Sovran Systems
2ea1427766
The LND-only rewrite of lndconnect.nix shipped a wrapper Zeus cannot use: unknown flags (--cert/--macaroon), a non-existent onion path (free/lnd.onion), and a REST hidden service that collided with LND's P2P onion. Restore the nix-bitcoin contract — dedicated lnd-rest onion on port 8080, --nocert over Tor, admin macaroon in the URI — and only persist a valid lndconnect:// URI for the Hub QR.
116 lines
3.6 KiB
Nix
116 lines
3.6 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
# LND-only lndconnect wrapper. Restored to the fort-nix/nix-bitcoin contract
|
|
# after the LND-only rewrite shipped a Zeus QR that Zeus cannot use:
|
|
# - unknown flags (--cert / --macaroon instead of --tlscertpath / --adminmacaroonpath)
|
|
# - onion hostname read from /var/lib/tor/onion/free/lnd/hostname (does not exist)
|
|
# - REST hidden service named "lnd", colliding with the LND P2P onion
|
|
# - TLS cert embedded in the URI (localhost CN + QR too dense to scan)
|
|
#
|
|
# Zeus needs: lndconnect://<lnd-rest-onion>:8080?macaroon=<admin> (no cert over Tor)
|
|
|
|
with lib;
|
|
let
|
|
cfg = config.services.lnd;
|
|
operatorName = config.nix-bitcoin.operator.name;
|
|
nbLib = config.nix-bitcoin.lib;
|
|
runAsUser = config.nix-bitcoin.runAsUserCmd;
|
|
|
|
mkLndconnect = {
|
|
name,
|
|
shebang ? "#!${pkgs.stdenv.shell} -e",
|
|
port,
|
|
authSecretPath,
|
|
enableOnion,
|
|
onionService ? null,
|
|
certPath ? null
|
|
}:
|
|
# lndconnect requires a --configfile argument, although it's unused
|
|
# https://github.com/LN-Zap/lndconnect/issues/25
|
|
lib.hiPrio (pkgs.writeScriptBin name ''
|
|
${shebang}
|
|
url=$(
|
|
${getExe pkgs.lndconnect} --url \
|
|
${optionalString enableOnion "--host=$(cat ${config.nix-bitcoin.onionAddresses.dataDir}/${onionService})"} \
|
|
--port=${toString port} \
|
|
${if enableOnion || certPath == null then "--nocert" else "--tlscertpath='${certPath}'"} \
|
|
--adminmacaroonpath='${authSecretPath}' \
|
|
--configfile=/dev/null "$@"
|
|
)
|
|
|
|
# If --url is in args
|
|
if [[ " $* " =~ " --url " ]]; then
|
|
echo "$url"
|
|
else
|
|
# UTF-8 QR is smaller than lndconnect's native output
|
|
echo -n "$url" | ${getExe pkgs.qrencode} -t UTF8 -o -
|
|
fi
|
|
'');
|
|
in {
|
|
options.services.lnd.lndconnect = {
|
|
enable = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Add a `lndconnect` binary to the system environment which prints
|
|
connection info for lnd clients (Zeus).
|
|
See: https://github.com/LN-Zap/lndconnect
|
|
|
|
Usage:
|
|
```bash
|
|
# Print QR code
|
|
lndconnect
|
|
|
|
# Print URL
|
|
lndconnect --url
|
|
```
|
|
'';
|
|
};
|
|
onion = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Create an onion service for the lnd REST server,
|
|
which is used by lndconnect / Zeus.
|
|
'';
|
|
};
|
|
};
|
|
|
|
config = mkIf (cfg.enable && cfg.lndconnect.enable) (mkMerge [
|
|
{
|
|
environment.systemPackages = [(
|
|
mkLndconnect {
|
|
name = "lndconnect";
|
|
# Run as lnd user because the macaroon and cert are not group-readable
|
|
shebang = "#!/usr/bin/env -S ${runAsUser} ${cfg.user} ${pkgs.bash}/bin/bash";
|
|
enableOnion = cfg.lndconnect.onion;
|
|
onionService = "${cfg.user}/lnd-rest";
|
|
port = cfg.restPort;
|
|
certPath = cfg.certPath;
|
|
authSecretPath = "${cfg.networkDir}/admin.macaroon";
|
|
}
|
|
)];
|
|
|
|
# LAN / clearnet Zeus needs REST on all interfaces. Tor-only stays on
|
|
# the existing restAddress (loopback) and is reached via lnd-rest.
|
|
services.lnd.restAddress = mkIf (!cfg.lndconnect.onion) "0.0.0.0";
|
|
}
|
|
|
|
(mkIf cfg.lndconnect.onion {
|
|
services.tor = {
|
|
enable = true;
|
|
# Dedicated name — must not reuse onionServices.lnd (that's P2P :9735).
|
|
relay.onionServices.lnd-rest = nbLib.mkOnionService {
|
|
target.addr = nbLib.address cfg.restAddress;
|
|
target.port = cfg.restPort;
|
|
port = cfg.restPort;
|
|
};
|
|
};
|
|
nix-bitcoin.onionAddresses.access = {
|
|
${cfg.user} = [ "lnd-rest" ];
|
|
${operatorName} = [ "lnd-rest" ];
|
|
};
|
|
})
|
|
]);
|
|
}
|