jeirmeister/btc-pay-server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

About to make change to fixing the postgres nbxplorer configuration, have to take a pause to this to get back to helm project.

Browse source
This commit is contained in:
jeirmeister 2025-07-22 00:50:22 -07:00
parent 11c5cd382e
commit f55936312f
6 changed files with 85 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

71
flake.nix
View file

@ -1,72 +1,99 @@
{
description = "BTCPay Server NixOS module";
description = "BTCPayServer NixOS flake with dotfile-based pg_hba.conf and sops-nix secrets";
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
nix-bitcoin.url = "github:fort-nix/nix-bitcoin/release";
sops-nix.url = "github:Mic92/sops-nix";
};
outputs = { self, nixpkgs, nix-bitcoin, ... }: {
# Export a module for others to use
outputs = { self, nixpkgs, nix-bitcoin, sops-nix, ... }: {
nixosModules.btcpay-server = { config, lib, pkgs, ... }: {
imports = [ nix-bitcoin.nixosModules.default ];
imports = [ nix-bitcoin.nixosModules.default sops-nix.nixosModules.sops ];
options.services.btcpay-full = {
enable = lib.mkEnableOption "BTCPay Server with Bitcoin node";
};
# Disable debugfs mount in LXC containers
config = lib.mkIf config.services.btcpay-full.enable {
nix-bitcoin.generateSecrets = true;
nix-bitcoin.operator = {
enable = true;
name = "btcpay";
};
# sops secret for Postgres password
sops.secrets.nbxplorer-pg-password = {
sopsFile = ./secrets.yaml;
owner = "postgres";
};
# Use tracked dotfile for Postgres auth rules
services.postgresql = {
enable = true;
package = pkgs.postgresql_14;
initialDatabases = [{ name = "nbxplorer"; }];
ensureUsers = [{
name = "nbxplorer";
passwordFile = config.sops.secrets.nbxplorer-pg-password.path;
ensureDBOwnership = true;
}];
authentication = builtins.readFile ./pg_hba.conf;
};
services.bitcoind = {
enable = true;
prune = 100000;
dbCache = 8000;
rpc.port = 8332;
};
# Enable BTCPay Server with network binding
services.btcpayserver = {
enable = true;
# Configure BTCPay Server to listen on all interfaces
address = "0.0.0.0";
port = 23000;
environment = {
NBXPLORER_CHAINS__BTC__POSTGRES = "User ID=nbxplorer;Host=localhost;Port=5432;Database=nbxplorer;Password=${
builtins.readFile config.sops.secrets.nbxplorer-pg-password.path
}";
};
};
networking.firewall.allowedTCPPorts = [
config.services.btcpayserver.port
config.services.bitcoind.port
5432
];
# (SSH added below)
};
};
# System configuration for deployment - REMOVED duplicate nix-bitcoin import
nixosConfigurations.btcpay = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
({ ... }: {
# Minimal system configuration for containers
({ config, ... }: {
boot.isContainer = true;
system.stateVersion = "25.05";
# Enable our BTCPay service
services.btcpay-full.enable = true;
# Basic SSH access
# SSH best practices: use a public key from secrets, fallback to password auth only if needed
sops.secrets.btcpay-ssh-pubkey = {
sopsFile = ./secrets.yaml;
owner = "root";
};
users.users.root.openssh.authorizedKeys.keys = [
(builtins.readFile config.sops.secrets.btcpay-ssh-pubkey.path)
];
services.openssh = {
enable = true;
settings = {
PermitRootLogin = "yes";
PasswordAuthentication = true;
PermitRootLogin = "prohibit-password"; # disables password logins
PasswordAuthentication = false;
};
};
})
# This module already imports nix-bitcoin.nixosModules.default
self.nixosModules.btcpay-server
];
};