fix: restore a Zeus-scannable LND REST connect QR

The LND-only rewrite of lndconnect.nix shipped a wrapper Zeus cannot
use: unknown flags (--cert/--macaroon), a non-existent onion path
(free/lnd.onion), and a REST hidden service that collided with LND's
P2P onion. Restore the nix-bitcoin contract — dedicated lnd-rest
onion on port 8080, --nocert over Tor, admin macaroon in the URI —
and only persist a valid lndconnect:// URI for the Hub QR.

modules/bitcoin/lndconnect.nix

@@ -1,63 +1,115 @@
 { config, lib, pkgs, ... }:
 
+# LND-only lndconnect wrapper. Restored to the fort-nix/nix-bitcoin contract
+# after the LND-only rewrite shipped a Zeus QR that Zeus cannot use:
+#   - unknown flags (--cert / --macaroon instead of --tlscertpath / --adminmacaroonpath)
+#   - onion hostname read from /var/lib/tor/onion/free/lnd/hostname (does not exist)
+#   - REST hidden service named "lnd", colliding with the LND P2P onion
+#   - TLS cert embedded in the URI (localhost CN + QR too dense to scan)
+#
+# Zeus needs: lndconnect://<lnd-rest-onion>:8080?macaroon=<admin>  (no cert over Tor)
+
 with lib;
 let
   cfg = config.services.lnd;
   operatorName = config.nix-bitcoin.operator.name;
   nbLib = config.nix-bitcoin.lib;
+  runAsUser = config.nix-bitcoin.runAsUserCmd;
 
-  mkLndconnect = { name, isClightning ? false, enableOnion, onionService, port, certPath, authSecretPath }:
-    let
-      lnd = config.services.lnd;
-      getOnionAddress = "cat ${config.nix-bitcoin.secretsDir}/onion-address-${onionService} 2>/dev/null || echo ${onionService}.onion";
-    in pkgs.writeScriptBin name ''
-      #!${pkgs.bash}/bin/bash
-      set -e
-      certPath="${certPath}"
-      authSecretPath="${authSecretPath}"
-      if [ "${toString enableOnion}" = "1" ]; then
-        host=$(cat /var/lib/tor/onion/${onionService}/hostname 2>/dev/null || echo "${onionService}.onion")
-        port="${toString port}"
-      else
-        host="${nbLib.address lnd.restAddress}"
-        port="${toString lnd.restPort}"
-      fi
-      # lndconnect is provided by pkgs.lndconnect
-      ${getExe pkgs.lndconnect} --host="$host" --port="$port" --cert="$certPath" --macaroon="$authSecretPath" "$@"
-    '';
+  mkLndconnect = {
+    name,
+    shebang ? "#!${pkgs.stdenv.shell} -e",
+    port,
+    authSecretPath,
+    enableOnion,
+    onionService ? null,
+    certPath ? null
+  }:
+  # lndconnect requires a --configfile argument, although it's unused
+  # https://github.com/LN-Zap/lndconnect/issues/25
+  lib.hiPrio (pkgs.writeScriptBin name ''
+    ${shebang}
+    url=$(
+      ${getExe pkgs.lndconnect} --url \
+        ${optionalString enableOnion "--host=$(cat ${config.nix-bitcoin.onionAddresses.dataDir}/${onionService})"} \
+        --port=${toString port} \
+        ${if enableOnion || certPath == null then "--nocert" else "--tlscertpath='${certPath}'"} \
+        --adminmacaroonpath='${authSecretPath}' \
+        --configfile=/dev/null "$@"
+    )
+
+    # If --url is in args
+    if [[ " $* " =~ " --url " ]]; then
+      echo "$url"
+    else
+      # UTF-8 QR is smaller than lndconnect's native output
+      echo -n "$url" | ${getExe pkgs.qrencode} -t UTF8 -o -
+    fi
+  '');
 in {
   options.services.lnd.lndconnect = {
     enable = mkOption {
       type = types.bool;
       default = false;
-      description = "Enable lndconnect for LND";
+      description = ''
+        Add a `lndconnect` binary to the system environment which prints
+        connection info for lnd clients (Zeus).
+        See: https://github.com/LN-Zap/lndconnect
+
+        Usage:
+        ```bash
+          # Print QR code
+          lndconnect
+
+          # Print URL
+          lndconnect --url
+        ```
+      '';
     };
     onion = mkOption {
       type = types.bool;
       default = false;
-      description = "Expose lndconnect via Tor onion service";
+      description = ''
+        Create an onion service for the lnd REST server,
+        which is used by lndconnect / Zeus.
+      '';
     };
   };
 
-  config = mkIf cfg.enable (mkMerge [
-    (mkIf cfg.lndconnect.enable {
-      environment.systemPackages = [
-        (mkLndconnect {
+  config = mkIf (cfg.enable && cfg.lndconnect.enable) (mkMerge [
+    {
+      environment.systemPackages = [(
+        mkLndconnect {
           name = "lndconnect";
+          # Run as lnd user because the macaroon and cert are not group-readable
+          shebang = "#!/usr/bin/env -S ${runAsUser} ${cfg.user} ${pkgs.bash}/bin/bash";
           enableOnion = cfg.lndconnect.onion;
-          onionService = "${operatorName}/lnd";
+          onionService = "${cfg.user}/lnd-rest";
           port = cfg.restPort;
           certPath = cfg.certPath;
           authSecretPath = "${cfg.networkDir}/admin.macaroon";
-        })
-      ];
-    })
-    (mkIf (cfg.lndconnect.enable && cfg.lndconnect.onion) {
-      services.tor.relay.onionServices.lnd = nbLib.mkOnionService {
-        port = cfg.restPort;
-        target = { addr = nbLib.address cfg.restAddress; port = cfg.restPort; };
+        }
+      )];
+
+      # LAN / clearnet Zeus needs REST on all interfaces. Tor-only stays on
+      # the existing restAddress (loopback) and is reached via lnd-rest.
+      services.lnd.restAddress = mkIf (!cfg.lndconnect.onion) "0.0.0.0";
+    }
+
+    (mkIf cfg.lndconnect.onion {
+      services.tor = {
+        enable = true;
+        # Dedicated name — must not reuse onionServices.lnd (that's P2P :9735).
+        relay.onionServices.lnd-rest = nbLib.mkOnionService {
+          target.addr = nbLib.address cfg.restAddress;
+          target.port = cfg.restPort;
+          port = cfg.restPort;
+        };
+      };
+      nix-bitcoin.onionAddresses.access = {
+        ${cfg.user} = [ "lnd-rest" ];
+        ${operatorName} = [ "lnd-rest" ];
       };
-      nix-bitcoin.onionAddresses.access.${operatorName} = [ "lnd" ];
     })
   ]);
 }