jeirmeister/btc-pay-server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Giving up on LXC, switching to VM config

Browse source
This commit is contained in:
jeirmeister 2025-09-12 13:30:59 -07:00
parent 81939bd533
commit 4dafb111b9
1 changed files with 75 additions and 133 deletions
Download patch file Download diff file Expand all files Collapse all files

208
flake.nix
View file

@ -1,137 +1,79 @@
{ ({
description = "BTCPay server, NBXplorer, Bitcoin Core, etc. as a NixOS system/container image"; config,
pkgs,
lib,
...
}: {
nixpkgs.overlays = [nix-bitcoin.overlays.default];
inputs = { nix-bitcoin.generateSecrets = true;
nix-bitcoin.url = "github:fort-nix/nix-bitcoin/release";
nixpkgs.follows = "nix-bitcoin/nixpkgs";
nixos-generators.url = "github:nix-community/nixos-generators";
flake-utils.url = "github:numtide/flake-utils";
};
outputs = { # Enable core services
self, services.bitcoind = {
nixpkgs, enable = true;
nix-bitcoin, dataDir = "/var/lib/bitcoind";
nixos-generators, address = "0.0.0.0";
flake-utils, port = 23002;
... listen = true;
}: let listenWhitelisted = true;
system = "x86_64-linux"; whitelistedPort = 8335;
pkgs = import nixpkgs {inherit system;}; rpc = {
in { address = "0.0.0.0";
nixosConfigurations.btc-pay-server = nixpkgs.lib.nixosSystem { port = 8332;
inherit system; threads = 16;
modules = [ allowip = ["10.1.1.0/24"];
nix-bitcoin.nixosModules.default
({
config,
pkgs,
lib,
...
}: {
nixpkgs.overlays = [nix-bitcoin.overlays.default];
nix-bitcoin.generateSecrets = true;
services.bitcoind = {
enable = true;
dataDir = "/var/lib/bitcoind";
address = "0.0.0.0";
port = 23002;
listen = true;
listenWhitelisted = true;
whitelistedPort = 8335;
rpc = {
address = "0.0.0.0";
port = 8332;
threads = 16;
allowip = ["10.1.1.0/24"];
};
regtest = false;
dataDirReadableByGroup = false;
disablewallet = null;
dbCache = 4000;
prune = 10000;
zmqpubrawblock = "tcp://0.0.0.0:28332";
zmqpubrawtx = "tcp://0.0.0.0:28333";
user = "bitcoind";
group = "bitcoind";
};
services.nbxplorer = {
enable = true;
address = "0.0.0.0";
port = 24444;
user = "nbxplorer";
group = "nbxplorer";
};
services.btcpayserver = {
enable = true;
address = "0.0.0.0";
port = 23000;
lbtc = true;
user = "btcpayserver";
group = "btcpayserver";
lightningBackend = "clightning";
};
# Relax seccomp and namespaces for BTCPayServer to avoid SIGSYS in LXC
systemd.services.btcpayserver.serviceConfig = {
SystemCallFilter = [];
PrivateMounts = false;
ProtectSystem = lib.mkForce false; # Overrides nix-bitcoin's "strict" value
};
boot.isContainer = true;
networking.firewall.allowedTCPPorts = [
config.services.btcpayserver.port
config.services.bitcoind.port
config.services.nbxplorer.port
22
];
services.openssh = {
enable = true;
settings = {
PermitRootLogin = "prohibit-password";
PasswordAuthentication = false;
};
};
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPs/pdZLlCbv0vgtFA4hHGuWz1EeSn2kKhBJthlZ5lww devnix"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDw6ilma4321EdQvguZKA7ijn9xF9QlfMfkES4bGCLTp jeirmeister@devnix-t470"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAaV7JtUWkWrjo5FfCcpTCCEY/OJ+T1mJOLbe4avg0XH sysadmin@skrybit.io"
];
systemd.suppressedSystemUnits = [
"dev-mqueue.mount"
"sys-kernel-debug.mount"
"sys-fs-fuse-connections.mount"
];
system.stateVersion = "25.05";
})
];
}; };
regtest = false;
# Your devShell remains the same dataDirReadableByGroup = false;
devShells = flake-utils.lib.eachDefaultSystem ( disablewallet = null;
system: let dbCache = 4000;
pkgs = import nixpkgs {inherit system;}; prune = 10000;
in { zmqpubrawblock = "tcp://0.0.0.0:28332";
default = pkgs.mkShell { zmqpubrawtx = "tcp://0.0.0.0:28333";
buildInputs = [ user = "bitcoind";
nixos-generators.packages.${system}.nixos-generate group = "bitcoind";
pkgs.just
];
shellHook = ''
echo "💚 Devshell ready: nixos-generate, just available."
'';
};
}
);
}; };
}
services.nbxplorer = {
enable = true;
address = "0.0.0.0";
port = 24444;
user = "nbxplorer";
group = "nbxplorer";
};
services.btcpayserver = {
enable = true;
address = "0.0.0.0";
port = 23000;
lbtc = true;
user = "btcpayserver";
group = "btcpayserver";
lightningBackend = "clightning";
};
# Firewall: Open necessary ports
networking.firewall.allowedTCPPorts = [
config.services.btcpayserver.port
config.services.bitcoind.port
config.services.nbxplorer.port
22
];
# SSH setup
services.openssh = {
enable = true;
settings = {
PermitRootLogin = "prohibit-password";
PasswordAuthentication = false;
};
};
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPs/pdZLlCbv0vgtFA4hHGuWz1EeSn2kKhBJthlZ5lww devnix"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDw6ilma4321EdQvguZKA7ijn9xF9QlfMfkES4bGCLTp jeirmeister@devnix-t470"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAaV7JtUWkWrjo5FfCcpTCCEY/OJ+T1mJOLbe4avg0XH sysadmin@skrybit.io"
];
system.stateVersion = "25.05";
})