From f1f0bf0d11be6c593b59a7a7b032496cecc80439 Mon Sep 17 00:00:00 2001
From: Sovran Systems <dev@sovransystems.com>
Date: Sun, 18 Oct 2026 22:12:51 +0000
Subject: [PATCH] fix(bitcoin): expand btcpayserver RPC whitelist for NBXplorer

- Ensure services.bitcoind.rpc.users.btcpayserver.rpcwhitelist includes
  public.rpcwhitelist and NBXplorer capability-scan/wallet RPC methods
  (validateaddress, testmempoolaccept, signrawtransactionwithkey,
  signrawtransactionwithwallet, getblockfrompeer, generatetoaddress,
  getindexinfo, createwallet, loadwallet, importdescriptors, etc.).
---
 modules/sovran-bitcoin-integration.nix | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/modules/sovran-bitcoin-integration.nix b/modules/sovran-bitcoin-integration.nix
index 9fae6bc..f30caea 100644
--- a/modules/sovran-bitcoin-integration.nix
+++ b/modules/sovran-bitcoin-integration.nix
@@ -55,13 +55,34 @@ in {
   };
 
   # ── 2. Second_Drive data paths (OS-specific) ──────────────────
-  services.bitcoind = lib.mkIf cfg.services.bitcoin {
+  services.bitcoind = lib.mkIf cfg.services.bitcoin ({
     dataDir = "/run/media/Second_Drive/BTCEcoandBackup/Bitcoin_Node";
     # The OS always enables the bitcoind wallet — the Hub and BTCPay need it.
     disablewallet = lib.mkForce false;
     # electrs 0.12.0 (bindex) requires bitcoind's REST interface (rest=1).
     extraConfig = lib.optionalString (!(options.services.bitcoind ? rest)) "rest=1";
-  };
+  } // lib.optionalAttrs cfg.web.btcpayserver {
+    rpc.users.btcpayserver.rpcwhitelist = lib.mkForce (lib.unique (config.services.bitcoind.rpc.users.public.rpcwhitelist ++ [
+      "setban"
+      "generatetoaddress"
+      "getrpcinfo"
+      "gettransaction"
+      "getwalletinfo"
+      "getnewaddress"
+      "listunspent"
+      "listtransactions"
+      "listreceivedbyaddress"
+      "importmulti"
+      "importdescriptors"
+      "importaddress"
+      "importprivkey"
+      "importpubkey"
+      "rescanblockchain"
+      "createwallet"
+      "loadwallet"
+      "signrawtransactionwithwallet"
+    ]));
+  });
 
   services.electrs = lib.mkIf cfg.services.bitcoin {
     dataDir = "/run/media/Second_Drive/BTCEcoandBackup/Electrs_Data";