.security.dbusHideProcessInformation = true;
|
||||
|
||||
# Use doas instead of sudo
|
||||
security.doas.enable = true;
|
||||
security.sudo.enable = false;
|
||||
environment.shellAliases.sudo = "doas";
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
jq
|
||||
];
|
||||
|
||||
# Add a SSH onion service
|
||||
services.tor.relay.onionServices.sshd = nbLib.mkOnionService { port = 22; };
|
||||
nix-bitcoin.onionAddresses.access.${operatorName} = [ "sshd" ];
|
||||
|
||||
services.bitcoind = {
|
||||
enable = true;
|
||||
listen = true;
|
||||
dbCache = 1000;
|
||||
};
|
||||
|
||||
services.liquidd = {
|
||||
# Enable `validatepegin` to verify that a transaction sending BTC into
|
||||
# Liquid exists on Bitcoin. Without it, a malicious liquid federation can
|
||||
# make the node accept a sidechain that is not fully backed.
|
||||
validatepegin = true;
|
||||
listen = true;
|
||||
};
|
||||
|
||||
nix-bitcoin.nodeinfo.enable = true;
|
||||
|
||||
# vendored: backups removed — was services.backups.frequency = "daily"
|
||||
|
||||
# operator
|
||||
nix-bitcoin.operator.enable = true;
|
||||
users.users.${operatorName} = {
|
||||
openssh.authorizedKeys.keys = config.users.users.root.openssh.authorizedKeys.keys;
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user