Commit Graph
2215 Commits
Author SHA1 Message Date
425a1845b4 chore: clean mempool module comment typo
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
2026-08-10 15:07:42 +00:00
546dacf396 vendor mempool packages and wire mempool module to vendored pkgs
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
2026-08-10 15:06:50 +00:00
copilot-swe-agent[bot]andGitHub 17c0db8290 Initial plan 2026-08-10 15:03:18 +00:00
Sovran SystemsandGitHub dac733de9a Refactor onion service configuration for LND 2026-08-10 09:55:59 -05:00
Sovran SystemsandGitHub 3baf504c60 Fix typo in onion-addresses service check 2026-08-10 09:52:55 -05:00
Sovran Systems f220b93b12 Add missing bitcoind-rpc-public-whitelist.nix
This file is imported by bitcoind.nix line 375 but was missing from the repo.
Vendored from nix-bitcoin to make the module self-contained.
2026-08-10 09:45:23 -05:00
Sovran SystemsandGitHub b2a5233653 Merge pull request #407 from naturallaw777/copilot/fixnix-bitcoin-vendoring
Complete nix-bitcoin vendoring for fully self-contained Bitcoin modules
2026-08-10 09:41:26 -05:00
copilot-swe-agent[bot]andGitHub 2bb5c50196 Initial plan 2026-08-10 14:30:27 +00:00
Sovran SystemsandGitHub 80c4b052a0 Merge pull request #406 from naturallaw777/fix/onion-services-remove-joinmarket-ob-watcher
Remove joinmarket-ob-watcher from onion-services defaults
2026-08-10 09:15:26 -05:00
Sovran Systems 2accada021 Remove joinmarket-ob-watcher from onion-services defaults
The joinmarket-ob-watcher module was not imported from nix-bitcoin,
so referencing it in the onion-services defaults caused an
"attribute 'joinmarket-ob-watcher' missing" evaluation error.
2026-08-10 09:13:33 -05:00
Sovran SystemsandGitHub a6296b9473 Fix formatting of extraGroups in btcpayserver.nix 2026-08-10 08:55:12 -05:00
Sovran SystemsandGitHub 5173fb3df6 Merge pull request #404 from naturallaw777/fix/syntax-final
fix: add missing semicolon after extraGroups in btcpayserver.nix
2026-08-10 08:53:36 -05:00
Syntax Fixandnaturallaw777 147afcc4ac fix: add missing semicolon after extraGroups in btcpayserver.nix
- Previous lnd-only refactor removed the '++ optional clightning' line
  but left 'extraGroups = [ cfg.nbxplorer.group ]' without trailing ';'
  -> syntax error: unexpected '=', expecting ';' at home = ...
- Add ';' to fix build on both f13ff45 and 8b8c811
2026-08-10 08:51:39 -05:00
Sovran SystemsandGitHub 2e35539ae6 Merge pull request #403 from naturallaw777/tailor/lnd-only-final
tailor: make bitcoin modules truly Sovran-only (lnd-only) and delete …
2026-08-10 08:40:08 -05:00
Sovran Tailorandnaturallaw777 31cd5f96f2 tailor: make bitcoin modules truly Sovran-only (lnd-only) and delete stubs.nix
- lndconnect.nix: rewrite to lnd-only (320 lines removed) - remove
  services.clightning.plugins.clnrest.lnconnect and
  services.clightning-rest.lndconnect (Sovran only uses services.lnd.lndconnect for Zeus)
  Fixes: 'services.clightning.plugins.clnrest.address does not exist' on f13ff45
  and 'attribute enable missing' at lndconnect.nix:216

- btcpayserver.nix: remove liquidd (lbtc) dead branch - Sovran uses lbtc=false
  * remove inherit (config.services) bitcoind liquidd -> just bitcoind
  * lbtc chains/rpc handling is dead code, keep guards but no need for liquidd service

- mempool.nix: remove fulcrum branch - Sovran uses electrs only
- rtl.nix: remove lightning-loop block and clightning service block (lnd only)
- Delete modules/bitcoin/stubs.nix entirely - no dead service references left
  * liquidd, fulcrum, lightning-loop, joinmarket now not referenced at all
  * clightning already handled via guards, not stubs
- Result: modules/bitcoin/ is now 100% tailored to Sovran (bitcoind+knots, lnd, electrs, rtl, btcpayserver, mempool)
  No more stubs whack-a-mole on any nixos-unstable
2026-08-10 08:37:29 -05:00
Sovran SystemsandGitHub 90262e672e Merge pull request #402 from naturallaw777/refactor/clean-bitcoin
refactor: move vendor/nix-bitcoin to modules/bitcoin, remove overlays
2026-08-10 08:24:07 -05:00
Sovran Cleanandnaturallaw777 1fbeafd02f refactor: move vendor/nix-bitcoin to modules/bitcoin, remove overlays
- Move modules/vendor/nix-bitcoin/* -> modules/bitcoin/* (clean, Sovran-owned)
  * modules/bitcoin/default.nix imports the 6 tailored services
  * modules/bitcoin/common.nix bundles secrets/onion/lib
  * modules/bitcoin/stubs.nix kept minimal (no clightning)
  * packages/lndinit/default.nix replaces pkgs/sovran-overlay.nix
    (lnd.nix now uses pkgs.callPackage ../../packages/lndinit {})
- Remove pkgs/sovran-overlay.nix, pkgs/nbxplorer.nix, pkgs/README.md
  * No global overlay - lndinit is a normal package in packages/
- Remove modules/vendor/ entirely
- Update flake.nix: drop overlay-sovran, import ./modules/bitcoin
  instead of ./modules/vendor/nix-bitcoin/modules.nix
- No more random vendor/ or pkgs/ dirs - follows Sovran convention:
  modules/ for NixOS modules, packages/ for packages
2026-08-10 08:20:40 -05:00
Sovran SystemsandGitHub 953cedce3f Merge pull request #401 from naturallaw777/fix/final-btcpayserver
fix: remove services.clightning.enable assignment that fails on f13ff45
2026-08-10 04:45:38 -05:00
Sovran Fixandnaturallaw777 58d7e21d28 fix: remove services.clightning.enable assignment that fails on f13ff45
- f13ff45 HAS services.clightning but only as { plugins = ... }, no enable
  -> 'option does not exist, did you mean plugins' (your error)
- Sovran never uses lightningBackend == clightning (uses lnd),
  so just don't set services.clightning.enable at all
- Also make lnd port conflict check always true for clightning case
- Fixes both f13ff45 (has clightning/plugins) and 8b8c811 (removed)
2026-08-10 04:43:20 -05:00
Sovran SystemsandGitHub 9f7dcfa6de Merge pull request #400 from naturallaw777/fix/final-clightning-both
fix: remove clightning and clightning-rest from stubs to avoid duplic…
2026-08-10 04:35:03 -05:00
Sovran Fixandnaturallaw777 6c2c69d18a fix: remove clightning and clightning-rest from stubs to avoid duplicate on f13ff45
- f13ff45 (staging-dev) HAS both services -> unconditional stubs duplicate
- Remove both from stubs.nix, keep only liquidd/fulcrum/etc.
- lndconnect.nix left as is (defines clightning-rest.lndconnect) - safe on f13ff45 where base exists
- On 8b8c811 where clightning is removed, Sovran doesn't use it anyway (lnd only), so guards in btcpayserver/lnd prevent use
2026-08-10 04:31:23 -05:00
Sovran SystemsandGitHub 6b9c68e3b2 Merge pull request #399 from naturallaw777/fix/nixpkgs-unstable-clightning-2026-08
fix: add stubs for nixpkgs-unstable 2026-08 where services.clightning…
2026-08-09 21:23:01 -05:00
Sovran Fixandnaturallaw777 4b511348ae fix: add stubs for nixpkgs-unstable 2026-08 where services.clightning removed
nixpkgs 8b8c811 (2026-08-08) removed services.clightning.enable,
causing btcpayserver.nix:124 to throw 'option does not exist' on
nixos-rebuild (your error). Sovran uses lnd only, never clightning,
but evaluation still throws.

- Add modules/vendor/nix-bitcoin/stubs.nix to provide missing options
  as false stubs: clightning, clightning-rest, liquidd, fulcrum,
  lightning-loop/pool, joinmarket
- Guard btcpayserver/rtl/lnd/mempool clightning/liquidd references
  with config.services ? X checks
- Trim enable-tor.nix onionServices for removed services
2026-08-09 21:21:19 -05:00
Sovran SystemsandGitHub 81946895db Merge pull request #398 from naturallaw777/vendor/nixpkgs-only
Vendor/nixpkgs only
2026-08-09 20:24:11 -05:00
naturallaw777 a10ef95b5c chore: nix flake update - drop nix-bitcoin 2026-08-09 20:19:35 -05:00
Sovran PR Botandnaturallaw777 278d480653 vendor: replace nix-bitcoin flake input with minimal vendored modules (nixpkgs-only)
- Remove inputs.nix-bitcoin (fort-nix/nix-bitcoin/release) from flake.nix
- Vendor only 6 services actually used by Sovran: bitcoind, electrs,
  lnd (+lndconnect), rtl, btcpayserver, mempool + supporting infra:
  secrets, onion-services/addresses, operator, nodeinfo, security,
  versioning
- All packages now from nixpkgs directly (pkgs.*) — no pinned pkgs
- Keep nix-bitcoin.* option namespace for compatibility
- backups.nix removed: Sovran uses rsnapshot to Second_Drive
  (configuration.nix: hourly/daily to BTCEcoandBackup) — duplicity
  remote backup not needed
- netns-isolation.nix replaced with stub (5 lines): original 365-line
  bridge/iptables/ip-netns broke Caddy/AlbyHub/RTL a year ago and
  is incompatible with nwc-wallets (requires enable=false). Stub
  keeps option valid but warns if enabled.
- Add pkgs/sovran-overlay.nix for gaps only: lndinit + netns-exec stub
2026-08-09 20:16:34 -05:00
naturallaw777 b64061135a fix(scripts): keep ISO artifacts out of the repo and auto-update README on release 2026-08-07 18:31:20 -05:00
Sovran SystemsandGitHub 825c3fbb4b Remove duplicate 1.0.6 release notes from CHANGELOG
Remove duplicate version 1.0.6 details from CHANGELOG.md.
2026-08-07 16:17:24 -05:00
naturallaw777 8b169a04e3 chore: release v1.0.6 v1.0.6 2026-08-07 16:11:59 -05:00
naturallaw777 d0c2ea933c docs: update CHANGELOG.md for v1.0.6 2026-08-07 16:03:21 -05:00
naturallaw777 b66c50c195 fix(scripts): resolve tag range detection and improve release diagnostics 2026-08-07 16:02:09 -05:00
naturallaw777 1737e6c7d8 fix(scripts): add token scope diagnostics and un-silence gh release errors 2026-08-07 15:59:22 -05:00
naturallaw777 782b279e0a docs: update CHANGELOG.md for v1.0.6 2026-08-07 15:55:26 -05:00
naturallaw777 564e9835ea chore: bump VERSION to v1.0.6 for ISO naming 2026-08-07 15:55:26 -05:00
Sovran SystemsandGitHub 3b8f809e7c Merge pull request #397 from naturallaw777/fix/security-error-hardening
fix: harden error handling and sanitize exception details across secu…
2026-08-07 15:38:49 -05:00
naturallaw777 9df52256d4 fix: harden error handling and sanitize exception details across security endpoints (CWE-209) 2026-08-07 15:36:44 -05:00
Sovran SystemsandGitHub de481db97c Merge pull request #396 from naturallaw777/fix/exception-exposure-5351
fix: sanitize exception handling in verify-integrity and security-res…
2026-08-07 15:00:10 -05:00
naturallaw777 9051aed737 fix: sanitize exception handling in verify-integrity and security-reset (CWE-209) 2026-08-07 14:58:24 -05:00
Sovran SystemsandGitHub 65376ec8fb Merge pull request #395 from naturallaw777/fix/exception-exposure-5252
fix: sanitize api_security_reset errors to prevent exception informat…
2026-08-07 14:40:08 -05:00
naturallaw777 899f570ded fix: sanitize api_security_reset errors to prevent exception information exposure (CWE-209) 2026-08-07 14:31:38 -05:00
Sovran SystemsandGitHub d3b41b14fb Merge pull request #394 from naturallaw777/fix/path-injection-4338
fix: pass sanitized abs_path to os.chown to resolve CodeQL path injec…
2026-08-07 14:23:57 -05:00
naturallaw777 56db634900 fix: use canonical prefix containment check for CodeQL path-injection 2026-08-07 14:22:44 -05:00
naturallaw777 3522270373 fix: pass sanitized abs_path to os.chown to resolve CodeQL path injection at 4338 2026-08-07 14:17:34 -05:00
Sovran SystemsandGitHub efda70c187 Merge pull request #393 from naturallaw777/fix/path-injection-4334-4532
fix: add CodeQL-recognized path sanitization for domain_name
2026-08-07 13:51:28 -05:00
a32b353eda fix: resolve merge conflict with origin/main in server.py
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
2026-08-07 18:50:01 +00:00
naturallaw777 4555764d87 fix: add CodeQL-recognized path sanitization for domain_name 2026-08-07 13:44:26 -05:00
Sovran SystemsandGitHub c38d4be851 Merge pull request #392 from naturallaw777/fix/path-injection-4334-4532
fix: add CodeQL-recognized path sanitization for domain_name
2026-08-07 13:36:03 -05:00
naturallaw777 5130076400 fix: add CodeQL-recognized path sanitization for domain_name 2026-08-07 13:33:55 -05:00
Sovran SystemsandGitHub 1dbbd6a943 Merge pull request #391 from naturallaw777/fix/njalla-sentinel-4371
fix: remove domain substring check for CodeQL incomplete-url
2026-08-07 13:28:14 -05:00
naturallaw777 f0a640519d fix: remove domain substring check for CodeQL incomplete-url 2026-08-07 13:26:41 -05:00