Initial commit

modules/mempool.nix

@@ -0,0 +1,182 @@
+{ config, pkgs, lib, ...}:
+{
+  virtualisation.oci-containers = {
+    backend = "podman";
+
+    containers = {
+      mempool-db = {
+        image = "mariadb:11";
+        autoStart = true;
+        environment = {
+          MARIADB_DATABASE = "mempool";
+          MARIADB_USER = "mempool";
+          MARIADB_PASSWORD = "mempool";
+          MARIADB_ROOT_PASSWORD = "root";
+        };
+        volumes = [
+          "/srv/mempool/mysql:/var/lib/mysql"
+        ];
+      };
+
+      mempool-backend = {
+        image = "mempool/backend:latest";
+        autoStart = true;
+        dependsOn = [ "mempool-db" ];
+        ports = [ "127.0.0.1:8999:8999" ];
+        extraOptions = [
+          "--add-host=host.containers.internal:host-gateway"
+        ];
+        environment = {
+          MEMPOOL_NETWORK = "mainnet";
+          MEMPOOL_BACKEND = "electrum";
+          MEMPOOL_HTTP_PORT = "8999";
+
+          ELECTRUM_HOST = "host.containers.internal";
+          ELECTRUM_PORT = "50001";
+          ELECTRUM_TLS_ENABLED = "false";
+
+          CORE_RPC_HOST = "host.containers.internal";
+          CORE_RPC_PORT = "8332";
+
+          CORE_RPC_COOKIE = "true";
+          CORE_RPC_COOKIE_PATH = "/bitcoin/.cookie";
+
+          DATABASE_ENABLED = "true";
+          DATABASE_HOST = "mempool-db";
+          DATABASE_PORT = "3306";
+          DATABASE_DATABASE = "mempool";
+          DATABASE_USERNAME = "mempool";
+          DATABASE_PASSWORD = "mempool";
+
+          STATISTICS_ENABLED = "true";
+        };
+       volumes = [
+         "/run/mempool/bitcoind.cookie:/bitcoin/.cookie:ro"
+       ];
+      };
+
+      mempool-frontend = {
+        image = "mempool/frontend:latest";
+        autoStart = true;
+        ports = [ "127.0.0.1:8998:8080" ];
+        environment = {
+          NGINX_HOSTNAME = "mempool.tobiasostner.de";
+          NGINX_PORT = "443";
+          NGINX_PROTOCOL = "https";
+        };
+      };
+    };
+  };
+
+  systemd.tmpfiles.rules = lib.mkAfter [
+    "d /run/mempool 0755 root root - -"
+  ];
+
+  # Copy cookie once
+  systemd.services.mempool-cookie = {
+    description = "Expose bitcoind cookie for mempool-backend";
+    after = [ "bitcoind-mainnet.service" ];
+    wants = [ "bitcoind-mainnet.service" ];
+
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = pkgs.writeShellScript "mempool-cookie" ''
+        set -euo pipefail
+        for i in $(seq 1 60); do
+          if [ -f /var/lib/bitcoind/.cookie ]; then
+            install -m 0644 -o root -g root /var/lib/bitcoind/.cookie /run/mempool/bitcoind.cookie
+            exit 0
+          fi
+          sleep 1
+        done
+        echo "Cookie not found after 60s" >&2
+        exit 1
+    '';
+    };
+  };
+
+  # Re-run the cookie copy whenever bitcoind rotates the cookie
+  systemd.paths.mempool-cookie = {
+    description = "Watch bitcoind cookie and refresh mempool copy";
+    wantedBy = [ "multi-user.target" ];
+
+    pathConfig = {
+      PathChanged = "/var/lib/bitcoind/.cookie";
+    };
+  };
+
+  # When the path triggers, it starts the service
+  systemd.services.mempool-cookie.wantedBy = lib.mkForce [ ];
+  systemd.paths.mempool-cookie.unitConfig = {
+    Unit = "mempool-cookie.service";
+  };
+
+  systemd.services.podman-mempool-backend = {
+    after = [ "mempool-cookie.service" ];
+    wants = [ "mempool-cookie.service" ];
+  };
+
+  services.nginx = {
+    appendHttpConfig = ''
+      limit_req_zone $binary_remote_addr zone=mempool_api:10m rate=60r/m;
+      limit_conn_zone $binary_remote_addr zone=mempool_ws:10m;
+    '';
+
+    virtualHosts."mempool.tobiasostner.de" = {
+      enableACME = true;
+      forceSSL = true;
+
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8998";
+        extraConfig = ''
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $scheme;
+        '';
+      };
+
+      locations."/api/" = {
+        proxyPass = "http://127.0.0.1:8999";
+        extraConfig = ''
+          limit_req zone=mempool_api burst=30 nodelay;
+
+          proxy_http_version 1.1;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $scheme;
+
+          proxy_connect_timeout 2s;
+          proxy_read_timeout 60s;
+          proxy_send_timeout 60s;
+          proxy_next_upstream error timeout http_502 http_503 http_504;
+          proxy_next_upstream_tries 3;
+          proxy_next_upstream_timeout 10s;
+        '';
+      };
+
+      locations."/api/v1/ws" = {
+        proxyPass = "http://127.0.0.1:8999/api/v1/ws";
+        proxyWebsockets = true;
+        extraConfig = ''
+          limit_conn mempool_ws 3;
+
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $scheme;
+
+          proxy_connect_timeout 2s;
+          proxy_read_timeout 60s;
+          proxy_send_timeout 60s;
+          proxy_next_upstream error timeout http_502 http_503 http_504;
+          proxy_next_upstream_tries 3;
+          proxy_next_upstream_timeout 10s;
+        '';
+      };
+    };
+  };
+
+  networking.firewall.interfaces."podman0".allowedTCPPorts = [ 8332 50001 ];
+}