107 lines
2.3 KiB
Nix
107 lines
2.3 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
{
|
|
sops.secrets."bitcoin/lnd-rpc-password" = {
|
|
owner = "lnd";
|
|
group = "lnd";
|
|
mode = "0400";
|
|
};
|
|
|
|
users.groups.lnd = { };
|
|
|
|
users.users.lnd = {
|
|
isSystemUser = true;
|
|
group = "lnd";
|
|
extraGroups = [ "tor" ];
|
|
};
|
|
|
|
sops.templates."lnd.conf" = {
|
|
owner = "lnd";
|
|
group = "lnd";
|
|
mode = "0400";
|
|
content = ''
|
|
[Application Options]
|
|
debuglevel=info
|
|
datadir=/var/lib/lnd
|
|
logdir=/var/lib/lnd/logs
|
|
|
|
alias=TobServer
|
|
color=#3399ff
|
|
|
|
listen=127.0.0.1:9735
|
|
rpclisten=127.0.0.1:10009
|
|
restlisten=127.0.0.1:8080
|
|
|
|
tlsextraip=127.0.0.1
|
|
tlsextradomain=localhost
|
|
|
|
[Bitcoin]
|
|
bitcoin.mainnet=true
|
|
bitcoin.node=bitcoind
|
|
|
|
[Bitcoind]
|
|
bitcoind.rpchost=127.0.0.1:8332
|
|
bitcoind.rpcuser=lnd
|
|
bitcoind.rpcpass=${config.sops.placeholder."bitcoin/lnd-rpc-password"}
|
|
bitcoind.zmqpubrawblock=tcp://127.0.0.1:28332
|
|
bitcoind.zmqpubrawtx=tcp://127.0.0.1:28333
|
|
bitcoind.estimatemode=ECONOMICAL
|
|
|
|
[tor]
|
|
tor.active=true
|
|
tor.socks=127.0.0.1:9050
|
|
tor.control=127.0.0.1:9051
|
|
tor.v3=true
|
|
tor.streamisolation=true
|
|
tor.targetipaddress=127.0.0.1
|
|
'';
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/lib/lnd 0700 lnd lnd - -"
|
|
];
|
|
|
|
systemd.services.lnd = {
|
|
description = "Lightning Network Daemon";
|
|
after = [
|
|
"network-online.target"
|
|
"tor.service"
|
|
"bitcoind-mainnet.service"
|
|
];
|
|
wants = [
|
|
"network-online.target"
|
|
"tor.service"
|
|
"bitcoind-mainnet.service"
|
|
];
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
serviceConfig = {
|
|
User = "lnd";
|
|
Group = "lnd";
|
|
Type = "simple";
|
|
|
|
WorkingDirectory = "/var/lib/lnd";
|
|
ExecStart = "${pkgs.lnd}/bin/lnd --lnddir=/var/lib/lnd --configfile=${config.sops.templates."lnd.conf".path}";
|
|
|
|
Restart = "on-failure";
|
|
RestartSec = "10s";
|
|
|
|
StateDirectory = "lnd";
|
|
StateDirectoryMode = "0700";
|
|
|
|
NoNewPrivileges = true;
|
|
PrivateTmp = true;
|
|
ProtectSystem = "strict";
|
|
ProtectHome = true;
|
|
ReadWritePaths = [ "/var/lib/lnd" ];
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = [
|
|
(pkgs.writeShellScriptBin "lncli" ''
|
|
exec /run/wrappers/bin/sudo -u lnd ${pkgs.lnd}/bin/lncli \
|
|
--lnddir=/var/lib/lnd \
|
|
"$@"
|
|
'')
|
|
];
|
|
}
|