commit 4fab5e9fe91c7c26c31eb4d936e24737def51508 · pyrox.dev/nixpkgs

+92 -22

nixos/modules/services/networking/fedimintd.nix

···

       49
        
                 openFirewall = mkOption {

     

       50
        
                   type = types.bool;

     

       51
        
                   default = true;

     

       52
       -
                   description = "Opens port in firewall for fedimintd's p2p port";

     

       53
        
                 };

     

       54
        
                 port = mkOption {

     

       55
        
                   type = types.port;

     

       56
        
                   default = 8173;

     

       57
       -
                   description = "Port to bind on for p2p connections from peers";

     

       58
        
                 };

     

       59
        
                 bind = mkOption {

     

       60
        
                   type = types.str;

     

       61
        
                   default = "0.0.0.0";

     

       62
       -
                   description = "Address to bind on for p2p connections from peers";

     

       63
        
                 };

     

       64
        
                 url = mkOption {

     

       65
       -
                   type = types.str;

     

       66
        
                   example = "fedimint://p2p.myfedimint.com:8173";

     

       67
        
                   description = ''

     

       68
       -
                     Public address for p2p connections from peers

     

       69
        
                   '';

     

       70
        
                 };

     

       71
        
               };

     

       72
       -
               api = {

     

       73
        
                 openFirewall = mkOption {

     

       74
        
                   type = types.bool;

     

       75
        
                   default = false;

     

       76
       -
                   description = "Opens port in firewall for fedimintd's api port";

     

       77
        
                 };

     

       78
        
                 port = mkOption {

     

       79
        
                   type = types.port;

     

       80
        
                   default = 8174;

     

       81
       -
                   description = "Port to bind on for API connections relied by the reverse proxy/tls terminator.";

     

       82
        
                 };

     

       83
        
                 bind = mkOption {

     

       84
        
                   type = types.str;

     
···

       86
        
                   description = "Address to bind on for API connections relied by the reverse proxy/tls terminator.";

     

       87
        
                 };

     

       88
        
                 url = mkOption {

     

       89
       -
                   type = types.str;

     

       90
        
                   description = ''

     

       91
        
                     Public URL of the API address of the reverse proxy/tls terminator. Usually starting with `wss://`.

     

       92
        
                   '';

     

       93
        
                 };

     

       94
        
               };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       95
        
               bitcoin = {

     

       96
        
                 network = mkOption {

     

       97
        
                   type = types.str;

     
···

       159
        
                   example = "api.myfedimint.com";

     

       160
        
                   description = "Public domain of the API address of the reverse proxy/tls terminator.";

     

       161
        
                 };

     

       162
       -
                 path = mkOption {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       163
        
                   type = types.str;

     

       164
        
                   example = "/";

     

       165
        
                   default = "/ws/";

     
···

       197
        
             networking.firewall.allowedTCPPorts = concatLists (

     

       198
        
               mapAttrsToList (

     

       199
        
                 fedimintdName: cfg:

     

       200
       -
                 (lib.optional cfg.api.openFirewall cfg.api.port ++ lib.optional cfg.p2p.openFirewall cfg.p2p.port)

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       201
        
               ) eachFedimintd

     

       202
        
             );

     

       203
        
       

     
···

       205
        
               fedimintdName: cfg:

     

       206
        
               (nameValuePair "fedimintd-${fedimintdName}" (

     

       207
        
                 let

     

       208
       -
                   startScript = pkgs.writeShellScript "fedimintd-start" (

     

       209
        
                     (

     

       210
        
                       if cfg.bitcoin.rpc.secretFile != null then

     

       211
        
                         ''

     

       212
       -
                           secret=$(${pkgs.coreutils}/bin/head -n 1 "${cfg.bitcoin.rpc.secretFile}")

     

       213
       -
                           prefix="''${FM_BITCOIN_RPC_URL%*@*}"  # Everything before the last '@'

     

       214
       -
                           suffix="''${FM_BITCOIN_RPC_URL##*@}"  # Everything after the last '@'

     

       215
       -
                           FM_BITCOIN_RPC_URL="''${prefix}:''${secret}@''${suffix}"

     

       216
        
                         ''

     

       217
        
                       else

     

       218
        
                         ""

     
···

       229
        
                   environment = lib.mkMerge [

     

       230
        
                     {

     

       231
        
                       FM_BIND_P2P = "${cfg.p2p.bind}:${toString cfg.p2p.port}";

     

       232
       -
                       FM_BIND_API = "${cfg.api.bind}:${toString cfg.api.port}";

     

       233
       -
                       FM_P2P_URL = cfg.p2p.url;

     

       234
       -
                       FM_API_URL = cfg.api.url;

     

       235
        
                       FM_DATA_DIR = cfg.dataDir;

     

       236
        
                       FM_BITCOIN_NETWORK = cfg.bitcoin.network;

     

       237
        
                       FM_BITCOIN_RPC_URL = cfg.bitcoin.rpc.url;

     

       238
        
                       FM_BITCOIN_RPC_KIND = cfg.bitcoin.rpc.kind;

     

       239
        
                     }

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       240
        
                     cfg.environment

     

       241
        
                   ];

     

       242
        
                   serviceConfig = {

     
···

       244
        
       

     

       245
        
                     StateDirectory = "fedimintd-${fedimintdName}";

     

       246
        
                     StateDirectoryMode = "0700";

     

       247
       -
                     ExecStart = startScript;

     

       248
        
       

     

       249
        
                     Restart = "always";

     

       250
        
                     RestartSec = 10;

     
···

       268
        
                     RestrictAddressFamilies = [

     

       269
        
                       "AF_INET"

     

       270
        
                       "AF_INET6"

     

       0
        
       
     

       271
        
                     ];

     

       272
        
                     RestrictNamespaces = true;

     

       273
        
                     RestrictRealtime = true;

     

       0
        
       
     

       274
        
                     SystemCallArchitectures = "native";

     

       275
        
                     SystemCallFilter = [

     

       276
        
                       "@system-service"

     
···

       292
        
                     # overridden by default value from vhost-options.nix

     

       293
        
                     enableACME = mkOverride 99 true;

     

       294
        
                     forceSSL = mkOverride 99 true;

     

       295
       -
                     locations.${cfg.nginx.path} = {

     

       296
       -
                       proxyPass = "http://127.0.0.1:${toString cfg.api.port}/";

     

       297
        
                       proxyWebsockets = true;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       298
        
                       extraConfig = ''

     

       299
        
                         proxy_pass_header Authorization;

     

       300
        
                       '';

···

       49
        
                 openFirewall = mkOption {

     

       50
        
                   type = types.bool;

     

       51
        
                   default = true;

     

       52
       +
                   description = "Opens port in firewall for fedimintd's p2p port (both TCP and UDP)";

     

       53
        
                 };

     

       54
        
                 port = mkOption {

     

       55
        
                   type = types.port;

     

       56
        
                   default = 8173;

     

       57
       +
                   description = "Port to bind on for p2p connections from peers (both TCP and UDP)";

     

       58
        
                 };

     

       59
        
                 bind = mkOption {

     

       60
        
                   type = types.str;

     

       61
        
                   default = "0.0.0.0";

     

       62
       +
                   description = "Address to bind on for p2p connections from peers (both TCP and UDP)";

     

       63
        
                 };

     

       64
        
                 url = mkOption {

     

       65
       +
                   type = types.nullOr types.str;

     

       66
        
                   example = "fedimint://p2p.myfedimint.com:8173";

     

       67
        
                   description = ''

     

       68
       +
                     Public address for p2p connections from peers (if TCP is used)

     

       69
        
                   '';

     

       70
        
                 };

     

       71
        
               };

     

       72
       +
               api_ws = {

     

       73
        
                 openFirewall = mkOption {

     

       74
        
                   type = types.bool;

     

       75
        
                   default = false;

     

       76
       +
                   description = "Opens TCP port in firewall for fedimintd's Websocket API";

     

       77
        
                 };

     

       78
        
                 port = mkOption {

     

       79
        
                   type = types.port;

     

       80
        
                   default = 8174;

     

       81
       +
                   description = "TCP Port to bind on for API connections relayed by the reverse proxy/tls terminator.";

     

       82
        
                 };

     

       83
        
                 bind = mkOption {

     

       84
        
                   type = types.str;

     
···

       86
        
                   description = "Address to bind on for API connections relied by the reverse proxy/tls terminator.";

     

       87
        
                 };

     

       88
        
                 url = mkOption {

     

       89
       +
                   type = types.nullOr types.str;

     

       90
        
                   description = ''

     

       91
        
                     Public URL of the API address of the reverse proxy/tls terminator. Usually starting with `wss://`.

     

       92
        
                   '';

     

       93
        
                 };

     

       94
        
               };

     

       95
       +
               api_iroh = {

     

       96
       +
                 openFirewall = mkOption {

     

       97
       +
                   type = types.bool;

     

       98
       +
                   default = true;

     

       99
       +
                   description = "Opens UDP port in firewall for fedimintd's API Iroh endpoint";

     

       100
       +
                 };

     

       101
       +
                 port = mkOption {

     

       102
       +
                   type = types.port;

     

       103
       +
                   default = 8174;

     

       104
       +
                   description = "UDP Port to bind Iroh endpoint for API connections";

     

       105
       +
                 };

     

       106
       +
                 bind = mkOption {

     

       107
       +
                   type = types.str;

     

       108
       +
                   default = "0.0.0.0";

     

       109
       +
                   description = "Address to bind on for Iroh endpoint for API connections";

     

       110
       +
                 };

     

       111
       +
               };

     

       112
       +
               ui = {

     

       113
       +
                 openFirewall = mkOption {

     

       114
       +
                   type = types.bool;

     

       115
       +
                   default = false;

     

       116
       +
                   description = "Opens TCP port in firewall for built-in UI";

     

       117
       +
                 };

     

       118
       +
                 port = mkOption {

     

       119
       +
                   type = types.port;

     

       120
       +
                   default = 8175;

     

       121
       +
                   description = "TCP Port to bind on for UI connections";

     

       122
       +
                 };

     

       123
       +
                 bind = mkOption {

     

       124
       +
                   type = types.str;

     

       125
       +
                   default = "127.0.0.1";

     

       126
       +
                   description = "Address to bind on for UI connections";

     

       127
       +
                 };

     

       128
       +
               };

     

       129
        
               bitcoin = {

     

       130
        
                 network = mkOption {

     

       131
        
                   type = types.str;

     
···

       193
        
                   example = "api.myfedimint.com";

     

       194
        
                   description = "Public domain of the API address of the reverse proxy/tls terminator.";

     

       195
        
                 };

     

       196
       +
                 path_ui = mkOption {

     

       197
       +
                   type = types.str;

     

       198
       +
                   example = "/";

     

       199
       +
                   default = "/";

     

       200
       +
                   description = "Path to host the built-in UI on and forward to the daemon's api port";

     

       201
       +
                 };

     

       202
       +
                 path_ws = mkOption {

     

       203
        
                   type = types.str;

     

       204
        
                   example = "/";

     

       205
        
                   default = "/ws/";

     
···

       237
        
             networking.firewall.allowedTCPPorts = concatLists (

     

       238
        
               mapAttrsToList (

     

       239
        
                 fedimintdName: cfg:

     

       240
       +
                 (

     

       241
       +
                   lib.optional cfg.api_ws.openFirewall cfg.api_ws.port

     

       242
       +
                   ++ lib.optional cfg.p2p.openFirewall cfg.p2p.port

     

       243
       +
                   ++ lib.optional cfg.ui.openFirewall cfg.ui.port

     

       244
       +
                 )

     

       245
       +
               ) eachFedimintd

     

       246
       +
             );

     

       247
       +
       

     

       248
       +
             networking.firewall.allowedUDPPorts = concatLists (

     

       249
       +
               mapAttrsToList (

     

       250
       +
                 fedimintdName: cfg:

     

       251
       +
                 (

     

       252
       +
                   lib.optional cfg.api_iroh.openFirewall cfg.api_iroh.port

     

       253
       +
                   ++ lib.optional cfg.p2p.openFirewall cfg.p2p.port

     

       254
       +
                 )

     

       255
        
               ) eachFedimintd

     

       256
        
             );

     

       257
        
       

     
···

       259
        
               fedimintdName: cfg:

     

       260
        
               (nameValuePair "fedimintd-${fedimintdName}" (

     

       261
        
                 let

     

       262
       +
                   startScript = pkgs.writeShellScriptBin "fedimintd" (

     

       263
        
                     (

     

       264
        
                       if cfg.bitcoin.rpc.secretFile != null then

     

       265
        
                         ''

     

       266
       +
                           >&2 echo "Setting FM_FORCE_BITCOIN_RPC_URL using password from ${cfg.bitcoin.rpc.secretFile}"

     

       267
       +
                           secret=$(${pkgs.coreutils}/bin/head -n 1 "${cfg.bitcoin.rpc.secretFile}" || exit 1)

     

       268
       +
                           export FM_FORCE_BITCOIN_RPC_URL=$(echo "$FM_BITCOIN_RPC_URL" | sed "s|^\(\w\+://[^@]\+\)\(@.*\)|\1:''${secret}\2|")

     

       0
        
       
     

       269
        
                         ''

     

       270
        
                       else

     

       271
        
                         ""

     
···

       282
        
                   environment = lib.mkMerge [

     

       283
        
                     {

     

       284
        
                       FM_BIND_P2P = "${cfg.p2p.bind}:${toString cfg.p2p.port}";

     

       285
       +
                       FM_BIND_API_WS = "${cfg.api_ws.bind}:${toString cfg.api_ws.port}";

     

       286
       +
                       FM_BIND_API_IROH = "${cfg.api_iroh.bind}:${toString cfg.api_iroh.port}";

     

       287
       +
                       FM_BIND_UI = "${cfg.ui.bind}:${toString cfg.ui.port}";

     

       288
        
                       FM_DATA_DIR = cfg.dataDir;

     

       289
        
                       FM_BITCOIN_NETWORK = cfg.bitcoin.network;

     

       290
        
                       FM_BITCOIN_RPC_URL = cfg.bitcoin.rpc.url;

     

       291
        
                       FM_BITCOIN_RPC_KIND = cfg.bitcoin.rpc.kind;

     

       292
        
                     }

     

       293
       +
       

     

       294
       +
                     (lib.optionalAttrs (cfg.p2p.url != null) {

     

       295
       +
                       FM_P2P_URL = cfg.p2p.url;

     

       296
       +
                     })

     

       297
       +
       

     

       298
       +
                     (lib.optionalAttrs (cfg.api_ws.url != null) {

     

       299
       +
                       FM_API_URL = cfg.api_ws.url;

     

       300
       +
                     })

     

       301
       +
       

     

       302
        
                     cfg.environment

     

       303
        
                   ];

     

       304
        
                   serviceConfig = {

     
···

       306
        
       

     

       307
        
                     StateDirectory = "fedimintd-${fedimintdName}";

     

       308
        
                     StateDirectoryMode = "0700";

     

       309
       +
                     ExecStart = "${startScript}/bin/fedimintd";

     

       310
        
       

     

       311
        
                     Restart = "always";

     

       312
        
                     RestartSec = 10;

     
···

       330
        
                     RestrictAddressFamilies = [

     

       331
        
                       "AF_INET"

     

       332
        
                       "AF_INET6"

     

       333
       +
                       "AF_NETLINK"

     

       334
        
                     ];

     

       335
        
                     RestrictNamespaces = true;

     

       336
        
                     RestrictRealtime = true;

     

       337
       +
                     SocketBindAllow = "udp:${builtins.toString cfg.api_iroh.port}";

     

       338
        
                     SystemCallArchitectures = "native";

     

       339
        
                     SystemCallFilter = [

     

       340
        
                       "@system-service"

     
···

       356
        
                     # overridden by default value from vhost-options.nix

     

       357
        
                     enableACME = mkOverride 99 true;

     

       358
        
                     forceSSL = mkOverride 99 true;

     

       359
       +
                     locations.${cfg.nginx.path_ws} = {

     

       360
       +
                       proxyPass = "http://127.0.0.1:${builtins.toString cfg.api_ws.port}/";

     

       361
        
                       proxyWebsockets = true;

     

       362
       +
                       extraConfig = ''

     

       363
       +
                         proxy_pass_header Authorization;

     

       364
       +
                       '';

     

       365
       +
                     };

     

       366
       +
                     locations.${cfg.nginx.path_ui} = {

     

       367
       +
                       proxyPass = "http://127.0.0.1:${builtins.toString cfg.ui.port}/";

     

       368
        
                       extraConfig = ''

     

       369
        
                         proxy_pass_header Authorization;

     

       370
        
                       '';

+3 -5

nixos/tests/fedimintd.nix

···

       17
        
               p2p = {

     

       18
        
                 url = "fedimint://example.com";

     

       19
        
               };

     

       20
       -
               api = {

     

       21
        
                 url = "wss://example.com";

     

       22
        
               };

     

       23
       -
               environment = {

     

       24
       -
                 "FM_REL_NOTES_ACK" = "0_4_xyz";

     

       25
       -
               };

     

       26
        
             };

     

       27
        
           };

     

       28
        
       

     
···

       32
        
             start_all()

     

       33
        
       

     

       34
        
             machine.wait_for_unit("fedimintd-mainnet.service")

     

       35
       -
             machine.wait_for_open_port(${toString nodes.machine.services.fedimintd.mainnet.api.port})

     

       36
        
           '';

     

       37
        
       }

···

       17
        
               p2p = {

     

       18
        
                 url = "fedimint://example.com";

     

       19
        
               };

     

       20
       +
               api_ws = {

     

       21
        
                 url = "wss://example.com";

     

       22
        
               };

     

       23
       +
               environment = { };

     

       0
        
       
     

       0
        
       
     

       24
        
             };

     

       25
        
           };

     

       26
        
       

     
···

       30
        
             start_all()

     

       31
        
       

     

       32
        
             machine.wait_for_unit("fedimintd-mainnet.service")

     

       33
       +
             machine.wait_for_open_port(${toString nodes.machine.services.fedimintd.mainnet.api_ws.port})

     

       34
        
           '';

     

       35
        
       }

+7 -5

pkgs/by-name/fe/fedimint/package.nix

···

       6
        
         pkg-config,

     

       7
        
         protobuf,

     

       8
        
         rustPlatform,

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       9
        
       }:

     

       10
        
       

     

       11
        
       rustPlatform.buildRustPackage rec {

     

       12
        
         pname = "fedimint";

     

       13
       -
         version = "0.5.1";

     

       14
        
       

     

       15
        
         src = fetchFromGitHub {

     

       16
        
           owner = "fedimint";

     

       17
        
           repo = "fedimint";

     

       18
        
           rev = "v${version}";

     

       19
       -
           hash = "sha256-dhZYOfXepOnt1lQEgrM/y++5V58weiiTMAyMKl2t37Q=";

     

       20
        
         };

     

       21
        
       

     

       22
        
         useFetchCargoVendor = true;

     

       23
       -
         cargoHash = "sha256-WElH4AdLlF/BuxRrURUv6xNGUVBZ6hhSFg1p+T3jG54=";

     

       24
        
       

     

       25
        
         nativeBuildInputs = [

     

       26
        
           protobuf

     
···

       45
        
           mkdir -p $fedimint/bin $fedimintCli/bin $gateway/bin $gatewayCli/bin $devimint/bin

     

       46
        
       

     

       47
        
           # delete fuzzing targets and other binaries no one cares about

     

       48
       -
           binsToKeep=(fedimint-cli fedimint-dbtool recoverytool fedimintd gatewayd gateway-cli gateway-cln-extension devimint)

     

       49
        
           keepPattern=$(printf "|%s" "''${binsToKeep[@]}")

     

       50
        
           keepPattern=''${keepPattern:1}

     

       51
        
           find "$out/bin" -maxdepth 1 -type f | grep -Ev "(''${keepPattern})" | xargs rm -f

     
···

       59
        
           cp -a $releaseDir/gateway-cli $gatewayCli/bin/

     

       60
        
       

     

       61
        
           cp -a $releaseDir/gatewayd $gateway/bin/

     

       62
       -
           cp -a $releaseDir/gateway-cln-extension $gateway/bin/

     

       63
        
       

     

       64
        
           cp -a $releaseDir/devimint $devimint/bin/

     

       65
        
         '';

···

       6
        
         pkg-config,

     

       7
        
         protobuf,

     

       8
        
         rustPlatform,

     

       9
       +
         version ? "0.7.1",

     

       10
       +
         hash ? "sha256-7meBYUN7sG1OAtMEm6I66+ptf4EfsbA+dm5/4P3IRV4=",

     

       11
       +
         cargoHash ? "sha256-4cFuasH2hvrnzTBTFifHEMtXZKsBv7OVpuwPlV19GGw=",

     

       12
        
       }:

     

       13
        
       

     

       14
        
       rustPlatform.buildRustPackage rec {

     

       15
        
         pname = "fedimint";

     

       16
       +
         inherit version;

     

       17
        
       

     

       18
        
         src = fetchFromGitHub {

     

       19
        
           owner = "fedimint";

     

       20
        
           repo = "fedimint";

     

       21
        
           rev = "v${version}";

     

       22
       +
           inherit hash;

     

       23
        
         };

     

       24
        
       

     

       25
        
         useFetchCargoVendor = true;

     

       26
       +
         inherit cargoHash;

     

       27
        
       

     

       28
        
         nativeBuildInputs = [

     

       29
        
           protobuf

     
···

       48
        
           mkdir -p $fedimint/bin $fedimintCli/bin $gateway/bin $gatewayCli/bin $devimint/bin

     

       49
        
       

     

       50
        
           # delete fuzzing targets and other binaries no one cares about

     

       51
       +
           binsToKeep=(fedimint-cli fedimint-dbtool recoverytool fedimintd gatewayd gateway-cli devimint)

     

       52
        
           keepPattern=$(printf "|%s" "''${binsToKeep[@]}")

     

       53
        
           keepPattern=''${keepPattern:1}

     

       54
        
           find "$out/bin" -maxdepth 1 -type f | grep -Ev "(''${keepPattern})" | xargs rm -f

     
···

       62
        
           cp -a $releaseDir/gateway-cli $gatewayCli/bin/

     

       63
        
       

     

       64
        
           cp -a $releaseDir/gatewayd $gateway/bin/

     

       0
        
       
     

       65
        
       

     

       66
        
           cp -a $releaseDir/devimint $devimint/bin/

     

       67
        
         '';