feat: add Bitcoin Core Tor IBD gossip control

modules/bitcoinecosystem.nix

@@ -4,6 +4,11 @@ lib.mkIf config.sovran_systemsOS.services.bitcoin {
 
   services.bitcoind = {
     enable = true;
+    # Keep the normal loopback P2P socket available for local clients such as
+    # Bisq. Because `address` defaults to 127.0.0.1 this does not expose a
+    # clearnet or LAN listener. When the existing bitcoind onion service is
+    # enabled, this also creates its Tor-tagged loopback target on port 8334.
+    listen = true;
     package = pkgs.bitcoind;
     dataDir = "/run/media/Second_Drive/BTCEcoandBackup/Bitcoin_Node";
     txindex = true;
@@ -16,7 +21,13 @@ lib.mkIf config.sovran_systemsOS.services.bitcoin {
     '';
   };
 
-  nix-bitcoin.onionServices.bitcoind.enable = true;
+  nix-bitcoin.onionServices.bitcoind = {
+    enable = true;
+    # This is a locally vendored option namespace, not an upstream dependency.
+    # The onion listener remains available to peers that already know it;
+    # advertising its address through Bitcoin peer gossip is opt-in in the Hub.
+    public = config.sovran_systemsOS.features.bitcoin-tor-gossip;
+  };
   nix-bitcoin.onionServices.electrs.enable = true;
   nix-bitcoin.onionServices.rtl.enable = true;
 

modules/core/role-logic.nix

@@ -33,6 +33,7 @@
         haven = lib.mkForce false;
         mempool = lib.mkForce false;
         element-calling = lib.mkForce false;
+        bitcoin-tor-gossip = lib.mkForce false;
         "nwc-wallets" = lib.mkForce false;
       };
 

modules/core/roles.nix

@@ -45,6 +45,7 @@
       haven = lib.mkEnableOption "Haven NOSTR relay";
       mempool = lib.mkEnableOption "Bitcoin Mempool Explorer";
       element-calling = lib.mkEnableOption "Element Video and Audio Calling";
+      bitcoin-tor-gossip = lib.mkEnableOption "Advertise the Bitcoin Core onion service through Bitcoin peer gossip";
       # Compatibility shim for Hub-managed settings from releases where Core
       # was an optional replacement for the default node. Core is now always
       # selected when the Bitcoin service is enabled.

modules/core/sovran-hub.nix

@@ -40,7 +40,7 @@ let
     # ── Bitcoin Base ────────────────────────────────────────────
     ++ lib.optionals cfg.services.bitcoin [
       { name = "Bitcoin Core"; unit = "bitcoind.service"; type = "system"; icon = "bitcoin-core"; enabled = cfg.services.bitcoin; category = "bitcoin-base"; credentials = [
-        { label = "Tor Address — Access from anywhere via Tor Browser"; file = "/var/lib/tor/onion/bitcoind/hostname"; prefix = "http://"; }
+        { label = "Tor Bitcoin P2P Address — Reachable only through Tor"; file = "/var/lib/tor/onion/bitcoind/hostname"; suffix = ":8333"; }
       ]; }
     ]
     # ── Bitcoin Apps (services on top of the node) ─────────────
@@ -122,6 +122,9 @@ let
       role             = activeRole;
       services         = monitoredServices;
       feature_manager  = true;
+      feature_states   = {
+        bitcoin-tor-gossip = cfg.features.bitcoin-tor-gossip;
+      };
       sovran_version   = sovranVersion;
     });