refactor: extract bitcoin stack into Sovran_Bitcoin flake input

Decouple the Bitcoin/Lightning modules and packages into the standalone
Sovran_Bitcoin flake, consumed as a NixOS module input.

Deleted (now in Sovran_Bitcoin):
  - modules/bitcoin/          (19 files — vendored nix-bitcoin modules)
  - modules/bitcoinecosystem.nix
  - modules/nwc-wallets.nix
  - modules/mempool.nix
  - packages/{albyhub,mempool,rtl,build-support}/
  - tests/bitcoin-btcpay-hardening.nix

Created:
  - modules/sovran-bitcoin-integration.nix — the OS-specific bridge that
    maps sovran_systemsOS.* options to sovran-bitcoin.* and applies
    Second_Drive paths, operator 'free', forced wallet, firewall 3051,
    and Sovran Hub NWC environment wiring.

Modified:
  - flake.nix — added sovran-bitcoin flake input, updated module imports
  - modules/modules.nix — removed deleted imports
  - modules/core/sovran-hub.nix — version metadata now reads from
    pkgs.sovran-bitcoin.* overlay instead of local packages/
  - tests/test_bitcoin_tor_gossip.py — updated to check integration layer

The sovran_systemsOS.* option namespace is preserved. The Hub, roles,
and custom.nix continue to work unchanged.

tests/bitcoin-btcpay-hardening.nix

@@ -1,146 +0,0 @@
-{ nixpkgs, overlay-stable, system ? "x86_64-linux" }:
-
-let
-  lib = nixpkgs.lib;
-  pkgs = import nixpkgs {
-    inherit system;
-    overlays = [ overlay-stable ];
-  };
-
-  normalize = s:
-    lib.replaceStrings [ "\n" "\\" "  " ] [ " " "" " " ] s;
-
-  extractAfter = prefix: str:
-    let
-      match = builtins.match ".*${prefix} ([^ ]+).*" (normalize str);
-    in
-      if match == null then
-        throw "Unable to extract ${prefix} from: ${normalize str}"
-      else
-        builtins.head match;
-
-  extractFlagValue = flag: str:
-    let
-      match = builtins.match ".*${flag}=([^ ]+).*" (normalize str);
-    in
-      if match == null then
-        throw "Unable to extract ${flag} from: ${normalize str}"
-      else
-        builtins.head match;
-
-  config = (lib.nixosSystem {
-    inherit system;
-    modules = [
-      { nixpkgs.hostPlatform = system; nixpkgs.overlays = [ overlay-stable ]; }
-      ../modules/bitcoin
-      {
-        nix-bitcoin.generateSecrets = true;
-        nix-bitcoin.secretsDir = "/build/secrets";
-
-        services.btcpayserver.enable = true;
-        services.btcpayserver.lightningBackend = "lnd";
-        services.nbxplorer.dataDir = "/build/nbxplorer";
-        services.btcpayserver.dataDir = "/build/btcpayserver";
-        services.lnd.dataDir = "/build/lnd";
-        services.bitcoind.dataDir = "/build/bitcoind";
-      }
-    ];
-  }).config;
-
-  nbxplorerPreStart = config.systemd.services.nbxplorer.preStart;
-  bitcoindPreStart = config.systemd.services.bitcoind.preStart;
-  btcpayExecStart = config.systemd.services.btcpayserver.serviceConfig.ExecStart;
-  btcpayWorkingDir = config.systemd.services.btcpayserver.serviceConfig.WorkingDirectory;
-
-  nbxplorerConfigPath = extractAfter "install -m 600" nbxplorerPreStart;
-  btcpayConfigPath = extractFlagValue "--conf" btcpayExecStart;
-
-  nbxplorerConfig = builtins.readFile nbxplorerConfigPath;
-  btcpayConfig = builtins.readFile btcpayConfigPath;
-in
-assert lib.assertMsg
-  (config.users.users.${config.services.btcpayserver.user}.home == config.services.btcpayserver.dataDir)
-  "btcpayserver user home must match btcpayserver dataDir";
-assert lib.assertMsg
-  (config.users.users.${config.services.nbxplorer.user}.home == config.services.nbxplorer.dataDir)
-  "nbxplorer user home must match nbxplorer dataDir";
-assert lib.assertMsg
-  (config.nix-bitcoin.secrets.bitcoin-HMAC-btcpayserver.user == config.services.bitcoind.user)
-  "bitcoin-HMAC-btcpayserver must be owned by bitcoind";
-assert lib.assertMsg
-  (config.nix-bitcoin.secrets.bitcoin-rpcpassword-btcpayserver.user == config.services.bitcoind.user)
-  "bitcoin-rpcpassword-btcpayserver must be owned by bitcoind";
-assert lib.assertMsg
-  (config.nix-bitcoin.secrets.bitcoin-rpcpassword-btcpayserver.group == config.services.nbxplorer.group)
-  "bitcoin-rpcpassword-btcpayserver must be group-readable by nbxplorer";
-assert lib.assertMsg
-  (!(lib.elem config.services.nbxplorer.group config.users.users.${config.services.btcpayserver.user}.extraGroups))
-  "btcpayserver must not receive the nbxplorer group";
-assert lib.assertMsg
-  (lib.elem "nix-bitcoin-secrets.target" config.systemd.services.nbxplorer.after)
-  "nbxplorer must wait for nix-bitcoin-secrets.target";
-assert lib.assertMsg
-  (config.systemd.services.nbxplorer.serviceConfig.MemoryDenyWriteExecute == false)
-  "nbxplorer needs MemoryDenyWriteExecute = false";
-assert lib.assertMsg
-  (config.systemd.services.btcpayserver.serviceConfig.MemoryDenyWriteExecute == false)
-  "btcpayserver needs MemoryDenyWriteExecute = false";
-assert lib.assertMsg
-  (lib.hasInfix "network=mainnet" nbxplorerConfig
-    && lib.hasInfix "btcrpcuser=btcpayserver" nbxplorerConfig
-    && lib.hasInfix "btcnodeendpoint=127.0.0.1:8335" nbxplorerConfig
-    && lib.hasInfix "bind=127.0.0.1" nbxplorerConfig
-    && lib.hasInfix "port=24444" nbxplorerConfig
-    && lib.hasInfix "postgres=User ID=nbxplorer;Host=/run/postgresql;Database=nbxplorer" nbxplorerConfig)
-  "nbxplorer base config must contain the expected non-secret settings";
-assert lib.assertMsg
-  (lib.hasInfix "btcexplorerurl=http://127.0.0.1:24444/" btcpayConfig
-    && lib.hasInfix "btcexplorercookiefile=/build/nbxplorer/Main/.cookie" btcpayConfig)
-  "btcpayserver config must contain btcexplorerurl and btcexplorercookiefile";
-assert lib.assertMsg
-  (lib.hasSuffix "/lib/btcpayserver" btcpayWorkingDir)
-  "btcpayserver WorkingDirectory must end with /lib/btcpayserver";
-assert lib.assertMsg
-  (!lib.hasInfix "/build/btcpayserver/settings.config" btcpayExecStart
-    && lib.hasInfix "--datadir='/build/btcpayserver'" btcpayExecStart)
-  "btcpayserver must use a deterministic config file plus --datadir";
-assert lib.assertMsg
-  (lib.hasInfix "network=mainnet" btcpayConfig
-    && lib.hasInfix "bind=127.0.0.1" btcpayConfig
-    && lib.hasInfix "port=23000" btcpayConfig
-    && lib.hasInfix "btcexplorerurl=http://127.0.0.1:24444/" btcpayConfig
-    && lib.hasInfix "explorer.postgres=User ID=nbxplorer;Host=/run/postgresql;Database=nbxplorer" btcpayConfig
-    && lib.hasInfix "postgres=User ID=btcpayserver;Host=/run/postgresql;Database=btcpayserver" btcpayConfig
-    && lib.hasInfix "btclightning=type=lnd-rest;server=https://127.0.0.1:8080/;macaroonfilepath=/run/lnd/btcpayserver.macaroon;certfilepath=/build/secrets/lnd-cert" btcpayConfig)
-  "btcpayserver config must preserve BTCPay, NBXplorer, database, and LND settings";
-assert lib.assertMsg
-  (lib.hasInfix "readValidatedRpcHmac()" bitcoindPreStart
-    && lib.hasInfix ''if [[ ! -e "$hmacFile" ]]; then'' bitcoindPreStart
-    && lib.hasInfix ''if [[ ! -r "$hmacFile" ]]; then'' bitcoindPreStart
-    && lib.hasInfix ''if [[ -z "$hmacPayload" ]]; then'' bitcoindPreStart
-    && lib.hasInfix ''^[[:xdigit:]]+\$[[:xdigit:]]+$'' bitcoindPreStart
-    && lib.hasInfix ''Bitcoin RPC HMAC file has invalid format'' bitcoindPreStart
-    && lib.hasInfix ''hmacPayload="$(readValidatedRpcHmac '/build/secrets/bitcoin-HMAC-btcpayserver')" || exit 1'' bitcoindPreStart)
-  "bitcoind preStart must validate missing, unreadable, empty, and malformed HMAC files";
-pkgs.runCommand "bitcoin-btcpay-hardening" {} ''
-  mkdir -p /build/secrets /build/nbxplorer
-
-  printf '%s' 'first-password' > /build/secrets/bitcoin-rpcpassword-btcpayserver
-  bash -euo pipefail -c ${lib.escapeShellArg nbxplorerPreStart}
-
-  test "$(stat -c '%a' /build/nbxplorer/settings.config)" = "600"
-  test "$(grep -c '^btcrpcuser=' /build/nbxplorer/settings.config)" = "1"
-  test "$(grep -c '^btcrpcpassword=' /build/nbxplorer/settings.config)" = "1"
-  test "$(grep -c '^postgres=' /build/nbxplorer/settings.config)" = "1"
-
-  printf '%s' 'rotated-password' > /build/secrets/bitcoin-rpcpassword-btcpayserver
-  bash -euo pipefail -c ${lib.escapeShellArg nbxplorerPreStart}
-
-  test "$(grep -c '^btcrpcuser=' /build/nbxplorer/settings.config)" = "1"
-  test "$(grep -c '^btcrpcpassword=' /build/nbxplorer/settings.config)" = "1"
-  test "$(grep -c '^postgres=' /build/nbxplorer/settings.config)" = "1"
-  ! grep -q 'first-password' /build/nbxplorer/settings.config
-  grep -q 'rotated-password' /build/nbxplorer/settings.config
-
-  touch "$out"
-''

tests/test_bitcoin_tor_gossip.py

@@ -27,17 +27,12 @@ def _literal_assignment(source: str, name: str):
 
 
 class TestBitcoinTorGossipNixWiring(unittest.TestCase):
-    def test_bitcoind_loopback_listener_is_always_enabled(self):
-        ecosystem = _read("modules", "bitcoinecosystem.nix")
-        self.assertIn("listen = true;", ecosystem)
-        self.assertIn("peerbloomfilters=1", ecosystem)
-
-    def test_gossip_is_opt_in(self):
-        ecosystem = _read("modules", "bitcoinecosystem.nix")
-        self.assertIn(
-            "public = config.sovran_systemsOS.features.bitcoin-tor-gossip;",
-            ecosystem,
-        )
+    def test_integration_layer_maps_tor_gossip_option(self):
+        """The integration layer must bridge sovran_systemsOS.features.bitcoin-tor-gossip
+        to sovran-bitcoin.bitcoindTorGossip."""
+        integration = _read("modules", "sovran-bitcoin-integration.nix")
+        self.assertIn("bitcoindTorGossip", integration)
+        self.assertIn("bitcoin-tor-gossip", integration)
 
     def test_hub_option_and_evaluated_state_are_declared(self):
         roles = _read("modules", "core", "roles.nix")

tests/test_security.py

@@ -333,33 +333,6 @@ class TestSshPubkeyValidation(unittest.TestCase):
             _validate_ssh_pubkey("ssh-ed25519")
 
 
-# ---------------------------------------------------------------------------
-# LND macaroon command-line safety
-# ---------------------------------------------------------------------------
-
-class TestLndMacaroonCommandLineSafety(unittest.TestCase):
-    """The LND admin macaroon must never be exposed in curl's argv."""
-
-    @classmethod
-    def setUpClass(cls):
-        path = os.path.join(_REPO_ROOT, "modules", "bitcoin", "lnd.nix")
-        with open(path, encoding="utf-8") as f:
-            cls.lnd_module = f.read()
-
-    def test_admin_macaroon_not_interpolated_into_header_argument(self):
-        self.assertNotIn(
-            '-H "Grpc-Metadata-macaroon: $(',
-            self.lnd_module,
-        )
-
-    def test_admin_macaroon_header_is_passed_via_file_descriptor(self):
-        self.assertIn("adminMacaroonHex=$(", self.lnd_module)
-        self.assertIn(
-            """-H @<(printf 'Grpc-Metadata-macaroon: %s\\n' "$adminMacaroonHex")""",
-            self.lnd_module,
-        )
-
-
 # ---------------------------------------------------------------------------
 # Auth-exempt paths
 # ---------------------------------------------------------------------------

tests/test_zeus_connect.py

@@ -1,8 +1,8 @@
 """Regression tests for the Hub Zeus Connect QR.
 
-The LND-only rewrite of modules/bitcoin/lndconnect.nix shipped a wrapper
-that Zeus cannot use. These tests lock the contract the Hub QR depends on
-without needing lnd / tor / qrencode at test time.
+The Zeus Connect setup service (modules/wallet-autoconnect.nix) and the Hub QR
+encoding are tested here.  The lndconnect wrapper itself is now part of the
+Sovran_Bitcoin flake — its contract tests live in that repository.
 """
 
 import os
@@ -17,41 +17,6 @@ def _read(relpath: str) -> str:
         return fh.read()
 
 
-class TestLndconnectWrapper(unittest.TestCase):
-    """The system `lndconnect` wrapper must emit a Zeus-scannable URI."""
-
-    @classmethod
-    def setUpClass(cls):
-        cls.src = _read("modules/bitcoin/lndconnect.nix")
-
-    def test_uses_official_lndconnect_flags(self):
-        self.assertIn("--adminmacaroonpath=", self.src)
-        self.assertIn("--configfile=/dev/null", self.src)
-        self.assertIn("--nocert", self.src)
-        self.assertIn("--tlscertpath=", self.src)
-
-    def test_does_not_pass_unknown_short_flags(self):
-        # The broken rewrite called `lndconnect --cert … --macaroon …`.
-        # Those flags do not exist; Zeus then never got a valid URI.
-        self.assertIsNone(re.search(r"--cert=", self.src))
-        self.assertIsNone(re.search(r"--macaroon=", self.src))
-
-    def test_uses_dedicated_lnd_rest_onion(self):
-        self.assertIn("lnd-rest", self.src)
-        self.assertIn('onionServices.lnd-rest', self.src)
-        # Must not collide with the LND P2P onion named `lnd`.
-        self.assertNotIn("onionServices.lnd =", self.src)
-        self.assertNotIn('onionService = "${operatorName}/lnd"', self.src)
-
-    def test_reads_onion_from_onion_addresses_dir(self):
-        self.assertIn("onionAddresses.dataDir", self.src)
-        self.assertNotIn("/var/lib/tor/onion/${onionService}/hostname", self.src)
-
-    def test_omits_tls_cert_over_tor(self):
-        # Onion host + embedded localhost cert = Zeus rejects the QR.
-        self.assertIn('then "--nocert"', self.src)
-
-
 class TestZeusConnectSetup(unittest.TestCase):
     """zeus-connect-setup must wait for the REST onion and validate the URI."""