From 4dafb111b9e54f86a06c1e1bd51d0a0cbf49d1e4 Mon Sep 17 00:00:00 2001
From: jeirmeister <jeir@jeirslab.xyz>
Date: Fri, 12 Sep 2025 13:30:59 -0700
Subject: [PATCH] Giving up on LXC, switching to VM config

---
 flake.nix | 208 ++++++++++++++++++++----------------------------------
 1 file changed, 75 insertions(+), 133 deletions(-)

diff --git a/flake.nix b/flake.nix
index ca039c4..5cd6f33 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,137 +1,79 @@
-{
-  description = "BTCPay server, NBXplorer, Bitcoin Core, etc. as a NixOS system/container image";
+({
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  nixpkgs.overlays = [nix-bitcoin.overlays.default];
 
-  inputs = {
-    nix-bitcoin.url = "github:fort-nix/nix-bitcoin/release";
-    nixpkgs.follows = "nix-bitcoin/nixpkgs";
-    nixos-generators.url = "github:nix-community/nixos-generators";
-    flake-utils.url = "github:numtide/flake-utils";
-  };
+  nix-bitcoin.generateSecrets = true;
 
-  outputs = {
-    self,
-    nixpkgs,
-    nix-bitcoin,
-    nixos-generators,
-    flake-utils,
-    ...
-  }: let
-    system = "x86_64-linux";
-    pkgs = import nixpkgs {inherit system;};
-  in {
-    nixosConfigurations.btc-pay-server = nixpkgs.lib.nixosSystem {
-      inherit system;
-      modules = [
-        nix-bitcoin.nixosModules.default
-        ({
-          config,
-          pkgs,
-          lib,
-          ...
-        }: {
-          nixpkgs.overlays = [nix-bitcoin.overlays.default];
-
-          nix-bitcoin.generateSecrets = true;
-
-          services.bitcoind = {
-            enable = true;
-            dataDir = "/var/lib/bitcoind";
-            address = "0.0.0.0";
-            port = 23002;
-            listen = true;
-            listenWhitelisted = true;
-            whitelistedPort = 8335;
-            rpc = {
-              address = "0.0.0.0";
-              port = 8332;
-              threads = 16;
-              allowip = ["10.1.1.0/24"];
-            };
-            regtest = false;
-            dataDirReadableByGroup = false;
-            disablewallet = null;
-            dbCache = 4000;
-            prune = 10000;
-            zmqpubrawblock = "tcp://0.0.0.0:28332";
-            zmqpubrawtx = "tcp://0.0.0.0:28333";
-            user = "bitcoind";
-            group = "bitcoind";
-          };
-
-          services.nbxplorer = {
-            enable = true;
-            address = "0.0.0.0";
-            port = 24444;
-            user = "nbxplorer";
-            group = "nbxplorer";
-          };
-
-          services.btcpayserver = {
-            enable = true;
-            address = "0.0.0.0";
-            port = 23000;
-            lbtc = true;
-            user = "btcpayserver";
-            group = "btcpayserver";
-            lightningBackend = "clightning";
-          };
-
-          # Relax seccomp and namespaces for BTCPayServer to avoid SIGSYS in LXC
-          systemd.services.btcpayserver.serviceConfig = {
-            SystemCallFilter = [];
-            PrivateMounts = false;
-            ProtectSystem = lib.mkForce false; # Overrides nix-bitcoin's "strict" value
-          };
-
-          boot.isContainer = true;
-
-          networking.firewall.allowedTCPPorts = [
-            config.services.btcpayserver.port
-            config.services.bitcoind.port
-            config.services.nbxplorer.port
-            22
-          ];
-
-          services.openssh = {
-            enable = true;
-            settings = {
-              PermitRootLogin = "prohibit-password";
-              PasswordAuthentication = false;
-            };
-          };
-
-          users.users.root.openssh.authorizedKeys.keys = [
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPs/pdZLlCbv0vgtFA4hHGuWz1EeSn2kKhBJthlZ5lww devnix"
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDw6ilma4321EdQvguZKA7ijn9xF9QlfMfkES4bGCLTp jeirmeister@devnix-t470"
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAaV7JtUWkWrjo5FfCcpTCCEY/OJ+T1mJOLbe4avg0XH sysadmin@skrybit.io"
-          ];
-
-          systemd.suppressedSystemUnits = [
-            "dev-mqueue.mount"
-            "sys-kernel-debug.mount"
-            "sys-fs-fuse-connections.mount"
-          ];
-
-          system.stateVersion = "25.05";
-        })
-      ];
+  # Enable core services
+  services.bitcoind = {
+    enable = true;
+    dataDir = "/var/lib/bitcoind";
+    address = "0.0.0.0";
+    port = 23002;
+    listen = true;
+    listenWhitelisted = true;
+    whitelistedPort = 8335;
+    rpc = {
+      address = "0.0.0.0";
+      port = 8332;
+      threads = 16;
+      allowip = ["10.1.1.0/24"];
     };
-
-    # Your devShell remains the same
-    devShells = flake-utils.lib.eachDefaultSystem (
-      system: let
-        pkgs = import nixpkgs {inherit system;};
-      in {
-        default = pkgs.mkShell {
-          buildInputs = [
-            nixos-generators.packages.${system}.nixos-generate
-            pkgs.just
-          ];
-          shellHook = ''
-            echo "💚 Devshell ready: nixos-generate, just available."
-          '';
-        };
-      }
-    );
+    regtest = false;
+    dataDirReadableByGroup = false;
+    disablewallet = null;
+    dbCache = 4000;
+    prune = 10000;
+    zmqpubrawblock = "tcp://0.0.0.0:28332";
+    zmqpubrawtx = "tcp://0.0.0.0:28333";
+    user = "bitcoind";
+    group = "bitcoind";
   };
-}
+
+  services.nbxplorer = {
+    enable = true;
+    address = "0.0.0.0";
+    port = 24444;
+    user = "nbxplorer";
+    group = "nbxplorer";
+  };
+
+  services.btcpayserver = {
+    enable = true;
+    address = "0.0.0.0";
+    port = 23000;
+    lbtc = true;
+    user = "btcpayserver";
+    group = "btcpayserver";
+    lightningBackend = "clightning";
+  };
+
+  # Firewall: Open necessary ports
+  networking.firewall.allowedTCPPorts = [
+    config.services.btcpayserver.port
+    config.services.bitcoind.port
+    config.services.nbxplorer.port
+    22
+  ];
+
+  # SSH setup
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "prohibit-password";
+      PasswordAuthentication = false;
+    };
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPs/pdZLlCbv0vgtFA4hHGuWz1EeSn2kKhBJthlZ5lww devnix"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDw6ilma4321EdQvguZKA7ijn9xF9QlfMfkES4bGCLTp jeirmeister@devnix-t470"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAaV7JtUWkWrjo5FfCcpTCCEY/OJ+T1mJOLbe4avg0XH sysadmin@skrybit.io"
+  ];
+
+  system.stateVersion = "25.05";
+})